mesh-delivery-gate: stop asking the controller's forget-checks (issue 1318, the gate's part)

The controller's forget-checks goes with the merge gate's checks (ADR 0503 §3) and 1318 removes the verb in the same group, so the gate must stop calling it first: a closed pull request is stopped and asks the controller nothing, and the manifest no longer invokes it. delivery-check stays for hq's base until R4g (the lead's decision for 1302).
mesh-delivery-gate: read mesh/check alone on a base that requires it (issue 1302, S1-S10)
2026-10-22 17:50:44 +02:00 · 2026-10-22 17:50:25 +02:00 · 2026-10-22 17:49:53 +02:00 · 2026-10-22 17:49:53 +02:00 · 2026-10-22 17:49:53 +02:00
41 changed files with 1525 additions and 184 deletions
@@ -22,16 +22,18 @@ Every new head of an open pull request is announced as `pull.updated`, once, and
  minutes, or when the search fails.
 - **A pull request nobody checks is said — by the delivery's owner, not here.** `gitea_open_pulls` answers every
  open pull request from the forge itself, with the statuses its base requires and the ones its head has. The
-  `mesh-delivery` module asks it every five minutes, and a head on a base requiring `mesh/merge-gate` or
-  `mesh/repo-check` with neither for ten minutes since it first saw it so is a delivery held past its bound
+  delivery gate asks it every five minutes, and a head on a base requiring `mesh/check` (or hq's
+  `mesh/repo-check`) with none of them for ten minutes since it first saw it so is a delivery held past its bound
  (`delivery.<id>.stalled`, state `unannounced`), which the controller raises like any other (issue 347).
  Each of the head's statuses comes with its state and when it was set, so a head whose check started and never
  answered — a required check pending, or never set beside one that is — is said as a stalled line in the state
  `unanswered` once that has lasted the delivery table's bound for a check asked and not answered, an hour, counted
  from its first sight and again only when a check is asked anew (issue 438).
 - **How to see it work.** A pull request opened more than a minute after its branch was pushed — this fix's own
-  was one, and the announcer it fixes never saw it — has `mesh/merge-gate` pending within a pass of the next sweep
-  at the latest, and `mesh-controller.conditions` names none for it.
+  was one, and the announcer it fixes never saw it — is announced within a pass of the next sweep at the latest, its
+  `mesh/check` is the checker's to set, and `mesh-controller.conditions` names none for it. (Since issue 1301 this
+  module writes `mesh/merge-gate` only where a base still requires it, and none does once the forge requires
+  `mesh/check`.)
 - **A pull request or issue number that is not one is refused** before the forge is asked: a tool called with a
  misnamed argument sent `pulls/NaN`.

@@ -154,15 +156,19 @@ listed repository:
  naming the description, and a `merge-check.sh` declaring `# mesh-check-toolchain: go` that vets and runs the unit
  tests, then the integration tests (`-tags integration`), of every Go module in the tree, and says so and passes on
  a tree with none. The rule is then narrowed to main's rule of ADR 0398 §2 (no push, only `mesh-tools` merges),
-  requiring `mesh/repo-check` and `mesh/merge-gate`, and only then is the repository moved into the organisation.
+  requiring `mesh/check` (ADR 0447 §1, issue 1301), and only then is the repository moved into the organisation.
  There main's rule is read back and put right once more (the step `rule-after-move`): the forge drops from a merge
  list a user without access to the repository, and under the setup account `mesh-tools` has none;
 - one found still under the setup account is finished: the steps it lacks are done, main is never written twice;
- one in the organisation is only put right: main's rule narrowed, a missing one of the two statuses added and every
-  status already there kept.
+- one in the organisation is only put right: main's rule narrowed, `mesh/check` required in place of
+  `mesh/merge-gate` and `mesh/repo-check`, and every other status already there kept. A main that requires
+  `mesh/repo-check` without `mesh/merge-gate` is judged by its own script alone (hq, ADR 0503 §5, until issue 1296)
+  and keeps it; `mesh/check` is never dropped.

-A step the forge refuses stops that repository, and the others go on. A repository taken out of the value is never
-asked about: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
+Every other repository of the organisation whose main requires `mesh/merge-gate` has the two old statuses swapped
+for `mesh/check`, and only its statuses (issue 1301): the switch reaches every repository the merge gate judged, with
+no list kept by hand. A step the forge refuses stops that repository, and the others go on. Beyond that swap, a
+repository taken out of the value is never changed: nothing is deleted, renamed, moved out or unprotected. The pass keeps what it did per repository in
 `repositories-outcome.json`.

 **How a refusal is seen.** `repositories sync` is a run-once process, declared as the module's last resource, so
@@ -0,0 +1,215 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+// The tests of issue 1301 (ADR 0447 §1, §5; ADR 0503 §3, §5; lead decisions L4 and L11): main requires `mesh/check`
+// alone in place of `mesh/merge-gate` and `mesh/repo-check`; a main that requires `mesh/repo-check` without
+// `mesh/merge-gate` (hq) keeps it; every repository of the organisation whose main requires `mesh/merge-gate` is
+// switched, listed in the value or not; no other status is dropped.
+
+func narrowedRule(contexts ...any) map[string]any {
+	return map[string]any{
+		"enable_push": false, "enable_push_whitelist": false, "push_whitelist_usernames": []any{},
+		"enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
+		"enable_status_check": true, "status_check_contexts": contexts,
+		"block_admin_merge_override": true,
+	}
+}
+
+// 1301-S1: a listed repository whose main requires the two old statuses is put right to `mesh/check` in their place,
+// every other status kept; a second pass changes nothing.
+func TestListedRepositorySwapsTheTwoStatusesForCheck(t *testing.T) {
+	f := newFake()
+	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check", "other/x")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"mesh-delivery": {}})
+	got := strs(repo.Rules[mainRule]["status_check_contexts"])
+	if strings.Join(got, ",") != "other/x,mesh/check" {
+		t.Errorf("main requires %v, want other/x and mesh/check", got)
+	}
+	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
+		t.Errorf("outcome %+v, want put right", r)
+	}
+	before := len(f.writes())
+	run(t, s, Value{"mesh-delivery": {}})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 1301-S1: a repository the program makes requires `mesh/check` alone from its first rule in the organisation on.
+func TestNewRepositoryRequiresCheckAlone(t *testing.T) {
+	f := newFake()
+	s, _ := syncer(t, f)
+	run(t, s, Value{"fresh": {Description: "d"}})
+	rule := f.repos["novox/fresh"].Rules[mainRule]
+	if got := strs(rule["status_check_contexts"]); rule["enable_status_check"] != true || strings.Join(got, ",") != CheckStatus {
+		t.Errorf("a new repository's main requires %v, want %s alone", got, CheckStatus)
+	}
+	if readme := f.repos["novox/fresh"].Files["README.md"]; !strings.Contains(readme, CheckStatus) ||
+		strings.Contains(readme, "mesh/merge-gate") || strings.Contains(readme, "mesh/repo-check") {
+		t.Errorf("the README names the statuses of before: %q", readme)
+	}
+}
+
+// 1301-S1: mesh/check is never dropped, and a rule that requires it beside a retired status loses the retired one.
+func TestCheckIsKeptAndARetiredStatusBesideItGoes(t *testing.T) {
+	f := newFake()
+	both := f.add("novox/both", map[string]map[string]any{mainRule: narrowedRule("mesh/check", "mesh/repo-check")}, "main")
+	right := f.add("novox/right", map[string]map[string]any{mainRule: narrowedRule("mesh/check")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"both": {}, "right": {}})
+	if got := strs(both.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+		t.Errorf("both requires %v, want %s alone", got, CheckStatus)
+	}
+	if got := strs(right.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+		t.Errorf("right requires %v", got)
+	}
+	if result(o, "right").Did != DidUnchanged || result(o, "both").Did != DidPutRight {
+		t.Errorf("outcome %+v", o)
+	}
+}
+
+// 1301-S1: a listed repository whose main requires nothing is given mesh/check, not the old two.
+func TestListedRuleRequiringNothingGetsCheck(t *testing.T) {
+	f := newFake()
+	none := f.add("novox/none", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
+	s, _ := syncer(t, f)
+	run(t, s, Value{"none": {}})
+	if got := strs(none.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+		t.Errorf("none requires %v, want %s", got, CheckStatus)
+	}
+}
+
+// 1301-S2 (ADR 0503 §5): a main that requires mesh/repo-check without mesh/merge-gate is judged by its own script
+// alone (hq): it keeps mesh/repo-check and is not given mesh/check, listed or not.
+func TestOwnCheckAloneIsKept(t *testing.T) {
+	f := newFake()
+	hq := f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	lab := f.add("novox/mesh-lab", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"hq": {}})
+	for name, repo := range map[string]*fRepo{"hq": hq, "mesh-lab": lab} {
+		if got := strs(repo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != "mesh/repo-check" {
+			t.Errorf("%s requires %v, want mesh/repo-check alone", name, got)
+		}
+	}
+	if result(o, "hq").Did != DidUnchanged {
+		t.Errorf("hq outcome %+v, want unchanged", result(o, "hq"))
+	}
+	for _, w := range f.writes() {
+		t.Errorf("a repository judged by its own check alone was written: %s", w)
+	}
+}
+
+// 1301-S3 (L4, L11): a repository the value does not list whose main requires mesh/merge-gate has the two old
+// statuses swapped for mesh/check, and only its statuses: nothing else of its rule is sent. One that requires
+// neither, or mesh/repo-check alone, is not written to.
+func TestUnlistedRepositoryRequiringTheGateIsSwitched(t *testing.T) {
+	f := newFake()
+	catalog := f.add("novox/mesh-catalog", map[string]map[string]any{mainRule: {
+		"enable_push": true, "enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check"},
+	}}, "main")
+	toolsGo := f.add("novox/mesh-tools-go", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.add("novox/plain", map[string]map[string]any{mainRule: {"enable_push": false}}, "main")
+	f.add("novox/hq", map[string]map[string]any{mainRule: narrowedRule("mesh/repo-check")}, "main")
+	f.add("novox/norule", nil, "main")
+	f.add("mesh-admin/elsewhere", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{})
+
+	if got := strs(catalog.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+		t.Errorf("mesh-catalog requires %v, want %s", got, CheckStatus)
+	}
+	if catalog.Rules[mainRule]["enable_push"] != true {
+		t.Errorf("an unlisted repository's rule was narrowed beyond its statuses: %v", catalog.Rules[mainRule])
+	}
+	if got := strs(toolsGo.Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+		t.Errorf("mesh-tools-go requires %v, want %s", got, CheckStatus)
+	}
+	want := []string{
+		"PATCH /api/v1/repos/novox/mesh-catalog/branch_protections/main",
+		"PATCH /api/v1/repos/novox/mesh-tools-go/branch_protections/main",
+	}
+	if got := f.writes(); strings.Join(got, "\n") != strings.Join(want, "\n") {
+		t.Errorf("writes:\n%s\nwant:\n%s", strings.Join(got, "\n"), strings.Join(want, "\n"))
+	}
+	for _, n := range []string{"mesh-catalog", "mesh-tools-go"} {
+		if r := result(o, n); r.Did != DidPutRight {
+			t.Errorf("%s outcome %+v, want put right", n, r)
+		}
+	}
+	for _, n := range []string{"plain", "hq", "norule", "elsewhere"} {
+		if r := result(o, n); r.Name != "" {
+			t.Errorf("%s is in the outcome though nothing was done: %+v", n, r)
+		}
+	}
+	before := len(f.writes())
+	run(t, s, Value{})
+	if w := f.writes(); len(w) != before {
+		t.Errorf("a second pass wrote %v", w[before:])
+	}
+}
+
+// 1301-S3: the organisation's repositories are read page by page, so one past the first page is switched too.
+func TestUnlistedRepositoriesAreReadPastTheFirstPage(t *testing.T) {
+	f := newFake()
+	f.pageSize = 2
+	for _, n := range []string{"a", "b", "c", "d", "e"} {
+		f.add("novox/"+n, map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate", "mesh/repo-check")}, "main")
+	}
+	s, _ := syncer(t, f)
+	run(t, s, Value{})
+	for _, n := range []string{"a", "b", "c", "d", "e"} {
+		if got := strs(f.repos["novox/"+n].Rules[mainRule]["status_check_contexts"]); strings.Join(got, ",") != CheckStatus {
+			t.Errorf("%s requires %v", n, got)
+		}
+	}
+}
+
+// 1301-S3: a refused swap is said with the repository and its step, and the pass goes on to the next.
+func TestRefusedSwapIsSaid(t *testing.T) {
+	f := newFake()
+	f.add("novox/a", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.add("novox/b", map[string]map[string]any{mainRule: narrowedRule("mesh/merge-gate")}, "main")
+	f.refuse = func(method, path string) (int, string) {
+		if method == "PATCH" && strings.Contains(path, "/novox/a/") {
+			return 403, "no"
+		}
+		return 0, ""
+	}
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{})
+	if r := result(o, "a"); r.Did != DidRefused || r.Step != StepSwap {
+		t.Errorf("a: %+v, want refused at %s", r, StepSwap)
+	}
+	if r := result(o, "b"); r.Did != DidPutRight {
+		t.Errorf("b: %+v, want put right", r)
+	}
+}
+
+// 1301-S3: the organisation's list refused is said, and the listed repositories are still done.
+func TestOrganisationListRefusedIsSaid(t *testing.T) {
+	f := newFake()
+	f.refuse = func(method, path string) (int, string) {
+		if strings.HasPrefix(path, "/api/v1/orgs/") {
+			return 500, "down"
+		}
+		return 0, ""
+	}
+	s, _ := syncer(t, f)
+	o := run(t, s, Value{"x": {}})
+	if result(o, "x").Did != DidMade {
+		t.Errorf("x: %+v", result(o, "x"))
+	}
+	refusedList := false
+	for _, r := range o.Refused() {
+		refusedList = refusedList || r.Step == StepList
+	}
+	if !refusedList {
+		t.Errorf("the refused list is not in the outcome: %+v", o)
+	}
+}
@@ -11,6 +11,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -43,6 +44,8 @@ type fakeForge struct {
 	calls []string          // "METHOD /path"
 	// refuse answers a call with a status and a message when it returns a status above zero.
 	refuse func(method, path string) (int, string)
+	// pageSize is how many repositories one page of the organisation's list holds; 50 when zero.
+	pageSize int
 }

 func newFake() *fakeForge { return &fakeForge{repos: map[string]*fRepo{}} }
@@ -84,6 +87,7 @@ var (
 	branchPath = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/branches/([^/]+)$`)
 	filesPath  = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/contents$`)
 	movePath   = regexp.MustCompile(`^/api/v1/repos/([^/]+)/([^/]+)/transfer$`)
+	orgRepos   = regexp.MustCompile(`^/api/v1/orgs/([^/]+)/repos$`)
 )

 func strs(v any) []string {
@@ -167,6 +171,31 @@ func (f *fakeForge) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	switch {
 	case p == "/api/v1/version":
 		reply(200, map[string]string{"version": "1.27"})
+	case orgRepos.MatchString(p) && r.Method == http.MethodGet:
+		owner := orgRepos.FindStringSubmatch(p)[1]
+		var names []string
+		for full := range f.repos {
+			if o, n, _ := strings.Cut(full, "/"); o == owner {
+				names = append(names, n)
+			}
+		}
+		sort.Strings(names)
+		size := f.pageSize
+		if size == 0 {
+			size = 50
+		}
+		if l, _ := strconv.Atoi(r.URL.Query().Get("limit")); l > 0 && l < size {
+			size = l
+		}
+		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+		if page < 1 {
+			page = 1
+		}
+		out := []map[string]any{}
+		for i := (page - 1) * size; i < len(names) && i < page*size; i++ {
+			out = append(out, map[string]any{"name": names[i], "full_name": owner + "/" + names[i]})
+		}
+		reply(200, out)
 	case p == "/api/v1/user/repos" && r.Method == http.MethodPost:
 		name := fmt.Sprint(in["name"])
 		if f.repos[admin+"/"+name] != nil {
@@ -312,12 +341,3 @@ func result(o Outcome, name string) Result {
 	}
 	return Result{}
 }
-
-func has(list []string, want string) bool {
-	for _, s := range list {
-		if s == want {
-			return true
-		}
-	}
-	return false
-}
@@ -8,7 +8,7 @@ import "strings"
 const MergeCheck = `#!/bin/sh
 # mesh-check-toolchain: go
 #
-# This repository's own check, mesh/repo-check (novox/hq ADR 0238 §4), written with its first commit (ADR 0428 §4):
+# This repository's own check (novox/hq ADR 0238 §4), run by the checker within mesh/check (ADR 0447), written with its first commit (ADR 0428 §4):
 # every Go module in the tree is vetted, its unit tests run, and then its integration tests (-tags integration).
 # A tree with no Go module has nothing to test, and the check says so and passes.
 set -eu
@@ -37,7 +37,7 @@ func FirstCommit(name string, r Repo) map[string]string {
 	}
 	readme := "# " + name + "\n\n" + purpose + "\n\n" +
 		"Made by the mesh from the gitea module's config value `repositories` (novox/hq ADR 0428). Main takes no push: " +
-		"a change reaches it by a pull request whose `mesh/repo-check` (this repository's `merge-check.sh`) and " +
-		"`mesh/merge-gate` passed.\n"
+		"a change reaches it by a pull request whose `mesh/check` passed: the checker's verdict on its head merged onto " +
+		"main, this repository's `merge-check.sh` among its tests (novox/hq ADR 0447).\n"
 	return map[string]string{"README.md": readme, "merge-check.sh": MergeCheck}
 }
@@ -3,7 +3,8 @@
 // again whenever the value changes: it reads the file the mesh renders from that value and, with the setup login,
 // makes every listed repository that does not exist under that login's own account, protects its main, writes
 // main's first commit, narrows main's rule and only then moves it into the organisation; one that exists only has
-// its main rule put right. A repository the value does not list is never touched. It keeps what it did, per
+// its main rule put right, requiring mesh/check in place of the two statuses it replaces (issue 1301). A repository
+// the value does not list is touched only to swap those two for mesh/check when its main requires mesh/merge-gate. It keeps what it did, per
 // repository, in the outcome file, says each change on stdout in one line and never a secret, and exits 1 when a
 // step was refused, its last stderr lines naming each (outcome.go Report): the node-engine's gate on a run-once
 // step (ADR 0136) reports it and runs it again on every apply until it passes.
@@ -18,7 +18,7 @@ func TestNewRepositoryRefusesTheAdministratorsOverride(t *testing.T) {
 }

