From 03bb56481aff9debb7ddf8b11fc028ec67252e16 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:12:47 +0100
Subject: [PATCH 01/17] Move the level rules and the failure words into the
 checker's rules package (issue 1921)

The checking program judges a check from its facts (milestone 47/B0,
ADR 0644, ADR 0656): the rules package holds Facts v1, the level rule,
the failure words and the verdict's outcome, and the running checker
records each level answer as a fact and calls the rules. A row of the
every-failure tests judges the gathered facts and finds the running
checker's verdict.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../internal/check/builds.go                  |   3 +-
 .../internal/check/checker.go                 |   3 +-
 .../internal/check/composition.go             |   3 +-
 .../internal/check/every_failure_test.go      |  25 +-
 .../internal/check/failure_words_test.go      |  19 +-
 .../internal/check/judge.go                   | 374 ++----------------
 .../internal/check/line.go                    |  17 +-
 .../internal/check/package_cause_test.go      |  21 +-
 .../internal/check/results.go                 |  60 +--
 modules/mesh-delivery-checker/rules/facts.go  | 209 ++++++++++
 .../mesh-delivery-checker/rules/results.go    |  59 +++
 modules/mesh-delivery-checker/rules/words.go  | 280 +++++++++++++
 12 files changed, 628 insertions(+), 445 deletions(-)
 create mode 100644 modules/mesh-delivery-checker/rules/facts.go
 create mode 100644 modules/mesh-delivery-checker/rules/results.go
 create mode 100644 modules/mesh-delivery-checker/rules/words.go

diff --git a/modules/mesh-delivery-checker/internal/check/builds.go b/modules/mesh-delivery-checker/internal/check/builds.go
index 2afa2d42..82e79c2c 100644
--- a/modules/mesh-delivery-checker/internal/check/builds.go
+++ b/modules/mesh-delivery-checker/internal/check/builds.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"maps"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"sort"
 	"strings"
@@ -160,7 +161,7 @@ func (st *state) awaitBuilds(ctx context.Context, v *delivery.Verdict) []string
 				v.State, v.Failed = delivery.VerdictFail, f
 				continue
 			}
-			addFailure(v, f)
+			rules.AddFailure(v, f)
 		}
 	}
 	if len(late) > 0 && ctx.Err() == nil {
diff --git a/modules/mesh-delivery-checker/internal/check/checker.go b/modules/mesh-delivery-checker/internal/check/checker.go
index 4e8e91bc..193b7147 100644
--- a/modules/mesh-delivery-checker/internal/check/checker.go
+++ b/modules/mesh-delivery-checker/internal/check/checker.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"sort"
 	"strings"
@@ -449,7 +450,7 @@ func (ch *Checker) untrunked(ctx context.Context, c delivery.Candidate, left []P
 			continue
 		}
 		o := delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: "error",
-			Target: strings.TrimSuffix(ch.Link, "/") + "/" + key, Text: clipLine(words, MaxLine)}
+			Target: strings.TrimSuffix(ch.Link, "/") + "/" + key, Text: rules.ClipLine(words, MaxLine)}
 		data, err := delivery.EncodeCheckerOwed(o)
 		if err != nil {
 			ch.logf("%s: the status of %s cannot be written: %v", key, okey, err)
diff --git a/modules/mesh-delivery-checker/internal/check/composition.go b/modules/mesh-delivery-checker/internal/check/composition.go
index 0501844b..18944c34 100644
--- a/modules/mesh-delivery-checker/internal/check/composition.go
+++ b/modules/mesh-delivery-checker/internal/check/composition.go
@@ -1,6 +1,7 @@
 package check
 
 import (
+	"mesh-delivery-checker/rules"
 	"strings"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
@@ -20,7 +21,7 @@ func withComposition(v *delivery.Verdict, comp delivery.CompositionVerdict) {
 		}
 		f := delivery.FailedFirst{Machine: machine, Words: comp.Words}
 		if v.State == delivery.VerdictFail {
-			addFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
+			rules.AddFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
 			return
 		}
 		v.State, v.Failed = delivery.VerdictFail, f
diff --git a/modules/mesh-delivery-checker/internal/check/every_failure_test.go b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
index 444e9743..d4ba7709 100644
--- a/modules/mesh-delivery-checker/internal/check/every_failure_test.go
+++ b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
@@ -3,6 +3,8 @@ package check
 import (
 	"encoding/json"
 	"fmt"
+	"mesh-delivery-checker/rules"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -21,9 +23,18 @@ func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
 
