Name no node in the last residuals: asus-zephyrus-g14's denylist, lab's and mosquitto's comments, mesh-issues's help texts, mesh-knowledge's decision fixture and ssh-client's forge-URL fixture (issue 1838)

novox/hq is the name of the software's own record, whatever follows it; asus-g14 is the laptop's name in
its vendor trigger file, declared in particulars as hardware asus-g14 (1838/AC2).

checks/locks/go.mod

@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/locks
-
-go 1.22

checks/locks/main.go

@@ -1,105 +0,0 @@
-// Command locks refuses a TypeScript module that names packages beyond the SDK in its package.json and commits no
-// package-lock.json (novox/hq ADR 0469 §5, issue 1868): the Node build module installs a module's own packages only
-// from its committed lock, so such a module is refused by the builder and could not be delivered.
-//
-//	go run . <catalogue root>
-//
-// Exits 1 on a finding. The packages that count are those the build module counts (mesh-build-node fetch.go
-// ownDependencies): the `dependencies` beyond the SDK, typescript and the @types packages.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-)
-
-// Finding is one module refused: it names Packages beyond the SDK and has no lock file.
-type Finding struct {
-	Module   string
-	Packages []string
-}
-
-// Check reads every module under root/modules that builds a TypeScript artifact.
-func Check(root string) ([]Finding, error) {
-	manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil {
-		return nil, err
-	}
-	sort.Strings(manifests)
-	var out []Finding
-	for _, path := range manifests {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			return nil, err
-		}
-		var m struct {
-			Module string `json:"module"`
-			Build  struct {
-				Artifacts []struct {
-					Language string `json:"language"`
-				} `json:"artifacts"`
-			} `json:"build"`
-		}
-		if err := json.Unmarshal(raw, &m); err != nil {
-			return nil, fmt.Errorf("%s: %w", path, err)
-		}
-		typescript := false
-		for _, a := range m.Build.Artifacts {
-			typescript = typescript || a.Language == "typescript"
-		}
-		if !typescript {
-			continue
-		}
-		dir := filepath.Dir(path)
-		pkgRaw, err := os.ReadFile(filepath.Join(dir, "package.json"))
-		if os.IsNotExist(err) {
-			continue
-		}
-		if err != nil {
-			return nil, err
-		}
-		var pkg struct {
-			Dependencies map[string]json.RawMessage `json:"dependencies"`
-		}
-		if err := json.Unmarshal(pkgRaw, &pkg); err != nil {
-			return nil, fmt.Errorf("%s: package.json: %w", m.Module, err)
-		}
-		var names []string
-		for n := range pkg.Dependencies {
-			if n != "@novox/mesh-sdk" && n != "typescript" && !strings.HasPrefix(n, "@types/") {
-				names = append(names, n)
-			}
-		}
-		if len(names) == 0 {
-			continue
-		}
-		if _, err := os.Stat(filepath.Join(dir, "package-lock.json")); err != nil {
-			sort.Strings(names)
-			out = append(out, Finding{Module: m.Module, Packages: names})
-		}
-	}
-	return out, nil
-}
-
-func main() {
-	root := "."
-	if len(os.Args) > 1 {
-		root = os.Args[1]
-	}
-	found, err := Check(root)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
-	}
-	for _, f := range found {
-		fmt.Printf("%s names packages beyond the SDK (%s) and has no package-lock.json: commit one made by the build module's toolchain (novox/hq ADR 0469 §5)\n", f.Module, strings.Join(f.Packages, ", "))
-	}
-	if len(found) > 0 {
-		os.Exit(1)
-	}
-	fmt.Println("locks: every TypeScript module that names packages beyond the SDK commits its lock")
-}

checks/locks/main_test.go

@@ -1,63 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-// module writes modules/<name> with a TypeScript artifact, the package.json given ("" for none) and, when lock, a lock.
-func module(t *testing.T, root, name, language, pkg string, lock bool) {
-	t.Helper()
-	dir := filepath.Join(root, "modules", name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	write := func(file, body string) {
-		if err := os.WriteFile(filepath.Join(dir, file), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	write("module.json", `{"module":"`+name+`","build":{"artifacts":[{"name":"tools","kind":"bundle","language":"`+language+`","from":"index.ts"}]}}`)
-	if pkg != "" {
-		write("package.json", pkg)
-	}
-	if lock {
-		write("package-lock.json", "{}")
-	}
-}
-
-const sdkOnly = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1"},"devDependencies":{"typescript":"^5","@types/node":"^22"}}`
-const withPg = `{"dependencies":{"@novox/mesh-sdk":"^0.1.1","pg":"^8","@types/pg":"^8"}}`
-
-func TestAModuleNamingOnlyTheSDKNeedsNoLock(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "plain", "typescript", sdkOnly, false)
-	module(t, root, "none", "typescript", "", false)
-	got, err := Check(root)
-	if err != nil || len(got) != 0 {
-		t.Fatalf("%v %v", got, err)
-	}
-}
-
-func TestAModuleNamingMorePackagesWithoutALockIsRefusedNamingThem(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "db", "typescript", withPg, false)
-	module(t, root, "db-locked", "typescript", withPg, true)
-	got, err := Check(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []Finding{{Module: "db", Packages: []string{"pg"}}}; !reflect.DeepEqual(got, want) {
-		t.Fatalf("got %v, want %v", got, want)
-	}
-}
-
-func TestAModuleThatIsNotTypeScriptIsNotJudged(t *testing.T) {
-	root := t.TempDir()
-	module(t, root, "go", "go", withPg, false)
-	if got, err := Check(root); err != nil || len(got) != 0 {
-		t.Fatalf("%v %v", got, err)
-	}
-}

checks/owned/main.go

@@ -11,23 +11,13 @@
 //     another module, after ${dir:<id>} is resolved within each module and both homes are read as one root.
 //     Archives are not containers for this rule. This holds for ~/.ssh what checks/sshdir held (ADR 0415 §6).
 //
-//  5. a directory that is, lies inside or holds a directory a system package owns under /var/lib, or any other
-//     resource inside one (issue 1841: pacman's state directory, placed with "place": ".", was /var/lib/pacman, the
-//     package manager's own database directory). A placed directory is resolved as the mesh resolves it with the
-//     default data root: "." is /var/lib/<module>, "mesh" /var/lib/mesh/<module>, neither /var/lib/<module>/<id>.
-//     The system directories are checks/owned/system, captured from a machine (pacman -Qo, /usr/lib/tmpfiles.d);
-//     checks/owned/system-known names the exceptions still to fix, by module, resource and issue. That list only
-//     shrinks: an entry that no longer collides is refused, and with -base one the trunk's copy does not hold.
-//
-//     go run . [-base <trunk's system-known>] <catalogue root>
+//     go run . <catalogue root>
 //
 // Exits 1 on a finding.
 package main
 
 import (
 	"encoding/json"
-	"errors"
-	"flag"
 	"fmt"
 	"os"
 	"path"
@@ -37,12 +27,6 @@ import (
 	"strings"
 )
 
-// The lists of rule 5, relative to the catalogue's root.
-const (
-	SystemList  = "checks/owned/system"
-	SystemKnown = "checks/owned/system-known"
-)
-
 // Home is the one root both machine homes are read as.
 const Home = "${home}"
 
@@ -59,9 +43,9 @@ type Finding struct {
 }
 
 type resource struct {
-	ID, Type, Path, Unknown, Place string
-	Knows                          []string
-	HasKnows                       bool
+	ID, Type, Path, Unknown string
+	Knows                   []string
+	HasKnows                bool
 }
 
 type parsed struct {
@@ -81,7 +65,6 @@ func load(file string) (*parsed, error) {
 			ID      string   `json:"id"`
 			Type    string   `json:"type"`
 			Path    string   `json:"path"`
-			Place   string   `json:"place"`
 			Unknown *string  `json:"unknown"`
 			Knows   []string `json:"knows"`
 		} `json:"resources"`
@@ -98,7 +81,7 @@ func load(file string) (*parsed, error) {
 		out.Module = filepath.Base(filepath.Dir(file))
 	}
 	for _, r := range m.Resources {
-		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Place: r.Place, Knows: r.Knows, HasKnows: r.Knows != nil}
+		x := resource{ID: r.ID, Type: r.Type, Path: r.Path, Knows: r.Knows, HasKnows: r.Knows != nil}
 		if r.Unknown != nil {
 			x.Unknown = *r.Unknown
 			if x.Unknown == "" {
@@ -160,23 +143,14 @@ type declared struct {
 }
 
 // Check reads every manifest under root/modules and answers what it refuses.
-func Check(root string, base []string) ([]Finding, error) {
+func Check(root string) ([]Finding, error) {
 	files, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
 	if err != nil {
 		return nil, err
 	}
 	sort.Strings(files)
-	system, err := readSystem(filepath.Join(root, SystemList))
-	if err != nil {
-		return nil, err
-	}
-	known, err := readLines(filepath.Join(root, SystemKnown))
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		return nil, err
-	}
 	var out []Finding
 	var paths []declared
-	collided := map[string]bool{}
 	type container struct{ module, path string }
 	var containers []container
 	for _, file := range files {
@@ -196,7 +170,6 @@ func Check(root string, base []string) ([]Finding, error) {
 				dirs[r.ID] = "/placed/" + m.Module + "/" + r.ID
 			}
 		}
-		out = append(out, inSystem(m, system, known, collided)...)
 		for _, r := range m.Resources {
 			p := norm(r.Path, dirs)
 			if p != "" {
@@ -239,28 +212,6 @@ func Check(root string, base []string) ([]Finding, error) {
 			}
 		}
 	}
-	for _, k := range known {
-		if !collided[k] {
-			module, id, _ := strings.Cut(k, " ")
-			id, _, _ = strings.Cut(id, " ")
-			out = append(out, Finding{5, module, id, fmt.Sprintf("is listed in %s, and no longer lies in a system "+
-				"package's directory: take the line out, so the list only shrinks", SystemKnown)})
-		}
-	}
-	if base != nil {
-		held := map[string]bool{}
-		for _, b := range base {
-			held[b] = true
-		}
-		for _, k := range known {
-			if !held[k] {
-				module, id, _ := strings.Cut(k, " ")
-				id, _, _ = strings.Cut(id, " ")
-				out = append(out, Finding{5, module, id, fmt.Sprintf("is a new line in %s, which the trunk's copy "+
-					"does not hold: a module's directory is placed outside a system package's, never listed", SystemKnown)})
-			}
-		}
-	}
 	for _, d := range paths {
 		for _, c := range containers {
 			if c.module != d.module && (d.path == c.path || strings.HasPrefix(d.path, c.path+"/")) {
@@ -271,140 +222,21 @@ func Check(root string, base []string) ([]Finding, error) {
 	return out, nil
 }
 
-// systemDir is one directory a system package owns, and what says so.
-type systemDir struct{ Path, Source string }
-
-// readLines is a list's lines, without comments and blank lines.
-func readLines(file string) ([]string, error) {
-	raw, err := os.ReadFile(file)
-	if err != nil {
-		return nil, err
-	}
-	var lines []string
-	for _, line := range strings.Split(string(raw), "\n") {
-		if line = strings.TrimSpace(line); line != "" && !strings.HasPrefix(line, "#") {
-			lines = append(lines, line)
-		}
-	}
-	return lines, nil
-}
-
-// readSystem is the list of system directories: "<absolute path> <package>: <how it was read>" per line. Absent or
-// empty, the check fails: a list that says nothing would let every module through.
-func readSystem(file string) ([]systemDir, error) {
-	lines, err := readLines(file)
-	if err != nil {
-		return nil, fmt.Errorf("rule 5 reads the system packages' directories from %s: %w", file, err)
-	}
-	if len(lines) == 0 {
-		return nil, fmt.Errorf("%s names no system package's directory, so rule 5 would pass everything", file)
-	}
-	var out []systemDir
-	for _, line := range lines {
-		p, source, _ := strings.Cut(line, " ")
-		if !strings.HasPrefix(p, "/var/lib/") || strings.TrimSpace(source) == "" {
-			return nil, fmt.Errorf("%s: %q is not \"/var/lib/<directory> <package>: <how it was read>\"", file, line)
-		}
-		out = append(out, systemDir{path.Clean(p), strings.TrimSpace(source)})
-	}
-	return out, nil
-}
-
-// placedAt is where the mesh places a pathless directory with the default data root (mesh-sdk catalogue dirsFor).
-func placedAt(module string, r resource) string {
-	switch r.Place {
-	case ".":
-		return "/var/lib/" + module
-	case "mesh":
-		return "/var/lib/mesh/" + module
-	}
-	return "/var/lib/" + module + "/" + r.ID
-}
-
-// inSystem is rule 5 for one module: each resource whose resolved path collides with a system package's directory,
-// unless system-known lists it (then it is marked collided, so a stale line is found).
-func inSystem(m *parsed, system []systemDir, known []string, collided map[string]bool) []Finding {
-	real := map[string]string{}
-	for _, r := range m.Resources {
-		if r.Type == "directory" && r.Path == "" && r.ID != "" {
-			real[r.ID] = placedAt(m.Module, r)
-		}
-	}
-	for _, r := range m.Resources {
-		if r.ID != "" && r.Path != "" {
-			real[r.ID] = r.Path
-		}
-	}
-	var out []Finding
-	for _, r := range m.Resources {
-		p := ""
-		if r.Path != "" {
-			p = norm(r.Path, real)
-		} else if r.Type == "directory" {
-			p = real[r.ID]
-		}
-		if !strings.HasPrefix(p, "/") {
-			continue
-		}
-		for _, s := range system {
-			inside := p == s.Path || strings.HasPrefix(p, s.Path+"/")
-			holds := r.Type == "directory" && strings.HasPrefix(s.Path, p+"/")
-			if !inside && !holds {
-				continue
-			}
-			listed := ""
-			for _, k := range known {
-				if strings.HasPrefix(k, m.Module+" "+r.ID+" ") || k == m.Module+" "+r.ID {
-					listed = k
-				}
-			}
-			if listed != "" {
-				collided[listed] = true
-				break
-			}
-			how := "is or lies inside"
-			if holds {
-				how = "holds"
-			}
-			out = append(out, Finding{5, m.Module, r.ID, fmt.Sprintf("resolves to %q, which %s %s, the directory of the "+
-				"system package %s; place it under /var/lib/mesh/%s (\"place\": \"mesh\") or a path of its own", p, how,
-				s.Path, s.Source, m.Module)})
-			break
-		}
-	}
-	return out
-}
-
 func main() {
-	baseFile := flag.String("base", "", "the trunk's copy of "+SystemKnown+": a line it does not hold is refused")
-	flag.Parse()
 	root := "."
-	if flag.NArg() > 0 {
-		root = flag.Arg(0)
+	if len(os.Args) > 1 {
+		root = os.Args[1]
 	}
-	var base []string
-	if *baseFile != "" {
-		lines, err := readLines(*baseFile)
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		base = append([]string{}, lines...)
-	}
-	found, err := Check(root, base)
+	found, err := Check(root)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
 	for _, f := range found {
-		cite := "novox/hq ADR 0422 §8, issue 1024"
-		if f.Rule == 5 {
-			cite = "issue 1841"
-		}
-		fmt.Printf("%s: %s: %s (rule %d, %s)\n", f.Module, f.ID, f.Why, f.Rule, cite)
+		fmt.Printf("%s: %s: %s (rule %d, novox/hq ADR 0422 §8, issue 1024)\n", f.Module, f.ID, f.Why, f.Rule)
 	}
 	if len(found) > 0 {
 		os.Exit(1)
 	}
-	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory, or in a system package's")
+	fmt.Println("owned paths: every directory and archive says how it treats unknown files; no module declares inside another's directory")
 }

checks/owned/main_test.go

@@ -20,10 +20,7 @@ func manifest(t *testing.T, root, module, body string) {
 
 func check(t *testing.T, root string) []Finding {
 	t.Helper()
-	if _, err := os.Stat(filepath.Join(root, SystemList)); os.IsNotExist(err) {
-		lists(t, root, "/var/lib/pacman pacman: pacman -Qo\n", "")
-	}
-	found, err := Check(root, nil)
+	found, err := Check(root)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -38,20 +35,6 @@ func only(t *testing.T, found []Finding, rule int, module, id string) {
 	}
 }
 
-// lists writes the catalogue's list of system directories and its known exceptions.
-func lists(t *testing.T, root, system, known string) {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemList), []byte(system), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemKnown), []byte(known), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func dir(id, path, rest string) string {
 	return `{"id":"` + id + `","type":"directory","path":"` + path + `"` + rest + `}`
 }
@@ -162,87 +145,3 @@ func TestPlacedDirectoriesOfTwoModulesAreTheirOwn(t *testing.T) {
 		t.Fatalf("refused %+v", found)
 	}
 }
-
-// 1841/AC18: a module's directory that resolves to a /var/lib directory a system package owns, lies inside one or
-// holds one, is refused, whether placed (place ".", or by default beneath the module's own) or stated; a placed
-// directory saying place "mesh" lies under /var/lib/mesh and passes (issue 1841: pacman's state was /var/lib/pacman).
-func TestADirectoryOfASystemPackageIsRefused(t *testing.T) {
-	system := "/var/lib/pacman pacman: pacman -Qo\n/var/lib/systemd/coredump systemd: tmpfiles.d/systemd.conf\n"
-	for name, resources := range map[string][]string{
-		"placed-own":     {`{"id":"state","type":"directory","place":".","unknown":"program"}`},
-		"placed-beneath": {`{"id":"coredump","type":"directory","unknown":"program"}`},
-		"stated-inside":  {dir("d", "/var/lib/pacman/keeper", `,"unknown":"program"`)},
-		"stated-holding": {dir("d", "/var/lib/systemd", `,"unknown":"program"`)},
-		"file-inside": {`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
-			`{"id":"f","type":"file","path":"/var/lib/pacman/keeper.json"}`},
-	} {
-		module := map[string]string{"placed-own": "pacman", "placed-beneath": "systemd"}[name]
-		if module == "" {
-			module = "keeper"
-		}
-		root := t.TempDir()
-		lists(t, root, system, "")
-		manifest(t, root, module, mod(module, resources...))
-		found := check(t, root)
-		if len(found) != 1 || found[0].Rule != 5 || found[0].Module != module ||
-			!strings.Contains(found[0].Why, "/var/lib/") || !strings.Contains(found[0].Why, "package") {
-			t.Errorf("%s: found %+v; want one finding of rule 5 for %s naming the path and the package", name, found, module)
-		}
-	}
-	root := t.TempDir()
-	lists(t, root, system, "")
-	manifest(t, root, "pacman", mod("pacman",
-		`{"id":"state","type":"directory","place":"mesh","unknown":"program"}`,
-		`{"id":"f","type":"file","path":"${dir:state}/keeper.json"}`,
-		dir("other", "/var/lib/pacman-other", `,"unknown":"program"`)))
-	if found := check(t, root); len(found) != 0 {
-		t.Fatalf("a directory under /var/lib/mesh/pacman was refused: %+v", found)
-	}
-}
-
-// 1841/AC18: a known exception passes; one that no longer collides is refused, so the list only shrinks; one the trunk's
-// copy does not hold is refused; and an absent list of system directories fails the check rather than passing it.
-func TestKnownSystemExceptionsOnlyShrink(t *testing.T) {
-	system := "/var/lib/systemd systemd: tmpfiles.d/systemd.conf\n"
-	known := "# comment\nsystemd state issue 1873\n"
-	root := t.TempDir()
-	lists(t, root, system, known)
-	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":".","unknown":"program"}`))
-	if found := check(t, root); len(found) != 0 {
-		t.Fatalf("a known exception was refused: %+v", found)
-	}
-	if found, err := Check(root, []string{"systemd state issue 1873"}); err != nil || len(found) != 0 {
-		t.Fatalf("a known exception held by the trunk was refused: %+v %v", found, err)
-	}
-	if found, err := Check(root, []string{}); err != nil || len(found) != 1 || found[0].Rule != 5 {
-		t.Fatalf("an exception the trunk does not hold passed: %+v %v", found, err)
-	}
-
-	manifest(t, root, "systemd", mod("systemd", `{"id":"state","type":"directory","place":"mesh","unknown":"program"}`))
-	only(t, check(t, root), 5, "systemd", "state")
-
-	root = t.TempDir()
-	manifest(t, root, "a", mod("a"))
-	if err := os.MkdirAll(filepath.Join(root, "checks", "owned"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(root, SystemList), []byte("# nothing\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := Check(root, nil); err == nil {
-		t.Fatal("an empty list of system directories passed")
-	}
-}
-
-// 1841/AC18: the catalogue as it stands passes rule 5 with its own lists.
-func TestTheCatalogueKeepsOutOfSystemDirectories(t *testing.T) {
-	found, err := Check("../..", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		if f.Rule == 5 {
-			t.Errorf("%s: %s: %s", f.Module, f.ID, f.Why)
-		}
-	}
-}

checks/owned/system

@@ -1,23 +0,0 @@
-# The directories under /var/lib that a system package owns (rule 5 of checks/owned, issue 1841). A module's
-# directory, placed or stated, may not be one of these, lie inside one or hold one: the package's program and the
-# package manager keep their own files there, and the node-engine would judge, chmod or chown the directory.
-#
-# One line per directory: "<path> <package>: <how it was read>". Captured on the workstation on 2026-10-22, through
-# the mesh: pacman's own database by `pacman -Qo` (pacman_owns), the rest from the `d`, `D` and `Q` lines of
-# /usr/lib/tmpfiles.d (node-reads.search for "/var/lib/"). A directory found to belong to a package is added here.
-/var/lib/pacman pacman: pacman -Qo /var/lib/pacman/ (pacman 7.1.0)
-/var/lib/alsa alsa-utils: tmpfiles.d/alsa-utils.conf
-/var/lib/colord colord: tmpfiles.d/colord.conf
-/var/lib/containers podman: tmpfiles.d/podman.conf
-/var/lib/dbus dbus: tmpfiles.d/dbus.conf
-/var/lib/geoclue geoclue: tmpfiles.d/geoclue.conf
-/var/lib/lastlog util-linux: tmpfiles.d/lastlog2.conf
-/var/lib/libuuid util-linux: tmpfiles.d/uuidd.conf
-/var/lib/machines systemd: tmpfiles.d/systemd-nspawn.conf
-/var/lib/openvpn/chroot networkmanager-openvpn: tmpfiles.d/nm-openvpn-tmpfiles.conf
-/var/lib/portables systemd: tmpfiles.d/portables.conf
-/var/lib/postgres postgresql: tmpfiles.d/postgresql.conf
-/var/lib/private systemd: tmpfiles.d/systemd.conf
-/var/lib/rpcbind rpcbind: tmpfiles.d/rpcbind.conf
-/var/lib/systemd systemd: tmpfiles.d/systemd.conf
-/var/lib/tpm2-tss/system/keystore tpm2-tss: tmpfiles.d/tpm2-tss-fapi.conf

checks/owned/system-known

@@ -1,5 +0,0 @@
-# Modules whose directory lies in a system package's directory today (rule 5 of checks/owned, issue 1841), each with
-# the issue that moves it out: "<module> <resource id> issue <number>". This list only shrinks: a line whose module
-# no longer collides is refused, and so is a line the trunk's copy does not hold.
-postgres state issue 1873
-systemd state issue 1873

checks/particulars/covered

@@ -1,3 +0,0 @@
-# The modules the check covers (novox/hq ADR 0507 §9, issue 1838), one a line; issue 1838 widens it.
-pacman
-kernel

checks/particulars/main.go

@@ -1,12 +1,23 @@
 // Command particulars keeps this mesh's node names out of the modules it covers (novox/hq ADR 0507 §9,
 // issue 1838): a module is for any mesh, so no manifest, file, code string, identifier, comment, test name or
-// fixture of a covered module names a node of this one.
+// fixture of any module names a node of this one.
 //
 // The names are in the file `particulars` at the catalogue's root, one a line, `#` comments — the one place
-// they may be written. The modules covered are in `covered` at checks/particulars/covered, one a line. A name is matched
-// whole and in any case; a hyphen, an underscore or a CamelCase boundary parts one, so a longer word holding a name is another word.
-// The forge is not a node name: its host (git.novox.be) and the organisation path (novox/<repo>) are blanked
-// before a line is read.
+// they may be written. Every directory under modules/ is read, with no list of covered modules, so a new module
+// is covered from its first commit. A name is matched whole and in any case; a hyphen, an underscore or a
+// CamelCase boundary parts one, so a longer word holding a name is another word.
+// Some text holds a node name and is not one, so it is blanked before a line is read, each form exact: the
+// software's module path (git.novox.be/novox/<repo>), the name of the software's record (novox/hq, followed by
+// anything), the hardware model (asus-zephyrus-g14, ROG Zephyrus G14), and the software's own
+// name and npm scope (Novox Mesh, novox-mesh, @novox/mesh-sdk with nothing before the @). Any other novox/<x>,
+// the forge's host alone and a node after a word's @ (database@novox/postgres) are findings.
+//
+// A module may declare its hardware model's word in `particulars`, as a line `model <module> <word>`: the word,
+// one of the names, is then no finding in that module's directory and still one in every other
+// (asus-zephyrus-g14's adopted paths such as /etc/modprobe.d/g14-nvidia-power.conf). A declaration naming no
+// module or no listed name makes the list unreadable.
+// A hardware's own name holding a name is declared as a line `hardware <word>` (asus-g14): that exact word, in
+// any case and not part of a longer hyphened word, is no finding in any module.
 //
 //	go run . <catalogue root>
 //
@@ -21,13 +32,22 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 )
 
-// forge is the forge's host and organisation path, blanked before a line is read; a path segment novox/ elsewhere
-// (testdata/novox/x, /srv/novox/data) is not blanked.
-var forge = regexp.MustCompile(`(?i)git\.novox\.be(?:/novox/[\w.-]+)?|(?:^|[^/\w.-])novox/[\w.-]+`)
+// forge is the software's module path on its forge and the name of its record (novox/hq, in any form: a citation,
+// a review, a URL path), blanked before a line is read; any other novox/<x> (a repository in a fixture,
+// testdata/novox/x) is not blanked, nor novox/hqx.
+var forge = regexp.MustCompile(`(?i:git\.novox\.be/novox/[\w.-]+)|novox/hq(?:$|[^\w-])`)
+
+// ownNames are the hardware model's and the software's own names, blanked before a line is read: the model
+// in any separator and case (asus-zephyrus-g14, ASUS_ZEPHYRUS_G14, ROG Zephyrus G14), the software as two
+// words or hyphened, whole (Novox Mesh, novox mesh, novox-mesh), so novox-mesh-vault stays a node name joined;
+// and the software's npm scope (@novox/mesh-sdk, @novox:registry=), its package path as the Go module path is,
+// where no word stands before the @, so a session's who@node (fix-1@novox) is still a node name.
+var ownNames = regexp.MustCompile(`(?i)(?:asus[-_ ])?zephyrus[-_ ]g14|(?:^|[^\w-])novox[- ]mesh(?:$|[^\w-])|(?:^|[^\w.-])@novox(?:$|[^\w-])`)
 
 func main() {
 	root := "."
@@ -39,22 +59,30 @@ func main() {
 
 // check runs the check over a catalogue and returns the exit code: 0 clean, 1 a finding, 2 a list unreadable.
 func check(root string) int {
-	names, err := readList(filepath.Join(root, "particulars"))
+	entries, err := readList(filepath.Join(root, "particulars"))
+	names, models, hardware := splitModels(entries)
 	if err == nil && len(names) == 0 {
 		err = fmt.Errorf("particulars lists no name — the check would pass on anything")
 	}
-	var covered []string
+	var modules []string
 	if err == nil {
-		covered, err = readList(filepath.Join(root, "checks/particulars/covered"))
-		if err == nil && len(covered) == 0 {
-			err = fmt.Errorf("covered lists no module — the check would pass on anything")
+		modules, err = moduleDirs(root)
+		if err == nil && len(modules) == 0 {
+			err = fmt.Errorf("modules/ holds no module — the check would pass on anything")
 		}
 	}
+	if err == nil {
+		err = checkModels(models, names, modules)
+	}
+	var blanks *regexp.Regexp
+	if err == nil {
+		blanks, err = hardwareWords(hardware)
+	}
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "particulars:", err)
 		return 2
 	}
-	findings, err := run(root, names, covered)
+	findings, err := run(root, names, modules, models, blanks)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "particulars:", err)
 		return 2
@@ -66,7 +94,7 @@ func check(root string) int {
 		fmt.Printf("particulars: %d node name(s) in a module for any mesh (novox/hq ADR 0507 §9) — say what it shows, not where it was seen\n", len(findings))
 		return 1
 	}
-	fmt.Printf("particulars: none of %d node names in the %d covered modules\n", len(names), len(covered))
+	fmt.Printf("particulars: none of %d node names in the %d modules\n", len(names), len(modules))
 	return 0
 }
 
@@ -89,10 +117,104 @@ func readList(path string) ([]string, error) {
 	return out, sc.Err()
 }
 
-// run reads every text file of each covered module and returns the findings, sorted.
-func run(root string, names, covered []string) ([]string, error) {
+// splitModels parts the list's entries into the names, the models' words by module (`model <module> <word>`)
+// and the hardware's words (`hardware <word>`, kept whole to be checked).
+func splitModels(entries []string) (names []string, models map[string][]string, hardware []string) {
+	models = map[string][]string{}
+	for _, e := range entries {
+		f := strings.Fields(e)
+		if len(f) > 0 && f[0] == "hardware" {
+			hardware = append(hardware, e)
+			continue
+		}
+		if len(f) > 0 && f[0] == "model" {
+			if len(f) != 3 {
+				models[""] = append(models[""], e)
+				continue
+			}
+			models[f[1]] = append(models[f[1]], f[2])
+			continue
+		}
+		names = append(names, e)
+	}
+	return names, models, hardware
+}
+
+// hardwareWords is the matcher of the declared hardware words, nil when none is declared; a line that is not
+// `hardware <word>` makes the list unreadable.
+func hardwareWords(lines []string) (*regexp.Regexp, error) {
+	var words []string
+	for _, l := range lines {
+		f := strings.Fields(l)
+		if len(f) != 2 {
+			return nil, fmt.Errorf("particulars: %q is not `hardware <word>`", l)
+		}
+		words = append(words, regexp.QuoteMeta(f[1]))
+	}
+	if len(words) == 0 {
+		return nil, nil
+	}
+	return regexp.MustCompile(`(?i)(?:^|[^A-Za-z0-9-])(?:` + strings.Join(words, "|") + `)(?:$|[^A-Za-z0-9-])`), nil
+}
+
+// blankWith blanks what rx matches in s, keeping every other byte where it was.
+func blankWith(rx *regexp.Regexp, s string) string {
+	if rx == nil {
+		return s
+	}
+	return rx.ReplaceAllStringFunc(s, func(m string) string { return strings.Repeat(" ", len(m)) })
+}
+
+// checkModels refuses a model declaration that is malformed, names no module or names a word that is no name.
+func checkModels(models map[string][]string, names, modules []string) error {
+	for m, words := range models {
+		if m == "" {
+			return fmt.Errorf("particulars: %q is not `model <module> <word>`", words[0])
+		}
+		if !slices.Contains(modules, m) {
+			return fmt.Errorf("particulars: model %s %s names no module under modules/", m, words[0])
+		}
+		for _, w := range words {
+			if !slices.ContainsFunc(names, func(n string) bool { return strings.EqualFold(n, w) }) {
+				return fmt.Errorf("particulars: model %s %s: %q is not a listed name", m, w, w)
+			}
+		}
+	}
+	return nil
+}
+
+// without returns the names but the words, in any case.
+func without(names, words []string) []string {
 	var out []string
-	for _, m := range covered {
+	for _, n := range names {
+		if !slices.ContainsFunc(words, func(w string) bool { return strings.EqualFold(n, w) }) {
+			out = append(out, n)
+		}
+	}
+	return out
+}
+
+// moduleDirs returns every directory under the catalogue's modules/, sorted.
+func moduleDirs(root string) ([]string, error) {
+	entries, err := os.ReadDir(filepath.Join(root, "modules"))
+	if err != nil {
+		return nil, err
+	}
+	var out []string
+	for _, e := range entries {
+		if e.IsDir() {
+			out = append(out, e.Name())
+		}
+	}
+	return out, nil
+}
+
+// run reads every text file of each module named and returns the findings, sorted; a module's model words are
+// not read as names in it.
+func run(root string, all, modules []string, models map[string][]string, hardware *regexp.Regexp) ([]string, error) {
+	var out []string
+	for _, m := range modules {
+		names := without(all, models[m])
 		dir := filepath.Join(root, "modules", m)
 		err := filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
 			if err != nil {
@@ -107,7 +229,7 @@ func run(root string, names, covered []string) ([]string, error) {
 			}
 			rel, _ := filepath.Rel(root, path)
 			// A path is read too: a testdata directory named after a node is a finding.
-			for _, n := range hits(filepath.ToSlash(rel), names) {
+			for _, n := range hits(blankWith(hardware, filepath.ToSlash(rel)), names) {
 				out = append(out, fmt.Sprintf("%s:0: node name %q in the path", filepath.ToSlash(rel), n))
 			}
 			if d.Name() == "go.sum" {
@@ -120,7 +242,7 @@ func run(root string, names, covered []string) ([]string, error) {
 			if bytes.IndexByte(b, 0) >= 0 {
 				return nil
 			}
-			out = append(out, scan(filepath.ToSlash(rel), string(b), names)...)
+			out = append(out, scan(filepath.ToSlash(rel), blankWith(hardware, string(b)), names)...)
 			return nil
 		})
 		if err != nil {
@@ -143,17 +265,32 @@ func scan(file, src string, names []string) []string {
 }
 
 // hits returns the node names one line holds: as a word (a hyphen or underscore parts it), as a part of a
-// CamelCase identifier (TestAce, novoxTree), the forge's host and organisation path blanked first.
+// CamelCase identifier (TestAce, novoxTree), the forge's host and organisation path and the hardware's and the
+// software's own names blanked first.
 func hits(line string, names []string) []string {
-	line = forge.ReplaceAllStringFunc(line, func(s string) string { return strings.Repeat(" ", len(s)) })
+	blank := func(s string) string { return strings.Repeat(" ", len(s)) }
+	line = forge.ReplaceAllStringFunc(line, blank)
+	line = ownNames.ReplaceAllStringFunc(line, blank)
 	var out []string
 	for _, n := range names {
-		q := regexp.QuoteMeta(n)
-		camel := regexp.QuoteMeta(strings.ToUpper(n[:1]) + n[1:])
-		rx := regexp.MustCompile(`(?i:(?:^|[^A-Za-z0-9])` + q + `(?:$|[^A-Za-z0-9]))|[a-z0-9]` + camel + `(?:$|[^a-z])|(?:^|[^A-Za-z0-9])` + q + `[A-Z0-9]`)
-		if rx.MatchString(line) {
+		if matcher(n).MatchString(line) {
 			out = append(out, strings.ToLower(n))
 		}
 	}
 	return out
 }
+
+// matchers holds each name's matcher, compiled once: the check reads every line of every module.
+var matchers = map[string]*regexp.Regexp{}
+
+// matcher is the matcher of one name: as a word, or as a part of a CamelCase identifier.
+func matcher(n string) *regexp.Regexp {
+	if rx, ok := matchers[n]; ok {
+		return rx
+	}
+	q := regexp.QuoteMeta(n)
+	camel := regexp.QuoteMeta(strings.ToUpper(n[:1]) + n[1:])
+	rx := regexp.MustCompile(`(?i:(?:^|[^A-Za-z0-9])` + q + `(?:$|[^A-Za-z0-9]))|[a-z0-9]` + camel + `(?:$|[^a-z])|(?:^|[^A-Za-z0-9])` + q + `[A-Z0-9]`)
+	matchers[n] = rx
+	return rx
+}

checks/particulars/main_test.go

@@ -35,7 +35,6 @@ func TestTheForgeIsNotANodeName(t *testing.T) {
 		"see novox/hq issue 5",
 		"module git.novox.be/novox/mesh-sdk/go v1.2.3",
 		"https://git.novox.be/novox/mesh-catalog",
-		"git.novox.be",
 		"space trace surface grace g14x",
 	} {
 		if got := scan("f", s, names); len(got) != 0 {
@@ -68,7 +67,7 @@ func TestANodeNamedPathIsRefusedThroughRun(t *testing.T) {
 	p := filepath.Join(root, "modules/kernel/testdata/ace/x")
 	os.MkdirAll(filepath.Dir(p), 0o755)
 	os.WriteFile(p, []byte("clean\n"), 0o644)
-	got, err := run(root, names, []string{"kernel"})
+	got, err := run(root, names, []string{"kernel"}, nil, nil)
 	if err != nil || len(got) != 1 || !strings.HasPrefix(got[0], "modules/kernel/testdata/ace/x:0: ") {
 		t.Errorf("got %v, %v", got, err)
 	}
@@ -82,7 +81,6 @@ func TestCheckReturnsOneOnAFindingAndTwoOnAnUnreadableList(t *testing.T) {
 		os.WriteFile(p, []byte(s), 0o644)
 	}
 	write("particulars", "ace\n")
-	write("checks/particulars/covered", "kernel\n")
 	write("modules/kernel/a", "clean\n")
 	if got := check(root); got != 0 {
 		t.Errorf("clean = %d, want 0", got)
@@ -97,7 +95,7 @@ func TestCheckReturnsOneOnAFindingAndTwoOnAnUnreadableList(t *testing.T) {
 	}
 }
 
-func TestOnlyCoveredModulesAreRead(t *testing.T) {
+func TestRunReadsOnlyTheModulesItIsGiven(t *testing.T) {
 	root := t.TempDir()
 	write := func(p, s string) {
 		p = filepath.Join(root, p)
@@ -106,7 +104,7 @@ func TestOnlyCoveredModulesAreRead(t *testing.T) {
 	}
 	write("modules/kernel/files/a", "on novox\n")
 	write("modules/other/files/a", "on novox\n")
-	got, err := run(root, names, []string{"kernel"})
+	got, err := run(root, names, []string{"kernel"}, nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -114,3 +112,201 @@ func TestOnlyCoveredModulesAreRead(t *testing.T) {
 		t.Errorf("got %v", got)
 	}
 }
+
+// 1838/AC1: the check reads every directory under modules/ and no list of covered modules, so a module is
+// covered from its first commit.
+func TestEveryModuleIsReadWithoutAList(t *testing.T) {
+	root := t.TempDir()
+	write := func(p, s string) {
+		p = filepath.Join(root, p)
+		os.MkdirAll(filepath.Dir(p), 0o755)
+		os.WriteFile(p, []byte(s), 0o644)
+	}
+	write("particulars", "novox\n")
+	write("modules/kernel/files/a", "clean\n")
+	if got := check(root); got != 0 {
+		t.Errorf("clean, no covered list = %d, want 0", got)
+	}
+	write("modules/new-module/files/a", "on novox\n")
+	if got := check(root); got != 1 {
+		t.Errorf("a finding in a module no list names = %d, want 1", got)
+	}
+}
+
+// 1838/AC2: the hardware model's own name and the software's own name are not node names.
+func TestTheHardwareModelAndTheSoftwareAreNotNodeNames(t *testing.T) {
+	for _, s := range []string{
+		"modules/asus-zephyrus-g14/README.md",
+		"the asus-zephyrus-g14 module",
+		"ASUS_ZEPHYRUS_G14=1",
+		"product_family: ROG Zephyrus G14",
+		"# This machine is a node of a Novox mesh",
+		"Novox Mesh turns a handful of personal machines into one system",
+		"<!-- novox mesh: this file was changed on two nodes",
+		`const sealInfo = "novox-mesh sealed box v1"`,
+		"module git.novox.be/novox/mesh-catalog/modules/kernel",
+	} {
+		if got := scan("f", s, names); len(got) != 0 {
+			t.Errorf("%q refused: %v", s, got)
+		}
+	}
+}
+
+// 1838/AC2: a node name standing alone is still one, beside the hardware's or the software's name too.
+func TestANodeNameBesideTheHardwareOrTheSoftwareIsRefused(t *testing.T) {
+	cases := map[string]string{
+		"g14":            "the asus-zephyrus-g14 module on g14",
+		"shanks":         "Novox Mesh on shanks",
+		"novox":          "resolves under novox.internal",
+		"ace":            "ROG Zephyrus G14 beside ace",
+		"novox mesh-ish": "mesh.mod.gitea.call.x.novox-mesh-vault",
+	}
+	for want, s := range cases {
+		got := scan("modules/m/a.go", s, names)
+		if len(got) != 1 || !strings.HasPrefix(got[0], "modules/m/a.go:1: ") {
+			t.Errorf("%s: %q gave %v, want one finding naming file:line", want, s, got)
+		}
+	}
+}
+
+// 1838/AC2: the software's npm scope (@novox/mesh-sdk, @novox:registry=) is its package path, as the Go module
+// path is; a session's who@node naming a node is still a node name.
+func TestTheSoftwaresNpmScopeIsNotANodeName(t *testing.T) {
+	for _, s := range []string{
+		"printf '%s\\n' ${shellQuote(`@novox:registry=${registry}`)}",
+		"const url = `${asked}@novox%2fmesh-sdk`;",
+		"# The @novox scope resolves from the mesh's own package registry",
+		`"dependencies": { "@novox/mesh-sdk": "^0.1.0" }`,
+	} {
+		if got := scan("f", s, names); len(got) != 0 {
+			t.Errorf("%q refused: %v", s, got)
+		}
+	}
+	for _, s := range []string{"by fix-1@novox", "jochen@novox:"} {
+		if got := scan("f", s, names); len(got) != 1 {
+			t.Errorf("%q gave %v, want one finding", s, got)
+		}
+	}
+}
+
+// 1838/AC1: reading every module, the check compiles its matchers once, not once a line: a line read costs a
+// few allocations, not a regexp compiled per name (the whole catalogue took 41 s with one per line).
+func TestALineIsReadWithoutCompilingAMatcher(t *testing.T) {
+	line := "a line of code that names nothing at all, with git.novox.be/novox/mesh-sdk in it"
+	if n := testing.AllocsPerRun(100, func() { hits(line, names) }); n > 20 {
+		t.Errorf("a line costs %.0f allocations, want at most 20", n)
+	}
+}
+
+// 1838/AC2: a module may declare its hardware model's word in `particulars` (model <module> <word>); the word is
+// then no finding in that module, and still one in every other.
+func TestAModelsWordIsAllowedInItsModuleOnly(t *testing.T) {
+	root := t.TempDir()
+	write := func(p, s string) {
+		p = filepath.Join(root, p)
+		os.MkdirAll(filepath.Dir(p), 0o755)
+		os.WriteFile(p, []byte(s), 0o644)
+	}
+	write("particulars", "ace\ng14\nmodel asus-zephyrus-g14 g14\n")
+	write("modules/asus-zephyrus-g14/README.md", "the adopted /etc/modprobe.d/g14-nvidia-power.conf; a second G14\n")
+	write("modules/kernel/a", "clean\n")
+	if got := check(root); got != 0 {
+		t.Errorf("the model's word in its own module = %d, want 0", got)
+	}
+	write("modules/asus-zephyrus-g14/a", "on ace\n")
+	if got := check(root); got != 1 {
+		t.Errorf("another node name in the model's module = %d, want 1", got)
+	}
+	write("modules/asus-zephyrus-g14/a", "clean\n")
+	write("modules/kernel/a", "i3's 20-g14.conf\n")
+	if got := check(root); got != 1 {
+		t.Errorf("the model's word in another module = %d, want 1", got)
+	}
+	write("modules/kernel/a", "clean\n")
+	write("particulars", "ace\ng14\nmodel no-such-module g14\n")
+	if got := check(root); got != 2 {
+		t.Errorf("a model of a module that does not exist = %d, want 2", got)
+	}
+	write("particulars", "ace\ng14\nmodel asus-zephyrus-g14 shanks\n")
+	if got := check(root); got != 2 {
+		t.Errorf("a model's word that is no listed name = %d, want 2", got)
+	}
+}
+
+// 1838/AC2: only the module path git.novox.be/novox/<repo>, a package name or scope with nothing before its @, and
+// the exact record citation novox/hq ADR|issue|design|to-be|research are the forge's or the software's; any
+// other novox/<x>, the forge's host alone, and a node after a word's @ are findings.
+func TestOnlyTheModulePathThePackageAndTheCitationAreNotNodeNames(t *testing.T) {
+	for _, s := range []string{
+		"module git.novox.be/novox/mesh-sdk/go v1.2.3",
+		"https://git.novox.be/novox/mesh-catalog",
+		`import { registerModuleTools } from "@novox/mesh-sdk/tools";`,
+		`"dependencies": { "@novox/ui": "^2.0.0" }`,
+		"// novox/hq ADR 0507 §9",
+		"(novox/hq issue 1838)",
+		"novox/hq design 47 and novox/hq to-be 53, novox/hq research 12",
+	} {
+		if got := scan("f", s, names); len(got) != 0 {
+			t.Errorf("%q refused: %v", s, got)
+		}
+	}
+	for _, s := range []string{
+		`handedWith("node-b", "gitea", "postgres-database@novox/postgres+pair")`,
+		"delivery.novox/mesh-controller",
+		"see novox/mesh-catalog #441",
+		"git.novox.be",
+	} {
+		if got := scan("f", s, names); len(got) != 1 {
+			t.Errorf("%q gave %v, want one finding", s, got)
+		}
+	}
+}
+
+// 1838/AC2: novox/hq is the name of the software's own record, no finding in any form; another novox/<repo> is.
+func TestTheRecordsNameIsNoFindingInAnyForm(t *testing.T) {
+	for _, s := range []string{
+		"novox/hq review round 2",
+		"novox/hq issues 1665 and 1666",
+		"repository: novox/hq",
+		"[the record](https://forge.example.org/novox/hq/src/branch/main/00-META/glossary.md)",
+		"novox/hq#7 at aaa",
+		"git.anchor.internal:222/novox/hq.git",
+	} {
+		if got := scan("f", s, names); len(got) != 0 {
+			t.Errorf("%q refused: %v", s, got)
+		}
+	}
+	for _, s := range []string{`repo := "novox/mesh-catalog"`, "novox/hqx", "novox/hq-mirror"} {
+		if got := scan("f", s, names); len(got) != 1 {
+			t.Errorf("%q gave %v, want one finding", s, got)
+		}
+	}
+}
+
+// 1838/AC2: a hardware word declared in particulars (hardware <word>) is no finding anywhere; a name standing
+// alone still is.
+func TestAHardwareWordIsNoFindingAnywhere(t *testing.T) {
+	root := t.TempDir()
+	write := func(p, s string) {
+		p = filepath.Join(root, p)
+		os.MkdirAll(filepath.Dir(p), 0o755)
+		os.WriteFile(p, []byte(s), 0o644)
+	}
+	write("particulars", "g14\nhardware asus-g14\n")
+	write("modules/triggerhappy/a", "/etc/triggerhappy/triggers.d/asus-g14.conf and ASUS-G14\n")
+	if got := check(root); got != 0 {
+		t.Errorf("the hardware word = %d, want 0", got)
+	}
+	write("modules/triggerhappy/a", "asus-g14.conf on g14\n")
+	if got := check(root); got != 1 {
+		t.Errorf("g14 standing alone beside it = %d, want 1", got)
+	}
+	write("modules/triggerhappy/a", "my-asus-g14-x\n")
+	if got := check(root); got != 1 {
+		t.Errorf("a longer word holding it = %d, want 1", got)
+	}
+	write("particulars", "g14\nhardware\n")
+	if got := check(root); got != 2 {
+		t.Errorf("a hardware line with no word = %d, want 2", got)
+	}
+}

merge-check.sh

@@ -48,16 +48,15 @@
 #   10. the mail-store seat (novox/hq ADR 0378 §3, issue 800): no manifest but modules/mesh-mail claims it.
 #   11. owned paths (novox/hq ADR 0422 §8, issue 1024; it holds ~/.ssh for ssh-client as ADR 0415 §6 asked):
 #      every directory and archive says `unknown` (move-out, module or program) and a valid `knows`; `move-out`
-#      only under a home; no module declares a path inside a directory of another module; and none is, lies in or
-#      holds a directory a system package owns under /var/lib (checks/owned/system, issue 1841).
+#      only under a home; and no module declares a path inside a directory of another module.
 #      checks/sshdir (ADR 0415 §6) stays while main runs it; it goes under issue 1035 once main runs checks/owned.
 #   12. the image builder (novox/hq ADR 0487 §3, issue 1704): only modules/buildah provides rootless-image-build.
 #   13. the image's place (novox/hq ADR 0487 §1, issue 1707): every image builds from a Dockerfile in its own module's directory.
 set -eu
 
 (cd checks/words && go test -count=1 . && go run . ../..)
-# Node names (novox/hq ADR 0507 §9, issue 1838): no node name of this mesh in a covered module; the names are in
-# `particulars`, the covered modules in checks/particulars/covered.
+# Node names (novox/hq ADR 0507 §9, issue 1838): no node name of this mesh in any module (every directory under
+# modules/ is covered, with no list); the names, and a module's hardware model word, are in `particulars`.
 (cd checks/particulars && go test -count=1 . && go run . ../..)
 # The toolchains (novox/hq ADR 0477 clause 4): the package go only in modules/go, nodejs and npm only in modules/nodejs.
 (cd checks/toolchains && go test -count=1 . && go run . ../..)
@@ -65,8 +64,6 @@ set -eu
 (cd checks/imagebuild && go test -count=1 . && go run . ../..)
 # The image's place (novox/hq ADR 0487 §1): every image builds from a Dockerfile in its own module's directory.
 (cd checks/imageplace && go test -count=1 . && go run . ../..)
-# The Node lock files (novox/hq ADR 0469 §5, issue 1868): a TypeScript module that names packages beyond the SDK commits its lock.
-(cd checks/locks && go test -count=1 . && go run . ../..)
 # The agent's home (novox/hq ADR 0266): no archive, and no file written into, under it.
 (cd checks/agenthome && go test -count=1 . && go run . ../..)
 # The mail-store seat (novox/hq ADR 0378 §3): only mesh-mail may claim it.
@@ -74,19 +71,8 @@ set -eu
 # ~/.ssh (novox/hq ADR 0415 §6): only ssh-client may name a path under it. Main's merge check runs this line, so
 # checks/sshdir stays until main runs checks/owned; it goes under issue 1035.
 (cd checks/sshdir && go test -count=1 . && go run . ../..)
-# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory;
-# none in a system package's directory under /var/lib (issue 1841), the known exceptions only shrinking: judged
-# against the trunk's copy of checks/owned/system-known at the merge base; a trunk without one is the list's first copy.
-owned_base=""
-if merge_base=$(git merge-base HEAD "origin/${MESH_CHECK_BASE:-main}" 2>/dev/null); then
-	if git cat-file -e "$merge_base:checks/owned/system-known" 2>/dev/null; then
-		owned_base=$(mktemp)
-		git show "$merge_base:checks/owned/system-known" >"$owned_base"
-	fi
-else
-	echo "NOT COMPARED WITH THE TRUNK: no merge base with origin/${MESH_CHECK_BASE:-main}; checks/owned/system-known is held to the list it was first written with"
-fi
-(cd checks/owned && go test -count=1 . && if [ -n "$owned_base" ]; then go run . -base "$owned_base" ../..; else go run . ../..; fi)
+# Owned paths (novox/hq ADR 0422 §8): unknown files named per directory; no path inside another module's directory.
+(cd checks/owned && go test -count=1 . && go run . ../..)
 # The secrets (novox/hq issue 342): a password is not a setting, so no setting can replace the vault's. The
 # known list only shrinks: judged against the trunk's copy at the merge base, a line it does not hold is refused.
 secrets_base=""

modules/adwaita/README.md

@@ -86,7 +86,7 @@ login.
 