 // 1141/AC2: a narrowed main rule that still lets an administrator override is not right: it is put right, its
-// statuses kept, and a second pass changes nothing.
+// statuses kept (the two old ones as mesh/check, issue 1301), and a second pass changes nothing.
 func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	f := newFake()
 	repo := f.add("novox/mesh-delivery", map[string]map[string]any{mainRule: {
@@ -33,10 +33,8 @@ func TestNarrowedRuleLettingTheAdministratorOverrideIsPutRight(t *testing.T) {
 	if rule["block_admin_merge_override"] != true {
 		t.Errorf("the administrator's override is still allowed: %v", rule)
 	}
-	for _, c := range []string{"mesh/merge-gate", "mesh/repo-check", "other/x"} {
-		if !has(strs(rule["status_check_contexts"]), c) {
-			t.Errorf("a status was dropped: %v", rule["status_check_contexts"])
-		}
+	if c := strs(rule["status_check_contexts"]); strings.Join(c, ",") != "other/x,mesh/check" {
+		t.Errorf("statuses %v, want other/x kept and mesh/check for the two it replaces (issue 1301)", c)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidPutRight {
 		t.Errorf("outcome %+v, want put right", r)
@@ -26,9 +26,47 @@ const (
 	MainBranch = "main"
 )

-// RequiredStatuses are what main requires in every listed repository from its first commit (ADR 0428 §5): the
-// repository's own check and the module graph's gate. A status already on the rule is kept beside them.
-var RequiredStatuses = []string{"mesh/merge-gate", "mesh/repo-check"}
+// CheckStatus is the one status main requires (ADR 0447 §1, issue 1301): the checker's verdict on a pull request's
+// head merged onto its trunk's head. It replaces GateStatus and OwnCheckStatus, and is never dropped.
+const CheckStatus = "mesh/check"
+
+// GateStatus and OwnCheckStatus are the two statuses CheckStatus replaces: the controller's merge gate and the
+// repository's own merge-check.sh (ADR 0238 §4, ADR 0428 §5 before ADR 0447 §1).
+const (
+	GateStatus     = "mesh/merge-gate"
+	OwnCheckStatus = "mesh/repo-check"
+)
+
+// wanted is what a main rule requiring have should require: have with GateStatus and OwnCheckStatus replaced by
+// CheckStatus, every other status kept in its order (ADR 0447 §1). A rule requiring OwnCheckStatus with neither
+// GateStatus nor CheckStatus is judged by its own script alone, as hq is until issue 1296 settles how hq is
+// checked (ADR 0503 §5): the checker writes no status there (ADR 0484 §8), so it is left as it is. This reads the
+// rule, not a list of names (lead decision L11 of R4e).
+func wanted(have []string) []string {
+	if !has(have, GateStatus) && !has(have, CheckStatus) && has(have, OwnCheckStatus) {
+		return have
+	}
+	out := []string{}
+	for _, s := range have {
+		if s != GateStatus && s != OwnCheckStatus && s != CheckStatus {
+			out = append(out, s)
+		}
+	}
+	return append(out, CheckStatus)
+}
+
+func has(list []string, want string) bool {
+	for _, s := range list {
+		if s == want {
+			return true
+		}
+	}
+	return false
+}
+
+func sameList(a, b []string) bool {
+	return strings.Join(a, "\x00") == strings.Join(b, "\x00")
+}

 // The steps of one repository, as an outcome names a refused one (ADR 0428 §6).
 const (
@@ -42,6 +80,10 @@ const (
 	// StepRuleAfterMove reads main's rule back once the repository is in the organisation and puts it right: the
 	// forge drops from a merge whitelist a user without access, and under the setup account the tools' have none.
 	StepRuleAfterMove = "rule-after-move"
+	// StepList reads the organisation's repositories, for those the value does not list (issue 1301).
+	StepList = "list"
+	// StepSwap swaps the two old statuses for CheckStatus on a repository the value does not list (issue 1301).
+	StepSwap = "swap"
 )

 // What a pass did with one repository.
@@ -157,9 +199,73 @@ func (s *Syncer) Sync(ctx context.Context, v Value) (Outcome, error) {
 		}
 		out.Repositories = append(out.Repositories, r)
 	}
+	for _, r := range s.switchUnlisted(ctx, v) {
+		if r.Did == DidRefused {
+			s.say("refused: %s/%s at the step %s: %s", s.Org, r.Name, r.Step, r.Said)
+		} else {
+			s.say("%s: %s/%s (%s in place of %s and %s)", r.Did, s.Org, r.Name, CheckStatus, GateStatus, OwnCheckStatus)
+		}
+		out.Repositories = append(out.Repositories, r)
+	}
 	return out, nil
 }

+// orgPage is how many repositories one read of the organisation's list asks for.
+const orgPage = 50
+
+// switchUnlisted swaps the two old statuses for CheckStatus on main's rule of every repository of the organisation
+// the value does not list whose main requires GateStatus (issue 1301, lead decisions L4 and L11 of R4e): the
+// repositories the merge gate judges are switched in the delivery that has the checker write mesh/check (ADR 0447
+// §5), with no list kept by hand. Only the statuses of a rule covering main are sent; nothing else of a rule the
+// value does not hold is changed (ADR 0428 §7 for all of it but the statuses the mesh itself requires). A main that
+// does not require GateStatus gets no call. It answers only what it did: a repository switched, or refused.
+func (s *Syncer) switchUnlisted(ctx context.Context, v Value) []Result {
+	var names []string
+	for page := 1; ; page++ {
+		var repos []struct {
+			Name string `json:"name"`
+		}
+		q := "?limit=" + fmt.Sprint(orgPage) + "&page=" + fmt.Sprint(page)
+		if err := s.Forge.GetJSON(ctx, "/api/v1/orgs/"+url.PathEscape(s.Org)+"/repos"+q, &repos); err != nil {
+			return []Result{refused("(the organisation's repositories)", StepList, err)}
+		}
+		for _, r := range repos {
+			if _, listed := v[r.Name]; !listed && r.Name != "" {
+				names = append(names, r.Name)
+			}
+		}
+		if len(repos) == 0 || page > 1000 {
+			break
+		}
+	}
+	sort.Strings(names)
+	var out []Result
+	for _, n := range names {
+		rules, err := s.rules(ctx, s.Org, n)
+		if err != nil {
+			out = append(out, refused(n, StepRead, err))
+			continue
+		}
+		var did *Result
+		for _, r := range rules {
+			if ok, _ := path.Match(ruleName(r), MainBranch); !ok || !has(required(r), GateStatus) {
+				continue
+			}
+			body := map[string]any{"enable_status_check": true, "status_check_contexts": wanted(required(r))}
+			if err := s.Forge.SendJSON(ctx, http.MethodPatch,
+				repoAPI(s.Org, n)+"/branch_protections/"+url.PathEscape(ruleName(r)), body, nil); err != nil {
+				did = &Result{Name: n, Did: DidRefused, Step: StepSwap, Said: err.Error()}
+				break
+			}
+			did = &Result{Name: n, Did: DidPutRight}
+		}
+		if did != nil {
+			out = append(out, *did)
+		}
+	}
+	return out
+}
+
 // waitForForge is cmd/agent-teams' (teams.go waitForForge): the forge starting with the module answers late.
 func (s *Syncer) waitForForge(ctx context.Context) error {
 	deadline := time.Now().Add(s.WaitFor)
@@ -309,7 +415,7 @@ func strList(v any) []string {
 	return out
 }

-// statuses is what a rule requires, with RequiredStatuses added and none dropped.
+// statuses is what the rules require together, as wanted makes it.
 func statuses(rules ...rule) []string {
 	seen := map[string]bool{}
 	var out []string
@@ -320,16 +426,19 @@ func statuses(rules ...rule) []string {
 		}
 	}
 	for _, r := range rules {
-		if r != nil && r["enable_status_check"] == true {
-			for _, s := range strList(r["status_check_contexts"]) {
-				add(s)
-			}
+		for _, s := range required(r) {
+			add(s)
 		}
 	}
-	for _, s := range RequiredStatuses {
-		add(s)
+	return wanted(out)
+}
+
+// required is what a rule requires: its statuses when it checks them, else none.
+func required(r rule) []string {
+	if r == nil || r["enable_status_check"] != true {
+		return nil
 	}
-	return out
+	return strList(r["status_check_contexts"])
 }

 // narrowed is main's rule of ADR 0398 §2 (protection.ts mainRuleBody): no push, only the tools' account merges,
@@ -344,7 +453,7 @@ func narrowed(r rule, toolsAccount string, also ...rule) map[string]any {
 	}
 }

-// isRight says whether a rule already is narrowed and requires both statuses.
+// isRight says whether a rule already is narrowed and requires what wanted makes of it.
 func isRight(r rule, toolsAccount string) bool {
 	if r["enable_push"] != false || r["enable_push_whitelist"] == true || r["enable_merge_whitelist"] != true {
 		return false
@@ -352,26 +461,15 @@ func isRight(r rule, toolsAccount string) bool {
 	if m := strList(r["merge_whitelist_usernames"]); len(m) != 1 || m[0] != toolsAccount {
 		return false
 	}
-	return r["enable_status_check"] == true && hasAll(strList(r["status_check_contexts"])) &&
+	have := strList(r["status_check_contexts"])
+	return r["enable_status_check"] == true && len(have) > 0 && sameList(have, wanted(have)) &&
 		r["block_admin_merge_override"] == true
 }

-func hasAll(have []string) bool {
-	for _, want := range RequiredStatuses {
-		found := false
-		for _, h := range have {
-			found = found || h == want
-		}
-		if !found {
-			return false
-		}
-	}
-	return true
-}
-
-// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires.
+// putRight makes main's rule in an organisation's repository the narrowed one, keeping every status it requires but
+// the two CheckStatus replaces (ADR 0447 §1).
 // A repository with no rule named main gets one, carrying what a glob rule covering main asks (client.ts
-// ensureMainMerges, issue 948). It never takes a status away and never unprotects (ADR 0428 §5, §7).
+// ensureMainMerges, issue 948). It takes away no other status and never unprotects (ADR 0428 §5, §7).
 func (s *Syncer) putRight(ctx context.Context, owner, name string) (bool, error) {
 	rules, err := s.rules(ctx, owner, name)
 	if err != nil {
@@ -17,8 +17,8 @@ import (
 const mainRule = "main"

 // 1124/AC2: a listed repository that does not exist is made under the setup account, given main's rule letting that
-// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/repo-check (and
-// mesh/merge-gate, 1124/AC5), and only then moved into the organisation. Nothing reaches the organisation before the
+// login alone push, given its first commit, narrowed to no push and the tools' merge requiring mesh/check (1124/AC5
+// as issue 1301 changes it), and only then moved into the organisation. Nothing reaches the organisation before the
 // narrowed rule, and nothing else is pushed to main.
 func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 	f := newFake()
@@ -67,8 +67,8 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {
 		t.Errorf("main's merge whitelist is not the tools' account alone: %v", rule)
 	}
 	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
-		t.Errorf("main does not require mesh/repo-check and mesh/merge-gate (1124/AC5): %v", rule)
+	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
+		t.Errorf("main does not require mesh/check alone (1124/AC5, issue 1301): %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade || r.Step != "" {
 		t.Errorf("outcome %+v, want made", r)
@@ -87,7 +87,7 @@ func TestNewRepositoryIsMadeInOrder(t *testing.T) {

 // 1124/AC2: the forge drops from a merge whitelist a user without access to the repository, and under the setup
 // account the tools' account has none; so once the repository is in the organisation its main rule is read back and
-// put right: the tools' account the only one that merges, both statuses required.
+// put right: the tools' account the only one that merges, mesh/check required.
 func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 	f := newFake()
 	s, _ := syncer(t, f)
@@ -104,8 +104,8 @@ func TestOrganisationRuleListsTheToolsAfterTheMove(t *testing.T) {
 		t.Errorf("after the move main takes a push: %v", rule)
 	}
 	checks := strs(rule["status_check_contexts"])
-	if rule["enable_status_check"] != true || !has(checks, "mesh/repo-check") || !has(checks, "mesh/merge-gate") {
-		t.Errorf("after the move main does not require both statuses: %v", rule)
+	if rule["enable_status_check"] != true || strings.Join(checks, ",") != CheckStatus {
+		t.Errorf("after the move main does not require mesh/check alone: %v", rule)
 	}
 	if r := result(o, "mesh-delivery"); r.Did != DidMade {
 		t.Errorf("outcome %+v, want made", r)
@@ -136,7 +136,8 @@ func TestAdminRuleLetsTheSetupLoginAlonePush(t *testing.T) {
 }

 // 1124/AC3: a listed repository that exists in the organisation is not made again, only its main rule put right;
-// a rule still letting the setup login push is narrowed, its statuses kept (1124/AC5).
+// a rule still letting the setup login push is narrowed, its statuses kept but the two mesh/check replaces (1124/AC5,
+// issue 1301).
 func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 	f := newFake()
 	hq := f.add("novox/hq", map[string]map[string]any{mainRule: {
@@ -157,14 +158,11 @@ func TestExistingOrganisationRepositoryIsOnlyPutRight(t *testing.T) {
 		t.Errorf("hq's rule not narrowed: %v", rule)
 	}
 	checks := strs(rule["status_check_contexts"])
-	for _, c := range []string{"other/x", "mesh/merge-gate", "mesh/repo-check"} {
-		if !has(checks, c) {
-			t.Errorf("hq's rule lacks %s: %v", c, checks)
-		}
+	if strings.Join(checks, ",") != "other/x,mesh/check" {
+		t.Errorf("hq's rule requires %v, want other/x and mesh/check", checks)
 	}
 	made := bare.Rules[mainRule]
-	if made == nil || made["enable_push"] != false || !has(strs(made["status_check_contexts"]), "mesh/repo-check") ||
-		!has(strs(made["status_check_contexts"]), "mesh/merge-gate") {
+	if made == nil || made["enable_push"] != false || strings.Join(strs(made["status_check_contexts"]), ",") != CheckStatus {
 		t.Errorf("bare's rule: %v", made)
 	}
 	if hq.Commits != 0 || bare.Commits != 0 {
@@ -214,8 +212,8 @@ func TestRepositoryUnderTheSetupAccountIsFinished(t *testing.T) {
 	}
 }

-// 1124/AC5: putting a rule right adds a missing one of mesh/repo-check and mesh/merge-gate and keeps every status
-// already there; no pass drops one.
+// 1124/AC5 as issue 1301 changes it: putting a rule right adds mesh/check when the rule requires mesh/merge-gate,
+// and keeps every other status there; a rule requiring mesh/repo-check alone keeps it (ADR 0503 §5).
 func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
 	f := newFake()
 	only := f.add("novox/only", map[string]map[string]any{mainRule: {
@@ -224,15 +222,15 @@ func TestStatusesAreAddedAndNeverDropped(t *testing.T) {
 	}}, "main")
 	more := f.add("novox/more", map[string]map[string]any{mainRule: {
 		"enable_push": false, "enable_merge_whitelist": true, "merge_whitelist_usernames": []any{tools},
-		"enable_status_check": true, "status_check_contexts": []any{"mesh/merge-gate", "mesh/repo-check", "mesh/delivery"},
+		"enable_status_check": true, "status_check_contexts": []any{"mesh/delivery", "mesh/check"},
 		"block_admin_merge_override": true, // right since issue 1141
 	}}, "main")
 	s, _ := syncer(t, f)
 	o := run(t, s, Value{"only": {}, "more": {}})
-	if c := strs(only.Rules[mainRule]["status_check_contexts"]); !has(c, "mesh/merge-gate") || !has(c, "mesh/repo-check") {
+	if c := strs(only.Rules[mainRule]["status_check_contexts"]); strings.Join(c, ",") != "mesh/repo-check" {
 		t.Errorf("only: %v", c)
 	}
-	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 3 || !has(c, "mesh/delivery") {
+	if c := strs(more.Rules[mainRule]["status_check_contexts"]); len(c) != 2 || !has(c, "mesh/delivery") {
 		t.Errorf("more lost a status: %v", c)
 	}
 	for _, w := range f.writes() {
@@ -314,7 +312,8 @@ func TestRefusedStepStopsThatRepositoryOnly(t *testing.T) {
 	}
 }

-// 1124/AC7: a repository taken out of the value gets no call at all.
+// 1124/AC7: a repository taken out of the value is not changed: its rules are read (issue 1301 switches one whose
+// main requires mesh/merge-gate), nothing is written, and one still under the setup account is not asked about.
 func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	f := newFake()
 	f.add("novox/old", map[string]map[string]any{mainRule: {"enable_push": true}}, "main")
@@ -323,7 +322,7 @@ func TestRepositoryOutOfTheValueIsNotTouched(t *testing.T) {
 	run(t, s, Value{})
 	run(t, s, Value{"new": {}})
 	for _, c := range f.all() {
-		if strings.Contains(c, "old") {
+		if strings.Contains(c, "older") || (strings.Contains(c, "old") && !strings.HasPrefix(c, "GET ")) {
 			t.Errorf("a repository out of the value was asked: %s", c)
 		}
 	}
@@ -16,6 +16,9 @@ import { promisify } from "node:util";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus } from "./client.js";
 import { checkName } from "./guard.js";
+import { CHECK_STATUS } from "./pulls.js";
+
+export { CHECK_STATUS };

 /** How a command is run: docker on the forge's machine, or a test's. */
 export type Runner = (file: string, args: string[]) => Promise<{ stdout: string; code: number }>;
@@ -91,11 +94,18 @@ const states = new Set(["pending", "success", "error", "failure", "warning"]);
 /** The merge check's contexts (pulls.ts): a branch's protection may require them. */
 const mergeCheckContexts = new Set(["mesh/merge-gate", "mesh/repo-check"]);

