mesh-issues: a milestone or commit link moves no issue and keeps no worker current (issue 1781)

The seed linked 188 issues at once and every one read as moved at the seed's minute, hiding when each really moved; on a worked issue the link also counted as its worker's activity. These links only place an issue, so last-moved and the worker's activity leave them out.
2026-10-26 19:12:12 +01:00
29 changed files with 93 additions and 503 deletions
@@ -35,7 +35,3 @@ modules/mesh-build-image/cmd/mesh-build-image/mesh-build-image
 /checks/paths/paths
 /modules/mesh-build-go/mesh-build-go
 /modules/mesh-delivery-gate/mesh-delivery-gate
-
-# Built by their modules' build step (issue 1577), never committed.
-modules/forticlient/cmd/forticlient-tools/forticlient-tools
-modules/networkmanager/uplink-tools
@@ -1,3 +0,0 @@
-module git.novox.be/novox/mesh-catalog/checks/nobinaries
-
-go 1.22
@@ -1,78 +0,0 @@
-// Package nobinaries refuses a compiled program under modules/ (issue 1577): it is build output, made by the module's build step,
-// and `go build` in a module's folder writes one beside go.mod where `git add -A` takes it.
-package nobinaries
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-)
-
-// Kind says what executable format the first bytes of a file are, or "" when they are none.
-func Kind(head []byte) string {
-	switch {
-	case bytes.HasPrefix(head, []byte("\x7fELF")):
-		return "ELF"
-	case bytes.HasPrefix(head, []byte("MZ")):
-		return "PE"
-	case bytes.HasPrefix(head, []byte{0xcf, 0xfa, 0xed, 0xfe}), bytes.HasPrefix(head, []byte{0xce, 0xfa, 0xed, 0xfe}),
-		bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xcf}), bytes.HasPrefix(head, []byte{0xfe, 0xed, 0xfa, 0xce}),
-		bytes.HasPrefix(head, []byte{0xca, 0xfe, 0xba, 0xbe}) && len(head) >= 8 && head[7] < 0x20 && head[6] == 0 && head[5] == 0 && head[4] == 0:
-		return "Mach-O"
-	}
-	return ""
-}
-
-// Files are the files of the catalogue's root that the change holds under modules/: the tracked ones when the root is a git
-// checkout (an ignored binary a local build left is not the change's), else every file there.
-func Files(root string) ([]string, error) {
-	cmd := exec.Command("git", "-C", root, "ls-files", "-z", "--", "modules")
-	if out, err := cmd.Output(); err == nil && len(out) > 0 {
-		var files []string
-		for _, f := range strings.Split(strings.TrimRight(string(out), "\x00"), "\x00") {
-			if _, err := os.Lstat(filepath.Join(root, f)); err == nil { // a file the change deletes is not there
-				files = append(files, f)
-			}
-		}
-		return files, nil
-	}
-	var files []string
-	err := filepath.WalkDir(filepath.Join(root, "modules"), func(p string, d os.DirEntry, err error) error {
-		if err != nil || d.IsDir() || !d.Type().IsRegular() {
-			return err
-		}
-		rel, _ := filepath.Rel(root, p)
-		files = append(files, rel)
-		return nil
-	})
-	return files, err
-}
-
-// Find names each file of files (paths from root) that is a compiled program, with its format.
-func Find(root string, files []string) ([]string, error) {
-	var found []string
-	for _, f := range files {
-		p := filepath.Join(root, f)
-		if st, err := os.Lstat(p); err != nil || !st.Mode().IsRegular() {
-			continue
-		}
-		fh, err := os.Open(p)
-		if err != nil {
-			return nil, err
-		}
-		head := make([]byte, 8)
-		n, err := io.ReadFull(fh, head)
-		fh.Close()
-		if err != nil && err != io.ErrUnexpectedEOF && err != io.EOF {
-			return nil, err
-		}
-		if k := Kind(head[:n]); k != "" {
-			found = append(found, fmt.Sprintf("%s (%s)", f, k))
-		}
-	}
-	return found, nil
-}
@@ -1,54 +0,0 @@
-package nobinaries
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestFindNamesEachCompiledProgramAndNothingElse(t *testing.T) {
-	root := t.TempDir()
-	files := map[string][]byte{
-		"modules/a/a":           []byte("\x7fELF\x02\x01\x01\x00rest"),
-		"modules/b/cmd/b/b.exe": []byte("MZ\x90\x00"),
-		"modules/c/c":           {0xcf, 0xfa, 0xed, 0xfe, 7, 0, 0, 1},
-		"modules/d/main.go":     []byte("package main\n"),
-		"modules/e/short":       []byte("\x7f"),
-		"modules/f/empty":       {},
-		"modules/g/Foo.class":   {0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 52}, // Java, not Mach-O
-	}
-	var names []string
-	for f, b := range files {
-		p := filepath.Join(root, f)
-		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(p, b, 0o644); err != nil {
-			t.Fatal(err)
-		}
-		names = append(names, f)
-	}
-	got, err := Find(root, names)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got) != 3 {
-		t.Fatalf("found %v; wanted modules/a/a, modules/b/cmd/b/b.exe and modules/c/c only", got)
-	}
-}
-
-// The catalogue's own tree holds no compiled program: a compiled program is build output, so remove it and add it to .gitignore.
-func TestTheCatalogueHoldsNoCompiledProgram(t *testing.T) {
-	root := filepath.Join("..", "..")
-	files, err := Files(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	found, err := Find(root, files)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, f := range found {
-		t.Errorf("%s: a compiled program is build output: remove it and add it to .gitignore (issue 1577)", f)
-	}
-}
@@ -1 +0,0 @@
-These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
@@ -174,27 +174,8 @@ function ignoreSecretSetting(cfg: Record<string, unknown>, key: string): void {
  console.error(`the setting ${key} is ignored: it comes from the vault`);
 }

-/** How long the forge may take to answer one request before it is cut and said (novox/hq issue 1577: a request for a 5 MB
- *  file never ended, and every read through the module timed out behind it). */
-export const FORGE_REQUEST_TIMEOUT_MS = 20_000;
-
-/** The most a tool's answer carries of one file: the bus's message bound is 1 MiB and a file travels as text (issue 1577). */
-export const MAX_FILE_BYTES = 512 * 1024;
-
-/** One request to the forge, cut at the limit and failing loud naming the request. */
-async function timedFetch(url: string, init: RequestInit, label: string, timeoutMs: number): Promise<Response> {
-  try {
-    return await fetch(url, { ...init, signal: init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs) });
-  } catch (err) {
-    if (err instanceof Error && err.name === "TimeoutError") throw new Error(`Gitea API ${label}: no answer in ${timeoutMs / 1000} s, the request was cut`);
-    throw err;
-  }
-}
-
 export class GiteaClient {
  readonly baseUrl: string;
-  /** The limit of one request; a test sets it short. */
-  requestTimeoutMs = FORGE_REQUEST_TIMEOUT_MS;
  private readonly tokens: TokenSource;