 func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
 	t.Helper()
-	st := &state{j: &Examiner{}, c: &Case{}, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
+	st := &state{j: &Examiner{}, c: &Case{}, levels: rules.NewTally(), nodes: map[string]bool{}}
 	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
-	return settled(joinFailures(v)), st
+	v = rules.Settled(rules.JoinFailures(v))
+	// 1921 (B0, D1a): the facts the running checker gathered, judged by the rules, give the same failures and counts.
+	judged := rules.Judge(rules.Facts{V: rules.FactsVersion, Steps: st.facts})
+	switch {
+	case v == nil && judged.State != delivery.VerdictPass, v != nil && (judged.Failed != v.Failed || !reflect.DeepEqual(judged.Failures, v.Failures)):
+		t.Errorf("the rules judge the facts %+v, the running checker %+v", judged, v)
+	case judged.Levels[delivery.LevelIntegration] != (delivery.LevelResult{Run: st.levels[delivery.LevelIntegration].Run}):
+		t.Errorf("the rules count %+v, the running checker %+v", judged.Levels, *st.levels[delivery.LevelIntegration])
+	}
+	return v, st
 }
 
 // Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
@@ -48,7 +59,7 @@ func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
 		if len(v.Failures) != 2 || v.Failed.Test != "integration: x/a.TestA" || !strings.Contains(v.Failed.Words, "a_test.go:3: logged") {
 			t.Errorf("%s: verdict %+v", name, v)
 		}
-		if run := st.levels[delivery.LevelIntegration].run; run != 10 {
+		if run := st.levels[delivery.LevelIntegration].Run; run != 10 {
 			t.Errorf("%s: %d tests counted, want all 10", name, run)
 		}
 		if _, err := delivery.EncodeVerdict(delivery.Verdict{Group: "g", Heads: "0123456789ab", State: v.State, Failed: v.Failed, Failures: v.Failures}); err != nil {
@@ -58,7 +69,7 @@ func TestTwoFailingTestsInTwoPackagesAreTwoEntries(t *testing.T) {
 }
 
 // Issue 1921: past delivery.MaxFailures the list names the first fifty and how many more, the status line says how many
-// failed and names the first, cut so "and N more" stays whole, and each entry's line is cut to MaxFailureLine.
+// failed and names the first, cut so "and N more" stays whole, and each entry's line is cut to rules.MaxFailureLine.
 func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 	var fs []Failure
 	for i := range 60 {
@@ -68,10 +79,10 @@ func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 	if len(v.Failures) != delivery.MaxFailures+1 || v.Failures[delivery.MaxFailures].Test != "and 10 more" {
 		t.Fatalf("%d entries, last %+v", len(v.Failures), v.Failures[len(v.Failures)-1])
 	}
-	if len(v.Failures[0].Words) > MaxFailureLine {
+	if len(v.Failures[0].Words) > rules.MaxFailureLine {
 		t.Errorf("an entry's line is %d bytes", len(v.Failures[0].Words))
 	}
-	if n := failedCount(*v); n != 60 {
+	if n := rules.FailedCount(*v); n != 60 {
 		t.Errorf("failedCount = %d, want 60", n)
 	}
 	cs := &Case{Pulls: []Pull{{Repository: "novox/x", Head: "0123456789abcdef", Trunk: "fedcba9876543210"}}}
@@ -81,7 +92,7 @@ func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 	}
 	// A composition failing after them is counted in the last entry (the operator, 2026-11-02).
 	withComposition(v, delivery.CompositionVerdict{State: delivery.CompositionFail, Machine: "g14", Words: "route-proxy is defined twice"})
-	if n := failedCount(*v); n != 61 || v.Failed.Test != "integration: x/p0.TestT" {
+	if n := rules.FailedCount(*v); n != 61 || v.Failed.Test != "integration: x/p0.TestT" {
 		t.Errorf("after the composition failedCount = %d, failed %+v", n, v.Failed)
 	}
 
diff --git a/modules/mesh-delivery-checker/internal/check/failure_words_test.go b/modules/mesh-delivery-checker/internal/check/failure_words_test.go
index 9c01774d..0d9edc4b 100644
--- a/modules/mesh-delivery-checker/internal/check/failure_words_test.go
+++ b/modules/mesh-delivery-checker/internal/check/failure_words_test.go
@@ -2,6 +2,7 @@ package check
 
 import (
 	"encoding/json"
+	"mesh-delivery-checker/rules"
 	"strings"
 	"testing"
 