+
 /** A status mesh-delivery asks for, checked: one of the forge's states, a context of the mesh's own, a
 *  bounded description. */
 export function deliveryStatus(context: string, state: string, description: string, target?: string) {
  if (!/^mesh\/[a-z-]+$/.test(context)) throw new Error(`${context} is not a status of the mesh's own`);
  if (!states.has(state)) throw new Error(`${state} is not a status the forge keeps`);
+  // mesh/check is the checker's verdict and the one status main requires (ADR 0447 §1): no hand sets it in any
+  // state, as issue 293 closed for the two before it. The forge bridge writes it through gitea_check_status, a tool
+  // only its account may call (issue 1301).
+  if (context === CHECK_STATUS) {
+    throw new Error(`${CHECK_STATUS} is the checker's status: the forge bridge writes it through gitea_check_status, never this tool`);
+  }
  // The merge check's statuses are its verdict's, set when the controller says it, and a branch may require
  // them: never set to a verdict by hand, so nothing passes — or fails — a merge past the check (novox/hq
  // issue 293). Pending is no verdict: it is what this holder says on every new head until the verdict comes,
@@ -126,7 +136,7 @@ export interface StatusWriters {
 export function commitStatusTool(writers: StatusWriters): ToolDefinition {
  return {
    name: "gitea_commit_status",
-    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. The merge check's statuses (mesh/merge-gate, mesh/repo-check) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
+    description: "Set one of the mesh's statuses on a commit (mesh/delivery, mesh/delivery-group): pending, success, error, failure or warning, a short description, and the page it links to. mesh/check, the status main requires, is refused: the checker's forge bridge writes it through gitea_check_status. hq's mesh/repo-check (and mesh/merge-gate, kept for a revert) take pending only — a recheck putting them back until the fresh verdict sets them — on the head's whole sha, in their turn after the check's earlier writes.",
    input: {
      owner: { type: "string", description: "the repository owner" },
      repo: { type: "string", description: "the repository name" },
@@ -153,3 +163,48 @@ export function commitStatusTool(writers: StatusWriters): ToolDefinition {
    },
  };
 }
+
+/** What the check's status tool writes with: the forge. */
+export interface CheckStatusWriter {
+  setCommitStatus(owner: string, repo: string, sha: string, status: CommitStatus): Promise<void>;
+}
+
+/**
+ * The `gitea_check_status` tool (novox/hq issue 1301, ADR 0447 §1): the one way `mesh/check` is written. Its arguments
+ * are gitea_commit_status's, so the forge bridge sends an owed status's arguments unchanged to it: owner, repo, sha
+ * (the head's whole sha), state, description, target_url, and context, which may be left out and is mesh/check when
+ * given. **Who may write it is the bus's grant**: the runtime tells a tool no caller, so only a module that lists
+ * `gitea.gitea_check_status` in its manifest's `invokes` may call it, and the forge bridge alone does. Served beside
+ * gitea_commit_status, from the watcher's bundle.
+ */
+export function checkStatusTool(writer: CheckStatusWriter): ToolDefinition {
+  return {
+    name: "gitea_check_status",
+    description: "Set mesh/check, the checker's verdict and the one status main requires, on a pull request's head: pending, success, error, failure or warning, a short description, and the page it links to. The checker's forge bridge alone may call it (its manifest's invokes); no other status is written here, and no other tool writes this one.",
+    input: {
+      owner: { type: "string", description: "the repository owner" },
+      repo: { type: "string", description: "the repository name" },
+      sha: { type: "string", description: "the head's whole sha" },
+      context: { type: "string", description: "mesh/check, or left out" },
+      state: { type: "string", description: "pending | success | error | failure | warning" },
+      description: { type: "string", description: "one line" },
+      target_url: { type: "string", description: "the page it links to (the check's report)" },
+    },
+    run: async (args) => {
+      const owner = checkName("owner", args.owner), repo = checkName("name", args.repo), sha = String(args.sha ?? "");
+      if (args.context !== undefined && args.context !== null && String(args.context) !== CHECK_STATUS) {
+        throw new Error(`${JSON.stringify(args.context)}: this tool writes ${CHECK_STATUS} alone. Nothing was sent`);
+      }
+      if (!/^([0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha)) {
+        throw new Error(`${JSON.stringify(args.sha)} is not a head's whole sha: ${CHECK_STATUS} names the head whole. Nothing was sent`);
+      }
+      // deliveryStatus checks the state and cuts the description; it refuses mesh/check, so it is asked for a
+      // context of the mesh's own and the status is named mesh/check after.
+      const checked = deliveryStatus("mesh/delivery", String(args.state), String(args.description ?? ""),
+        args.target_url ? String(args.target_url) : undefined);
+      const status = { ...checked, context: CHECK_STATUS };
+      await writer.setCommitStatus(owner, repo, sha, status);
+      return { set: status };
+    },
+  };
+}
@@ -212,7 +212,8 @@ export class GateWriter {
      let since = h.pendingAt;
      if (since === undefined) {
        const gate = await this.forge.gateOf(owner, repo, sha);
-        if (gate && gate.state !== "pending") return;
+        // No gate on the forge: none was written (its base does not require it, issue 1301), and nothing is said.
+        if (!gate || gate.state !== "pending") return;
        since = gate?.updated_at ? Date.parse(gate.updated_at) : undefined;
      }
      if (since !== undefined && at.getTime() < since - CLOCK_SLACK_MS) return;
@@ -12,7 +12,9 @@
 // Consumes mesh-controller.checked — a pull request's merge check, judged — and sets it as the head
 // commit's statuses: `mesh/merge-gate`, the modules of the mesh's graph the change touches, and
 // `mesh/repo-check`, the repository's own merge-check.sh (novox/hq ADR 0237 as amended); with a comment
-// saying why when the gate is not a pass or the repository's own check failed.
+// saying why when the gate is not a pass or the repository's own check failed. Of the two, only those the base
+// still requires are written (issue 1301): main requires `mesh/check` — the checker's, written by its forge bridge
+// through gitea_check_status — everywhere but hq, whose main requires `mesh/repo-check` alone (ADR 0503 §5).
 //
 // Consumes node-build-agent.started — a build machine took an ask — and says, on the head a pending check is of,
 // which machine builds it since when (novox/hq issue 446). This module is the one writer of mesh/merge-gate.
@@ -38,12 +40,12 @@

 import { emit, on } from "@novox/mesh-sdk/events";
 import { registerModuleTools } from "@novox/mesh-sdk/tools";
-import { commitStatusTool } from "./delivery.js";
+import { checkStatusTool, commitStatusTool } from "./delivery.js";
 import { announce, keepWatermark, readWatermark } from "./announce.js";
 import { mergeTool } from "./merge.js";
 import { GiteaAdmin, GiteaClient, movedSince } from "./client.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, statusesFor, type Announced, type Checked,
-  repoCheckFacts, reposToLook } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, commentFor, composedGate, groupGateStatus, headsToAnnounce, maintained,
+  requiredOf, statusesFor, writesGate, type Announced, type Checked, repoCheckFacts, reposToLook } from "./pulls.js";
 import { GateWriter, clonedAs, type BuildStarted } from "./gate.js";
 import { HOOK_PATH, HOOK_PORT, Pace, claimHead, ensureSystemHook, eventsTool, keptSecret, receiver, type ForgeEvent } from "./webhook.js";
 import { keepSiblings, noteComposed, noteVerdict, readSiblings, siblingsFile, siblingsOf, weighSiblings } from "./siblings.js";
@@ -247,8 +249,11 @@ async function announceHead(client: GiteaClient, repo: RepoOf, pull: OpenOf): Pr
  // Said, so an operator knows the mesh was asked to check it.
  console.log(`[gitea] announced ${key} at ${sha.slice(0, 8)} to be checked before it merges`);
  // Pending until the verdict comes, so the pull request says a check is running rather than nothing — and
-  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446).
-  await gates.pending(repo.owner, repo.name, sha);
+  // where it is: in the build queue from now, until a build machine takes it (novox/hq issue 446). Only where the base
+  // still requires mesh/merge-gate (issue 1301): a main that requires mesh/check is the checker's, and hq's requires
+  // mesh/repo-check alone; a rule that cannot be read is said pending, as before.
+  const rule = await client.appliedProtection(repo.owner, repo.name, String(pull.base || "main")).catch(() => undefined);
+  if (writesGate(requiredOf(rule))) await gates.pending(repo.owner, repo.name, sha);
  return true;
 }
 type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
@@ -257,7 +262,7 @@ type OpenOf = Awaited<ReturnType<GiteaClient["listOpenPullsSince"]>>[number];
 async function alreadyChecked(client: GiteaClient, repo: RepoOf, pull: OpenOf): Promise<boolean> {
  try {
    const checks = await client.headChecks(repo.owner, repo.name, String(pull.head_sha));
-    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks;
+    return CHECK_CONTEXT in checks || REPO_CHECK_CONTEXT in checks || CHECK_STATUS in checks;
  } catch {
    return false; // the forge cannot say: announced, and the bus's message id collapses it if it was
  }
@@ -394,16 +399,20 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
  // (novox/hq ADR 0323 §4): a check asked before the trunk moved. It is said so, pending with the reason, in place of
  // its pass or failure; a trunk that cannot be read lets the verdict stand, and the merge tool compares the commits.
  const trunk = base ?? c.plan?.base;
+  // Only the statuses the base still requires are written (issue 1301): on hq, mesh/repo-check alone.
+  const required = trunk ? requiredOf(await client.appliedProtection(c.owner, c.repo, trunk).catch(() => undefined)) : undefined;
+  const kept = maintained(required);
  if (c.trunk && trunk) {
    const head = await client.branchHead(c.owner, c.repo, trunk).catch(() => undefined);
    if (head && !sameCommit(c.trunk, head)) {
      const description = outOfDateWords(c.trunk, head);
-      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]) {
+      for (const context of [...(composedGate(c) ? [] : [CHECK_CONTEXT]), ...(c["repo-check"] ? [REPO_CHECK_CONTEXT] : [])]
+        .filter((x) => kept.includes(x))) {
        await client.setCommitStatus(c.owner, c.repo, c.commit, { state: "pending", context, description,
          ...(target ? { target_url: target } : {}) });
      }
      // Its account is kept and shown all the same (ADR 0323 §7): what it judged, and that it is out of date.
-      const said = commentFor(c, await repoCheckFacts(client, c, trunk));
+      const said = commentFor(c, await repoCheckFacts(client, c, trunk), required);
      if (c.number && !composedGate(c)) await client.addComment(c.owner, c.repo, c.number, lateVerdictComment(c, said, description));
      console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}, ` +
        `${description}`);
@@ -412,10 +421,10 @@ async function setVerdict(client: GiteaClient, event: { body: unknown }): Promis
  }
  const facts = await repoCheckFacts(client, c, base ?? c.plan?.base);
  const gateNow = composedGate(c) ? (await client.headChecks(c.owner, c.repo, c.commit).catch(() => ({} as Record<string, { description?: string }>)))[CHECK_CONTEXT]?.description : undefined;
-  for (const status of statusesFor(c, facts, gateNow)) {
+  for (const status of statusesFor(c, facts, gateNow, required)) {
    await client.setCommitStatus(c.owner, c.repo, c.commit, target ? { ...status, target_url: target } : status);
  }
-  const comment = composedGate(c) ? null : commentFor(c, facts);
+  const comment = composedGate(c) ? null : commentFor(c, facts, required);
  if (comment && c.number) await client.addComment(c.owner, c.repo, c.number, comment);
  console.log(`[gitea] ${c.owner}/${c.repo}#${c.number ?? "?"} at ${c.commit.slice(0, 8)}: merge check ${c.verdict}`);
 }
@@ -477,6 +486,8 @@ if (!gitea) pace.unheard("the forge is not watched: no way to a token", false);
 registerModuleTools("gitea", () => [eventsTool(pace), ...(gitea ? [commitStatusTool({
  setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
  gates,
+}), checkStatusTool({
+  setCommitStatus: (owner, repo, sha, status) => (gitea as GiteaClient).setCommitStatus(owner, repo, sha, status),
 }), mergeTool(gitea, { gates })] : [])]);

 // **A build machine took an ask** (the build seat's `started`, novox/hq ADR 0157): said on the head it checks, when
@@ -4,13 +4,18 @@
 // when a verdict is judged against an earlier trunk commit than the trunk's head, the tool asks the head's check and
 // puts its statuses back to pending through that writer, so where the check runs is said and no second check is asked.
 // Each bundle the runtime serves is its own process; from the tools' bundle the pending bypassed the writer's chain.
+//
+// **It judges on the status the base requires** (issue 1301; ADR 0447 §1, §4; ADR 0503 §5): mesh/check, the checker's,
+// whose line names the trunk it judged ("pass <head12> on <trunk12>"); where a base does not require it, the controller's
+// status it still requires (hq's mesh/repo-check), as before. A mesh/check of another trunk is refused and nothing is
+// asked: the checker sets it out of date on the trunk's move and checks it again.

 import { announce } from "./announce.js";
 import type { ToolDefinition } from "@novox/mesh-sdk/tools";
 import type { CommitStatus, GiteaClient } from "./client.js";
 import { mergeableUnder, newestByContext } from "./checks.js";
 import { MERGE_METHODS, Refused, checkName } from "./guard.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT, maintained, requiredOf } from "./pulls.js";
 import { approvedHeadsOf, groupRefusal, memberKey, namesSiblings, notApproved, readSiblings, siblingOutOfDate, siblingsFile } from "./siblings.js";
 import { announcementOf, askedWords, outOfDateWords, sameCommit, tookFile, tookWords, twelve, verdictAtTrunk, waitsForComposed } from "./trunk.js";

@@ -32,7 +37,7 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
  return {
    name: "gitea_merge_pull_request",
    description: "Merge a pull request at the head you name — the commit you reviewed — when that is still its head " +
-      "and every status its base branch's protection requires succeeded there (mesh/merge-gate, mesh/repo-check), " +
+      "and every status its base branch's protection requires succeeded there (mesh/check; hq's mesh/repo-check), " +
      "judged against the trunk's head as it is now, optionally deleting the source branch afterwards. Refused " +
      "otherwise, with nothing merged: no tool merges past a check, and none merges a head that moved after it was " +
      "reviewed. A verdict judged against an earlier trunk commit is refused, naming both, and the head's check against " +
@@ -108,11 +113,33 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
      // head makes — never again while one is on its way. The caller asks again at the reviewed head once it passes.
      const trunkHead = await gitea.branchHead(owner, repo, pull.base);
      const checks = await gitea.headChecks(owner, repo, pull.head_sha);
-      const at = verdictAtTrunk(checks, trunkHead);
+      const required = requiredOf(rule) ?? [];
+      if (required.includes(CHECK_STATUS)) {
+        // **mesh/check is the checker's** (ADR 0447 §4): it is judged here against the trunk's head, and refused when it
+        // is not current; nothing is written or asked — the checker checks a head again when its trunk moves.
+        const check = checks[CHECK_STATUS];
+        const at = verdictAtTrunk(checks, trunkHead, CHECK_STATUS);
+        if (!check || check.state === "pending") {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} is ` +
+            `${check ? `pending (${check.description ?? ""})` : "not set yet"}; the checker answers it. Ask again at ` +
+            `${twelve(pull.head_sha)} once it passes against ${pull.base}'s head ${twelve(trunkHead)}. Nothing was merged`);
+        }
+        if (!at.current) {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its ${CHECK_STATUS} ` +
+            `${at.judged ? `was judged on trunk ${twelve(at.judged)}` : "names no trunk commit it was judged on"}, and ` +
+            `${pull.base} is now ${twelve(trunkHead)}. The checker checks it again against the trunk's head (novox/hq ` +
+            `ADR 0447); this tool asks nothing. Ask again at ${twelve(pull.head_sha)} once it passes. Nothing was merged`);
+        }
+      }
+      // Where the base still requires the controller's statuses (hq's mesh/repo-check; mesh/merge-gate only on a
+      // revert), the first it requires judges, as before (ADR 0323 §5).
+      const kept = maintained(required);
+      const judge = kept[0] ?? CHECK_CONTEXT;
+      const at = kept.length ? verdictAtTrunk(checks, trunkHead, judge) : { current: true, onItsWay: false };
      if (!at.current) {
        // A verdict put out of date by a sibling's move says so in its own words (ADR 0382 §5); it is asked again as a
        // trunk's move is, and a failed ask puts those words back, not the trunk's.
-        const siblingWords = siblingOutOfDate(checks[CHECK_CONTEXT]?.description) ? checks[CHECK_CONTEXT]?.description : undefined;
+        const siblingWords = siblingOutOfDate(checks[judge]?.description) ? checks[judge]?.description : undefined;
        const judged = siblingWords ? `was put out of date by a sibling's move (${siblingWords})`
          : at.judged ? `was judged against trunk ${twelve(at.judged)}` : "names no trunk commit it was judged against";
        const took = tookWords(tookFile(deps.stateDir), `${owner}/${repo}`);
@@ -120,21 +147,22 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
        // **A member that waits for its group's composed check is not announced again** (novox/hq issue 1106): its own
        // check can only say "composed" once more, so an ask here brought a verdict naming no trunk and the next merge was
        // refused the same way for ever. The composed check is mesh-delivery's to ask; this says whose verdict is awaited.
-        if (waitsForComposed(checks[CHECK_CONTEXT])) {
-          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[CHECK_CONTEXT]?.description}; the ` +
+        if (waitsForComposed(checks[judge])) {
+          throw new Refused(`${owner}/${repo}#${number} is not merged: its merge gate ${checks[judge]?.description}; the ` +
            `verdict that names its trunk commit is its group's composed check's, and mesh-delivery asks it, this tool asks no check ` +
            `(main is now ${now}). Ask again once the group's composed check has passed. Nothing was merged`);
        }
        if (at.onItsWay) {
          throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict ${judged}, and ${pull.base} is now ` +
-            `${now}. Its check is already asked and not yet answered (${checks[CHECK_CONTEXT]?.description}), so it is not ` +
+            `${now}. Its check is already asked and not yet answered (${checks[judge]?.description}), so it is not ` +
            `asked again; ${took}. Ask again at ${head} once both statuses pass: this tool never merges by itself ` +
              `(novox/hq ADR 0323). A check that never answers is asked again with mesh-delivery.recheck. Nothing was merged`);
        }
        // Pending first, so a second ask finds the check on its way; then the head is announced as a new head is. An
        // announcement that cannot be made puts the statuses back to out of date, so the next ask asks again rather
        // than wait for ever on a check nobody asked.
-        const contexts = [CHECK_CONTEXT, ...(checks[REPO_CHECK_CONTEXT] ? [REPO_CHECK_CONTEXT] : [])];
+        // The statuses the base requires of the controller's (issue 1301): hq's mesh/repo-check alone.
+        const contexts = kept.filter((c) => c === judge || (c === REPO_CHECK_CONTEXT && checks[REPO_CHECK_CONTEXT]));
        // Through the module's one writer of the merge check (gate.ts, novox/hq issue 456): the pending opens a new
        // check of the head, so where it runs is said ("building on …") and its verdict is not weighed as older.
        const say = async (description: string) => {
@@ -167,9 +195,12 @@ export function mergeTool(gitea: GiteaClient, given: MergeDeps): ToolDefinition
      // **A member judged beside its siblings merges only with its group passed and reviewed** (novox/hq ADR 0382 §6): the
      // siblings its verdict names are the holder's record (siblings.ts); a status that says it read siblings with no record
      // of them is no verdict to merge on, never read as none.
-      const heard = readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
+      // Under mesh/check (issue 1301) the group is the checker's one verdict on every member's head (ADR 0447 §2) and the
+      // Approve's heads above; a record the controller's verdicts left before the switch judges nothing there.
+      const heard = required.includes(CHECK_STATUS) ? undefined : readSiblings(siblingsFile(deps.stateDir))[memberKey(owner, repo, number)];
      const siblings = heard && sameCommit(heard.head, pull.head_sha) ? heard.siblings : [];
-      if (!siblings.length && namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
+      if (!siblings.length && !required.includes(CHECK_STATUS) &&
+        namesSiblings(statuses.find((s) => s.context === CHECK_CONTEXT)?.description)) {
        throw new Refused(`${owner}/${repo}#${number} is not merged: its verdict read siblings, and which ones is not held ` +
          `here, so the group cannot be weighed. Ask its check again at ${twelve(pull.head_sha)}. Nothing was merged`);
      }
@@ -172,7 +172,7 @@
    },
    "repositories": {
      "type": "object",
-      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/repo-check and mesh/merge-gate, and only then moved into the organisation; one that exists only has main's rule put right, its statuses kept. A repository taken out of the value is never touched.",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/check, and only then moved into the organisation; one that exists only has main's rule put right, mesh/check in place of mesh/merge-gate and mesh/repo-check and its other statuses kept (a main requiring mesh/repo-check alone keeps it). Every other repository whose main requires mesh/merge-gate has the two swapped for mesh/check; nothing else of a repository out of the value is touched.",
      "trusted": true,
      "default": {}
    }
@@ -1,6 +1,6 @@
-// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's merge check —
-// `mesh/merge-gate`, the module graph's gate, and `mesh/repo-check`, the repository's own tests — before it
-// may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).
+// A branch's protection (novox/hq ADR 0237): what makes a pull request wait for the mesh's check — `mesh/check`,
+// the checker's verdict on the head merged onto its trunk (ADR 0447 §1; hq's `mesh/repo-check` until issue 1296) —
+// before it may merge. Pure, so it is tested without a forge; the client does the asking (client.ts).