  /** A token given as a string is one somebody configured; a source decides for itself (token.ts). */
@@ -249,14 +230,14 @@ export class GiteaClient {

  private send(path: string, options: RequestInit, token: string): Promise<Response> {
    checkSentPath(path);
-    return timedFetch(`${this.baseUrl}/api/v1${path}`, {
+    return fetch(`${this.baseUrl}/api/v1${path}`, {
      ...options,
      headers: {
        "Content-Type": "application/json",
        Authorization: `token ${token}`,
        ...(options.headers as Record<string, string> | undefined),
      },
-    }, `${options.method ?? "GET"} ${path}`, this.requestTimeoutMs);
+    });
  }

  /** Generic authenticated API call — the escape hatch for endpoints without a dedicated method.
@@ -790,22 +771,6 @@ export class GiteaClient {
  /** One file's contents at a ref (default the repository's default branch), decoded. */
  async getFile(owner: string, repo: string, path: string, ref?: string): Promise<{ path: string; ref?: string; sha: string; size: number; content: string }> {
    const qs = ref ? `?ref=${encodeURIComponent(ref)}` : "";
-    // The size first, from the file's directory listing, which carries no content: a file over what an answer can carry is
-    // refused without its body being fetched (issue 1577). A file the listing does not show is asked for as before.
-    const clean = path.replace(/^\/+|\/+$/g, "");
-    pathSegments("file path", clean); // a path that is another path or user is refused before anything reaches the forge
-    const slash = clean.lastIndexOf("/");
-    const dir = slash < 0 ? "" : clean.slice(0, slash);
-    let listing: any[] | null = null;
-    try {
-      listing = await this.request<any[]>(`${repoPath(owner, repo)}/contents${dir ? "/" + pathSegments("file path", dir) : ""}${qs}`);
-    } catch (err) {
-      if (!(err instanceof Error) || !/: 404 /.test(err.message)) throw err;
-    }
-    const entry = Array.isArray(listing) ? listing.find((e) => e?.path === clean) : undefined;
-    if (entry && Number(entry.size) > MAX_FILE_BYTES) {
-      throw new Error(`the file is ${Number(entry.size)} bytes, over the ${MAX_FILE_BYTES / 1024} KiB a tool answer can carry; read it from a clone`);
-    }
    const f = await this.request<any>(`${repoPath(owner, repo)}/contents/${pathSegments("file path", path.replace(/^\/+|\/+$/g, ""))}${qs}`);
    if (!f || f.type !== "file") throw new Error(`Gitea API: ${path} is not a file`);
    const content = f.encoding === "base64" ? Buffer.from(String(f.content ?? ""), "base64").toString("utf8") : String(f.content ?? "");
@@ -975,14 +940,14 @@ export class GiteaAdmin {
   *  throwing on it — the caller decides which non-2xx codes are idempotent successes. Only an
   *  unexpected status becomes an error, and only where the caller says so. */
  private async request(path: string, options: RequestInit = {}): Promise<AdminResponse> {
-    const res = await timedFetch(`${this.baseUrl}/api/v1${path}`, {
+    const res = await fetch(`${this.baseUrl}/api/v1${path}`, {
      ...options,
      headers: {
        "Content-Type": "application/json",
        Authorization: this.authorization,
        ...(options.headers as Record<string, string> | undefined),
      },
-    }, `${options.method ?? "GET"} ${path}`, FORGE_REQUEST_TIMEOUT_MS);
+    });
    const text = await res.text();
    let body: any = null;
    if (text) {
@@ -1082,19 +1047,12 @@ export class GiteaAdmin {
    return true;
  }

-  /** What the forge gives an account on a repository, effective: none, read, write, admin or owner. It is the repository as
-   *  that account sees it (the site administrator acts as the account with `sudo`), so access through an organisation's team
-   *  counts. The collaborator endpoint is not used: it names only a collaborator's own permission, and says "read" of an
-   *  account that writes through a team (novox/hq issue 1945). */
+  /** What the forge itself says an account may do on a repository: none, read, write, admin or owner. */
  async repositoryPermission(owner: string, repo: string, user: string): Promise<string> {
-    const path = `${repoPath(owner, repo)}?sudo=${encodeURIComponent(user)}`;
+    const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}/permission`;
    const res = await this.request(path);
-    if (res.status === 404) return "none";
    if (res.status !== 200) GiteaAdmin.fail(path, res);
-    const p = res.body?.permissions;
-    if (p?.admin === true) return res.body?.owner?.login === user ? "owner" : "admin";
-    if (p?.push === true) return "write";
-    return p?.pull === true ? "read" : "none";
+    return String(res.body?.permission ?? "none");
  }

  /** Make an account a collaborator of a repository that reads only. The forge asks a repository's administrator for
@@ -1109,38 +1067,6 @@ export class GiteaAdmin {
    await this.addCollaborator(owner, repo, user, "write");
  }