@@ -21,19 +22,19 @@ func fatalAfterLog() Failure {
 }
 
 func TestAFailedTestsVerdictKeepsItsWholeFailureMessage(t *testing.T) { // 1901/AC1
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{fatalAfterLog()}})
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
 	for _, want := range []string{"3 subscription(s) derive to a subject no emitter owns:", "a.b.c", "d.e.f", "g.h.i"} {
 		if !strings.Contains(v.Failed.Words, want) {
 			t.Errorf("words lack %q: %q", want, v.Failed.Words)
 		}
 	}
-	if len(v.Failed.Words) > MaxWords+200 {
-		t.Errorf("words are %d bytes, bound %d", len(v.Failed.Words), MaxWords)
+	if len(v.Failed.Words) > rules.MaxWords+200 {
+		t.Errorf("words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
 	}
 }
 
 func TestTheStatusLineNamesTheFailureNotTheFirstLoggedLine(t *testing.T) { // 1901/AC2
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{fatalAfterLog()}})
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
 	got := firstFailed(*v)
 	if !strings.Contains(got, "3 subscription(s) derive to a subject no emitter owns:") || strings.Contains(got, "judged against") || strings.Contains(got, "\n") {
 		t.Errorf("firstFailed = %q", got)
@@ -41,7 +42,7 @@ func TestTheStatusLineNamesTheFailureNotTheFirstLoggedLine(t *testing.T) { // 19
 	// With no cause told apart (an older build module), the words still start at the first line, as before.
 	f := fatalAfterLog()
 	f.Cause = ""
-	v = levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
+	v = rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
 	if !strings.HasPrefix(afterHid(v.Failed.Words), "agreement_catalogue_test.go:130") {
 		t.Errorf("words = %q", v.Failed.Words)
 	}
@@ -49,8 +50,8 @@ func TestTheStatusLineNamesTheFailureNotTheFirstLoggedLine(t *testing.T) { // 19
 
 func TestWordsLongerThanTheBoundKeepTheirLastLines(t *testing.T) { // 1901/AC1
 	f := Failure{Output: strings.Repeat("log line of some length\n", 500) + "the cause is here"}
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
-	if !strings.HasSuffix(v.Failed.Words, "the cause is here") || len(v.Failed.Words) > MaxWords+200 {
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+	if !strings.HasSuffix(v.Failed.Words, "the cause is here") || len(v.Failed.Words) > rules.MaxWords+200 {
 		t.Errorf("%d bytes, ends %q", len(v.Failed.Words), v.Failed.Words[len(v.Failed.Words)-30:])
 	}
 	_ = delivery.VerdictFail
@@ -66,7 +67,7 @@ func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) {
 	if err := json.Unmarshal([]byte(old), &f); err != nil || f.Cause != "" {
 		t.Fatalf("1901/AC3: err = %v, cause = %q", err, f.Cause)
 	}
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
 	if afterHid(v.Failed.Words) != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
 		t.Errorf("1901/AC3: words = %q", v.Failed.Words)
 	}
@@ -84,7 +85,7 @@ func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) {
 		{"a real cause", "mesh-build-node", by, "one plus one is not three", "not ok 3 - fails", ""},
 	} {
 		t.Run(c.name, func(t *testing.T) {
-			v := levelFailure(&target{module: c.module}, "unit", Tested{By: c.by, Failed: []Failure{{Package: "modules/gitea", Test: "fails", Cause: c.cause, Output: c.output}}})
+			v := rules.LevelFailure("", c.module, "unit", Tested{By: c.by, Failed: []Failure{{Package: "modules/gitea", Test: "fails", Cause: c.cause, Output: c.output}}})
 			if v.State != delivery.VerdictFail {
 				t.Errorf("1901/AC8: the verdict is %q, want it failed", v.State)
 			}
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 391d9f27..e9981b10 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"path"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"sort"
 	"strings"
@@ -228,24 +228,17 @@ func (t *target) stepArgs(args map[string]any) map[string]any {
 	return args
 }
 