 import { TOOLS_ACCOUNT } from "./tools-account.js";

@@ -24,7 +24,7 @@ export interface BranchProtection {
 /** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
 *  default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
 export interface ProtectionWanted {
-  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/merge-gate. Empty: none. */
+  /** The statuses a pull request must have succeeded before it merges, e.g. mesh/check. Empty: none. */
  statusChecks: string[];
  /** Whether a person may push to the branch directly. */
  push?: boolean;
@@ -19,6 +19,34 @@ export const CHECK_CONTEXT = "mesh/merge-gate";
 /** The status context of the repository's own merge-check.sh, the check's second layer (novox/hq ADR 0237). */
 export const REPO_CHECK_CONTEXT = "mesh/repo-check";

+/** The one status main requires (novox/hq ADR 0447 §1, issue 1301): the checker's verdict, written by its forge bridge
+ *  through gitea_check_status. Its line names the head and the trunk commit it judged: "pass <head12> on <trunk12> …". */
+export const CHECK_STATUS = "mesh/check";
+
+/** The statuses a branch's rule requires, from the rule the forge applies to it: none when it is unprotected or checks
+ *  no status; undefined when the rule could not be read. */
+export function requiredOf(rule: { enable_status_check?: boolean; status_check_contexts?: string[] } | null | undefined): string[] | undefined {
+  if (rule === undefined) return undefined;
+  if (!rule || !rule.enable_status_check) return [];
+  return (rule.status_check_contexts ?? []).filter(Boolean);
+}
+
+/**
+ * **The controller's statuses are written only where a base still requires them** (issue 1301; ADR 0503 §3, §5): of
+ * mesh/merge-gate and mesh/repo-check, those the base requires — hq's mesh/repo-check alone once the forge requires
+ * mesh/check everywhere else, so no mesh/merge-gate stands on a head that nothing will set. A base whose rule could not
+ * be read keeps both, as before: a status nothing requires blocks nothing, and one that is required is never left out.
+ */
+export function maintained(required: string[] | undefined): string[] {
+  const both = [CHECK_CONTEXT, REPO_CHECK_CONTEXT];
+  return required === undefined ? both : both.filter((c) => required.includes(c));
+}
+
+/** Whether mesh/merge-gate is written on a head of this base (maintained). */
+export function writesGate(required: string[] | undefined): boolean {
+  return maintained(required).includes(CHECK_CONTEXT);
+}
+
 /**
 * The pending words a head's merge check is announced with (novox/hq issue 446): where the check is, and since when,
 * in the time the operator reads. They stood as "the mesh is mapping this head onto its module graph" for the whole
@@ -257,8 +285,14 @@ export function composedGate(c: Checked): boolean {
  return c.gate?.verdict === "composed";
 }

-/** Every status a verdict sets: the gate's, and the repository's own check's when it was said. */
-export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
+/** Every status a verdict sets: the gate's, and the repository's own check's when it was said; of them, only those the
+ *  base requires (`required`, the base's rule: maintained). */
+export function statusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string, required?: string[]): CommitStatus[] {
+  const kept = maintained(required);
+  return allStatusesFor(c, facts, gateNow).filter((s) => kept.includes(s.context));
+}
+
+function allStatusesFor(c: Checked, facts: RepoCheckFacts = {}, gateNow?: string): CommitStatus[] {
  if (composedGate(c)) {
    // A member whose gate the group's composed check judges (ADR 0403 §1): only its repository's check is its own to
    // set. The gate stays pending, saying it waits for the group, unless a composed verdict already stands on it.
@@ -292,11 +326,13 @@ function judgedFirst(c: Checked, status: CommitStatus): CommitStatus {
 *  change that builds something (novox/hq ADR 0238), and why, when the gate is not a pass or the
 *  repository's own check failed or could not run. A repository with no merge-check.sh, touching nothing,
 *  is said by its statuses alone, not by a comment on every push. */
-export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | null {
+export function commentFor(c: Checked, facts: RepoCheckFacts = {}, required?: string[]): string | null {
  const gate = c.gate ?? { verdict: c.verdict, summary: c.summary };
+  // A base that no longer requires the gate (issue 1301) is told nothing of it: its verdict is the repository's own check.
+  const withGate = writesGate(required);
  const repo = c["repo-check"];
  const wrong = repoWrong(repo, facts);
-  if (gate.verdict === "pass" && !wrong && !builds(c.plan)) return null;
+  if ((!withGate || gate.verdict === "pass") && !wrong && !builds(c.plan)) return null;
  const lines = [`**Merge check** at \`${c.commit.slice(0, 8)}\``, ""];
  if (c.trunk) {
    // What was judged (novox/hq ADR 0323 §3): the head merged into the trunk commit, and what was read beside it.
@@ -312,9 +348,11 @@ export function commentFor(c: Checked, facts: RepoCheckFacts = {}): string | nul
  } else if (c.siblings_unknown) {
    lines.splice(c.trunk ? 2 : 1, 0, `Siblings could not be learned: ${c.siblings_unknown}`);
  }
-  lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
-    (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
-      (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
+  if (withGate) {
+    lines.push(`- \`${CHECK_CONTEXT}\`: **${saidAs(gate.verdict).toUpperCase()}** — ${gate.summary}` +
+      (gate.modules?.length ? ` (modules: ${gate.modules.join(", ")}` +
+        (gate.dependents?.length ? `; built after them: ${gate.dependents.join(", ")}` : "") + ")" : ""));
+  }
  if (repo) {
    const st = repoStatus(repo, facts);
    lines.push(`- \`${REPO_CHECK_CONTEXT}\`: ` + (repo.verdict === "warning" && facts.defined === false
@@ -61,3 +61,38 @@ test("one view per pull request, found by its marker; only the mesh's statuses",
  assert.equal(deliveryStatus("mesh/repo-check", "pending", "checking again: main moved on").context, "mesh/repo-check");
  assert.equal(deliveryStatus("mesh/delivery", "success", "x", "javascript:alert(1)").target_url, undefined);
 });
+
+// Issue 1301-S4 (ADR 0447 §1; the lead's choice A): main requires mesh/check, so no hand may set it. The status tool
+// every caller may use refuses it in every state; it is written only by gitea_check_status, which the forge bridge
+// alone lists in its manifest's `invokes`, so only its account may call it.
+test("mesh/check is refused by the status tool and written by the check's own tool alone", async () => {
+  const { commitStatusTool, checkStatusTool, deliveryStatus, CHECK_STATUS } = await import("../delivery.ts");
+  assert.equal(CHECK_STATUS, "mesh/check");
+  const sha = "0123456789abcdef0123456789abcdef01234567";
+  const sent: string[] = [];
+  const setCommitStatus = async (o: string, r: string, s: string, st: any) =>
+    void sent.push(`${o}/${r}@${s.slice(0, 8)} ${st.context} ${st.state} ${st.description}${st.target_url ? " " + st.target_url : ""}`);
+  const gates = { rechecked: async () => { throw new Error("not the gate writer's"); } };
+  for (const state of ["pending", "success", "failure", "error", "warning"]) {
+    assert.throws(() => deliveryStatus("mesh/check", state, "x"), /mesh\/check is the checker's status/);
+    await assert.rejects(commitStatusTool({ setCommitStatus, gates } as any).run({ owner: "novox", repo: "mesh-sdk", sha,
+      context: "mesh/check", state, description: "by hand" }), /gitea_check_status/);
+  }
+  assert.deepEqual(sent, [], "nothing was sent for a hand-set mesh/check");
+
+  const tool = checkStatusTool({ setCommitStatus });
+  assert.equal(tool.name, "gitea_check_status");
+  for (const k of ["owner", "repo", "sha", "state", "description", "target_url", "context"]) assert.ok(k in tool.input, k);
+  // The bridge's arguments as it sends them for gitea_commit_status: the context may be given, and is mesh/check.
+  await tool.run({ owner: "novox", repo: "mesh-sdk", sha, context: "mesh/check", state: "success", description: "pass",
+    target_url: "https://forge.invalid/novox/mesh-sdk/pulls/1" });
+  await tool.run({ owner: "novox", repo: "mesh-sdk", sha, state: "pending", description: "y".repeat(300) });
+  assert.equal(sent[0], "novox/mesh-sdk@01234567 mesh/check success pass https://forge.invalid/novox/mesh-sdk/pulls/1");
+  assert.ok(sent[1].startsWith("novox/mesh-sdk@01234567 mesh/check pending yyyy"), sent[1]);
+  assert.ok(sent[1].length < 200, "the description is cut as every status's is");
+  await assert.rejects(tool.run({ owner: "novox", repo: "mesh-sdk", sha, context: "mesh/delivery", state: "success" }), /mesh\/check alone/);
+  await assert.rejects(tool.run({ owner: "novox", repo: "mesh-sdk", sha: sha.slice(0, 12), state: "success" }), /whole sha/);
+  await assert.rejects(tool.run({ owner: "novox", repo: "mesh-sdk", sha, state: "green" }), /not a status/);
+  await assert.rejects(tool.run({ owner: "../x", repo: "mesh-sdk", sha, state: "success" }));
+  assert.equal(sent.length, 2, "nothing more was sent");
+});
@@ -322,3 +322,13 @@ test("a repository as the mesh clones it is told from another", async () => {
  assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-hq.git", "novox", "hq"), false);
  assert.equal(clonedAs("http://127.0.0.1:20000/novox/mesh-controller.git", "novox", "hq"), false);
 });
+
+// Issue 1301: a build machine's start on a head that holds no mesh/merge-gate (its base requires none, so none was written)
+// says nothing: no "building on" status appears on a main that does not require the gate.
+test("a start on a head with no gate on the forge writes nothing", async () => {
+  const { GateWriter } = await import("../gate.ts");
+  const forge = aForge();
+  const gates = new GateWriter(forge, announcedAt);
+  assert.equal(await gates.started("novox", "hq", SHA, startedOnShanks), false);
+  assert.equal(forge.kept["mesh/merge-gate"], undefined);
+});
@@ -15,7 +15,7 @@ import { GiteaClient } from "../dist/client.js";
 import { ConfiguredToken } from "../dist/token.js";
 import { getGiteaTools } from "../dist/tools/index.js";
 import { mergeTool } from "../dist/merge.js";
-import { commitStatusTool } from "../dist/delivery.js";
+import { checkStatusTool, commitStatusTool } from "../dist/delivery.js";
 import { GateWriter } from "../dist/gate.js";
 import { judgeApiCall, judgeProtectionChange, ruleCovers, routedPath } from "../dist/guard.js";