 ## What changes when it is assigned
 
-| | g14 | shanks |
+| | node-b | node-d |
 |---|---|---|
 | packages | none (all present) | the same |
 | GTK settings, `portals.conf` | the found files kept once, then the module's: adds the cursor and Inter, keeps Adwaita dark; `portals.conf` adds the Secret line | the same |

modules/asus-zephyrus-g14/cmd/zephyrus/manifest_test.go

@@ -94,7 +94,8 @@ func TestTheManifestNamesNoMachineAndItsTriggersExist(t *testing.T) {
 		ids[r["id"].(string)] = true
 	}
 	raw, _ := os.ReadFile("../../module.json")
-	for _, banned := range []string{"jochen", "/home/", "/run/user/1000", "\"g14\"", "shanks"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, banned := range []string{"jochen", "/home/", "/run/user/1000"} {
 		if strings.Contains(string(raw), banned) {
 			t.Errorf("the manifest says %q", banned)
 		}

modules/betterbird/README.md

@@ -1,6 +1,6 @@
 # betterbird
 
-Betterbird, the mail and calendar client of g14 and shanks (a Thunderbird fork, with the operator's
+Betterbird, the mail and calendar client of node-b and node-d (a Thunderbird fork, with the operator's
 Exchange calendar through the Owl add-on), as a module (novox/hq issue 345, issue 586, ADR 0208, ADR 0316,
 ADR 0317, ADR 0329, to-be 56). It requires `x11-display`, so it is assigned only where a display server is held
 on the same machine. It installs Betterbird from a pinned upstream release, ships Owl with it through
@@ -58,7 +58,7 @@ reading the new range there (ADR 0316 §8).
 **The policy** turns Betterbird's own updater off (`DisableAppUpdate`, which Betterbird's update check
 honours) and installs Owl into every profile from `file:///opt/betterbird/owl/owl.xpi` as
 `force_installed`, with `updates_disabled`. A profile that already runs another Owl keeps it: the policy
-installs the pinned one where Owl is missing. A newer Owl in the profile (g14 runs 1.5.7) is said as a
+installs the pinned one where Owl is missing. A newer Owl in the profile (node-b runs 1.5.7) is said as a
 fact by `betterbird_status`; Owl installed by policy cannot be removed in Betterbird, so the remedy is
 moving the pin. An older one is a finding of `betterbird_check`, with the same remedy.
 
@@ -323,10 +323,10 @@ question.
 
 ## What changes when it is pushed
 
-The module is assigned to shanks today (look-only, from issue 345's first part); g14 runs Betterbird
+The module is assigned to node-d today (look-only, from issue 345's first part); node-b runs Betterbird
 outside the mesh. With this version, a push to a node (each waits for the operator: `upgrade: record`):
 
-| | on a node with the community package (g14, shanks) |
+| | on a node with the community package (node-b, node-d) |
 |---|---|
 | the package | `betterbird-bin` removed (quit Betterbird first) |
 | `/opt/betterbird` | the mesh's 153.4.0esr-bb10, in the same place, so the same profile opens |

modules/betterbird/cmd/betterbird-tools/config_test.go

@@ -412,13 +412,13 @@ func TestKeepProposesANodeLayerThroughTheController(t *testing.T) {
 	f.write(profileDir+"/prefs.js", `user_pref("mail.uifontsize", 16);`+"\n"+`user_pref("mail.spam.manualMark", true);`+"\n")
 	oldNode, oldAsk := nodeName, asker
 	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "shanks" }
+	nodeName = func() string { return "node-d" }
 	var asked []map[string]any
 	asker = func(v string, a any) (json.RawMessage, error) {
 		args := a.(map[string]any)
 		asked = append(asked, args)
 		if args["propose"] == nil {
-			return json.RawMessage(`{"ok": true, "output": "{\"prefs\": {\"calendar.alarms.playsound\": false}, \"identities\": {\"mail\": {\"account\": \"mail\"}}}\n  set at the terminal\nbetterbird on shanks, every value"}`), nil
+			return json.RawMessage(`{"ok": true, "output": "{\"prefs\": {\"calendar.alarms.playsound\": false}, \"identities\": {\"mail\": {\"account\": \"mail\"}}}\n  set at the terminal\nbetterbird on node-d, every value"}`), nil
 		}
 		return json.RawMessage(`{"ok": true, "output": "proposed: p-1"}`), nil
 	}
@@ -427,7 +427,7 @@ func TestKeepProposesANodeLayerThroughTheController(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(asked) != 2 || asked[0]["node"] != "shanks" || asked[1]["node"] != "shanks" || asked[1]["propose"] != "true" ||
+	if len(asked) != 2 || asked[0]["node"] != "node-d" || asked[1]["node"] != "node-d" || asked[1]["propose"] != "true" ||
 		asked[1]["module"] != "betterbird" {
 		t.Fatalf("the node's layer read, then proposed: %v", asked)
 	}

modules/betterbird/cmd/betterbird-tools/derive_test.go

@@ -12,11 +12,11 @@ import (
 // ADR 0329 §10, §12: derived from every desktop node's profile, laid out per layer, and proposed one layer at a
 // time, carrying the layer as it stands.
 
-// derivingMesh is two desktop nodes, g14 (this one, f) and shanks (f2), and a server that holds no Betterbird, as the
+// derivingMesh is two desktop nodes, node-b (this one, f) and node-d (f2), and a server that holds no Betterbird, as the
 // controller answers them; layers are the controller's layers, open the proposals that wait.
 type derivingMesh struct {
 	t        *testing.T
-	shanks   *fake
+	nodeD    *fake
 	layers   map[string]map[string]any
 	open     bool
 	proposed []map[string]any
@@ -35,17 +35,17 @@ func (d *derivingMesh) ask(key string, body any) (json.RawMessage, error) {
 	}
 	switch {
 	case key == "seat:mesh-controller.nodes":
-		return answer(true, `[{"name": "g14"}, {"name": "novox"}, {"name": "shanks"}]`)
+		return answer(true, `[{"name": "node-b"}, {"name": "node-c"}, {"name": "node-d"}]`)
 	case key == "seat:mesh-controller.node":
-		if args["node"] == "novox" {
-			return answer(true, "novox\n  assigned: postgres, nats\n")
+		if args["node"] == "node-c" {
+			return answer(true, "node-c\n  assigned: postgres, nats\n")
 		}
 		return answer(true, fmt.Sprintf("%s\n  last heard from   here\n  assigned: adwaita, betterbird, dunst\n", args["node"]))
-	case key == "betterbird.betterbird_derive@shanks":
+	case key == "betterbird.betterbird_derive@node-d":
 		if d.asleep {
 			return nil, errors.New("nats: no responders available for request")
 		}
-		here, err := d.shanks.deriveHere(stringsOf(args["kinds"]))
+		here, err := d.nodeD.deriveHere(stringsOf(args["kinds"]))
 		if err != nil {
 			d.t.Fatal(err)
 		}
@@ -53,10 +53,10 @@ func (d *derivingMesh) ask(key string, body any) (json.RawMessage, error) {
 		return json.Marshal(map[string]any{"content": []any{map[string]any{"type": "text", "text": string(text)}}})
 	case key == "seat:mesh-controller.settings" && args["proposals"] == "true":
 		if d.open {
-			return answer(true, "sab12  set betterbird on the whole mesh  (accounts, identities)\n    by g14.node-tools at 2026-10-13 01:00; fingerprint ab12\n    waiting for the operator until 2026-10-14 01:00\n"+
-				"scd34  set mounts on shanks  (sources)\n    by g14.node-tools at 2026-10-11 00:05; fingerprint dd0b\n    chosen: done\n")
+			return answer(true, "sab12  set betterbird on the whole mesh  (accounts, identities)\n    by node-b.node-tools at 2026-10-13 01:00; fingerprint ab12\n    waiting for the operator until 2026-10-14 01:00\n"+
+				"scd34  set mounts on node-d  (sources)\n    by node-b.node-tools at 2026-10-11 00:05; fingerprint dd0b\n    chosen: done\n")
 		}
-		return answer(true, "scd34  set mounts on shanks  (sources)\n    by g14.node-tools; fingerprint dd0b\n    chosen: done\n")
+		return answer(true, "scd34  set mounts on node-d  (sources)\n    by node-b.node-tools; fingerprint dd0b\n    chosen: done\n")
 	case key == "seat:mesh-controller.settings" && args["propose"] == "true":
 		d.proposed = append(d.proposed, args)
 		return answer(true, "proposal sab12: Set the settings of betterbird?\n  fingerprint ab12")
@@ -107,23 +107,23 @@ func TestDeriveLaysEachEntryOutPerLayerAndProposesOneLayerAtATime(t *testing.T)
 	f2 := newFake(t)
 	f2.profileWithAccounts()
 	f2.profileWithConfiguration()
-	// shanks holds the same accounts and calendars, another signature, another tag colour and a calendar of its own.
+	// node-d holds the same accounts and calendars, another signature, another tag colour and a calendar of its own.
 	f2.write(profileDir+"/prefs.js", strings.NewReplacer(`"Regards"`, `"Cheers"`, `"#FF0000"`, `"#CC0000"`).Replace(f2.read(profileDir+"/prefs.js"))+
 		`user_pref("calendar.registry.s1.type", "caldav");`+"\n"+
 		`user_pref("calendar.registry.s1.uri", "https://dav.example.org/cal/standup/");`+"\n"+
 		`user_pref("calendar.registry.s1.name", "Standup");`+"\n")
 	f2.declareAccounts(adoptable)
-	mesh := &derivingMesh{t: t, shanks: f2, layers: map[string]map[string]any{"": {"accounts": map[string]any{"mail": "as approved"}}}}
+	mesh := &derivingMesh{t: t, nodeD: f2, layers: map[string]map[string]any{"": {"accounts": map[string]any{"mail": "as approved"}}}}
 	oldNode, oldAsk := nodeName, asker
 	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "g14" }
+	nodeName = func() string { return "node-b" }
 	asker = mesh.ask
 
 	a, err := f.Derive(nil, false, false, nil, "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(a.From, []string{"g14", "shanks"}) || len(a.NotHeard) != 0 {
+	if !reflect.DeepEqual(a.From, []string{"node-b", "node-d"}) || len(a.NotHeard) != 0 {
 		t.Fatalf("derived from the nodes holding Betterbird: %v %v", a.From, a.NotHeard)
 	}
 	whole := mustJSON(a)
@@ -134,9 +134,9 @@ func TestDeriveLaysEachEntryOutPerLayerAndProposesOneLayerAtATime(t *testing.T)
 	}
 	cals, _ := mw[kindCalendars].(map[string]any)
 	if cals["home"] == nil || cals["standup"] != nil {
-		t.Errorf("a calendar both hold is mesh-wide, one only shanks holds is not: %v", cals)
+		t.Errorf("a calendar both hold is mesh-wide, one only node-d holds is not: %v", cals)
 	}
-	if sh := mustJSON(a.Layers["shanks"]); !strings.Contains(sh, "https://dav.example.org/cal/standup/") {
+	if sh := mustJSON(a.Layers["node-d"]); !strings.Contains(sh, "https://dav.example.org/cal/standup/") {
 		t.Errorf("an entry on one node only goes into that node's layer: %s", sh)
 	}
 	tags, _ := mw[kindTags].(map[string]any)
@@ -147,8 +147,8 @@ func TestDeriveLaysEachEntryOutPerLayerAndProposesOneLayerAtATime(t *testing.T)
 	for _, d := range a.Differences {
 		diffs[d.Kind+"/"+d.Entry+"/"+d.Field] = d
 	}
-	if d := diffs["identities/mail/signature"]; d.Node != "shanks" || mustJSON(d.There) != `["Cheers"]` {
-		t.Errorf("the answer lists the field shanks holds differently: %+v", a.Differences)
+	if d := diffs["identities/mail/signature"]; d.Node != "node-d" || mustJSON(d.There) != `["Cheers"]` {
+		t.Errorf("the answer lists the field node-d holds differently: %+v", a.Differences)
 	}
 	if d := diffs["tags/$label1/color"]; d.There != "#CC0000" || d.MeshWide != "#FF0000" {
 		t.Errorf("%+v", a.Differences)
@@ -195,22 +195,22 @@ func TestDeriveLaysEachEntryOutPerLayerAndProposesOneLayerAtATime(t *testing.T)
 	if _, err := f.Derive(nil, false, true, nil, ""); err == nil || !strings.Contains(err.Error(), "sab12 (the whole mesh)") || len(mesh.proposed) != 1 {
 		t.Fatalf("one open proposal of the module's at a time: %v", err)
 	}
-	// Approved: the mesh-wide layer holds it, so the next layer is shanks's own.
+	// Approved: the mesh-wide layer holds it, so the next layer is node-d's own.
 	mesh.open = false
 	mesh.layers[""] = values
 	a, err = f.Derive(nil, false, true, prefs, "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(mesh.proposed) != 2 || mesh.proposed[1]["node"] != "shanks" || a.Next != "shanks" ||
+	if len(mesh.proposed) != 2 || mesh.proposed[1]["node"] != "node-d" || a.Next != "node-d" ||
 		!strings.Contains(mesh.proposed[1]["values"].(string), "standup") {
 		t.Fatalf("then the node's own layer: %v", mesh.proposed)
 	}
-	var shanks map[string]any
-	if err := json.Unmarshal([]byte(mesh.proposed[1]["values"].(string)), &shanks); err != nil {
+	var nodeD map[string]any
+	if err := json.Unmarshal([]byte(mesh.proposed[1]["values"].(string)), &nodeD); err != nil {
 		t.Fatal(err)
 	}
-	mesh.layers["shanks"] = shanks
+	mesh.layers["node-d"] = nodeD
 	if a, err = f.Derive(nil, false, true, prefs, ""); err != nil || len(mesh.proposed) != 2 || !strings.HasPrefix(a.Next, "none") {
 		t.Fatalf("nothing left to propose: %v %s", err, a.Next)
 	}
@@ -240,10 +240,10 @@ func TestALayerThatCannotBeReadRefusesTheProposal(t *testing.T) {
 	f2 := newFake(t)
 	f2.profileWithAccounts()
 	f2.declareAccounts(adoptable)
-	mesh := &derivingMesh{t: t, shanks: f2, garbled: true}
+	mesh := &derivingMesh{t: t, nodeD: f2, garbled: true}
 	oldNode, oldAsk := nodeName, asker
 	t.Cleanup(func() { nodeName, asker = oldNode, oldAsk })
-	nodeName = func() string { return "g14" }
+	nodeName = func() string { return "node-b" }
 	asker = mesh.ask
 	if _, err := f.Derive(nil, false, true, nil, ""); err == nil || !strings.Contains(err.Error(), "cannot be read as the layer") ||
 		len(mesh.proposed) != 0 {
@@ -257,7 +257,7 @@ func TestALayerThatCannotBeReadRefusesTheProposal(t *testing.T) {
 		t.Fatal("an unreadable layer is an error, never an empty layer")
 	}
 	mesh.garbled = false
-	if got, err := readLayer("shanks"); err != nil || len(got) != 0 {
+	if got, err := readLayer("node-d"); err != nil || len(got) != 0 {
 		t.Fatalf("no layer, in the controller's words, is an empty layer: %v %v", got, err)
 	}
 }

modules/betterbird/cmd/betterbird-tools/manifest_test.go

@@ -107,7 +107,8 @@ func TestItPlacesBetterbirdWhereTheCommunityPackageDidAndOnlyAfterItIsGone(t *te
 		}
 	}
 	s := strings.ToLower(raw)
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "http://", "mediahuis"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "http://", "mediahuis"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/blueman/README.md

@@ -52,7 +52,7 @@ through an injected runner and a fake root in the tests.
 
 ## What changes when it is assigned
 
-| | g14 | shanks |
+| | node-b | node-d |
 |---|---|---|
 | package | none: `blueman` 2.4.6 is installed, explicitly, from `extra` | the same |
 | start | none: dex starts the applet from the package's entry, in the login session's scope; the tray icon with it | none on disk. **The applet running now came from the predecessor's window-manager line** (a child of i3, since the session of 2026-10-04 16:00). That session began before the `i3` module dropped the line and installed `dex`, so the next login is the first that starts it from the entry |
@@ -62,7 +62,7 @@ The workstations are already in the state this module describes.
 
 ## Migration (ADR 0182)
 
-Nothing is required on either machine. On shanks, log out and in once, or run `blueman_restart`, and
+Nothing is required on either machine. On node-d, log out and in once, or run `blueman_restart`, and
 the applet runs from its one start. `blueman_check` then answers `ok`.
 
 ## Leaves as found

modules/blueman/cmd/blueman-tools/manifest_test.go

@@ -101,7 +101,8 @@ func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 		t.Errorf("the Go tools bundle: %v", b)
 	}
 	s := strings.ToLower(raw)
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "http", "password", "token"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "http", "password", "token"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/bluetooth/cmd/bluetooth-tools/bluetooth_test.go

@@ -20,7 +20,7 @@ func TestTheManifestIsTheStackItsToolsAndTheDaemon(t *testing.T) {
 	}
 }
 
-const show = "Controller 4C:82:A9:97:01:8E (public)\n\tName: g14\n\tAlias: g14\n\tPowered: yes\n\tPowerState: on\n\tDiscoverable: no\n\tPairable: yes\n\tUUID: Headset (00001108-0000-1000-8000-00805f9b34fb)\n\tDiscovering: no\n"
+const show = "Controller 4C:82:A9:97:01:8E (public)\n\tName: node-b\n\tAlias: node-b\n\tPowered: yes\n\tPowerState: on\n\tDiscoverable: no\n\tPairable: yes\n\tUUID: Headset (00001108-0000-1000-8000-00805f9b34fb)\n\tDiscovering: no\n"
 
 func headphones(connected bool) string {
 	c := "no"
@@ -34,7 +34,7 @@ func headphones(connected bool) string {
 func TestControllerReadsShow(t *testing.T) {
 	using(t, func(string, Cmd) Result { return ok("\x1b[0;94m" + show) })
 	c, err := Controller()
-	if err != nil || c.Address != "4C:82:A9:97:01:8E" || c.Name != "g14" || !c.Powered || c.Discoverable || !c.Pairable {
+	if err != nil || c.Address != "4C:82:A9:97:01:8E" || c.Name != "node-b" || !c.Powered || c.Discoverable || !c.Pairable {
 		t.Fatalf("%+v %v", c, err)
 	}
 	using(t, func(string, Cmd) Result { return ok("No default controller available\n") })

modules/brother/cmd/brother/device_integration_test.go

@@ -64,7 +64,7 @@ func TestTheAdminProcessAnswersAnAskOverARealBus(t *testing.T) {
 		Retention: jetstream.WorkQueuePolicy, Discard: jetstream.DiscardNew, MaxAge: 24 * time.Hour, MaxBytes: 8 << 20}); err != nil {
 		t.Fatal(err)
 	}
-	account := process.Account{URL: url, Node: "g14", Module: "brother", User: "g14.brother." + DeviceProcessID, Password: "pw"}
+	account := process.Account{URL: url, Node: "node-b", Module: "brother", User: "node-b.brother." + DeviceProcessID, Password: "pw"}
 	if _, err := js.CreateConsumer(ctx, AsksStream, jetstream.ConsumerConfig{Durable: account.QueueConsumerName(),
 		AckPolicy: jetstream.AckExplicitPolicy, AckWait: 30 * time.Second, MaxDeliver: 3}); err != nil {
 		t.Fatal(err)

modules/brother/cmd/brother/fetch_test.go

@@ -234,7 +234,7 @@ func TestAFetchedPDFIsStoredUnderItsHashAndPrinted(t *testing.T) {
 	// A refusal inside the mesh is answered, and nothing is stored nor printed.
 	fake.body = nil
 	before := len(r.objects.keys())
-	if _, err := r.call(t, "printer.print", map[string]any{"url": "http://127.0.0.1:9000/mesh-shanks-brother/x"}); err == nil || !strings.Contains(err.Error(), "loopback") {
+	if _, err := r.call(t, "printer.print", map[string]any{"url": "http://127.0.0.1:9000/mesh-node-d-brother/x"}); err == nil || !strings.Contains(err.Error(), "loopback") {
 		t.Errorf("a loopback address: error = %v", err)
 	}
 	if len(r.objects.keys()) != before || fake.body != nil {

modules/brother/cmd/brother/main.go

@@ -160,7 +160,7 @@ func tools(settingsFile string, now func() time.Time) []stdio.Tool {
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"object": str("a stored document's key: a scan's key, as scan.added names it, or the key node-files.upload answered"),
 				"path":   str("an absolute path of a file on the machine node names"),
-				"node":   str("the machine path is on, such as g14"),
+				"node":   str("the machine path is on, such as node-b"),
 				"url":    str("an http or https address of a document or a page"),
 				"ask":    str("the ask id of an earlier print that was answered as started: alone, it reads that print's outcome"),
 				"copies": num("1 to 99 (default 1)"),

modules/brother/cmd/brother/printlink_test.go

@@ -56,15 +56,15 @@ func TestPrintTakesExactlyOneSource(t *testing.T) {
 	for name, args := range map[string]map[string]any{
 		"none":                {},
 		"only options":        {"copies": float64(2)},
-		"object and path":     {"object": key, "path": "/home/ops/a.pdf", "node": "g14"},
+		"object and path":     {"object": key, "path": "/home/ops/a.pdf", "node": "node-b"},
 		"object and url":      {"object": key, "url": "https://example.com/a.pdf"},
-		"path+node and url":   {"path": "/home/ops/a.pdf", "node": "g14", "url": "https://example.com/a.pdf"},
-		"all three":           {"object": key, "path": "/home/ops/a.pdf", "node": "g14", "url": "https://example.com/a.pdf"},
+		"path+node and url":   {"path": "/home/ops/a.pdf", "node": "node-b", "url": "https://example.com/a.pdf"},
+		"all three":           {"object": key, "path": "/home/ops/a.pdf", "node": "node-b", "url": "https://example.com/a.pdf"},
 		"path without node":   {"path": "/home/ops/a.pdf"},
-		"node without path":   {"node": "g14", "object": key},
+		"node without path":   {"node": "node-b", "object": key},
 		"the retired upload":  {"upload": "u1"},
 		"object and upload":   {"object": key, "upload": "u1"},
-		"path and its object": {"path": "/home/ops/a.pdf", "node": "g14", "object": key},
+		"path and its object": {"path": "/home/ops/a.pdf", "node": "node-b", "object": key},
 	} {
 		_, err := r.call(t, "printer.print", args)
 		if err == nil {
@@ -82,7 +82,7 @@ func TestPrintTakesExactlyOneSource(t *testing.T) {
 	}
 }
 
-// 1598/AC2: with path and node g14, printer.print asks g14's node-files to upload the path into brother's bucket, and
+// 1598/AC2: with path and node node-b, printer.print asks node-b's node-files to upload the path into brother's bucket, and
 // queues a print ask that carries the returned key and the options: under 4 KiB, and no path, node or bytes.
 func TestPrintOfAFileOfAnotherMachineUploadsThenPrintsTheKey(t *testing.T) {
 	fake := newIPPFake(t, 31, 5)
@@ -90,12 +90,12 @@ func TestPrintOfAFileOfAnotherMachineUploadsThenPrintsTheKey(t *testing.T) {
 	key := sha256Hex(doc)
 	up := withUpload(t, key, nil)
 	r := newRig(t, `{"printer":"192.0.2.10"}`, "pw")
-	r.objects.Put(t.Context(), key, "application/pdf", doc) // what g14's upload stored
-	got, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/letter.pdf", "node": "g14", "copies": float64(2)})
+	r.objects.Put(t.Context(), key, "application/pdf", doc) // what node-b's upload stored
+	got, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/letter.pdf", "node": "node-b", "copies": float64(2)})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(up.seen()) != 1 || up.seen()[0] != "g14|/home/ops/letter.pdf|brother-test" {
+	if len(up.seen()) != 1 || up.seen()[0] != "node-b|/home/ops/letter.pdf|brother-test" {
 		t.Fatalf("uploads asked: %v", up.seen())
 	}
 	if len(r.bus.published) != 1 {
@@ -114,7 +114,7 @@ func TestPrintOfAFileOfAnotherMachineUploadsThenPrintsTheKey(t *testing.T) {
 		}
 	}
 	m := got.(map[string]any)
-	if m["job-id"] != float64(31) || m["node"] != "g14" || m["path"] != "/home/ops/letter.pdf" {
+	if m["job-id"] != float64(31) || m["node"] != "node-b" || m["path"] != "/home/ops/letter.pdf" {
 		t.Errorf("answer = %v", m)
 	}
 	if _, sent := fake.request(t); string(sent) != string(doc) {
@@ -127,7 +127,7 @@ func TestARefusedUploadIsAnsweredWithItsReasonAndNothingIsPrinted(t *testing.T)
 	fake := newIPPFake(t, 1, 3)
 	up := withUpload(t, "", errors.New("/home/ops/.ssh/id_ed25519 is refused by name: it is in .ssh, which holds an account's credentials"))
 	r := newRig(t, `{"printer":"192.0.2.10"}`, "pw")
-	_, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/.ssh/id_ed25519", "node": "g14"})
+	_, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/.ssh/id_ed25519", "node": "node-b"})
 	if err == nil || !strings.Contains(err.Error(), "is refused by name: it is in .ssh") {
 		t.Fatalf("error = %v", err)
 	}
@@ -277,7 +277,7 @@ func TestASlowUploadAndPrintAnswersStartedNeverATimeout(t *testing.T) {
 	t.Cleanup(func() { uploadVia = old })
 	r := newRig(t, `{"printer":"192.0.2.10"}`, "pw")
 	r.objects.Put(t.Context(), key, "application/pdf", doc)
-	got, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/letter.pdf", "node": "g14"})
+	got, err := r.call(t, "printer.print", map[string]any{"path": "/home/ops/letter.pdf", "node": "node-b"})
 	if err != nil {
 		t.Fatalf("a slow upload failed the call: %v", err)
 	}
@@ -292,7 +292,7 @@ func TestASlowUploadAndPrintAnswersStartedNeverATimeout(t *testing.T) {
 			t.Fatal(err)
 		}
 		if rm := read.(map[string]any); rm["state"] == nil {
-			if rm["job-id"] != float64(72) || rm["path"] != "/home/ops/letter.pdf" || rm["node"] != "g14" {
+			if rm["job-id"] != float64(72) || rm["path"] != "/home/ops/letter.pdf" || rm["node"] != "node-b" {
 				t.Errorf("the outcome = %v", rm)
 			}
 			break
@@ -309,7 +309,7 @@ func TestASlowUploadAndPrintAnswersStartedNeverATimeout(t *testing.T) {
 		time.Sleep(150 * time.Millisecond)
 		return "", errors.New("/home/ops/.ssh/id_ed25519 is refused by name")
 	}
-	got, _ = r.call(t, "printer.print", map[string]any{"path": "/home/ops/.ssh/id_ed25519", "node": "g14"})
+	got, _ = r.call(t, "printer.print", map[string]any{"path": "/home/ops/.ssh/id_ed25519", "node": "node-b"})
 	id2, _ := got.(map[string]any)["ask"].(string)
 	time.Sleep(300 * time.Millisecond)
 	if _, err := r.call(t, "printer.print", map[string]any{"ask": id2}); err == nil || !strings.Contains(err.Error(), "refused by name") {

modules/brother/cmd/brother/rig_test.go

@@ -139,7 +139,7 @@ func newRig(t *testing.T, settings, password string) *printerRig {
 			return nil
 		},
 		Answers: answers,
-		Node:    "shanks",
+		Node:    "node-d",
 		Now:     func() time.Time { return fixedNow },
 	}
 	bus := &fakeAskBus{worker: w, answers: answers}

modules/brother/cmd/brother/scanlink_test.go

@@ -76,7 +76,7 @@ func TestTheDeviceAnswerCarriesALinkAndNoBytes(t *testing.T) {
 	}
 
 	// The real store: the binding's key signs, for the binding's host and port, in the module's bucket.
-	s3 := NewS3(StoreFacts{Scheme: "http", At: "novox.internal", Port: "20001", Bucket: "mesh-shanks-brother", Region: "eu-west",
+	s3 := NewS3(StoreFacts{Scheme: "http", At: "node-c.internal", Port: "20001", Bucket: "mesh-node-d-brother", Region: "eu-west",
 		Key: "binding-key", Secret: "binding-secret"})
 	s3.Now = func() time.Time { return fixedNow }
 	got, err := s3.Link("GET", "abc.pdf", 10*time.Minute)
@@ -84,7 +84,7 @@ func TestTheDeviceAnswerCarriesALinkAndNoBytes(t *testing.T) {
 		t.Fatal(err)
 	}
 	gu, _ := url.Parse(got)
-	if gu.Host != "novox.internal:20001" || gu.Path != "/mesh-shanks-brother/abc.pdf" ||
+	if gu.Host != "node-c.internal:20001" || gu.Path != "/mesh-node-d-brother/abc.pdf" ||
 		!strings.HasPrefix(gu.Query().Get("X-Amz-Credential"), "binding-key/") || gu.Query().Get("X-Amz-Expires") != "600" {
 		t.Errorf("link %s", got)
 	}

modules/brother/cmd/brother/service_test.go

@@ -111,7 +111,7 @@ func TestScanNowEmitsOneEventAfterTheScanIsKeptUnderTheSha256(t *testing.T) {
 	if kept, err := r.objects.Get(t.Context(), want+".pdf"); err != nil || !bytes.Equal(kept, pdf) {
 		t.Errorf("the bucket does not hold the filed PDF under its sha256 (%v)", err)
 	}
-	if ev.body["bytes"] != len(pdf) || ev.body["node"] != "shanks" || ev.body["cropped"] != true || ev.body["color-mode"] != "color" {
+	if ev.body["bytes"] != len(pdf) || ev.body["node"] != "node-d" || ev.body["cropped"] != true || ev.body["color-mode"] != "color" {
 		t.Errorf("event = %v", ev.body)
 	}
 	if want := fixedNow.UTC().Format(time.RFC3339); ev.body["scanned-at"] != want {

modules/claude-code/cmd/claude-code/claude_code_test.go

@@ -290,11 +290,11 @@ func TestAnAppliedBindingSaysWhyAndWho(t *testing.T) {
 	p, w := node(t, "laptop")
 	var asked []string
 	done, err := OnBinding(p, &BindingState{Licence: "personal", Kind: "subscription", Generation: 7,
-		Why: "the switch verb", By: "g14.node-tools"}, seat(t, "personal", "at-7", 7, &asked), writer(w))
+		Why: "the switch verb", By: "node-b.node-tools"}, seat(t, "personal", "at-7", 7, &asked), writer(w))
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, want := range []string{`"generation":7`, `"why":"the switch verb"`, `"by":"g14.node-tools"`} {
+	for _, want := range []string{`"generation":7`, `"why":"the switch verb"`, `"by":"node-b.node-tools"`} {
 		if !strings.Contains(done, want) {
 			t.Fatalf("the line %s lacks %s", done, want)
 		}

modules/claude-code/cmd/claude-code/config_test.go

@@ -355,8 +355,8 @@ func TestAPathOrAKeyThatIsNotWhatItSaysIsRefused(t *testing.T) {
 }
 
 func TestAllIsEveryNodeAndANameThatCannotBeAKeyIsRefused(t *testing.T) {
-	nodes, err := ExpandNodes([]string{"all"}, func() ([]string, error) { return []string{"ace", "g14"}, nil })
-	if err != nil || strings.Join(nodes, ",") != "ace,g14" {
+	nodes, err := ExpandNodes([]string{"all"}, func() ([]string, error) { return []string{"node-a", "node-b"}, nil })
+	if err != nil || strings.Join(nodes, ",") != "node-a,node-b" {
 		t.Fatalf("%v %v", nodes, err)
 	}
 	p, w := node(t, "laptop")

modules/claude-code/cmd/claude-code/forge_test.go

@@ -251,7 +251,7 @@ func TestTheSessionsGitIsPointedAtTheFileUnderTheOperatorsOwnEnvironment(t *test
 
 func TestForgeCredentialLinesAreReadStrictly(t *testing.T) {
 	for _, bad := range []string{"", "\n", "token", "https://git.example.test", "https://agent-anchor@git.example.test",
-		"https://agent-anchor:t@git.example.test/novox/hq.git", "ssh://agent-anchor:t@git.example.test",
+		"https://agent-anchor:t@git.example.test/acme/hq.git", "ssh://agent-anchor:t@git.example.test",
 		"https://agent-anchor:t@git.example.test\nnot a line"} {
 		if _, err := ForgeCredentialLines(bad); err == nil {
 			t.Errorf("%q was taken", bad)

modules/claude-code/cmd/claude-code/guard_test.go

@@ -131,13 +131,13 @@ func TestWhatIsNotAWorkAroundPasses(t *testing.T) {
 	g := guard()
 	for _, command := range []string{
 		"git push -u origin feat/x",
-		"git clone ssh://git@git.anchor.internal:222/novox/hq.git",
-		"git fetch ssh://git@git.anchor.internal:222/novox/hq.git main",
+		"git clone ssh://git@git.anchor.internal:222/acme/hq.git",
+		"git fetch ssh://git@git.anchor.internal:222/acme/hq.git main",
 		`GIT_SSH_COMMAND="ssh -i ~/.ssh/forge -o IdentitiesOnly=yes" git push origin HEAD`,
 		"git -c core.sshCommand='ssh -p 222' pull",
 		"ssh -T git@git.anchor.internal -p 222",
 		"ssh forge",
-		"scp git@git.anchor.internal:novox/hq.git .",
+		"scp git@git.anchor.internal:acme/hq.git .",
 		"ssh github.com",
 		"ssh -T git@github.com",
 		"ssh user@203.0.113.7 uptime",

modules/claude-code/cmd/claude-code/hook_calls_test.go

@@ -51,13 +51,13 @@ func suggestedCall(t *testing.T, msg string) map[string]any {
 
 // Issue 1757: the Stop hook's suggested watched call carries `by`, and the tool accepts it as printed.
 func TestTheStopHooksSuggestedWatchedCallIsAcceptedByTheTool(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
 	t.Cleanup(func() { waiting = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
 
-	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@g14",
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@node-b",
 		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
 	if isErr {
 		t.Fatalf("add: %s", text)
@@ -81,14 +81,14 @@ func TestTheStopHooksSuggestedWatchedCallIsAcceptedByTheTool(t *testing.T) {
 
 // Issue 1757: the Stop hook's suggested said call (past its bound) carries `by` too.
 func TestTheStopHooksSuggestedSaidCallIsAcceptedByTheTool(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	clock := t0
 	waiting = &Waiting{Store: store, Now: func() time.Time { return clock }}
 	t.Cleanup(func() { waiting = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
 
-	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@g14",
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "verify-0489-test", "by": "fix-1757@node-b",
 		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 1})
 	if isErr {
 		t.Fatalf("add: %s", text)
@@ -114,20 +114,20 @@ func TestTheStopHooksSuggestedSaidCallIsAcceptedByTheTool(t *testing.T) {
 // Issue 1757: the SessionStart hook's suggested adopt call already carries `by` — checked, as asked, so a
 // regression here is caught the same way as the Stop hook's.
 func TestTheSessionStartHooksSuggestedAdoptCallIsAcceptedByTheTool(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
 	t.Cleanup(func() { waiting = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
 
-	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-old", "by": "fix-1757@g14",
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-old", "by": "fix-1757@node-b",
 		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
 	if isErr {
 		t.Fatalf("add: %s", text)
 	}
 
 	msg := SessionStartMessage("sess-new", WaitsDirPath(p), t0.Add(time.Minute))
-	if !strings.Contains(msg, "\"by\":\"fix-1757@g14\"") {
+	if !strings.Contains(msg, "\"by\":\"fix-1757@node-b\"") {
 		t.Fatalf("the suggested adopt call does not carry by: %s", msg)
 	}
 	args := suggestedCall(t, msg)

modules/claude-code/cmd/claude-code/memory.go

@@ -813,7 +813,7 @@ func (m *MemoryCarrier) unwritten(key, project, path string, err error) {
 }
 
 // OlderBeside is where the older of two versions too large to share one file is kept: beside the file, named for
-// the node it was changed on ("MEMORY.md" from shanks: "MEMORY.older-from-shanks.md").
+// the node it was changed on ("MEMORY.md" from node-d: "MEMORY.older-from-node-d.md").
 func OlderBeside(path, node string) string {
 	ext := filepath.Ext(path)
 	return strings.TrimSuffix(path, ext) + ".older-from-" + node + ext
@@ -900,7 +900,7 @@ func (m *MemoryCarrier) Take(key, op string, value json.RawMessage, revision uin
 	}
 	// Only noted here, never applied: the runtime hands the watch's values over one at a time and gives the whole
 	// current set ten seconds, so a watch whose handler reads the state, waits for a look or writes a file never
-	// starts on a node with a few hundred memory files (issue 367, seen on shanks on 2026-10-13). Drain applies
+	// starts on a node with a few hundred memory files (issue 367, seen on node-d on 2026-10-13). Drain applies
 	// what was noted, the newest revision of each key.
 	m.queueMu.Lock()
 	if m.queue == nil {

modules/claude-code/cmd/claude-code/memory_test.go

@@ -206,15 +206,15 @@ func holdsText(list []string, s string) bool {
 	return false
 }
 
-const project = "-home-op-projects-novox-hq"
+const project = "-home-op-projects-acme-hq"
 
 func twoNodes(t *testing.T) (*memState, *clock, *memNode, *memNode) {
 	state, c := newMemState(), &clock{now: time.Date(2026, 10, 13, 12, 0, 0, 0, time.UTC)}
 	root := t.TempDir()
-	return state, c, newMemNode(t, root, "g14", HomeOperator, state, c), newMemNode(t, root, "shanks", HomeOperator, state, c)
+	return state, c, newMemNode(t, root, "node-b", HomeOperator, state, c), newMemNode(t, root, "node-d", HomeOperator, state, c)
 }
 
-// carried writes a file on g14 and carries it to shanks.
+// carried writes a file on node-b and carries it to node-d.
 func carriedOnBoth(t *testing.T, state *memState, c *clock, a, b *memNode, file, text string) {
 	t.Helper()
 	a.write(t, project, file, text, c.now)
@@ -229,39 +229,39 @@ func carriedOnBoth(t *testing.T, state *memState, c *clock, a, b *memNode, file,
 
 // §5, §6: a memory file written on one node appears unchanged on another, at any depth, and is carried once.
 func TestAMemoryFileWrittenOnOneNodeAppearsUnchangedOnAnother(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	g14.write(t, project, "MEMORY.md", "- [state](state.md) — where things stand\n", c.now)
-	g14.write(t, project, "notes/state.md", "ADR 0343 proposed.\n", c.now)
-	g14.look(t)
+	state, c, nodeB, nodeD := twoNodes(t)
+	nodeB.write(t, project, "MEMORY.md", "- [state](state.md) — where things stand\n", c.now)
+	nodeB.write(t, project, "notes/state.md", "ADR 0343 proposed.\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
 	for file, want := range map[string]string{"MEMORY.md": "- [state](state.md) — where things stand\n", "notes/state.md": "ADR 0343 proposed.\n"} {
-		if got, ok := shanks.read(t, project, file); !ok || got != want {
-			t.Fatalf("%s on shanks: %q, %v", file, got, ok)
+		if got, ok := nodeD.read(t, project, file); !ok || got != want {
+			t.Fatalf("%s on node-d: %q, %v", file, got, ok)
 		}
 	}
 	before := state.rev
-	shanks.look(t)
-	g14.look(t)
+	nodeD.look(t)
+	nodeB.look(t)
 	state.pump(t)
 	if state.rev != before {
 		t.Fatalf("a carried file was carried again: %d changes", state.rev-before)
 	}
-	// A change on shanks comes back to g14, over the version it replaced, which g14 keeps.
+	// A change on node-d comes back to node-b, over the version it replaced, which node-b keeps.
 	c.now = c.now.Add(time.Minute)
-	shanks.write(t, project, "notes/state.md", "ADR 0343 accepted.\n", c.now)
-	shanks.look(t)
+	nodeD.write(t, project, "notes/state.md", "ADR 0343 accepted.\n", c.now)
+	nodeD.look(t)
 	state.pump(t)
-	if got, _ := g14.read(t, project, "notes/state.md"); got != "ADR 0343 accepted.\n" {
-		t.Fatalf("the change did not reach g14: %q", got)
+	if got, _ := nodeB.read(t, project, "notes/state.md"); got != "ADR 0343 accepted.\n" {
+		t.Fatalf("the change did not reach node-b: %q", got)
 	}
-	if !holdsText(g14.copies(t), "ADR 0343 proposed.\n") {
-		t.Fatal("the version replaced on g14 was not kept")
+	if !holdsText(nodeB.copies(t), "ADR 0343 proposed.\n") {
+		t.Fatal("the version replaced on node-b was not kept")
 	}
-	if len(g14.notices)+len(shanks.notices) != 0 {
-		t.Fatalf("a plain change warned: %v %v", g14.notices, shanks.notices)
+	if len(nodeB.notices)+len(nodeD.notices) != 0 {
+		t.Fatalf("a plain change warned: %v %v", nodeB.notices, nodeD.notices)
 	}
 	// No value in the state is anything but a version of a memory file, and no tool answer carries the text.
-	raw, _ := json.Marshal(g14.Status())
+	raw, _ := json.Marshal(nodeB.Status())
 	if strings.Contains(string(raw), "accepted") {
 		t.Fatalf("the memory tool answered the text: %s", raw)
 	}
@@ -270,44 +270,44 @@ func TestAMemoryFileWrittenOnOneNodeAppearsUnchangedOnAnother(t *testing.T) {
 // §1, §2: only the memory folders are carried; a symbolic link, an oversized file and a secret's shape are not, and are
 // listed with why.
 func TestOnlyTheMemoryFoldersAreCarried(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	projectDir := filepath.Join(g14.Home, ".claude", "projects", project)
-	g14.write(t, project, "MEMORY.md", "index\n", c.now)
+	state, c, nodeB, nodeD := twoNodes(t)
+	projectDir := filepath.Join(nodeB.Home, ".claude", "projects", project)
+	nodeB.write(t, project, "MEMORY.md", "index\n", c.now)
 	for path, text := range map[string]string{
-		filepath.Join(projectDir, "session.jsonl"):          "{}\n",
-		filepath.Join(g14.Home, ".claude", "settings.json"): "{}\n",
-		filepath.Join(g14.Home, ".claude", "history.jsonl"): "{}\n",
+		filepath.Join(projectDir, "session.jsonl"):            "{}\n",
+		filepath.Join(nodeB.Home, ".claude", "settings.json"): "{}\n",
+		filepath.Join(nodeB.Home, ".claude", "history.jsonl"): "{}\n",
 	} {
 		if err := os.WriteFile(path, []byte(text), 0o600); err != nil {
 			t.Fatal(err)
 		}
 	}
-	g14.write(t, project, "key.md", "-----BEGIN OPENSSH PRIVATE KEY-----\nabc\n", c.now)
-	g14.write(t, project, "url.md", "https://op:hunter2@git.example.org/x\n", c.now)
-	g14.write(t, project, "big.md", strings.Repeat("x", MemoryMostBytes+1), c.now)
-	g14.write(t, project, "hash.md", "head 1fe6ea4ee47379007598e163784dbd7ac50b7f79\n", c.now)
+	nodeB.write(t, project, "key.md", "-----BEGIN OPENSSH PRIVATE KEY-----\nabc\n", c.now)
+	nodeB.write(t, project, "url.md", "https://op:hunter2@git.example.org/x\n", c.now)
+	nodeB.write(t, project, "big.md", strings.Repeat("x", MemoryMostBytes+1), c.now)
+	nodeB.write(t, project, "hash.md", "head 1fe6ea4ee47379007598e163784dbd7ac50b7f79\n", c.now)
 	outside := filepath.Join(t.TempDir(), "elsewhere.md")
 	_ = os.WriteFile(outside, []byte("not memory\n"), 0o600)
-	if err := os.Symlink(outside, g14.path(project, "link.md")); err != nil {
+	if err := os.Symlink(outside, nodeB.path(project, "link.md")); err != nil {
 		t.Fatal(err)
 	}
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
 	for _, file := range []string{"key.md", "url.md", "big.md", "link.md"} {
-		if _, ok := shanks.read(t, project, file); ok {
+		if _, ok := nodeD.read(t, project, file); ok {
 			t.Errorf("%s was carried", file)
 		}
 	}
 	for _, file := range []string{"MEMORY.md", "hash.md"} {
-		if _, ok := shanks.read(t, project, file); !ok {
+		if _, ok := nodeD.read(t, project, file); !ok {
 			t.Errorf("%s was not carried", file)
 		}
 	}
-	if _, err := os.Stat(filepath.Join(shanks.Home, ".claude", "projects", project, "session.jsonl")); err == nil {
+	if _, err := os.Stat(filepath.Join(nodeD.Home, ".claude", "projects", project, "session.jsonl")); err == nil {
 		t.Error("a session was carried")
 	}
 	for _, f := range []string{"settings.json", "history.jsonl"} {
-		if _, err := os.Stat(filepath.Join(shanks.Home, ".claude", f)); err == nil {
+		if _, err := os.Stat(filepath.Join(nodeD.Home, ".claude", f)); err == nil {
 			t.Errorf("%s was carried", f)
 		}
 	}
@@ -315,7 +315,7 @@ func TestOnlyTheMemoryFoldersAreCarried(t *testing.T) {
 	if len(keys) != 2 {
 		t.Fatalf("the state holds %d keys, not the two memory files: %v", len(keys), keys)
 	}
-	not, _ := g14.Status()["not carried"].(map[string]string)
+	not, _ := nodeB.Status()["not carried"].(map[string]string)
 	for _, file := range []string{"key.md", "url.md", "big.md", "link.md"} {
 		if not[project+"/"+file] == "" {
 			t.Errorf("%s is not listed as not carried: %v", file, not)
@@ -327,8 +327,8 @@ func TestOnlyTheMemoryFoldersAreCarried(t *testing.T) {
 func TestHomesOfTheTwoKindsNeverTakeEachOthersMemory(t *testing.T) {
 	state, c := newMemState(), &clock{now: time.Date(2026, 10, 13, 12, 0, 0, 0, time.UTC)}
 	root := t.TempDir()
-	laptop := newMemNode(t, root, "g14", HomeOperator, state, c)
-	control := newMemNode(t, root, "novox", HomeAgent, state, c)
+	laptop := newMemNode(t, root, "node-b", HomeOperator, state, c)
+	control := newMemNode(t, root, "node-c", HomeAgent, state, c)
 	control.write(t, project, "MEMORY.md", "from a confined agent\n", c.now)
 	control.look(t)
 	state.pump(t)
@@ -343,7 +343,7 @@ func TestHomesOfTheTwoKindsNeverTakeEachOthersMemory(t *testing.T) {
 	}
 	// A value of the other kind put under this kind's key is refused too.
 	key := MemoryKey(HomeOperator, project, "x.md")
-	raw, _ := json.Marshal(MemoryVersion{Kind: HomeAgent, Project: project, Path: "x.md", Text: "x", Digest: digestOf([]byte("x")), Node: "novox"})
+	raw, _ := json.Marshal(MemoryVersion{Kind: HomeAgent, Project: project, Path: "x.md", Text: "x", Digest: digestOf([]byte("x")), Node: "node-c"})
 	if err := laptop.Take(key, "put", raw, 99); err == nil {
 		t.Fatal("a value of another kind was taken")
 	}
@@ -362,31 +362,31 @@ func TestHomesOfTheTwoKindsNeverTakeEachOthersMemory(t *testing.T) {
 // §7, §8: a file changed on two nodes since it was carried is kept twice in one file on both, the newer first, with
 // one warning; it clears once the file is tidied.
 func TestAFileChangedOnTwoNodesIsKeptTwiceTheNewerFirstWithAWarning(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "- base\n")
-	g14.write(t, project, "MEMORY.md", "- base\n- learned on g14\n", c.now.Add(time.Minute))
-	shanks.write(t, project, "MEMORY.md", "- base\n- learned on shanks\n", c.now.Add(2*time.Minute))
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "- base\n")
+	nodeB.write(t, project, "MEMORY.md", "- base\n- learned on node-b\n", c.now.Add(time.Minute))
+	nodeD.write(t, project, "MEMORY.md", "- base\n- learned on node-d\n", c.now.Add(2*time.Minute))
 	c.now = c.now.Add(3 * time.Minute)
-	g14.look(t)
-	shanks.look(t)
+	nodeB.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	g14.look(t)
-	shanks.look(t)
+	nodeB.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	a, _ := g14.read(t, project, "MEMORY.md")
-	b, _ := shanks.read(t, project, "MEMORY.md")
+	a, _ := nodeB.read(t, project, "MEMORY.md")
+	b, _ := nodeD.read(t, project, "MEMORY.md")
 	if a != b {
 		t.Fatalf("the nodes did not end on one text:\n%s\n----\n%s", a, b)
 	}
-	newer, older := strings.Index(a, "learned on shanks"), strings.Index(a, "learned on g14")
+	newer, older := strings.Index(a, "learned on node-d"), strings.Index(a, "learned on node-b")
 	marker := strings.Index(a, "<!-- novox mesh: this file was changed on two nodes")
 	if newer < 0 || older < 0 || marker < 0 || !(newer < marker && marker < older) {
 		t.Fatalf("not both versions, the newer first, with the line between:\n%s", a)
 	}
-	if !strings.Contains(a[marker:], "changed on shanks") || !strings.Contains(a[marker:], "changed on g14") {
+	if !strings.Contains(a[marker:], "changed on node-d") || !strings.Contains(a[marker:], "changed on node-b") {
 		t.Fatalf("the line does not name both nodes:\n%s", a)
 	}
-	notices := append(append([]map[string]any{}, g14.notices...), shanks.notices...)
+	notices := append(append([]map[string]any{}, nodeB.notices...), nodeD.notices...)
 	if len(notices) != 1 || notices[0]["severity"] != "warning" || notices[0]["clear"] != nil {
 		t.Fatalf("not one warning: %v", notices)
 	}
@@ -406,22 +406,22 @@ func TestAFileChangedOnTwoNodesIsKeptTwiceTheNewerFirstWithAWarning(t *testing.T
 	if h, _ := notices[0]["headline"].(string); len([]rune(h)) > 60 {
 		t.Errorf("the headline is longer than sixty characters: %q", h)
 	}
-	all := append(g14.copies(t), shanks.copies(t)...)
-	for _, v := range []string{"- base\n- learned on g14\n", "- base\n- learned on shanks\n"} {
+	all := append(nodeB.copies(t), nodeD.copies(t)...)
+	for _, v := range []string{"- base\n- learned on node-b\n", "- base\n- learned on node-d\n"} {
 		if !holdsText(all, v) {
 			t.Errorf("the version %q was not kept", v)
 		}
 	}
-	if st := g14.Status(); len(st["conflicts"].([]conflict))+len(shanks.Status()["conflicts"].([]conflict)) != 1 {
+	if st := nodeB.Status(); len(st["conflicts"].([]conflict))+len(nodeD.Status()["conflicts"].([]conflict)) != 1 {
 		t.Fatalf("the conflict is not listed: %v", st)
 	}
 	// Tidied on either node, the warning clears.
 	c.now = c.now.Add(time.Minute)
-	g14.write(t, project, "MEMORY.md", "- base\n- learned on g14\n- learned on shanks\n", c.now)
-	g14.look(t)
+	nodeB.write(t, project, "MEMORY.md", "- base\n- learned on node-b\n- learned on node-d\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
 	cleared := false
-	for _, n := range append(g14.notices, shanks.notices...) {
+	for _, n := range append(nodeB.notices, nodeD.notices...) {
 		if n["clear"] == true {
 			cleared = true
 		}
@@ -429,39 +429,39 @@ func TestAFileChangedOnTwoNodesIsKeptTwiceTheNewerFirstWithAWarning(t *testing.T
 	if !cleared {
 		t.Fatal("the warning did not clear once the file was tidied")
 	}
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "- base\n- learned on g14\n- learned on shanks\n" {
-		t.Fatalf("the tidied file did not reach shanks: %q", got)
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "- base\n- learned on node-b\n- learned on node-d\n" {
+		t.Fatalf("the tidied file did not reach node-d: %q", got)
 	}
 }
 