-// acc collects a level's counts across targets.
-type acc struct {
-	run, kept, skipped int
-	elapsed, setup     float64
-	lint               float64
-	over               bool
-	slowest            []TestTime
-}
-
 // state is one judging.
 type state struct {
 	j       *Examiner
 	c       *Case
 	targets []*target
-	levels  map[string]*acc
-	nodes   map[string]bool
-	clone   time.Duration
-	slow    []string
+	levels  rules.Tally
+	// facts are the facts of the check met so far, in order: what the checking program judges (milestone 47/B0).
+	facts []rules.Step
+	nodes map[string]bool
+	clone time.Duration
+	slow  []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
 	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
@@ -305,13 +298,13 @@ func (st *state) takeTryCandidate(ctx context.Context) {
 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
 // be judged at all.
 func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
-	st := &state{j: j, c: c, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{},
+	st := &state{j: j, c: c, levels: rules.NewTally(), nodes: map[string]bool{},
 		beside: map[string]string{}}
 	// Every member and level runs to its end, and every manifest the change touches is judged by the indexer's judge (ADR
 	// 0578 §2), also after a failure: the verdict names every failure, not only the first (the operator, 2026-11-02).
 	tests := st.judgeAll(ctx)
 	st.takeTryCandidate(ctx)
-	if v := settled(joinFailures(tests, st.judgeManifests(ctx), st.refuseCycle(ctx))); v != nil {
+	if v := rules.Settled(rules.JoinFailures(tests, st.judgeManifests(ctx), st.refuseCycle(ctx))); v != nil {
 		return st.finish(ctx, *v), nil
 	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
@@ -370,40 +363,8 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 
 // outcome fills the verdict's levels, times, machines and composition from what ran.
 func (st *state) outcome(v delivery.Verdict) Outcome {
-	if v.State == delivery.VerdictPass || len(v.Levels) == 0 {
-		v.Levels = map[string]delivery.LevelResult{}
-		for level, a := range st.levels {
-			v.Levels[level] = delivery.LevelResult{Run: a.run, Kept: a.kept, Skipped: a.skipped}
-		}
-	}
-	ms := func(s float64) int64 { return int64(s * 1000) }
-	u, i := st.levels[delivery.LevelUnit], st.levels[delivery.LevelIntegration]
-	v.Took = delivery.Took{Clone: st.clone.Milliseconds(), Unit: ms(u.elapsed), Lint: ms(u.lint), IntegrationSetup: ms(i.setup), IntegrationRun: ms(i.elapsed)}
-	for node := range st.nodes {
-		v.Machines = append(v.Machines, node)
-	}
-	sort.Strings(v.Machines)
-	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
-		if st.levels[level].over {
-			v.OverBound = append(v.OverBound, level)
-		}
-	}
-	// The composition is made from the engines' answers (ADR 0593 §7): until it is, a verdict says it was not run (ADR 0484 clause 6).
-	v.Composition = &delivery.Composition{State: delivery.CompositionNotRun}
-	var slow []string
-	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
-		a := st.levels[level]
-		if !a.over {
-			continue
-		}
-		sort.SliceStable(a.slowest, func(x, y int) bool { return a.slowest[x].Elapsed > a.slowest[y].Elapsed })
-		for n, s := range a.slowest {
-			if n == 3 {
-				break
-			}
-			slow = append(slow, fmt.Sprintf("%s %s %.1fs", level, path.Base(s.Package)+"."+s.Test, s.Elapsed))
-		}
-	}
+	rules.Outcome(&v, st.levels, st.clone.Milliseconds(), st.nodes)
+	slow := rules.Slowest(st.levels)
 	out := Outcome{Verdict: v, Slowest: slow}
 	if len(st.beside) > 0 {
 		out.Beside = st.beside
@@ -506,7 +467,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
 	}
-	return joinFailures(failures...)
+	return rules.JoinFailures(failures...)
 }
 