@@ -168,7 +168,7 @@ const gates = { rechecked: (o: string, r: string, sha: string, s: any) => {
 } };
 const tools = [...getGiteaTools(client), commitStatusTool({
  setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s), gates: writer,
-}), mergeTool(client, { gates, stateDir, emit: async (type, body) => { state.emitted.push({ type, body }); },
+}), checkStatusTool({ setCommitStatus: (o, r, sha, s) => client.setCommitStatus(o, r, sha, s) }), mergeTool(client, { gates, stateDir, emit: async (type, body) => { state.emitted.push({ type, body }); },
  now: () => new Date(2026, 9, 12, 15, 1) })];
 const tool = (name: string) => tools.find((t) => t.name === name)!;
 const writes = () => state.sent.map((s) => `${s.method} ${s.path}`);
@@ -568,6 +568,10 @@ test("no tool's caller text becomes another path or another user: `..` and `?sud
    ["gitea_get_file", { ...repo, path: "README.md?sudo=jschoubben" }],
    ["gitea_commit_status", { ...repo, sha: "abc1234?sudo=jschoubben", context: "mesh/delivery", state: "success" }],
    ["gitea_commit_status", { ...repo, sha: "../../../admin/users", context: "mesh/delivery", state: "success" }],
+    ["gitea_check_status", { ...repo, sha: "abc1234?sudo=jschoubben", state: "success" }],
+    ["gitea_check_status", { ...repo, sha: "../../../admin/users", state: "success" }],
+    ["gitea_check_status", { owner: "novox", repo: "..", sha: "0123456789abcdef0123456789abcdef01234567", state: "success" }],
+    ["gitea_commit_status", { ...repo, sha: "0123456789abcdef0123456789abcdef01234567", context: "mesh/check", state: "success" }],
    ["gitea_commit_statuses", { ...repo, sha: ".." }],
    ["gitea_commit_statuses", { ...repo, sha: "main?sudo=jschoubben" }],
    ["gitea_branch_protection_set", { ...repo, branch: "..", status_checks: "mesh/merge-gate" }],
@@ -704,3 +708,53 @@ test("a group of two merges in one pass: the sibling's merge of the composed hea
  assert.equal(done.merged, true);
  assert.equal(state.emitted.length, 0, "no check was asked");
 });
+
+// **Issue 1301 (ADR 0447 §1, §4; ADR 0503 §3, §5): the merge tool judges on the status the base requires.** A main that
+// requires mesh/check is judged by the checker's line ("pass <head12> on <trunk12> …"): it merges on a pass that names the
+// trunk's head, and refuses one that names an older trunk, naming both, writing nothing and asking nothing — a re-check on
+// a trunk's move is the checker's. No mesh/merge-gate is read or written there.
+test("gitea_merge_pull_request judges a main requiring mesh/check on mesh/check alone, and asks nothing of it", async () => {
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/check"] }];
+  const line = (trunk: string, s = "success", words = "pass") =>
+    [{ context: "mesh/check", state: s, description: `${words} ${REVIEWED.slice(0, 12)} on ${trunk.slice(0, 12)} | unit 12 run` }];
+  const before = state.emitted.length;
+
+  state.statuses = line(MOVED);
+  await assert.rejects(merge(), (err: Error) => {
+    assert.match(err.message, /mesh\/check/);
+    assert.match(err.message, new RegExp(`${MOVED.slice(0, 12)}.*${TRUNK.slice(0, 12)}`));
+    assert.match(err.message, /checker checks it again/i);
+    assert.match(err.message, /Nothing was merged/);
+    return true;
+  });
+  state.statuses = line(TRUNK, "pending", "checking");
+  await assert.rejects(merge(), /mesh\/check is pending/);
+  state.statuses = judgedAt(TRUNK); // the old two, current: not what this main requires
+  await assert.rejects(merge(), /mesh\/check/);
+  assert.deepEqual(writes(), [], "nothing is written: mesh/check is the checker's");
+  assert.equal(state.emitted.length, before, "no check is asked");
+  assert.equal(state.merged, false);
+
+  state.statuses = line(TRUNK);
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
+
+// hq's main requires mesh/repo-check alone (ADR 0503 §5): judged on its words, and an out-of-date one is asked again on
+// mesh/repo-check alone; no mesh/merge-gate is written on it.
+test("gitea_merge_pull_request judges a main requiring mesh/repo-check alone on it, and writes no mesh/merge-gate", async () => {
+  const { keepSiblings, siblingsFile } = await import("../dist/siblings.js");
+  keepSiblings(siblingsFile(stateDir), {}); // no sibling record left by the tests before
+  const merge = () => tool("gitea_merge_pull_request").run({ owner: "novox", repo: "mesh-catalog", number: 7, head: REVIEWED });
+  state.rules = [{ ...protectedMain(), status_check_contexts: ["mesh/repo-check"] }];
+  state.statuses = [judgedAt(MOVED)[1]];
+  const before = state.emitted.length;
+  await assert.rejects(merge(), /judged against trunk/);
+  assert.deepEqual(state.sent.filter((s) => s.path.includes("/statuses/")).map((s) => `${s.body.context} ${s.body.state}`),
+    ["mesh/repo-check pending"]);
+  assert.equal(state.emitted.length, before + 1, "its check is asked once");
+  await assert.rejects(merge(), /already asked/);
+  state.sent = [];
+  state.statuses = [judgedAt(TRUNK)[1]];
+  assert.equal(((await merge()) as Record<string, unknown>).merged, true);
+});
@@ -192,3 +192,27 @@ test("a member's own verdict with a composed gate layer leaves the gate to the c
  // A verdict with an ordinary gate is as before.
  assert.equal(composedGate({ ...c, gate: { verdict: "pass", summary: "x" } }), false);
 });
+
+// Issue 1301 (ADR 0503 §3, §5): gitea writes the controller's statuses only where the base still requires them. hq's main
+// requires mesh/repo-check alone: its verdict sets mesh/repo-check and no mesh/merge-gate, and its comment names no gate.
+test("a base's required statuses decide which of the controller's statuses are written", async () => {
+  const { maintained, writesGate, statusesFor, commentFor, CHECK_STATUS } = await import("../pulls.ts");
+  assert.equal(CHECK_STATUS, "mesh/check");
+  assert.deepEqual(maintained(undefined), ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
+  assert.deepEqual(maintained(["mesh/repo-check"]), ["mesh/repo-check"]);
+  assert.deepEqual(maintained(["mesh/check", "other/x"]), []);
+  assert.deepEqual(maintained([]), []);
+  assert.equal(writesGate(undefined), true);
+  assert.equal(writesGate(["mesh/repo-check"]), false);
+  assert.equal(writesGate(["mesh/check"]), false);
+  assert.equal(writesGate(["mesh/merge-gate", "mesh/repo-check"]), true);
+  const c = { owner: "novox", repo: "hq", number: 5, commit: "a".repeat(40), id: "x", verdict: "warning", summary: "no script",
+    trunk: "b".repeat(12), "repo-check": { verdict: "pass", summary: "ok" } } as any;
+  const hq = statusesFor(c, {}, undefined, ["mesh/repo-check"]);
+  assert.deepEqual(hq.map((s: any) => s.context), ["mesh/repo-check"]);
+  assert.match(hq[0].description, /merged into trunk bbbbbbbbbbbb/);
+  assert.deepEqual(statusesFor(c).map((s: any) => s.context), ["mesh/merge-gate", "mesh/repo-check"], "unread: as before");
+  assert.deepEqual(statusesFor(c, {}, undefined, ["mesh/check"]), []);
+  const comment = commentFor(c, {}, ["mesh/repo-check"]);
+  assert.ok(comment === null || !comment.includes("mesh/merge-gate"), comment ?? "");
+});
@@ -199,3 +199,21 @@ test("a release branch's move puts every open pull request into it out of date,
  assert.equal(verdictAtTrunk({ "mesh/merge-gate": { state: "success",
    description: "head x merged into trunk eeeeeeeeeeee — pass" } }, MOVED).current, false);
 });
+
+// Issue 1301: a trunk's move puts out of date only the controller's statuses the base still requires; on hq that is
+// mesh/repo-check alone, judged by its own words; on a main requiring mesh/check, none (the checker's, ADR 0447 §4).
+test("a trunk's move writes only the statuses the base still requires", async () => {
+  const { outOfDateStatuses, trunkNamed } = await import("../trunk.ts");
+  const old = "1".repeat(40), now = "2".repeat(40);
+  const repo = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: y` };
+  const gate = { state: "success", description: `head ${"a".repeat(12)} merged into trunk ${old.slice(0, 12)} — pass: x` };
+  assert.deepEqual(outOfDateStatuses({ "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context), ["mesh/repo-check"]);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/repo-check"]).map((s: any) => s.context),
+    ["mesh/repo-check"]);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now, ["mesh/check"]), []);
+  assert.deepEqual(outOfDateStatuses({ "mesh/merge-gate": gate, "mesh/repo-check": repo }, now).map((s: any) => s.context),
+    ["mesh/merge-gate", "mesh/repo-check"], "a rule not read: as before");
+  // The checker's line names its trunk as "<head12> on <trunk12>".
+  assert.equal(trunkNamed(`pass ${"a".repeat(12)} on ${old.slice(0, 12)} | unit 3 run`), old.slice(0, 12));
+  assert.equal(trunkNamed("building on shanks since 10:00"), undefined);
+});
@@ -350,3 +350,14 @@ test("a pull request's edit event carries its description, and no other pull req
    assert.equal(eventOf("pull_request", { action, pull_request: pull, repository }).body.body, undefined, action);
  }
 });
+
+// Issue 1302: a status event carries the status's words, so the delivery gate reads mesh/check's line (the head and the trunk
+// it judged) from the event itself.
+test("a status event carries its context, state and words", async () => {
+  const { eventOf } = await import("../webhook.ts");
+  const e = eventOf("status", { sha: "a".repeat(40), context: "mesh/check", state: "success",
+    description: "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept", repository: { name: "x", owner: { login: "novox" } } });
+  assert.equal(e.name, "forge.status");
+  assert.equal((e.body as any).context, "mesh/check");
+  assert.equal((e.body as any).description, "pass aaaaaaaaaaaa on bbbbbbbbbbbb | unit 3 run, 0 kept");
+});
@@ -395,7 +395,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    // ---- Branch protection (novox/hq ADR 0237) ----
    {
      name: "gitea_branch_protection_get",
-      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/merge-gate), approvals, and whether an administrator may merge past them.",
+      description: "A repository's branch protection: the rule for one branch (null when it has none) or every rule — whether direct pushes are refused, which commit statuses a pull request must have succeeded to merge (e.g. mesh/check), approvals, and whether an administrator may merge past them.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
@@ -413,12 +413,12 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    },
    {
      name: "gitea_branch_protection_set",
-      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's merge check sets `mesh/merge-gate` (the module graph's gate) and `mesh/repo-check` (the repository's own tests). Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
+      description: "Only ever stronger (novox/hq ADR 0266): a change that drops a required status, lets a person push directly or lets an administrator merge past a status is refused, and on main so is a change that drops the merge whitelist (only mesh-tools merges there) or widens it (novox/hq ADR 0398 §2, issue 948) — that is the operator's, at the forge. Make a branch require commit statuses before a pull request merges into it — the mesh's checker sets `mesh/check` (ADR 0447), and the repositories program requires it on every main. Edits the branch's rule (its required statuses replaced by these, everything else kept unless given) or creates one, which refuses direct pushes unless push=true. Answers the rule before and after.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
        branch: { type: "string", description: "the branch to protect, e.g. main" },
-        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/merge-gate,mesh/repo-check; empty requires none" },
+        status_checks: { type: "string", description: "comma-separated statuses required to merge, e.g. mesh/check; empty requires none" },
        push: { type: "boolean", description: "whether a person may push to the branch directly (a new rule refuses it when not given)" },
        block_admin_override: { type: "boolean", description: "stop an administrator merging past a status that has not succeeded (left as it is when not given)" },
      },
@@ -478,7 +478,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    },
    {
      name: "gitea_commit_statuses",
-      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/merge-gate, mesh/repo-check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
+      description: "Read a commit's statuses — or a pull request's head's — as the forge keeps them: the newest of each context (mesh/check, mesh/delivery, …) with its state, description, link, when it was set and by whom; and whether the branch it merges into would let it merge, every status that branch's protection requires being a success. Reads only.",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
@@ -12,12 +12,17 @@
 //     the moment it is asked, merges nothing when they differ, asks the head's check once — the same announcement a
 //     new head makes — and says how long the last check of that repository took. It never merges by itself after.
 //
+// Since issue 1301 (ADR 0447 §4) a main that requires mesh/check is the checker's: its line names the trunk commit it judged
+// ("pass <head12> on <trunk12>"), the checker sets it out of date when the trunk moves, and the merge tool refuses a verdict
+// of another trunk and asks nothing. The two statuses above are kept only where a base still requires them (hq's
+// mesh/repo-check, pulls.ts maintained).
+//
 // Pure functions and two small files of the module's own state, so this is tested without a forge.

 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import type { CommitStatus, GiteaClient, GiteaPull, HeadCheck } from "./client.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT, WAITS_FOR_COMPOSED } from "./pulls.js";
+import { CHECK_CONTEXT, WAITS_FOR_COMPOSED, maintained, requiredOf } from "./pulls.js";

 /** A commit as a verdict names it: its first twelve characters. */
 export function twelve(sha: string | undefined): string {
@@ -40,7 +45,9 @@ export function judgedWords(head: string, trunk: string): string {
 *  verdict put out of date, the one it had judged ("judged against trunk …"). Undefined when it names none, as a
 *  verdict of a build seat from before ADR 0323 does. */
 export function trunkNamed(description: string | undefined): string | undefined {
-  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "");
+  const m = /(?:merged into|judged against) trunk ([0-9a-f]{7,64})\b/i.exec(description ?? "")
+    // The checker's mesh/check line (ADR 0447 §3): "<head12> on <trunk12>".
+    ?? /\b[0-9a-f]{12} on ([0-9a-f]{12})\b/i.exec(description ?? "");
  return m ? m[1].toLowerCase() : undefined;
 }

@@ -70,15 +77,15 @@ export function waitsForComposed(gate: HeadCheck | undefined): boolean {
 * gate, and the repository's own check when the head has one — a pending repo-check a verdict will not set would
 * stand for ever (novox/hq issue 305's rule).
 */
-export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string): CommitStatus[] {
-  const gate = checks[CHECK_CONTEXT];
-  if (!gate || gate.state === "pending") return [];
-  const judged = trunkNamed(gate.description);
+export function outOfDateStatuses(checks: Record<string, HeadCheck>, trunkHead: string, required?: string[]): CommitStatus[] {
+  // Only the statuses the base still requires (issue 1301): the first of them the head holds judges.
+  const kept = maintained(required).filter((c) => checks[c]);
+  const judge = kept.length ? checks[kept[0]] : undefined;
+  if (!judge || judge.state === "pending") return [];
+  const judged = trunkNamed(judge.description);
  if (judged && sameCommit(judged, trunkHead)) return [];
  const description = outOfDateWords(judged, trunkHead);
-  const out: CommitStatus[] = [{ state: "pending", context: CHECK_CONTEXT, description }];
-  if (checks[REPO_CHECK_CONTEXT]) out.push({ state: "pending", context: REPO_CHECK_CONTEXT, description });
-  return out;
+  return kept.map((context) => ({ state: "pending" as const, context, description }));
 }

 /** Where the merge tool stands with a head's verdict and the trunk's head (ADR 0323 §5). */
@@ -91,8 +98,8 @@ export interface VerdictAtTrunk {
  judged?: string;
 }

-export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string): VerdictAtTrunk {
-  const gate = checks[CHECK_CONTEXT];
+export function verdictAtTrunk(checks: Record<string, HeadCheck>, trunkHead: string, context = CHECK_CONTEXT): VerdictAtTrunk {
+  const gate = checks[context];
  const judged = trunkNamed(gate?.description);
  if (checkOnItsWay(gate)) return { current: false, onItsWay: true, judged };
  return { current: !!gate && gate.state !== "pending" && !!judged && sameCommit(judged, trunkHead), onItsWay: false, judged };
@@ -119,6 +126,9 @@ export function lateVerdictComment(c: { commit: string; trunk?: string; verdict:
 export interface TrunkForge {
  listOpenPulls(owner: string, repo: string): Promise<GiteaPull[]>;
  branchHead(owner: string, repo: string, branch: string): Promise<string>;
+  /** The rule the forge applies to a branch: which of the controller's statuses are kept there (issue 1301). Not given,
+   *  or not read: both, as before. */
+  appliedProtection?(owner: string, repo: string, branch: string): Promise<{ enable_status_check?: boolean; status_check_contexts?: string[] } | null>;
 }

 /** What it writes with: the merge check's one writer (gate.ts), which decides in the head's own turn. */
@@ -147,11 +157,13 @@ export async function weighTrunks(forge: TrunkForge, gates: OutOfDateWriter, tru
      if (before && sameCommit(before, head)) continue;
      if (before) {
        let put = 0;
+        const required = forge.appliedProtection
+          ? requiredOf(await forge.appliedProtection(owner, name, base).catch(() => undefined)) : undefined;
        for (const pull of open.filter((p) => p.base === base)) {
          // The trunk is read again in the head's own turn: a verdict judged against a head newer than the pass's first
          // read — the trunk moved again meanwhile, and a check answered — is not put out of date.
          const written = await gates.outOfDate(owner, name, String(pull.head_sha),
-            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base)), pull.html_url || undefined);
+            async (checks) => outOfDateStatuses(checks, await forge.branchHead(owner, name, base), required), pull.html_url || undefined);
          if (written.length) put++;
        }
        console.log(`[gitea] ${owner}/${name}'s ${base} moved from ${twelve(before)} to ${twelve(head)}: ${put} open pull ` +
@@ -127,7 +127,9 @@ function forgeEventOf(said: string, payload: any): ForgeEvent {
    return { name: kind, body: { ...base, ref: str(payload.ref), ref_type: str(payload.ref_type), sha: str(payload.sha) } };
  }
  if (kind === "status") {
-    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state) } };
+    // Its words too (issue 1302): mesh/check's line names the head and the trunk it judged, which the delivery gate reads.
+    return { name: "status", body: { ...base, sha: str(payload.sha), context: str(payload.context), state: str(payload.state),
+      description: str(payload.description) } };
  }
  const name = family === "other" ? `other.${kind.replace(/[^a-z0-9_-]/gi, "_") || "unknown"}` :
    ["fork"].includes(family) ? family : `${family}.${action ?? "changed"}`;
@@ -1,7 +1,6 @@
 package main

 import (
-	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -10,14 +9,15 @@ import (
 // One build per change (novox/hq ADR 0350): a pull request closed unmerged has its check builds let go of, and a
 // walk's record says per module whether its build reused a check's build or built, and why.

-// A pull request closed unmerged asks the controller to let go of what its checks built for its merge (§5); one
-// the controller cannot answer is said, never fatal.
-func TestAPullRequestClosedUnmergedLetsGoOfItsCheckBuilds(t *testing.T) {
+// A pull request closed unmerged is stopped. Since issue 1318 (ADR 0503 §3) the controller is no longer asked to let go
+// of what its checks built (§5's forget-checks goes with the merge gate's checks); a controller that is down changes
+// nothing.
+func TestAPullRequestClosedUnmergedIsStoppedAndAsksTheControllerNothing(t *testing.T) {
 	w := newWorldOver(t, newMemStore(), newFakeController(), newFakeForge(), atCC)
 	cc := pr(cat, 101, headCC, "feat/claude-code", "modules/claude-code/module.json")
 	w.h.PullUpdated(cc)
 	w.h.PullClosed(cc)
-	if want := []string{"novox/mesh-catalog#101"}; !reflect.DeepEqual(w.ctl.forgot, want) {
+	if len(w.ctl.forgot) != 0 {
 		t.Fatalf("closed unmerged, the controller was asked to let go of %v", w.ctl.forgot)
 	}
 	if s := w.state(IDOf(cat, headCC)); s != Stopped {
@@ -18,6 +18,7 @@ import (

 // Context names of the statuses this owner can say more of than the forge keeps.
 const (
+	// ctxGate is the controller's merge gate, kept where a base still requires it; mesh/check is ctxCheck (onestatus.go).
 	ctxGate     = "mesh/merge-gate"
 	ctxRepo     = "mesh/repo-check"
 	ctxDelivery = "mesh/delivery"
@@ -230,6 +231,10 @@ func (h *Holder) addWhatIsKnown(s *CheckStatus, v *Verdict, d *checksDelivery) {
 		} else if v.Repo != "" {
 			s.Verdict = strings.ToUpper(v.Repo) + " — " + v.RepoSaid
 		}
+	case ctxCheck:
+		if v != nil && v.Status == ctxCheck {
+			s.Verdict = strings.ToUpper(firstOf(v.Gate, "error")) + " — " + v.Summary
+		}
 	case ctxDelivery:
 		if d != nil {
 			s.Verdict = string(d.State)
@@ -103,6 +103,13 @@ func (h *Holder) askProposedAgain(id, why string) {
 		h.mu.Unlock()
 		return
 	}
+	if d.judgedByCheck() {
+		// The checker's (issue 1302): its check is not asked here, and whether a held config value is weighed is the
+		// checker's composition's.
+		h.Logf("[mesh-delivery] %s: a held config value changed; %v", id, checkerRefusal(id))
+		h.mu.Unlock()
+		return
+	}
 	owner, repo, commit, page, number := d.Owner(), d.Repo(), d.Commit, d.HTMLURL, d.Number
 	h.mu.Unlock()
 	if err := h.checkingAgain(owner, repo, number, commit, page, why); err != nil {
@@ -19,6 +19,9 @@ type ForgeStatusEvent struct {
 	SHA     string `json:"sha"`
 	Context string `json:"context"`
 	State   string `json:"state"`
+	// Description is the status's words (the gitea module's status event carries them since issue 1302): mesh/check's
+	// line names the head and the trunk it judged.
+	Description string `json:"description,omitempty"`
 }

 // wantForge says the forge's open pull requests are to be read at the next look: a check may have answered.
@@ -44,7 +47,8 @@ func (h *Holder) AnswersChanged() {
 	}
 }

-// CommitStatus takes a commit status set on the forge: one of the merge checks (mesh/merge-gate, mesh/repo-check) says a
+// CommitStatus takes a commit status set on the forge: one of the merge checks (mesh/check; hq's mesh/repo-check and, on a
+// base that still requires it, mesh/merge-gate) says a
 // check started, answered, or was put back, so the forge's open pull requests are read to see which heads still wait on
 // one (SeeOpenPulls). A status of any other context shows nothing the merge needs.
 //
@@ -60,6 +64,10 @@ func (h *Holder) CommitStatus(e ForgeStatusEvent) {
 	h.wantForge()
 	h.mu.Lock()
 	defer h.mu.Unlock()
+	if e.Context == ctxCheck && (e.Description != "" || e.State == "pending") {
+		// mesh/check is the verdict on its base (issue 1302): taken at once, as the controller's `checked` was.
+		h.takeCheckStatus(e.Owner+"/"+e.Repo, e.SHA, e.State, e.Description)
+	}
 	if e.State != "success" {
 		h.withdrawForStatus(e)
 		return
@@ -78,6 +78,9 @@ type Holder struct {
 	refusals  []string
 	// unchecked are the open pull requests' heads seen without a merge check (unchecked.go).
 	unchecked map[string]unchecked
+	// checker are the checker's verdicts by the hash of the heads they judged, as its verdicts bucket holds them
+	// (onestatus.go, issue 1302).
+	checker map[string]checkerVerdict
 	// walks are the walks' and batches' last records (answers.go); orphans the waiting walks no live delivery
 	// holds, by when that was first seen; turning the walks whose turn came this look, for some deliveries.
 	walks   map[string]seenWalk
@@ -170,6 +173,7 @@ func (h *Holder) init() {
 	h.lostRead = map[string]time.Time{}
 	h.walkAsked = map[string]time.Time{}
 	h.unchecked = map[string]unchecked{}
+	h.checker = map[string]checkerVerdict{}
 	h.walks = map[string]seenWalk{}
 	h.orphans = map[string]time.Time{}
 	h.asking = map[string]bool{}
@@ -860,9 +864,8 @@ func verdictOfState(s string) string {