 // The order of the two versions: the later change first, equal times by node name.
 func TestMergeVersionsPutsTheNewerFirst(t *testing.T) {
 	at := time.Date(2026, 10, 13, 12, 0, 0, 0, time.UTC)
-	m := string(MergeVersions([]byte("old\n"), "g14", at, []byte("new\n"), "shanks", at.Add(time.Second)))
+	m := string(MergeVersions([]byte("old\n"), "node-b", at, []byte("new\n"), "node-d", at.Add(time.Second)))
 	if strings.Index(m, "new") > strings.Index(m, "old") {
 		t.Fatalf("the newer is not first: %s", m)
 	}
-	m = string(MergeVersions([]byte("from shanks\n"), "shanks", at, []byte("from ace\n"), "ace", at))
-	if strings.Index(m, "from ace") > strings.Index(m, "from shanks") {
+	m = string(MergeVersions([]byte("from node-d\n"), "node-d", at, []byte("from node-a\n"), "node-a", at))
+	if strings.Index(m, "from node-a") > strings.Index(m, "from node-d") {
 		t.Fatalf("equal times are not ordered by node name: %s", m)
 	}
 }
 
 // §9: a removal moves the other node's unchanged file into the copies.
 func TestARemovalMovesTheUnchangedFileIntoTheCopies(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "old.md", "an old note\n")
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "index\n")
-	if err := os.Remove(g14.path(project, "old.md")); err != nil {
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "old.md", "an old note\n")
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "index\n")
+	if err := os.Remove(nodeB.path(project, "old.md")); err != nil {
 		t.Fatal(err)
 	}
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
-	if _, ok := shanks.read(t, project, "old.md"); ok {
-		t.Fatal("the removal did not reach shanks")
+	if _, ok := nodeD.read(t, project, "old.md"); ok {
+		t.Fatal("the removal did not reach node-d")
 	}
-	if !holdsText(shanks.copies(t), "an old note\n") {
-		t.Fatal("the removed version was not kept on shanks")
+	if !holdsText(nodeD.copies(t), "an old note\n") {
+		t.Fatal("the removed version was not kept on node-d")
 	}
 	raw, _, ok, _ := state.Get(MemoryKey(HomeOperator, project, "old.md"))
 	var v MemoryVersion
@@ -469,7 +469,7 @@ func TestARemovalMovesTheUnchangedFileIntoTheCopies(t *testing.T) {
 	if !ok || !v.Removed || v.Text != "" {
 		t.Fatalf("the removal is not a marker in the state: %s", raw)
 	}
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "index\n" {
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "index\n" {
 		t.Fatal("another file was touched")
 	}
 }
@@ -477,23 +477,23 @@ func TestARemovalMovesTheUnchangedFileIntoTheCopies(t *testing.T) {
 // §9: a change outlives a removal, whichever reaches the state first.
 func TestAChangeOutlivesARemoval(t *testing.T) {
 	for _, removalFirst := range []bool{true, false} {
-		state, c, g14, shanks := twoNodes(t)
-		carriedOnBoth(t, state, c, g14, shanks, "note.md", "v1\n")
-		_ = os.Remove(g14.path(project, "note.md"))
-		shanks.write(t, project, "note.md", "v2\n", c.now.Add(time.Minute))
+		state, c, nodeB, nodeD := twoNodes(t)
+		carriedOnBoth(t, state, c, nodeB, nodeD, "note.md", "v1\n")
+		_ = os.Remove(nodeB.path(project, "note.md"))
+		nodeD.write(t, project, "note.md", "v2\n", c.now.Add(time.Minute))
 		if removalFirst {
-			g14.look(t)
+			nodeB.look(t)
 			state.pump(t)
-			shanks.look(t)
+			nodeD.look(t)
 		} else {
-			shanks.look(t)
-			g14.look(t)
+			nodeD.look(t)
+			nodeB.look(t)
 		}
 		state.pump(t)
-		g14.look(t)
-		shanks.look(t)
+		nodeB.look(t)
+		nodeD.look(t)
 		state.pump(t)
-		for _, n := range []*memNode{g14, shanks} {
+		for _, n := range []*memNode{nodeB, nodeD} {
 			if got, _ := n.read(t, project, "note.md"); got != "v2\n" {
 				t.Fatalf("removal first %v: the change did not outlive the removal on %s: %q", removalFirst, n.Node, got)
 			}
@@ -503,51 +503,51 @@ func TestAChangeOutlivesARemoval(t *testing.T) {
 
 // §9: a missing folder, a state that lost its keys and a deleted key remove nothing.
 func TestAMissingFolderOrAnAbsentKeyRemovesNothing(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "index\n")
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "index\n")
 	key := MemoryKey(HomeOperator, project, "MEMORY.md")
-	// The folder gone on g14.
-	if err := os.RemoveAll(filepath.Join(g14.Home, ".claude", "projects", project, "memory")); err != nil {
+	// The folder gone on node-b.
+	if err := os.RemoveAll(filepath.Join(nodeB.Home, ".claude", "projects", project, "memory")); err != nil {
 		t.Fatal(err)
 	}
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "index\n" {
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "index\n" {
 		t.Fatal("a missing folder removed the file elsewhere")
 	}
 	// A deleted key.
 	_ = state.Delete(key)
 	state.pump(t)
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "index\n" {
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "index\n" {
 		t.Fatal("a deleted key removed the file")
 	}
 	// The state lost: the file is carried again, not removed.
-	shanks.look(t)
+	nodeD.look(t)
 	state.pump(t)
 	if _, _, ok, _ := state.Get(key); !ok {
 		t.Fatal("a file whose key the state lost was not carried again")
 	}
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "index\n" {
-		t.Fatalf("the file was touched on shanks: %q", got)
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "index\n" {
+		t.Fatalf("the file was touched on node-d: %q", got)
 	}
 }
 
 // §10: on a first carrying, two nodes' different versions are both kept, and each node's own files reach the other.
 func TestTheFirstCarryingKeepsEveryVersion(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	g14.write(t, project, "MEMORY.md", "- laptop's index\n", c.now)
-	g14.write(t, project, "laptop.md", "only on the laptop\n", c.now)
-	shanks.write(t, project, "MEMORY.md", "- workstation's index\n", c.now.Add(time.Hour))
-	shanks.write(t, project, "workstation.md", "only on the workstation\n", c.now)
-	shanks.write(t, project, "same.md", "same\n", c.now)
-	g14.write(t, project, "same.md", "same\n", c.now)
-	g14.look(t)
+	state, c, nodeB, nodeD := twoNodes(t)
+	nodeB.write(t, project, "MEMORY.md", "- laptop's index\n", c.now)
+	nodeB.write(t, project, "laptop.md", "only on the laptop\n", c.now)
+	nodeD.write(t, project, "MEMORY.md", "- workstation's index\n", c.now.Add(time.Hour))
+	nodeD.write(t, project, "workstation.md", "only on the workstation\n", c.now)
+	nodeD.write(t, project, "same.md", "same\n", c.now)
+	nodeB.write(t, project, "same.md", "same\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
-	shanks.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
-	for _, n := range []*memNode{g14, shanks} {
+	for _, n := range []*memNode{nodeB, nodeD} {
 		index, _ := n.read(t, project, "MEMORY.md")
 		if !strings.Contains(index, "laptop's index") || !strings.Contains(index, "workstation's index") ||
 			strings.Index(index, "workstation's index") > strings.Index(index, "laptop's index") {
@@ -559,23 +559,23 @@ func TestTheFirstCarryingKeepsEveryVersion(t *testing.T) {
 			}
 		}
 	}
-	if n := len(g14.notices) + len(shanks.notices); n != 1 {
+	if n := len(nodeB.notices) + len(nodeD.notices); n != 1 {
 		t.Fatalf("%d warnings for one conflict", n)
 	}
 }
 
 // Nothing is written through a symbolic link: a memory folder that is one is neither read nor written.
 func TestNothingIsWrittenThroughASymbolicLink(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
+	state, c, nodeB, nodeD := twoNodes(t)
 	elsewhere := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(shanks.Home, ".claude", "projects", project), 0o700); err != nil {
+	if err := os.MkdirAll(filepath.Join(nodeD.Home, ".claude", "projects", project), 0o700); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.Symlink(elsewhere, filepath.Join(shanks.Home, ".claude", "projects", project, "memory")); err != nil {
+	if err := os.Symlink(elsewhere, filepath.Join(nodeD.Home, ".claude", "projects", project, "memory")); err != nil {
 		t.Fatal(err)
 	}
-	g14.write(t, project, "MEMORY.md", "index\n", c.now)
-	g14.look(t)
+	nodeB.write(t, project, "MEMORY.md", "index\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
 	if entries, _ := os.ReadDir(elsewhere); len(entries) != 0 {
 		t.Fatalf("written through a symbolic link: %v", entries)
@@ -619,24 +619,24 @@ func (s *memState) replay(t *testing.T, n *memNode) {
 // §6: a node that was away while a file changed twice takes the newest version, whose base it never saw, because
 // its own file holds no change it did not carry; the version replaced is kept.
 func TestANodeThatWasAwayTakesTheNewestVersion(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "v1\n")
-	state.watchers = []*MemoryCarrier{g14.MemoryCarrier}
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "v1\n")
+	state.watchers = []*MemoryCarrier{nodeB.MemoryCarrier}
 	for _, v := range []string{"v2\n", "v3\n"} {
 		c.now = c.now.Add(time.Minute)
-		g14.write(t, project, "MEMORY.md", v, c.now)
-		g14.look(t)
+		nodeB.write(t, project, "MEMORY.md", v, c.now)
+		nodeB.look(t)
 		state.pump(t)
 	}
-	state.watchers = append(state.watchers, shanks.MemoryCarrier)
-	state.replay(t, shanks)
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "v3\n" {
+	state.watchers = append(state.watchers, nodeD.MemoryCarrier)
+	state.replay(t, nodeD)
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "v3\n" {
 		t.Fatalf("the node that was away holds %q", got)
 	}
-	if !holdsText(shanks.copies(t), "v1\n") {
+	if !holdsText(nodeD.copies(t), "v1\n") {
 		t.Fatal("the version replaced was not kept")
 	}
-	if len(g14.notices)+len(shanks.notices) != 0 {
+	if len(nodeB.notices)+len(nodeD.notices) != 0 {
 		t.Fatal("taking a newer version warned")
 	}
 }
@@ -644,24 +644,24 @@ func TestANodeThatWasAwayTakesTheNewestVersion(t *testing.T) {
 // §2, §7: two versions too large to share one file are kept in two: the newer in the file, the older beside it,
 // both carried; and a text that would not fit in one value of the state is not carried.
 func TestTwoVersionsTooLargeForOneFileAreKeptInTwo(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "big.md", "base\n")
-	older := strings.Repeat("from g14 ", MemoryMostBytes/9-100) + "\n"
-	newer := strings.Repeat("from shanks ", MemoryMostBytes/12-100) + "\n"
-	g14.write(t, project, "big.md", older, c.now.Add(time.Minute))
-	shanks.write(t, project, "big.md", newer, c.now.Add(2*time.Minute))
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "big.md", "base\n")
+	older := strings.Repeat("from node-b ", MemoryMostBytes/12-100) + "\n"
+	newer := strings.Repeat("from node-d ", MemoryMostBytes/12-100) + "\n"
+	nodeB.write(t, project, "big.md", older, c.now.Add(time.Minute))
+	nodeD.write(t, project, "big.md", newer, c.now.Add(2*time.Minute))
 	c.now = c.now.Add(3 * time.Minute)
-	g14.look(t)
-	shanks.look(t)
+	nodeB.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	g14.look(t)
-	shanks.look(t)
+	nodeB.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	beside := OlderBeside("big.md", "g14")
-	if beside != "big.older-from-g14.md" {
+	beside := OlderBeside("big.md", "node-b")
+	if beside != "big.older-from-node-b.md" {
 		t.Fatalf("the older is named %q", beside)
 	}
-	for _, n := range []*memNode{g14, shanks} {
+	for _, n := range []*memNode{nodeB, nodeD} {
 		if got, _ := n.read(t, project, "big.md"); got != newer {
 			t.Fatalf("%s's file does not hold the newer version", n.Node)
 		}
@@ -669,18 +669,18 @@ func TestTwoVersionsTooLargeForOneFileAreKeptInTwo(t *testing.T) {
 			t.Fatalf("%s does not hold the older version beside it", n.Node)
 		}
 	}
-	notices := append(append([]map[string]any{}, g14.notices...), shanks.notices...)
+	notices := append(append([]map[string]any{}, nodeB.notices...), nodeD.notices...)
 	if len(notices) != 1 || !strings.Contains(notices[0]["explanation"].(string), "second file beside it") {
 		t.Fatalf("not one warning saying the older is beside it: %v", notices)
 	}
 	// Under the size limit, but too large once encoded: not carried, and said.
-	g14.write(t, project, "angles.md", strings.Repeat("<", MemoryMostBytes-10), c.now)
-	g14.look(t)
+	nodeB.write(t, project, "angles.md", strings.Repeat("<", MemoryMostBytes-10), c.now)
+	nodeB.look(t)
 	state.pump(t)
-	if _, ok := shanks.read(t, project, "angles.md"); ok {
+	if _, ok := nodeD.read(t, project, "angles.md"); ok {
 		t.Fatal("a text too large for one value was carried")
 	}
-	not, _ := g14.Status()["not carried"].(map[string]string)
+	not, _ := nodeB.Status()["not carried"].(map[string]string)
 	if not[project+"/angles.md"] == "" {
 		t.Fatalf("it is not listed as not carried: %v", not)
 	}
@@ -713,8 +713,8 @@ func (s *memState) putRaw(t *testing.T, v MemoryVersion) string {
 // Review of #276, 1: a value whose project or path leads out of a memory folder is never taken, and nothing is
 // written for it.
 func TestAValueLeadingOutOfAMemoryFolderIsNeverTaken(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	root := filepath.Dir(filepath.Dir(shanks.Home))
+	state, c, nodeB, nodeD := twoNodes(t)
+	root := filepath.Dir(filepath.Dir(nodeD.Home))
 	for _, bad := range []struct{ project, path string }{
 		{"../../../escaped", "x.md"}, {"..", "x.md"}, {"a/b", "x.md"}, {"", "x.md"},
 		{project, "../x.md"}, {project, "/abs.md"}, {project, "a//x.md"}, {project, "./x.md"}, {project, "a/../../x.md"},
@@ -727,8 +727,8 @@ func TestAValueLeadingOutOfAMemoryFolderIsNeverTaken(t *testing.T) {
 		}
 	}
 	state.pump(t)
-	g14.look(t)
-	shanks.look(t)
+	nodeB.look(t)
+	nodeD.look(t)
 	_ = filepath.WalkDir(root, func(p string, d os.DirEntry, err error) error {
 		if err == nil && !d.IsDir() {
 			if raw, _ := os.ReadFile(p); string(raw) == "planted\n" {
@@ -748,21 +748,21 @@ func TestWhatCannotBeReadIsNeverTakenForGone(t *testing.T) {
 	if os.Geteuid() == 0 {
 		t.Skip("root reads a file whatever its mode")
 	}
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "index\n")
-	carriedOnBoth(t, state, c, g14, shanks, "notes/deep.md", "deep\n")
-	file, folder := g14.path(project, "MEMORY.md"), filepath.Dir(g14.path(project, "notes/deep.md"))
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "index\n")
+	carriedOnBoth(t, state, c, nodeB, nodeD, "notes/deep.md", "deep\n")
+	file, folder := nodeB.path(project, "MEMORY.md"), filepath.Dir(nodeB.path(project, "notes/deep.md"))
 	_ = os.Chmod(file, 0)
 	_ = os.Chmod(folder, 0)
 	t.Cleanup(func() { _ = os.Chmod(file, 0o644); _ = os.Chmod(folder, 0o755) })
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
 	for _, f := range []string{"MEMORY.md", "notes/deep.md"} {
-		if _, ok := shanks.read(t, project, f); !ok {
-			t.Errorf("%s, unreadable on g14, was removed on shanks", f)
+		if _, ok := nodeD.read(t, project, f); !ok {
+			t.Errorf("%s, unreadable on node-b, was removed on node-d", f)
 		}
 	}
-	not, _ := g14.Status()["not carried"].(map[string]string)
+	not, _ := nodeB.Status()["not carried"].(map[string]string)
 	if len(not) == 0 {
 		t.Fatalf("nothing is said as not carried: %v", not)
 	}
@@ -782,33 +782,33 @@ func TestNoUnscreenedTextReachesTheState(t *testing.T) {
 	token := "ghp_" + strings.Repeat("A1b2C3d4", 5) + "\n"
 	big := strings.Repeat("x", MemoryMostBytes+10) + "\n"
 	for _, text := range []string{token, big} {
-		// The removal path: removed on g14, changed on shanks to what is never carried.
-		state, c, g14, shanks := twoNodes(t)
-		carriedOnBoth(t, state, c, g14, shanks, "note.md", "v1\n")
-		_ = os.Remove(g14.path(project, "note.md"))
-		shanks.write(t, project, "note.md", text, c.now.Add(time.Minute))
-		g14.look(t)
+		// The removal path: removed on node-b, changed on node-d to what is never carried.
+		state, c, nodeB, nodeD := twoNodes(t)
+		carriedOnBoth(t, state, c, nodeB, nodeD, "note.md", "v1\n")
+		_ = os.Remove(nodeB.path(project, "note.md"))
+		nodeD.write(t, project, "note.md", text, c.now.Add(time.Minute))
+		nodeB.look(t)
 		state.pump(t)
 		if state.holds(text[:20]) {
 			t.Errorf("the removal path put text that is never carried into the state")
 		}
-		if got, _ := shanks.read(t, project, "note.md"); got != text {
-			t.Errorf("the change on shanks was not kept")
+		if got, _ := nodeD.read(t, project, "note.md"); got != text {
+			t.Errorf("the change on node-d was not kept")
 		}
-		// The conflict path: changed on g14, and on shanks to what is never carried.
-		state, c, g14, shanks = twoNodes(t)
-		carriedOnBoth(t, state, c, g14, shanks, "note.md", "v1\n")
-		g14.write(t, project, "note.md", "v2\n", c.now.Add(time.Minute))
-		shanks.write(t, project, "note.md", text, c.now.Add(2*time.Minute))
-		g14.look(t)
+		// The conflict path: changed on node-b, and on node-d to what is never carried.
+		state, c, nodeB, nodeD = twoNodes(t)
+		carriedOnBoth(t, state, c, nodeB, nodeD, "note.md", "v1\n")
+		nodeB.write(t, project, "note.md", "v2\n", c.now.Add(time.Minute))
+		nodeD.write(t, project, "note.md", text, c.now.Add(2*time.Minute))
+		nodeB.look(t)
 		state.pump(t)
-		shanks.look(t)
+		nodeD.look(t)
 		state.pump(t)
 		if state.holds(text[:20]) {
 			t.Errorf("the conflict path put text that is never carried into the state")
 		}
-		if got, _ := shanks.read(t, project, "note.md"); got != text {
-			t.Errorf("shanks's own version was not kept as it was")
+		if got, _ := nodeD.read(t, project, "note.md"); got != text {
+			t.Errorf("node-d's own version was not kept as it was")
 		}
 	}
 }
@@ -819,24 +819,24 @@ func TestAConflictThatCannotBeWrittenIsNotMergedAgainAndAgain(t *testing.T) {
 	if os.Geteuid() == 0 {
 		t.Skip("root writes a folder whatever its mode")
 	}
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "MEMORY.md", "base\n")
-	g14.write(t, project, "MEMORY.md", "base\nfrom g14\n", c.now.Add(time.Minute))
-	shanks.write(t, project, "MEMORY.md", "base\nfrom shanks\n", c.now.Add(2*time.Minute))
-	folder := filepath.Dir(shanks.path(project, "MEMORY.md"))
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "MEMORY.md", "base\n")
+	nodeB.write(t, project, "MEMORY.md", "base\nfrom node-b\n", c.now.Add(time.Minute))
+	nodeD.write(t, project, "MEMORY.md", "base\nfrom node-d\n", c.now.Add(2*time.Minute))
+	folder := filepath.Dir(nodeD.path(project, "MEMORY.md"))
 	_ = os.Chmod(folder, 0o500)
 	t.Cleanup(func() { _ = os.Chmod(folder, 0o700) })
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
 	for i := 0; i < 5; i++ {
-		_ = shanks.Look()
+		_ = nodeD.Look()
 		state.pump(t)
 	}
 	if state.holds("<!-- novox mesh") {
 		t.Fatal("a merge that could not be written here reached the state")
 	}
 	unwritten := 0
-	for _, n := range shanks.notices {
+	for _, n := range nodeD.notices {
 		if strings.HasSuffix(n["key"].(string), ".unwritten") {
 			unwritten++
 		}
@@ -845,13 +845,13 @@ func TestAConflictThatCannotBeWrittenIsNotMergedAgainAndAgain(t *testing.T) {
 		t.Fatalf("%d warnings that the file could not be written", unwritten)
 	}
 	_ = os.Chmod(folder, 0o700)
-	shanks.look(t)
+	nodeD.look(t)
 	state.pump(t)
-	g14.look(t)
+	nodeB.look(t)
 	state.pump(t)
-	for _, n := range []*memNode{g14, shanks} {
+	for _, n := range []*memNode{nodeB, nodeD} {
 		got, _ := n.read(t, project, "MEMORY.md")
-		if strings.Count(got, "<!-- novox mesh") != 1 || !strings.Contains(got, "from g14") || !strings.Contains(got, "from shanks") {
+		if strings.Count(got, "<!-- novox mesh") != 1 || !strings.Contains(got, "from node-b") || !strings.Contains(got, "from node-d") {
 			t.Fatalf("%s does not hold both versions once:\n%s", n.Node, got)
 		}
 	}
@@ -860,24 +860,24 @@ func TestAConflictThatCannotBeWrittenIsNotMergedAgainAndAgain(t *testing.T) {
 // Review of #276, minor: a file that changed between its reading and its writing is not written over; text that is
 // not UTF-8 is not carried.
 func TestAFileChangedBeforeItsWritingIsNotWrittenOver(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
+	state, c, nodeB, nodeD := twoNodes(t)
 	_ = state
-	g14.write(t, project, "a.md", "read\n", c.now)
-	g14.write(t, project, "a.md", "changed meanwhile\n", c.now)
-	err := g14.writeLocal(project, "a.md", []byte("incoming\n"), "replaced", digestOf([]byte("read\n")))
+	nodeB.write(t, project, "a.md", "read\n", c.now)
+	nodeB.write(t, project, "a.md", "changed meanwhile\n", c.now)
+	err := nodeB.writeLocal(project, "a.md", []byte("incoming\n"), "replaced", digestOf([]byte("read\n")))
 	if !errors.Is(err, errChangedHere) {
 		t.Fatalf("written over a change: %v", err)
 	}
-	if got, _ := g14.read(t, project, "a.md"); got != "changed meanwhile\n" {
+	if got, _ := nodeB.read(t, project, "a.md"); got != "changed meanwhile\n" {
 		t.Fatalf("the change was replaced: %q", got)
 	}
-	g14.write(t, project, "latin1.md", "caf\xe9\n", c.now)
-	g14.look(t)
+	nodeB.write(t, project, "latin1.md", "caf\xe9\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
-	if _, ok := shanks.read(t, project, "latin1.md"); ok {
+	if _, ok := nodeD.read(t, project, "latin1.md"); ok {
 		t.Fatal("text that is not UTF-8 was carried")
 	}
-	not, _ := g14.Status()["not carried"].(map[string]string)
+	not, _ := nodeB.Status()["not carried"].(map[string]string)
 	if !strings.Contains(not[project+"/latin1.md"], "UTF-8") {
 		t.Fatalf("it is not said why: %v", not)
 	}
@@ -886,28 +886,28 @@ func TestAFileChangedBeforeItsWritingIsNotWrittenOver(t *testing.T) {
 // §9: a node that was away takes a removal of a version newer than the one it holds, when it holds no change of
 // its own: the removed file does not come back.
 func TestARemovalReachesANodeThatWasAway(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	carriedOnBoth(t, state, c, g14, shanks, "old.md", "v1\n")
-	state.watchers = []*MemoryCarrier{g14.MemoryCarrier}
+	state, c, nodeB, nodeD := twoNodes(t)
+	carriedOnBoth(t, state, c, nodeB, nodeD, "old.md", "v1\n")
+	state.watchers = []*MemoryCarrier{nodeB.MemoryCarrier}
 	c.now = c.now.Add(time.Minute)
-	g14.write(t, project, "old.md", "v2\n", c.now)
-	g14.look(t)
+	nodeB.write(t, project, "old.md", "v2\n", c.now)
+	nodeB.look(t)
 	state.pump(t)
-	_ = os.Remove(g14.path(project, "old.md"))
-	g14.look(t)
+	_ = os.Remove(nodeB.path(project, "old.md"))
+	nodeB.look(t)
 	state.pump(t)
-	state.watchers = append(state.watchers, shanks.MemoryCarrier)
-	state.replay(t, shanks)
-	shanks.look(t)
+	state.watchers = append(state.watchers, nodeD.MemoryCarrier)
+	state.replay(t, nodeD)
+	nodeD.look(t)
 	state.pump(t)
-	g14.look(t)
-	if _, ok := shanks.read(t, project, "old.md"); ok {
+	nodeB.look(t)
+	if _, ok := nodeD.read(t, project, "old.md"); ok {
 		t.Fatal("the removal did not reach the node that was away")
 	}
-	if _, ok := g14.read(t, project, "old.md"); ok {
+	if _, ok := nodeB.read(t, project, "old.md"); ok {
 		t.Fatal("the removed file came back")
 	}
-	if !holdsText(shanks.copies(t), "v1\n") {
+	if !holdsText(nodeD.copies(t), "v1\n") {
 		t.Fatal("the version removed on the node that was away was not kept")
 	}
 }
@@ -924,25 +924,25 @@ func (s slowState) Get(key string) (json.RawMessage, uint64, bool, error) {
 }
 
 // Issue 367, seen live: the runtime hands a watch its current values one at a time and gives them all ten seconds;
-// shanks's handler read the state and waited for its look for each of a few hundred values, so the watch never
-// started and nothing written on g14 reached it. The handler now only notes a change: it returns at once while a
+// node-d's handler read the state and waited for its look for each of a few hundred values, so the watch never
+// started and nothing written on node-b reached it. The handler now only notes a change: it returns at once while a
 // look holds the carrier and while the state is slow to answer, and Drain applies what it noted.
 func TestTheWatchHandlerReturnsAtOnceAndDrainAppliesWhatItNoted(t *testing.T) {
-	state, c, g14, shanks := twoNodes(t)
-	g14.write(t, project, "MEMORY.md", "index\n", c.now)
-	g14.look(t)
+	state, c, nodeB, nodeD := twoNodes(t)
+	nodeB.write(t, project, "MEMORY.md", "index\n", c.now)
+	nodeB.look(t)
 	state.mu.Lock()
 	state.pending = nil
 	state.mu.Unlock()
 	slow := slowState{memState: state, gate: make(chan struct{})}
-	shanks.Store = slow
+	nodeD.Store = slow
 	key := MemoryKey(HomeOperator, project, "MEMORY.md")
 	raw, rev, _, _ := state.Get(key)
-	shanks.mu.Lock() // a look running
+	nodeD.mu.Lock() // a look running
 	done := make(chan error, 1)
 	start := time.Now()
 	for i := 0; i < 400; i++ {
-		go func() { done <- shanks.Take(key, "put", raw, rev) }()
+		go func() { done <- nodeD.Take(key, "put", raw, rev) }()
 	}
 	for i := 0; i < 400; i++ {
 		select {
@@ -957,12 +957,12 @@ func TestTheWatchHandlerReturnsAtOnceAndDrainAppliesWhatItNoted(t *testing.T) {
 	if took := time.Since(start); took > time.Second {
 		t.Fatalf("400 values took %s to hand over", took)
 	}
-	shanks.mu.Unlock()
+	nodeD.mu.Unlock()
 	close(slow.gate)
-	if err := shanks.Drain(); err != nil {
+	if err := nodeD.Drain(); err != nil {
 		t.Fatal(err)
 	}
-	if got, _ := shanks.read(t, project, "MEMORY.md"); got != "index\n" {
+	if got, _ := nodeD.read(t, project, "MEMORY.md"); got != "index\n" {
 		t.Fatalf("what the watch noted was not applied: %q", got)
 	}
 }

modules/claude-code/cmd/claude-code/proposal_tools.go

@@ -117,7 +117,7 @@ func proposalTools(p Paths) []stdio.Tool {
 			Input: map[string]any{
 				"scope":  str("mesh (every node) or node (the nodes given, or this one)"),
 				"nodes":  str("for scope node: a comma-separated list of nodes; absent is this node"),
-				"name":   str("the section's name: lower-case letters, digits and -, e.g. handoff-from-g14"),
+				"name":   str("the section's name: lower-case letters, digits and -, e.g. handoff-from-node-b"),
 				"text":   str("the section's text, markdown, as every session will read it"),
 				"remove": map[string]any{"type": "boolean", "description": "propose removing the approved section of this name and scope instead"},
 			},
@@ -173,7 +173,7 @@ func questionTools(p Paths, notLaunched error) []stdio.Tool {
 					}, "required": []string{"label", "means"}}},
 				"why":       str("why the recommended option is the one you recommend, at most 120 bytes"),
 				"on_expiry": str("what you do if nobody answers before it expires, e.g. 'I leave the pull request open'"),
-				"by":        str("required: your session's name, as who@node or who, e.g. fix-589@g14"),
+				"by":        str("required: your session's name, as who@node or who, e.g. fix-589@node-b"),
 				"expires_minutes": map[string]any{"type": "integer",
 					"description": "minutes until it expires, 5 to 1430; 60 when absent"},
 			},

modules/claude-code/cmd/claude-code/proposals_test.go

@@ -55,7 +55,7 @@ type router struct {
 
 func newRouter() *router {
 	return &router{published: map[string]asks.Ask{}, records: map[string]json.RawMessage{},
-		kinds: []stdio.KindHeld{{Seat: "channel", Kind: "telegram", Module: "telegram", Node: "novox",
+		kinds: []stdio.KindHeld{{Seat: "channel", Kind: "telegram", Module: "telegram", Node: "node-c",
 			Capabilities: []string{"choice", "exact-render", "verified-sender"}}}}
 }
 
@@ -106,7 +106,7 @@ const handover = "Hand-over from the laptop.\n\nThe controller's merge of the as
 
 func proposeHandover(t *testing.T, p Paths, store *memProposals, r *router) string {
 	t.Helper()
-	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-g14", Text: handover}, store, r, t0)
+	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-node-b", Text: handover}, store, r, t0)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -136,7 +136,7 @@ func renderedInstructions(t *testing.T, p Paths) string {
 }
 
 func TestAProposalAsksTheOperatorAtTheLevelApproveAndChangesNothing(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 
@@ -153,10 +153,10 @@ func TestAProposalAsksTheOperatorAtTheLevelApproveAndChangesNothing(t *testing.T
 		asks.Glance(a.Explanation) != nil {
 		t.Errorf("the phone does not say what is asked at a glance: %q", a.Explanation)
 	}
-	if a.Headline != "Add Claude instructions 'handoff-from-g14'?" {
+	if a.Headline != "Add Claude instructions 'handoff-from-node-b'?" {
 		t.Errorf("headline: %q", a.Headline)
 	}
-	if !strings.HasPrefix(a.Details, "The text:\n"+strings.TrimRight(handover, "\n")+"\nProposed through the claude-code module on g14 at ") {
+	if !strings.HasPrefix(a.Details, "The text:\n"+strings.TrimRight(handover, "\n")+"\nProposed through the claude-code module on node-b at ") {
 		t.Errorf("a short text is not shown whole: %q", a.Details)
 	}
 	if len(a.Options) != 2 {
@@ -180,26 +180,26 @@ func TestAProposalAsksTheOperatorAtTheLevelApproveAndChangesNothing(t *testing.T
 }
 
 func TestApprovedTextReachesEveryNodeOnlyOnAWarrantEachNodeProves(t *testing.T) {
-	g14, _ := node(t, "g14")
-	shanks, _ := node(t, "shanks")
+	nodeB, _ := node(t, "node-b")
+	nodeD, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
-	id := proposeHandover(t, g14, store, r)
+	id := proposeHandover(t, nodeB, store, r)
 	r.close(r.chose(id, OptionApprove, t0.Add(time.Hour)))
 	rec := &recorded{}
-	changed, said, err := Reconcile(shanks, store, r, rec.record, t0.Add(time.Hour+time.Minute))
+	changed, said, err := Reconcile(nodeD, store, r, rec.record, t0.Add(time.Hour+time.Minute))
 	if err != nil || !changed {
-		t.Fatalf("shanks did not take the approved text: %v %v", err, said)
+		t.Fatalf("node-d did not take the approved text: %v %v", err, said)
 	}
-	got := renderedInstructions(t, shanks)
-	if !strings.Contains(got, "## Instructions the operator approved") || !strings.Contains(got, "### handoff-from-g14") ||
+	got := renderedInstructions(t, nodeD)
+	if !strings.Contains(got, "## Instructions the operator approved") || !strings.Contains(got, "### handoff-from-node-b") ||
 		!strings.Contains(got, "Do not merge it before the gate is green.") {
-		t.Fatalf("a new session on shanks does not read the text:\n%s", got)
+		t.Fatalf("a new session on node-d does not read the text:\n%s", got)
 	}
 	if len(rec.asks) != 1 || rec.asks[0] != id {
 		t.Errorf("the warrant was not handed to the hand-act log: %v", rec.asks)
 	}
 	// Heard again, or replayed: decided once, recorded once.
-	if changed, _, _ := Reconcile(shanks, store, r, rec.record, t0.Add(2*time.Hour)); changed || len(rec.asks) != 1 {
+	if changed, _, _ := Reconcile(nodeD, store, r, rec.record, t0.Add(2*time.Hour)); changed || len(rec.asks) != 1 {
 		t.Errorf("a warrant heard twice acted twice (changed %v, recorded %v)", changed, rec.asks)
 	}
 }
@@ -259,7 +259,7 @@ func TestNothingBecomesActiveWithoutAValidWarrant(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			p, _ := node(t, "shanks")
+			p, _ := node(t, "node-d")
 			store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 			id := proposeHandover(t, p, store, r)
 			c.tamper(r, store, id)
@@ -278,7 +278,7 @@ func TestNothingBecomesActiveWithoutAValidWarrant(t *testing.T) {
 }
 
 func TestARemovalNeedsTheSameApprovalAndARecordDeletedRemovesNothing(t *testing.T) {
-	p, _ := node(t, "shanks")
+	p, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 	r.close(r.chose(id, OptionApprove, t0.Add(time.Hour)))
@@ -289,31 +289,31 @@ func TestARemovalNeedsTheSameApprovalAndARecordDeletedRemovesNothing(t *testing.
 	if _, _, err := Reconcile(p, store, r, nil, t0.Add(2*time.Hour)); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(renderedInstructions(t, p), "### handoff-from-g14") {
+	if !strings.Contains(renderedInstructions(t, p), "### handoff-from-node-b") {
 		t.Fatal("deleting the bus record removed an approved section")
 	}
-	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-g14", Remove: true}, store, r, t0.Add(3*time.Hour))
+	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-node-b", Remove: true}, store, r, t0.Add(3*time.Hour))
 	if err != nil {
 		t.Fatal(err)
 	}
 	rid := out["proposed"].(string)
-	if r.published[rid].Explanation != "Every Claude session on the mesh stops reading the instructions 'handoff-from-g14' from its next start." {
+	if r.published[rid].Explanation != "Every Claude session on the mesh stops reading the instructions 'handoff-from-node-b' from its next start." {
 		t.Errorf("removal ask: %q", r.published[rid].Explanation)
 	}
-	if !strings.Contains(renderedInstructions(t, p), "### handoff-from-g14") {
+	if !strings.Contains(renderedInstructions(t, p), "### handoff-from-node-b") {
 		t.Fatal("proposing a removal removed it")
 	}
 	r.close(r.chose(rid, OptionApprove, t0.Add(4*time.Hour)))
 	if changed, _, _ := Reconcile(p, store, r, nil, t0.Add(4*time.Hour)); !changed {
 		t.Fatal("the approved removal changed nothing")
 	}
-	if strings.Contains(renderedInstructions(t, p), "handoff-from-g14") {
+	if strings.Contains(renderedInstructions(t, p), "handoff-from-node-b") {
 		t.Fatal("the approved removal left the section")
 	}
 	// The first approval, replayed into the bus again, brings nothing back: it was decided here.
 	r2 := r.records[id]
-	_ = store.Put(id, Proposal{ID: id, Action: ActionAdd, Scope: ScopeMesh, Name: "handoff-from-g14", Text: handover,
-		Digest: textDigest(handover), From: "g14", At: t0})
+	_ = store.Put(id, Proposal{ID: id, Action: ActionAdd, Scope: ScopeMesh, Name: "handoff-from-node-b", Text: handover,
+		Digest: textDigest(handover), From: "node-b", At: t0})
 	r.records[id] = r2
 	if changed, _, _ := Reconcile(p, store, r, nil, t0.Add(5*time.Hour)); changed {
 		t.Fatal("a replayed approval brought a removed section back")
@@ -321,22 +321,22 @@ func TestARemovalNeedsTheSameApprovalAndARecordDeletedRemovesNothing(t *testing.
 }
 
 func TestANodeScopedSectionReachesOnlyItsNodes(t *testing.T) {
-	ace, _ := node(t, "ace")
-	shanks, _ := node(t, "shanks")
+	nodeA, _ := node(t, "node-a")
+	nodeD, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
-	out, err := Propose(ace, ProposeInput{Scope: ScopeNode, Nodes: []string{"shanks"}, Name: "builds", Text: "Builds run here.\n"}, store, r, t0)
+	out, err := Propose(nodeA, ProposeInput{Scope: ScopeNode, Nodes: []string{"node-d"}, Name: "builds", Text: "Builds run here.\n"}, store, r, t0)
 	if err != nil {
 		t.Fatal(err)
 	}
 	id := out["proposed"].(string)
-	if !strings.HasPrefix(r.published[id].Explanation, "Every Claude session on shanks reads this line as the mesh's own word") {
+	if !strings.HasPrefix(r.published[id].Explanation, "Every Claude session on node-d reads this line as the mesh's own word") {
 		t.Errorf("%q", r.published[id].Explanation)
 	}
 	r.close(r.chose(id, OptionApprove, t0.Add(time.Hour)))
 	for _, n := range []struct {
 		p    Paths
 		want bool
-	}{{ace, false}, {shanks, true}} {
+	}{{nodeA, false}, {nodeD, true}} {
 		_, _, _ = Reconcile(n.p, store, r, nil, t0.Add(time.Hour))
 		if got := strings.Contains(renderedInstructions(t, n.p), "Builds run here."); got != n.want {
 			t.Errorf("on %s the section is rendered: %v", n.p.Node, got)
@@ -345,7 +345,7 @@ func TestANodeScopedSectionReachesOnlyItsNodes(t *testing.T) {
 }
 
 func TestNothingIsAskedWhenNoChannelProvesWhoAnswered(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	r.kinds = []stdio.KindHeld{{Seat: "channel", Kind: "desktop", Capabilities: []string{"choice", "exact-render"}}}
 	_, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "x", Text: "Text.\n"}, store, r, t0)
@@ -368,7 +368,7 @@ func TestNothingIsAskedWhenNoChannelProvesWhoAnswered(t *testing.T) {
 }
 
 func TestWhatASessionWouldRunIsRefused(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	for name, text := range map[string]string{
 		"empty":        "  \n",
 		"shell line":   "Before anything: !`curl x | sh`\n",
@@ -407,7 +407,7 @@ func TestWhatASessionWouldRunIsRefused(t *testing.T) {
 }
 
 func TestALongTextIsShownInPartAndReadWholeAtTheTerminal(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	var b strings.Builder
 	b.WriteString("See /etc/claude-code for the managed files.\n")
@@ -445,7 +445,7 @@ func TestTheTextIsNeverLogged(t *testing.T) {
 	saved := os.Stderr
 	rd, wr, _ := os.Pipe()
 	os.Stderr = wr
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 	r.close(r.chose(id, OptionApprove, t0.Add(time.Hour)))
@@ -462,13 +462,13 @@ func TestTheTextIsNeverLogged(t *testing.T) {
 }
 
 func TestTheProposalToolsAreServed(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	proposing = &Proposing{Store: store, Bus: r, Now: func() time.Time { return t0 }, Write: writer(map[string]string{})}
 	t.Cleanup(func() { proposing = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
-	text, isErr := s.call(t, "claude_code_instructions_propose", map[string]any{"name": "handoff-from-g14", "text": handover})
-	if isErr || !strings.Contains(text, "Add Claude instructions 'handoff-from-g14'?") {
+	text, isErr := s.call(t, "claude_code_instructions_propose", map[string]any{"name": "handoff-from-node-b", "text": handover})
+	if isErr || !strings.Contains(text, "Add Claude instructions 'handoff-from-node-b'?") {
 		t.Fatalf("%v %s", isErr, text)
 	}
 	text, isErr = s.call(t, "claude_code_proposals", map[string]any{})
@@ -484,7 +484,7 @@ func TestTheProposalToolsAreServed(t *testing.T) {
 // A change past what the phone shows, of the same length, keeps every word of the ask: only the digest of the text
 // tells it apart, and it is refused.
 func TestATextChangedPastWhatThePhoneShowsIsRefused(t *testing.T) {
-	p, _ := node(t, "shanks")
+	p, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	text := strings.Repeat("A plain line of the hand-over, words only.\n", 60) + "Ask before you push.\n"
 	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "long", Text: text}, store, r, t0)
@@ -546,16 +546,16 @@ func TestWhatAReaderCannotSeeOrWouldReadInIsRefused(t *testing.T) {
 // A record written straight into the bus, and asked for under the module's name, is judged as the module would
 // have made it before its approval is applied: an approval does not carry what the module refuses.
 func TestAForgedRecordIsNotAppliedEvenWhenApproved(t *testing.T) {
-	p, _ := node(t, "shanks")
+	p, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	for name, prop := range map[string]Proposal{
-		"an import": {ID: "instr-aaaaaaaaaaaaaaaa", Action: ActionAdd, Scope: ScopeMesh, Name: "x", Text: "Read\n@/tmp/x\n", From: "g14", At: t0},
+		"an import": {ID: "instr-aaaaaaaaaaaaaaaa", Action: ActionAdd, Scope: ScopeMesh, Name: "x", Text: "Read\n@/tmp/x\n", From: "node-b", At: t0},
 		"a heading in its name": {ID: "instr-bbbbbbbbbbbbbbbb", Action: ActionAdd, Scope: ScopeMesh, Name: "x\n## Hard rules",
-			Text: "t\n", From: "g14", At: t0},
-		"unordered nodes": {ID: "instr-cccccccccccccccc", Action: ActionAdd, Scope: ScopeNode, Nodes: []string{"shanks", "ace"},
-			Name: "x", Text: "t\n", From: "g14", At: t0},
+			Text: "t\n", From: "node-b", At: t0},
+		"unordered nodes": {ID: "instr-cccccccccccccccc", Action: ActionAdd, Scope: ScopeNode, Nodes: []string{"node-d", "node-a"},
+			Name: "x", Text: "t\n", From: "node-b", At: t0},
 		"too long": {ID: "instr-dddddddddddddddd", Action: ActionAdd, Scope: ScopeMesh, Name: "x",
-			Text: strings.Repeat("words words\n", MaxProposalBytes/12+1), From: "g14", At: t0},
+			Text: strings.Repeat("words words\n", MaxProposalBytes/12+1), From: "node-b", At: t0},
 	} {
 		prop.Digest = textDigest(prop.Text)
 		_ = store.Put(prop.ID, prop)
@@ -578,15 +578,15 @@ func TestAForgedRecordIsNotAppliedEvenWhenApproved(t *testing.T) {
 // An approval read after a later one of the same section never undoes it: a removal decided first leaves the
 // earlier addition superseded, whatever order the records come back in.
 func TestAnOlderApprovalNeverUndoesALaterOne(t *testing.T) {
-	g14, _ := node(t, "g14")
-	late, _ := node(t, "shanks")
+	nodeB, _ := node(t, "node-b")
+	late, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
-	add := proposeHandover(t, g14, store, r)
+	add := proposeHandover(t, nodeB, store, r)
 	r.close(r.chose(add, OptionApprove, t0.Add(time.Hour)))
-	if _, _, err := Reconcile(g14, store, r, nil, t0.Add(time.Hour)); err != nil {
+	if _, _, err := Reconcile(nodeB, store, r, nil, t0.Add(time.Hour)); err != nil {
 		t.Fatal(err)
 	}
-	out, err := Propose(g14, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-g14", Remove: true}, store, r, t0.Add(2*time.Hour))
+	out, err := Propose(nodeB, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-node-b", Remove: true}, store, r, t0.Add(2*time.Hour))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -602,7 +602,7 @@ func TestAnOlderApprovalNeverUndoesALaterOne(t *testing.T) {
 	if changed, _, _ := Reconcile(late, store, r, nil, t0.Add(5*time.Hour)); changed {
 		t.Fatal("the earlier addition, read after the removal, was applied")
 	}
-	if strings.Contains(renderedInstructions(t, late), "handoff-from-g14") {
+	if strings.Contains(renderedInstructions(t, late), "handoff-from-node-b") {
 		t.Fatal("a removed section came back")
 	}
 	if got := outcomeHere(t, late, add); !strings.Contains(got, "superseded") {
@@ -611,7 +611,7 @@ func TestAnOlderApprovalNeverUndoesALaterOne(t *testing.T) {
 }
 
 func TestAnUnreadableRecordIsNeverTakenForAnEmptyOne(t *testing.T) {
-	p, _ := node(t, "shanks")
+	p, _ := node(t, "node-d")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 	r.close(r.chose(id, OptionApprove, t0.Add(time.Hour)))
@@ -630,27 +630,27 @@ func TestAnUnreadableRecordIsNeverTakenForAnEmptyOne(t *testing.T) {
 // A section for some nodes is its own: a proposal of the same name for other nodes adds another, and replaces
 // or removes nothing of the first.
 func TestANodeSectionIsNotReplacedFromOtherNodes(t *testing.T) {
-	ace, _ := node(t, "ace")
+	nodeA, _ := node(t, "node-a")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
-	out, _ := Propose(ace, ProposeInput{Scope: ScopeNode, Nodes: []string{"ace"}, Name: "builds", Text: "On ace.\n"}, store, r, t0)
+	out, _ := Propose(nodeA, ProposeInput{Scope: ScopeNode, Nodes: []string{"node-a"}, Name: "builds", Text: "On node-a.\n"}, store, r, t0)
 	r.close(r.chose(out["proposed"].(string), OptionApprove, t0.Add(time.Hour)))
-	_, _, _ = Reconcile(ace, store, r, nil, t0.Add(time.Hour))
-	out, err := Propose(ace, ProposeInput{Scope: ScopeNode, Nodes: []string{"shanks"}, Name: "builds", Text: "On shanks.\n"}, store, r, t0.Add(2*time.Hour))
+	_, _, _ = Reconcile(nodeA, store, r, nil, t0.Add(time.Hour))
+	out, err := Propose(nodeA, ProposeInput{Scope: ScopeNode, Nodes: []string{"node-d"}, Name: "builds", Text: "On node-d.\n"}, store, r, t0.Add(2*time.Hour))
 	if err != nil {
 		t.Fatal(err)
 	}
 	if out["action"] != ActionAdd {
 		t.Errorf("a section for other nodes was proposed as %v", out["action"])
 	}
-	if _, err := Propose(ace, ProposeInput{Scope: ScopeNode, Nodes: []string{"shanks"}, Name: "builds", Remove: true}, store, r, t0.Add(2*time.Hour)); err == nil {
-		t.Error("a removal for other nodes was taken for the section on ace")
+	if _, err := Propose(nodeA, ProposeInput{Scope: ScopeNode, Nodes: []string{"node-d"}, Name: "builds", Remove: true}, store, r, t0.Add(2*time.Hour)); err == nil {
+		t.Error("a removal for other nodes was taken for the section on node-a")
 	}
 }
 