-  /** The rule that applies to main in a repository, as its administrator reads it: a rule named main, else the first glob
-   *  rule covering main; null when none does. With the administrator's login. */
-  async mainRule(owner: string, repo: string): Promise<BranchProtection | null> {
-    const rules = await this.branchProtections(owner, repo);
-    return rules.find((r) => (r.rule_name ?? r.branch_name) === MAIN_BRANCH)
-      ?? rules.find((r) => ruleCovers(String(r.rule_name ?? r.branch_name ?? ""), MAIN_BRANCH)) ?? null;
-  }
-
-  /** Put an account on main's merge whitelist in a repository of a user, and nothing else (the operator, 2026-10-26:
-   *  write, the rule untouched). Only an existing rule whose merge whitelist is on is changed, and only its whitelist: the
-   *  account is added to the logins already there. Push, status checks, approvals and the administrator override stay as
-   *  the operator set them; with no rule, or the whitelist off, nothing is written (whoever writes may merge). Read back:
-   *  the forge drops a whitelist login that cannot write the repository and still answers success, so a whitelist read back
-   *  without the account fails loud. Answers the rule as the forge holds it after. With the administrator's login. */
-  async ensureMergerListed(owner: string, repo: string, account: string): Promise<{ changed: boolean; rule: BranchProtection | null }> {
-    const rule = await this.mainRule(owner, repo);
-    const listed = rule?.merge_whitelist_usernames ?? [];
-    if (!rule || rule.enable_merge_whitelist !== true || listed.includes(account)) return { changed: false, rule };
-    const name = String(rule.rule_name ?? rule.branch_name);
-    const path = `${repoPath(owner, repo)}/branch_protections/${encodeURIComponent(name)}`;
-    const res = await this.request(path, { method: "PATCH", body: JSON.stringify({ merge_whitelist_usernames: [...listed, account] }) });
-    if (res.status !== 200) GiteaAdmin.fail(path, res);
-    const after = (await this.branchProtections(owner, repo)).find((r) => (r.rule_name ?? r.branch_name) === name);
-    if (!after) throw new Error(`main's rule ${name} of ${owner}/${repo} was written, but the forge does not list it`);
-    const held = after.merge_whitelist_usernames ?? [];
-    if (after.enable_merge_whitelist === true && !held.includes(account)) {
-      throw new Error(`${account} was added to the merge whitelist of main's rule ${name} of ${owner}/${repo}, but the forge ` +
-        `holds [${held.join(", ")}]: it drops a login that cannot write the repository`);
-    }
-    return { changed: true, rule: after };
-  }
-
  private async addCollaborator(owner: string, repo: string, user: string, permission: "read" | "write"): Promise<void> {
    const path = `${repoPath(owner, repo)}/collaborators/${encodeURIComponent(user)}`;
    const res = await this.request(path, { method: "PUT", body: JSON.stringify({ permission }) });
@@ -1266,9 +1192,9 @@ export class GiteaAdmin {
   * other answer rejects (novox/hq issue 120).
   */
  async holdsTeamMember(org: string, team: string, username: string, password: string): Promise<boolean> {
-    const me = await timedFetch(`${this.baseUrl}/api/v1/user`, {
+    const me = await fetch(`${this.baseUrl}/api/v1/user`, {
      headers: { Authorization: "Basic " + Buffer.from(`${username}:${password}`).toString("base64") },
-    }, "GET /user", FORGE_REQUEST_TIMEOUT_MS);
+    });
    if (me.status === 401 || me.status === 403) return false;
    if (me.status !== 200) throw new Error(`Gitea GET /user as ${username}: ${me.status}`);
    const teams = await this.request(`/orgs/${encodeURIComponent(org)}/teams?limit=50`);
@@ -640,7 +640,6 @@ test("no tool's caller text becomes another path or another user: `..` and `?sud
  await tool("gitea_delete_branch").run({ ...repo, branch: "feat/x" });
  await tool("gitea_get_file").run({ ...repo, path: "modules/gitea/module.json" }).catch(() => undefined);
  assert.deepEqual(state.asked, ["DELETE /repos/novox/mesh-catalog/branches/feat/x",
-    "GET /repos/novox/mesh-catalog/contents/modules/gitea", // the file's size first (issue 1577)
    "GET /repos/novox/mesh-catalog/contents/modules/gitea/module.json"]);
 });

@@ -90,48 +90,3 @@ test("a pass pages until it reaches back past its floor, and no further", async
    server.close();
  }
 });
-
-// **One forge request never holds the others, and a file too big for an answer is not downloaded** (novox/hq issue 1577): a
-// request for a 4.9 MB file never ended and every read through the module timed out behind it.
-test("a request the forge never answers is cut at the limit and says which request", async () => {
-  const { GiteaClient } = await import("../client.ts");
-  const server = createServer((req) => { if (!req.url?.includes("fast")) return; });
-  await new Promise<void>((r) => server.listen(0, r));
-  const client = new GiteaClient(`http://127.0.0.1:${(server.address() as any).port}`, "t");
-  client.requestTimeoutMs = 150;
-  try {
-    const started = Date.now();
-    await assert.rejects(client.api("/repos/novox/hq/pulls"), /Gitea API GET \/repos\/novox\/hq\/pulls: no answer in 0\.15 s/);
-    assert.ok(Date.now() - started < 3000);
-  } finally {
-    server.closeAllConnections();
-    await new Promise<void>((r) => server.close(() => r()));
-  }
-});
-
-test("a file over 512 KiB is refused from its directory listing, and its body is never asked for", async () => {
-  const { GiteaClient } = await import("../client.ts");
-  const asked: string[] = [];
-  const server = createServer((req, res) => {
-    asked.push(req.url ?? "");
-    res.setHeader("Content-Type", "application/json");
-    if (req.url?.startsWith("/api/v1/repos/novox/hq/contents/bin?")) {
-      return res.end(JSON.stringify([{ path: "bin/big", type: "file", size: 5_000_000 }, { path: "bin/small", type: "file", size: 5 }]));
-    }
-    if (req.url?.startsWith("/api/v1/repos/novox/hq/contents/bin/small")) {
-      return res.end(JSON.stringify({ type: "file", encoding: "base64", sha: "s", size: 5, content: Buffer.from("hello").toString("base64") }));
-    }
-    res.statusCode = 404;
-    res.end("{}");
-  });
-  await new Promise<void>((r) => server.listen(0, r));
-  const client = new GiteaClient(`http://127.0.0.1:${(server.address() as any).port}`, "t");
-  try {
-    await assert.rejects(client.getFile("novox", "hq", "bin/big", "main"),
-      /the file is 5000000 bytes, over the 512 KiB a tool answer can carry; read it from a clone/);
-    assert.ok(!asked.some((u) => u.includes("/contents/bin/big")), asked.join("\n"));
-    assert.equal((await client.getFile("novox", "hq", "bin/small", "main")).content, "hello");
-  } finally {
-    await new Promise<void>((r) => server.close(() => r()));
-  }
-});
@@ -28,7 +28,6 @@ interface Team { id: number; name: string; units: any; members: Set<string> }

 interface ForgeRepo { owner: string; name: string; full: string; private: boolean; archived?: boolean; ownerVisibility: string; collaborators: Map<string, string> }
 const forgeRepos: ForgeRepo[] = [];
-const userRules = new Map<string, any>();
 const repoFaults = { refuse: new Set<string>(), permission: new Set<string>() };
 function addRepo(full: string, isPrivate: boolean, ownerVisibility = "public"): ForgeRepo {
  const [owner, name] = full.split("/");
@@ -85,7 +84,7 @@ function fakeForge() {
  const server = createServer(async (req, res) => {
    const url = new URL(req.url ?? "/", "http://fake");
    const p = url.pathname.replace(/^\/api\/v1/, "");
-    const me = url.searchParams.has("sudo") && isAdmin(who(req)) ? url.searchParams.get("sudo") : who(req);
+    const me = who(req);
    calls.push(`${req.method} ${p} as ${me}`);
    if (me === null) return json(res, 401, { message: "unauthorized" });