 // DefaultDeclineBound is an Examiner's DeclineBound when it names none: longer than a check runs, so a node with the
@@ -675,7 +636,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		st.j.logf("%s#%d: %s on %s left untested; asked of a node with %s", p.Repository, p.Number, unmetOf(answer.Levels), step.Node, strings.Join(unmet, ", "))
 		failures = append(failures, st.askNeeding(ctx, t, merged, again, unmet, packages))
 	}
-	return joinFailures(failures...)
+	return rules.JoinFailures(failures...)
 }
 
 // unmetNames names the unmet packages and their needs.
@@ -703,62 +664,30 @@ func unmetOf(levels []delivery.LevelAnswer) string {
 // one that did not pass, so the verdict names every failed test of the level (issue 1921). It answers the level's
 // running time (its tests' and setup's).
 func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) (*delivery.Verdict, float64) {
-	level := la.Level
-	a := st.levels[level]
-	if a == nil {
-		return fail(t.node, fmt.Sprintf("the check of %s#%d answered the level %q, which is no level", t.pull.Repository, t.pull.Number, level)), 0
-	}
-	var digests map[string]string
-	if t.module == buildrun.GoBuildModule && la.Digest != nil {
-		// The packages come as a list, never keyed by a package path (issue 1930); an answer stored before reads too.
-		digests = la.Digest.Map()
-		if t.runner != "" {
-			t.judgedBy(la.Digest.JudgedBy) // the installed module judged it: the runner is not used again
-		}
+	if t.runner != "" && t.module == buildrun.GoBuildModule && la.Digest != nil {
+		t.judgedBy(la.Digest.JudgedBy) // the installed module judged it: the runner is not used again
 	}
 	if t.runner != "" && la.Judged != "" {
 		t.judgedBy(la.Judged) // the candidate judged the level: nothing is kept (ADR 0535 §4)
 	}
-	for _, k := range la.Kept {
-		a.kept += k.Tests
+	v, elapsed, results := st.levels.Level(t.pull.Repository, t.pull.Number, t.module, t.node, la)
+	st.facts = append(st.facts, rules.Step{Repository: t.pull.Repository, Number: t.pull.Number, Module: t.module, Node: t.node, Level: &la})
+	var digests map[string]string
+	if t.module == buildrun.GoBuildModule && la.Digest != nil {
+		// The packages come as a list, never keyed by a package path (issue 1930); an answer stored before reads too.
+		digests = la.Digest.Map()
 	}
-	elapsed := 0.0
-	var failedResults []Tested
-	for _, raw := range la.Tests {
-		var res Tested
-		if err := json.Unmarshal(raw, &res); err != nil {
-			return fail(t.node, fmt.Sprintf("the %s level of %s#%d answered what is not a result: %v", level, t.pull.Repository, t.pull.Number, err)), elapsed
-		}
+	for _, res := range results {
 		if t.runner != "" {
 			t.judgedBy(res.JudgedBy)
 		}
-		elapsed += res.Elapsed + res.Setup + res.Lint
-		if t.module == buildrun.NodeBuildModule {
-			if !res.NoTests {
-				a.run++ // a Node package is counted whole: its build module counts no tests (ADR 0484 clause 10)
-			}
-		} else {
-			a.run += res.Tests
-			a.skipped += res.Skipped
-			a.slowest = append(a.slowest, res.Slowest...)
-		}
-		a.elapsed += res.Elapsed
-		a.setup += res.Setup
-		a.lint += res.Lint
-		a.over = a.over || res.OverBound
 		if len(digests) > 0 {
-			if _, err := st.j.Kept.KeepPasses(ctx, t.pull.Repository, level, t.toolchain, res, digests, st.j.now()); err != nil {
+			if _, err := st.j.Kept.KeepPasses(ctx, t.pull.Repository, la.Level, t.toolchain, res, digests, st.j.now()); err != nil {
 				st.j.logf("%s#%d: a passing package could not be kept: %v", t.pull.Repository, t.pull.Number, err)
 			}
 		}
-		if !res.Passed {
-			failedResults = append(failedResults, res)
-		}
 	}
-	if len(failedResults) > 0 {
-		return levelFailure(t, level, failedResults...), elapsed
-	}
-	return nil, elapsed
+	return v, elapsed
 }
 