 // A module that only asks is issued no channel kinds (they come with a kinded bench a module uses or watches): an
 // empty list is no refusal, and the router, which judges, is asked (the live failure of 2026-10-10).
 func TestAnAskerIssuedNoKindsLeavesTheJudgingToTheRouter(t *testing.T) {
-	p, _ := node(t, "novox")
+	p, _ := node(t, "node-c")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	r.kinds = nil
 	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "x", Text: "Text.\n"}, store, r, t0)
@@ -664,7 +664,7 @@ func TestAnAskerIssuedNoKindsLeavesTheJudgingToTheRouter(t *testing.T) {
 
 // The router's refusal reaches the proposer at once, and discards the proposal on every node that hears it.
 func TestTheRoutersRefusalIsSaidAndDiscards(t *testing.T) {
-	p, _ := node(t, "novox")
+	p, _ := node(t, "node-c")
 	store := &memProposals{m: map[string]json.RawMessage{}}
 	r := newRouter()
 	r.kinds = nil
@@ -687,7 +687,7 @@ func TestTheRoutersRefusalIsSaidAndDiscards(t *testing.T) {
 
 // A proposal whose ask ended and that the router keeps no record of is discarded, never left waiting.
 func TestAnAskTheRouterKeepsNoRecordOfIsDiscardedAfterItsTime(t *testing.T) {
-	p, _ := node(t, "novox")
+	p, _ := node(t, "node-c")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 	delete(r.records, id)
@@ -726,7 +726,7 @@ func (r *refusingRouter) Publish(subject string, body any, id string) error {
 
 // A refusal heard, and then the same ask taken after all and approved: the approval is taken, not lost in silence.
 func TestAnAskTakenAfterItsRefusalIsStillAnswered(t *testing.T) {
-	p, _ := node(t, "novox")
+	p, _ := node(t, "node-c")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
 	id := proposeHandover(t, p, store, r)
 	if _, err := HeardEnd(p, store, asks.Warrant{Ask: id, Asker: Module, Outcome: asks.OutcomeRefused, Words: "no channel", At: t0}, t0); err != nil {
@@ -747,9 +747,9 @@ func TestAnAskTakenAfterItsRefusalIsStillAnswered(t *testing.T) {
 // A proposer's summary is the explanation, held to a glance; a proposal made before issue 639 is composed as it was
 // asked, so the warrant for it still holds after the change.
 func TestAProposalIsAskedAtAGlanceAndAnOlderOneAsItWasAsked(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := &memProposals{m: map[string]json.RawMessage{}}, newRouter()
-	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-g14", Text: handover,
+	out, err := Propose(p, ProposeInput{Scope: ScopeMesh, Name: "handoff-from-node-b", Text: handover,
 		Summary: "Every session learns how hand-overs are written, so the next one reads them the same way."}, store, r, t0)
 	if err != nil {
 		t.Fatal(err)

modules/claude-code/cmd/claude-code/questions.go

@@ -351,7 +351,7 @@ func AskQuestion(p Paths, in QuestionInput, store QuestionStore, bus AskBus, now
 		by = who
 	}
 	if by == "" {
-		return refuse("it does not say who asks: give by, your session's name as who@node, such as fix-589@g14")
+		return refuse("it does not say who asks: give by, your session's name as who@node, such as fix-589@node-b")
 	}
 	life := in.Expires
 	if life == 0 {

modules/claude-code/cmd/claude-code/questions_test.go

@@ -26,7 +26,7 @@ func mergeTonight() QuestionInput {
 		},
 		Why:      "it is reviewed and the checks are green",
 		OnExpiry: "I leave the pull request open",
-		By:       "fix-589@g14",
+		By:       "fix-589@node-b",
 	}
 }
 
@@ -40,7 +40,7 @@ func askMergeTonight(t *testing.T, p Paths, store *memQuestions, r *router, at t
 }
 
 func TestAQuestionIsAskedUnderTheModulesNameAtTheLevelApprove(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	out, err := AskQuestion(p, mergeTonight(), store, r, t0)
 	if err != nil {
@@ -72,7 +72,7 @@ func TestAQuestionIsAskedUnderTheModulesNameAtTheLevelApprove(t *testing.T) {
 	if !strings.HasSuffix(a.Explanation, "\n• Recommended: Merge now, because it is reviewed and the checks are green.") || asks.Glance(a.Explanation) != nil {
 		t.Errorf("the explanation does not read at a glance:\n%s", a.Explanation)
 	}
-	for _, want := range []string{"the agent session fix-589 on g14", "performs nothing by itself"} {
+	for _, want := range []string{"the agent session fix-589 on node-b", "performs nothing by itself"} {
 		if !strings.Contains(a.Details, want) || strings.Contains(a.Explanation, want) {
 			t.Errorf("the details do not say %q:\n%s", want, a.Details)
 		}
@@ -83,7 +83,7 @@ func TestAQuestionIsAskedUnderTheModulesNameAtTheLevelApprove(t *testing.T) {
 }
 
 func TestTheChosenAnswerIsReadBackByItsKey(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	key := askMergeTonight(t, p, store, r, t0)
 	out, err := ReadAnswer(store, r, key, t0.Add(time.Minute))
@@ -105,7 +105,7 @@ func TestTheChosenAnswerIsReadBackByItsKey(t *testing.T) {
 }
 
 func TestAnAnswerThatDoesNotHoldToTheQuestionIsNotProven(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	key := askMergeTonight(t, p, store, r, t0)
 	w := r.chose(key, "o1", t0.Add(time.Minute))
@@ -140,7 +140,7 @@ func TestAnAnswerThatDoesNotHoldToTheQuestionIsNotProven(t *testing.T) {
 }
 
 func TestAQuestionIsRefusedOutsideItsBounds(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	for name, change := range map[string]func(*QuestionInput){
 		"one option":        func(in *QuestionInput) { in.Options = in.Options[:1] },
 		"five options":      func(in *QuestionInput) { in.Options = append(in.Options, in.Options[1], in.Options[1], in.Options[1]) },
@@ -154,7 +154,7 @@ func TestAQuestionIsRefusedOutsideItsBounds(t *testing.T) {
 		"an option unsaid":  func(in *QuestionInput) { in.Options[1].Means = "" },
 		"too short":         func(in *QuestionInput) { in.Expires = time.Minute },
 		"too long":          func(in *QuestionInput) { in.Expires = 2 * 24 * time.Hour },
-		"another node":      func(in *QuestionInput) { in.By = "fix-589@shanks" },
+		"another node":      func(in *QuestionInput) { in.By = "fix-589@node-d" },
 		"an invisible char": func(in *QuestionInput) { in.Context += "\u200b" },
 		"invisible label":   func(in *QuestionInput) { in.Options[0].Label = "Merge\u200bnow" },
 		"invisible means":   func(in *QuestionInput) { in.Options[1].Means += "\u202e" },
@@ -182,7 +182,7 @@ func TestAQuestionIsRefusedOutsideItsBounds(t *testing.T) {
 }
 
 func TestAtMostTwoQuestionsWaitSoAProposalFindsRoom(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	first := askMergeTonight(t, p, store, r, t0)
 	askMergeTonight(t, p, store, r, t0)
@@ -219,7 +219,7 @@ func (r *questionRefusingRouter) Publish(subject string, body any, id string) er
 }
 
 func TestTheRoutersRefusalIsSaidAndKept(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemQuestions()
 	refusing := &questionRefusingRouter{router: newRouter(), store: store}
 	within, every := RouterAnswersWithin, RouterAnswersEvery
@@ -244,7 +244,7 @@ func TestTheRoutersRefusalIsSaidAndKept(t *testing.T) {
 }
 
 func TestAnExpiredQuestionSaysWhatTheSessionDoes(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	key := askMergeTonight(t, p, store, r, t0)
 	r.close(asks.Warrant{Ask: key, Outcome: asks.OutcomeExpired, At: t0.Add(QuestionDefault)})
@@ -255,7 +255,7 @@ func TestAnExpiredQuestionSaysWhatTheSessionDoes(t *testing.T) {
 }
 
 func TestTheQuestionToolsAreServed(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	r := newRouter()
 	questions := newMemQuestions()
 	proposing = &Proposing{Store: &memProposals{m: map[string]json.RawMessage{}}, Bus: r, Now: func() time.Time { return t0 },
@@ -268,7 +268,7 @@ func TestTheQuestionToolsAreServed(t *testing.T) {
 			map[string]any{"label": "Merge now", "means": "I merge it", "recommended": true},
 			map[string]any{"label": "Wait", "means": "I leave it open"},
 		},
-		"why": "it is reviewed", "on_expiry": "I leave it open", "by": "fix-589@g14", "expires_minutes": 30,
+		"why": "it is reviewed", "on_expiry": "I leave it open", "by": "fix-589@node-b", "expires_minutes": 30,
 	})
 	if isErr || !strings.Contains(text, `"key"`) {
 		t.Fatalf("%v %s", isErr, text)
@@ -292,7 +292,7 @@ func TestAReadWaitsNoLongerThanItsBound(t *testing.T) {
 	if AnswerWaitsAtMost != 60*time.Second {
 		t.Fatalf("a read may wait %s; ADR 0332 says 60 s", AnswerWaitsAtMost)
 	}
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	key := askMergeTonight(t, p, store, r, t0)
 	most, every := AnswerWaitsAtMost, AnswerLooksEvery
@@ -369,7 +369,7 @@ func (s *memQuestions) Put(key string, value any) error {
 
 // The edges of ADR 0332 §2 that are allowed: a 60-character headline and 1430 minutes.
 func TestTheEdgesOfAQuestionAreAsked(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	in := mergeTonight()
 	in.Headline = strings.Repeat("x", 59) + "?"
 	in.Expires = 1430 * time.Minute
@@ -380,7 +380,7 @@ func TestTheEdgesOfAQuestionAreAsked(t *testing.T) {
 
 // A warrant naming another asker or another ask, or an option the question did not offer, is no answer to it.
 func TestAWarrantForAnotherAskOrOptionIsNotProven(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	for name, change := range map[string]func(*asks.Warrant){
 		"another asker":       func(w *asks.Warrant) { w.Asker = "mesh-controller" },
 		"another ask":         func(w *asks.Warrant) { w.Ask = "q-0000000000000000" },
@@ -400,7 +400,7 @@ func TestAWarrantForAnotherAskOrOptionIsNotProven(t *testing.T) {
 // Two nodes asking at the same moment take two slots at most: of three sessions racing, one is refused.
 func TestTheCapHoldsAcrossNodesAskingAtOnce(t *testing.T) {
 	store, r := newMemQuestions(), &lockedRouter{router: newRouter()}
-	nodes := []string{"g14", "shanks", "ace"}
+	nodes := []string{"node-b", "node-d", "node-a"}
 	var wg sync.WaitGroup
 	errs := make([]error, len(nodes))
 	for i, name := range nodes {
@@ -430,7 +430,7 @@ func TestTheCapHoldsAcrossNodesAskingAtOnce(t *testing.T) {
 
 // A slot that cannot be read refuses the question: the cap fails closed.
 func TestTheCapFailsClosed(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	store.failGet = "slot-"
 	if _, err := AskQuestion(p, mergeTonight(), store, r, t0); err == nil || !strings.Contains(err.Error(), "could not be counted") {
@@ -444,7 +444,7 @@ func TestTheCapFailsClosed(t *testing.T) {
 // A question whose refusal was not heard here, and of which the router holds no record, keeps its slot and reads as
 // waiting until it expires — the router may still take it from its queue — and only then frees its slot and ends.
 func TestAQuestionTheRouterHasNotRecordedHoldsItsSlotUntilItExpires(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	first := askMergeTonight(t, p, store, r, t0)
 	askMergeTonight(t, p, store, r, t0)
@@ -470,13 +470,13 @@ func TestAQuestionTheRouterHasNotRecordedHoldsItsSlotUntilItExpires(t *testing.T
 // A slot is taken only at the revision read: when another node takes both slots between this node's read and its
 // write, this node's writes are refused and the question is refused — a plain write would take a slot it lost.
 func TestASlotIsTakenOnlyAtTheRevisionRead(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store, r := newMemQuestions(), newRouter()
 	// Two questions that ended: their slots are free to take again.
 	for _, id := range []string{askMergeTonight(t, p, store, r, t0), askMergeTonight(t, p, store, r, t0)} {
 		r.close(asks.Warrant{Ask: id, Outcome: asks.OutcomeExpired, At: t0.Add(time.Minute)})
 	}
-	shanks, _ := node(t, "shanks")
+	nodeD, _ := node(t, "node-d")
 	other := newRouter()
 	store.afterGet = func(key string) {
 		if !strings.HasPrefix(key, "slot-") {
@@ -484,7 +484,7 @@ func TestASlotIsTakenOnlyAtTheRevisionRead(t *testing.T) {
 		}
 		// Another node asks between this node's read of the slot and its write: its question waits.
 		q := Question{ID: newQuestionID(), Headline: "Another", Context: "c", Why: "w", OnExpiry: "e", By: "other",
-			From: shanks.Node, At: t0, Expires: t0.Add(time.Hour),
+			From: nodeD.Node, At: t0, Expires: t0.Add(time.Hour),
 			Options: []QuestionOption{{ID: "o1", Label: "A", Means: "a", Recommended: true}, {ID: "o2", Label: "B", Means: "b"}}}
 		_ = store.Put(q.ID, q)
 		_ = other.Publish(asks.AskSubject(Module), q.Ask(), q.ID)

modules/claude-code/cmd/claude-code/session_start_test.go

@@ -122,7 +122,7 @@ func TestSessionStartRejectsAnUnsafeSessionID(t *testing.T) {
 func TestSessionStartListsEveryNameOnTheNodeWithOpenWaits(t *testing.T) {
 	waitsDir := t.TempDir()
 	lastCall := time.Date(2026, 10, 21, 9, 55, 0, 0, time.UTC)
-	idx := NodeIndex{Node: "g14", At: lastCall, Names: []NodeIndexEntry{
+	idx := NodeIndex{Node: "node-b", At: lastCall, Names: []NodeIndexEntry{
 		{Name: "fix-1629", Open: 2, CurrentSession: "sess-old", LastCall: lastCall},
 	}}
 	raw, err := indented(idx)
@@ -135,7 +135,7 @@ func TestSessionStartListsEveryNameOnTheNodeWithOpenWaits(t *testing.T) {
 	if !strings.Contains(msg, "fix-1629") || !strings.Contains(msg, "2 open wait") {
 		t.Fatalf("the name and its count are not listed:\n%s", msg)
 	}
-	want := `claude_code_wait {"op":"adopt","by":"fix-1629@g14","session":"sess-brand-new"}`
+	want := `claude_code_wait {"op":"adopt","by":"fix-1629@node-b","session":"sess-brand-new"}`
 	if !strings.Contains(msg, want) {
 		t.Fatalf("the exact adopt call is not given:\n%s\nwant it to contain:\n%s", msg, want)
 	}

modules/claude-code/cmd/claude-code/waits_test.go

@@ -77,13 +77,13 @@ func addApproveWait(t *testing.T, p Paths, store WaitStore, name, session string
 
 // 1629/AC1: add answers an id; list answers the open waits with their age and whether each is past its bound.
 func TestAddAnswersAnIDAndListShowsItsAgeAndPastBound(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	id := addApproveWait(t, p, store, "fix-1629", "sess-1", t0)
 	if !strings.HasPrefix(id, WaitPrefix) {
 		t.Fatalf("id %q does not start with %q", id, WaitPrefix)
 	}
-	out, err := ListWaits(p, "sess-1", "fix-1629@g14", store, t0.Add(time.Minute))
+	out, err := ListWaits(p, "sess-1", "fix-1629@node-b", store, t0.Add(time.Minute))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -91,7 +91,7 @@ func TestAddAnswersAnIDAndListShowsItsAgeAndPastBound(t *testing.T) {
 	if len(open) != 1 || open[0]["id"] != id || open[0]["past_bound"] != false || open[0]["age_seconds"] != 60 {
 		t.Fatalf("%+v", open)
 	}
-	out, err = ListWaits(p, "sess-1", "fix-1629@g14", store, t0.Add(11*time.Minute))
+	out, err = ListWaits(p, "sess-1", "fix-1629@node-b", store, t0.Add(11*time.Minute))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -104,9 +104,9 @@ func TestAddAnswersAnIDAndListShowsItsAgeAndPastBound(t *testing.T) {
 // 1629/AC2: watched, done and said change the wait; said is refused for a wait not past its bound; done removes
 // it from the open list.
 func TestWatchedDoneAndSaidChangeTheWait(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	id := addApproveWait(t, p, store, "fix-1629", "sess-2", t0)
 
 	if _, err := SaidWait(p, "sess-2", by, id, store, t0.Add(time.Minute)); err == nil || !strings.Contains(err.Error(), "not past its bound") {
@@ -143,9 +143,9 @@ func TestWatchedDoneAndSaidChangeTheWait(t *testing.T) {
 // 1629/AC3: every change rewrites the session's waits file whole, atomically; it holds exactly the open waits
 // and the write time.
 func TestEveryChangeRewritesTheWaitsFileWhole(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	id1 := addApproveWait(t, p, store, "fix-1629", "sess-3", t0)
 	f, err := readWaitsFile(waitsFilePath(p, "sess-3"))
 	if err != nil {
@@ -179,9 +179,9 @@ func TestEveryChangeRewritesTheWaitsFileWhole(t *testing.T) {
 // 1629/AC4: the waits are read again after the module "restarts" (the state is kept) and for the same name
 // after a /clear that keeps calling with the same session id; a different name lists none of them.
 func TestWaitsSurviveARestartAndAreNeverSeenByAnotherName(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	addApproveWait(t, p, store, "fix-1629", "sess-4", t0)
 
 	// A restart: a fresh Waiting over the same store reads the same waits.
@@ -199,7 +199,7 @@ func TestWaitsSurviveARestartAndAreNeverSeenByAnotherName(t *testing.T) {
 	}
 
 	// A different name, same node: none of them.
-	out, err = ListWaits(p, "sess-other", "fix-other@g14", store, t0.Add(2*time.Minute))
+	out, err = ListWaits(p, "sess-other", "fix-other@node-b", store, t0.Add(2*time.Minute))
 	if err != nil || len(out["open"].([]map[string]any)) != 0 {
 		t.Fatalf("another name saw them: %v %v", out, err)
 	}
@@ -208,7 +208,7 @@ func TestWaitsSurviveARestartAndAreNeverSeenByAnotherName(t *testing.T) {
 // 1629/AC5: add refuses an empty what, a bound under 1 or over 1440 minutes, a read address that is not an
 // address, and more than 50 open waits per name, naming the argument.
 func TestAddRefusesOutsideItsBounds(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	base := func() WaitInput {
 		return WaitInput{Session: "sess-5", By: "fix-1629@" + p.Node, What: "something", Read: WaitRead{Address: "mesh-delivery.recheck"}, Bound: 10}
 	}
@@ -247,8 +247,8 @@ func TestAddRefusesOutsideItsBounds(t *testing.T) {
 // Review round 1 item (b): list, watched, done and said refuse a session id that is not a plain one (the
 // same waitSessionID add already holds to), naming "session" — not silently treating it as just-another-key.
 func TestListWatchedDoneAndSaidRefuseABadSessionID(t *testing.T) {
-	p, _ := node(t, "g14")
-	by := "fix-1629@g14"
+	p, _ := node(t, "node-b")
+	by := "fix-1629@node-b"
 	for _, bad := range []string{"", "a/b", "../x"} {
 		store := newMemWaits()
 		if _, err := ListWaits(p, bad, by, store, t0); err == nil || !strings.Contains(err.Error(), "session") {
@@ -268,13 +268,13 @@ func TestListWatchedDoneAndSaidRefuseABadSessionID(t *testing.T) {
 
 // 1629/AC6: the tool is served through the module's own dispatch.
 func TestTheWaitToolIsServedThroughTheModulesDispatch(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
 	t.Cleanup(func() { waiting = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
 
-	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-6", "by": "fix-1629@g14",
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-6", "by": "fix-1629@node-b",
 		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
 	if isErr {
 		t.Fatalf("add: %s", text)
@@ -288,12 +288,12 @@ func TestTheWaitToolIsServedThroughTheModulesDispatch(t *testing.T) {
 		t.Fatalf("no id answered: %s", text)
 	}
 
-	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "list", "session": "sess-6", "by": "fix-1629@g14"})
+	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "list", "session": "sess-6", "by": "fix-1629@node-b"})
 	if isErr || !strings.Contains(text, id) {
 		t.Fatalf("list: %v %s", isErr, text)
 	}
 
-	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "done", "session": "sess-6", "by": "fix-1629@g14",
+	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "done", "session": "sess-6", "by": "fix-1629@node-b",
 		"id": id, "outcome": "approved"})
 	if isErr {
 		t.Fatalf("done: %s", text)
@@ -305,10 +305,10 @@ func TestTheWaitToolIsServedThroughTheModulesDispatch(t *testing.T) {
 // ADR 0490 §1: a name nothing has bound yet is claimed by the first session that calls for it (add), without
 // a separate adopt first.
 func TestAFirstAddBindsAnUnboundNameAtOnce(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	id := addApproveWait(t, p, store, "fix-1629", "sess-a", t0)
-	out, err := ListWaits(p, "sess-a", "fix-1629@g14", store, t0)
+	out, err := ListWaits(p, "sess-a", "fix-1629@node-b", store, t0)
 	if err != nil || len(out["open"].([]map[string]any)) != 1 || out["open"].([]map[string]any)[0]["id"] != id {
 		t.Fatalf("%v %v", out, err)
 	}
@@ -317,9 +317,9 @@ func TestAFirstAddBindsAnUnboundNameAtOnce(t *testing.T) {
 // ADR 0490 §1/§3: once a name is bound to a session, a different, non-adopted session calling for the same
 // name (any op) is refused, naming the session that holds it and when it last called.
 func TestADifferentSessionIsRefusedWithoutAdopting(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	addApproveWait(t, p, store, "fix-1629", "sess-old", t0)
 
 	if _, err := AddWait(p, WaitInput{Session: "sess-new", By: by, What: "another", Read: WaitRead{Address: "mesh-delivery.recheck"},
@@ -341,9 +341,9 @@ func TestADifferentSessionIsRefusedWithoutAdopting(t *testing.T) {
 // ADR 0490 §2/§3: adopt right after a simulated /clear binds the name to the new session id at once; the
 // mirrored file of the old session id is emptied and the new one holds the waits, with no delay.
 func TestAdoptRightAfterAClearBindsAtOnce(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	id := addApproveWait(t, p, store, "fix-1629", "sess-old", t0)
 
 	out, err := AdoptName(p, by, "sess-new", store, t0.Add(time.Minute))
@@ -376,9 +376,9 @@ func TestAdoptRightAfterAClearBindsAtOnce(t *testing.T) {
 // ADR 0490 §3: adopt of a name bound to another id always takes it over, however recently that id called —
 // no bound protects it.
 func TestAdoptAlwaysTakesOverEvenJustCalled(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	addApproveWait(t, p, store, "fix-1629", "sess-fresh", t0)
 	// sess-fresh calls again right before being adopted away from.
 	if _, err := ListWaits(p, "sess-fresh", by, store, t0.Add(10*time.Second)); err != nil {
@@ -396,9 +396,9 @@ func TestAdoptAlwaysTakesOverEvenJustCalled(t *testing.T) {
 // ADR 0490 §3: the earlier id's next claude_code_wait call (any op) answers that its name now answers to
 // another session, naming it.
 func TestTheEarlierIDIsToldOnItsNextCall(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	addApproveWait(t, p, store, "fix-1629", "sess-old", t0)
 	if _, err := AdoptName(p, by, "sess-new", store, t0.Add(time.Minute)); err != nil {
 		t.Fatal(err)
@@ -413,11 +413,11 @@ func TestTheEarlierIDIsToldOnItsNextCall(t *testing.T) {
 // ADR 0490 §2: the node-wide index lists every name on this node with an open wait, for the SessionStart
 // hook to read directly.
 func TestTheNodeWideIndexListsEveryNameWithOpenWaits(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	addApproveWait(t, p, store, "fix-1629", "sess-x", t0)
 	addApproveWait(t, p, store, "fix-1744", "sess-y", t0)
-	if _, err := DoneWait(p, "sess-x", "fix-1629@g14", wantsOnlyWait(t, store, p, "fix-1629", "sess-x"), "done",
+	if _, err := DoneWait(p, "sess-x", "fix-1629@node-b", wantsOnlyWait(t, store, p, "fix-1629", "sess-x"), "done",
 		store, t0.Add(time.Minute)); err != nil {
 		t.Fatal(err)
 	}
@@ -426,7 +426,7 @@ func TestTheNodeWideIndexListsEveryNameWithOpenWaits(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if idx.Node != "g14" || len(idx.Names) != 1 || idx.Names[0].Name != "fix-1744" || idx.Names[0].Open != 1 ||
+	if idx.Node != "node-b" || len(idx.Names) != 1 || idx.Names[0].Name != "fix-1744" || idx.Names[0].Open != 1 ||
 		idx.Names[0].CurrentSession != "sess-y" {
 		t.Fatalf("%+v", idx)
 	}
@@ -448,18 +448,18 @@ func wantsOnlyWait(t *testing.T, store WaitStore, p Paths, name, session string)
 
 // claude_code_wait op=adopt, served through the module's own dispatch (1629/AC6, ADR 0490).
 func TestAdoptIsServedThroughTheModulesDispatch(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	waiting = &Waiting{Store: store, Now: func() time.Time { return t0 }}
 	t.Cleanup(func() { waiting = nil })
 	s := serve(t, p, &bus{kept: map[string]map[string]any{}}, memConfig{})
 
-	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-old", "by": "fix-1629@g14",
+	text, isErr := s.call(t, "claude_code_wait", map[string]any{"op": "add", "session": "sess-old", "by": "fix-1629@node-b",
 		"what": "the operator's Approve", "read": map[string]any{"address": "mesh-delivery.recheck"}, "bound_minutes": 10})
 	if isErr {
 		t.Fatalf("add: %s", text)
 	}
-	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "adopt", "session": "sess-new", "by": "fix-1629@g14"})
+	text, isErr = s.call(t, "claude_code_wait", map[string]any{"op": "adopt", "session": "sess-new", "by": "fix-1629@node-b"})
 	if isErr || !strings.Contains(text, "sess-old") {
 		t.Fatalf("adopt: %v %s", isErr, text)
 	}
@@ -470,7 +470,7 @@ func TestAdoptIsServedThroughTheModulesDispatch(t *testing.T) {
 // Review round 2, item 2 (ADR 0490 §1): one session id with two different names bound to it holds both
 // names' waits in its one mirrored file, not only the name an op last acted on.
 func TestASessionsFileHoldsEveryNameBoundToIt(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	idX := addApproveWait(t, p, store, "fix-x", "sess-shared", t0)
 	idY := addApproveWait(t, p, store, "fix-y", "sess-shared", t0.Add(time.Minute))
@@ -491,12 +491,12 @@ func TestASessionsFileHoldsEveryNameBoundToIt(t *testing.T) {
 // Review round 2, item 2: adopting one of two names bound to the same session away keeps that session's
 // file holding the other name's waits — it is never emptied wholesale.
 func TestAdoptingOneNameAwayKeepsTheSessionsOtherNamesWaits(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
 	idX := addApproveWait(t, p, store, "fix-x", "sess-shared", t0)
 	idY := addApproveWait(t, p, store, "fix-y", "sess-shared", t0.Add(time.Minute))
 
-	if _, err := AdoptName(p, "fix-y@g14", "sess-y-new", store, t0.Add(2*time.Minute)); err != nil {
+	if _, err := AdoptName(p, "fix-y@node-b", "sess-y-new", store, t0.Add(2*time.Minute)); err != nil {
 		t.Fatal(err)
 	}
 
@@ -513,9 +513,9 @@ func TestAdoptingOneNameAwayKeepsTheSessionsOtherNamesWaits(t *testing.T) {
 // Review round 2, item b: adopt clears the refusal counter of both the earlier id and the new one, so a
 // fresh three-strikes count starts under the new binding.
 func TestAdoptClearsTheRefusalCounterOfBothIDs(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 	addApproveWait(t, p, store, "fix-1629", "sess-old", t0)
 	waitsDir := WaitsDirPath(p)
 	if err := writeRefusalCounters(waitsDir, "sess-old", map[string]int{"w-1": 2}); err != nil {
@@ -538,9 +538,9 @@ func TestAdoptClearsTheRefusalCounterOfBothIDs(t *testing.T) {
 // Review round 2, item c: list is read-only — it never binds an unbound name, and never refuses a
 // mismatched session; it answers the name's waits and who currently holds it.
 func TestListNeverBindsAndAnswersWhoHoldsTheName(t *testing.T) {
-	p, _ := node(t, "g14")
+	p, _ := node(t, "node-b")
 	store := newMemWaits()
-	by := "fix-1629@g14"
+	by := "fix-1629@node-b"
 
 	// An unbound name: list answers no waits, and binds nothing (a later add from a different session still
 	// succeeds, as the first caller for an unbound name).

modules/claude-licence-manager/cmd/claude-licence-manager/manager_test.go

@@ -347,7 +347,7 @@ func TestAReportIsReadAsTheAgentModuleWritesIt(t *testing.T) {
 func TestANodeReportingAnAdoptedAccountLaterIsBoundToIt(t *testing.T) {
 	mm := newMesh(t)
 	ctx := context.Background()
-	_, _ = mm.m.Consider(ctx, []Holdings{mm.login("novox", "rt-new", true, t0)})
+	_, _ = mm.m.Consider(ctx, []Holdings{mm.login("node-c", "rt-new", true, t0)})
 	late := mm.login("laptop", "rt-older", true, t0.Add(-24*time.Hour))
 	_, _ = mm.m.Consider(ctx, []Holdings{late})
 	if mm.state["laptop"].Licence != licence1 {
@@ -477,16 +477,16 @@ func TestEveryMoveSaysWhatWhyAndWho(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	asked := WithCause(ctx, Cause{Why: "the switch verb", By: "g14.node-tools"})
+	asked := WithCause(ctx, Cause{Why: "the switch verb", By: "node-b.node-tools"})
 	if _, err := mm.m.Bind(asked, "laptop", "api"); err != nil {
 		t.Fatal(err)
 	}
-	if s := mm.state["laptop"]; s.Why != "the switch verb" || s.By != "g14.node-tools" {
+	if s := mm.state["laptop"]; s.Why != "the switch verb" || s.By != "node-b.node-tools" {
 		t.Fatalf("the node is told %+v", s)
 	}
 	said := strings.Join(lines, "\n")
 	if !strings.Contains(said, "switched laptop from "+licence1+" to api (generation ") ||
-		!strings.Contains(said, "the switch verb; asked by g14.node-tools") {
+		!strings.Contains(said, "the switch verb; asked by node-b.node-tools") {
 		t.Fatalf("the journal said:\n%s", said)
 	}
 	var switched string
@@ -495,18 +495,18 @@ func TestEveryMoveSaysWhatWhyAndWho(t *testing.T) {
 			switched = e
 		}
 	}
-	for _, want := range []string{`"by":"g14.node-tools"`, `"from":"` + licence1 + `"`, `"licence":"api"`, `"consumer":"laptop"`, `"generation":`} {
+	for _, want := range []string{`"by":"node-b.node-tools"`, `"from":"` + licence1 + `"`, `"licence":"api"`, `"consumer":"laptop"`, `"generation":`} {
 		if !strings.Contains(switched, want) {
 			t.Fatalf("the event %q lacks %s; events %v", switched, want, mm.events)
 		}
 	}
 	last := mm.store.Audits[len(mm.store.Audits)-1]
-	if raw, _ := json.Marshal(last); !strings.Contains(string(raw), `"by":"g14.node-tools"`) || !strings.Contains(string(raw), "switched") {
+	if raw, _ := json.Marshal(last); !strings.Contains(string(raw), `"by":"node-b.node-tools"`) || !strings.Contains(string(raw), "switched") {
 		t.Fatalf("the audit kept %s", raw)
 	}
 
-	_, _ = mm.m.Rotate(WithCause(ctx, Cause{Why: "the refresh verb", By: "novox.node-tools"}), licence1, true)
-	if !strings.Contains(strings.Join(mm.events, "|"), `licence.rotated {"by":"novox.node-tools"`) {
+	_, _ = mm.m.Rotate(WithCause(ctx, Cause{Why: "the refresh verb", By: "node-c.node-tools"}), licence1, true)
+	if !strings.Contains(strings.Join(mm.events, "|"), `licence.rotated {"by":"node-c.node-tools"`) {
 		t.Fatalf("a rotation asked for said no caller: %v", mm.events)
 	}
 

modules/clipmenu/cmd/clipmenu-tools/manifest_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"bufio"
 	"context"
 	"net"
 	"os"
@@ -171,33 +170,20 @@ func TestTheLauncherWaitsQuietlyWhileAnotherClipmenudHoldsTheLock(t *testing.T)
 	store := dir + "/cm/clipmenu.6.op"
 	os.MkdirAll(store, 0o700)
 	lock := store + "/session_lock"
-	// the older clipmenud: it holds the lock the way clipmenud does, until it is killed. It says "held" once it has the
-	// lock, so the test goes on only when the lock is held for certain: a holder that is slow to start (the checker
-	// runs thousands of tests at once) must not let the launcher find the lock free (issue 1814).
-	holder := exec.Command("flock", "-x", "-n", lock, "sh", "-c", "echo held; exec sleep 60")
+	// the older clipmenud: it holds the lock the way clipmenud does, until it is killed
+	holder := exec.Command("flock", "-x", "-n", lock, "sleep", "60")
 	holder.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	held, err := holder.StdoutPipe()
-	if err != nil {
-		t.Fatal(err)
-	}
 	if err := holder.Start(); err != nil {
 		t.Fatal(err)
 	}
 	// flock's child shares the lock, so the whole group goes
 	release := func() { syscall.Kill(-holder.Process.Pid, syscall.SIGKILL); holder.Wait() }
 	defer release()
-	said := make(chan string, 1)
-	go func() {
-		line, _ := bufio.NewReader(held).ReadString('\n')
-		said <- strings.TrimSpace(line)
-	}()
-	select {
-	case line := <-said:
-		if line != "held" {
-			t.Fatalf("the older clipmenud did not take the lock: %q", line)
+	for i := 0; i < 50; i++ {
+		if probe := exec.Command("flock", "-n", lock, "true"); probe.Run() != nil {
+			break
 		}
-	case <-time.After(30 * time.Second):
-		t.Fatal("the older clipmenud did not take the lock within 30 s")
+		time.Sleep(50 * time.Millisecond)
 	}
 	var out syncBuffer
 	cmd := exec.Command("sh", file)

modules/cups/README.md

@@ -22,7 +22,7 @@ Research 027 asked for "`cups` with the printer's driver". Measured on 2026-10-0
 | workstation | queue | device | prints through | driver package installed |
 |---|---|---|---|---|
 | laptop | `Brother` (MFC-L8690CDW) | `ipp://` on the LAN | **IPP Everywhere, driverless** | `brother-mfc-l8690cdw` (AUR), unused |
-| desktop | `Brother_MFC_Novox` (default) | `ipp://` on the LAN | **IPP Everywhere, driverless** | `brother-mfc-l8390cdw` and its `-debug` (AUR), unused |
+| desktop | `Brother_MFC_NodeC` (default) | `ipp://` on the LAN | **IPP Everywhere, driverless** | `brother-mfc-l8390cdw` and its `-debug` (AUR), unused |
 | desktop | `Kanjuro` (Canon PIXMA MG4200) | `cnijnet:` | the vendor's PPD and filter | `cnijfilter-mg4200` 3.80 (AUR) |
 