@@ -169,23 +168,6 @@ function fakeForge() {
      if (m[2] === "feat/unguarded") return json(res, 200, { name: m[2], protected: false });
      return json(res, 404, { message: "branch does not exist" });
    }
-    // A repository of a user: its rules are its administrator's (a site administrator, or a collaborator with admin).
-    m = p.match(/^\/repos\/(?!novox\/)([^/]+)\/([^/]+)\/branch_protections(?:\/(.*))?$/);
-    if (m) {
-      const key = `${m[1]}/${m[2]}`;
-      const repo = forgeRepos.find((r) => r.full === key);
-      if (!repo || !["admin", "owner"].includes(permissionOf(me, repo))) return json(res, 403, { message: "user should be an owner or a collaborator with admin write of a repository" });
-      if (req.method === "GET" && m[3] === undefined) return json(res, 200, userRules.has(key) ? [userRules.get(key)] : []);
-      // As gitea does: a whitelist login that cannot write the repository is dropped, and the write still answered.
-      const keep = (b: any) => (Array.isArray(b.merge_whitelist_usernames)
-        ? { ...b, merge_whitelist_usernames: b.merge_whitelist_usernames.filter((u: string) => ["write", "admin", "owner"].includes(permissionOf(u, repo))) } : b);
-      if (req.method === "PATCH" && m[3] === "main") {
-        if (!userRules.has(key)) return json(res, 404, { message: "branch protection does not exist" });
-        Object.assign(userRules.get(key), keep(await read(req)));
-        return json(res, 200, userRules.get(key));
-      }
-      if (req.method === "POST") { const b = keep(await read(req)); userRules.set(key, b); return json(res, 201, b); }
-    }
    // gitea's reqAdmin on the whole group: reading the rules is administration too.
    m = p.match(/^\/repos\/novox\/([^/]+)\/branch_protections(?:\/(.*))?$/);
    if (m) {
@@ -223,7 +205,6 @@ function fakeForge() {
    m = p.match(/^\/repos\/([^/]+)\/([^/]+)(?:\/collaborators\/([^/]+)(\/permission)?)?$/);
    if (m) {
      const repo = forgeRepos.find((r) => r.owner === decodeURIComponent(m![1]) && r.name === decodeURIComponent(m![2]));
-      if (repo && req.method === "GET" && !m[3] && url.searchParams.has("sudo") && repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
      if (!repo || permissionOf(me, repo) === "none") return json(res, 404, { message: "repository does not exist" });
      if (req.method === "GET" && !m[3]) {
        const mine = permissionOf(me, repo);
@@ -233,8 +214,7 @@ function fakeForge() {
      if (req.method === "GET" && m[4]) {
        if (repoFaults.permission.has(repo.full)) return json(res, 500, { message: "the forge is not well" });
        if (!isAdmin(me) && me !== user) return json(res, 403, { message: "only the user or an administrator" });
-        // As gitea answers: the collaborator's own permission, not what a team gives the account.
-        return json(res, 200, { permission: repo.collaborators.get(user) ?? "read" });
+        return json(res, 200, { permission: permissionOf(user, repo) });
      }
      if (req.method === "PUT" && !m[4]) {
        // gitea's reqAdmin: the repository's administration, which on a repository of another user the site administrator alone holds.
@@ -628,8 +608,7 @@ test("the merging account is given write on each repository the indexer's module
  await writes.take({ key: "car-hunter-2", op: "put", value: { v: 1, repository: "jschoubben/car-hunter" } });
  assert.equal(forge.calls.length, from, "a repository already written asks nothing more");
  const repo = (full: string) => forgeRepos.find((x) => x.full === full)!;
-  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "write", "a user's repository is written, not administered");
-  assert.equal(userRules.has("jschoubben/car-hunter"), false, "a repository with no rule for main is given none");
+  assert.equal(repo("jschoubben/car-hunter").collaborators.get(TOOLS_ACCOUNT), "write");
  assert.equal(repo("novox/hq").collaborators.size, 0, "the organisation's repository is written through its team, no collaborator");
  assert.equal((await client.getRepo("jschoubben", "car-hunter")).writes, true);
  assert.deepEqual(said, [{ type: WRITABLE_EVENT, body: { owner: "jschoubben", repo: "car-hunter", account: TOOLS_ACCOUNT } }]);
@@ -657,37 +636,9 @@ test("the merging account is given write on each repository the indexer's module
  assert.ok(!forge.calls.slice(puts).some((c) => c.startsWith("PUT ")), "no write is asked on a repository no module builds from");
  assert.equal(repo("jschoubben/dotfiles").collaborators.get(TOOLS_ACCOUNT), "read");
  repoFaults.refuse.clear();
-  // The operator's rule is left as set (the operator, 2026-10-26: "Write, rule untouched"): only mesh-tools is added to its
-  // merge whitelist; a status the mesh does not set and required approvals are said as blocking the mesh's merge, unchanged.
-  const operators = { rule_name: "main", enable_push: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"],
-    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "ci/external"], required_approvals: 2,
-    block_admin_merge_override: false, require_signed_commits: true, block_on_outdated_branch: true, block_on_rejected_reviews: true };
-  userRules.set("jschoubben/snake", structuredClone(operators));
  const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
  assert.deepEqual(after.granted, ["jschoubben/snake"]);
-  assert.equal(repo("jschoubben/snake").collaborators.get(TOOLS_ACCOUNT), "write");
-  assert.deepEqual(userRules.get("jschoubben/snake"), { ...operators, merge_whitelist_usernames: ["jschoubben", TOOLS_ACCOUNT] }, "only the whitelist changed");
-  assert.deepEqual(after.merge_whitelist, [{ repository: "jschoubben/snake", changed: true, listed: ["jschoubben", TOOLS_ACCOUNT] }]);
-  const blockedWhy = "writable, but main's rule blocks the mesh's merge: it requires the status ci/external, which the mesh does not set; " +
-    "it requires 2 approving reviews on the forge, which the gate does not give; it requires signed commits, which the mesh does not make; " +
-    "it refuses a branch behind main, which the mesh does not bring up to date; " +
-    "it refuses a merge after a review asked for changes, which the gate does not clear";
-  assert.deepEqual(after.merge_blocked, [{ repository: "jschoubben/snake", why: blockedWhy }]);
-  const again = await unwritableTool.run({}) as any;
-  assert.deepEqual([again.unwritable, again.merge_blocked], [[], [{ repository: "jschoubben/snake", why: blockedWhy }]]);
-  const writesBefore = forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length;
-  assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_whitelist[0].changed, false);
-  assert.equal(forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length, writesBefore, "a listed account is not written again");
-  // The mesh's own statuses never block: a rule requiring only them, with mesh-tools listed, is not reported.
-  userRules.set("jschoubben/snake", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT],
-    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "mesh/repo-check"] });
-  assert.deepEqual(((await unwritableTool.run({})) as any).merge_blocked, []);
-  assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_blocked, []);
-  // The forge drops a whitelist login that cannot write and still answers 200: the whitelist is read back and that fails loud.
-  userRules.set("jschoubben/dotfiles", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"] });
-  await assert.rejects(GiteaAdmin.fromEnv(env).ensureMergerListed("jschoubben", "dotfiles", TOOLS_ACCOUNT),
-    /mesh-tools was added to the merge whitelist of main's rule main of jschoubben\/dotfiles, but the forge holds \[jschoubben\]: it drops a login that cannot write/);
-  userRules.delete("jschoubben/dotfiles");
+  assert.deepEqual(((await unwritableTool.run({})) as any).unwritable, []);
  // A module gone from the indexer leaves its repository out of the delivered list.
  await writes.take({ key: "snake", op: "delete" });
  assert.deepEqual(writes.delivered(), ["jschoubben/car-hunter", "novox/hq"]);
@@ -374,7 +374,7 @@ function allGiteaTools(gitea: GiteaClient, admin?: () => GiteaAdmin): ToolDefini
    // ---- Contents and branches ----
    {
      name: "gitea_get_file",
-      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch). Refuses a file over 512 KiB, which a tool answer cannot carry: read it from a clone.",
+      description: "One file's contents from a repository, decoded, at a branch, tag or commit (default the repository's default branch).",
      input: {
        owner: { type: "string", description: "the repository owner" },
        repo: { type: "string", description: "the repository name" },
@@ -18,18 +18,10 @@
 // `repo.writable` {owner, repo, account}: mesh-delivery-gate, which does not ask the operator's Approve of a pull request
 // whose merge the forge would refuse, reads that repository again on it.
 //
-// **A repository of a user is written, and main's rule is left as the operator set it** (the operator, 2026-10-26, asked
-// "Write, rule untouched"): the account is a write collaborator there, and only added to main's merge whitelist when that
-// rule keeps one (client.ts ensureMergerListed). What else in main's rule stops the mesh's merge (a status the mesh does not
-// set, approvals the gate does not give) is changed by nobody but said: both tools list such a repository as writable, but
-// blocked, with why (merge_blocked).
-//
 // Not taken away: a repository whose last module goes from the indexer keeps its collaborator until a hand removes it;
 // gitea_unwritable_repos and gitea_grant_write say the delivered list as it is now.