 // PullClosed takes a pull request closed unmerged: its open deliveries are stopped.
 //
-// **And what its checks built for its merge goes** (novox/hq ADR 0350 §5): nothing will take it now. Asked of the
-// controller once the deliveries are settled, outside the lock; a refusal is said, and the build seat's holders let
-// go of it within the week anyway.
+// What its checks built is no longer asked to be let go of here (issue 1318): the controller's forget-checks goes with
+// the merge gate's checks (ADR 0503 §3), and the build seat's holders let go of it within the week.
 func (h *Holder) PullClosed(p PullEvent) {
 	h.mu.Lock()
 	h.forgetUnchecked(p.Owner, p.Repo, p.Number)
@@ -899,15 +902,6 @@ func (h *Holder) PullClosed(p PullEvent) {
 		h.pullUpdated(*over)
 	}
 	h.mu.Unlock()
-	if h.Controller == nil || p.Owner == "" || p.Repo == "" || p.Number <= 0 {
-		return
-	}
-	if err := h.Controller.ForgetChecks(p.Owner, p.Repo, p.Number); err != nil {
-		h.mu.Lock()
-		h.refuse(fmt.Errorf("%s#%d closed, and its check builds stay until the week's sweep: %w", p.repository(),
-			p.Number, err))
-		h.mu.Unlock()
-	}
 }

 // CheckedEvent is the controller's `checked`.
@@ -1959,7 +1953,7 @@ func standingVerdict(p OpenPull, now time.Time) *Verdict {
 	if p.Checks == nil {
 		return nil
 	}
-	contexts := slices.Clone(mergeChecks)
+	contexts := []string{"mesh/merge-gate", "mesh/repo-check"} // the controller's; mesh/check is taken in askChecks
 	for _, c := range p.Required {
 		if !slices.Contains(contexts, c) {
 			contexts = append(contexts, c)
@@ -1995,7 +1989,8 @@ func (h *Holder) askChecks(now time.Time) func() {
 		}
 		w := want{id: d.ID, head: d.Commit, number: d.Number, member: MemberOf(d)}
 		w.owner, w.repo, _ = strings.Cut(d.Repository, "/")
-		if !askedCheck(d) {
+		// A base that requires mesh/check is the checker's: nothing is asked of the controller (issue 1302).
+		if !askedCheck(d) && !d.judgedByCheck() {
 			if tried, was := h.askTried[d.ID]; was && now.Sub(tried) < time.Minute {
 				h.lookAt(tried.Add(time.Minute), "a proposed delivery's check that could not be asked")
 			} else {
@@ -2014,14 +2009,30 @@ func (h *Holder) askChecks(now time.Time) func() {
 		open, err := h.Forge.OpenPulls()
 		for _, w := range wants {
 			var standing *Verdict
+			oneStatus := false
 			if err == nil {
 				for _, p := range open {
 					if p.Number == w.number && strings.EqualFold(p.Owner, w.owner) && strings.EqualFold(p.Repo, w.repo) &&
 						sameCommit(p.HeadSHA, w.head) {
+						if slices.Contains(p.Required, ctxCheck) {
+							// Its base requires mesh/check (issue 1302): its verdict is that status, when it stands, and
+							// nothing is asked of the controller.
+							oneStatus = true
+							h.mu.Lock()
+							h.noteRequired(h.deliveries[w.id], p.Required)
+							if c := p.Checks[ctxCheck]; c.State != "" {
+								h.takeCheckStatus(w.owner+"/"+w.repo, w.head, c.State, c.Description)
+							}
+							h.mu.Unlock()
+							continue
+						}
 						standing = standingVerdict(p, h.Now())
 					}
 				}
 			}
+			if oneStatus {
+				continue
+			}
 			if standing != nil {
 				h.mu.Lock()
 				if d := h.deliveries[w.id]; d != nil && d.State == Proposed && d.Check == nil {
@@ -2169,14 +2180,20 @@ func (h *Holder) planGroup(g *Group, members []*Delivery, now time.Time) []func(
 			allReady = false
 		}
 	}
-	again := g.Check != nil && (!sameMembers(g.Check.Commits, commits) || g.Check.OutOfDate != "" && rejudgedSince(members, g.Check.OutOfDateAt))
+	// A group judged by mesh/check (issue 1302, ADR 0447 §2): its verdict is the checker's one verdict at its members'
+	// heads, read, not asked; nothing below asks a composed check or owes a member's mesh/merge-gate.
+	oneStatus := oneStatusGroup(members)
+	if oneStatus {
+		h.composeFromChecker(g, members, now)
+	}
+	again := !oneStatus && g.Check != nil && (!sameMembers(g.Check.Commits, commits) || g.Check.OutOfDate != "" && rejudgedSince(members, g.Check.OutOfDateAt))
 	// A closed group's member whose merge the tool refused, after the composed check answered, is judged again at once
 	// (novox/hq ADR 0418 §4, issue 1082): the refusal is a sibling's merge having moved what the verdict stands on, and
 	// nothing else asks the composed check again. Not while a check is on its way (its verdict is empty then).
 	// **A refusal that names the member's OWN pending status** (mesh/repo-check, with the gate not pending: the composed
 	// check set it) is not that: the composed check sets no repository check, so asking it again changes nothing. The
 	// member's own check is asked, once for the head (issue 1049); its verdict sets the status.
-	if !again && g.Closed && g.Check != nil && g.Check.Verdict != "" {
+	if !oneStatus && !again && g.Closed && g.Check != nil && g.Check.Verdict != "" {
 		for _, d := range members {
 			if !refusedAfter(d, g.Check.At) {
 				continue
@@ -2193,7 +2210,7 @@ func (h *Holder) planGroup(g *Group, members []*Delivery, now time.Time) []func(
 			break
 		}
 	}
-	if allReady && (g.Check == nil && !g.Closed || again) {
+	if !oneStatus && allReady && (g.Check == nil && !g.Closed || again) {
 		ms := membersOfAsk(members)
 		id := g.ID
 		asks = append(asks, func() {
@@ -2262,7 +2279,7 @@ func (h *Holder) planGroup(g *Group, members []*Delivery, now time.Time) []func(
 	}
 	// Each member's mesh/merge-gate is the composed check's (ADR 0403 §1, §6): pending, saying why, while no composed
 	// verdict stands at these heads. The verdict itself sets it, success or failure, in the forge module.
-	if why := composedPending(g, members); why != "" {
+	if why := composedPending(g, members); why != "" && !oneStatus {
 		if g.SaidGate == nil {
 			g.SaidGate = map[string]string{}
 		}
@@ -2820,8 +2837,8 @@ func ownStatusPending(answer string) bool {
 // its own. Under the lock; the ask is made outside it. Nil when it was asked already for this head.
 func (h *Holder) askOwnAfterRefusal(d *Delivery) func() {
 	r := d.Ready
-	if !r.OwnAskedAt.IsZero() {
-		return nil
+	if !r.OwnAskedAt.IsZero() || d.judgedByCheck() {
+		return nil // asked already; or the checker's, who checks it again on its own (issue 1302)
 	}
 	r.OwnAskedAt = h.Now()
 	h.keep(d)
@@ -30,8 +30,8 @@ func (h *Holder) lostCheckBound(repository string) time.Duration {
 // awaitedSince is when a proposed delivery's check was asked, when it waits for one this owner asked: no verdict yet,
 // or a verdict out of date with its check against the trunk's head asked. False for a delivery waiting for none.
 func awaitedSince(d *Delivery) (time.Time, bool) {
-	if d.State != Proposed || d.MergedAs != "" || d.Number == 0 {
-		return time.Time{}, false
+	if d.State != Proposed || d.MergedAs != "" || d.Number == 0 || d.judgedByCheck() {
+		return time.Time{}, false // a head on mesh/check asks the controller nothing (issue 1302)
 	}
 	switch {
 	case d.Check == nil && askedCheck(d):
@@ -115,6 +115,25 @@ func run(h *Holder, l *listening, occupancy *busOccupancy) {
 			time.Sleep(wait)
 		}
 	}()
+	// The checker's verdicts (issue 1302, ADR 0447 §2): the Approve on mesh/check is asked only on its verdict at exactly the
+	// heads an ask covers, and a group's verdict is that one; each change asks for a look.
+	go func() {
+		for wait := 2 * time.Second; ; wait = min(wait*2, time.Minute) {
+			err := stdio.State(checkerVerdicts).Watch("", func(c stdio.StateChange) error {
+				if c.Op == "delete" {
+					h.CheckerVerdictChanged(c.Key, nil)
+				} else {
+					h.CheckerVerdictChanged(c.Key, c.Value)
+				}
+				return nil
+			})
+			if err == nil {
+				return
+			}
+			logf("[mesh-delivery] not hearing the checker's verdicts yet (%v); asking again in %s", err, wait)
+			time.Sleep(wait)
+		}
+	}()
 	logf("[mesh-delivery] listening: %s", strings.Join(followed, ", "))
 }

@@ -313,7 +332,8 @@ func tools(h *Holder, l *listening) []stdio.Tool {
 		{Name: seat + "groups",
 			Description: "Every delivery group: its members, its composed check and its state, derived from its members. " +
 				"A group has no order: it is merged in one pass and delivered by one plan, whose tiers come from the module " +
-				"graph (novox/hq ADR 0418). composed_gate says its members' gate is the composed check's (ADR 0403).",
+				"graph (novox/hq ADR 0418). On mesh/check its check is the checker's one verdict at every member's head (ADR 0447); " +
+				"composed_gate says its members' gate is the controller's composed check's (ADR 0403), for a base still on it.",
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"all": map[string]any{"type": "string", "enum": []string{"true", "false"}}}},
 			Run: func(a map[string]any) (any, error) { return h.Groups(boolArg(a, "all")), nil }},
@@ -330,7 +350,7 @@ func tools(h *Holder, l *listening) []stdio.Tool {
 			}},
 		{Name: seat + "checks",
 			Description: "What the mesh's checks said of a pull request's head or of one commit: each of the commit's " +
-				"statuses (mesh/merge-gate, mesh/repo-check, mesh/delivery, …) with its state, description and when it " +
+				"statuses (mesh/check, mesh/delivery, …; hq's mesh/repo-check) with its state, description and when it " +
 				"was set; the merge check's full verdict as the controller said it — each layer's summary, the machine " +
 				"that ran it, when, its build id and its report; and whether the branch's protection would let it " +
 				"merge, every required status being success.",
@@ -83,16 +83,17 @@ func TestItClaimsTheDeliverySeatAndFollowsWhatItHandles(t *testing.T) {
 	if !reflect.DeepEqual(buckets, []string{"deliveries", "groups", "pulls", "asks", "merges", "owed", "source"}) {
 		t.Fatalf("state %v", buckets)
 	}
-	// What it reads: the carry from today's module's three buckets, the teller's answers, the seat's holder and the
-	// machines' haves (ADR 0450 §6 and its insight of 2026-10-20).
+	// What it reads: the carry from today's module's three buckets, the teller's answers, the checker's verdicts (issue
+	// 1302), the seat's holder and the machines' haves (ADR 0450 §6 and its insight of 2026-10-20).
 	if !reflect.DeepEqual(m.Reads, []string{"mesh-delivery.deliveries", "mesh-delivery.groups", "mesh-delivery.pulls",
-		"mesh-delivery-teller.answers", "mesh-controller.assignments", "node-engine.have"}) {
+		"mesh-delivery-teller.answers", "mesh-delivery-checker.verdicts", "mesh-controller.assignments", "node-engine.have"}) {
 		t.Fatalf("reads %v", m.Reads)
 	}
-	// It calls exactly the controller's seven verbs (ADR 0450 §7) and reads the forge with three tools; the forge's
+	// It calls exactly the controller's seven verbs (ADR 0450 §7; queue since issue 1274, forget-checks no more since issue 1318) and reads the forge with
+	// three tools; the forge's
 	// writes are the bridge's (ADR 0437 §8). It uses no operator-channel: the teller asks (ADR 0437 §6).
 	want := []string{}
-	for _, v := range []string{"deliver", "delivery-stop", "delivery-backups-again", "delivery-walks", "delivery-check", "forget-checks", "queue", "plans"} {
+	for _, v := range []string{"deliver", "delivery-stop", "delivery-backups-again", "delivery-walks", "delivery-check", "queue", "plans"} {
 		want = append(want, "seat:"+ControllerSeat+"."+v)
 	}
 	want = append(want, "gitea.gitea_commit_statuses", "gitea.gitea_contains", "gitea.gitea_open_pulls")
@@ -54,6 +54,12 @@ type Delivery struct {
 	Plan *DeliveryPlan `json:"plan,omitempty"`
 	// Check is its own check's verdict.
 	Check *Verdict `json:"check,omitempty"`
+	// Required are the statuses its base requires, as the forge last said them (gitea_open_pulls): mesh/check makes it
+	// the checker's (issue 1302). Empty until the forge said them.
+	Required []string `json:"required,omitempty"`
+	// CheckState is its head's mesh/check as the forge last said it (pending, success, failure, error): a pending one
+	// after a pass is the checker judging it again, and no Approve is asked meanwhile (issue 1302).
+	CheckState string `json:"check_state,omitempty"`
 	// CheckAsk is this owner's own ask of its check, when the forge's announcement did not bring one: a head
 	// adopted while it already waited, or one whose announcement the controller missed.
 	CheckAsk *CheckAsk `json:"check_ask,omitempty"`
@@ -179,6 +185,9 @@ type Verdict struct {
 	Trunk  string            `json:"trunk,omitempty"`
 	Beside map[string]string `json:"beside,omitempty"`
 	Took   string            `json:"took,omitempty"`
+	// Status is the forge status it was read from when it is not the controller's verdict: mesh/check, the checker's
+	// (novox/hq ADR 0447, issue 1302). Empty for the controller's `checked`.
+	Status string `json:"status,omitempty"`
 }