 **Both Brother queues already print without a vendor driver.** CUPS's own IPP Everywhere support,

modules/cups/cmd/cups-tools/cups_test.go

@@ -36,13 +36,13 @@ func theDesktop(t *testing.T, more func(line string, c Cmd) (Result, bool)) *fak
 		case "lpstat -r":
 			return ok("scheduler is running\n")
 		case "lpstat -d":
-			return ok("system default destination: Brother_MFC_Novox\n")
+			return ok("system default destination: Brother_MFC_NodeC\n")
 		case "lpstat -p":
-			return ok("printer Brother_MFC_Novox is idle.  enabled since Mon Jun 29 21:34:30 2026\n" +
+			return ok("printer Brother_MFC_NodeC is idle.  enabled since Mon Jun 29 21:34:30 2026\n" +
 				"printer Kanjuro disabled since Sun Jun  9 11:16:03 2024 -\n\tPaused\n")
 		case "lpstat -a":
-			return ok("Brother_MFC_Novox accepting requests since Mon Jun 29 21:34:30 2026\nKanjuro not accepting requests since Sun Jun  9 11:16:03 2024 -\n\tRejecting Jobs\n")
-		case "lpoptions -p Brother_MFC_Novox":
+			return ok("Brother_MFC_NodeC accepting requests since Mon Jun 29 21:34:30 2026\nKanjuro not accepting requests since Sun Jun  9 11:16:03 2024 -\n\tRejecting Jobs\n")
+		case "lpoptions -p Brother_MFC_NodeC":
 			return ok(`copies=1 device-uri=ipp://192.0.2.171/ipp/port1 finishings=3 marker-levels=70,100,8,100 marker-low-levels=10,10,10,10 marker-names='Black\ Toner\ Cartridge,Cyan\ Toner\ Cartridge,Magenta\ Toner\ Cartridge,Yellow\ Toner\ Cartridge' marker-types=toner,toner,toner,toner printer-is-shared=false printer-make-and-model='Printer - IPP Everywhere' printer-state-reasons=none`)
 		case "lpoptions -p Kanjuro":
 			return ok(`device-uri=cnijnet:/18-0C-AC-B0-62-83 printer-is-shared=false printer-make-and-model='Canon MG4200 series Ver.3.80' printer-state-reasons=paused`)
@@ -54,7 +54,7 @@ func theDesktop(t *testing.T, more func(line string, c Cmd) (Result, bool)) *fak
 func TestPrintersReadsStateDeviceModelAndSupplies(t *testing.T) {
 	theDesktop(t, nil)
 	got, err := Printers()
-	if err != nil || len(got.Printers) != 2 || got.Default != "Brother_MFC_Novox" || got.Scheduler != "scheduler is running" {
+	if err != nil || len(got.Printers) != 2 || got.Default != "Brother_MFC_NodeC" || got.Scheduler != "scheduler is running" {
 		t.Fatalf("%+v %v", got, err)
 	}
 	b, k := got.Printers[0], got.Printers[1]
@@ -186,11 +186,11 @@ func TestDefaultReadsAndSetsThroughSudo(t *testing.T) {
 		return Result{}, false
 	})
 	got, err := Default("")
-	if err != nil || got["default"] != "Brother_MFC_Novox" {
+	if err != nil || got["default"] != "Brother_MFC_NodeC" {
 		t.Fatalf("%v %v", got, err)
 	}
 	got, err = Default("Kanjuro")
-	if err != nil || got["default"] != "Kanjuro" || got["was"] != "Brother_MFC_Novox" {
+	if err != nil || got["default"] != "Kanjuro" || got["was"] != "Brother_MFC_NodeC" {
 		t.Fatalf("%v %v", got, err)
 	}
 	if l := f.lines(); l[len(l)-1] != "sudo -n lpadmin -d Kanjuro" {

modules/desk-channel/cmd/desk-channel/desk_test.go

@@ -133,7 +133,7 @@ func TestANotifierThatStartedAgainIsShownNothingFromMemory(t *testing.T) {
 	d, shown, said, store := newDesk(t, "laptop")
 	d.Paused("laptop", false)
 	d.SayStanding()
-	take(t, d, asks.Show, asks.Message{Handle: "open", Title: "2 failed services on shanks",
+	take(t, d, asks.Show, asks.Message{Handle: "open", Title: "2 failed services on node-d",
 		Buttons: []asks.Button{{Label: "Silence for a week", Ticket: "t-open"}}})
 	take(t, d, asks.Show, asks.Message{Handle: "silenced", Title: "Agent-home shrank",
 		Buttons: []asks.Button{{Label: "Silence for a week", Ticket: "t-silenced"}}})
@@ -162,7 +162,7 @@ func TestANotifierThatStartedAgainIsShownNothingFromMemory(t *testing.T) {
 		t.Fatalf("the standing after the start: %d said, last %s", len(got)-standings, got[len(got)-1])
 	}
 	// The router says the open one again under its handle: in place of its notification, with its answers.
-	take(t, d, asks.Show, asks.Message{Handle: "open", Title: "2 failed services on shanks",
+	take(t, d, asks.Show, asks.Message{Handle: "open", Title: "2 failed services on node-d",
 		Buttons: []asks.Button{{Label: "Silence for a week", Ticket: "t-open"}}})
 	last := (*shown)[len(*shown)-1]
 	if len(*shown) != before+1 || last.args["replace_id"] != openID || last.args["actions"] == nil {
@@ -329,7 +329,7 @@ func TestItRunsAsItsOwnAccount(t *testing.T) {
 // was not shown; a message under a new handle replaces nothing.
 func TestAMessageSaidAgainUnderItsHandleReplacesItsNotification(t *testing.T) {
 	d, shown, _, store := newDesk(t, "laptop", "desktop")
-	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "2 failed services on shanks"})
+	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "2 failed services on node-d"})
 	take(t, d, asks.Send, asks.Message{Handle: "m2", Title: "another problem"})
 	if len(*shown) != 4 {
 		t.Fatalf("shown %d", len(*shown))
@@ -342,7 +342,7 @@ func TestAMessageSaidAgainUnderItsHandleReplacesItsNotification(t *testing.T) {
 	first := store["m1"].On
 	// The desk now names a third machine as well.
 	d.Machines = func() []string { return []string{"laptop", "desktop", "third"} }
-	take(t, d, asks.Show, asks.Message{Handle: "m1", Title: "Still open: 2 failed services on shanks", Urgent: true,
+	take(t, d, asks.Show, asks.Message{Handle: "m1", Title: "Still open: 2 failed services on node-d", Urgent: true,
 		Buttons: []asks.Button{{Label: "Silence for a week", Ticket: "t1"}}})
 	again := (*shown)[4:]
 	if len(again) != 3 {
@@ -367,7 +367,7 @@ func TestAMessageSaidAgainUnderItsHandleReplacesItsNotification(t *testing.T) {
 // later edit or clearing still reaches it; failing everywhere, it is said to the router as failed.
 func TestAFailedReplaceKeepsTheNotificationItWasToReplace(t *testing.T) {
 	d, shown, said, store := newDesk(t, "laptop", "desktop")
-	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "2 failed services on shanks"})
+	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "2 failed services on node-d"})
 	first := store["m1"].On
 	notify := d.Notify
 	d.Notify = func(machine string, args map[string]any) (json.RawMessage, error) {
@@ -376,12 +376,12 @@ func TestAFailedReplaceKeepsTheNotificationItWasToReplace(t *testing.T) {
 		}
 		return notify(machine, args)
 	}
-	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "Still open: 2 failed services on shanks"})
+	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "Still open: 2 failed services on node-d"})
 	if got := store["m1"].On["desktop"]; got != first["desktop"] {
 		t.Fatalf("the desktop's notification %d was forgotten: %v", first["desktop"], store["m1"].On)
 	}
 	d.Notify = func(string, map[string]any) (json.RawMessage, error) { return nil, errors.New("away") }
-	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "Now urgent: 2 failed services on shanks"})
+	take(t, d, asks.Send, asks.Message{Handle: "m1", Title: "Now urgent: 2 failed services on node-d"})
 	if len(said[asks.IntakeSubject(asks.FailedWhat, Kind)]) != 1 {
 		t.Fatalf("shown nowhere, and not said as failed")
 	}

modules/disk-load/cmd/disk-load/tools_test.go

@@ -49,7 +49,8 @@ func TestTheManifestNamesExactlyTheToolsTheBundleServesAndNoMachine(t *testing.T
 	if len(m.Resources) != 0 {
 		t.Errorf("the module only reads, and declares %d resources", len(m.Resources))
 	}
-	for _, banned := range []string{"g14", "novox", "ace", "shanks", "jochen", "/home/"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, banned := range []string{"jochen", "/home/"} {
 		if strings.Contains(string(raw), banned) {
 			t.Errorf("the manifest says %q", banned)
 		}

modules/dnsmasq/cmd/dnsmasq-tools/dnsmasq_test.go

@@ -134,8 +134,8 @@ func aResolverMachine(t *testing.T, port string, now func() time.Time) *Machine
 		}
 	}
 	write(ConfigFile, "bind-interfaces\nlisten-address=127.0.0.2\nlisten-address=127.0.0.1\nno-resolv\n")
-	write(NodesFile, "local=/internal/\naddress=/novox.internal/127.0.0.2\nhost-record=novox.internal,127.0.0.2\n"+
-		"address=/ace.internal/10.77.0.2\nhost-record=ace.internal,10.77.0.2\n")
+	write(NodesFile, "local=/internal/\naddress=/node-c.internal/127.0.0.2\nhost-record=node-c.internal,127.0.0.2\n"+
+		"address=/node-a.internal/10.77.0.2\nhost-record=node-a.internal,10.77.0.2\n")
 	if err := os.MkdirAll(filepath.Join(root, filepath.Dir(StateFile)), 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -147,13 +147,13 @@ func TestTheConfigurationAndTheRosterSayWhereAndWhatToAsk(t *testing.T) {
 	if strings.Join(listen, " ") != "10.77.0.1 127.0.0.1" {
 		t.Fatalf("listen addresses %v", listen)
 	}
-	names := AnsweredNames("local=/internal/\naddress=/ace.internal/10.77.0.2\nhost-record=ace.internal,10.77.0.2\n" +
-		"host-record=novox.internal,10.77.0.1\n")
+	names := AnsweredNames("local=/internal/\naddress=/node-a.internal/10.77.0.2\nhost-record=node-a.internal,10.77.0.2\n" +
+		"host-record=node-c.internal,10.77.0.1\n")
 	q, ok := Question(listen, names)
-	if !ok || q.Name != "novox.internal" || q.Address != "10.77.0.1" {
+	if !ok || q.Name != "node-c.internal" || q.Address != "10.77.0.1" {
 		t.Fatalf("asks %+v", q)
 	}
-	if q, _ := Question([]string{"127.0.0.1"}, names); q.Name != "ace.internal" {
+	if q, _ := Question([]string{"127.0.0.1"}, names); q.Name != "node-a.internal" {
 		t.Fatalf("with no own name in the roster, asks %+v", q)
 	}
 }
@@ -165,7 +165,7 @@ func TestALookFindsAResolverThatStoppedAnsweringOnOneAddress(t *testing.T) {
 	m := aResolverMachine(t, port, time.Now)
 	private := startStandIn(t, "127.0.0.2", port, "127.0.0.2")
 	startStandIn(t, "127.0.0.1", port, "127.0.0.2")
-	if l := m.Look(t.Context()); !l.Healthy || len(l.Answers) != 4 || l.Asked.Name != "novox.internal" {
+	if l := m.Look(t.Context()); !l.Healthy || len(l.Answers) != 4 || l.Asked.Name != "node-c.internal" {
 		t.Fatalf("a resolver answering everywhere: %+v", l)
 	}
 	private.stop()
@@ -173,14 +173,14 @@ func TestALookFindsAResolverThatStoppedAnsweringOnOneAddress(t *testing.T) {
 	if l.Healthy || len(l.Wrong) != 2 {
 		t.Fatalf("a resolver that stopped answering on its private address: %+v", l)
 	}
-	if why := l.Why(); !strings.Contains(why, "127.0.0.2:"+port+" over udp did not answer novox.internal: refused") ||
+	if why := l.Why(); !strings.Contains(why, "127.0.0.2:"+port+" over udp did not answer node-c.internal: refused") ||
 		!strings.Contains(why, "over tcp") || strings.Contains(why, "127.0.0.1:") {
 		t.Fatalf("said as %q", why)
 	}
 }
 
 func TestAWrongAnswerIsNotAnAnswer(t *testing.T) {
-	q := Named{Name: "novox.internal", Address: "10.77.0.1"}
+	q := Named{Name: "node-c.internal", Address: "10.77.0.1"}
 	for _, c := range []struct {
 		a    Answer
 		want string
@@ -198,7 +198,7 @@ func TestAWrongAnswerIsNotAnAnswer(t *testing.T) {
 
 func failing(at time.Time) Look {
 	return Look{At: at, Answers: []Answer{{Server: "10.77.0.1:53", Over: "udp", Failed: "refused: nothing listens there"}},
-		Wrong: []string{"10.77.0.1:53 over udp did not answer novox.internal: refused: nothing listens there"}}
+		Wrong: []string{"10.77.0.1:53 over udp did not answer node-c.internal: refused: nothing listens there"}}
 }
 
 func healthy(at time.Time) Look { return Look{At: at, Healthy: true} }
@@ -323,7 +323,7 @@ func TestTheWatchRestartsAResolverThatStoppedAnsweringAndHealthSaysWhetherItHelp
 		look()
 	}
 	h := m.Health(t.Context())
-	if h.Healthy || !strings.Contains(h.Why, "did not answer novox.internal: refused") ||
+	if h.Healthy || !strings.Contains(h.Why, "did not answer node-c.internal: refused") ||
 		!strings.Contains(h.Why, "which did not help") {
 		t.Fatalf("a restart that did not help: %q", h.Why)
 	}
@@ -482,10 +482,10 @@ func TestResolveAsksOnlyAListenAddress(t *testing.T) {
 	m := aResolverMachine(t, port, time.Now)
 	startStandIn(t, "127.0.0.2", port, "127.0.0.2")
 	startStandIn(t, "127.0.0.1", port, "127.0.0.2")
-	if _, err := m.Resolve(t.Context(), "novox.internal", "8.8.8.8", ""); err == nil || !strings.Contains(err.Error(), "not one the resolver listens on") {
+	if _, err := m.Resolve(t.Context(), "node-c.internal", "8.8.8.8", ""); err == nil || !strings.Contains(err.Error(), "not one the resolver listens on") {
 		t.Fatalf("another address was asked: %v", err)
 	}
-	got, err := m.Resolve(t.Context(), "novox.internal", "127.0.0.2", "tcp")
+	got, err := m.Resolve(t.Context(), "node-c.internal", "127.0.0.2", "tcp")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -493,10 +493,10 @@ func TestResolveAsksOnlyAListenAddress(t *testing.T) {
 	if len(answers) != 1 || answers[0].Over != "tcp" || answers[0].Code != "NOERROR" || answers[0].Addresses[0] != "127.0.0.2" {
 		t.Fatalf("%+v", answers)
 	}
-	if got, _ := m.Resolve(t.Context(), "novox.internal", "", ""); len(got.(map[string]any)["answers"].([]Answer)) != 4 {
+	if got, _ := m.Resolve(t.Context(), "node-c.internal", "", ""); len(got.(map[string]any)["answers"].([]Answer)) != 4 {
 		t.Fatalf("every listen address over both: %+v", got)
 	}
-	if _, err := m.Resolve(t.Context(), "novox.internal", "", "quic"); err == nil {
+	if _, err := m.Resolve(t.Context(), "node-c.internal", "", "quic"); err == nil {
 		t.Fatal("over quic was accepted")
 	}
 	if _, err := m.Resolve(t.Context(), "", "", ""); err == nil {
@@ -540,12 +540,12 @@ func TestTheAnnouncerSaysWhatChangedAndRemembersOnlyWhatWasSaid(t *testing.T) {
 	}
 	// The roster changes: one machine added, one gone. An unreadable roster says nothing.
 	nodes := filepath.Join(m.Root, NodesFile)
-	if err := os.WriteFile(nodes, []byte("host-record=novox.internal,127.0.0.2\nhost-record=shanks.internal,10.77.0.4\n"), 0o644); err != nil {
+	if err := os.WriteFile(nodes, []byte("host-record=node-c.internal,127.0.0.2\nhost-record=node-d.internal,10.77.0.4\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	Tell(m, &a, emit)
-	if got := strings.Join(said, "|"); !strings.Contains(got, "name.added shanks.internal") ||
-		!strings.Contains(got, "name.removed ace.internal") || len(said) != 2 {
+	if got := strings.Join(said, "|"); !strings.Contains(got, "name.added node-d.internal") ||
+		!strings.Contains(got, "name.removed node-a.internal") || len(said) != 2 {
 		t.Fatalf("the roster's change: %v", said)
 	}
 	said = nil

modules/docker/cmd/docker-tools/resolv_test.go

@@ -32,7 +32,7 @@ func archiveOf(t *testing.T, h tar.Header, body string) string {
 // Issue 348: route-proxy asked 10.10.0.1 alone while the machine listed both mesh resolvers; its copy
 // of the file could not be read by anything on the mesh.
 func TestAContainersResolverFileIsReadThroughTheArchiveAndComparedWithTheMachines(t *testing.T) {
-	inside := "# Generated by Docker Engine.\nnameserver 10.10.0.1\nsearch novox.internal\noptions timeout:1 attempts:2\n"
+	inside := "# Generated by Docker Engine.\nnameserver 10.10.0.1\nsearch node-c.internal\noptions timeout:1 attempts:2\n"
 	f := (&fake{}).on("docker cp route-proxy:/etc/resolv.conf -",
 		Ran{Stdout: archiveOf(t, tar.Header{Name: "resolv.conf", Typeflag: tar.TypeReg, Mode: 0o644}, inside)})
 	c := client(f, 1000)
@@ -47,7 +47,7 @@ func TestAContainersResolverFileIsReadThroughTheArchiveAndComparedWithTheMachine
 		t.Fatal(err)
 	}
 	rc := got["resolv_conf"].(ResolvConf)
-	if strings.Join(rc.Nameservers, ",") != "10.10.0.1" || strings.Join(rc.Search, ",") != "novox.internal" ||
+	if strings.Join(rc.Nameservers, ",") != "10.10.0.1" || strings.Join(rc.Search, ",") != "node-c.internal" ||
 		strings.Join(rc.Options, ",") != "timeout:1,attempts:2" || rc.Raw != inside {
 		t.Fatalf("parsed: %+v", rc)
 	}

modules/dunst/cmd/dunst-tools/actions_test.go

@@ -17,7 +17,7 @@ func TestANotificationsChosenAnswerIsSaidAsAnEvent(t *testing.T) {
 	withBus(t)
 	bin := fakeBinaries(t, map[string]string{"notify-send": `for a in "$@"; do printf '[%s]' "$a"; done > "$LOG"; echo 42; sleep 0.2; echo "$CHOSEN"`})
 	t.Setenv("LOG", filepath.Join(bin, "log"))
-	t.Setenv("MESH_NODE", "g14")
+	t.Setenv("MESH_NODE", "node-b")
 	var mu sync.Mutex
 	var said []map[string]any
 	before := emit
@@ -58,7 +58,7 @@ func TestANotificationsChosenAnswerIsSaidAsAnEvent(t *testing.T) {
 		time.Sleep(20 * time.Millisecond)
 	}
 	mu.Lock()
-	if len(said) != 1 || said[0]["token"] != "c3d4" || said[0]["id"] != 42 || said[0]["machine"] != "g14" {
+	if len(said) != 1 || said[0]["token"] != "c3d4" || said[0]["id"] != 42 || said[0]["machine"] != "node-b" {
 		t.Fatalf("said %v", said)
 	}
 	said = nil
@@ -96,7 +96,7 @@ func TestActionsAreRefusedForWhatTheyCannotBe(t *testing.T) {
 // **A bundle that started says so**, so the operator channel shows again the answers lost with the one
 // before.
 func TestABundleThatStartedSaysSo(t *testing.T) {
-	t.Setenv("MESH_NODE", "g14")
+	t.Setenv("MESH_NODE", "node-b")
 	var said []string
 	before := emit
 	emit = func(event string, body any) error {
@@ -105,7 +105,7 @@ func TestABundleThatStartedSaysSo(t *testing.T) {
 	}
 	t.Cleanup(func() { emit = before })
 	sayStarted()
-	if len(said) != 1 || said[0] != "started map[machine:g14]" {
+	if len(said) != 1 || said[0] != "started map[machine:node-b]" {
 		t.Fatalf("%v", said)
 	}
 }

modules/dunst/cmd/dunst-tools/manifest_helpers_test.go

@@ -227,7 +227,8 @@ func checkNoSecretsOrInstallationNames(t *testing.T) {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/fail2ban/cmd/fail2ban-tools/own.go

@@ -48,7 +48,7 @@ const (
 // the operator's own addresses. fail2ban keeps a file entry in its own form, not as written: it reads
 // `file:/var/lib/…` and prints it back as `file://var/lib/…` (server/ipdns.py, FileIPAddrSet.__repr__, in 1.1),
 // in `get <jail> ignoreip` and in its `Ignore … by …` lines alike. So the path is compared, with fail2ban's own
-// reading of the slashes after `file:`, never the text (seen on ace on 2026-10-13: every jail held the list
+// reading of the slashes after `file:`, never the text (seen on node-a on 2026-10-13: every jail held the list
 // and the watch said none did).
 func isOurList(word string) bool {
 	path, ok := strings.CutPrefix(strings.TrimSpace(word), "file:")

modules/fail2ban/cmd/fail2ban-tools/own_test.go

@@ -16,7 +16,7 @@ import (
 )
 
 // asPrinted is the list's entry as fail2ban 1.1 prints it back, in `get <jail> ignoreip` and in its log: it reads
-// `file:/var/lib/…` and keeps it as `file://var/lib/…` (FileIPAddrSet.__repr__), as ace's daemon printed it on
+// `file:/var/lib/…` and keeps it as `file://var/lib/…` (FileIPAddrSet.__repr__), as node-a's daemon printed it on
 // 2026-10-13.
 const asPrinted = "file://var/lib/mesh-fail2ban/own-addresses"
 

modules/feh/cmd/feh-tools/manifest_helpers_test.go

@@ -259,7 +259,8 @@ func checkNoSecretsOrInstallationNames(t *testing.T) {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/forticlient/cmd/forticlient-tools/manifest_test.go

@@ -82,7 +82,8 @@ func TestTheToolsAgreeWithTheManifest(t *testing.T) {
 		t.Errorf("the Go tools bundle: %v", b)
 	}
 	s := strings.ToLower(raw)
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "http", "password", "token"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "http", "password", "token"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/gitea/.gitignore

@@ -1,2 +0,0 @@
-# The test script compiles the sources beside themselves before the tests import them (package.json, issue 1891).
-*.js

modules/gitea/README.md

@@ -22,18 +22,16 @@ Every new head of an open pull request is announced as `pull.updated`, once, and
   minutes, or when the search fails.
 - **A pull request nobody checks is said — by the delivery's owner, not here.** `gitea_open_pulls` answers every
   open pull request from the forge itself, with the statuses its base requires and the ones its head has. The
-  delivery gate asks it every five minutes, and a head on a base requiring `mesh/check` (or hq's
-  `mesh/repo-check`) with none of them for ten minutes since it first saw it so is a delivery held past its bound
+  `mesh-delivery` module asks it every five minutes, and a head on a base requiring `mesh/merge-gate` or
+  `mesh/repo-check` with neither for ten minutes since it first saw it so is a delivery held past its bound
   (`delivery.<id>.stalled`, state `unannounced`), which the controller raises like any other (issue 347).
   Each of the head's statuses comes with its state and when it was set, so a head whose check started and never
   answered — a required check pending, or never set beside one that is — is said as a stalled line in the state
   `unanswered` once that has lasted the delivery table's bound for a check asked and not answered, an hour, counted
   from its first sight and again only when a check is asked anew (issue 438).
 - **How to see it work.** A pull request opened more than a minute after its branch was pushed — this fix's own
-  was one, and the announcer it fixes never saw it — is announced within a pass of the next sweep at the latest, its
-  `mesh/check` is the checker's to set, and `mesh-controller.conditions` names none for it. (Since issue 1301 this
-  module writes `mesh/merge-gate` only where a base still requires it, and none does once the forge requires
-  `mesh/check`.)
+  was one, and the announcer it fixes never saw it — has `mesh/merge-gate` pending within a pass of the next sweep
+  at the latest, and `mesh-controller.conditions` names none for it.
 - **A pull request or issue number that is not one is refused** before the forge is asked: a tool called with a
   misnamed argument sent `pulls/NaN`.
 
@@ -156,19 +154,15 @@ listed repository:
   naming the description, and a `merge-check.sh` declaring `# mesh-check-toolchain: go` that vets and runs the unit
   tests, then the integration tests (`-tags integration`), of every Go module in the tree, and says so and passes on
   a tree with none. The rule is then narrowed to main's rule of ADR 0398 §2 (no push, only `mesh-tools` merges),
-  requiring `mesh/check` (ADR 0447 §1, issue 1301), and only then is the repository moved into the organisation.
+  requiring `mesh/repo-check` and `mesh/merge-gate`, and only then is the repository moved into the organisation.
   There main's rule is read back and put right once more (the step `rule-after-move`): the forge drops from a merge
   list a user without access to the repository, and under the setup account `mesh-tools` has none;
 - one found still under the setup account is finished: the steps it lacks are done, main is never written twice;
-- one in the organisation is only put right: main's rule narrowed, `mesh/check` required in place of
-  `mesh/merge-gate` and `mesh/repo-check`, and every other status already there kept. A main that requires
-  `mesh/repo-check` without `mesh/merge-gate` is judged by its own script alone (hq, ADR 0503 §5, until issue 1296)
-  and keeps it; `mesh/check` is never dropped.
+- one in the organisation is only put right: main's rule narrowed, a missing one of the two statuses added and every
+  status already there kept.
 
-Every other repository of the organisation whose main requires `mesh/merge-gate` has the two old statuses swapped
-for `mesh/check`, and only its statuses (issue 1301): the switch reaches every repository the merge gate judged, with
-no list kept by hand. A step the forge refuses stops that repository, and the others go on. Beyond that swap, a
-repository taken out of the value is never changed: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
+A step the forge refuses stops that repository, and the others go on. A repository taken out of the value is never
+asked about: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
 `repositories-outcome.json`.
 
 **How a refusal is seen.** `repositories sync` is a run-once process, declared as the module's last resource, so

modules/gitea/check.ts

@@ -1,188 +0,0 @@
-// **mesh/check is written from the checker's owed state, read by a watch** (ADR 0521; R4e round 2 finding R2-1; finding K1
-// before it; novox/hq issue 1301; ADR 0447 §1, ADR 0503 §3: main requires mesh/check alone).
-//
-// No tool writes mesh/check: a tool is told no caller, and the console every agent session speaks through (node-tools)
-// invokes every tool, so a tool that wrote it could be called by any session to merge past the checker (the fault issue
-// 293 closed for the two statuses before it). Nor does an event: nothing in the delivery plan orders this module before the
-// forge bridge, and a durable consumer whose filters change keeps its deliver policy, so an event said before this module
-// consumed it was lost. The checker keeps what it owes the forge in its state `owed` (ADR 0484 §2), which it announces
-// readable (ADR 0495 §2-§3), and only the checker writes it. This module watches it: the watch hands over the latest value of
-// every key when it starts, whenever that is, and then every change. Each key whose act is the status mesh/check is
-// written on its head, once per revision; a revision older than one already written on the key is dropped.
-//
-// A read refused (the grant not yet composed) is said once and asked again on a bound until it holds. A forge that refuses
-// a status is asked again on a bound, until it writes or a newer revision of the key comes.
-
-import type { CommitStatus } from "./client.js";
-import { bindUntilHeld, bindWait } from "./bind.js";
-import { checkName } from "./guard.js";
-import { CHECK_STATUS } from "./pulls.js";
-
-/** The checker's state this module reads, and the act of its keys this module writes. */
-export const CHECKER_OWED = "mesh-delivery-checker.owed";
-export const CHECK_ACT = `status=${CHECK_STATUS}`;
-
-const states = new Set(["pending", "success", "error", "failure", "warning"]);
-
-/** What writing the check needs of the forge. */
-export interface CheckForge {
-  setCommitStatus(owner: string, repo: string, sha: string, status: CommitStatus): Promise<void>;
-}
-
-/** One change of the checker's owed, as the SDK's state watch hands it. */
-export interface OwedChange {
-  key: string;
-  op: "put" | "delete";
-  value?: unknown;
-  revision: number;
-  current?: boolean;
-}
-
-/** A key part as mesh-sdk go/delivery EscapeName writes it, read back: `=` and two lowercase hex digits per byte. */
-function unescapeName(part: string): string {
-  if (!/^([-/_a-zA-Z0-9]|=[0-9a-f]{2})+$/.test(part)) throw new Error(`${JSON.stringify(part)} is not an escaped name`);
-  return Buffer.from(part.replace(/=([0-9a-f]{2})/g, (_, h) => String.fromCharCode(parseInt(h, 16))), "latin1").toString("utf8");
-}
-
-/** The pull request and head of the checker's owed key (mesh-sdk go/delivery CheckerOwedKey):
- *  `<owner>/<name>.<number>.<head>.status=mesh/check`, owner and name escaped. */
-export function owedKeyOf(key: string): { owner: string; repo: string; number: number; sha: string } {
-  const parts = String(key ?? "").split(".");
-  if (parts.length !== 4) throw new Error(`${JSON.stringify(key)} is not an owed key, <repository>.<number>.<head>.<act>`);
-  const [repository, number, sha, act] = parts;
-  if (act !== CHECK_ACT) throw new Error(`${JSON.stringify(key)} owes ${JSON.stringify(act)}, not ${CHECK_ACT}`);
-  const m = /^([^/]+)\/([^/]+)$/.exec(repository);
-  if (!m) throw new Error(`${JSON.stringify(key)} names no <owner>/<name>`);
-  if (!/^(0|[1-9][0-9]*)$/.test(number)) throw new Error(`${JSON.stringify(key)} names no pull request number`);
-  if (!/^([0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha)) throw new Error(`${JSON.stringify(key)} names no head's whole sha`);
-  return { owner: checkName("owner", unescapeName(m[1])), repo: checkName("name", unescapeName(m[2])), number: Number(number), sha };
-}
-
-/** The status an owed change asks for, checked as mesh-sdk go/delivery DecodeCheckerOwed checks it; or why it is not one. */
-export function checkStatusOf(change: OwedChange): { owner: string; repo: string; sha: string; revision: number; status: CommitStatus } {
-  if (change.op !== "put") throw new Error(`a ${change.op} owes nothing`);
-  const { owner, repo, sha } = owedKeyOf(change.key);
-  const revision = change.revision;
-  if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) {
-    throw new Error(`${JSON.stringify(revision)} is not a revision`);
-  }
-  const v = change.value;
-  if (!v || typeof v !== "object") throw new Error("the value is no owed act");
-  const o = v as Record<string, unknown>;
-  if (o.v !== 1) throw new Error(`the owed act's version ${JSON.stringify(o.v)} is not one this module reads`);
-  if (o.act !== "status" || o.context !== CHECK_STATUS) {
-    throw new Error(`the owed act is ${JSON.stringify(o.act)} ${JSON.stringify(o.context)}, not the status ${CHECK_STATUS}`);
-  }
-  const state = String(o.state ?? "");
-  if (!states.has(state)) throw new Error(`${JSON.stringify(o.state)} is not a status the forge keeps`);
-  let description = String(o.text ?? "").replace(/\s+/g, " ").trim();
-  if (description.length > 140) description = description.slice(0, 139) + "…";
-  const target = typeof o.target === "string" && /^https?:\/\//.test(o.target) ? o.target : undefined;
-  const status: CommitStatus = { state: state as CommitStatus["state"], context: CHECK_STATUS, description,
-    ...(target ? { target_url: target } : {}) };
-  return { owner, repo, sha, revision, status };
-}
-
-/** The one writer of mesh/check: each owed revision of the checker's, in revision order per key. */
-export class CheckStatuses {
-  /** The newest revision written of each key, and the newest seen; the oldest keys go past what any forge holds open. */
-  private written = new Map<string, number>();
-  private seen = new Map<string, number>();
-  /** The turn each key's writes wait on, and the asks again still running. */
-  private turns = new Map<string, Promise<unknown>>();
-  private again = new Set<Promise<void>>();
-  private forge: CheckForge;
-  private say: (line: string) => void;
-  private sleep: (ms: number) => Promise<void>;
-
-  constructor(forge: CheckForge, say: (line: string) => void = (l) => console.error(l),
-    sleep: (ms: number) => Promise<void> = (ms) => new Promise((r) => setTimeout(r, ms))) {
-    this.forge = forge;
-    this.say = say;
-    this.sleep = sleep;
-  }
-
-  /** Write the change's status: "written", or "dropped" for one that owes no mesh/check or is older than one written. A
-   *  forge that refuses throws. */
-  async apply(change: OwedChange): Promise<"written" | "dropped"> {
-    let asked;
-    try {
-      asked = checkStatusOf(change);
-    } catch (err) {
-      this.say(`[gitea] ${CHECKER_OWED} ${change?.key} at revision ${change?.revision} writes nothing: ${err instanceof Error ? err.message : err}`);
-      return "dropped";
-    }
-    const key = change.key;
-    const seen = this.seen.get(key);
-    if (seen === undefined || asked.revision > seen) this.remember(this.seen, key, asked.revision);
-    // One key's writes take turns, so two at once are weighed one after the other.
-    const before = this.turns.get(key) ?? Promise.resolve();
-    const turn = before.then(async (): Promise<"written" | "dropped"> => {
-      const newest = this.written.get(key);
-      if (newest !== undefined && asked.revision < newest) {
-        this.say(`[gitea] ${asked.owner}/${asked.repo}@${asked.sha.slice(0, 12)}: mesh/check at revision ${asked.revision} is older than ${newest}, already written, and is dropped`);
-        return "dropped";
-      }
-      await this.forge.setCommitStatus(asked.owner, asked.repo, asked.sha, asked.status);
-      this.remember(this.written, key, asked.revision);
-      return "written";
-    });
-    const settled = turn.catch(() => {});
-    this.turns.set(key, settled);
-    void settled.then(() => { if (this.turns.get(key) === settled) this.turns.delete(key); });
-    return turn;
-  }
-
-  /** What the watch hands over: written, or when the forge refuses, asked again on a bound in the background until it is
-   *  written or a newer revision of the key was seen. Never throws: a watch's handler that throws loses the change. */
-  async take(change: OwedChange): Promise<void> {
-    try {
-      await this.apply(change);
-    } catch (err) {
-      const run = this.askAgain(change, err);
-      this.again.add(run);
-      void run.finally(() => this.again.delete(run));
-    }
-  }
-
-  /** Resolves when no ask again is running. */
-  async settled(): Promise<void> {
-    while (this.again.size) await Promise.all([...this.again]);
-  }
-
-  private async askAgain(change: OwedChange, first: unknown): Promise<void> {
-    let err = first;
-    for (let attempt = 1; ; attempt++) {
-      const wait = bindWait(attempt);
-      this.say(`[gitea] ${change.key}: mesh/check at revision ${change.revision} could not be written (${err instanceof Error ? err.message : err}); asked again in ${wait / 1000}s`);
-      await this.sleep(wait);
-      const newest = this.seen.get(change.key);
-      if (newest !== undefined && newest > change.revision) return;
-      try {
-        await this.apply(change);
-        return;
-      } catch (e) {
-        err = e;
-      }
-    }
-  }
-
-  private remember(map: Map<string, number>, key: string, revision: number): void {
-    map.delete(key);
-    map.set(key, revision);
-    if (map.size > 4000) map.delete(map.keys().next().value as string);
-  }
-}
-
-/**
- * Watch the checker's owed with `watch` (the SDK's `state(CHECKER_OWED).watch`), handing each change to `checks`. A watch
- * refused — the read not granted yet — is said once and asked again on a bound until it holds (bind.ts). Never rejects.
- */
-export async function watchOwed(watch: (handler: (change: OwedChange) => Promise<void>) => Promise<void>, checks: CheckStatuses,
-  sleep?: (ms: number) => Promise<void>, say: (line: string) => void = (l) => console.error(l)): Promise<void> {
-  let refusals = 0;
-  await bindUntilHeld(CHECKER_OWED, () => watch((change) => checks.take(change)), sleep, (line) => {
-    if (/could not be bound/.test(line) && refusals++ > 0) return;
-    say(line);
-  });
-}

modules/gitea/client.ts

@@ -533,7 +533,7 @@ export class GiteaClient {
    *  **A listing the forge cut is no listing** (it says `truncated` on a page with nothing more to read, or the pages
    *  run past a bound): the call fails naming the repository and the commit, never answering the directories it did
    *  see, since a directory left out would be taken for one without a module. Reads only. */
-  async commitTrees(owner: string, repo: string, sha: string, paths?: Record<string, string[]>): Promise<{ root: string; trees: Record<string, string>; paths?: Record<string, Record<string, string>> }> {
+  async commitTrees(owner: string, repo: string, sha: string): Promise<{ root: string; trees: Record<string, string> }> {
     const base = `${repoPath(owner, repo)}/git/trees/${commitSegment(sha)}?recursive=true`;
     const cut = (why: string) => new Error(`the forge's tree listing of ${owner}/${repo} at ${sha} was cut (${why}); no trees are answered from a part`);
     const entries: any[] = [];
@@ -560,22 +560,7 @@ export class GiteaClient {
       if (!tree) throw new Error(`the forge's tree listing of ${owner}/${repo} at ${sha} holds ${e.path} but not the tree of ${dir}`);
       trees[dir] = tree;
     }
-    if (paths === undefined) return { root, trees };
-    // **Named paths** (novox/hq ADR 0499 §3, issue 1758): each asked path's git object id at the commit, a file's or a
-    // directory's, from the same listing, by directory and by path relative to it. A path the listing lacks fails
-    // naming both, and nothing is answered in part.
-    const objectOf = new Map<string, string>();
-    for (const e of entries) if (typeof e?.path === "string" && (e.type === "tree" || e.type === "blob")) objectOf.set(e.path, String(e.sha));
-    const named: Record<string, Record<string, string>> = {};
-    for (const [dir, list] of Object.entries(paths)) {
-      named[dir] = {};
-      for (const p of list) {
-        const id = objectOf.get(dir === "" ? p : `${dir}/${p}`);
-        if (!id) throw new Error(`the path ${p} of ${dir === "" ? "the repository root" : dir} is not in ${owner}/${repo} at ${sha}`);
-        named[dir][p] = id;
-      }
-    }
-    return { root, trees, paths: named };
+    return { root, trees };
   }
 
   /** Whether a repository holds a file at a commit: true, false for a 404, thrown when the forge cannot say. */
@@ -699,9 +684,9 @@ export class GiteaClient {
     };
   }
 
-  /** Protect a branch (novox/hq ADR 0237): the rule named for the branch is edited — its required statuses taken
-   *  off (ADR 0534 §5), everything else it says kept unless asked — or created, refusing direct pushes unless asked
-   *  otherwise. Answers the rule as it is now. */
+  /** Make a branch require these commit statuses to merge (novox/hq ADR 0237): the rule named for the
+   *  branch is edited — its required statuses replaced by these, everything else it says kept unless
+   *  asked — or created, refusing direct pushes unless asked otherwise. Answers the rule as it is now. */
   async setBranchProtection(owner: string, repo: string, branch: string, want: ProtectionWanted): Promise<{ created: boolean; rule: BranchProtection }> {
     const had = await this.branchProtection(owner, repo, branch);
     const body = protectionBody(want, !had, branch);
@@ -932,9 +917,9 @@ export class GiteaAdmin {
     return Array.isArray(res.body) ? res.body : [];
   }
 
-  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, only
-   *  the tools' account merges, and no status required (ADR 0534 §1). The rule there is edited; a repository with no
-   *  rule for main gets one. Answers the repositories it touched. With the administrator's login:
+  /** Put main's rule right in every repository of an organisation (novox/hq ADR 0398 §2, issue 948): no push, and
+   *  only the tools' account merges. The rule there is edited, its statuses left as they are; a repository with no
+   *  rule for main gets one that requires none. Answers the repositories it touched. With the administrator's login:
    *  the tools' account is no repository's administrator, so no tool can do this (ADR 0365 §2). */
   async ensureMainMerges(org: string): Promise<string[]> {
     const repos: string[] = [];
@@ -954,11 +939,11 @@ export class GiteaAdmin {
         if (patch.status !== 200) GiteaAdmin.fail(rule, patch);
         continue;
       }
-      // A rule named exactly main is matched before any glob rule, so it would hide the approvals and administrator
-      // limit a glob rule covering main asks: they are copied into it (issue 948, review round 1). Its statuses are
-      // not: main requires none (ADR 0534 §1).
+      // A rule named exactly main is matched before any glob rule, so it would hide the statuses, approvals and
+      // administrator limit a glob rule covering main asks: they are copied into it (issue 948, review round 1).
       const covering = rules.filter((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH));
-      const copied: Record<string, unknown> = {};
+      const checks = [...new Set(covering.filter((r) => r.enable_status_check).flatMap((r) => (r.status_check_contexts ?? []).filter(Boolean)))];
+      const copied: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
       const approvals = Math.max(0, ...covering.map((r) => Number(r.required_approvals ?? 0)));
       if (approvals > 0) copied.required_approvals = approvals;
       if (covering.some((r) => r.block_admin_merge_override === true)) copied.block_admin_merge_override = true;

modules/gitea/cmd/repositories/check_test.go

@@ -1,263 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// The tests of ADR 0534 §1, §2 (the operator, 2026-10-23): the forge requires no status to merge. Main's rule keeps no
-// push, no push whitelist, the tools' account alone in its merge whitelist and no administrator merging past it, and
-// requires no status: the program writes it so on every repository it lists, and takes every required status off a
-// rule covering main in every repository of the organisation it does not list. Nothing else of an unlisted
-// repository's rule is sent.
-
-func narrowedRule(contexts ...any) map[string]any {
-	return map[string]any{
-		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []any{},
-		"enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": len(contexts) > 0, "status_check_contexts": contexts,
-		"block_admin_merge_override": true,
-	}
-}
-
-// requiresNone is whether a rule as the fake forge keeps it requires no status.
-func requiresNone(rule map[string]any) bool {
-	return rule["enable_status_check"] != true && len(strs(rule["status_check_contexts"])) == 0
-}
-
-// 0534-1: a listed repository whose main requires statuses has them all taken off, the rest of the rule kept; a
-// second pass changes nothing.
-func TestListedRepositoryRequiresNoStatus(t *testing.T) {
-	f := newFake()
-	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check", "other/x")}, "main")
-	checked := f.add("novox/checked", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{"mesh-delivery": {}, "checked": {}})
-	for name, r := range map[string]*fRepo{"mesh-delivery": repo, "checked": checked} {
-		rule := r.Rules[mainRule]
-		if !requiresNone(rule) {
-			t.Errorf("%s's main still requires %v", name, rule["status_check_contexts"])
-		}
-		if rule["enable_push"] != false || rule["enable_merge_whitelist"] != true ||
-			strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools || rule["block_admin_merge_override"] != true {
-			t.Errorf("%s's main lost the rest of its rule: %v", name, rule)
-		}
-		if r := result(o, name); r.Did != DidPutRight {
-			t.Errorf("%s outcome %+v, want put right", name, r)
-		}
-	}
-	before := len(f.writes())
-	o = run(t, s, Value{"mesh-delivery": {}, "checked": {}})
-	if w := f.writes(); len(w) != before {
-		t.Errorf("a second pass wrote %v", w[before:])
-	}
-	if result(o, "checked").Did != DidUnchanged {
-		t.Errorf("second outcome %+v, want unchanged", result(o, "checked"))
-	}
-}
-
-// 0534-1: a repository the program makes requires no status from its first rule in the organisation on.
-func TestNewRepositoryRequiresNoStatus(t *testing.T) {
-	f := newFake()
-	s, _ := syncer(t, f)
-	run(t, s, Value{"fresh": {Description: "d"}})
-	rule := f.repos["novox/fresh"].Rules[mainRule]
-	if !requiresNone(rule) {
-		t.Errorf("a new repository's main requires %v, want none", rule["status_check_contexts"])
-	}
-	if readme := f.repos["novox/fresh"].Files["README.md"]; strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
-		t.Errorf("the README names the statuses of before: %q", readme)
-	}
-}
-
-// 0534-1: a listed repository whose main requires nothing stays so, and is not written when the rest is right.
-func TestListedRuleRequiringNothingIsRight(t *testing.T) {
-	f := newFake()
-	none := f.add("novox/none", map[string]map[string]any{mainRule: narrowedRule()}, "main")
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{"none": {}})
-	if !requiresNone(none.Rules[mainRule]) {
-		t.Errorf("none requires %v", none.Rules[mainRule]["status_check_contexts"])
-	}
-	if result(o, "none").Did != DidUnchanged {
-		t.Errorf("outcome %+v, want unchanged", result(o, "none"))
-	}
-	for _, w := range f.writes() {
-		t.Errorf("a right rule was written: %s", w)
-	}
-}
-
-// 0534-1: hq, whose main required mesh/repo-check alone, requires no status either, listed or not.
-func TestOwnCheckAloneGoesToo(t *testing.T) {
-	f := newFake()
-	hq := f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
-	lab := f.add("novox/mesh-lab", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{"hq": {}})
-	for name, repo := range map[string]*fRepo{"hq": hq, "mesh-lab": lab} {
-		if !requiresNone(repo.Rules[mainRule]) {
-			t.Errorf("%s requires %v, want none", name, repo.Rules[mainRule]["status_check_contexts"])
-		}
-		if r := result(o, name); r.Did != DidPutRight {
-			t.Errorf("%s outcome %+v, want put right", name, r)
-		}
-	}
-}
-
-// 0534-1: a repository the value does not list whose rule covering main requires any status has them taken off, and
-// only its statuses: nothing else of its rule is sent. One that requires none is not written to.
-func TestUnlistedRepositoryRequiringAStatusHasItTakenOff(t *testing.T) {
-	f := newFake()
-	catalog := f.add("novox/mesh-catalog", map[string]map[string]any{mainRule: {
-		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/check"},
-	}}, "main")
-	toolsGo := f.add("novox/mesh-tools-go", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
-	f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
-	f.add("novox/unticked", map[string]map[string]any{mainRule: {"enable_push": false, "enable_status_check": false,
-		"status_check_contexts": []any{"mesh/check"}}}, "main")
-	f.add("novox/norule", nil, "main")
-	f.add("mesh-admin/elsewhere", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{})
-
-	if !requiresNone(catalog.Rules[mainRule]) {
-		t.Errorf("mesh-catalog requires %v, want none", catalog.Rules[mainRule]["status_check_contexts"])
-	}
-	if catalog.Rules[mainRule]["enable_push"] != true {
-		t.Errorf("an unlisted repository's rule was changed beyond its statuses: %v", catalog.Rules[mainRule])
-	}
-	if !requiresNone(toolsGo.Rules[mainRule]) {
-		t.Errorf("mesh-tools-go requires %v, want none", toolsGo.Rules[mainRule]["status_check_contexts"])
-	}
-	want := []string{
-		"PATCH /api/v1/repos/novox/mesh-catalog/branch_protections/main",
-		"PATCH /api/v1/repos/novox/mesh-tools-go/branch_protections/main",
-	}
-	if got := f.writes(); strings.Join(got, "\n") != strings.Join(want, "\n") {
-		t.Errorf("writes:\n%s\nwant:\n%s", strings.Join(got, "\n"), strings.Join(want, "\n"))
-	}
-	for _, n := range []string{"mesh-catalog", "mesh-tools-go"} {
-		if r := result(o, n); r.Did != DidPutRight {
-			t.Errorf("%s outcome %+v, want put right", n, r)
-		}
-	}
-	for _, n := range []string{"plain", "unticked", "norule", "elsewhere"} {
-		if r := result(o, n); r.Name != "" {
-			t.Errorf("%s is in the outcome though nothing was done: %+v", n, r)
-		}
-	}
-	before := len(f.writes())
-	run(t, s, Value{})
-	if w := f.writes(); len(w) != before {
-		t.Errorf("a second pass wrote %v", w[before:])
-	}
-}
-
-// 0534-1: the organisation's repositories are read page by page, so one past the first page is put right too.
-func TestUnlistedRepositoriesAreReadPastTheFirstPage(t *testing.T) {
-	f := newFake()
-	f.pageSize = 2
-	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
-	}
-	s, _ := syncer(t, f)
-	run(t, s, Value{})
-	for _, n := range []string{"a", "b", "c", "d", "e"} {
-		if rule := f.repos["novox/"+n].Rules[mainRule]; !requiresNone(rule) {
-			t.Errorf("%s requires %v", n, rule["status_check_contexts"])
-		}
-	}
-}
-
-// 0534-1: a refused removal is said with the repository and its step, and the pass goes on to the next.
-func TestRefusedRemovalIsSaid(t *testing.T) {
-	f := newFake()
-	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
-	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
-	f.refuse = func(method, path string) (int, string) {
-		if method == "PATCH" && strings.Contains(path, "/novox/a/") {
-			return 403, "no"
-		}
-		return 0, ""
-	}
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{})
-	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepNoStatus {
-		t.Errorf("a: %+v, want refused at %s", r, StepNoStatus)
-	}
-	if r := result(o, "b"); r.Did != DidPutRight {
-		t.Errorf("b: %+v, want put right", r)
-	}
-}
-
-// 1301-S3: the organisation's list refused is said, and the listed repositories are still done.
-func TestOrganisationListRefusedIsSaid(t *testing.T) {
-	f := newFake()
-	f.refuse = func(method, path string) (int, string) {
-		if strings.HasPrefix(path, "/api/v1/orgs/") {
-			return 500, "down"
-		}
-		return 0, ""
-	}
-	s, _ := syncer(t, f)
-	o := run(t, s, Value{"x": {}})
-	if result(o, "x").Did != DidMade {
-		t.Errorf("x: %+v", result(o, "x"))
-	}
-	refusedList := false
-	for _, r := range o.Refused() {
-		refusedList = refusedList || r.Step == StepList
-	}
-	if !refusedList {
-		t.Errorf("the refused list is not in the outcome: %+v", o)
-	}
-}
-
-// 0534-2 (the operator, 2026-10-23 ~12:05): the operator's own forge login stays on main's merge whitelist beside the
-// tools' account, so the operator can always merge by hand at the forge; a rule naming the tools' account alone is put
-// right, and a second pass changes nothing.
-func TestTheOperatorsLoginStaysBesideTheTools(t *testing.T) {
-	f := newFake()
-	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule()}, "main")
-	s, _ := syncer(t, f)
-	s.Mergers = []string{"jschoubben", tools, "jschoubben"}
-	o := run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
-	for name, rule := range map[string]map[string]any{"mesh-delivery": repo.Rules[mainRule], "fresh": f.repos["novox/fresh"].Rules[mainRule]} {
-		if got := strings.Join(strs(rule["merge_whitelist_usernames"]), ","); got != tools+",jschoubben" {
-			t.Errorf("%s's merge whitelist is %s, want %s and jschoubben", name, got, tools)
-		}
-		if !requiresNone(rule) || rule["enable_push"] != false {
-			t.Errorf("%s's rule: %v", name, rule)
-		}
-	}
-	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
-		t.Errorf("outcome %+v, want put right", r)
-	}
-	before := len(f.writes())
-	run(t, s, Value{"mesh-delivery": {}, "fresh": {}})
-	if w := f.writes(); len(w) != before {
-		t.Errorf("a second pass wrote %v", w[before:])
-	}
-}
-
-// 0534-2: the mergers are read from the module's runtime config file; a missing key is none; a name that is no forge login
-// is refused.
-func TestReadMergers(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "r.json")
-	_ = os.WriteFile(p, []byte(`{"url":"","main-mergers":["jschoubben"]}`), 0o600)
-	if m, err := ReadMergers(p); err != nil || strings.Join(m, ",") != "jschoubben" {
-		t.Fatalf("%v %v", m, err)
-	}
-	_ = os.WriteFile(p, []byte(`{"url":""}`), 0o600)
-	if m, err := ReadMergers(p); err != nil || len(m) != 0 {
-		t.Fatalf("%v %v", m, err)
-	}
-	for _, bad := range []string{`["a b"]`, `["../x"]`, `[""]`, `"jschoubben"`} {
-		_ = os.WriteFile(p, []byte(`{"main-mergers":`+bad+`}`), 0o600)
-		if _, err := ReadMergers(p); err == nil {
-			t.Errorf("%s was accepted", bad)
-		}
-	}
-}

modules/gitea/cmd/repositories/fake_test.go

@@ -11,7 +11,6 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
-	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -44,8 +43,6 @@ type fakeForge struct {
 	calls []string          // "METHOD /path"
 	// refuse answers a call with a status and a message when it returns a status above zero.
 	refuse func(method, path string) (int, string)
-	// pageSize is how many repositories one page of the organisation's list holds; 50 when zero.
-	pageSize int
 }
 
 func newFake() *fakeForge { return &fakeForge{repos: map[string]*fRepo{}} }
@@ -87,7 +84,6 @@ var (
 	branchPath = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/branches/([^/]+)$`)
 	filesPath  = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/contents$`)
 	movePath   = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/transfer$`)
-	orgRepos   = regexp.MustCompile(`^/api/v1/orgs/([^/]+)/repos$`)
 )
 
 func strs(v any) []string {
@@ -126,8 +122,7 @@ func lets(rule map[string]any, login string) bool {
 // and in the organisation the tools' team does (it is on every repository there); nobody else here.
 func reaches(full, login string) bool {
 	owner := strings.SplitN(full, "/", 2)[0]
-	// The operator's own login is an owner of the organisation, so it reaches every repository there (ADR 0534 §2).
-	return owner == login || (owner == org && (login == tools || login == "jschoubben"))
+	return owner == login || (owner == org && login == tools)
 }
 