 // changesPackage says whether the merge of a pull request changes a file inside the named paths of one of its repository's
@@ -780,258 +709,3 @@ func (j *Examiner) changesPackage(p Pull, merged []Fetched) bool {
 	}
 	return false
 }
-
-// failedName names a failure: its package and test.
-func failedName(f Failure) string {
-	if f.Test == "" {
-		return f.Package
-	}
-	return f.Package + "." + f.Test
-}
-
-// MaxWords is the most a failed test's words in a verdict hold (issue 1901). **The words keep the failure's last lines**,
-// where a test says why it failed: the first line is often something it logged before (the group r4g verdict kept a
-// "judged against" line and lost the t.Fatalf after it), and the 120 characters kept before cut a docker command's echo
-// before docker's own error. Four kilobytes holds a long message and is small beside a verdict's other parts.
-const MaxWords = 4096
-
-// failureWords is a failure's words: its output's last lines up to MaxWords, with the line the build module told apart as
-// the test's error first when the output does not start with it, so the first line of the words is the cause and the
-// status line, which is cut short, names it. **A failure's words are never "PASS" or "ok"** (issue 1901, its third
-// meeting: a package that failed after its tests passed was worded "PASS"): go test's summary lines are dropped, and with
-// no cause told apart (an older build module) the cause is the output's first "panic:", "fatal error:" or "signal:"
-// line, read before the output is cut, or the words say the tests passed and the program failed after them.
-func failureWords(f Failure) string {
-	return failureWordsAfter(f, "")
-}
-
-// failureWordsAfter is failureWords with the line loud put first, within the same MaxWords: what the checker itself says of
-// the failure (that the build module hid it), which the status line then names.
-func failureWordsAfter(f Failure, loud string) string {
-	out, passed := dropSummary(strings.TrimSpace(f.Output))
-	cause := strings.TrimSpace(f.Cause)
-	if cause == "" {
-		cause = causeIn(out)
-	}
-	switch {
-	case cause == "" && out == "" && passed:
-		cause = "the tests passed, then the test program exited with a failure: an os.Exit or a panic in TestMain or after the tests"
-	case cause == "" && out == "":
-		// The build module on main sends a package that stopped (a timeout, an exit, a kill) as its "FAIL" line alone.
-		cause = "the package failed with no test to name and no panic, signal or build error in its output (an older build module sent no cause)"
-	}
-	if len(cause) > MaxCause {
-		cause = strings.ToValidUTF8(cause[:MaxCause], "") + "..."
-	}
-	// The words keep MaxWords exactly: the loud line, the cause and their newlines, the marker and the kept lines.
-	budget := MaxWords
-	if cause != "" {
-		budget -= len(cause) + 1
-	}
-	if loud != "" {
-		budget -= len(loud) + 1
-	}
-	if len(out) > budget {
-		const marker = "... "
-		tail := out[len(out)-(budget-len(marker)):]
-		// Start on a whole line, and a whole character.
-		if i := strings.IndexByte(tail, '\n'); i >= 0 {
-			tail = strings.TrimLeft(tail[i:], "\n")
-		}
-		out = marker + strings.ToValidUTF8(tail, "")
-	}
-	if cause != "" && !strings.HasPrefix(firstLine(out), cause) {
-		out = strings.TrimRight(cause+"\n"+out, "\n")
-	}
-	if loud != "" {
-		out = strings.TrimRight(loud+"\n"+out, "\n")
-	}
-	return out
-}
-
-// hidWords is the checker's loud line for a failure the build module sent hiding its cause (issue 1901, its thorough
-// fix): with no cause, or a passing line as its cause, under the failure contract (buildstep.Hidden). It names the build
-// module and the version it says it is (Tested.By, "<module> with mesh-sdk <version>"); one from before the contract
-// says nothing of itself. "" when the failure keeps the contract. The check fails either way: only its words change.
-func hidWords(module, by string, f Failure) string {
-	why := buildstep.Hidden(f)
-	if why == "" {
-		return ""
-	}
-	version := "a version before the failure contract"
-	if module == "" {
-		module = "an unnamed build module"
-	}
-	if m, v, ok := strings.Cut(by, " with "); ok && m != "" {
-		module, version = m, v
-	}
-	return fmt.Sprintf("the build module hid the failure (%s at %s): %s", module, version, why)
-}
-
-// MaxCause is the most a cause in a failure's words holds: one long line (the 1901 review: a cause of a kilobyte could
-// push the words past MaxWords).
-const MaxCause = 1024
-
-// dropSummary drops go test's summary lines from a failure's output ("PASS", "FAIL", "ok <pkg>", "FAIL <pkg>"), and says
-// whether a "PASS" was among them: the package's tests passed before it failed.
-func dropSummary(out string) (string, bool) {
-	passed := false
-	lines := strings.Split(out, "\n")
-	kept := lines[:0]
-	for _, l := range lines {
-		// go's exact forms only (review round 1): "PASS" or "FAIL" alone, "ok  \t<pkg>\t<time>", "FAIL\t<pkg>\t<time>".
-		switch t := strings.TrimRight(l, "\r"); {
-		case t == "PASS":
-			passed = true
-		case t == "FAIL", strings.HasPrefix(t, "ok  \t"), strings.HasPrefix(t, "FAIL\t"):
-		default:
-			kept = append(kept, l)
-		}
-	}
-	return strings.TrimSpace(strings.Join(kept, "\n")), passed
-}
-
-// causeIn is a race the race detector reported, as its heading, its access and the frame that made it ("WARNING: DATA
-// RACE: Write at 0x... by goroutine 9 in pkg.F.func1()"); else the first "panic:", "fatal error:" or "signal:" line of a