 // Judged is what a verdict judged, in words: "head 1a2b3c4d5e6f merged into trunk 7a8b9c0d1e2f" (ADR 0323 §3);
@@ -1034,7 +1043,8 @@ type Group struct {
 	Updated time.Time `json:"updated"`
 	// Check is its composed check: asked of the controller for these member commits, and its verdict.
 	Check *GroupCheck `json:"check,omitempty"`
-	// SaidGate is, by member id, why the member's mesh/merge-gate was last said pending: written again only when it
+	// SaidGate is, by member id, why the member's mesh/merge-gate was last said pending (a group the controller judges;
+	// a group on mesh/check is owed none, issue 1302): written again only when it
 	// changes (novox/hq ADR 0403 §1, §6, issue 978). Cleared once a composed verdict stands at the heads, which the
 	// forge module then sets as every member's gate.
 	SaidGate map[string]string `json:"said_gate,omitempty"`
@@ -0,0 +1,289 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	sdk "git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **One required status** (novox/hq ADR 0447, issue 1302; ADR 0503 §3, §5).
+//
+// Main requires `mesh/check` everywhere but hq: the checker's verdict on a pull request's head merged onto its trunk's
+// head, written by its forge bridge. On such a base this owner reads that one status, and nothing of the controller:
+//
+//   - the verdict of a head is its mesh/check, heard as the forge's status event (its words name the head and the trunk
+//     it judged: "pass <head12> on <trunk12> | …") or read from the forge's open pull requests; it is kept as the
+//     delivery's Check, marked as mesh/check's, and moves the delivery as the controller's verdict did;
+//   - the Approve is asked only when the checker's verdict for exactly the heads the ask covers passed (its verdicts
+//     bucket, keyed by the heads' hash, ADR 0447 §2): a member's pass from a check that judged it alone, before a sibling
+//     joined, is not the group's;
+//   - a group's verdict is that one verdict (no composed check is asked, and no member is owed a mesh/merge-gate); a
+//     member's mesh/check that is no longer a success withdraws the group's ask (ADR 0441 §1, withdrawForStatus);
+//   - no check is asked of the controller: the checker checks every head on every move, and the trunk's move is its to
+//     say on mesh/check (ADR 0447 §4). The controller is asked only for a base that requires mesh/repo-check without
+//     mesh/check (hq), and only what it was asked before (the lead's decision for issue 1302 in R4e).
+//
+// A base whose required statuses are not known yet is read as before: the forge's open pull requests say them at the next
+// look, and a mesh/check heard on the head says it too.
+
+// ctxCheck is the one status main requires (ADR 0447 §1).
+const ctxCheck = "mesh/check"
+
+// checkerVerdicts is the checker's verdicts bucket as this module reads it (its manifest's reads).
+const checkerVerdicts = "mesh-delivery-checker.verdicts"
+
+// The states of a checker's verdict (mesh-sdk go/delivery VerdictRunning, VerdictPass, VerdictFail; this module's mesh-sdk
+// pin is older than them).
+const (
+	checkerRunning = "running"
+	checkerPass    = "pass"
+)
+
+// checkerVerdict is a verdict of the checker as its verdicts bucket keeps it (mesh-sdk go/delivery Verdict, read here by
+// the fields the gate needs): the group, the hash of the heads it judged, each repository's trunk head and its state.
+type checkerVerdict struct {
+	Group  string            `json:"group"`
+	Heads  string            `json:"heads"`
+	Trunk  map[string]string `json:"trunk,omitempty"`
+	State  string            `json:"state"`
+	Failed struct {
+		Test    string `json:"test,omitempty"`
+		Machine string `json:"machine,omitempty"`
+		Words   string `json:"words,omitempty"`
+	} `json:"failed,omitzero"`
+}
+
+// CheckerVerdictChanged takes a key of the checker's verdicts bucket (`<group>.<heads hash>`) put or deleted (an empty
+// value): the view of the checker's verdicts the Approve and a group's verdict are read from. A value that is no verdict
+// is said and dropped.
+func (h *Holder) CheckerVerdictChanged(key string, value []byte) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.checker == nil {
+		h.checker = map[string]checkerVerdict{}
+	}
+	hash := key
+	if i := strings.LastIndex(key, "."); i >= 0 {
+		hash = key[i+1:]
+	}
+	if len(value) == 0 || string(value) == "null" {
+		delete(h.checker, hash)
+		h.Poke()
+		return
+	}
+	var v checkerVerdict
+	if err := json.Unmarshal(value, &v); err != nil || v.State == "" {
+		h.Logf("[mesh-delivery] the checker's verdict %s cannot be read (%v); it is not taken", key, err)
+		return
+	}
+	if v.Heads == "" {
+		v.Heads = hash
+	}
+	h.checker[v.Heads] = v
+	h.Poke()
+}
+
+// checkWords are the head and the trunk mesh/check's line names: "<head12> on <trunk12>" (ADR 0447 §3).
+var checkWords = regexp.MustCompile(`\b([0-9a-f]{12}) on ([0-9a-f]{12})\b`)
+
+// checkLine is the head and the trunk commit a mesh/check line names, twelve characters each; empty when it names none.
+func checkLine(desc string) (head, trunk string) {
+	m := checkWords.FindStringSubmatch(strings.ToLower(desc))
+	if m == nil {
+		return "", ""
+	}
+	return m[1], m[2]
+}
+
+// verdictOfCheck is a delivery's verdict from its head's mesh/check: its state as a verdict, its line as the summary, and
+// the head and trunk it names.
+func verdictOfCheck(state, desc string, now time.Time) *Verdict {
+	head, trunk := checkLine(desc)
+	return &Verdict{At: now, Gate: verdictOfState(state), Summary: firstOf(desc, "mesh/check "+state), Head: head, Trunk: trunk,
+		Status: ctxCheck}
+}
+
+// judgedByCheck is whether the delivery's base requires mesh/check, as the forge said it, or its verdict is mesh/check's.
+func (d *Delivery) judgedByCheck() bool {
+	return slices.Contains(d.Required, ctxCheck) || (d.Check != nil && d.Check.Status == ctxCheck)
+}
+
+// noteRequired keeps what the forge said the delivery's base requires. Under the lock.
+func (h *Holder) noteRequired(d *Delivery, required []string) {
+	if d == nil || required == nil || slices.Equal(d.Required, required) {
+		return
+	}
+	d.Required = slices.Clone(required)
+	h.keep(d)
+}
+
+// takeCheckStatus takes a head's mesh/check as its delivery's verdict, as the controller's `checked` was taken: a
+// proposed delivery moves on it, a rejected one judged again against another trunk or now passing is proposed again
+// first. A pending mesh/check is no verdict and changes nothing here (its ask is withdrawn by withdrawForStatus). The same
+// verdict heard twice changes nothing. Under the lock.
+func (h *Holder) takeCheckStatus(repository, sha, state, desc string) {
+	d := h.deliveries[IDOf(strings.ToLower(repository), sha)]
+	if d == nil || state == "" {
+		return // its announcement makes it; the forge's open pull requests bring the verdict then
+	}
+	if d.CheckState != state {
+		d.CheckState = state
+		h.keep(d)
+	}
+	if state == "pending" {
+		return
+	}
+	if !slices.Contains(d.Required, ctxCheck) {
+		d.Required = append(d.Required, ctxCheck)
+	}
+	now := h.Now()
+	v := verdictOfCheck(state, desc, now)
+	if c := d.Check; c != nil && c.Status == ctxCheck && c.Gate == v.Gate && c.Trunk == v.Trunk && c.Summary == v.Summary {
+		return
+	}
+	if d.State == Rejected && d.Check != nil && (v.Passes() || v.Trunk != "" && !sameCommit(d.Check.Trunk, v.Trunk)) {
+		t, err := Apply(d, EvRecheck, true, Facts{Now: now, By: byOwner, Why: fmt.Sprintf("its mesh/check judged it again: %s",
+			oneLine(clip(desc, 120)))})
+		if err != nil {
+			h.refuse(err)
+			return
+		}
+		h.moved(d, []Transition{t})
+	}
+	if d.State != Proposed {
+		h.keep(d)
+		return // past its verdict: the merge reads the forge's status itself
+	}
+	d.Check, d.AskedAgain, d.CheckAsk = v, nil, nil
+	h.mergeAgainNow(d)
+	if why := d.outOfDate(); why != "" {
+		h.Logf("[mesh-delivery] %s: its mesh/check is %s; the checker checks it again", d.ID, why)
+	}
+	h.Logf("[mesh-delivery] %s: its mesh/check is %s — %s", d.ID, state, oneLine(clip(desc, 120)))
+	h.settleAndKeep(d)
+}
+
+// headsOf are the heads the checker judges together for an ask: the members the ask covers.
+func headsOf(members []*Delivery) []sdk.Head {
+	out := make([]sdk.Head, 0, len(members))
+	for _, m := range members {
+		out = append(out, sdk.Head{Repository: strings.ToLower(m.Repository), Number: m.Number, Head: strings.ToLower(m.Commit)})
+	}
+	return out
+}
+
+// checkerAt is the checker's verdict for exactly these members' heads, and their hash.
+func (h *Holder) checkerAt(members []*Delivery) (checkerVerdict, string, bool) {
+	hash, err := sdk.HeadsHash(headsOf(members))
+	if err != nil {
+		return checkerVerdict{}, "", false
+	}
+	v, ok := h.checker[hash]
+	return v, hash, ok
+}
+
+// checkerWaits is why the Approve of a delivery on mesh/check is not asked yet: the checker's verdict for the heads the ask
+// covers is not held, or did not pass. Empty when it passed, for a delivery not judged by mesh/check, and once an ask
+// covers the head (the merge then reads the forge's statuses itself). Under the lock.
+func (h *Holder) checkerWaits(d *Delivery) string {
+	if !d.judgedByCheck() || h.covering(d) != nil {
+		return ""
+	}
+	members := h.askMembers(d)
+	for _, m := range members {
+		if m.CheckState != "" && m.CheckState != "success" {
+			return fmt.Sprintf("the mesh/check of %s is %s at its head %s", m.ID, m.CheckState, shortOf(m.Commit, 12))
+		}
+	}
+	v, hash, ok := h.checkerAt(members)
+	what := "its head"
+	if len(members) > 1 {
+		what = fmt.Sprintf("its group's %d heads", len(members))
+	}
+	switch {
+	case !ok:
+		return fmt.Sprintf("the checker's verdict at %s (heads %s) is not held yet", what, hash)
+	case v.State == checkerRunning:
+		return fmt.Sprintf("the checker's verdict at %s (heads %s) is running", what, hash)
+	case v.State != checkerPass:
+		return fmt.Sprintf("the checker's verdict at %s (heads %s) is %s", what, hash, v.State)
+	}
+	return ""
+}
+
+// oneStatusGroup is whether a group is judged by mesh/check: one of its members is.
+func oneStatusGroup(members []*Delivery) bool {
+	return slices.ContainsFunc(members, (*Delivery).judgedByCheck)
+}
+
+// composeFromChecker makes a group's verdict on mesh/check from the checker's one verdict at its members' heads (ADR 0447
+// §2): no composed check is asked. It is kept in the group's check as a composed verdict was, so the group's state, its
+// Approve and its merges read it unchanged: running or not held is no verdict yet, a pass or a failure is the group's, and
+// a member whose trunk moved past what it judged puts it out of date. Under the lock.
+func (h *Holder) composeFromChecker(g *Group, members []*Delivery, now time.Time) {
+	live := make([]*Delivery, 0, len(members))
+	for _, d := range members {
+		if d.MergedAs == "" && !d.State.Final() {
+			live = append(live, d)
+		}
+	}
+	if len(live) == 0 || (g.Closed && g.Check != nil && g.Check.Verdict != "") {
+		return // every member on the trunk, or a closed group: the verdict its Approve was asked on stands
+	}
+	v, hash, ok := h.checkerAt(live)
+	c := &GroupCheck{Asked: "mesh/check " + hash, At: now, Commits: commitsOf(members)}
+	if g.Check != nil && g.Check.Asked == c.Asked && sameMembers(g.Check.Commits, c.Commits) {
+		c.At = g.Check.At
+	}
+	if ok && v.State != checkerRunning {
+		c.Verdict = v.State
+		c.Summary = "the checker's verdict at the members' heads (" + hash + ")"
+		if w := firstOf(v.Failed.Test, v.Failed.Machine, v.Failed.Words); w != "" {
+			c.Summary += ": " + w
+		}
+		c.Trunks = map[string]string{}
+		ids := make([]string, 0, len(live))
+		for _, d := range live {
+			ids = append(ids, d.ID)
+		}
+		sort.Strings(ids)
+		for _, id := range ids {
+			d := h.deliveries[id]
+			judged := v.Trunk[strings.ToLower(d.Repository)]
+			if judged == "" {
+				continue
+			}
+			c.Trunks[d.ID] = judged
+			if c.OutOfDate == "" && d.TrunkNow != "" && !sameCommit(judged, d.TrunkNow) {
+				c.OutOfDate = fmt.Sprintf("the checker's verdict is out of date: %s was judged on trunk %s, the trunk is now %s",
+					d.ID, shortOf(judged, 12), shortOf(d.TrunkNow, 12))
+				c.OutOfDateAt = now
+			}
+		}
+	}
+	if g.Check != nil && g.Check.Asked == c.Asked && g.Check.Verdict == c.Verdict && g.Check.OutOfDate == c.OutOfDate &&
+		sameMembers(g.Check.Commits, c.Commits) {
+		return
+	}
+	g.Check, g.Updated = c, now
+	h.keepGroup(g)
+	if c.Verdict != "" {
+		for _, d := range members {
+			h.mergeAgainNow(d)
+		}
+		h.Logf("[mesh-delivery] group %s: %s — %s", g.ID, c.Verdict, c.Summary)
+	}
+}
+
+// checkerRefusal is why a delivery on mesh/check is asked nothing of the controller: the checker checks it.
+func checkerRefusal(id string) error {
+	return fmt.Errorf("%s is judged by mesh/check, the checker's: the checker checks its head again on every move of the head, "+
+		"its trunk or its group, and nothing is asked of it here (novox/hq ADR 0447). Read where its check stands with the "+
+		"checker's checker_pull tool", id)
+}
@@ -0,0 +1,82 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	sdk "git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **Issue 1302's acceptance over a real bus** (ADR 0447, 1302-S10): a pull request into a main that requires mesh/check goes
+// ready on its mesh/check alone — the forge's status event and the checker's verdict in its verdicts bucket — has its Approve
+// asked, and on the Approve its merge is handed to the bridge; nothing is asked of the controller (no delivery-check, no
+// forget-checks) and no controller verdict is heard at all.
+func TestADeliveryOnMeshCheckGoesReadyAskedAndMergedOverARealBus(t *testing.T) {
+	b := newTestBus(t)
+	ctx := context.Background()
+	rt := b.start(t)
+	evctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	rt.deliverEvents(evctx)
+	rt.until("the module to subscribe to the events it follows", 20*time.Second, func() bool {
+		rt.mu.Lock()
+		defer rt.mu.Unlock()
+		return len(rt.subs) >= len(followed)
+	})
+	rt.untilHolding()
+
+	const head = "2222222222222222222222222222222222222222"
+	const trunk = "3333333333333333333333333333333333333333"
+	rt.mu.Lock()
+	rt.openPulls = []OpenPull{{Owner: "novox", Repo: "app", Number: 8, Base: "main", HeadSHA: head, Required: []string{ctxCheck},
+		Statuses: []string{}, Checks: map[string]HeadCheck{}}}
+	rt.mu.Unlock()
+	announced := pr("novox/app", 8, head, "fix/y", "src/b.go")
+	announced.Body = "Reviewed-by: lead@shanks at " + head
+	b.publish(t, "mesh.mod.gitea.event.pull.updated", announced)
+
+	// The checker's verdict at the head, then the forge's word that its bridge set mesh/check.
+	hash, err := sdk.HeadsHash([]sdk.Head{{Repository: "novox/app", Number: 8, Head: head}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	verdict, _ := json.Marshal(map[string]any{"v": 1, "group": "fix/y", "heads": hash, "trunk": map[string]string{"novox/app": trunk},
+		"state": "pass"})
+	if _, err := b.kvs[checkerVerdicts].Put(ctx, "fix/y."+hash, verdict); err != nil {
+		t.Fatal(err)
+	}
+	line := "pass " + head[:12] + " on " + trunk[:12] + " | unit 3 run, 0 kept"
+	rt.mu.Lock()
+	rt.openPulls[0].Statuses = []string{ctxCheck}
+	rt.openPulls[0].Checks = map[string]HeadCheck{ctxCheck: {State: "success", Description: line}}
+	rt.mu.Unlock()
+	set := b.publish(t, "mesh.mod.gitea.event.forge.status", map[string]any{"owner": "novox", "repo": "app", "sha": head,
+		"context": ctxCheck, "state": "success", "description": line})
+
+	var key string
+	rt.until("the ask to be written on mesh/check alone", 10*time.Second, func() bool { key = onlyAsk(b); return key != "" })
+	t.Logf("the ask was written %s after mesh/check was set", time.Since(set))
+	b.answer(t, key, OptionApprove)
+	var handed sdk.Merge
+	rt.until("the merge to be handed to the bridge", 10*time.Second, func() bool { handed = mergeAt(b, "fix/y"); return len(handed.Pulls) > 0 })
+	if len(handed.Pulls) != 1 || handed.Pulls[0].Head.Head != head || handed.Pulls[0].State != sdk.MergeMerging {
+		t.Fatalf("the merge handed is %+v", handed)
+	}
+	for _, verb := range []string{"delivery-check", "forget-checks"} {
+		if n := len(rt.asksOf("seat:" + ControllerSeat + "." + verb)); n != 0 {
+			t.Fatalf("the controller was asked %s %d times on a mesh/check base", verb, n)
+		}
+	}
+	// No mesh/merge-gate is owed on the head.
+	keys, _ := b.kvs["owed"].Keys(ctx)
+	for _, k := range keys {
+		if strings.Contains(k, "merge-gate") {
+			t.Fatalf("a mesh/merge-gate was owed: %s", k)
+		}
+	}
+}
@@ -0,0 +1,245 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	sdk "git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The tests of issue 1302 (ADR 0447 §2, §4; ADR 0441 §1; ADR 0421 §1, §3; lead decisions L6 and the gate's part of
+// 1318): on a base that requires mesh/check the gate reads that one status. A delivery is ready, its Approve asked and its
+// merge handed on when mesh/check passed at its head and the checker's verdict covers every member's head as they are; no
+// check is asked of the controller, no composed check is asked, and no mesh/merge-gate is owed.
+
+const (
+	oneRepo, oneRepo2 = "novox/mesh-sdk", "novox/mesh-delivery"
+	oneHead, oneHead2 = "e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5", "f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6f6"
+	oneTrunk          = "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
+	oneTrunk2         = "b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2"
+)
+
+// requiresCheck makes the forge say each pull request's base requires mesh/check alone, as gitea_open_pulls answers.
+func requiresCheck(w *world, pulls ...PullEvent) {
+	w.forge.mu.Lock()
+	defer w.forge.mu.Unlock()
+	w.forge.open = nil
+	for _, p := range pulls {
+		w.forge.open = append(w.forge.open, OpenPull{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Base: "main",
+			HeadSHA: p.HeadSHA, Required: []string{ctxCheck}, Statuses: []string{}, Checks: map[string]HeadCheck{}})
+	}
+}
+
+// checkStatus is the forge's word that mesh/check was set on a head, with its line as the checker writes it.
+func checkStatus(repository, head, state, trunk string) ForgeStatusEvent {
+	owner, repo, _ := strings.Cut(repository, "/")
+	words := map[string]string{"success": "pass", "pending": "checking", "failure": "failed: a test"}[state]
+	return ForgeStatusEvent{Owner: owner, Repo: repo, SHA: head, Context: ctxCheck, State: state,
+		Description: words + " " + head[:12] + " on " + trunk[:12] + " | unit 4 run, 0 kept"}
+}
+
+// putCheckerVerdict puts the checker's verdict for these heads in the gate's view of the checker's verdicts bucket.
+func putCheckerVerdict(w *world, state string, heads ...sdk.Head) {
+	w.t.Helper()
+	hash, err := sdk.HeadsHash(heads)
+	if err != nil {
+		w.t.Fatal(err)
+	}
+	trunk := map[string]string{}
+	for _, h := range heads {
+		trunk[h.Repository] = oneTrunk
+	}
+	value, _ := json.Marshal(map[string]any{"v": 1, "group": "g", "heads": hash, "trunk": trunk, "state": state})
+	w.h.CheckerVerdictChanged("g."+hash, value)
+}
+
+func headOf(repository string, number int, head string) sdk.Head {
+	return sdk.Head{Repository: repository, Number: number, Head: head}
+}
+
+func mergeGateOwed(w *world) []string {
+	w.forge.mu.Lock()
+	defer w.forge.mu.Unlock()
+	var out []string
+	for k := range w.forge.statuses {
+		if strings.HasSuffix(k, " mesh/merge-gate") {
+			out = append(out, k)
+		}
+	}
+	return out
+}
+
+// 1302 acceptance: the gate's table moves a lone delivery to ready on mesh/check alone, asks its Approve and merges it,
+// with no check asked of the controller and no mesh/merge-gate written.
+func TestALoneDeliveryGoesReadyAskedAndMergedOnMeshCheckAlone(t *testing.T) {
+	w := newWorld(t)
+	p := pr(oneRepo, 1, oneHead, "feat/one")
+	requiresCheck(w, p)
+	w.h.PullUpdated(p)
+	w.settleAll()
+	if got := w.ctl.checks; len(got) != 0 {
+		t.Fatalf("a check was asked of the controller for a mesh/check base: %v", got)
+	}
+	id := IDOf(oneRepo, oneHead)
+	if s := w.state(id); s != Proposed {
+		t.Fatalf("before mesh/check it is %s, want proposed", s)
+	}
+	putCheckerVerdict(w, "pass", headOf(oneRepo, 1, oneHead))
+	w.h.CommitStatus(checkStatus(oneRepo, oneHead, "success", oneTrunk))
+	w.settleAll()
+	if s := w.state(id); s == Proposed || s == Rejected {
+		t.Fatalf("after mesh/check passed it is %s (%s), want ready or on", s, w.logs())
+	}
+	if d := w.delivery(id); d.Check == nil || d.Check.Status != ctxCheck || d.Check.Trunk != oneTrunk[:12] || d.Check.Head != oneHead[:12] {
+		t.Fatalf("the verdict is not mesh/check's: %+v", d.Check)
+	}
+	if w.op.count() != 1 {
+		t.Fatalf("its Approve was asked %d times, want once", w.op.count())
+	}
+	if len(w.forge.merges) != 1 || !strings.Contains(w.forge.merges[0], "mesh-sdk#1") {
+		t.Fatalf("merges %v, want mesh-sdk#1", w.forge.merges)
+	}
+	if got := mergeGateOwed(w); len(got) != 0 {
+		t.Fatalf("mesh/merge-gate was written: %v", got)
+	}
+	if len(w.ctl.checks) != 0 {
+		t.Fatalf("a check was asked of the controller: %v", w.ctl.checks)
+	}
+}
+
+// 1302 (lead: the verdict read must be the group's): mesh/check passing on a head is not enough while the checker's
+// verdict for exactly the delivery's heads is not held: the Approve waits for it, and says so.
+func TestTheApproveWaitsForTheCheckersVerdictAtTheDeliverysHeads(t *testing.T) {
+	w := newWorld(t)
+	p := pr(oneRepo, 1, oneHead, "feat/one")
+	requiresCheck(w, p)
+	w.h.PullUpdated(p)
+	w.h.CommitStatus(checkStatus(oneRepo, oneHead, "success", oneTrunk))
+	w.settleAll()
+	if w.op.count() != 0 {
+		t.Fatalf("the Approve was asked with no checker verdict at the head")
+	}
+	if d := w.delivery(IDOf(oneRepo, oneHead)); d.Ready == nil || !strings.Contains(d.Ready.Waits, "checker") {
+		t.Fatalf("it does not say it waits for the checker's verdict: %+v", d.Ready)
+	}
+	putCheckerVerdict(w, "running", headOf(oneRepo, 1, oneHead))
+	w.settleAll()
+	if w.op.count() != 0 {
+		t.Fatalf("the Approve was asked on a running verdict")
+	}
+	putCheckerVerdict(w, "pass", headOf(oneRepo, 1, oneHead))
+	w.settleAll()
+	if w.op.count() != 1 {
+		t.Fatalf("the Approve was asked %d times after the checker's pass, want once", w.op.count())
+	}
+}
+
+// 1302 acceptance (ADR 0447 §2, ADR 0441 §1): a group on mesh/check is asked once when every member's mesh/check passed
+// and the checker's verdict names every member's head; a member's mesh/check that changes withdraws the ask. No composed
+// check is asked of the controller and no member is owed a mesh/merge-gate.
+func TestAGroupOnMeshCheckIsAskedOnTheCheckersOneVerdictAndWithdrawnWhenAMemberChanges(t *testing.T) {
+	w := newWorld(t)
+	w.op.auto = false
+	a, b := pr(oneRepo, 1, oneHead, "feat/two"), pr(oneRepo2, 2, oneHead2, "feat/two")
+	requiresCheck(w, a, b)
+	w.h.PullUpdated(a)
+	w.h.PullUpdated(b)
+	w.h.wantForge() // as the event's handler does for a head not seen before (main.go)
+	w.settleAll()
+	// One member's verdict alone, of a check that judged it by itself: not the group's.
+	putCheckerVerdict(w, "pass", headOf(oneRepo, 1, oneHead))
+	w.h.CommitStatus(checkStatus(oneRepo, oneHead, "success", oneTrunk))
+	w.h.CommitStatus(checkStatus(oneRepo2, oneHead2, "success", oneTrunk))
+	w.settleAll()
+	if w.op.count() != 0 {
+		t.Fatalf("the group was asked on a verdict that does not name every member's head")
+	}
+	putCheckerVerdict(w, "pass", headOf(oneRepo, 1, oneHead), headOf(oneRepo2, 2, oneHead2))
+	w.settleAll()
+	if w.op.count() != 1 || len(w.op.open()) != 1 {
+		t.Fatalf("the group was asked %d times (open %v), want once", w.op.count(), w.op.open())
+	}
+	if len(w.ctl.checks) != 0 {
+		t.Fatalf("a check was asked of the controller: %v", w.ctl.checks)
+	}
+	if got := mergeGateOwed(w); len(got) != 0 {
+		t.Fatalf("mesh/merge-gate was owed: %v", got)
+	}
+	w.h.CommitStatus(checkStatus(oneRepo2, oneHead2, "pending", oneTrunk2))
+	w.settleAll()
+	if len(w.op.open()) != 0 {
+		t.Fatalf("the group's ask stands though a member's mesh/check changed: %v", w.op.open())
+	}
+}
+
+// 1302: a failing mesh/check rejects the delivery; nothing is asked.
+func TestAFailingMeshCheckRejects(t *testing.T) {
+	w := newWorld(t)
+	p := pr(oneRepo, 1, oneHead, "feat/one")
+	requiresCheck(w, p)
+	w.h.PullUpdated(p)
+	w.h.CommitStatus(checkStatus(oneRepo, oneHead, "failure", oneTrunk))
+	w.settleAll()
+	if s := w.state(IDOf(oneRepo, oneHead)); s != Rejected {
+		t.Fatalf("it is %s, want rejected", s)
+	}
+	if w.op.count() != 0 || len(w.ctl.checks) != 0 {
+		t.Fatalf("asked: operator %d, controller %v", w.op.count(), w.ctl.checks)
+	}
+}
+
+// 1302 (lead's (2)): the recheck verb refuses a delivery on a mesh/check base, saying the checker checks again on every
+// move and where to read it.
+func TestRecheckRefusesAMeshCheckDelivery(t *testing.T) {
+	w := newWorld(t)
+	p := pr(oneRepo, 1, oneHead, "feat/one")
+	requiresCheck(w, p)
+	w.h.PullUpdated(p)
+	w.h.CommitStatus(checkStatus(oneRepo, oneHead, "failure", oneTrunk))
+	w.settleAll()
+	_, err := w.h.Recheck(IDOf(oneRepo, oneHead), "try again", "tester")
+	if err == nil || !strings.Contains(err.Error(), "checker_pull") || !strings.Contains(err.Error(), "checker") {
+		t.Fatalf("recheck answered %v, want a refusal naming the checker and checker_pull", err)
+	}
+	if len(w.ctl.checks) != 0 {
+		t.Fatalf("a check was asked of the controller: %v", w.ctl.checks)
+	}
+}
+
+// 1318 (the gate's part): a pull request closed unmerged asks the controller to forget nothing: forget-checks is not called.
+func TestAClosedPullRequestAsksNoForgetChecks(t *testing.T) {
+	w := newWorld(t)
+	p := pr(oneRepo, 1, oneHead, "feat/one")
+	w.h.PullUpdated(p)
+	w.h.PullClosed(p)
+	if len(w.ctl.forgot) != 0 {
+		t.Fatalf("forget-checks was called: %v", w.ctl.forgot)
+	}
+}
+
+// 1302: the mesh/check line gives the head and the trunk it judged.
+func TestTheCheckLineGivesHeadAndTrunk(t *testing.T) {
+	head, trunk := checkLine("pass " + oneHead[:12] + " on " + oneTrunk[:12] + " | unit 4 run, 0 kept | group g of 2 pull requests")
+	if head != oneHead[:12] || trunk != oneTrunk[:12] {
+		t.Fatalf("head %q trunk %q", head, trunk)
+	}
+	if head, trunk = checkLine("failed: a test"); head != "" || trunk != "" {
+		t.Fatalf("a line that names no commits gave %q %q", head, trunk)
+	}
+}
+
+// 1302 with issue 1274's lost checks: a head on mesh/check never awaits a controller's check, so the build queue is not
+// read for it and nothing is asked again.
+func TestAHeadOnMeshCheckAwaitsNoControllersCheck(t *testing.T) {
+	at := time.Date(2026, 10, 22, 12, 0, 0, 0, time.UTC)
+	d := &Delivery{State: Proposed, Number: 1, CheckAsk: &CheckAsk{ID: "check-1", At: at}}
+	if _, ok := awaitedSince(d); !ok {
+		t.Fatal("the controller's asked check is not awaited")
+	}
+	d.Required = []string{ctxCheck}
+	if _, ok := awaitedSince(d); ok {
+		t.Fatal("a head on mesh/check awaits a controller's check")
+	}
+}
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"slices"
 	"sort"
-	"strconv"
 	"strings"