 // keepReaching drops from a rule's merge whitelist every user without access to the repository, as gitea's
@@ -172,31 +167,6 @@ func (f *fakeForge) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch {
 	case p == "/api/v1/version":
 		reply(200, map[string]string{"version": "1.27"})
-	case orgRepos.MatchString(p) && r.Method == http.MethodGet:
-		owner := orgRepos.FindStringSubmatch(p)[1]
-		var names []string
-		for full := range f.repos {
-			if o, n, _ := strings.Cut(full, "/"); o == owner {
-				names = append(names, n)
-			}
-		}
-		sort.Strings(names)
-		size := f.pageSize
-		if size == 0 {
-			size = 50
-		}
-		if l, _ := strconv.Atoi(r.URL.Query().Get("limit")); l > 0 && l < size {
-			size = l
-		}
-		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
-		if page < 1 {
-			page = 1
-		}
-		out := []map[string]any{}
-		for i := (page - 1) * size; i < len(names) && i < page*size; i++ {
-			out = append(out, map[string]any{"name": names[i], "full_name": owner + "/" + names[i]})
-		}
-		reply(200, out)
 	case p == "/api/v1/user/repos" && r.Method == http.MethodPost:
 		name := fmt.Sprint(in["name"])
 		if f.repos[admin+"/"+name] != nil {
@@ -342,3 +312,12 @@ func result(o Outcome, name string) Result {
 	}
 	return Result{}
 }
+
+func has(list []string, want string) bool {
+	for _, s := range list {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}

modules/gitea/cmd/repositories/first.go

@@ -8,7 +8,7 @@ import "strings"
 const MergeCheck = `#!/bin/sh
 # mesh-check-toolchain: go
 #
-# This repository's own check (novox/hq ADR 0238 §4), run by the checker within mesh/check (ADR 0447), written with its first commit (ADR 0428 §4):
+# This repository's own check, mesh/repo-check (novox/hq ADR 0238 §4), written with its first commit (ADR 0428 §4):
 # every Go module in the tree is vetted, its unit tests run, and then its integration tests (-tags integration).
 # A tree with no Go module has nothing to test, and the check says so and passes.
 set -eu
@@ -37,7 +37,7 @@ func FirstCommit(name string, r Repo) map[string]string {
 	}
 	readme := "# " + name + "\n\n" + purpose + "\n\n" +
 		"Made by the mesh from the gitea module's config value `repositories` (novox/hq ADR 0428). Main takes no push: " +
-		"a change reaches it by a pull request whose `mesh/check` passed: the checker's verdict on its head merged onto " +
-		"main, this repository's `merge-check.sh` among its tests (novox/hq ADR 0447).\n"
+		"a change reaches it by a pull request whose `mesh/repo-check` (this repository's `merge-check.sh`) and " +
+		"`mesh/merge-gate` passed.\n"
 	return map[string]string{"README.md": readme, "merge-check.sh": MergeCheck}
 }

modules/gitea/cmd/repositories/main.go

@@ -3,8 +3,7 @@
 // again whenever the value changes: it reads the file the mesh renders from that value and, with the setup login,
 // makes every listed repository that does not exist under that login's own account, protects its main, writes
 // main's first commit, narrows main's rule and only then moves it into the organisation; one that exists only has
-// its main rule put right, requiring no status (novox/hq ADR 0534 §1). A repository the value does not list is
-// touched only to take the required statuses off a rule covering its main. It keeps what it did, per
+// its main rule put right. A repository the value does not list is never touched. It keeps what it did, per
 // repository, in the outcome file, says each change on stdout in one line and never a secret, and exits 1 when a
 // step was refused, its last stderr lines naming each (outcome.go Report): the node-engine's gate on a run-once
 // step (ADR 0136) reports it and runs it again on every apply until it passes.
@@ -30,8 +29,7 @@ func main() {
 func runSync() int {
 	forge, missing := forgehttp.FromEnv()
 	file, outcome := os.Getenv("MESH_REPOSITORIES_FILE"), os.Getenv("MESH_REPOSITORIES_OUTCOME")
-	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome,
-		"MESH_GITEA_CONFIG_FILE": os.Getenv("MESH_GITEA_CONFIG_FILE")} {
+	for k, v := range map[string]string{"MESH_REPOSITORIES_FILE": file, "MESH_REPOSITORIES_OUTCOME": outcome} {
 		if v == "" {
 			missing = append(missing, k)
 		}
@@ -57,11 +55,6 @@ func runSync() int {
 		_ = WriteOutcome(outcome, o)
 		return Report(o, os.Stderr)
 	}
-	if s.Mergers, err = ReadMergers(os.Getenv("MESH_GITEA_CONFIG_FILE")); err != nil {
-		o := Outcome{At: time.Now().UTC(), Org: s.Org, Failed: err.Error()}
-		_ = WriteOutcome(outcome, o)
-		return Report(o, os.Stderr)
-	}
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 	defer cancel()
 	o, _ := s.Sync(ctx, value) // a forge not reachable is in o.Failed

modules/gitea/cmd/repositories/manifest_test.go

@@ -64,7 +64,6 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 	if v, err := ReadValue(filled); err != nil || len(v) != 1 || v["mesh-delivery"].Description != "d" {
 		t.Errorf("the filled template reads as %v, %v; want mesh-delivery", v, err)
 	}
-
 	for _, r := range m.Resources {
 		if r["type"] == "process" && has(strs(r["restart-on"]), file["id"].(string)) {
 			process = r
@@ -106,61 +105,3 @@ func TestManifestDeclaresTheValueAndItsTrigger(t *testing.T) {
 		t.Errorf("repositories is declared unlike agent-read-teams: %v vs %v", v, teams)
 	}
 }
-
-// 0534-2: the manifest declares main-mergers as a trusted list naming the operator's login by default, merges it into
-// the module's runtime config file (with url, which the TypeScript part reads), and the repositories program is given
-// that file and runs again when it changes.
-func TestManifestDeclaresTheMainMergers(t *testing.T) {
-	raw, err := os.ReadFile("../../module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var m struct {
-		Config    map[string]map[string]any `json:"config"`
-		Resources []map[string]any          `json:"resources"`
-	}
-	if err := json.Unmarshal(raw, &m); err != nil {
-		t.Fatal(err)
-	}
-	v := m.Config[MergersKey]
-	if v == nil || v["type"] != "list" || v["trusted"] != true || strings.Join(strs(v["default"]), ",") != "jschoubben" {
-		t.Fatalf("config %s = %v, want a trusted list defaulting to the operator's login", MergersKey, v)
-	}
-	var cfg, process map[string]any
-	for _, r := range m.Resources {
-		if r["id"] == "runtime-config" {
-			cfg = r
-		}
-		if r["name"] == "gitea-repositories" {
-			process = r
-		}
-	}
-	if cfg == nil || !has(strs(cfg["takes-config"]), MergersKey) || cfg["merge"] != "json" {
-		t.Fatalf("runtime-config does not take %s: %v", MergersKey, cfg)
-	}
-	text, err := os.ReadFile("../../" + cfg["template"].(string))
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := filepath.Join(t.TempDir(), "config.json")
-	_ = os.WriteFile(file, text, 0o600)
-	if got, err := ReadMergers(file); err != nil || strings.Join(got, ",") != "jschoubben" {
-		t.Errorf("the template's mergers read as %v, %v; want the default", got, err)
-	}
-	env, _ := process["env"].(map[string]any)
-	if env["MESH_GITEA_CONFIG_FILE"] != cfg["path"] {
-		t.Errorf("the repositories program reads %v, want %v", env["MESH_GITEA_CONFIG_FILE"], cfg["path"])
-	}
-	if !has(strs(process["restart-on"]), "runtime-config") {
-		t.Errorf("the repositories program does not run again when the mergers change: %v", process["restart-on"])
-	}
-}
-
-func has(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}

modules/gitea/cmd/repositories/override_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 )
 
-// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past it refused,
+// 1141/AC1: a repository the program makes gets main's rule with an administrator's merge past a status refused,
 // as every repository's main has had since 2026-10-07.
 func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 	f := newFake()
@@ -18,7 +18,7 @@ func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 }
 
 // 1141/AC2: a narrowed main rule that still lets an administrator override is not right: it is put right, its
-// statuses taken off (ADR 0534 §1), and a second pass changes nothing.
+// statuses kept, and a second pass changes nothing.
 func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: {
@@ -33,8 +33,10 @@ func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	if rule["block_admin_merge_override"] != true {
 		t.Errorf("the administrator's override is still allowed: %v", rule)
 	}
-	if !requiresNone(rule) {
-		t.Errorf("statuses %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
+	for _, c := range []string{"mesh/merge-gate", "mesh/repo-check", "other/x"} {
+		if !has(strs(rule["status_check_contexts"]), c) {
+			t.Errorf("a status was dropped: %v", rule["status_check_contexts"])
+		}
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
 		t.Errorf("outcome %+v, want put right", r)

modules/gitea/cmd/repositories/repositories.go

@@ -11,7 +11,6 @@ import (
 	"os"
 	"path"
 	"regexp"
-	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -27,12 +26,9 @@ const (
 	MainBranch = "main"
 )
 
-// noStatus is what main's rule says of statuses: none is required to merge (novox/hq ADR 0534 §1, the operator,
-// 2026-10-23). The checks still run and report; mesh-delivery asks the operator's Approve on a passing verdict and the
-// merge tool judges it at the merge (ADR 0534 §3, §4). The forge enforces none of them.
-func noStatus() map[string]any {
-	return map[string]any{"enable_status_check": false, "status_check_contexts": []string{}}
-}
+// RequiredStatuses are what main requires in every listed repository from its first commit (ADR 0428 §5): the
+// repository's own check and the module graph's gate. A status already on the rule is kept beside them.
+var RequiredStatuses = []string{"mesh/merge-gate", "mesh/repo-check"}
 
 // The steps of one repository, as an outcome names a refused one (ADR 0428 §6).
 const (
@@ -46,10 +42,6 @@ const (
 	// StepRuleAfterMove reads main's rule back once the repository is in the organisation and puts it right: the
 	// forge drops from a merge whitelist a user without access, and under the setup account the tools' have none.
 	StepRuleAfterMove = "rule-after-move"
-	// StepList reads the organisation's repositories, for those the value does not list (issue 1301).
-	StepList = "list"
-	// StepNoStatus takes the required statuses off main's rule of a repository the value does not list (ADR 0534 §1).
-	StepNoStatus = "no-status"
 )
 
 // What a pass did with one repository.
@@ -72,37 +64,6 @@ type Repo struct {
 // Value is the config value: each repository of the organisation by name.
 type Value map[string]Repo
 
-// MergersKey is the config value naming the forge logins that merge into main beside the tools' account (ADR 0534 §2).
-const MergersKey = "main-mergers"
-
-// loginName is a forge login: what a merge whitelist may name.
-var loginName = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$`)
-
-// ReadMergers reads the main-mergers value from the module's runtime config file, which the mesh merges the value into
-// (module.json runtime-config); a file without the key names none.
-func ReadMergers(file string) ([]string, error) {
-	raw, err := os.ReadFile(file)
-	if err != nil {
-		return nil, fmt.Errorf("the module's config file cannot be read (%s): %w", file, err)
-	}
-	var whole map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &whole); err != nil {
-		return nil, fmt.Errorf("the module's config file %s is not JSON: %w", file, err)
-	}
-	var out []string
-	if r, ok := whole[MergersKey]; ok && string(r) != "null" {
-		if err := json.Unmarshal(r, &out); err != nil {
-			return nil, fmt.Errorf("%s in %s is not a list of forge logins: %w", MergersKey, file, err)
-		}
-	}
-	for _, n := range out {
-		if !loginName.MatchString(n) || strings.Contains(n, "..") {
-			return nil, fmt.Errorf("%s in %s lists %q, which is not a forge login", MergersKey, file, n)
-		}
-	}
-	return out, nil
-}
-
 // ReadValue reads the file the mesh renders from the config value. A file without the key is the empty value,
 // which makes nothing and touches nothing.
 func ReadValue(file string) (Value, error) {
@@ -163,11 +124,8 @@ type Syncer struct {
 	Forge forgehttp.Client // the setup login's
 	Org   string           // the organisation, novox
 	Admin string           // the setup login, under whose own account a repository is made
-	Tools string           // the tools' account, which merges into main for mesh-delivery
-	// Mergers are the forge logins that merge into main beside the tools' account: the operator's own, so the operator
-	// can always merge by hand at the forge (ADR 0534 §2; the gitea module's config value main-mergers).
-	Mergers []string
-	Log     func(format string, a ...any)
+	Tools string           // the tools' account, the only one that merges into main
+	Log   func(format string, a ...any)
 	// WaitFor is how long to wait for the forge to answer; none when zero.
 	WaitFor, Poll time.Duration
 }
@@ -199,70 +157,9 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 		}
 		out.Repositories = append(out.Repositories, r)
 	}
-	for _, r := range s.switchUnlisted(ctx, v) {
-		if r.Did == DidRefused {
-			s.say("refused: %s/%s at the step %s: %s", s.Org, r.Name, r.Step, r.Said)
-		} else {
-			s.say("%s: %s/%s (main requires no status)", r.Did, s.Org, r.Name)
-		}
-		out.Repositories = append(out.Repositories, r)
-	}
 	return out, nil
 }
 
-// orgPage is how many repositories one read of the organisation's list asks for.
-const orgPage = 50
-
-// switchUnlisted takes every required status off a rule covering main in every repository of the organisation the
-// value does not list (ADR 0534 §1): the forge requires no status to merge anywhere, with no list kept by hand. Only
-// the statuses are sent; nothing else of a rule the value does not hold is changed (ADR 0428 §7). A main whose rules
-// require no status gets no call. It answers only what it did: a repository put right, or refused.
-func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
-	var names []string
-	for page := 1; ; page++ {
-		var repos []struct {
-			Name string `json:"name"`
-		}
-		q := "?limit=" + fmt.Sprint(orgPage) + "&page=" + fmt.Sprint(page)
-		if err := s.Forge.GetJSON(ctx, "/api/v1/orgs/"+url.PathEscape(s.Org)+"/repos"+q, &repos); err != nil {
-			return []Result{refused("(the organisation's repositories)", StepList, err)}
-		}
-		for _, r := range repos {
-			if _, listed := v[r.Name]; !listed && r.Name != "" {
-				names = append(names, r.Name)
-			}
-		}
-		if len(repos) == 0 || page > 1000 {
-			break
-		}
-	}
-	sort.Strings(names)
-	var out []Result
-	for _, n := range names {
-		rules, err := s.rules(ctx, s.Org, n)
-		if err != nil {
-			out = append(out, refused(n, StepRead, err))
-			continue
-		}
-		var did *Result
-		for _, r := range rules {
-			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || len(required(r)) == 0 {
-				continue
-			}
-			if err := s.Forge.SendJSON(ctx, http.MethodPatch,
-				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), noStatus(), nil); err != nil {
-				did = &Result{Name: n, Did: DidRefused, Step: StepNoStatus, Said: err.Error()}
-				break
-			}
-			did = &Result{Name: n, Did: DidPutRight}
-		}
-		if did != nil {
-			out = append(out, *did)
-		}
-	}
-	return out
-}
-
 // waitForForge is cmd/agent-teams' (teams.go waitForForge): the forge starting with the module answers late.
 func (s *Syncer) waitForForge(ctx context.Context) error {
 	deadline := time.Now().Add(s.WaitFor)
@@ -346,9 +243,9 @@ func (s *Syncer) one(ctx context.Context, name string, r Repo) Result {
 			return refused(name, StepFirstCommit, err)
 		}
 	}
-	if rule == nil || !isRight(rule, s.Tools, s.Mergers) {
+	if rule == nil || !isRight(rule, s.Tools) {
 		if err := s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(s.Admin, name)+"/branch_protections/"+MainBranch,
-			narrowed(s.Tools, s.Mergers), nil); err != nil {
+			narrowed(rule, s.Tools), nil); err != nil {
 			return refused(name, StepNarrow, err)
 		}
 	}
@@ -412,66 +309,80 @@ func strList(v any) []string {
 	return out
 }
 
-// required is what a rule requires: its statuses when it checks them, else none.
-func required(r rule) []string {
-	if r == nil || r["enable_status_check"] != true {
-		return nil
-	}
-	return strList(r["status_check_contexts"])
-}
-
-// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges, no
-// administrator merging past the rule, as every repository's main has been since 2026-10-07 (issue 1141), and no
-// status required (ADR 0534 §1). A field the forge keeps beside these is left as it is.
-func narrowed(toolsAccount string, mergers []string) map[string]any {
-	body := map[string]any{
-		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
-		"enable_merge_whitelist": true, "merge_whitelist_usernames": whitelist(toolsAccount, mergers),
-		"block_admin_merge_override": true,
-	}
-	for k, v := range noStatus() {
-		body[k] = v
-	}
-	return body
-}
-
-// whitelist is main's merge whitelist: the tools' account first, then each other merger once, in the value's order.
-func whitelist(toolsAccount string, mergers []string) []string {
-	out := []string{toolsAccount}
-	for _, m := range mergers {
-		if !slices.Contains(out, m) {
-			out = append(out, m)
+// statuses is what a rule requires, with RequiredStatuses added and none dropped.
+func statuses(rules ...rule) []string {
+	seen := map[string]bool{}
+	var out []string
+	add := func(s string) {
+		if !seen[s] {
+			seen[s] = true
+			out = append(out, s)
 		}
 	}
+	for _, r := range rules {
+		if r != nil && r["enable_status_check"] == true {
+			for _, s := range strList(r["status_check_contexts"]) {
+				add(s)
+			}
+		}
+	}
+	for _, s := range RequiredStatuses {
+		add(s)
+	}
 	return out
 }
 
-// isRight says whether a rule already is narrowed and requires no status.
-func isRight(r rule, toolsAccount string, mergers []string) bool {
+// narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges,
+// requiring the statuses (ADR 0428 §5), and no administrator merging past them, as every repository's main has been
+// since 2026-10-07 (issue 1141). A field the forge keeps beside these is left as it is.
+func narrowed(r rule, toolsAccount string, also ...rule) map[string]any {
+	return map[string]any{
+		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []string{},
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": []string{toolsAccount},
+		"enable_status_check": true, "status_check_contexts": statuses(append([]rule{r}, also...)...),
+		"block_admin_merge_override": true,
+	}
+}
+
+// isRight says whether a rule already is narrowed and requires both statuses.
+func isRight(r rule, toolsAccount string) bool {
 	if r["enable_push"] != false || r["enable_push_whitelist"] == true || r["enable_merge_whitelist"] != true {
 		return false
 	}
-	if m := strList(r["merge_whitelist_usernames"]); !slices.Equal(m, whitelist(toolsAccount, mergers)) {
+	if m := strList(r["merge_whitelist_usernames"]); len(m) != 1 || m[0] != toolsAccount {
 		return false
 	}
-	return r["enable_status_check"] != true && len(strList(r["status_check_contexts"])) == 0 &&
+	return r["enable_status_check"] == true && hasAll(strList(r["status_check_contexts"])) &&
 		r["block_admin_merge_override"] == true
 }
 
-// putRight makes main's rule in an organisation's repository the narrowed one, requiring no status (ADR 0534 §1).
-// A repository with no rule named main gets one, carrying the approvals a glob rule covering main asks (client.ts
-// ensureMainMerges, issue 948). It never unprotects (ADR 0428 §7).
+func hasAll(have []string) bool {
+	for _, want := range RequiredStatuses {
+		found := false
+		for _, h := range have {
+			found = found || h == want
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires.
+// A repository with no rule named main gets one, carrying what a glob rule covering main asks (client.ts
+// ensureMainMerges, issue 948). It never takes a status away and never unprotects (ADR 0428 §5, §7).
 func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error) {
 	rules, err := s.rules(ctx, owner, name)
 	if err != nil {
 		return false, err
 	}
 	if own := ruleNamed(rules, MainBranch); own != nil {
-		if isRight(own, s.Tools, s.Mergers) {
+		if isRight(own, s.Tools) {
 			return false, nil
 		}
 		return true, s.Forge.SendJSON(ctx, http.MethodPatch, repoAPI(owner, name)+"/branch_protections/"+MainBranch,
-			narrowed(s.Tools, s.Mergers), nil)
+			narrowed(own, s.Tools), nil)
 	}
 	var covering []rule
 	for _, r := range rules {
@@ -479,7 +390,7 @@ func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error)
 			covering = append(covering, r)
 		}
 	}
-	body := narrowed(s.Tools, s.Mergers)
+	body := narrowed(nil, s.Tools, covering...)
 	body["rule_name"] = MainBranch
 	approvals := 0.0
 	for _, r := range covering {

modules/gitea/cmd/repositories/repositories_test.go

@@ -17,9 +17,9 @@ import (
 const mainRule = "main"
 
 // 1124/AC2: a listed repository that does not exist is made under the setup account, given main's rule letting that
-// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/check (1124/AC5
-// as issue 1301 changes it), and only then moved into the organisation. Nothing reaches the organisation before the
-// narrowed rule, and nothing else is pushed to main. Main requires no status (ADR 0534 §1).
+// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/repo-check (and
+// mesh/merge-gate, 1124/AC5), and only then moved into the organisation. Nothing reaches the organisation before the
+// narrowed rule, and nothing else is pushed to main.
 func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -66,8 +66,9 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	if rule["enable_merge_whitelist"] != true || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("main's merge whitelist is not the tools' account alone: %v", rule)
 	}
-	if !requiresNone(rule) {
-		t.Errorf("main requires a status (ADR 0534 §1): %v", rule)
+	checks := strs(rule["status_check_contexts"])
+	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
+		t.Errorf("main does not require mesh/repo-check and mesh/merge-gate (1124/AC5): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade || r.Step != "" {
 		t.Errorf("outcome %+v, want made", r)
@@ -86,7 +87,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 
 // 1124/AC2: the forge drops from a merge whitelist a user without access to the repository, and under the setup
 // account the tools' account has none; so once the repository is in the organisation its main rule is read back and
-// put right: the tools' account the only one that merges, no status required (ADR 0534 §1).
+// put right: the tools' account the only one that merges, both statuses required.
 func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -102,8 +103,9 @@ func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	if rule["enable_push"] != false {
 		t.Errorf("after the move main takes a push: %v", rule)
 	}
-	if !requiresNone(rule) {
-		t.Errorf("after the move main requires a status (ADR 0534 §1): %v", rule)
+	checks := strs(rule["status_check_contexts"])
+	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
+		t.Errorf("after the move main does not require both statuses: %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade {
 		t.Errorf("outcome %+v, want made", r)
@@ -134,7 +136,7 @@ func TestAdminRuleLetsTheSetupLoginAlonePush(t *testing.T) {
 }
 
 // 1124/AC3: a listed repository that exists in the organisation is not made again, only its main rule put right;
-// a rule still letting the setup login push is narrowed, and requires no status (ADR 0534 §1).
+// a rule still letting the setup login push is narrowed, its statuses kept (1124/AC5).
 func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
@@ -154,11 +156,15 @@ func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	if rule["enable_push"] != false || strings.Join(strs(rule["merge_whitelist_usernames"]), ",") != tools {
 		t.Errorf("hq's rule not narrowed: %v", rule)
 	}
-	if !requiresNone(rule) {
-		t.Errorf("hq's rule requires %v, want none (ADR 0534 §1)", rule["status_check_contexts"])
+	checks := strs(rule["status_check_contexts"])
+	for _, c := range []string{"other/x", "mesh/merge-gate", "mesh/repo-check"} {
+		if !has(checks, c) {
+			t.Errorf("hq's rule lacks %s: %v", c, checks)
+		}
 	}
 	made := bare.Rules[mainRule]
-	if made == nil || made["enable_push"] != false || !requiresNone(made) {
+	if made == nil || made["enable_push"] != false || !has(strs(made["status_check_contexts"]), "mesh/repo-check") ||
+		!has(strs(made["status_check_contexts"]), "mesh/merge-gate") {
 		t.Errorf("bare's rule: %v", made)
 	}
 	if hq.Commits != 0 || bare.Commits != 0 {
@@ -208,33 +214,33 @@ func TestRepositoryUnderTheSetupAccountIsFinished(t *testing.T) {
 	}
 }
 
-// ADR 0534 §1: putting a rule right takes every required status off it, whichever they are, and a rule already right
-// is not written.
-func TestStatusesAreTakenOff(t *testing.T) {
+// 1124/AC5: putting a rule right adds a missing one of mesh/repo-check and mesh/merge-gate and keeps every status
+// already there; no pass drops one.
+func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
 	f := newFake()
 	only := f.add("novox/only", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
 		"enable_status_check": true, "status_check_contexts": []any{"mesh/repo-check"},
 	}}, "main")
-	right := f.add("novox/right", map[string]map[string]any{mainRule: {
+	more := f.add("novox/more", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": false, "status_check_contexts": []any{},
+		"enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check", "mesh/delivery"},
 		"block_admin_merge_override": true, // right since issue 1141
 	}}, "main")
 	s, _ := syncer(t, f)
-	o := run(t, s, Value{"only": {}, "right": {}})
-	if !requiresNone(only.Rules[mainRule]) {
-		t.Errorf("only: %v", only.Rules[mainRule]["status_check_contexts"])
+	o := run(t, s, Value{"only": {}, "more": {}})
+	if c := strs(only.Rules[mainRule]["status_check_contexts"]); !has(c, "mesh/merge-gate") || !has(c, "mesh/repo-check") {
+		t.Errorf("only: %v", c)
 	}
-	if !requiresNone(right.Rules[mainRule]) {
-		t.Errorf("right: %v", right.Rules[mainRule]["status_check_contexts"])
+	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 3 || !has(c, "mesh/delivery") {
+		t.Errorf("more lost a status: %v", c)
 	}
 	for _, w := range f.writes() {
-		if strings.Contains(w, "/right/") {
+		if strings.Contains(w, "/more/") {
 			t.Errorf("a right rule was written: %s", w)
 		}
 	}
-	if result(o, "right").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
+	if result(o, "more").Did != DidUnchanged || result(o, "only").Did != DidPutRight {
 		t.Errorf("outcome %+v", o)
 	}
 }
@@ -308,8 +314,7 @@ func TestRefusedStepStopsThatRepositoryOnly(t *testing.T) {
 	}
 }
 
-// 1124/AC7: a repository taken out of the value is not changed: its rules are read (issue 1301 switches one whose
-// main requires mesh/merge-gate), nothing is written, and one still under the setup account is not asked about.
+// 1124/AC7: a repository taken out of the value gets no call at all.
 func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	f := newFake()
 	f.add("novox/old", map[string]map[string]any{mainRule: {"enable_push": true}}, "main")
@@ -318,7 +323,7 @@ func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	run(t, s, Value{})
 	run(t, s, Value{"new": {}})
 	for _, c := range f.all() {
-		if strings.Contains(c, "older") || (strings.Contains(c, "old") && !strings.HasPrefix(c, "GET ")) {
+		if strings.Contains(c, "old") {
 			t.Errorf("a repository out of the value was asked: %s", c)
 		}
 	}

modules/gitea/delivery.ts

@@ -16,9 +16,6 @@ import { promisify } from "node:util";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus } from "./client.js";
 import { checkName } from "./guard.js";
-import { CHECK_STATUS } from "./pulls.js";
-
-export { CHECK_STATUS };
 
 /** How a command is run: docker on the forge's machine, or a test's. */
 export type Runner = (file: string, args: string[]) => Promise<{ stdout: string; code: number }>;
@@ -94,18 +91,11 @@ const states = new Set(["pending", "success", "error", "failure", "warning"]);
 /** The merge check's contexts (pulls.ts): a branch's protection may require them. */
 const mergeCheckContexts = new Set(["mesh/merge-gate", "mesh/repo-check"]);
 
-
 /** A status mesh-delivery asks for, checked: one of the forge's states, a context of the mesh's own, a
  *  bounded description. */
 export function deliveryStatus(context: string, state: string, description: string, target?: string) {
   if (!/^mesh\/[a-z-]+$/.test(context)) throw new Error(`${context} is not a status of the mesh's own`);
   if (!states.has(state)) throw new Error(`${state} is not a status the forge keeps`);
-  // mesh/check is the checker's verdict and the one status main requires (ADR 0447 §1): no hand sets it in any
-  // state, as issue 293 closed for the two before it. No tool writes it, since a tool is told no caller (R4e finding K1):
-  // check.ts writes it from the checker's owed state (ADR 0521).
-  if (context === CHECK_STATUS) {
-    throw new Error(`${CHECK_STATUS} is the checker's status: it is written from mesh-delivery-checker.owed alone, never by a tool`);
-  }
   // The merge check's statuses are its verdict's, set when the controller says it, and a branch may require
   // them: never set to a verdict by hand, so nothing passes — or fails — a merge past the check (novox/hq
   // issue 293). Pending is no verdict: it is what this holder says on every new head until the verdict comes,
@@ -136,7 +126,7 @@ export interface StatusWriters {
 export function commitStatusTool(writers: StatusWriters): ToolDefinition {
   return {
     name: "gitea_commit_status",
-    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. mesh/check, the status main requires, is refused: no tool writes it: it is written from the checker's own state. hq's mesh/repo-check (and mesh/merge-gate, kept for a revert) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
+    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. The merge check's statuses (mesh/merge-gate, mesh/repo-check) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
     input: {
       owner: { type: "string", description: "the repository owner" },
       repo: { type: "string", description: "the repository name" },

modules/gitea/files/config.json

@@ -1 +1 @@
-{"main-mergers": ["jschoubben"]}
+{}

modules/gitea/gate.ts

@@ -212,8 +212,7 @@ export class GateWriter {
       let since = h.pendingAt;
       if (since === undefined) {
         const gate = await this.forge.gateOf(owner, repo, sha);
-        // No gate on the forge: none was written (its base does not require it, issue 1301), and nothing is said.
-        if (!gate || gate.state !== "pending") return;
+        if (gate && gate.state !== "pending") return;
         since = gate?.updated_at ? Date.parse(gate.updated_at) : undefined;
       }
       if (since !== undefined && at.getTime() < since - CLOCK_SLACK_MS) return;

modules/gitea/go.mod

@@ -3,7 +3,7 @@ module gitea
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

modules/gitea/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9 h1:Ufmd2cYEXICQ817IGflccP9bexABE4WhIO49HPbaoSo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022190740-104533e8c0c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2 h1:Cdl5N56QPfmFBoLHrDfvvyc5Q+PUnTjf3fgYD7imcco=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021114014-66e8fdaa62e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/gitea/guard.ts

@@ -10,16 +10,15 @@
 //     Everything else — administration, protection, settings, collaborators, teams, hooks, keys, tokens,
 //     statuses, a merge, a repository deleted or moved — has its own tool or is the operator's, at the
 //     forge as themselves;
-//   - `gitea_branch_protection_set` lets no person push and no administrator merge past a rule, and on main keeps
-//     the tools' account the only one that merges; it requires no status, as no rule of the mesh does (ADR 0534 §5);
-//   - `gitea_merge_pull_request` merges only into a branch that refuses its push, only a head whose mesh/check passed
-//     against the trunk's head, approved by the operator where the branch requires no status (ADR 0534 §4), and only
-//     that head;
+//   - `gitea_branch_protection_set` only makes protection stronger;
+//   - `gitea_merge_pull_request` merges only a head whose every required status succeeded, and only that
+//     head;
 //   - `gitea_delete_repo` refuses a repository any protection rule guards.
 //
 // Pure, so it is tested without a forge; the tools do the asking (tools/index.ts).
 
-import { MAIN_BRANCH, mainMergers, type BranchProtection, type ProtectionWanted } from "./protection.js";
+import { MAIN_BRANCH, type BranchProtection, type ProtectionWanted } from "./protection.js";
+import { TOOLS_ACCOUNT } from "./tools-account.js";
 
 /** A refusal of policy, in the words the caller sees. Never an error of the forge's. */
 export class Refused extends Error {
@@ -164,7 +163,7 @@ export function judgeApiCall(method: string, rawPath: string, body: unknown): Ap
       `that is not the default branch and that no protection rule names. The forge's administration, a ` +
       `branch's protection, a repository's settings, collaborators, teams, hooks, keys, tokens and statuses ` +
       `are the operator's at the forge, or have their own tool (gitea_merge_pull_request, gitea_commit_status, ` +
-      `gitea_branch_protection_set, which never lets a person push). Nothing was sent`,
+      `gitea_branch_protection_set, which only strengthens). Nothing was sent`,
   };
 }
 
@@ -288,7 +287,7 @@ export function judgeContentsWrite(target: string, defaultBranch: string, rules:
  * Refuses a protection change that weakens what guards a branch (novox/hq ADR 0266): the branch's own rule, or —
  * when it has none — every glob rule that covers it, since a rule named for the branch takes the glob's place.
  * A rule made new takes the forge's defaults for what it does not say: pushes refused, an administrator's
- * override allowed. A required status taken away is no weakening: no rule of the mesh requires one (ADR 0534 §5).
+ * override allowed.
  */
 export function judgeProtectionChange(before: BranchProtection | null, want: ProtectionWanted,
   covering: BranchProtection[] = [], branch = ""): string | null {
@@ -306,34 +305,37 @@ export function judgeProtectionChange(before: BranchProtection | null, want: Pro
     }
     return null; // A new rule protects what nothing protected.
   }
+  const had = before.enable_status_check ? [...new Set((before.status_check_contexts ?? []).filter(Boolean))] : [];
+  const wanted = new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean));
+  const dropped = had.filter((c) => !wanted.has(c));
   const why: string[] = [];
+  if (dropped.length) why.push(`it drops the required status ${dropped.join(", ")}`);
   if (want.push === true && before.enable_push === false) why.push("it lets a person push to the branch directly");
   if (want.blockAdminOverride === false && before.block_admin_merge_override === true) {
-    why.push("it lets an administrator merge past what the rule asks");
+    why.push("it lets an administrator merge past a status that has not succeeded");
   }
   if (!why.length) return null;
   return `the protection of ${before.rule_name ?? before.branch_name} is only made stronger through a tool: ` +
     `${why.join("; ")}. Whoever may call a tool includes agents, and a branch's protection is what keeps a ` +
-    `change from landing but through a pull request the operator approved (novox/hq ADR 0266, ADR 0534) — weakening it is the ` +
+    `change from merging without its checks and the operator (novox/hq ADR 0266) — weakening it is the ` +
     `operator's, at the forge as themselves. Nothing was changed`;
 }
 
-/** Main's rule takes no push and lets only the tools' account and main-mergers merge (novox/hq ADR 0398 §2, issue 948,
- *  ADR 0534 §2): a change that enables push, drops the merge whitelist or widens it past them is refused, whatever the
- *  rule was. */
+/** Main's rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948): a change
+ *  that enables push, drops the merge whitelist or widens it past that account is refused, whatever the rule was. */
 function judgeMain(before: BranchProtection | null, want: ProtectionWanted): string | null {
   const why: string[] = [];
   if (want.push === true) why.push("it lets a person push to the branch directly");
   if (want.mergeWhitelist !== undefined) {
     const names = want.mergeWhitelist ?? [];
     if (names.length === 0) why.push("it drops the merge whitelist of main");
-    else if (names.some((n) => !mainMergers().includes(n))) {
-      why.push(`it widens who may merge into main beyond ${mainMergers().join(", ")}`);
+    else if (names.some((n) => n !== TOOLS_ACCOUNT)) {
+      why.push(`it widens who may merge into main beyond ${TOOLS_ACCOUNT}`);
     }
   }
   if (!why.length) return null;
   return `the protection of ${before?.rule_name ?? before?.branch_name ?? "main"} is only made stronger through a tool: ` +
-    `${why.join("; ")}. Main takes no push, and only ${mainMergers().join(" and ")} merge into it (novox/hq ADR 0398 §2, ADR 0534 §2) — ` +
+    `${why.join("; ")}. Main takes no push, and only ${TOOLS_ACCOUNT} merges into it (novox/hq ADR 0398 §2) — ` +
     `weakening that is the operator's, at the forge as themselves. Nothing was changed`;
 }
 

modules/gitea/index.ts

@@ -12,13 +12,7 @@
 // Consumes mesh-controller.checked — a pull request's merge check, judged — and sets it as the head
 // commit's statuses: `mesh/merge-gate`, the modules of the mesh's graph the change touches, and
 // `mesh/repo-check`, the repository's own merge-check.sh (novox/hq ADR 0237 as amended); with a comment
-// saying why when the gate is not a pass or the repository's own check failed. Of the two, only those the base
-// still requires are written (issue 1301): main requires `mesh/check` — the checker's — everywhere but hq, whose main
-// requires `mesh/repo-check` alone (ADR 0503 §5).
-//
-// Reads mesh-delivery-checker.owed — what the checker owes the forge, mesh/check on each head it judged — by a watch, and
-// writes it (check.ts; ADR 0521, R4e finding R2-1). No tool writes mesh/check (finding K1), and no event: the watch hands
-// over the latest value of every key whenever this module starts.
+// saying why when the gate is not a pass or the repository's own check failed.
 //
 // Consumes node-build-agent.started — a build machine took an ask — and says, on the head a pending check is of,
 // which machine builds it since when (novox/hq issue 446). This module is the one writer of mesh/merge-gate.
@@ -44,15 +38,12 @@
 
 import { emit, on } from "@novox/mesh-sdk/events";
 import { registerModuleTools } from "@novox/mesh-sdk/tools";
-import { statesAnnouncement } from "./kept.js";
 import { commitStatusTool } from "./delivery.js";
-import { CHECKER_OWED, CheckStatuses, watchOwed, type OwedChange } from "./check.js";
-import { state } from "@novox/mesh-sdk/state";
 import { announce, keepWatermark, readWatermark } from "./announce.js";
 import { mergeTool } from "./merge.js";
 import { GiteaAdmin, GiteaClient, movedSince } from "./client.js";
-import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, maintained,
-  requiredOf, statusesFor, writesGate, type Announced, type Checked, repoCheckFacts, reposToLook } from "./pulls.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, statusesFor, type Announced, type Checked,
+  repoCheckFacts, reposToLook } from "./pulls.js";
 import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
 import { HOOK_PATH, HOOK_PORT, Pace, claimHead, ensureSystemHook, eventsTool, keptSecret, receiver, type ForgeEvent } from "./webhook.js";
 import { keepSiblings, noteComposed, noteVerdict, readSiblings, siblingsFile, siblingsOf, weighSiblings } from "./siblings.js";
@@ -256,11 +247,8 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
   // Said, so an operator knows the mesh was asked to check it.
   console.log(`[gitea] announced ${key} at ${sha.slice(0, 8)} to be checked before it merges`);
   // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
-  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446). Only where the base
-  // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's, and hq's requires
-  // mesh/repo-check alone; a rule that cannot be read is said pending, as before.
-  const rule = await client.appliedProtection(repo.owner, repo.name, String(pull.base || "main")).catch(() => undefined);
-  if (writesGate(requiredOf(rule))) await gates.pending(repo.owner, repo.name, sha);
+  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446).
+  await gates.pending(repo.owner, repo.name, sha);
   return true;
 }
 type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
@@ -269,7 +257,7 @@ type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
 async function alreadyChecked(client: GiteaClient, repo: RepoOf, pull: OpenOf): Promise<boolean> {
   try {
     const checks = await client.headChecks(repo.owner, repo.name, String(pull.head_sha));
-    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks || CHECK_STATUS in checks;
+    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks;
   } catch {
     return false; // the forge cannot say: announced, and the bus's message id collapses it if it was
   }
@@ -406,20 +394,16 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
   // (novox/hq ADR 0323 §4): a check asked before the trunk moved. It is said so, pending with the reason, in place of
   // its pass or failure; a trunk that cannot be read lets the verdict stand, and the merge tool compares the commits.
   const trunk = base ?? c.plan?.base;
-  // Only the statuses the base still requires are written (issue 1301): on hq, mesh/repo-check alone.
-  const required = trunk ? requiredOf(await client.appliedProtection(c.owner, c.repo, trunk).catch(() => undefined)) : undefined;
-  const kept = maintained(required);
   if (c.trunk && trunk) {
     const head = await client.branchHead(c.owner, c.repo, trunk).catch(() => undefined);
     if (head && !sameCommit(c.trunk, head)) {
       const description = outOfDateWords(c.trunk, head);
-      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]
-        .filter((x) => kept.includes(x))) {
+      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]) {
         await client.setCommitStatus(c.owner, c.repo, c.commit, { state: "pending", context, description,
           ...(target ? { target_url: target } : {}) });
       }
       // Its account is kept and shown all the same (ADR 0323 §7): what it judged, and that it is out of date.
-      const said = commentFor(c, await repoCheckFacts(client, c, trunk), required);
+      const said = commentFor(c, await repoCheckFacts(client, c, trunk));
       if (c.number && !composedGate(c)) await client.addComment(c.owner, c.repo, c.number, lateVerdictComment(c, said, description));
       console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}, ` +
         `${description}`);
@@ -428,10 +412,10 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
   }
   const facts = await repoCheckFacts(client, c, base ?? c.plan?.base);
   const gateNow = composedGate(c) ? (await client.headChecks(c.owner, c.repo, c.commit).catch(() => ({} as Record<string, { description?: string }>)))[CHECK_CONTEXT]?.description : undefined;
-  for (const status of statusesFor(c, facts, gateNow, required)) {
+  for (const status of statusesFor(c, facts, gateNow)) {
     await client.setCommitStatus(c.owner, c.repo, c.commit, target ? { ...status, target_url: target } : status);
   }
-  const comment = composedGate(c) ? null : commentFor(c, facts, required);
+  const comment = composedGate(c) ? null : commentFor(c, facts);
   if (comment && c.number) await client.addComment(c.owner, c.repo, c.number, comment);
   console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}`);
 }
@@ -481,11 +465,6 @@ const gates = new GateWriter({
   headChecks: (owner, repo, sha) => (gitea as GiteaClient).headChecks(owner, repo, sha),
 });
 
-// The one writer of mesh/check, from the checker's owed (check.ts; ADR 0521).
-const checks = new CheckStatuses({
-  setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
-});
-
 // **The status tool is served here, beside the writer** (novox/hq issue 456): the runtime starts each bundle as its own
 // process, so a recheck's pending written from the tools' bundle bypassed this writer's chain. Without a forge to
 // reach, nothing is served, as the tools' bundle serves nothing then.
@@ -494,10 +473,6 @@ const checks = new CheckStatuses({
 const pace = new Pace();
 if (!gitea) pace.unheard("the forge is not watched: no way to a token", false);
 
-// The states this module keeps and which others may read, said on the bus before it serves (novox/hq ADR 0495 clause 2).
-// Said with `emit`, not the SDK's `keeps`, which the toolchain's SDK does not have yet: switch to `keeps` once that SDK is 0.1.15 or later (issue 1852).
-await emit("states", statesAnnouncement(process.env.MESH_MODULE || "gitea", process.env.MESH_NODE));
-
 // gitea_events is served whether or not the forge is watched: it says so (novox/hq issue 729).
 registerModuleTools("gitea", () => [eventsTool(pace), ...(gitea ? [commitStatusTool({
   setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
@@ -630,7 +605,4 @@ if (gitea) {
     })],
     ["node-build-agent.started", () => on("node-build-agent.started", buildStarted)],
   ], () => console.log("[gitea] watching for new repositories and merged pull requests"));
-  // The checker's mesh/check, from its owed state (check.ts; ADR 0521): a read not granted yet is said once and asked again,
-  // apart from the binds above, so neither waits for the other.
-  void watchOwed((handler) => state<OwedChange["value"]>(CHECKER_OWED).watch((change) => handler(change)), checks);
 }

modules/gitea/kept.ts

@@ -1,20 +0,0 @@
-// The states this module keeps on the bus and whether other modules may read them (novox/hq ADR 0495 clause 2; issue
-// 1790): the module says it itself, from its code, as it starts (index.ts calls keeps with this list), and a reader is
-// granted what it said (clause 3). A state is readable when another module's manifest reads it; none reads gitea's.
-// test/kept.test.ts holds the list to the manifest's `state`.
-export const KEPT: readonly { readonly name: string; readonly readable?: boolean }[] = [
-  { name: "announced" },
-  { name: "bound" },
-];
-
-/** The announcement of these states, in the layout mesh-sdk's go/announce reads (novox/hq ADR 0495 clause 2): version 1,
- *  the module, the machine when known, and the states sorted by name, `readable` only where true. It is said as the event
- *  `states`, which is the subject mesh.mod.gitea.event.states. gitea says it with the SDK's `emit` because the
- *  toolchain's SDK, which judges R4e's group, predates the SDK's `keeps` (0.1.15); switch to `keeps` once the toolchain's
- *  SDK is 0.1.15 or later (issue 1852). */
-export function statesAnnouncement(module: string, node: string | undefined) {
-  const states = [...KEPT]
-    .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
-    .map((k) => (k.readable ? { name: k.name, readable: true } : { name: k.name }));
-  return { v: 1, module, ...(node ? { node } : {}), states };
-}

modules/gitea/merge.ts

@@ -4,20 +4,13 @@
 // when a verdict is judged against an earlier trunk commit than the trunk's head, the tool asks the head's check and
 // puts its statuses back to pending through that writer, so where the check runs is said and no second check is asked.
 // Each bundle the runtime serves is its own process; from the tools' bundle the pending bypassed the writer's chain.
-//
-// **It judges mesh/check whether or not the base requires it** (issue 1301; ADR 0447 §1, §4; ADR 0534 §4): the checker's
-// verdict, whose line names the trunk it judged ("pass <head12> on <trunk12>"), must be a pass against the trunk's head.
-// The forge requires no status to merge (ADR 0534 §1); where a base still requires one of the controller's old statuses,
-// until the forge's holder takes it off, that status judges, as before. A mesh/check of another trunk is refused and
-// nothing is asked: the checker sets it out of date on the trunk's move and checks it again. Where the base requires no
-// status, only a head the operator's Approve names (approved_heads) merges (ADR 0534 §4, ADR 0421 §9).
 
 import { announce } from "./announce.js";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus, GiteaClient } from "./client.js";
 import { mergeableUnder, newestByContext } from "./checks.js";
 import { MERGE_METHODS, Refused, checkName } from "./guard.js";
-import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, maintained, requiredOf } from "./pulls.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
 import { approvedHeadsOf, groupRefusal, memberKey, namesSiblings, notApproved, readSiblings, siblingOutOfDate, siblingsFile } from "./siblings.js";
 import { announcementOf, askedWords, outOfDateWords, sameCommit, tookFile, tookWords, twelve, verdictAtTrunk, waitsForComposed } from "./trunk.js";
 
