Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

The gate composed 0 of 4 machines with the change and without, and passed every change: the store it
raised held each module's bus credential but no account for it (issue 203's refusal), no outward links
(so no filter could be composed), and refused settings the mesh holds. Now the account is minted with
its credential, the facts carry each machine's outward links (a stand-in for an older snapshot), the
mesh's layers are kept as held, and a withheld path keeps a path's shape. A machine the mesh composes
that the gate cannot raise makes the verdict an error, never a pass; the verdict alone is on stdout.

A merge-check.sh that passed on an agent's machine failed on the build seat: a newer gofmt, siblings at
a feature branch, another user. `mesh-controller check-here` runs builder.Check with the ask the
controller would make, from facts that now name the toolchains and the refs cloned beside; a failed
script is said by what failed. (novox/hq issues 282, 283)

cmd/mesh-controller/checks.go

@@ -241,21 +241,14 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 		if err != nil {
 			return link.BuildRequest{}, err
 		}
-		ref := current[e.Manifest.Module].Commit
-		if dir == "mesh-catalog" {
-			// The catalogue the mesh runs is in the snapshot, every manifest as it holds it; its checkout
-			// beside is what tests read its files from, so its main — what the next merge builds from.
-			ref = "main"
-		}
-		beside[dir] = link.CheckedOut{Repository: url, Ref: ref}
+		refs := besideRefs(dir, current[e.Manifest.Module].Commit)
+		beside[dir] = link.CheckedOut{Repository: url, Ref: refs[dir]}
 		if dir == "mesh-controller" {
-			// And its main, for a judge the running controller predates (Phase 5 rolling out).
-			beside["mesh-controller-main"] = link.CheckedOut{Repository: url, Ref: "main"}
-			// And the lab, whose replays of what the mesh runs every check runs; on the same forge.
+			beside["mesh-controller-main"] = link.CheckedOut{Repository: url, Ref: refs["mesh-controller-main"]}
 			if e.Source.Seat != "" {
 				if lab, err := clone(inventory.Source{Seat: e.Source.Seat, Repository: siblingOf(e.Source.Repository,
 					"mesh-lab")}); err == nil {
-					beside["mesh-lab"] = link.CheckedOut{Repository: lab, Ref: "main"}
+					beside["mesh-lab"] = link.CheckedOut{Repository: lab, Ref: refs["mesh-lab"]}
 				}
 			}
 		}
@@ -273,6 +266,22 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 	}, nil
 }
 
+// besideRefs is the ref each repository is cloned at beside a check, by the directory it is found under:
+// a core repository at the commit the mesh runs of the module built from it (`running`) — but the
+// catalogue, whose checkout beside is what tests read its files from, at its main, what the next merge
+// builds from; and beside the controller its main, for a judge the running controller predates, and the
+// lab's main, whose replays every check runs. **One rule, read by the check the controller asks for and by
+// the facts snapshot** (Facts.Beside), so a check run by hand clones what the build seat clones.
+func besideRefs(dir, running string) map[string]string {
+	switch dir {
+	case "mesh-catalog":
+		return map[string]string{dir: "main"}
+	case "mesh-controller":
+		return map[string]string{dir: running, "mesh-controller-main": "main", "mesh-lab": "main"}
+	}
+	return map[string]string{dir: running}
+}
+
 // siblingOf is another repository of the same owner: novox/mesh-controller → novox/mesh-lab.
 func siblingOf(repository, name string) string {
 	if cut := strings.LastIndex(repository, "/"); cut >= 0 {