 	stdio "git.novox.be/novox/mesh-sdk/go"
@@ -65,8 +64,6 @@ type Controller interface {
 	StopWithout(walk, why, by string, without []string) (StopAnswer, error)
 	// Walks are the walks the controller keeps — one, given its id — and whether this seat has a holder on record.
 	Walks(walk string) (bool, []Walk, error)
-	// ForgetChecks lets go of the builds a pull request's merge checks made for its merge (novox/hq ADR 0350 §5).
-	ForgetChecks(owner, repo string, number int) error
 	// Queue is every ask the build queue holds, waiting or in flight (the controller's `queue`, novox/hq issue 455): what
 	// tells a check still on its way from one the queue lost (issue 1274). A dead ask is not held.
 	Queue() ([]QueuedAsk, error)
@@ -290,11 +287,6 @@ func (c seatController) BackupsAgain(walk, why string) error {
 	return err
 }

-func (c seatController) ForgetChecks(owner, repo string, number int) error {
-	_, err := c.verb("forget-checks", map[string]any{"owner": owner, "repo": repo, "number": strconv.Itoa(number)})
-	return err
-}
-
 func (c seatController) Stop(walk, why, by string) error {
 	_, err := c.verb("delivery-stop", map[string]any{"plan": walk, "why": why, "by": by})
 	return err
@@ -299,8 +299,8 @@ func (h *Holder) sayAfterLine(d *Delivery) func() {
 // second Approve. Nil when nothing needs asking. Under the lock; the ask runs outside it.
 func (h *Holder) askFresh(d *Delivery, now time.Time) func() {
 	if d.State != Proposed || d.outOfDate() == "" || d.AskedAgain != nil || !d.Check.Passes() || d.Base != MergeBranch ||
-		d.Number == 0 || d.TrunkNow == "" {
-		return nil
+		d.Number == 0 || d.TrunkNow == "" || d.judgedByCheck() {
+		return nil // a head on mesh/check is the checker's to judge again on its trunk's move (ADR 0447 §4)
 	}
 	// A group's member too (issue 1047, design 47: a move of the trunk asks every check again): the group's one Approve is
 	// asked after its composed check, so a member ready before that has no Approve to carry; its check is asked at once
@@ -383,6 +383,9 @@ func (r *ReadyRun) noteRefusal(d *Delivery, answer string) {
 // stays through a trunk move, ADR 0421 §3) and its check against the trunk's head is not on its way; one without an
 // Approve waits for that check first.
 func (h *Holder) readyWaits(d *Delivery) string {
+	if d.judgedByCheck() && d.State == Proposed && d.outOfDate() != "" && h.covering(d) == nil {
+		return "its mesh/check is " + d.outOfDate() + ": the checker checks it again against the trunk's head"
+	}
 	switch {
 	case d.State == Ready:
 	case d.State == Proposed && d.outOfDate() != "" && d.AskedAgain != nil:
@@ -402,6 +405,10 @@ func (h *Holder) readyWaits(d *Delivery) string {
 			return w
 		}
 	}
+	// On mesh/check, the checker's verdict at exactly the heads the ask covers (issue 1302, ADR 0447 §2).
+	if w := h.checkerWaits(d); w != "" {
+		return w
+	}
 	if d.Group == "" {
 		return ""
 	}
@@ -54,9 +54,10 @@ const outOfDatePrefix = "out of date:"
 // minute and the check is asked at once, so ten minutes is a fault, never a queue.
 const UncheckedAfter = 10 * time.Minute

-// mergeChecks are the statuses that are the mesh's merge check (novox/hq ADR 0237): a base requiring either is
-// one the mesh is meant to check.
-var mergeChecks = []string{"mesh/merge-gate", "mesh/repo-check"}
+// mergeChecks are the statuses that are the mesh's check: mesh/check, the one main requires (novox/hq ADR 0447, issue
+// 1302), and the two it replaced, which hq's base (mesh/repo-check, ADR 0503 §5) and a reverted one still require. A base
+// requiring any is one the mesh is meant to check; only those a base requires are waited on.
+var mergeChecks = []string{ctxCheck, "mesh/merge-gate", "mesh/repo-check"}

 // OpenPull is an open pull request as the forge says it (the gitea module's gitea_open_pulls): its head, its base,
 // the contexts the base's protection requires, the contexts its head has a status of, in any state, and each of
@@ -179,6 +180,15 @@ func (h *Holder) SeeOpenPulls() error {
 	now := h.Now()
 	seen := map[string]unchecked{}
 	for _, p := range open {
+		if slices.Contains(p.Required, ctxCheck) {
+			// What the forge says of a head on a mesh/check base is its verdict (issue 1302): kept, and taken.
+			if d := h.deliveries[IDOf(p.Owner+"/"+p.Repo, p.HeadSHA)]; d != nil {
+				h.noteRequired(d, p.Required)
+				if c := p.Checks[ctxCheck]; c.State != "" {
+					h.takeCheckStatus(p.Owner+"/"+p.Repo, p.HeadSHA, c.State, c.Description)
+				}
+			}
+		}
 		waiting, pending, _ := p.unanswered()
 		if len(waiting) == 0 {
 			continue
@@ -152,8 +152,9 @@ type GroupLine struct {
 	ID    string `json:"id"`
 	State string `json:"state"`
 	Why   string `json:"why"`
-	// ComposedGate says the group's gate is the composed check's: each member's own pull request check runs the
-	// repository's check alone, and the composed verdict sets its mesh/merge-gate (novox/hq ADR 0403 §1, issue 978).
+	// ComposedGate says the group's gate is the controller's composed check's: each member's own pull request check runs
+	// the repository's check alone, and the composed verdict sets its mesh/merge-gate (novox/hq ADR 0403 §1, issue 978).
+	// On mesh/check the group's check is the checker's one verdict at every member's head (ADR 0447 §2, issue 1302).
 	ComposedGate bool     `json:"composed_gate"`
 	Check        string   `json:"composed,omitempty"`
 	Members      []string `json:"members"`
@@ -215,8 +216,8 @@ type StalledLine struct {
 	State  State `json:"state"`
 	// Walk is the walk a line of the state Unheld is about (novox/hq issue 362).
 	Walk string `json:"walk,omitempty"`
-	// Waiting are the merge checks a line of the state Unanswered waits on, each as it reads — "mesh/repo-check
-	// never set", "mesh/merge-gate pending since <UTC time>" — so the controller's words name them without reading
+	// Waiting are the merge checks a line of the state Unanswered waits on, each as it reads — "mesh/check
+	// never set", "mesh/check pending since <UTC time>" — so the controller's words name them without reading
 	// Says (novox/hq issue 438).
 	Waiting []string `json:"waiting,omitempty"`
 	// Checks are the same merge checks as data — context, state, since when — so the controller says their times in
@@ -303,6 +304,10 @@ func (h *Holder) Recheck(id, why, by string) (string, error) {
 		h.mu.Unlock()
 		return "", fmt.Errorf("no delivery %q", id)
 	}
+	if d.judgedByCheck() {
+		h.mu.Unlock()
+		return "", checkerRefusal(id) // the lead's decision for issue 1302: the checker serves no ask
+	}
 	if d.State == Proposed {
 		// A proposed delivery's check is asked again when the build queue holds none of its head (issue 1274).
 		h.mu.Unlock()
@@ -670,6 +675,10 @@ func (h *Holder) Close(id, why string) (string, error) {
 // does not take spends nothing. Called under the lock; it unlocks.
 func (h *Holder) reask(d *Delivery, why string) (string, error) {
 	id := d.ID
+	if d.judgedByCheck() {
+		h.mu.Unlock()
+		return "", checkerRefusal(id)
+	}
 	trial := *d
 	trial.Transitions = nil
 	if _, err := Apply(&trial, EvReask, true, Facts{Now: h.Now(), By: byH2, Why: why}); err != nil {
@@ -46,7 +46,6 @@
    "seat:mesh-controller.delivery-backups-again",
    "seat:mesh-controller.delivery-walks",
    "seat:mesh-controller.delivery-check",
-    "seat:mesh-controller.forget-checks",
    "seat:mesh-controller.queue",
    "seat:mesh-controller.plans",
    "gitea.gitea_commit_statuses",
@@ -79,6 +78,7 @@
    "mesh-delivery.groups",
    "mesh-delivery.pulls",
    "mesh-delivery-teller.answers",
+    "mesh-delivery-checker.verdicts",
    "mesh-controller.assignments",
    "node-engine.have"
  ],
Author	SHA1	Message	Date
jschoubben	e53ac973e9	mesh-delivery-gate: stop asking the controller's forget-checks (issue 1318, the gate's part) The controller's forget-checks goes with the merge gate's checks (ADR 0503 §3) and 1318 removes the verb in the same group, so the gate must stop calling it first: a closed pull request is stopped and asks the controller nothing, and the manifest no longer invokes it. delivery-check stays for hq's base until R4g (the lead's decision for 1302).	2026-10-22 17:50:44 +02:00
jschoubben	f1f18bf2bd	mesh-delivery-gate: read mesh/check alone on a base that requires it (issue 1302, S1-S10) Once main requires mesh/check, the controller publishes no verdict for it and the gate, which moved deliveries on the controller's checked, would hold every pull request proposed. A head's mesh/check is now its verdict, from the forge's status event (gitea now sends the status's words) or its open pull requests. The Approve is asked only on the checker's verdict at exactly the heads the ask covers, so a member judged alone never passes its group; a group on mesh/check asks no composed check and owes no mesh/merge-gate; a member's mesh/check that changes withdraws the ask. Nothing is asked of the controller for such a base, and recheck refuses, naming checker_pull. hq's mesh/repo-check keeps today's path.	2026-10-22 17:50:25 +02:00
jschoubben	c41c968086	gitea: judge and write only the statuses a base requires, so merges go on mesh/check (issue 1301, S5-S7) Once main requires mesh/check, nothing writes mesh/merge-gate, and the merge tool, which judged on it, would refuse every merge. It now judges on the status the base requires: mesh/check's line names the trunk it judged, an out-of-date one is refused and nothing is asked (the checker re-checks on a trunk move, ADR 0447 §4); hq's mesh/repo-check is judged as before. The announcer, the verdict, a trunk's move and a build's start write the controller's two statuses only where a base still requires them, so hq keeps mesh/repo-check and no stale mesh/merge-gate appears anywhere else.	2026-10-22 17:49:53 +02:00
jschoubben	939475cb63	gitea: only the forge bridge writes mesh/check, through a tool of its own (issue 1301, S4) Once main requires mesh/check, a hand that set it could pass a merge past the checker, the gap issue 293 closed for the two statuses before it. gitea_commit_status now refuses mesh/check in every state, and the new gitea_check_status writes it alone; the bus grants that tool only to a module whose manifest invokes it, the forge bridge (the lead's choice A).	2026-10-22 17:49:53 +02:00
jschoubben	5e24deb0f1	gitea: require mesh/check in place of the two old statuses on every main the gate judges (issue 1301, S1-S3) ADR 0447 §1 has main require mesh/check alone. The repositories program now requires it in place of mesh/merge-gate and mesh/repo-check on every listed repository and on every other one whose main requires mesh/merge-gate, so the switch needs no hand-kept list (lead decisions L4, L11). A main requiring mesh/repo-check alone (hq) keeps it until issue 1296 (ADR 0503 §5).	2026-10-22 17:49:53 +02:00