@@ -38,10 +31,9 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
     now: given.now ?? (() => new Date()) };
   return {
     name: "gitea_merge_pull_request",
-    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head, " +
-      "its base refuses this account's push, its mesh/check passed judged against the trunk's head as it is now, and, " +
-      "where the base requires no status (novox/hq ADR 0534), the operator's Approve names it in approved_heads; " +
-      "optionally deleting the source branch afterwards. Refused " +
+    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
+      "and every status its base branch's protection requires succeeded there (mesh/merge-gate, mesh/repo-check), " +
+      "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
       "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
       "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
       "the trunk's head is asked once, with how long the last check of the repository took: ask again at the same head " +
@@ -103,11 +95,11 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
           `approved (novox/hq ADR 0421). Nothing was merged`);
       }
       const rule = await gitea.appliedProtection(owner, repo, pull.base);
-      // Only into a branch whose protection refuses this account's push: a pull request whose base was moved to a
-      // branch nothing guards would land where anyone pushes (novox/hq ADR 0266, ADR 0534 §4).
-      if (!rule || rule.enable_push !== false) {
-        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule refusing ` +
-          `a push guards: a tool merges only into such a branch (novox/hq ADR 0266, ADR 0534). Nothing was merged`);
+      // Only into a branch whose protection requires the checks: a pull request whose base was moved to a
+      // branch nothing guards would merge past every check (novox/hq ADR 0266).
+      if (!rule || !rule.enable_status_check || !(rule.status_check_contexts ?? []).filter(Boolean).length) {
+        throw new Refused(`${owner}/${repo}#${number} merges into ${pull.base}, which no protection rule requiring ` +
+          `the checks guards: a tool merges only into such a branch (novox/hq ADR 0266). Nothing was merged`);
       }
       // **The verdict must be judged against the trunk's head** (novox/hq ADR 0323 §5, issue 341): a check judges the
       // head merged into a named trunk commit, and a merge of another trunk is not the one that check judged. Compared
@@ -116,45 +108,11 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       // head makes — never again while one is on its way. The caller asks again at the reviewed head once it passes.
       const trunkHead = await gitea.branchHead(owner, repo, pull.base);
       const checks = await gitea.headChecks(owner, repo, pull.head_sha);
-      const required = requiredOf(rule) ?? [];
-      // **The forge requires no status; the operator's Approve and mesh/check do** (ADR 0534 §4): where the base requires
-      // no status, only a head the Approve names merges, and mesh/check judges it as where it was required.
-      if (required.length === 0 && !approved) {
-        throw new Refused(`${owner}/${repo}#${number} is not merged: ${pull.base} requires no status, so a merge into it ` +
-          `lands only a head the operator's Approve names: give approved_heads with ${owner}/${repo}@<full sha> ` +
-          `(novox/hq ADR 0534, ADR 0421 §9). Nothing was merged`);
-      }
-      const kept = maintained(required);
-      const byCheck = required.includes(CHECK_STATUS) || kept.length === 0;
-      if (byCheck) {
-        // **mesh/check is the checker's** (ADR 0447 §4): it is judged here against the trunk's head, and refused when it
-        // is not current; nothing is written or asked — the checker checks a head again when its trunk moves.
-        const check = checks[CHECK_STATUS];
-        const at = verdictAtTrunk(checks, trunkHead, CHECK_STATUS);
-        if (!check || check.state === "pending") {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ` +
-            `${check ? `pending (${check.description ?? ""})` : "not set yet"}; the checker answers it. Ask again at ` +
-            `${twelve(pull.head_sha)} once it passes against ${pull.base}'s head ${twelve(trunkHead)}. Nothing was merged`);
-        }
-        if (check.state !== "success") {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ${check.state} ` +
-            `(${check.description ?? ""}). A pull request merges once its check passes (novox/hq ADR 0534). Nothing was merged`);
-        }
-        if (!at.current) {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} ` +
-            `${at.judged ? `was judged on trunk ${twelve(at.judged)}` : "names no trunk commit it was judged on"}, and ` +
-            `${pull.base} is now ${twelve(trunkHead)}. The checker checks it again against the trunk's head (novox/hq ` +
-            `ADR 0447); this tool asks nothing. Ask again at ${twelve(pull.head_sha)} once it passes. Nothing was merged`);
-        }
-      }
-      // Where the base still requires the controller's statuses (hq's mesh/repo-check; mesh/merge-gate only on a
-      // revert), the first it requires judges, as before (ADR 0323 §5).
-      const judge = kept[0] ?? CHECK_CONTEXT;
-      const at = kept.length ? verdictAtTrunk(checks, trunkHead, judge) : { current: true, onItsWay: false };
+      const at = verdictAtTrunk(checks, trunkHead);
       if (!at.current) {
         // A verdict put out of date by a sibling's move says so in its own words (ADR 0382 §5); it is asked again as a
         // trunk's move is, and a failed ask puts those words back, not the trunk's.
-        const siblingWords = siblingOutOfDate(checks[judge]?.description) ? checks[judge]?.description : undefined;
+        const siblingWords = siblingOutOfDate(checks[CHECK_CONTEXT]?.description) ? checks[CHECK_CONTEXT]?.description : undefined;
         const judged = siblingWords ? `was put out of date by a sibling's move (${siblingWords})`
           : at.judged ? `was judged against trunk ${twelve(at.judged)}` : "names no trunk commit it was judged against";
         const took = tookWords(tookFile(deps.stateDir), `${owner}/${repo}`);
@@ -162,22 +120,21 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
         // **A member that waits for its group's composed check is not announced again** (novox/hq issue 1106): its own
         // check can only say "composed" once more, so an ask here brought a verdict naming no trunk and the next merge was
         // refused the same way for ever. The composed check is mesh-delivery's to ask; this says whose verdict is awaited.
-        if (waitsForComposed(checks[judge])) {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[judge]?.description}; the ` +
+        if (waitsForComposed(checks[CHECK_CONTEXT])) {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[CHECK_CONTEXT]?.description}; the ` +
             `verdict that names its trunk commit is its group's composed check's, and mesh-delivery asks it, this tool asks no check ` +
             `(main is now ${now}). Ask again once the group's composed check has passed. Nothing was merged`);
         }
         if (at.onItsWay) {
           throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
-            `${now}. Its check is already asked and not yet answered (${checks[judge]?.description}), so it is not ` +
+            `${now}. Its check is already asked and not yet answered (${checks[CHECK_CONTEXT]?.description}), so it is not ` +
             `asked again; ${took}. Ask again at ${head} once both statuses pass: this tool never merges by itself ` +
               `(novox/hq ADR 0323). A check that never answers is asked again with mesh-delivery.recheck. Nothing was merged`);
         }
         // Pending first, so a second ask finds the check on its way; then the head is announced as a new head is. An
         // announcement that cannot be made puts the statuses back to out of date, so the next ask asks again rather
         // than wait for ever on a check nobody asked.
-        // The statuses the base requires of the controller's (issue 1301): hq's mesh/repo-check alone.
-        const contexts = kept.filter((c) => c === judge || (c === REPO_CHECK_CONTEXT && checks[REPO_CHECK_CONTEXT]));
+        const contexts = [CHECK_CONTEXT, ...(checks[REPO_CHECK_CONTEXT] ? [REPO_CHECK_CONTEXT] : [])];
         // Through the module's one writer of the merge check (gate.ts, novox/hq issue 456): the pending opens a new
         // check of the head, so where it runs is said ("building on …") and its verdict is not weighed as older.
         const say = async (description: string) => {
@@ -210,12 +167,9 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
       // **A member judged beside its siblings merges only with its group passed and reviewed** (novox/hq ADR 0382 §6): the
       // siblings its verdict names are the holder's record (siblings.ts); a status that says it read siblings with no record
       // of them is no verdict to merge on, never read as none.
-      // Under mesh/check (issue 1301) the group is the checker's one verdict on every member's head (ADR 0447 §2) and the
-      // Approve's heads above; a record the controller's verdicts left before the switch judges nothing there.
-      const heard = byCheck ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
+      const heard = readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
       const siblings = heard && sameCommit(heard.head, pull.head_sha) ? heard.siblings : [];
-      if (!siblings.length && !byCheck &&
-        namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
+      if (!siblings.length && namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
         throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict read siblings, and which ones is not held ` +
           `here, so the group cannot be weighed. Ask its check again at ${twelve(pull.head_sha)}. Nothing was merged`);
       }

modules/gitea/module.json

@@ -172,15 +172,9 @@
     },
     "repositories": {
       "type": "object",
-      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push, the tools' account and main-mergers alone merging, and no status required (ADR 0534), and only then moved into the organisation; one that exists only has main's rule put right so. Every other repository has the statuses its main requires taken off; nothing else of a repository out of the value is touched.",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/repo-check and mesh/merge-gate, and only then moved into the organisation; one that exists only has main's rule put right, its statuses kept. A repository taken out of the value is never touched.",
       "trusted": true,
       "default": {}
-    },
-    "main-mergers": {
-      "type": "list",
-      "description": "The forge logins that may merge into main beside the tools' account, on every repository of the organisation (ADR 0534 §2): the operator's own, so the operator can always merge by hand at the forge. The tools' account is always on main's merge whitelist; no agent's account belongs here.",
-      "trusted": true,
-      "default": ["jschoubben"]
     }
   },
   "facts": {
@@ -309,8 +303,7 @@
       "template": "files/config.json",
       "merge": "json",
       "takes-config": [
-        "url",
-        "main-mergers"
+        "url"
       ]
     },
     {
@@ -373,12 +366,10 @@
         "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
         "MESH_GITEA_TOOLS_USER": "mesh-tools",
         "MESH_REPOSITORIES_FILE": "${dir:mesh-state}/repositories.json",
-        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json",
-        "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json"
       },
       "restart-on": [
-        "repositories-file",
-        "runtime-config"
+        "repositories-file"
       ]
     }
   ],
@@ -552,7 +543,6 @@
     "ssh-client.keys",
     "mesh-build-go.keys",
     "mesh-build-node.keys",
-    "mesh-build-image.keys",
-    "mesh-delivery-checker.owed"
+    "mesh-build-image.keys"
   ]
 }

modules/gitea/package.json

@@ -6,7 +6,7 @@
   "private": true,
   "scripts": {
     "build": "tsc client.ts token.ts index.ts provisioner/index.ts provisioner/teams.ts tools/index.ts --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist",
-    "test": "npm run build && tsc --module NodeNext --moduleResolution NodeNext --target ES2022 --types node --rootDir . --outDir . $(find . -name '*.ts' ! -name '*.d.ts' ! -path './test/*' ! -path './node_modules/*' ! -path './dist/*') && node --test --experimental-strip-types 'test/*.test.ts'"
+    "test": "npm run build && node --test --experimental-strip-types 'test/*.test.ts'"
   },
   "dependencies": {
     "@novox/mesh-sdk": "^0.1.1"

modules/gitea/protection.ts

@@ -1,9 +1,7 @@
-// A branch's protection (novox/hq ADR 0237): no direct push, and on main only the tools' account merges (ADR 0398 §2).
-// The forge requires no status to merge (ADR 0534 §1): the checks still run and report, and mesh-delivery and the
-// merge tool judge them (ADR 0534 §3, §4), never the forge. Pure, so it is tested without a forge; the client does the
-// asking (client.ts).
+// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's merge check —
+// `mesh/merge-gate`, the module graph's gate, and `mesh/repo-check`, the repository's own tests — before it
+// may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).
 
-import { readFileSync } from "node:fs";
 import { TOOLS_ACCOUNT } from "./tools-account.js";
 
 /** The branch whose rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948). */
@@ -26,50 +24,26 @@ export interface BranchProtection {
 /** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
  *  default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
 export interface ProtectionWanted {
+  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/merge-gate. Empty: none. */
+  statusChecks: string[];
   /** Whether a person may push to the branch directly. */
   push?: boolean;
-  /** Whether an administrator is stopped from merging past what the rule asks. */
+  /** Whether an administrator is stopped from merging past a status that has not succeeded. */
   blockAdminOverride?: boolean;
   /** Who may merge into the branch; for main only ever the tools' account (ADR 0398 §2). Not given: left as it is.
    *  Empty or null asks for no whitelist, which the guard refuses for main; the body for main ignores it. */
   mergeWhitelist?: string[] | null;
 }
 
-/** What every rule the mesh writes says of statuses: none is required to merge (novox/hq ADR 0534 §1). */
-export function noStatusBody(): Record<string, unknown> {
-  return { enable_status_check: false, status_check_contexts: [] };
-}
-
-/** A forge login a merge whitelist may name. */
-const LOGIN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,39}$/;
-
-/** Who merges into main: the tools' account, for mesh-delivery, then each login of the module's config value
- *  main-mergers once, the operator's own, so the operator can always merge by hand at the forge (novox/hq ADR 0534 §2).
- *  Read from the module's runtime config file (MESH_GITEA_CONFIG_FILE); a file not there, or a name that is no login,
- *  leaves the tools' account alone, the narrowest whitelist. */
-export function mainMergers(env: NodeJS.ProcessEnv = process.env): string[] {
-  const out = [TOOLS_ACCOUNT];
-  let given: unknown = [];
-  try {
-    if (env.MESH_GITEA_CONFIG_FILE) given = JSON.parse(readFileSync(env.MESH_GITEA_CONFIG_FILE, "utf8"))["main-mergers"] ?? [];
-  } catch {
-    given = [];
-  }
-  for (const name of Array.isArray(given) ? given : []) {
-    if (typeof name === "string" && LOGIN.test(name) && !name.includes("..") && !out.includes(name)) out.push(name);
-  }
-  return out;
-}
-
-/** What main's rule always says: no push, only the tools' account and main-mergers merge (novox/hq ADR 0398 §2,
- *  issue 948, ADR 0534 §2), and no status required (ADR 0534 §1). */
-export function mainRuleBody(mergers: string[] = mainMergers()): Record<string, unknown> {
-  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: mergers, ...noStatusBody() };
+/** What main's rule always says: no push, and only the tools' account merges (novox/hq ADR 0398 §2, issue 948). */
+export function mainRuleBody(): Record<string, unknown> {
+  return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT] };
 }
 
 /** The forge's body for a wanted protection. */
 export function protectionBody(want: ProtectionWanted, creating: boolean, branch = ""): Record<string, unknown> {
-  const body: Record<string, unknown> = noStatusBody();
+  const checks = [...new Set(want.statusChecks.map((c) => c.trim()).filter(Boolean))];
+  const body: Record<string, unknown> = { enable_status_check: checks.length > 0, status_check_contexts: checks };
   if (want.push !== undefined) body.enable_push = want.push;
   else if (creating) body.enable_push = false;
   if (want.blockAdminOverride !== undefined) body.block_admin_merge_override = want.blockAdminOverride;

modules/gitea/pulls.ts

@@ -19,34 +19,6 @@ export const CHECK_CONTEXT = "mesh/merge-gate";
 /** The status context of the repository's own merge-check.sh, the check's second layer (novox/hq ADR 0237). */
 export const REPO_CHECK_CONTEXT = "mesh/repo-check";
 
-/** The one status main requires (novox/hq ADR 0447 §1, issue 1301): the checker's verdict, written by this module from the
- *  checker's owed state (check.ts, ADR 0521). Its line names the head and the trunk commit it judged: "pass <head12> on <trunk12> …". */
-export const CHECK_STATUS = "mesh/check";
-
-/** The statuses a branch's rule requires, from the rule the forge applies to it: none when it is unprotected or checks
- *  no status; undefined when the rule could not be read. */
-export function requiredOf(rule: { enable_status_check?: boolean; status_check_contexts?: string[] | null } | null | undefined): string[] | undefined {
-  if (rule === undefined) return undefined;
-  if (!rule || !rule.enable_status_check) return [];
-  return (rule.status_check_contexts ?? []).filter(Boolean);
-}
-
-/**
- * **The controller's statuses are written only where a base still requires them** (issue 1301; ADR 0503 §3, §5): of
- * mesh/merge-gate and mesh/repo-check, those the base requires — hq's mesh/repo-check alone once the forge requires
- * mesh/check everywhere else, so no mesh/merge-gate stands on a head that nothing will set. A base whose rule could not
- * be read keeps both, as before: a status nothing requires blocks nothing, and one that is required is never left out.
- */
-export function maintained(required: string[] | undefined): string[] {
-  const both = [CHECK_CONTEXT, REPO_CHECK_CONTEXT];
-  return required === undefined ? both : both.filter((c) => required.includes(c));
-}
-
-/** Whether mesh/merge-gate is written on a head of this base (maintained). */
-export function writesGate(required: string[] | undefined): boolean {
-  return maintained(required).includes(CHECK_CONTEXT);
-}
-
 /**
  * The pending words a head's merge check is announced with (novox/hq issue 446): where the check is, and since when,
  * in the time the operator reads. They stood as "the mesh is mapping this head onto its module graph" for the whole
@@ -285,14 +257,8 @@ export function composedGate(c: Checked): boolean {
   return c.gate?.verdict === "composed";
 }
 
-/** Every status a verdict sets: the gate's, and the repository's own check's when it was said; of them, only those the
- *  base requires (`required`, the base's rule: maintained). */
-export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string, required?: string[]): CommitStatus[] {
-  const kept = maintained(required);
-  return allStatusesFor(c, facts, gateNow).filter((s) => kept.includes(s.context));
-}
-
-function allStatusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
+/** Every status a verdict sets: the gate's, and the repository's own check's when it was said. */
+export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
   if (composedGate(c)) {
     // A member whose gate the group's composed check judges (ADR 0403 §1): only its repository's check is its own to
     // set. The gate stays pending, saying it waits for the group, unless a composed verdict already stands on it.
@@ -326,13 +292,11 @@ function judgedFirst(c: Checked, status: CommitStatus): CommitStatus {
  *  change that builds something (novox/hq ADR 0238), and why, when the gate is not a pass or the
  *  repository's own check failed or could not run. A repository with no merge-check.sh, touching nothing,
  *  is said by its statuses alone, not by a comment on every push. */
-export function commentFor(c: Checked, facts: RepoCheckFacts = {}, required?: string[]): string | null {
+export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | null {
   const gate = c.gate ?? { verdict: c.verdict, summary: c.summary };
-  // A base that no longer requires the gate (issue 1301) is told nothing of it: its verdict is the repository's own check.
-  const withGate = writesGate(required);
   const repo = c["repo-check"];
   const wrong = repoWrong(repo, facts);
-  if ((!withGate || gate.verdict === "pass") && !wrong && !builds(c.plan)) return null;
+  if (gate.verdict === "pass" && !wrong && !builds(c.plan)) return null;
   const lines = [`**Merge check** at \`${c.commit.slice(0, 8)}\``, ""];
   if (c.trunk) {
     // What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and what was read beside it.
@@ -348,11 +312,9 @@ export function commentFor(c: Checked, facts: RepoCheckFacts = {}, required?: st
   } else if (c.siblings_unknown) {
     lines.splice(c.trunk ? 2 : 1, 0, `Siblings could not be learned: ${c.siblings_unknown}`);
   }
-  if (withGate) {
-    lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
-      (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
-        (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
-  }
+  lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
+    (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
+      (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
   if (repo) {
     const st = repoStatus(repo, facts);
     lines.push(`- \`${REPO_CHECK_CONTEXT}\`: ` + (repo.verdict === "warning" && facts.defined === false

modules/gitea/test/bundle-import.test.ts

@@ -36,76 +36,3 @@ test("importing the bundle resolves while the broker keeps refusing the binds",
   clearTimeout(timer);
   assert.match(out, /imported/, `the import did not resolve within 3 s while a bind was refused; stderr: ${err.slice(0, 600)}`);
 });
-
-// **The bundle writes mesh/check from the checker's owed state, and serves no tool that writes it** (ADR 0521; R4e round 2
-// finding R2-1; finding K1). The bundle is imported whole, as the runtime imports it, while its read of the checker's owed
-// is refused (the grant not yet composed): the watch is asked again, and once granted it is handed the bucket as the bus
-// keeps it, the latest revision of each key, then an older revision delivered late. The forge stand-in sees the latest
-// written, and nothing after it.
-test("a bundle whose read of the checker's owed is granted late writes the latest mesh/check, and serves no gitea_check_status", async () => {
-  const index = pathToFileURL(join(here, "..", "dist", "index.js")).href;
-  const sha = "0123456789abcdef0123456789abcdef01234567";
-  const script = `
-    const http = await import("node:http");
-    const statuses = [];
-    const forge = http.createServer((req, res) => {
-      let b = ""; req.on("data", (d) => (b += d)); req.on("end", () => {
-        if (req.method === "POST" && /\\/statuses\\//.test(req.url)) statuses.push(req.url + " " + b);
-        res.setHeader("content-type", "application/json"); res.end(req.method === "GET" ? "[]" : "{}");
-      });
-    });
-    await new Promise((r) => forge.listen(0, "127.0.0.1", r));
-    process.env.MESH_GITEA_URL = "http://127.0.0.1:" + forge.address().port;
-    const bound = [];
-    const { useBroker } = await import("@novox/mesh-sdk/messaging");
-    useBroker(() => ({
-      subscribe: async (pattern) => { bound.push(pattern); return () => {}; },
-      publish: async () => {}, request: async () => { throw new Error("no responders"); },
-      handle: async () => () => {}, close: async () => {},
-    }));
-    const key = "novox/mesh-sdk.12.${sha}.status=mesh/check";
-    const owed = (state, text) => ({ v: 1, act: "status", context: "mesh/check", state, text, target: "https://view.example/c" });
-    const watched = [];
-    let granted = 0;
-    const { useStateChannel } = await import("@novox/mesh-sdk/state");
-    useStateChannel({
-      ask: async () => null,
-      watch: async (params, deliver) => {
-        watched.push(params.state);
-        if (watched.length === 1) throw new Error('gitea keeps and reads no state called "mesh-delivery-checker.owed"');
-        granted++;
-        // Two revisions were written while the read was refused; the bucket hands the latest, then a late older one.
-        await deliver({ state: params.state, key, op: "put", value: owed("success", "pass at 4"), revision: 4, current: true });
-        await deliver({ state: params.state, key, op: "put", value: owed("pending", "pending at 3"), revision: 3, current: false });
-      },
-    });
-    await import(${JSON.stringify(index)});
-    const { collectTools } = await import("@novox/mesh-sdk/tools");
-    const tools = collectTools().flatMap((r) => r.tools.map((t) => t.name));
-    for (let i = 0; i < 300 && !(granted && statuses.length); i++) await new Promise((r) => setTimeout(r, 20));
-    await new Promise((r) => setTimeout(r, 200));
-    console.log(JSON.stringify({ tools, bound, watched, statuses }));
-    process.exit(0);`;
-  const env = { ...process.env, MESH_GITEA_TOKEN: "x" };
-  for (const k of ["MESH_GITEA_STATE_DIR", "MESH_GITEA_ADMIN_USER", "MESH_GITEA_ADMIN_PASSWORD", "MESH_SERVED_MODULE", "MESH_GITEA_URL"]) delete env[k];
-  const child = spawn(process.execPath, ["--input-type=module", "-e", script], { cwd: join(here, ".."), env, stdio: ["ignore", "pipe", "pipe"] });
-  let out = "";
-  let err = "";
-  child.stdout.on("data", (d) => (out += d));
-  child.stderr.on("data", (d) => (err += d));
-  const ended = new Promise<void>((r) => child.on("exit", () => r()));
-  const timer = setTimeout(() => child.kill("SIGKILL"), 15000);
-  await ended;
-  clearTimeout(timer);
-  const line = out.split("\n").find((l) => l.startsWith("{"));
-  assert.ok(line, `the bundle said nothing; stdout: ${out.slice(0, 400)} stderr: ${err.slice(0, 600)}`);
-  const got = JSON.parse(line!) as { tools: string[]; bound: string[]; watched: string[]; statuses: string[] };
-  assert.ok(got.tools.includes("gitea_commit_status"), `the bundle's tools: ${got.tools}`);
-  assert.ok(!got.tools.includes("gitea_check_status"), "no tool writes mesh/check");
-  assert.ok(!got.bound.some((p) => p.includes("check.status")), `bound: ${got.bound}`);
-  assert.deepEqual(got.watched, ["mesh-delivery-checker.owed", "mesh-delivery-checker.owed"], "refused, then asked again");
-  assert.equal(got.statuses.length, 1, `statuses written: ${got.statuses}`);
-  assert.match(got.statuses[0], new RegExp(`/repos/novox/mesh-sdk/statuses/${sha} .*"context":"mesh/check"`));
-  assert.match(got.statuses[0], /"state":"success".*pass at 4/);
-  assert.match(err, /mesh-delivery-checker\.owed could not be bound/, "the refusal is said");
-});

modules/gitea/test/check-owed.test.ts

@@ -1,135 +0,0 @@
-// **mesh/check is written from the checker's owed state, read by a watch** (ADR 0521; R4e round 2 finding R2-1; finding K1
-// before it). No tool writes mesh/check, since a tool is told no caller and node-tools invokes every tool. Nor does an event:
-// nothing in the delivery plan orders this module before the forge bridge, and a durable consumer whose filters change keeps
-// its deliver policy, so an event said before this module consumed it was lost. A watch of the checker's state hands over
-// the latest value of every key when it starts, whenever that is.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { readFileSync } from "node:fs";
-
-const sha = "0123456789abcdef0123456789abcdef01234567";
-const key = (s = sha, repo = "novox/mesh-sdk", n = 12) => `${repo}.${n}.${s}.status=mesh/check`;
-const owed = (over: Record<string, unknown> = {}) => ({ v: 1, act: "status", context: "mesh/check", state: "success",
-  text: "pass 0123456789ab on aaaaaaaaaaaa", target: "https://view.example/checks/g.1", ...over });
-const put = (k: string, value: unknown, revision: number, current = false) =>
-  ({ state: "mesh-delivery-checker.owed", key: k, op: "put" as const, value, revision, current });
-
-function forge() {
-  const sent: string[] = [];
-  let failing = 0;
-  return {
-    sent,
-    fail: (n: number) => { failing = n; },
-    setCommitStatus: async (o: string, r: string, s: string, st: any) => {
-      if (failing > 0) { failing--; throw new Error("Gitea API /repos/x/statuses: 502 bad gateway"); }
-      sent.push(`${o}/${r}@${s.slice(0, 8)} ${st.context} ${st.state} ${st.description}${st.target_url ? " " + st.target_url : ""}`);
-    },
-  };
-}
-const noSleep = async () => {};
-
-test("the checker's owed is what this module reads, and it consumes no check.status", async () => {
-  const { CHECKER_OWED } = await import("../check.ts");
-  assert.equal(CHECKER_OWED, "mesh-delivery-checker.owed");
-  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8"));
-  assert.ok(manifest.reads.includes(CHECKER_OWED), "gitea's manifest reads the checker's owed");
-  assert.ok(!manifest.consumes.some((c: string) => c.includes("check.status")), "no check.status is consumed");
-});
-
-test("an owed mesh/check writes the status on its head: its state, its line cut and its link", async () => {
-  const { CheckStatuses } = await import("../check.ts");
-  const f = forge();
-  const checks = new CheckStatuses(f, () => {}, noSleep);
-  assert.equal(await checks.apply(put(key(), owed(), 7, true)), "written");
-  const other = sha.replace(/0/g, "f");
-  assert.equal(await checks.apply(put(key(other, "novox/my=2erepo"), owed({ state: "pending", text: "y".repeat(300), target: "javascript:x" }), 8)), "written");
-  assert.equal(f.sent[0], "novox/mesh-sdk@01234567 mesh/check success pass 0123456789ab on aaaaaaaaaaaa https://view.example/checks/g.1");
-  assert.ok(f.sent[1].startsWith("novox/my.repo@f1234567 mesh/check pending yyyy"), f.sent[1]);
-  assert.ok(f.sent[1].length < 200, "the line is cut as every status's is");
-  assert.ok(!f.sent[1].includes("javascript"), "a link that is no web page is not written");
-});
-
-test("a key or value that is no owed mesh/check, and a delete, write nothing", async () => {
-  const { CheckStatuses } = await import("../check.ts");
-  const f = forge();
-  const checks = new CheckStatuses(f, () => {}, noSleep);
-  const cases = [
-    put(key(sha.slice(0, 12)), owed(), 1), put(`novox/mesh-sdk.12.${sha}.status=mesh/merge-gate`, owed(), 1),
-    put(`novox/mesh-sdk.12.${sha}.view`, owed(), 1), put(`nokey`, owed(), 1), put(`../x/y.12.${sha}.status=mesh/check`, owed(), 1),
-    put(key(), owed({ context: "mesh/delivery" }), 1), put(key(), owed({ act: "view" }), 1), put(key(), owed({ state: "green" }), 1),
-    put(key(), owed({ v: 2 }), 1), put(key(), null, 1), put(key(), "text", 1), put(key(), owed(), -1),
-    { state: "mesh-delivery-checker.owed", key: key(), op: "delete" as const, revision: 2, current: false },
-  ];
-  for (const c of cases) assert.equal(await checks.apply(c as any), "dropped", JSON.stringify(c));
-  assert.deepEqual(f.sent, []);
-});
-
-test("a revision older than one written on the key is dropped; the same one is written again", async () => {
-  const { CheckStatuses } = await import("../check.ts");
-  const f = forge();
-  const checks = new CheckStatuses(f, () => {}, noSleep);
-  await checks.apply(put(key(), owed({ state: "success" }), 10));
-  assert.equal(await checks.apply(put(key(), owed({ state: "pending" }), 9)), "dropped", "a stale pending never hides the verdict");
-  assert.equal(await checks.apply(put(key(), owed({ state: "success" }), 10)), "written");
-  assert.equal(await checks.apply(put(key(sha.replace(/1/g, "2")), owed({ state: "pending" }), 3)), "written", "another key is its own");
-  assert.equal(await checks.apply(put(key(), owed({ state: "pending" }), 11)), "written");
-  assert.deepEqual(f.sent.map((s) => s.split(" ").slice(0, 3).join(" ")), ["novox/mesh-sdk@01234567 mesh/check success",
-    "novox/mesh-sdk@01234567 mesh/check success", "novox/mesh-sdk@02234567 mesh/check pending", "novox/mesh-sdk@01234567 mesh/check pending"]);
-});
-
-test("a forge that refuses is asked again until it writes, unless a newer revision of the key came meanwhile", async () => {
-  const { CheckStatuses } = await import("../check.ts");
-  const f = forge();
-  const said: string[] = [];
-  const waits: number[] = [];
-  const checks = new CheckStatuses(f, (l) => said.push(l), async (ms) => { waits.push(ms); });
-  f.fail(2);
-  await checks.take(put(key(), owed({ state: "success" }), 5));
-  await checks.settled();
-  assert.deepEqual(f.sent.map((s) => s.split(" ")[2]), ["success"], "written on the third ask");
-  assert.deepEqual(waits, [2_000, 5_000]);
-  assert.match(said[0], /502.*asked again/);
-  // A refusal whose key moved on meanwhile is not asked again: the newer revision is written, the older never after it.
-  const g = forge();
-  let release: () => void = () => {};
-  const gate = new Promise<void>((r) => { release = r; });
-  const later = new CheckStatuses(g, () => {}, () => gate);
-  g.fail(1);
-  await later.take(put(key(), owed({ state: "pending" }), 6));
-  await later.take(put(key(), owed({ state: "success" }), 7));
-  release();
-  await later.settled();
-  assert.deepEqual(g.sent.map((s) => s.split(" ")[2]), ["success"]);
-});
-
-test("a watch refused at first is asked again, said once, and once granted writes the latest revision of each key", async () => {
-  const { CheckStatuses, watchOwed } = await import("../check.ts");
-  const f = forge();
-  const said: string[] = [];
-  const checks = new CheckStatuses(f, () => {}, noSleep);
-  // The checker's bucket as the bus keeps it: two revisions of one key written while the read was refused.
-  const kept = new Map<string, { value: unknown; revision: number }>();
-  kept.set(key(), { value: owed({ state: "pending" }), revision: 3 });
-  kept.set(key(), { value: owed({ state: "success" }), revision: 4 });
-  let asked = 0;
-  const watch = async (handler: (c: any) => Promise<void>) => {
-    asked++;
-    if (asked < 3) throw new Error("gitea keeps and reads no state called \"mesh-delivery-checker.owed\"");
-    for (const [k, e] of kept) await handler(put(k, e.value, e.revision, true));
-  };
-  await watchOwed(watch, checks, noSleep, (l) => said.push(l));
-  await checks.settled();
-  assert.equal(asked, 3);
-  assert.deepEqual(f.sent.map((s) => s.split(" ")[2]), ["success"], "only the latest revision is written");
-  assert.equal(said.filter((l) => /could not be bound/.test(l)).length, 1, `said once: ${said.join(" | ")}`);
-  assert.ok(said.some((l) => /bound after 3 attempts/.test(l)), said.join(" | "));
-});
-
-test("no tool writes mesh/check: gitea_check_status is gone and gitea_commit_status refuses it", async () => {
-  const delivery = await import("../delivery.ts");
-  assert.equal((delivery as Record<string, unknown>).checkStatusTool, undefined, "delivery.ts serves no gitea_check_status");
-  assert.throws(() => delivery.deliveryStatus("mesh/check", "success", "x"), /mesh-delivery-checker\.owed/);
-  const index = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
-  assert.ok(!/gitea_check_status|checkStatusTool/.test(index), "index.ts serves no gitea_check_status");
-});

modules/gitea/test/commit-trees.test.ts

@@ -171,53 +171,3 @@ test("the root tree is git's hash of the root's own entries, never the listing's
     server.close();
   }
 });
-
-test("named paths: each asked path's git object id at the commit, a file's or a directory's, by directory (1758 S1, ADR 0499 §3)", async () => {
-  const { client, server } = await serve([{ sha: COMMIT, url: "u", tree: LISTING, truncated: false, page: 1, total_count: LISTING.length }]);
-  try {
-    const got = await client.commitTrees("novox", "hq", COMMIT, { "modules/a": ["main.go", "module.json"], "modules/b": ["c"], "": ["README.md", "modules/d"] });
-    assert.deepEqual(got.paths, {
-      "modules/a": { "main.go": h("6"), "module.json": h("5") },
-      "modules/b": { c: h("8") },
-      "": { "README.md": h("1"), "modules/d": h("a") },
-    });
-    assert.deepEqual(got.trees, { "": ROOT, "modules/a": h("4"), "modules/b/c": h("8") });
-    assert.equal((await client.commitTrees("novox", "hq", COMMIT)).paths, undefined, "no paths asked, none answered");
-  } finally {
-    server.close();
-  }
-});
-
-test("a named path the listing lacks fails naming the directory and the path, and answers nothing", async () => {
-  const { client, server } = await serve([{ sha: COMMIT, url: "u", tree: LISTING, truncated: false, page: 1, total_count: LISTING.length }]);
-  try {
-    await assert.rejects(client.commitTrees("novox", "hq", COMMIT, { "modules/a": ["main.go", "gone.go"] }), (err: Error) => {
-      assert.match(err.message, /modules\/a/);
-      assert.match(err.message, /gone\.go/);
-      return true;
-    });
-    for (const bad of [[""], ["../x"], ["/abs"], ["a//b"]]) {
-      await assert.rejects(client.commitTrees("novox", "hq", COMMIT, { "modules/a": bad }), /./, JSON.stringify(bad));
-    }
-  } finally {
-    server.close();
-  }
-});
-
-test("gitea_commit_trees takes paths as {directory: [paths]} and refuses another shape before the forge is asked", async () => {
-  const { getGiteaTools } = await import("../tools/index.ts");
-  const { client, server, asked } = await serve([{ sha: COMMIT, url: "u", tree: LISTING, truncated: false, page: 1, total_count: LISTING.length }]);
-  try {
-    const tool = getGiteaTools(client).find((t) => t.name === "gitea_commit_trees")!;
-    assert.ok("paths" in tool.input, "the tool names the argument");
-    const got: any = await tool.run({ owner: "novox", repo: "hq", sha: COMMIT, paths: { "modules/a": ["main.go"] } } as any);
-    assert.deepEqual(got.paths, { "modules/a": { "main.go": h("6") } });
-    const before = asked.length;
-    for (const paths of ["modules/a", ["main.go"], { "modules/a": "main.go" }, { "modules/a": [1] }]) {
-      await assert.rejects(tool.run({ owner: "novox", repo: "hq", sha: COMMIT, paths } as any), /paths/, JSON.stringify(paths));
-    }
-    assert.equal(asked.length, before, "the forge was asked for a refused call");
-  } finally {
-    server.close();
-  }
-});

modules/gitea/test/delivery.test.ts

@@ -61,21 +61,3 @@ test("one view per pull request, found by its marker; only the mesh's statuses",
   assert.equal(deliveryStatus("mesh/repo-check", "pending", "checking again: main moved on").context, "mesh/repo-check");
   assert.equal(deliveryStatus("mesh/delivery", "success", "x", "javascript:alert(1)").target_url, undefined);
 });
-
-// Issue 1301-S4 (ADR 0447 §1; R4e findings K1 and R2-1): main requires mesh/check, so no hand may set it. The status tool
-// every caller may use refuses it in every state; no tool writes it at all: it is written from the checker's owed state
-// (check.ts, test/check-owed.test.ts; ADR 0521).
-test("mesh/check is refused by the status tool in every state", async () => {
-  const { commitStatusTool, deliveryStatus, CHECK_STATUS } = await import("../delivery.ts");
-  assert.equal(CHECK_STATUS, "mesh/check");
-  const sha = "0123456789abcdef0123456789abcdef01234567";
-  const sent: string[] = [];
-  const setCommitStatus = async (o: string, r: string, s: string, st: any) => void sent.push(`${o}/${r}@${s} ${st.context}`);
-  const gates = { rechecked: async () => { throw new Error("not the gate writer's"); } };
-  for (const state of ["pending", "success", "failure", "error", "warning"]) {
-    assert.throws(() => deliveryStatus("mesh/check", state, "x"), /mesh\/check is the checker's status/);
-    await assert.rejects(commitStatusTool({ setCommitStatus, gates } as any).run({ owner: "novox", repo: "mesh-sdk", sha,
-      context: "mesh/check", state, description: "by hand" }), /mesh-delivery-checker\.owed/);
-  }
-  assert.deepEqual(sent, [], "nothing was sent for a hand-set mesh/check");
-});

modules/gitea/test/gate.test.ts

@@ -322,13 +322,3 @@ test("a repository as the mesh clones it is told from another", async () => {
   assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-hq.git", "novox", "hq"), false);
   assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-controller.git", "novox", "hq"), false);
 });
-
-// Issue 1301: a build machine's start on a head that holds no mesh/merge-gate (its base requires none, so none was written)
-// says nothing: no "building on" status appears on a main that does not require the gate.
-test("a start on a head with no gate on the forge writes nothing", async () => {
-  const { GateWriter } = await import("../gate.ts");
-  const forge = aForge();
-  const gates = new GateWriter(forge, announcedAt);
-  assert.equal(await gates.started("novox", "hq", SHA, startedOnShanks), false);
-  assert.equal(forge.kept["mesh/merge-gate"], undefined);
-});

modules/gitea/test/guard.test.ts

@@ -109,7 +109,7 @@ const server = createServer(async (req, res) => {
     const rule = (state.rules as any[]).find((r) => ruleCovers(String(r.rule_name ?? r.branch_name), branch));
     return json(res, 200, { name: branch, commit: { id: branch === "main" ? state.trunk : "c0ffee" }, protected: !!rule,
       ...(rule ? { effective_branch_protection_name: rule.rule_name ?? rule.branch_name, enable_status_check: !!rule.enable_status_check,
-        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: !!rule.enable_push } : {}) });
+        status_check_contexts: rule.status_check_contexts ?? [], required_approvals: rule.required_approvals ?? 0, user_can_push: false } : {}) });
   }
   if (method === "GET" && path === `${repo}/pulls/7/files`) {
     return json(res, 200, url.searchParams.get("page") === "1" ? [{ filename: "modules/gitea/x.ts", status: "modified" }] : []);
@@ -237,24 +237,18 @@ test("gitea_api still writes what an author writes", async () => {
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/issues/3/comments", "POST /repos/novox/mesh-catalog/pulls/7/reviews"]);
 });
 
-// **The forge requires no status to merge** (novox/hq ADR 0534 §5): the tool writes no required status and takes no
-// status argument; taking a required status away is no weakening it refuses, and a push or an administrator's merge
-// past the rule still is.
-test("gitea_branch_protection_set writes no required status, and refuses a push or an administrator's override", async () => {
+test("gitea_branch_protection_set only strengthens", async () => {
   state.admin = true; // a repository administrator's token: the tools' account is refused the rules by the forge
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "main", ...args });
-  assert.equal((tool("gitea_branch_protection_set").input as Record<string, unknown>).status_checks, undefined,
-    "the tool takes no status argument");
-  await assert.rejects(set({ push: true }), /push to the branch directly/);
-  await assert.rejects(set({ block_admin_override: false }), /merge past/);
+  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate, mesh\/repo-check/);
+  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /drops the required status mesh\/repo-check/);
+  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", push: true }), /push to the branch directly/);
+  await assert.rejects(set({ status_checks: "mesh/merge-gate,mesh/repo-check", block_admin_override: false }),
+    /merge past a status/);
   assert.deepEqual(writes(), []);
-  await set({ status_checks: "mesh/check" }); // an argument it no longer takes is not read
+  await set({ status_checks: "mesh/merge-gate,mesh/repo-check,mesh/delivery" });
   assert.deepEqual(writes(), ["PATCH /repos/novox/mesh-catalog/branch_protections/main"]);
-  const sent = state.sent[0].body;
-  assert.equal(sent.enable_status_check, false);
-  assert.deepEqual(sent.status_check_contexts, []);
-  assert.equal(sent.enable_push, false);
 });
 
 test("gitea_merge_pull_request merges only a head whose required statuses all succeeded, and only that head", async () => {
@@ -480,62 +474,26 @@ test("gitea_api sends the path it judged, and refuses moving a pull request's ba
   assert.equal(writes().length, 2);
 });
 
-test("gitea_merge_pull_request merges only into a branch whose protection refuses its push", async () => {
-  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
-  state.statuses = [{ context: "mesh/check", state: "success", description: `pass ${REVIEWED.slice(0, 12)} on ${TRUNK.slice(0, 12)}` }];
+test("gitea_merge_pull_request merges only into a branch whose protection requires the checks", async () => {
   state.rules = [];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
-    approved_heads }), /no protection rule refusing/);
-  state.rules = [{ rule_name: "main", enable_push: true, enable_status_check: false, status_check_contexts: [] }];
-  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED,
-    approved_heads }), /no protection rule refusing/);
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
+    /no protection rule requiring the checks guards/);
+  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [] }];
+  await assert.rejects(tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED }),
+    /no protection rule requiring the checks guards/);
   assert.deepEqual(writes(), []);
 });
 
-// **The forge requires no status to merge; the merge tool still judges mesh/check, and asks the operator's Approve**
-// (novox/hq ADR 0534 §4): on a main whose rule takes no push and requires no status, a head merges only with
-// approved_heads naming it and a mesh/check that passed against the trunk's head at the merge.
-test("gitea_merge_pull_request judges mesh/check on a main requiring no status, and merges only an approved head", async () => {
-  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
-  keepSiblings(siblingsFile(stateDir), {});
-  const approved_heads = [`novox/mesh-catalog@${REVIEWED}`];
-  const merge = (args: Record<string, unknown> = { approved_heads }) =>
-    tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED, ...args });
-  state.rules = [{ rule_name: "main", enable_push: false, enable_status_check: false, status_check_contexts: [],
-    block_admin_merge_override: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] }];
-  const line = (trunk: string, s = "success", words = "pass") =>
-    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
-  const before = state.emitted.length;
-
-  state.statuses = line(TRUNK);
-  await assert.rejects(merge({}), /Approve/);
-  state.statuses = [];
-  await assert.rejects(merge(), /mesh\/check is not set yet/);
-  state.statuses = line(TRUNK, "pending", "checking");
-  await assert.rejects(merge(), /mesh\/check is pending/);
-  state.statuses = line(TRUNK, "failure", "fail");
-  await assert.rejects(merge(), /mesh\/check is failure/);
-  state.statuses = line(MOVED);
-  await assert.rejects(merge(), new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
-  state.statuses = judgedAt(TRUNK); // the old two, current: not mesh/check
-  await assert.rejects(merge(), /mesh\/check/);
-  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
-  assert.equal(state.emitted.length, before, "no check is asked");
-  assert.equal(state.merged, false);
-
-  state.statuses = line(TRUNK);
-  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
-});
-
 test("a rule named for a branch is not made weaker than the glob rule that guards it now", async () => {
   state.admin = true; // reads the rules' list, a repository administrator's (novox/hq ADR 0365)
   state.rules.push({ rule_name: "release/*", enable_push: false, enable_status_check: true,
     status_check_contexts: ["mesh/merge-gate"], block_admin_merge_override: true });
   const set = (args: Record<string, unknown>) =>
     tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-catalog", branch: "release/1", ...args });
-  await assert.rejects(set({}), /merge past/);
+  await assert.rejects(set({ status_checks: "" }), /drops the required status mesh\/merge-gate/);
+  await assert.rejects(set({ status_checks: "mesh/merge-gate" }), /merge past a status/);
   assert.deepEqual(writes(), []);
-  await set({ block_admin_override: true }); // the glob's required status is no longer asked (ADR 0534 §5)
+  await set({ status_checks: "mesh/merge-gate", block_admin_override: true });
   assert.deepEqual(writes(), ["POST /repos/novox/mesh-catalog/branch_protections"]);
 });
 
@@ -553,25 +511,26 @@ test("the judges, without a forge", () => {
   assert.ok("refused" in judgeApiCall("POST", "/repos/a/b/branch_protections", {}));
   assert.ok("contents" in judgeApiCall("POST", "/repos/a/b/contents", { new_branch: "x" }));
   assert.ok(ruleCovers("release/**", "release/a/b") && ruleCovers("feat/*", "feat/a") && !ruleCovers("feat/*", "feat/a/b"));
-  assert.equal(judgeProtectionChange(null, {}), null);
-  assert.equal(judgeProtectionChange(protectedMain(), {}), null, "taking its required statuses off is no weakening (ADR 0534 §5)");
+  assert.equal(judgeProtectionChange(null, { statusChecks: [] }), null);
+  assert.equal(judgeProtectionChange(protectedMain(), { statusChecks: ["mesh/repo-check", "mesh/merge-gate"] }), null);
 });
 
 test("main's protection is never weakened in its push or its merge whitelist (issue 948, ADR 0398 §2)", () => {
   const strong = () => ({ ...protectedMain(), enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
-  assert.equal(judgeProtectionChange(strong(), {}, [], "main"), null);
-  assert.equal(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
-  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
-  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
-  assert.match(judgeProtectionChange(strong(), { push: true }, [], "main") ?? "", /push/);
+  const checks = ["mesh/merge-gate", "mesh/repo-check"];
+  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks }, [], "main"), null);
+  assert.equal(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools"] }, [], "main"), null);
+  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: [] }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: null }, [], "main") ?? "", /merge whitelist/);
+  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["mesh-tools", "agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange(strong(), { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
   // Even a rule that lets a person push already, or has no rule yet, is not given a push through a tool.
-  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { push: true }, [], "main") ?? "", /push/);
-  assert.match(judgeProtectionChange(null, { mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
+  assert.match(judgeProtectionChange({ ...strong(), enable_push: true }, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "main") ?? "", /push/);
+  assert.match(judgeProtectionChange(null, { statusChecks: checks, mergeWhitelist: ["agent-ace"] }, [], "main") ?? "", /widens/);
   // Another branch is judged as before.
-  assert.equal(judgeProtectionChange(null, { push: true }, [], "feat/x"), null);
+  assert.equal(judgeProtectionChange(null, { statusChecks: checks, push: true }, [], "feat/x"), null);
 });
 
 test("gitea_api never acts as another user: sudo, in any case, and any query key it does not send are refused", async () => {
@@ -609,7 +568,6 @@ test("no tool's caller text becomes another path or another user: `..` and `?sud
     ["gitea_get_file", { ...repo, path: "README.md?sudo=jschoubben" }],
     ["gitea_commit_status", { ...repo, sha: "abc1234?sudo=jschoubben", context: "mesh/delivery", state: "success" }],
     ["gitea_commit_status", { ...repo, sha: "../../../admin/users", context: "mesh/delivery", state: "success" }],
-    ["gitea_commit_status", { ...repo, sha: "0123456789abcdef0123456789abcdef01234567", context: "mesh/check", state: "success" }],
     ["gitea_commit_statuses", { ...repo, sha: ".." }],
     ["gitea_commit_statuses", { ...repo, sha: "main?sudo=jschoubben" }],
     ["gitea_branch_protection_set", { ...repo, branch: "..", status_checks: "mesh/merge-gate" }],
@@ -746,53 +704,3 @@ test("a group of two merges in one pass: the sibling's merge of the composed hea
   assert.equal(done.merged, true);
   assert.equal(state.emitted.length, 0, "no check was asked");
 });
-
-// **Issue 1301 (ADR 0447 §1, §4; ADR 0503 §3, §5): the merge tool judges on the status the base requires.** A main that
-// requires mesh/check is judged by the checker's line ("pass <head12> on <trunk12> …"): it merges on a pass that names the
-// trunk's head, and refuses one that names an older trunk, naming both, writing nothing and asking nothing — a re-check on
-// a trunk's move is the checker's. No mesh/merge-gate is read or written there.
-test("gitea_merge_pull_request judges a main requiring mesh/check on mesh/check alone, and asks nothing of it", async () => {
-  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
-  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/check"] }];
-  const line = (trunk: string, s = "success", words = "pass") =>
-    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
-  const before = state.emitted.length;
-
-  state.statuses = line(MOVED);
-  await assert.rejects(merge(), (err: Error) => {
-    assert.match(err.message, /mesh\/check/);
-    assert.match(err.message, new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
-    assert.match(err.message, /checker checks it again/i);
-    assert.match(err.message, /Nothing was merged/);
-    return true;
-  });
-  state.statuses = line(TRUNK, "pending", "checking");
-  await assert.rejects(merge(), /mesh\/check is pending/);
-  state.statuses = judgedAt(TRUNK); // the old two, current: not what this main requires
-  await assert.rejects(merge(), /mesh\/check/);
-  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
-  assert.equal(state.emitted.length, before, "no check is asked");
-  assert.equal(state.merged, false);
-
-  state.statuses = line(TRUNK);
-  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
-});
-
-// hq's main requires mesh/repo-check alone (ADR 0503 §5): judged on its words, and an out-of-date one is asked again on
-// mesh/repo-check alone; no mesh/merge-gate is written on it.
-test("gitea_merge_pull_request judges a main requiring mesh/repo-check alone on it, and writes no mesh/merge-gate", async () => {
-  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
-  keepSiblings(siblingsFile(stateDir), {}); // no sibling record left by the tests before
-  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
-  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/repo-check"] }];
-  state.statuses = [judgedAt(MOVED)[1]];
-  const before = state.emitted.length;
-  await assert.rejects(merge(), /judged against trunk/);
-  assert.deepEqual(state.sent.filter((s) => s.path.includes("/statuses/")).map((s) => `${s.body.context} ${s.body.state}`),
-    ["mesh/repo-check pending"]);
-  assert.equal(state.emitted.length, before + 1, "its check is asked once");
-  await assert.rejects(merge(), /already asked/);
-  state.sent = [];
-  state.statuses = [judgedAt(TRUNK)[1]];
-  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
-});

modules/gitea/test/kept.test.ts

@@ -1,25 +0,0 @@
-import assert from "node:assert/strict";
-import { test } from "node:test";
-import { readFileSync } from "node:fs";
-
-// 1790: the states the module announces are the states its manifest declares, no more, no fewer; none is readable
-// because no other module's manifest reads one of them.
-test("the states the module announces are the states its manifest declares", async () => {
-  const { KEPT } = await import("../kept.ts");
-  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8"));
-  const declared = (manifest.state as (string | { name: string })[]).map((s) => (typeof s === "string" ? s : s.name)).sort();
-  assert.deepEqual(KEPT.map((k) => k.name).sort(), declared);
-  assert.ok(KEPT.every((k) => !k.readable), "no other module's manifest reads a state of gitea");
-});
-
-test("the announcement has the layout mesh-sdk's go/announce reads: version 1, the module, the node, the states sorted by name", async () => {
-  const { statesAnnouncement } = await import("../kept.ts");
-  assert.deepEqual(statesAnnouncement("gitea", "ace"), { v: 1, module: "gitea", node: "ace", states: [{ name: "announced" }, { name: "bound" }] });
-  assert.deepEqual(statesAnnouncement("gitea", undefined), { v: 1, module: "gitea", states: [{ name: "announced" }, { name: "bound" }] });
-});
-
-test("index.ts says the announcement as the event `states` before the tools are served", () => {
-  const source = readFileSync(new URL("../index.ts", import.meta.url), "utf8");
-  assert.match(source, /await emit\("states", statesAnnouncement\(/);
-  assert.ok(source.indexOf('await emit("states"') < source.indexOf('registerModuleTools("gitea"'), "announced before the tools are served");
-});

modules/gitea/test/protection-read.test.ts

@@ -52,7 +52,7 @@ test("gitea_branch_protection_get answers the rule for a branch, null when it ha
 
 test("gitea_branch_protection_set still gets the forge's refusal, as the tools' account", async () => {
   await assert.rejects(
-    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main" }),
+    tool("gitea_branch_protection_set").run({ owner: "novox", repo: "mesh-controller", branch: "main", status_checks: "mesh/merge-gate" }),
     /403/,
   );
   assert.ok(!seen.some((s) => /^(PATCH|POST|PUT|DELETE) .*branch_protections.* as admin$/.test(s)), seen.join("\n"));

modules/gitea/test/protection.test.ts

@@ -4,33 +4,32 @@ import { test } from "node:test";
 // A branch's protection (novox/hq ADR 0237): what the operator's agent sets so a pull request waits for the
 // mesh's merge check before it merges.
 