-// failure's output, in that order; or "". **Only lines at column 0**, where go prints the runtime's: a test's indented log
-// line holding the same words is not the cause (review round 1).
-func causeIn(out string) string {
-	lines := strings.Split(out, "\n")
-	for i, l := range lines {
-		if strings.TrimRight(l, "\r") != "WARNING: DATA RACE" {
-			continue
-		}
-		words := "WARNING: DATA RACE"
-		if i+1 < len(lines) && strings.TrimSpace(lines[i+1]) != "" {
-			words += ": " + strings.TrimSuffix(strings.TrimSpace(lines[i+1]), ":")
-			if i+2 < len(lines) && strings.HasPrefix(lines[i+2], "  ") {
-				words += " in " + strings.TrimSpace(lines[i+2])
-			}
-		}
-		return words
-	}
-	for _, prefix := range []string{"panic: ", "fatal error: ", "signal: "} {
-		for _, l := range lines {
-			if l = strings.TrimRight(l, "\r"); strings.HasPrefix(l, prefix) {
-				return l
-			}
-		}
-	}
-	return ""
-}
-
-// firstLine is the first non-empty line of a failure's words.
-func firstLine(s string) string {
-	for _, l := range strings.Split(s, "\n") {
-		if l = strings.TrimSpace(l); l != "" {
-			return l
-		}
-	}
-	return ""
-}
-
-// MaxFailureLine is the most bytes of a failure's line in a verdict's Failures: the first line of its words, which is
-// its cause where the build module told one apart (issue 1901). Failed keeps the first failure's words whole.
-const MaxFailureLine = 300
-
-// levelFailure turns a level that did not pass into a verdict: Failed names what failed first with its words whole,
-// and Failures every failed test of the level's results with its first line, at most delivery.MaxFailures and an entry
-// saying how many more (issue 1921).
-func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict {
-	v := delivery.Verdict{State: delivery.VerdictFail}
-	var all []delivery.FailedFirst
-	for _, res := range results {
-		if len(res.Failed) == 0 {
-			why := res.Why
-			if why == "" {
-				why = "the " + level + " level did not pass"
-			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why})
-			continue
-		}
-		for _, f := range res.Failed {
-			name := failedName(f)
-			if t.module == buildrun.NodeBuildModule && f.Package == "" {
-				name = res.Module
-			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f))})
-		}
-	}
-	if len(all) == 0 { // no result: a level said failed with nothing to name
-		all = append(all, delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: "the " + level + " level did not pass"})
-	}
-	v.Failed = all[0]
-	v.Failures = all // whole: settled cuts them to their first lines once every failure of the check is joined
-	return &v
-}
-
-// joinFailures is one failed verdict of every failure of vs, in the order given (a nil one passed), unsettled: Failed is
-// the first whole, and Failures every failure whole, or none when the one failure is no level's (a conflict, a refused
-// step: one line, as before issue 1921). Nil when none failed.
-func joinFailures(vs ...*delivery.Verdict) *delivery.Verdict {
-	var out *delivery.Verdict
-	var all []delivery.FailedFirst
-	listed := false
-	for _, v := range vs {
-		if v == nil {
-			continue
-		}
-		if out == nil {
-			out = &delivery.Verdict{State: delivery.VerdictFail, Failed: v.Failed}
-		}
-		if len(v.Failures) > 0 {
-			all, listed = append(all, v.Failures...), true
-			continue
-		}
-		all = append(all, v.Failed)
-	}
-	if out != nil && (listed || len(all) > 1) {
-		out.Failures = all
-	}
-	return out
-}
-
-// settled is a joined verdict as it is written: each failure of its list cut to its first line, at most
-// delivery.MaxFailures and then how many more (failureLines).
-func settled(v *delivery.Verdict) *delivery.Verdict {
-	if v != nil && len(v.Failures) > 0 {
-		v.Failures = failureLines(v.Failures)
-	}
-	return v
-}
-
-// addFailure is a settled list of failures with one more at its end: the first failure is put first when the list is
-// empty (a verdict of one failure keeps none), and past delivery.MaxFailures the last entry counts one more.
-func addFailure(v *delivery.Verdict, f delivery.FailedFirst) {
-	if len(v.Failures) == 0 {
-		v.Failures = failureLines([]delivery.FailedFirst{v.Failed})
-	}
-	if n := len(v.Failures); n > delivery.MaxFailures {
-		v.Failures[n-1].Test = fmt.Sprintf("and %d more", failedCount(*v)-delivery.MaxFailures+1)
-		return
-	}
-	v.Failures = append(v.Failures, failureLines([]delivery.FailedFirst{f})...)
-}
-
-// failureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
-// and then one entry saying how many more failed.
-func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
-	n := min(len(all), delivery.MaxFailures)
-	out := make([]delivery.FailedFirst, 0, n+1)
-	for _, f := range all[:n] {
-		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
-	}
-	if more := len(all) - n; more > 0 {
-		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
-	}
-	return out
-}
-
-// clipLine cuts a line to at most n bytes on a whole character, marking the cut.
-func clipLine(s string, n int) string {
-	if len(s) <= n {
-		return s
-	}
-	s = strings.ToValidUTF8(s[:n-3], "")
-	return s + "..."
-}
diff --git a/modules/mesh-delivery-checker/internal/check/line.go b/modules/mesh-delivery-checker/internal/check/line.go
index 153b5b61..d77bb742 100644
--- a/modules/mesh-delivery-checker/internal/check/line.go
+++ b/modules/mesh-delivery-checker/internal/check/line.go
@@ -2,6 +2,7 @@ package check
 