 import type { ForgeRepository } from "./client.js";
-import type { BranchProtection } from "./protection.js";
-import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT } from "./pulls.js";

 /** The indexer's state this module reads: one key per registered module, its value naming the repository. */
 export const INDEXER_MODULES = "mesh-delivery-indexer.modules";
@@ -42,35 +34,8 @@ export interface WriteForge {
  repository(owner: string, repo: string): Promise<ForgeRepository | null>;
  repositoryPermission(owner: string, repo: string, user: string): Promise<string>;
  addWriteCollaborator(owner: string, repo: string, user: string): Promise<void>;
-  mainRule(owner: string, repo: string): Promise<BranchProtection | null>;
-  ensureMergerListed(owner: string, repo: string, account: string): Promise<{ changed: boolean; rule: BranchProtection | null }>;
 }

-/** The statuses every pull request the mesh delivers carries (mesh-delivery's checks); a rule requiring another blocks. */
-const MESH_CONTEXTS = new Set([CHECK_STATUS, CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
-
-/** What in main's rule stops the mesh's merge, in words; empty when nothing does. Changed by nobody here: the operator's. */
-export function mergeBlocks(rule: BranchProtection | null, account: string): string[] {
-  if (!rule) return [];
-  const blocks: string[] = [];
-  if (rule.enable_merge_whitelist === true && !(rule.merge_whitelist_usernames ?? []).includes(account)) {
-    blocks.push(`its merge whitelist [${(rule.merge_whitelist_usernames ?? []).join(", ")}] leaves out ${account} (gitea_grant_write adds it)`);
-  }
-  if (rule.enable_status_check === true) {
-    for (const c of rule.status_check_contexts ?? []) {
-      if (!MESH_CONTEXTS.has(c)) blocks.push(`it requires the status ${c}, which the mesh does not set`);
-    }
-  }
-  const approvals = Number(rule.required_approvals ?? 0);
-  if (approvals > 0) blocks.push(`it requires ${approvals} approving review${approvals === 1 ? "" : "s"} on the forge, which the gate does not give`);
-  if (rule.require_signed_commits === true) blocks.push("it requires signed commits, which the mesh does not make");
-  if (rule.block_on_outdated_branch === true) blocks.push("it refuses a branch behind main, which the mesh does not bring up to date");
-  if (rule.block_on_rejected_reviews === true) blocks.push("it refuses a merge after a review asked for changes, which the gate does not clear");
-  return blocks;
-}
-
-const blockedWhy = (blocks: string[]): string => `writable, but main's rule blocks the mesh's merge: ${blocks.join("; ")}`;
-
 /** One change of the indexer's modules state, as the SDK's state watch hands it. */
 export interface ModulesChange {
  key: string;
@@ -86,13 +51,8 @@ export interface Written {
  delivered: string[];
  /** Made writable now, each read back from the forge. */
  granted: string[];
-  /** Written already (a collaborator of a user's repository), or written through the organisation's team. */
+  /** Written already (the organisation's team, or a collaborator that writes). */
  already: string[];
-  /** Each repository of a user: whether the account was added to main's merge whitelist now, and the whitelist read back
-   *  (null: main's rule keeps no whitelist, or there is no rule, and whoever writes may merge). */
-  merge_whitelist: { repository: string; changed: boolean; listed: string[] | null }[];
-  /** Writable, but main's rule (the operator's, left as set) stops the mesh's merge, and why. */
-  merge_blocked: { repository: string; why: string }[];
  /** The forge refused, in its own words; or the repository is the organisation's, whose team should write it. */
  refused: { repository: string; why: string }[];
  /** Repositories the account cannot write that are left so, and why: they build no registered module. */
@@ -158,7 +118,7 @@ export class DeliveredWrites {
        "(the watch is not granted or not answered); nothing is granted");
    }
    const delivered = this.delivered();
-    const result: Written = { account: this.account, delivered, granted: [], already: [], merge_whitelist: [], merge_blocked: [], refused: [], left_read_only: [] };
+    const result: Written = { account: this.account, delivered, granted: [], already: [], refused: [], left_read_only: [] };
    const named = only && only.length ? only.map((x) => String(x).trim()) : null;
    const targets: string[] = [];
    for (const full of named ?? delivered) {
@@ -180,55 +140,36 @@ export class DeliveredWrites {
        result.refused.push({ repository: full, why: `its permission could not be read — ${said(err)}` });
        continue;
      }
+      if (WRITES.has(permission)) {
+        this.writable.add(full);
+        result.already.push(full);
+        continue;
+      }
      if (owner === this.org) {
-        if (WRITES.has(permission)) {
-          this.writable.add(full);
-          result.already.push(full);
-          continue;
-        }
        // The organisation's repositories are written through its team (tools-account.ts), never a collaborator.
        result.refused.push({ repository: full, why: `a repository of ${this.org}, which ${this.account} writes through the ` +
          `team ${this.org}/${this.account}; the forge gives it "${permission}", so the team is not as it should be (it is ` +
          "set again at the next mint of the tools' token)" });
        continue;
      }
-      // A repository of a user: the account writes it, and is put on main's merge whitelist when the rule keeps one.
-      let changed = false;
-      if (!WRITES.has(permission)) {
-        try {
-          await this.forge.addWriteCollaborator(owner, name, this.account);
-        } catch (err) {
-          result.refused.push({ repository: full, why: said(err) });
-          continue;
-        }
-        let after: string;
-        try {
-          after = await this.forge.repositoryPermission(owner, name, this.account);
-        } catch (err) {
-          result.refused.push({ repository: full, why: `granted, but its permission could not be read back — ${said(err)}` });
-          continue;
-        }
-        if (!WRITES.has(after)) {
-          result.refused.push({ repository: full, why: `the grant was answered, but the forge still gives ${this.account} "${after}"` });
-          continue;
-        }
-        changed = true;
-      }
      try {
-        const { changed: listedNow, rule } = await this.forge.ensureMergerListed(owner, name, this.account);
-        result.merge_whitelist.push({ repository: full, changed: listedNow,
-          listed: rule?.enable_merge_whitelist === true ? (rule.merge_whitelist_usernames ?? []) : null });
-        const blocks = mergeBlocks(rule, this.account);
-        if (blocks.length > 0) result.merge_blocked.push({ repository: full, why: blockedWhy(blocks) });
+        await this.forge.addWriteCollaborator(owner, name, this.account);
      } catch (err) {
-        result.refused.push({ repository: full, why: `${this.account} writes it, but could not be put on main's merge whitelist — ${said(err)}` });
+        result.refused.push({ repository: full, why: said(err) });
+        continue;
+      }
+      let after: string;
+      try {
+        after = await this.forge.repositoryPermission(owner, name, this.account);
+      } catch (err) {
+        result.refused.push({ repository: full, why: `granted, but its permission could not be read back — ${said(err)}` });
+        continue;
+      }
+      if (!WRITES.has(after)) {
+        result.refused.push({ repository: full, why: `the grant was answered, but the forge still gives ${this.account} "${after}"` });
        continue;
      }
      this.writable.add(full);
-      if (!changed) {
-        result.already.push(full);
-        continue;
-      }
      result.granted.push(full);
      await this.emit(WRITABLE_EVENT, { owner, repo: name, account: this.account }).catch((err) =>
        this.log(`${this.account} writes ${full} now, and that could not be said on the bus — ${said(err)}`));
@@ -251,12 +192,10 @@ export class DeliveredWrites {
  }