-test("a rule's body requires no status, whatever the rule required (ADR 0534 §5)", async () => {
+test("the statuses asked for replace the rule's, and an empty list requires none", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.deepEqual(protectionBody({}, false), { enable_status_check: false, status_check_contexts: [] },
-    "an edited rule keeps its pushes as they are, and requires no status");
+  assert.deepEqual(protectionBody({ statusChecks: ["mesh/merge-gate", " mesh/repo-check", "", "mesh/merge-gate"] }, false),
+    { enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "mesh/repo-check"] },
+    "an edited rule keeps its pushes as they are, and each status once");
+  assert.deepEqual(protectionBody({ statusChecks: [] }, false), { enable_status_check: false, status_check_contexts: [] });
 });
 
 test("a new rule refuses direct pushes unless asked; an administrator's override only when said", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  assert.equal(protectionBody({}, true).enable_push, false);
-  assert.equal(protectionBody({ push: true }, true).enable_push, true);
-  assert.equal(protectionBody({}, true).block_admin_merge_override, undefined);
-  assert.equal(protectionBody({ blockAdminOverride: true }, false).block_admin_merge_override, true);
+  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).enable_push, false);
+  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], push: true }, true).enable_push, true);
+  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"] }, true).block_admin_merge_override, undefined);
+  assert.equal(protectionBody({ statusChecks: ["mesh/merge-gate"], blockAdminOverride: true }, false).block_admin_merge_override, true);
 });
 
-// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges; it requires no status
-// (ADR 0534 §1).
+// Issue 948 (novox/hq ADR 0398 §2): main takes no push, and only the tools' account merges.
 test("main's body always refuses pushes and lets only the tools' account merge, whatever is asked", async () => {
   const { protectionBody } = await import("../dist/protection.js");
   const { TOOLS_ACCOUNT } = await import("../dist/tools-account.js");
   for (const creating of [true, false]) {
-    for (const want of [{}, { push: true }, { push: false }]) {
+    for (const want of [{ statusChecks: ["mesh/merge-gate"] }, { statusChecks: [], push: true }, { statusChecks: [], push: false }]) {
       const body = protectionBody(want, creating, "main");
       assert.equal(body.enable_push, false, "main takes no push, an edit and a push=true included");
       assert.equal(body.enable_merge_whitelist, true);
       assert.deepEqual(body.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
-      assert.equal(body.enable_status_check, false);
-      assert.deepEqual(body.status_check_contexts, []);
     }
   }
   assert.deepEqual(TOOLS_ACCOUNT, "mesh-tools");
@@ -38,28 +37,13 @@ test("main's body always refuses pushes and lets only the tools' account merge,
 
 test("another branch's body carries no merge whitelist", async () => {
   const { protectionBody } = await import("../dist/protection.js");
-  const body = protectionBody({}, false, "release/1");
+  const body = protectionBody({ statusChecks: ["mesh/merge-gate"] }, false, "release/1");
   assert.equal(body.enable_merge_whitelist, undefined);
   assert.equal(body.merge_whitelist_usernames, undefined);
+  assert.equal(protectionBody({ statusChecks: [] }, false).enable_merge_whitelist, undefined);
 });
 
-test("the rule main is put right in the forge's own words: no push, the tools' account merges, no status required", async () => {
+test("the rule main is put right in the forge's own words: the body a setup sends carries no status checks of its own", async () => {
   const { mainRuleBody } = await import("../dist/protection.js");
-  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"],
-    enable_status_check: false, status_check_contexts: [] });
-});
-
-// The operator's own login stays on main's merge whitelist beside the tools' account (novox/hq ADR 0534 §2): read from
-// the module's config value main-mergers, in the runtime config file; nothing there leaves the tools' account alone.
-test("main's merge whitelist is the tools' account, then the configured mergers once each", async () => {
-  const { mainMergers, mainRuleBody } = await import("../dist/protection.js");
-  const { mkdtempSync, writeFileSync } = await import("node:fs");
-  const { join } = await import("node:path");
-  const { tmpdir } = await import("node:os");
-  const file = join(mkdtempSync(join(tmpdir(), "gitea-mergers-")), "config.json");
-  writeFileSync(file, JSON.stringify({ url: "", "main-mergers": ["jschoubben", "mesh-tools", "jschoubben", "../x", "a b"] }));
-  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: file }), ["mesh-tools", "jschoubben"]);
-  assert.deepEqual(mainMergers({}), ["mesh-tools"]);
-  assert.deepEqual(mainMergers({ MESH_GITEA_CONFIG_FILE: join(tmpdir(), "no-such-gitea-config.json") }), ["mesh-tools"]);
-  assert.deepEqual(mainRuleBody(["mesh-tools", "jschoubben"]).merge_whitelist_usernames, ["mesh-tools", "jschoubben"]);
+  assert.deepEqual(mainRuleBody(), { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: ["mesh-tools"] });
 });

modules/gitea/test/pulls.test.ts

@@ -192,36 +192,3 @@ test("a member's own verdict with a composed gate layer leaves the gate to the c
   // A verdict with an ordinary gate is as before.
   assert.equal(composedGate({ ...c, gate: { verdict: "pass", summary: "x" } }), false);
 });
-
-// Issue 1301 (ADR 0503 §3, §5): gitea writes the controller's statuses only where the base still requires them. hq's main
-// requires mesh/repo-check alone: its verdict sets mesh/repo-check and no mesh/merge-gate, and its comment names no gate.
-test("a base's required statuses decide which of the controller's statuses are written", async () => {
-  const { maintained, writesGate, statusesFor, commentFor, CHECK_STATUS } = await import("../pulls.ts");
-  assert.equal(CHECK_STATUS, "mesh/check");
-  assert.deepEqual(maintained(undefined), ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
-  assert.deepEqual(maintained(["mesh/repo-check"]), ["mesh/repo-check"]);
-  assert.deepEqual(maintained(["mesh/check", "other/x"]), []);
-  assert.deepEqual(maintained([]), []);
-  assert.equal(writesGate(undefined), true);
-  assert.equal(writesGate(["mesh/repo-check"]), false);
-  assert.equal(writesGate(["mesh/check"]), false);
-  assert.equal(writesGate(["mesh/merge-gate", "mesh/repo-check"]), true);
-  const c = { owner: "novox", repo: "hq", number: 5, commit: "a".repeat(40), id: "x", verdict: "warning", summary: "no script",
-    trunk: "b".repeat(12), "repo-check": { verdict: "pass", summary: "ok" } } as any;
-  const hq = statusesFor(c, {}, undefined, ["mesh/repo-check"]);
-  assert.deepEqual(hq.map((s: any) => s.context), ["mesh/repo-check"]);
-  assert.match(hq[0].description, /merged into trunk bbbbbbbbbbbb/);
-  assert.deepEqual(statusesFor(c).map((s: any) => s.context), ["mesh/merge-gate", "mesh/repo-check"], "unread: as before");
-  assert.deepEqual(statusesFor(c, {}, undefined, ["mesh/check"]), []);
-  const comment = commentFor(c, {}, ["mesh/repo-check"]);
-  assert.ok(comment === null || !comment.includes("mesh/merge-gate"), comment ?? "");
-});
-
-test("a rule the forge gives with no contexts (null) requires nothing, and an unread rule is unknown", async () => {
-  const { requiredOf } = await import("../pulls.ts");
-  // The forge's BranchProtection says status_check_contexts may be null (protection.ts); requiredOf takes it as it comes.
-  assert.deepEqual(requiredOf({ enable_status_check: true, status_check_contexts: null }), []);
-  assert.deepEqual(requiredOf({ enable_status_check: true, status_check_contexts: ["mesh/check", ""] }), ["mesh/check"]);
-  assert.deepEqual(requiredOf(null), []);
-  assert.equal(requiredOf(undefined), undefined);
-});

modules/gitea/test/tools-account.test.ts

@@ -235,7 +235,7 @@ test("with the tools' token, the forge writes a status and refuses a protection
   const client = fresh(env);
   await client.setCommitStatus("novox", "hq", "abc123def4567890abc123def4567890abc12345", { state: "success", context: "mesh/merge-gate", description: "ok" } as any);
   await assert.rejects(
-    client.setBranchProtection("novox", "hq", "main", {}),
+    client.setBranchProtection("novox", "hq", "main", { statusChecks: ["mesh/merge-gate"] }),
     /403/,
   );
 });
@@ -350,7 +350,7 @@ test("a team another process made between the look and the create is found, not
   assert.ok(team?.members.has(TOOLS_ACCOUNT));
 });
 
-test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges, no status (issue 948, ADR 0534 §1)", async () => {
+test("setting the tools' account up puts main's rule right in every repository: no push, only the tools' account merges (issue 948)", async () => {
   const env = await environment();
   const from = forge.calls.length;
   await fresh(env).listRepos();
@@ -358,8 +358,7 @@ test("setting the tools' account up puts main's rule right in every repository:
   assert.equal(hq.enable_push, false);
   assert.equal(hq.enable_merge_whitelist, true);
   assert.deepEqual(hq.merge_whitelist_usernames, [TOOLS_ACCOUNT]);
-  assert.deepEqual(hq.status_check_contexts, [], "a rule found has its required statuses taken off (ADR 0534 §1)");
-  assert.equal(hq.enable_status_check, false);
+  assert.deepEqual(hq.status_check_contexts, ["mesh/merge-gate"], "a rule found keeps the statuses it requires");
   const catalog = forge.mainRules.get("mesh-catalog");
   assert.ok(catalog, "a repository with no rule for main is given one");
   assert.equal(catalog.rule_name, "main");
@@ -369,13 +368,13 @@ test("setting the tools' account up puts main's rule right in every repository:
     "only the administrator's login touches a rule: the tools' account is no repository's administrator");
 });
 
-test("a glob rule covering main gives its approvals and override, not its statuses, when main is given a rule of its own name (issue 948, ADR 0534 §1)", async () => {
+test("a glob rule covering main keeps its statuses when main is given a rule of its own name (issue 948, review round 1)", async () => {
   const env = await environment();
   await fresh(env).listRepos();
   const rule = forge.mainRules.get("globbed");
   assert.ok(rule, "main is given its own rule");
-  assert.deepEqual(rule.status_check_contexts, []);
-  assert.equal(rule.enable_status_check, false);
+  assert.deepEqual(rule.status_check_contexts, ["mesh/merge-gate", "mesh/repo-check"]);
+  assert.equal(rule.enable_status_check, true);
   assert.equal(rule.block_admin_merge_override, true);
   assert.equal(rule.required_approvals, 1);
   assert.equal(rule.enable_push, false);

modules/gitea/test/trunk.test.ts

@@ -199,21 +199,3 @@ test("a release branch's move puts every open pull request into it out of date,
   assert.equal(verdictAtTrunk({ "mesh/merge-gate": { state: "success",
     description: "head x merged into trunk eeeeeeeeeeee — pass" } }, MOVED).current, false);
 });
-
-// Issue 1301: a trunk's move puts out of date only the controller's statuses the base still requires; on hq that is
-// mesh/repo-check alone, judged by its own words; on a main requiring mesh/check, none (the checker's, ADR 0447 §4).
-test("a trunk's move writes only the statuses the base still requires", async () => {
-  const { outOfDateStatuses, trunkNamed } = await import("../trunk.ts");
-  const old = "1".repeat(40), now = "2".repeat(40);
-  const repo = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: y` };
-  const gate = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: x` };
-  assert.deepEqual(outOfDateStatuses({ "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context), ["mesh/repo-check"]);
-  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context),
-    ["mesh/repo-check"]);
-  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/check"]), []);
-  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now).map((s: any) => s.context),
-    ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
-  // The checker's line names its trunk as "<head12> on <trunk12>".
-  assert.equal(trunkNamed(`pass ${"a".repeat(12)} on ${old.slice(0, 12)} | unit 3 run`), old.slice(0, 12));
-  assert.equal(trunkNamed("building on shanks since 10:00"), undefined);
-});

modules/gitea/test/webhook.test.ts

@@ -350,14 +350,3 @@ test("a pull request's edit event carries its description, and no other pull req
     assert.equal(eventOf("pull_request", { action, pull_request: pull, repository }).body.body, undefined, action);
   }
 });
-
-// Issue 1302: a status event carries the status's words, so the delivery gate reads mesh/check's line (the head and the trunk
-// it judged) from the event itself.
-test("a status event carries its context, state and words", async () => {
-  const { eventOf } = await import("../webhook.ts");
-  const e = eventOf("status", { sha: "a".repeat(40), context: "mesh/check", state: "success",
-    description: "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept", repository: { name: "x", owner: { login: "novox" } } });
-  assert.equal(e.name, "forge.status");
-  assert.equal((e.body as any).context, "mesh/check");
-  assert.equal((e.body as any).description, "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept");
-});

modules/gitea/tools/index.ts

@@ -60,22 +60,6 @@ function namesChecked(tools: ToolDefinition[]): ToolDefinition[] {
   }));
 }
 
-/** The `paths` argument of gitea_commit_trees: {directory: [path relative to it]}, each path plain (no empty, `.` or `..`
- *  segment, not absolute); anything else is refused before the forge is asked. Absent is absent. */
-function namedPaths(raw: unknown): Record<string, string[]> | undefined {
-  if (raw === undefined || raw === null) return undefined;
-  if (typeof raw !== "object" || Array.isArray(raw)) throw new Error("paths is {directory: [path, ...]}");
-  const out: Record<string, string[]> = {};
-  for (const [dir, list] of Object.entries(raw as Record<string, unknown>)) {
-    if (!Array.isArray(list) || list.some((p) => typeof p !== "string")) throw new Error(`paths of ${dir || "the root"} is a list of paths`);
-    for (const p of list as string[]) {
-      if (p === "" || p.split("/").some((seg) => seg === "" || seg === "." || seg === "..")) throw new Error(`paths: ${JSON.stringify(p)} of ${dir || "the root"} is not a plain relative path`);
-    }
-    out[dir] = list as string[];
-  }
-  return out;
-}
-
 export function getGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefinition[] {
   return namesChecked(allGiteaTools(gitea, admin));
 }
@@ -411,7 +395,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     // ---- Branch protection (novox/hq ADR 0237) ----
     {
       name: "gitea_branch_protection_get",
-      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/check), approvals, and whether an administrator may merge past them.",
+      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/merge-gate), approvals, and whether an administrator may merge past them.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
@@ -429,13 +413,14 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     },
     {
       name: "gitea_branch_protection_set",
-      description: "Protect a branch. Never weaker (novox/hq ADR 0266): a change that lets a person push directly or lets an administrator merge past the rule is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. The forge requires no status to merge (ADR 0534): the rule written requires none, and one the rule required is taken off; the checks are judged by mesh-delivery and the merge tool. Edits the branch's rule (everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
+      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's merge check sets `mesh/merge-gate` (the module graph's gate) and `mesh/repo-check` (the repository's own tests). Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
         branch: { type: "string", description: "the branch to protect, e.g. main" },
+        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/merge-gate,mesh/repo-check; empty requires none" },
         push: { type: "boolean", description: "whether a person may push to the branch directly (a new rule refuses it when not given)" },
-        block_admin_override: { type: "boolean", description: "stop an administrator merging past what the rule asks (left as it is when not given)" },
+        block_admin_override: { type: "boolean", description: "stop an administrator merging past a status that has not succeeded (left as it is when not given)" },
       },
       run: async (args) => {
         const owner = String(args.owner), repo = String(args.repo), branch = String(args.branch ?? "").trim();
@@ -444,6 +429,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
 
         const before = await gitea.branchProtection(owner, repo, branch);
         const want = {
+          statusChecks: String(args.status_checks ?? "").split(","),
           push: args.push === undefined ? undefined : Boolean(args.push),
           blockAdminOverride: args.block_admin_override === undefined ? undefined : Boolean(args.block_admin_override),
         };
@@ -492,7 +478,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     },
     {
       name: "gitea_commit_statuses",
-      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
+      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/merge-gate, mesh/repo-check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
@@ -539,19 +525,18 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
     },
     {
       name: "gitea_commit_trees",
-      description: "A commit's trees from the forge's one recursive listing: the root tree, and the tree of every directory that holds a module.json (the root as an empty name), each by its git hash. What the forge bridge puts in a merge's message (novox/hq ADR 0437 §5). With paths, {directory: [path relative to it]}, the answer also carries paths, {directory: {path: git object id}} of each named file or directory at the commit (novox/hq ADR 0499 §3); a path the commit lacks fails naming the directory and the path. The commit is a full 40-hex sha. A listing the forge cut is refused, never answered in part. Reads only.",
+      description: "A commit's trees from the forge's one recursive listing: the root tree, and the tree of every directory that holds a module.json (the root as an empty name), each by its git hash. What the forge bridge puts in a merge's message (novox/hq ADR 0437 §5). The commit is a full 40-hex sha. A listing the forge cut is refused, never answered in part. Reads only.",
       input: {
         owner: { type: "string", description: "the repository owner" },
         repo: { type: "string", description: "the repository name" },
         sha: { type: "string", description: "the commit, its full 40-hex sha" },
-        paths: { type: "object", description: "optional, {directory: [path relative to it]}: the git object id of each named file or directory is answered under paths; the root directory is the empty name" },
       },
       run: async (args) => {
         const owner = String(args.owner ?? "").trim(), repo = String(args.repo ?? "").trim();
         const sha = String(args.sha ?? "").trim();
         if (!owner || !repo) throw new Error("name the repository: owner and repo");
         if (!/^[0-9a-f]{40}$/i.test(sha)) throw new Error("sha is a commit's full 40-hex sha");
-        return gitea.commitTrees(owner, repo, sha, namedPaths(args.paths));
+        return gitea.commitTrees(owner, repo, sha);
       },
     },
     {

modules/gitea/trunk.ts

@@ -12,17 +12,12 @@
 //     the moment it is asked, merges nothing when they differ, asks the head's check once — the same announcement a
 //     new head makes — and says how long the last check of that repository took. It never merges by itself after.
 //
-// Since issue 1301 (ADR 0447 §4) a main that requires mesh/check is the checker's: its line names the trunk commit it judged
-// ("pass <head12> on <trunk12>"), the checker sets it out of date when the trunk moves, and the merge tool refuses a verdict
-// of another trunk and asks nothing. The two statuses above are kept only where a base still requires them (hq's
-// mesh/repo-check, pulls.ts maintained).
-//
 // Pure functions and two small files of the module's own state, so this is tested without a forge.
 
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import type { CommitStatus, GiteaClient, GiteaPull, HeadCheck } from "./client.js";
-import { CHECK_CONTEXT, WAITS_FOR_COMPOSED, maintained, requiredOf } from "./pulls.js";
+import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, WAITS_FOR_COMPOSED } from "./pulls.js";
 
 /** A commit as a verdict names it: its first twelve characters. */
 export function twelve(sha: string | undefined): string {
@@ -45,9 +40,7 @@ export function judgedWords(head: string, trunk: string): string {
  *  verdict put out of date, the one it had judged ("judged against trunk …"). Undefined when it names none, as a
  *  verdict of a build seat from before ADR 0323 does. */
 export function trunkNamed(description: string | undefined): string | undefined {
-  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "")
-    // The checker's mesh/check line (ADR 0447 §3): "<head12> on <trunk12>".
-    ?? /\b[0-9a-f]{12} on ([0-9a-f]{12})\b/i.exec(description ?? "");
+  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "");
   return m ? m[1].toLowerCase() : undefined;
 }
 
@@ -77,15 +70,15 @@ export function waitsForComposed(gate: HeadCheck | undefined): boolean {
  * gate, and the repository's own check when the head has one — a pending repo-check a verdict will not set would
  * stand for ever (novox/hq issue 305's rule).
  */
-export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string, required?: string[]): CommitStatus[] {
-  // Only the statuses the base still requires (issue 1301): the first of them the head holds judges.
-  const kept = maintained(required).filter((c) => checks[c]);
-  const judge = kept.length ? checks[kept[0]] : undefined;
-  if (!judge || judge.state === "pending") return [];
-  const judged = trunkNamed(judge.description);
+export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string): CommitStatus[] {
+  const gate = checks[CHECK_CONTEXT];
+  if (!gate || gate.state === "pending") return [];
+  const judged = trunkNamed(gate.description);
   if (judged && sameCommit(judged, trunkHead)) return [];
   const description = outOfDateWords(judged, trunkHead);
-  return kept.map((context) => ({ state: "pending" as const, context, description }));
+  const out: CommitStatus[] = [{ state: "pending", context: CHECK_CONTEXT, description }];
+  if (checks[REPO_CHECK_CONTEXT]) out.push({ state: "pending", context: REPO_CHECK_CONTEXT, description });
+  return out;
 }
 
 /** Where the merge tool stands with a head's verdict and the trunk's head (ADR 0323 §5). */
@@ -98,8 +91,8 @@ export interface VerdictAtTrunk {
   judged?: string;
 }
 
-export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string, context = CHECK_CONTEXT): VerdictAtTrunk {
-  const gate = checks[context];
+export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string): VerdictAtTrunk {
+  const gate = checks[CHECK_CONTEXT];
   const judged = trunkNamed(gate?.description);
   if (checkOnItsWay(gate)) return { current: false, onItsWay: true, judged };
   return { current: !!gate && gate.state !== "pending" && !!judged && sameCommit(judged, trunkHead), onItsWay: false, judged };
@@ -126,9 +119,6 @@ export function lateVerdictComment(c: { commit: string; trunk?: string; verdict:
 export interface TrunkForge {
   listOpenPulls(owner: string, repo: string): Promise<GiteaPull[]>;
   branchHead(owner: string, repo: string, branch: string): Promise<string>;
-  /** The rule the forge applies to a branch: which of the controller's statuses are kept there (issue 1301). Not given,
-   *  or not read: both, as before. */
-  appliedProtection?(owner: string, repo: string, branch: string): Promise<{ enable_status_check?: boolean; status_check_contexts?: string[] | null } | null>;
 }
 
 /** What it writes with: the merge check's one writer (gate.ts), which decides in the head's own turn. */
@@ -157,13 +147,11 @@ export async function weighTrunks(forge: TrunkForge, gates: OutOfDateWriter, tru
       if (before && sameCommit(before, head)) continue;
       if (before) {
         let put = 0;
-        const required = forge.appliedProtection
-          ? requiredOf(await forge.appliedProtection(owner, name, base).catch(() => undefined)) : undefined;
         for (const pull of open.filter((p) => p.base === base)) {
           // The trunk is read again in the head's own turn: a verdict judged against a head newer than the pass's first
           // read — the trunk moved again meanwhile, and a check answered — is not put out of date.
           const written = await gates.outOfDate(owner, name, String(pull.head_sha),
-            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base), required), pull.html_url || undefined);
+            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base)), pull.html_url || undefined);
           if (written.length) put++;
         }
         console.log(`[gitea] ${owner}/${name}'s ${base} moved from ${twelve(before)} to ${twelve(head)}: ${put} open pull ` +

modules/gitea/webhook.ts

@@ -127,9 +127,7 @@ function forgeEventOf(said: string, payload: any): ForgeEvent {
     return { name: kind, body: { ...base, ref: str(payload.ref), ref_type: str(payload.ref_type), sha: str(payload.sha) } };
   }
   if (kind === "status") {
-    // Its words too (issue 1302): mesh/check's line names the head and the trunk it judged, which the delivery gate reads.
-    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state),
-      description: str(payload.description) } };
+    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state) } };
   }
   const name = family === "other" ? `other.${kind.replace(/[^a-z0-9_-]/gi, "_") || "unknown"}` :
     ["fork"].includes(family) ? family : `${family}.${action ?? "changed"}`;

modules/gnome-keyring/cmd/gnome-keyring-tools/manifest_helpers_test.go

@@ -257,7 +257,8 @@ func checkNoSecretsOrInstallationNames(t *testing.T) {
 		t.Fatal(err)
 	}
 	s := strings.ToLower(string(raw))
-	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox.be", "api_key", ".hal/", "greenclip daemon"} {
+	// 1838/AC1: the catalogue-wide check covers a node's name now; this list keeps what it does not.
+	for _, never := range []string{"/home/", "jochen", "api_key", ".hal/", "greenclip daemon"} {
 		if strings.Contains(s, never) {
 			t.Errorf("module.json names %q", never)
 		}

modules/home-assistant/provisions/connections.ts

@@ -105,7 +105,7 @@ export function hasField(schema: readonly SchemaField[] | null | undefined, name
 // **Nothing loses its connection without someone seeing it.** Before Home Assistant is touched the
 // broker itself is asked whether it takes the delivered login (the provisioner creates it within
 // seconds of the grant): if not, nothing is written and the step fails saying why, and Home
-// Assistant keeps the login it has — the carried `luffy` on ace, which mosquitto keeps. If Home
+// Assistant keeps the login it has — the carried `luffy` on node-a, which mosquitto keeps. If Home
 // Assistant's own connection test refuses the new settings, the flow saves nothing, and the step
 // fails with Home Assistant's reason. A login that may not subscribe to the discovery topics is said
 // as a warning: discovery would find nothing.
@@ -299,8 +299,8 @@ export function describe(r: { type: string; reason?: string; errors?: Record<str
 //      is the bound one and which is loaded: already as the mesh says. The key needs no digest here:
 //      a Servarr app has one key, so an entry loaded against the app holds the key the app took.
 //   5. A working entry at a different URL that reaches **the same app** — the same process, by the
-//      app's own status (start time, data folder, version) — is left as it is and said: ace's entries
-//      say `127.0.0.1:<port>` and the binding says `ace.internal:<port>`, one Sonarr either way.
+//      app's own status (start time, data folder, version) — is left as it is and said: node-a's entries
+//      say `127.0.0.1:<port>` and the binding says `node-a.internal:<port>`, one Sonarr either way.
 //   6. Anything else is refused, loudly, with what the operator can do; nothing is removed.
 
 

modules/home-assistant/test/provisions.test.ts

@@ -6,7 +6,7 @@
 // minted value before the operator accepts the app's) is never written.
 //
 // Home Assistant and the apps are fakes answering as the real ones do (flow shapes checked against
-// ghcr.io/home-assistant/home-assistant 2026.9.3, the build ace runs).
+// ghcr.io/home-assistant/home-assistant 2026.9.3, the build node-a runs).
 
 import { test } from "node:test";
 import assert from "node:assert/strict";
@@ -21,7 +21,7 @@ const PWD_NOT_CHANGED = "__**password_not_changed**__";
 const MINTED = "mesh-minted-password";
 
 function mqttBinding(): Binding {
-  return { provision: "mqtt-topic", from: "ace", at: "ace.internal", as: "mesh_ace_hass", serves: { scheme: "mqtt", port: 1883 } };
+  return { provision: "mqtt-topic", from: "node-a", at: "node-a.internal", as: "mesh_node-a_hass", serves: { scheme: "mqtt", port: 1883 } };
 }
 
 /** The MQTT reconfigure form as Home Assistant serializes it, pre-filled from an entry. */
@@ -138,29 +138,29 @@ function memoryMarks(): Marks & { store: Map<string, string> } {
   return { store, get: async (k) => store.get(k), set: async (k, v) => void store.set(k, v) };
 }
 
-const takes = (suback = 0): Probe => async (_h, _p, user, pass) => ({ connack: user === "mesh_ace_hass" && pass === MINTED ? 0 : 5, suback });
+const takes = (suback = 0): Probe => async (_h, _p, user, pass) => ({ connack: user === "mesh_node-a_hass" && pass === MINTED ? 0 : 5, suback });
 
-const aceMqttEntry = () => ({
+const nodeAMqttEntry = () => ({
   entry_id: "7d1e", domain: "mqtt", state: "loaded",
   data: { broker: "127.0.0.1", port: 1883, protocol: "5", username: "luffy", password: "luffys-password" },
 });
 
 test("mqtt: the broker is asked first; a login it does not take is never written", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+  const f = fakeHass({ entries: { mqtt: [nodeAMqttEntry()] } });
   const out = await reconcileMqtt({ hass: f.hass, probe: async () => ({ connack: 5 }), marks: memoryMarks() }, mqttBinding(), MINTED);
   assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /does not \(yet\) take the login mesh_ace_hass/);
+  assert.match((out as { problem: string }).problem, /does not \(yet\) take the login mesh_node-a_hass/);
   assert.deepEqual(f.calls, []); // Home Assistant not even asked
   assert.equal(f.entries.mqtt[0].data.username, "luffy");
 });
 
-test("mqtt: ace's entry (127.0.0.1, luffy) is moved to the bound broker and login, every other setting kept", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+test("mqtt: node-a's entry (127.0.0.1, luffy) is moved to the bound broker and login, every other setting kept", async () => {
+  const f = fakeHass({ entries: { mqtt: [nodeAMqttEntry()] } });
   const marks = memoryMarks();
   const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), `${MINTED}\n`);
   assert.deepEqual(out, { what: "mqtt", result: "written", fields: ["broker", "username", "password"] });
   assert.deepEqual(f.entries.mqtt[0].data, {
-    broker: "ace.internal", port: 1883, protocol: "5", username: "mesh_ace_hass", password: MINTED,
+    broker: "node-a.internal", port: 1883, protocol: "5", username: "mesh_node-a_hass", password: MINTED,
     other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
   });
   assert.ok(marks.store.get("mqtt"));
@@ -175,7 +175,7 @@ test("mqtt: ace's entry (127.0.0.1, luffy) is moved to the bound broker and logi
 });
 
 test("mqtt: a new password alone is written (the digest tells)", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] } });
+  const f = fakeHass({ entries: { mqtt: [nodeAMqttEntry()] } });
   const marks = memoryMarks();
   await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
   const rotated: Probe = async () => ({ connack: 0, suback: 0 });
@@ -185,7 +185,7 @@ test("mqtt: a new password alone is written (the digest tells)", async () => {
 });
 
 test("mqtt: Home Assistant's own connection test refusing saves nothing and fails loudly", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry()] }, accepts: () => false });
+  const f = fakeHass({ entries: { mqtt: [nodeAMqttEntry()] }, accepts: () => false });
   const marks = memoryMarks();
   const out = await reconcileMqtt({ hass: f.hass, probe: takes(), marks }, mqttBinding(), MINTED);
   assert.equal(out.result, "refused");
@@ -199,11 +199,11 @@ test("mqtt: a fresh Home Assistant gets an entry; a grant without the discovery
   const out = await reconcileMqtt({ hass: f.hass, probe: takes(0x80), marks: memoryMarks() }, mqttBinding(), MINTED);
   assert.equal(out.result, "written");
   assert.match((out as { note?: string }).note ?? "", /may not subscribe to homeassistant\/#/);
-  assert.equal(f.entries.mqtt[0].data.broker, "ace.internal");
+  assert.equal(f.entries.mqtt[0].data.broker, "node-a.internal");
 });
 
 test("mqtt: two entries, or a binding without a port, are refused rather than guessed", async () => {
-  const f = fakeHass({ entries: { mqtt: [aceMqttEntry(), { ...aceMqttEntry(), entry_id: "other" }] } });
+  const f = fakeHass({ entries: { mqtt: [nodeAMqttEntry(), { ...nodeAMqttEntry(), entry_id: "other" }] } });
   assert.equal((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, mqttBinding(), MINTED)).result, "refused");
   const noPort = { ...mqttBinding(), serves: {} };
   assert.match(((await reconcileMqtt({ hass: f.hass, probe: takes(), marks: memoryMarks() }, noPort, MINTED)) as { problem: string }).problem, /no usable port/);
@@ -214,9 +214,9 @@ test("mqtt: two entries, or a binding without a port, are refused rather than gu
 const SONARR = APPS.find((a) => a.domain === "sonarr") as ServarrApp;
 const RADARR = APPS.find((a) => a.domain === "radarr") as ServarrApp;
 const KEY = "the-apps-own-key";
-const servarrBinding = (port: number, at = "ace.internal"): Binding => ({ provision: "sonarr-api", from: "ace", at, as: "mesh_ace_hass", serves: { scheme: "http", port, "url-base": "" } });
+const servarrBinding = (port: number, at = "node-a.internal"): Binding => ({ provision: "sonarr-api", from: "node-a", at, as: "mesh_node-a_hass", serves: { scheme: "http", port, "url-base": "" } });
 
-/** One running Sonarr, answering on several addresses (127.0.0.1 and ace.internal are one host). */
+/** One running Sonarr, answering on several addresses (127.0.0.1 and node-a.internal are one host). */
 function apps(instances: Record<string, { startTime: string }>): Http & { asked: string[] } {
   const asked: string[] = [];
   return {
@@ -231,18 +231,18 @@ function apps(instances: Record<string, { startTime: string }>): Http & { asked:
     },
   };
 }
-const oneSonarr = () => apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "t1" } });
+const oneSonarr = () => apps({ "node-a.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "t1" } });
 const sonarrEntry = (state = "loaded") => ({ entry_id: "5a1d", domain: "sonarr", state, data: { url: "http://127.0.0.1:8989", api_key: KEY } });
 
 test("servarr: the mesh's minted key is never written; the remedy names the accept", async () => {
   const f = fakeHass({ entries: { sonarr: [sonarrEntry()] } });
   const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), "minted-by-the-mesh");
   assert.equal(out.result, "refused");
-  assert.match((out as { problem: string }).problem, /secret accept <this node> home-assistant sonarr-api --provider ace/);
+  assert.match((out as { problem: string }).problem, /secret accept <this node> home-assistant sonarr-api --provider node-a/);
   assert.deepEqual(f.calls, []);
 });
 
-test("servarr: ace's entry at 127.0.0.1 reaches the same Sonarr the mesh bound at ace.internal — left, and said", async () => {
+test("servarr: node-a's entry at 127.0.0.1 reaches the same Sonarr the mesh bound at node-a.internal — left, and said", async () => {
   const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
   const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
   assert.equal(out.result, "equivalent");
@@ -250,13 +250,13 @@ test("servarr: ace's entry at 127.0.0.1 reaches the same Sonarr the mesh bound a
 });
 
 test("servarr: an entry already at the bound URL is unchanged", async () => {
-  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://ace.internal:8989" }] });
+  const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://node-a.internal:8989" }] });
   assert.deepEqual(await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY), { what: "sonarr", result: "unchanged" });
 });
 
 test("servarr: a working entry that reaches a different app is refused, and nothing is removed", async () => {
   const f = fakeHass({ entries: { sonarr: [sonarrEntry()] }, devices: [{ id: "d", config_entries: ["5a1d"], configuration_url: "http://127.0.0.1:8989" }] });
-  const two = apps({ "ace.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "another" } });
+  const two = apps({ "node-a.internal:8989": { startTime: "t1" }, "127.0.0.1:8989": { startTime: "another" } });
   const out = await reconcileApp({ hass: f.hass, http: two }, SONARR, servarrBinding(8989), KEY);
   assert.equal(out.result, "refused");
   assert.match((out as { problem: string }).problem, /never does/);
@@ -267,7 +267,7 @@ test("servarr: no entry — one is made at the bound URL through the user flow",
   const f = fakeHass({ entries: {} });
   const out = await reconcileApp({ hass: f.hass, http: oneSonarr() }, SONARR, servarrBinding(8989), KEY);
   assert.deepEqual(out, { what: "sonarr", result: "written", fields: ["entry"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:8989", api_key: KEY, more_options: { verify_ssl: false } });
+  assert.deepEqual(f.submitted[0], { url: "http://node-a.internal:8989", api_key: KEY, more_options: { verify_ssl: false } });
 });
 
 test("servarr: a reauth Home Assistant started is finished with the bound URL and key", async () => {
@@ -276,10 +276,10 @@ test("servarr: a reauth Home Assistant started is finished with the bound URL an
     entries: { radarr: [entry] },
     reauth: [{ flow_id: "r1", handler: "radarr", step_id: "reauth_confirm", context: { source: "reauth", entry_id: "1955" } }],
   });
-  const radarr = apps({ "ace.internal:7878": { startTime: "t" } });
+  const radarr = apps({ "node-a.internal:7878": { startTime: "t" } });
   const out = await reconcileApp({ hass: f.hass, http: radarr }, RADARR, { ...servarrBinding(7878), provision: "radarr-api" }, KEY);
   assert.deepEqual(out, { what: "radarr", result: "written", fields: ["api_key", "url"] });
-  assert.deepEqual(f.submitted[0], { url: "http://ace.internal:7878", api_key: KEY, verify_ssl: false });
+  assert.deepEqual(f.submitted[0], { url: "http://node-a.internal:7878", api_key: KEY, verify_ssl: false });
 });
 
 test("form values: suggested first, then default, sections nested", () => {
@@ -287,7 +287,7 @@ test("form values: suggested first, then default, sections nested", () => {
     broker: "b", port: 1, protocol: "5", username: "u", password: PWD_NOT_CHANGED,
     other_settings: { keepalive: 60, transport: "tcp", set_ca_cert: "off", set_client_cert: false },
   });
-  assert.ok(sameUrl("http://ace.internal:8989/", "http://ace.internal:8989"));
-  assert.ok(sameUrl("http://ACE.internal", "http://ace.internal:80"));
-  assert.ok(!sameUrl("http://127.0.0.1:8989", "http://ace.internal:8989"));
+  assert.ok(sameUrl("http://node-a.internal:8989/", "http://node-a.internal:8989"));
+  assert.ok(sameUrl("http://NODE-A.internal", "http://node-a.internal:80"));
+  assert.ok(!sameUrl("http://127.0.0.1:8989", "http://node-a.internal:8989"));
 });

modules/i3/cmd/i3-tools/manifest_test.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"sort"
 	"strings"
 	"testing"
 )
@@ -203,37 +204,41 @@ func TestTheLoginManagersEntryRunsTheSessionsStart(t *testing.T) {
 	}
 }
 
-// The window-manager lines the catalogue's modules contribute to the main file (novox/hq ADR 0212) are kept in
-// testdata/window-manager-lines.json, one entry per contributing module in module order, as the controller places
-// them. The test reads that file, never the other modules' manifests: a module may not read a manifest (ADR 0495
-// §1), and a test that reads its siblings' fails wherever they are not beside it (issue 1814). The main file and
-// those lines are placed together — each module's under a line naming it — and loaded as i3 would load them on a
-// machine with all of them assigned: no two bind one key, and every line parses.
+// Every module of the catalogue that contributes window-manager lines (novox/hq ADR 0212) is placed in
+// the main file as the controller places them — in module order, each module's under a line naming it
+// — and loaded as i3 would load them on a machine with all of them assigned: no two bind one key, and
+// every line parses.
 func TestTheMainFileAndEveryModulesContributionLoadTogether(t *testing.T) {
 	i3, err := exec.LookPath("i3")
 	if err != nil {
 		t.Skip("no i3 here to check with")
 	}
 	dir := t.TempDir()
-	raw, err := os.ReadFile(filepath.Join("testdata", "window-manager-lines.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var contributions []struct {
-		Module  string   `json:"module"`
-		Content []string `json:"content"`
-	}
-	if err := json.Unmarshal(raw, &contributions); err != nil {
-		t.Fatal(err)
-	}
+	manifests, _ := filepath.Glob(filepath.Join("..", "..", "..", "*", "module.json"))
+	sort.Strings(manifests)
 	var placed strings.Builder
 	var found []string
-	for _, c := range contributions {
-		placed.WriteString("# " + c.Module + "\n")
-		found = append(found, c.Module)
-		for _, content := range c.Content {
-			placed.WriteString(content)
-			if !strings.HasSuffix(content, "\n") {
+	for _, p := range manifests {
+		raw, _ := os.ReadFile(p)
+		var m struct {
+			Module        string `json:"module"`
+			Contributions []struct {
+				Seat, Kind, Content string
+			} `json:"contributions"`
+		}
+		json.Unmarshal(raw, &m)
+		named := false
+		for _, c := range m.Contributions {
+			if c.Seat != "node-display-session" || c.Kind != "config" {
+				continue
+			}
+			if !named {
+				placed.WriteString("# " + m.Module + "\n")
+				named = true
+				found = append(found, m.Module)
+			}
+			placed.WriteString(c.Content)
+			if !strings.HasSuffix(c.Content, "\n") {
 				placed.WriteString("\n")
 			}
 		}

modules/i3/cmd/i3-tools/testdata/window-manager-lines.json

@@ -1,50 +0,0 @@
-[
-  {
-    "module": "asus-zephyrus-g14",
-    "content": [
-      "# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the\n# mesh: replaced at every push. Once the controller places contributions to node-display-session\n# (ADR 0210), these become the module's contribution instead of a file in i3's directory.\n#\n# The keys the firmware turns into ordinary key presses. The vendor keys that reach no X client are\n# triggerhappy's (/etc/triggerhappy/triggers.d/asus-g14.conf): M4 and Fn+F4/F5 for media, Fn+F7/F8 for\n# the panel, Fn+F10 for the touchpad. The keyboard backlight (Fn+F2/F3) is the firmware's and asusd's.\n\n# Fn+F6, the screenshot key: the firmware sends Super+Shift+S. Released before it runs, because the\n# screenshot grabs the pointer to select a region, which fails while the key is still held.\nbindsym --release $mod+Shift+s exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh\n\n# Fn+F9, the display key: the firmware sends Super+P. Odd workspaces to the panel, even ones to the\n# external output.\nbindsym $mod+p exec --no-startup-id /usr/local/lib/example-laptop/bin/zephyrus-display order\n\n# The keyboard backlight's level, shown when it changes.\nexec --no-startup-id /usr/local/lib/example-laptop/bin/zephyrus-kbd-notify\n# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the\n# mesh: replaced at every push. Once the controller places contributions to node-display-session\n# (ADR 0210), these become the module's contribution instead of a file in i3's directory.\n#\n# The model's panel and touchpad.\n\n# The internal panel is the primary output, where the bars' tray goes. Which monitors are on and where\n# is the display server's (autorandr, run at every session start).\nexec --no-startup-id /usr/local/lib/example-laptop/bin/zephyrus-display primary\n\n# The touchpad's settings again, by hand. X applies them itself whenever the device appears.\nbindsym $mod+Shift+x exec --no-startup-id /usr/local/lib/example-laptop/bin/zephyrus-touchpad reset\n"
-    ]
-  },
-  {
-    "module": "clipmenu",
-    "content": [
-      "# The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at\n# every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which\n# the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the\n# clipboard.\nbindsym $mod+period exec --no-startup-id clipmenu -p Clipboard\n"
-    ]
-  },
-  {
-    "module": "dunst",
-    "content": [
-      "# The notifications' key (module dunst, novox/hq ADR 0208). Owned by the mesh: replaced at every push.\n# Super+N opens the menu (rofi) of the actions and links of every notification on screen, so one is\n# chosen from the keyboard as a tap chooses it on the notification.\nbindsym $mod+n exec --no-startup-id dunstctl context\n"
-    ]
-  },
-  {
-    "module": "feh",
-    "content": [
-      "# The wallpaper's key (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push.\n# It puts the declared wallpaper back, after a monitor change or a wallpaper set for the session.\nbindsym $mod+Shift+b exec --no-startup-id ~/.fehbg\n"
-    ]
-  },
-  {
-    "module": "i3status-rust",
-    "content": [
-      "# The bars (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every push.\n# i3 reads this file through its configuration's `include ~/.config/i3/config.d/*.conf`. The bottom\n# bar shows the machine; the top bar the focused window and the tray, on the primary output. The\n# face is the monospace one every desktop module names.\nbar {\n        font pango:JetBrainsMono Nerd Font 11\n        position bottom\n        status_command i3status-rs ~/.config/i3status-rust/bottom-bar.toml\n        tray_output none\n        colors {\n                separator #ffffff\n                background #000000\n                statusline #ffffff\n                # The text on an accent-coloured button is dark: light text on the accent was barely\n                # legible.\n                focused_workspace #de5200 #de5200 #000000\n                active_workspace #de5200 #de5200 #000000\n                inactive_workspace #000000 #000000 #ffffff\n                urgent_workspace #2f343a #900000 #ffffff\n        }\n}\n\nbar {\n        font pango:JetBrainsMono Nerd Font 11\n        position top\n        status_command i3status-rs ~/.config/i3status-rust/top-bar.toml\n        workspace_buttons no\n        tray_output primary\n        colors {\n                separator #ffffff\n                background #000000\n                statusline #ffffff\n        }\n}\n"
-    ]
-  },
-  {
-    "module": "polychromatic",
-    "content": [
-      "# The Razer peripherals' tray (module polychromatic, novox/hq ADR 0208, ADR 0212). Owned by the mesh:\n# replaced at every push. This line is the tray's one start, at the session's start (exec, not\n# exec_always, so a reload starts nothing). The package's own login helper starts it too while the\n# application's setting \"Start the tray applet when I log on\" is ticked; polychromatic_check names\n# that as a second start.\nexec --no-startup-id polychromatic-tray-applet\n"
-    ]
-  },
-  {
-    "module": "rofi",
-    "content": [
-      "# The launcher's key bindings (module rofi, novox/hq ADR 0208). Owned by the mesh: replaced at every\n# push. i3 reads this file through its configuration's `include ~/.config/i3/config.d/*.conf`, after\n# the variables it sets, so $mod is i3's.\nbindsym $mod+d exec --no-startup-id ~/.local/bin/rofi-launch drun\nbindsym $mod+t exec --no-startup-id ~/.local/bin/rofi-launch run\nbindsym $mod+Shift+t exec --no-startup-id ~/.local/bin/rofi-launch sudo\nbindsym $mod+Shift+w exec --no-startup-id ~/.local/bin/rofi-launch window\nbindsym $mod+Escape exec --no-startup-id ~/.local/bin/rofi-powermenu\n"
-    ]
-  },
-  {
-    "module": "slack",
-    "content": [
-      "# Slack (module slack, novox/hq ADR 0208, ADR 0212). Owned by the mesh: replaced at every push.\n# Its one start: at login, to the tray (-s), with the arguments of the package's own desktop entry.\n# No XDG autostart entry starts it as well; slack_check names one if it appears.\nexec --no-startup-id /usr/bin/slack --gtk-version=3 -s\n# The chat window. Slack owns four X windows, and the only one i3 manages has the class \"slack\" in\n# lower case; the three of class \"Slack\" (the packaged entry's StartupWMClass) are its unmanaged\n# helpers and its tray icon, so a rule on class=\"Slack\" matches nothing. window_role keeps a call or\n# screen-share window out of the rules. $ws3 is i3's, in scope here.\nfor_window [class=\"(?i)^slack$\" window_role=\"browser-window\"] move to workspace $ws3\nfor_window [class=\"(?i)^slack$\" window_role=\"browser-window\"] floating disable\nfor_window [class=\"(?i)^slack$\" window_role=\"browser-window\"] border pixel 2\n"
-    ]
-  }
-]