A changed file touches exactly the modules whose build reads it (hq issue 280, ADR 0237)

The builder reads a module's own directory (the repository for one built from its root)
and a repository its recipe packages, nothing else. A file in no module's directory was
read as shared code and rebuilt everything built from the repository: 103 modules for a
merge-check.sh added at the catalogue's root. It now touches nothing, in the merge
handler, the release planner and the pull request's check alike, and the gate says so.

cmd/mesh-controller/order_test.go

@@ -144,7 +144,7 @@ func TestAMergeRebuildsTheModulesItChanged(t *testing.T) {
 	}{
 		{"one module's own files", merge([]string{"modules/gitea/index.ts", "modules/gitea/client.ts"}, false), "gitea"},
 		{"two modules' files", merge([]string{"modules/gitea/index.ts", "modules/keycloak/module.json"}, false), "gitea,keycloak"},
-		{"a file they share", merge([]string{"tsconfig.json"}, false), "gitea,keycloak"},
+		{"a file at the root no build reads (issue 280)", merge([]string{"tsconfig.json"}, false), ""},
 		{"a module the mesh does not hold", merge([]string{"modules/plex/index.ts"}, false), ""},
 		{"nothing said about the files", merge(nil, false), "gitea,keycloak"},
 		{"more files than were listed", merge([]string{"modules/gitea/index.ts"}, true), "gitea,keycloak"},
@@ -153,9 +153,9 @@ func TestAMergeRebuildsTheModulesItChanged(t *testing.T) {
 		{"a new module beside a held one", merge([]string{"modules/gitea/x", "modules/newmod/module.json"}, false), "gitea"},
 		{"a new module's other files", merge([]string{"modules/newmod/index.ts", "modules/newmod/module.json"}, false), ""},
 		{"a module removed", merge([]string{"modules/gone/module.json"}, false), ""},
-		{"a directory with no manifest", merge([]string{"modules/lib/x.go"}, false), "gitea,keycloak"},
-		{"a file directly among the modules", merge([]string{"modules/README.md"}, false), "gitea,keycloak"},
-		{"the root's files still", merge([]string{"tsconfig.json"}, false), "gitea,keycloak"},
+		{"a directory with no manifest", merge([]string{"modules/lib/x.go"}, false), ""},
+		{"a file directly among the modules", merge([]string{"modules/README.md"}, false), ""},
+		{"a root file beside a module's", merge([]string{"merge-check.sh", "modules/keycloak/x.ts"}, false), "keycloak"},
 	} {
 		if got := named(whatTheMergeTouched(candidates, known, c.m)); got != c.want {
 			t.Errorf("%s: rebuilt %q, wanted %q", c.what, got, c.want)
@@ -245,12 +245,11 @@ func TestAModuleBuiltAtACommitStillFollowsItsBranch(t *testing.T) {
 	}
 }
 
-// novox/hq issue 278: whether a directory is a module is a fact of the repository at the merge commit,
-// and the announcer says it. A merge touching the code of a module the mesh does not hold — the
+// novox/hq issues 278 and 280: a merge touching the code of a module the mesh does not hold — the
 // catalogue's reference module, whose manifest it left alone — read as shared and rebuilt every module
-// built from the repository (103 of them on 2026-10-06, 88 byte-identical). Said by the announcer, it
-// rebuilds nothing; a directory holding no manifest is shared as before; and an announcer that does not
-// say keeps the old rule.
+// built from the repository (103 of them on 2026-10-06, 88 byte-identical); so did a merge-check.sh added at
+// the root. No build reads a file outside its module's directory, so neither rebuilds anything, said by the
+// announcer or not.
 func TestAChangeInsideAModuleIsThatModulesHeldOrNot(t *testing.T) {
 	const repo = "http://forge.internal:20000/novox/mesh-catalog.git"
 	gitea := fromRepo("gitea", repo, "modules/gitea")
@@ -278,12 +277,12 @@ func TestAChangeInsideAModuleIsThatModulesHeldOrNot(t *testing.T) {
 		{"beside a held one's change", merge(append([]string{"modules/gitea/index.ts"}, showcase...),
 			[]string{"modules/gitea", "modules/showcase"}, true), "gitea"},
 		{"deeper inside it", merge([]string{"modules/showcase/daemon/index.ts"}, []string{"modules/showcase"}, true), ""},
-		{"a directory holding no manifest is still shared", merge([]string{"modules/lib/x.go"}, nil, true), "gitea,keycloak"},
+		{"a directory holding no manifest, read by no build", merge([]string{"modules/lib/x.go"}, nil, true), ""},
 		{"one of two files in no module", merge([]string{"modules/showcase/index.ts", "modules/lib/x.go"},
-			[]string{"modules/showcase"}, true), "gitea,keycloak"},
-		{"the root is never a module directory", merge([]string{"tsconfig.json"}, []string{"", "/", "."}, true), "gitea,keycloak"},
-		{"not said: the old rule", merge(showcase, []string{"modules/showcase"}, false), "gitea,keycloak"},
-		{"an old announcer saying nothing", merge(showcase, nil, false), "gitea,keycloak"},
+			[]string{"modules/showcase"}, true), ""},
+		{"the root is never a module directory", merge([]string{"tsconfig.json"}, []string{"", "/", "."}, true), ""},
+		{"not said: still no build reads it", merge(showcase, []string{"modules/showcase"}, false), ""},
+		{"an old announcer saying nothing", merge(showcase, nil, false), ""},
 		{"a manifest the merge removed, said or not", merge([]string{"modules/gone/module.json", "modules/gone/x.ts"}, nil, true), ""},
 	} {
 		if got := named(whatTheMergeTouched(candidates, known, c.m)); got != c.want {