  /** Every delivered repository the account cannot write, as the forge says now, and why. */
-  async unwritable(): Promise<{ account: string; delivered: number; unwritable: { repository: string; permission: string; why: string }[];
-    merge_blocked: { repository: string; why: string }[] }> {
+  async unwritable(): Promise<{ account: string; delivered: number; unwritable: { repository: string; permission: string; why: string }[] }> {
    if (!this.heard) throw new Error(`which repositories build a registered module is not known yet: ${INDEXER_MODULES} has not been read`);
    const delivered = this.delivered();
    const out: { repository: string; permission: string; why: string }[] = [];
-    const blocked: { repository: string; why: string }[] = [];
    for (const full of delivered) {
      const [owner, name] = split(full);
      let permission: string;
@@ -266,21 +205,12 @@ export class DeliveredWrites {
        out.push({ repository: full, permission: "unknown", why: `the forge did not answer ${this.account}'s permission on it — ${said(err)}` });
        continue;
      }
-      if (WRITES.has(permission)) {
-        if (owner === this.org) continue; // the organisation's main rules are the mesh's own (mainrules.ts)
-        try {
-          const blocks = mergeBlocks(await this.forge.mainRule(owner, name), this.account);
-          if (blocks.length > 0) blocked.push({ repository: full, why: blockedWhy(blocks) });
-        } catch (err) {
-          blocked.push({ repository: full, why: `writable, but main's rule could not be read — ${said(err)}` });
-        }
-        continue;
-      }
+      if (WRITES.has(permission)) continue;
      const modules = [...this.modules].filter(([, r]) => r === full).map(([m]) => m).sort();
      out.push({ repository: full, permission, why: `builds ${modules.join(", ")}, and the forge gives ${this.account} ` +
        `"${permission}" on it: its commit status and its merge are refused until gitea_grant_write grants it` });
    }
-    return { account: this.account, delivered: delivered.length, unwritable: out, merge_blocked: blocked };
+    return { account: this.account, delivered: delivered.length, unwritable: out };
  }
 }

@@ -294,19 +224,14 @@ export function writeTools(writes: () => DeliveredWrites): Tool[] {
      description: "Every repository that builds a registered module (the indexer's modules, read over the bus) on which " +
        "the mesh's merging forge account (mesh-tools, which sets commit statuses and merges) cannot write, with the " +
        "permission the forge gives it there and why: such a pull request can be checked but never merged, and the " +
-        "delivery gate does not ask its Approve. Empty when it writes every one. Its merge_blocked lists each repository of " +
-        "a user it writes whose main's rule (the operator's, left as set) still stops the mesh's merge: a merge whitelist " +
-        "without it, a required status the mesh does not set, required approving reviews. Read with the site administrator's login.",
+        "delivery gate does not ask its Approve. Empty when it writes every one. Read with the site administrator's login.",
      input: {},
      run: async () => writes().unwritable(),
    },
    {
      name: "gitea_grant_write",
-      description: "Give the mesh's merging forge account (mesh-tools) write, as a collaborator, on every repository of a " +
-        "user that builds a registered module, or on the repositories named (each must build one). Main's rule there is left " +
-        "as the operator set it; only when it keeps a merge whitelist is mesh-tools added to it, read back (merge_whitelist). " +
-        "What else in that rule stops the mesh's merge (a required status the mesh does not set, required approving reviews) " +
-        "is changed by nobody and said in merge_blocked. " +
+      description: "Give the mesh's merging forge account (mesh-tools) write, as a collaborator, on every repository that " +
+        "builds a registered module and that it cannot write now, or on the repositories named (each must build one). " +
        "The module does this itself at its start and when a module of a new repository is registered; this is the same " +
        "act by hand, such as when a merge or a commit status was refused 403. A repository of the organisation novox " +
        "is written through its team and needs nothing. Answers what was granted (each read back from the forge), what " +
@@ -42,13 +42,11 @@ type FetchResult struct {
 	// head onto it, the paths the merge changes, and the tree of each module directory (a directory holding a
 	// module.json) in the merge. A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the
 	// files, and the workspace is left at the trunk commit.
-	Base      string   `json:"base,omitempty"`
-	Merge     string   `json:"merge,omitempty"`
-	Conflicts []string `json:"conflicts,omitempty"`
-	Changed   []string `json:"changed,omitempty"`
-	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
-	Programs *[]buildstep.Program            `json:"programs,omitempty"`
-	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Base      string                          `json:"base,omitempty"`
+	Merge     string                          `json:"merge,omitempty"`
+	Conflicts []string                        `json:"conflicts,omitempty"`
+	Changed   []string                        `json:"changed,omitempty"`
+	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 	// Beside are the sibling repositories placed as plain directories under the workspace's beside directory, which
 	// build_go_test hands to the tests as MESH_CHECK_BESIDE (ADR 0484 clause 4).
 	Beside []Sibling `json:"beside,omitempty"`
@@ -41,9 +41,6 @@ func (m *Module) merge(ctx context.Context, res *FetchResult, tree, remote, base
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
-	if mr.Merge != "" {
-		res.Programs = &mr.Programs
-	}
 	if res.Merge == "" {
 		return nil
 	}
@@ -77,7 +77,7 @@ func TestFetchWithABaseMergesAndAnswersThePreview(t *testing.T) {
 		t.Fatal(err)
 	}
 	if res.Base != baseSHA || res.Merge != mergeSHA || res.Commit != commitSHA || len(res.Conflicts) != 0 ||
-		strings.Join(res.Changed, ",") != "a.go,modules/m/main.go" || res.Programs == nil || len(*res.Programs) != 0 { // 1577: a merge says it found no program
+		strings.Join(res.Changed, ",") != "a.go,modules/m/main.go" {
 		t.Errorf("result = %s", st.Result)
 	}
 	mt, ok := res.Trees["modules/m"]
@@ -3,7 +3,7 @@ module meshbuildgo
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
@@ -1,9 +1,5 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
@@ -31,15 +31,13 @@ const ForgeAlias = "mesh-forge"
 // files in conflict, the paths the merge changes and the tree of each module directory). A head that does not
 // merge cleanly is an answer: Merge is empty, Conflicts names the files, and the workspace is left at the trunk.
 type FetchResult struct {
-	Workspace string   `json:"workspace"`
-	Commit    string   `json:"commit"`
-	Base      string   `json:"base,omitempty"`
-	Merge     string   `json:"merge,omitempty"`
-	Conflicts []string `json:"conflicts,omitempty"`
-	Changed   []string `json:"changed,omitempty"`
-	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
-	Programs *[]buildstep.Program            `json:"programs,omitempty"`
-	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Workspace string                          `json:"workspace"`
+	Commit    string                          `json:"commit"`
+	Base      string                          `json:"base,omitempty"`
+	Merge     string                          `json:"merge,omitempty"`
+	Conflicts []string                        `json:"conflicts,omitempty"`
+	Changed   []string                        `json:"changed,omitempty"`
+	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 }

