diff --git a/cmd/mesh-controller/grants_step_store_test.go b/cmd/mesh-controller/grants_step_store_test.go
index 3248a1b4..095a84f1 100644
--- a/cmd/mesh-controller/grants_step_store_test.go
+++ b/cmd/mesh-controller/grants_step_store_test.go
@@ -26,7 +26,6 @@ func TestTheGrantsStepSendsTheUserListAndNothingElse(t *testing.T) {
 	ctx := t.Context()
 	inv := open.inventory
 	start := time.Now().Add(-time.Hour)
-	image := "registry.invalid:5000/restic/backup@sha256:" + strings.Repeat("b", 64)
 	build := func(module, commit string, at time.Time, manifest map[string]any) link.BuildResult {
 		manifest["module"], manifest["version"] = module, "1"
 		raw, _ := json.Marshal(manifest)
@@ -34,24 +33,10 @@ func TestTheGrantsStepSendsTheUserListAndNothingElse(t *testing.T) {
 			On: "anchor", Module: module, Commit: commit, Manifest: raw,
 			Source: &link.SourceOnSeat{Seat: "git", Repository: "novox/mesh-catalog"}}
 	}
-	restic := func(health map[string]any, tools ...string) map[string]any {
-		r := map[string]any{"id": "backup", "type": "container", "name": "restic-backup", "image": image}
-		if health != nil {
-			r["health"] = health
-		}
-		m := map[string]any{"resources": []any{r}}
-		if len(tools) > 0 {
-			m["tools"] = tools
-		}
-		return m
-	}
-	nats := map[string]any{"bus-users": "/var/lib/nats-module/conf/accounts.conf",
-		"claims": []any{map[string]any{"name": catalogue.BrokerSeat, "scope": catalogue.ScopeMesh}}}
 	for _, b := range []link.BuildResult{
-		build("nats", "n1", start, nats),
-		build("restic", "c1", start.Add(time.Second), restic(nil)),
-		build("wallpaper", "w1", start.Add(2*time.Second), map[string]any{"resources": []any{
-			map[string]any{"id": "paper", "type": "container", "name": "wallpaper", "image": image}}}),
+		build("nats", "n1", start, natsFixture()),
+		build("restic", "c1", start.Add(time.Second), resticFixture(false)),
+		build("wallpaper", "w1", start.Add(2*time.Second), wallpaperFixture()),
 	} {
 		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
 			t.Fatal(err)
@@ -120,7 +105,7 @@ func TestTheGrantsStepSendsTheUserListAndNothingElse(t *testing.T) {
 
 	// The merge: restic's c2 gives it a health tool.
 	if _, _, err := takeIn(ctx, inv, build("restic", "c2", start.Add(time.Minute),
-		restic(map[string]any{"kind": catalogue.HealthTool, "tool": "backup_health"}, "backup_health"))); err != nil {
+		resticFixture(true))); err != nil {
 		t.Fatal(err)
 	}
 
@@ -181,3 +166,33 @@ func TestTheGrantsStepSendsTheUserListAndNothingElse(t *testing.T) {
 		t.Fatalf("the grants step's send of a new assignment was not refused by the send: %v", err)
 	}
 }
+
+// fixtureImage is the image every fixture container of the grants step's tests runs.
+var fixtureImage = "registry.invalid:5000/restic/backup@sha256:" + strings.Repeat("b", 64)
+
+// resticFixture is restic's manifest in the shape of mesh-catalog #210: at c2 (withTool) its backup judged by
+// its new tool `backup_health`, beside a check of another kind it does not run itself — a tool check alone
+// is refused (ADR 0227 rule 8, ADR 0240 rule 2) — and at c1 neither.
+func resticFixture(withTool bool) map[string]any {
+	backup := map[string]any{"id": "backup", "type": "container", "name": "restic-backup", "image": fixtureImage}
+	measure := map[string]any{"id": "measure", "type": "container", "name": "restic-measure", "image": fixtureImage}
+	m := map[string]any{"resources": []any{backup, measure}}
+	if withTool {
+		backup["health"] = map[string]any{"kind": catalogue.HealthTool, "tool": "backup_health"}
+		measure["health"] = map[string]any{"kind": "runtime"}
+		m["tools"] = []string{"backup_health"}
+	}
+	return m
+}
+
+// natsFixture is the bus's module: it holds mesh-broker and is sent the user list.
+func natsFixture() map[string]any {
+	return map[string]any{"bus-users": "/var/lib/nats-module/conf/accounts.conf",
+		"claims": []any{map[string]any{"name": catalogue.BrokerSeat, "scope": catalogue.ScopeMesh}}}
+}
+
+// wallpaperFixture is a module the bus's machine is newly assigned.
+func wallpaperFixture() map[string]any {
+	return map[string]any{"resources": []any{
+		map[string]any{"id": "paper", "type": "container", "name": "wallpaper", "image": fixtureImage}}}
+}
diff --git a/cmd/mesh-controller/grants_step_test.go b/cmd/mesh-controller/grants_step_test.go
index 48b34bb5..70e275b2 100644
--- a/cmd/mesh-controller/grants_step_test.go
+++ b/cmd/mesh-controller/grants_step_test.go
@@ -177,6 +177,22 @@ func TestTheGrantsStepKeepsOneMachinesBuilds(t *testing.T) {
 	}
 }
 
+// The store test's manifests are manifests the controller takes in: checked here, where no store is needed,
+// so a fixture the module rules refuse fails before the store test is run (repo-check of #230 at 325575b2).
+func TestTheGrantsStepFixturesAreManifests(t *testing.T) {
+	for name, m := range map[string]map[string]any{"nats": natsFixture(), "restic-c1": resticFixture(false),
+		"restic-c2": resticFixture(true), "wallpaper": wallpaperFixture()} {
+		m["module"], m["version"] = strings.SplitN(name, "-", 2)[0], "1"
+		raw, err := json.Marshal(m)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := catalogue.ParseManifest(raw); err != nil {
+			t.Errorf("%s: %v", name, err)
+		}
+	}
+}
+
 // The delivery plan says the step before the merge.
 func TestAChangePlanSaysTheGrantsStep(t *testing.T) {
 	const catalogue_ = "http://forge.internal:20000/novox/mesh-catalog.git"