Raise the mesh as it is in the gate, call a baseline that does not compose an error, and let a check run by hand as the seat runs it

The gate composed 0 of 4 machines with the change and without, and passed every change: the store it
raised held each module's bus credential but no account for it (issue 203's refusal), no outward links
(so no filter could be composed), and refused settings the mesh holds. Now the account is minted with
its credential, the facts carry each machine's outward links (a stand-in for an older snapshot), the
mesh's layers are kept as held, and a withheld path keeps a path's shape. A machine the mesh composes
that the gate cannot raise makes the verdict an error, never a pass; the verdict alone is on stdout.

A merge-check.sh that passed on an agent's machine failed on the build seat: a newer gofmt, siblings at
a feature branch, another user. `mesh-controller check-here` runs builder.Check with the ask the
controller would make, from facts that now name the toolchains and the refs cloned beside; a failed
script is said by what failed. (novox/hq issues 282, 283)

cmd/mesh-controller/facts.go

@@ -18,6 +18,7 @@ import (
 
 	"github.com/novox/mesh-controller/internal/artifacts"
 	"github.com/novox/mesh-controller/internal/broker"
+	"github.com/novox/mesh-controller/internal/builder"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
@@ -236,6 +237,28 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 		scrub.Site(o.Site)
 	}
 
+	// What a merge check runs in and reads beside it, as the build seat would be asked for it.
+	if held, err := inv.Held(ctx); err == nil {
+		for language, reference := range builder.ToolchainsOf(held) {
+			if f.Versions.Toolchains == nil {
+				f.Versions.Toolchains = map[string]string{}
+			}
+			f.Versions.Toolchains[language] = catalogue.Recorded(reference)
+		}
+	} else {
+		return snapshot.Facts{}, err
+	}
+	for _, e := range entries {
+		if dir, core := coreModules[e.Manifest.Module]; core && !e.Provided && e.Source.Repository != "" {
+			for d, ref := range besideRefs(dir, current[e.Manifest.Module].Commit) {
+				if f.Beside == nil {
+					f.Beside = map[string]string{}
+				}
+				f.Beside[d] = ref
+			}
+		}
+	}
+
 	if c, ok := current["mesh-controller"]; ok {
 		f.Controller.Commit = c.Commit
 	}
@@ -263,6 +286,13 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 			return snapshot.Facts{}, err
 		}
 		m.Architecture, m.Kernel = reported.Architecture, reported.Kernel
+		outward, err := inv.OutwardLinksOf(ctx, n.Name)
+		if err != nil {
+			return snapshot.Facts{}, err
+		}
+		for _, l := range outward {
+			m.OutwardLinks = append(m.OutwardLinks, scrub.Text(l))
+		}
 		capabilities, err := inv.Profile(ctx, n.Name)
 		if err != nil {
 			return snapshot.Facts{}, err
@@ -426,7 +456,10 @@ func declarationFacts(ctx context.Context, open *stores, node string, gens map[s
 	if body, err := declared.Body(); err == nil {
 		d.Digest = fmt.Sprintf("sha256:%x", sha256.Sum256(body))
 	}
-	d.Resources = resourceNames(declared.Resources)
+	// Scrubbed like every other word: a resource is named after the machine a grant is for.
+	for _, r := range resourceNames(declared.Resources) {
+		d.Resources = append(d.Resources, scrub.Text(r))
+	}
 	for module, why := range declared.leftOutWhy {
 		if d.LeftOut == nil {
 			d.LeftOut = map[string]string{}