 func (m *Module) fetchTool() StepTool {
@@ -129,9 +127,6 @@ func (m *Module) merge(ctx context.Context, res *FetchResult, tree, remote, base
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
-	if mr.Merge != "" {
-		res.Programs = &mr.Programs
-	}
 	if res.Merge == "" {
 		return nil
 	}
@@ -3,7 +3,7 @@ module meshbuildimage
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,9 +1,5 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -51,13 +51,11 @@ type FetchResult struct {
 	// commit, the merge commit of the head onto it, the paths the merge changes and the tree of each module directory.
 	// A head that does not merge cleanly is an answer: Merge is empty, Conflicts names the files, and the workspace is
 	// left at the trunk commit with nothing installed.
-	Base      string   `json:"base,omitempty"`
-	Merge     string   `json:"merge,omitempty"`
-	Conflicts []string `json:"conflicts,omitempty"`
-	Changed   []string `json:"changed,omitempty"`
-	// Programs are the changed files that are compiled programs (issue 1577); a merge answers it, a pointer to an empty list when there are none, absent for a fetch that made no merge.
-	Programs *[]buildstep.Program            `json:"programs,omitempty"`
-	Trees    map[string]buildstep.ModuleTree `json:"trees,omitempty"`
+	Base      string                          `json:"base,omitempty"`
+	Merge     string                          `json:"merge,omitempty"`
+	Conflicts []string                        `json:"conflicts,omitempty"`
+	Changed   []string                        `json:"changed,omitempty"`
+	Trees     map[string]buildstep.ModuleTree `json:"trees,omitempty"`
 	// Group is the group's package the fetch packed and served to the TypeScript members (the call's `package`):
 	// "<name>@<version> <integrity>".
 	Group string `json:"group,omitempty"`
@@ -27,9 +27,6 @@ func (m *Module) merge(ctx context.Context, run forgekey.Runner, res *FetchResul
 	}
 	res.Base = mr.Base
 	res.Conflicts, res.Merge, res.Changed = mr.Conflicts, mr.Merge, mr.Changed
-	if mr.Merge != "" {
-		res.Programs = &mr.Programs
-	}
 	if res.Merge == "" {
 		return nil
 	}
@@ -3,7 +3,7 @@ module meshbuildnode
 go 1.26.0

 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f
 	github.com/distribution/distribution/v3 v3.1.2
 	github.com/nats-io/nats.go v1.54.0
 )
@@ -1,9 +1,5 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f h1:GYLCvz2x+JNUOTbXzyh2QwzX0sTzvRlXR7lGocWjk3A=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142629-ff81bdf8cc8f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f h1:LwefZSIEVjhdhgx22kgL+eJFfD9VVGJblYNPUCh1yZQ=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026175935-22bc4dc8ef4f/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397 h1:ozuxlh0fOlq1c3mJ4DLNPgQQ+AIaqd6nWd5CQaEe/r4=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026184717-fe11db929397/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
 github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
@@ -2,6 +2,7 @@ package main

 import (
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 )
@@ -26,6 +27,22 @@ func TestListSaysWhenEachIssueMovedAndKeepsTheLinkedOnes(t *testing.T) {
 	if _, err := h.Link(LinkAsk{Number: quiet, Kind: LinkDesign, Target: "03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md"}); err != nil {
 		t.Fatal(err)
 	}
+	// Issue 1781: a milestone or a commit link places the issue and moves nothing, nor keeps its worker current.
+	if _, err := h.milestoneSet("lead@shanks", MilestoneSetAsk{Design: 47, ID: "R6", Outcome: "x"}); err != nil {
+		t.Fatal(err)
+	}
+	h.fixing(t, noted)
+	worked, _ := h.Get(noted)
+	clock = clock.Add(time.Hour)
+	for _, l := range []LinkAsk{{Number: noted, Kind: LinkMilestone, Target: "47/R6"},
+		{Number: noted, Kind: LinkCommit, Target: "mesh-catalog@" + strings.Repeat("a", 40)}} {
+		if _, err := h.link("seed@shanks", l); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if after, _ := h.Get(noted); !after.Worker.Active.Equal(worked.Worker.Active) {
+		t.Fatalf("a milestone link kept the worker current: %v, was %v", after.Worker.Active, worked.Worker.Active)
+	}
 	start := time.Date(2026, 10, 26, 12, 0, 0, 0, time.UTC)
 	for _, c := range []struct {
 		name   string
@@ -35,7 +52,7 @@ func TestListSaysWhenEachIssueMovedAndKeepsTheLinkedOnes(t *testing.T) {
 		refuse bool
 	}{
 		{"numbers say moved", ListAsk{Numbers: []uint64{quiet, noted, linked}}, []uint64{quiet, noted, linked},
-			[]time.Time{start.Add(2 * time.Hour), start.Add(time.Hour), start.Add(2 * time.Hour)}, false},
+			[]time.Time{start.Add(2 * time.Hour), start.Add(2 * time.Hour), start.Add(2 * time.Hour)}, false},
 		{"linked to a decision", ListAsk{Linked: "decision:0493"}, []uint64{linked}, nil, false},
 		{"linked to a design", ListAsk{Linked: " design:03-DESIGN/01-to-be/47-delivery-from-commit-to-delivered.md"}, []uint64{quiet}, nil, false},
 		{"linked and numbers together", ListAsk{Linked: "decision:0493", Numbers: []uint64{quiet, noted}}, nil, nil, false},
@@ -675,7 +675,9 @@ func (t *Tracker) link(by string, a LinkAsk) (*Linked, error) {
 					return fmt.Errorf("issue %d already has the %s link to %s", is.Number, kind, target)
 				}
 				is.Links = append(is.Links[:i:i], is.Links[i+1:]...)
-				touch(is, by, at)
+				if !placesOnly(kind) {
+					touch(is, by, at)
+				}
 				return nil
 			}
 		}
@@ -692,7 +694,9 @@ func (t *Tracker) link(by string, a LinkAsk) (*Linked, error) {
 			return fmt.Errorf("issue %d has %d links, the most one issue keeps", is.Number, MostLinks)
 		}
 		is.Links = append(is.Links, Link{Kind: kind, Target: target, By: by, At: at})
-		touch(is, by, at)
+		if !placesOnly(kind) {
+			touch(is, by, at)
+		}
 		return nil
 	})
 	if err != nil {
@@ -768,7 +772,7 @@ type Row struct {
 }

 // lastMoved is when an issue last changed, as its own record says: the latest of its opening, its closing, its
-// notes, its links, its worker's start and last act, its import and what the delivery last said of each fix.
+// notes, its links but those that only place it, its worker's start and last act, its import and what the delivery last said of each fix.
 func lastMoved(is *Issue) time.Time {
 	at := is.Opened
 	later := func(t time.Time) {
@@ -783,7 +787,9 @@ func lastMoved(is *Issue) time.Time {
 		later(n.At)
 	}
 	for _, l := range is.Links {
-		later(l.At)
+		if !placesOnly(l.Kind) {
+			later(l.At)
+		}
 	}
 	if w := is.Worker; w != nil {
 		later(w.Since)
@@ -798,6 +804,10 @@ func lastMoved(is *Issue) time.Time {
 	return at
 }

+// placesOnly says a link of this kind only places the issue (its milestone) or names a commit that fixed it: no work
+// on it, so it neither moves the issue nor keeps its worker current (issue 1781: the seed linked 188 issues at once).
+func placesOnly(kind string) bool { return kind == LinkMilestone || kind == LinkCommit }
+
 // checkLinked is a list's linked filter, kind:target, said the one way a link of that kind is kept.
 func checkLinked(s string) (kind, target string, err error) {
 	k, t, ok := strings.Cut(strings.TrimSpace(s), ":")
@@ -168,8 +168,6 @@ func (k *KB) Progress(a ProgressAsk) (*Progress, error) {
 	if err != nil {
 		return nil, err
 	}
-	// A cut takes the warnings from the last: the calls that failed are said before the answers that did not parse.
-	callsFirst(p.Warnings)
 	fitProgress(p, boundOf(a.Bound))
 	return p, nil
 }
@@ -837,21 +835,8 @@ func movedSay(t *time.Time) string {
 	return " · moved " + when(t)
 }

-// callsFirst puts the warnings of calls that failed before those of answers that did not parse, in place.
-func callsFirst(w []string) {
-	sort.SliceStable(w, func(i, j int) bool {
-		return !strings.Contains(w[i], " answered something else") && strings.Contains(w[j], " answered something else")
-	})
-}
-
 // fitProgress keeps an answer within its bound: the items go first, then the tree's last lines, saying what was cut.
-// A minimal answer never carries the items: its tree says the same, one line per milestone, so leaving them out is how
-// the minimal form is made (the items of design 47 alone passed 8192 bytes) and no cut. A detailed answer's items, and
-// everything else that goes, are said in cut.
 func fitProgress(p *Progress, bound int) {
-	if p.Detail == DetailMinimal && p.Tree != "" {
-		p.Items = nil
-	}
 	if size(p) <= bound {
 		return
 	}
@@ -306,23 +306,12 @@ func TestProgressOfADesignMinimalAndDetailed(t *testing.T) {
 	if len(raw) > DefaultBound || p.Detail != DetailMinimal || !strings.Contains(p.Source, "the issue tracker's milestone records of design 47") {
 		t.Fatalf("%d bytes, %s, %s", len(raw), p.Detail, p.Source)
 	}
-	if p.Cut != "" || len(p.Items) != 0 {
-		t.Errorf("a minimal answer leaves the items to its tree and is not a cut: cut %q, %d items", p.Cut, len(p.Items))
-	}
-	warns := []string{"mesh-delivery.show a answered something else: x", "issue-tracker.get 1: refused", "the tracker did not name 2", "issue-tracker.get 3 answered something else: y"}
-	callsFirst(warns)
-	if strings.Join(warns, "|") != "issue-tracker.get 1: refused|the tracker did not name 2|mesh-delivery.show a answered something else: x|issue-tracker.get 3 answered something else: y" {
-		t.Errorf("call failures do not come first: %q", warns)
-	}
 	if seats.asked["seat:issue-tracker.list"] != 1 || seats.asked["seat:mesh-delivery.deliveries"] != 0 || seats.asked["seat:issue-tracker.get"] != 0 {
 		t.Fatalf("minimal asked %v", seats.asked)
 	}
 	if w := strings.Join(p.Warnings, "\n"); !strings.Contains(w, "the tracker neither answered nor named missing") || !strings.Contains(w, "973, 525") {
 		t.Errorf("a row the tracker did not answer is not said: %v", p.Warnings)
 	}
-	if big, _ := k.Progress(ProgressAsk{Of: "design 47", Bound: 8192}); big.Cut != "" || big.Tree != p.Tree {
-		t.Errorf("a minimal answer at bound 8192 is cut: %q", big.Cut)
-	}
 	lines := strings.Split(p.Tree, "\n")
 	if !strings.HasPrefix(lines[0], "✗ design 47 · Delivery: from a commit to delivered — ") {
 		t.Fatalf("first line %q", lines[0])
				`@@ -1 +0,0 @@`
				`These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).`