 import (
 	"fmt"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"strings"
 	"unicode/utf8"
@@ -70,7 +71,7 @@ func failedLines(v delivery.Verdict) []string {
 // are cut to fit room characters when room is not negative; the count and "and N more" are never cut.
 func failedHead(v delivery.Verdict, room int) string {
 	first := firstFailed(v)
-	n := failedCount(v)
+	n := rules.FailedCount(v)
 	if n <= 1 {
 		return clipRunes("failed: "+first, room)
 	}
@@ -93,20 +94,8 @@ func clipRunes(s string, n int) string {
 	return string(r[:n-1]) + "…"
 }
 
-// failedCount is how many failures a verdict names, the ones after delivery.MaxFailures counted too.
-func failedCount(v delivery.Verdict) int {
-	n := len(v.Failures)
-	if n > delivery.MaxFailures {
-		var more int
-		if _, err := fmt.Sscanf(v.Failures[n-1].Test, "and %d more", &more); err == nil {
-			return delivery.MaxFailures + more
-		}
-	}
-	return n
-}
-
 // firstWordsLine is the first line of a failure's words: the words are several lines (issue 1901) and the status line one.
-func firstWordsLine(w string) string { return firstLine(w) }
+func firstWordsLine(w string) string { return rules.FirstLine(w) }
 
 // pieces are the parts of a line, from the most to the least needed.
 type pieces struct {
diff --git a/modules/mesh-delivery-checker/internal/check/package_cause_test.go b/modules/mesh-delivery-checker/internal/check/package_cause_test.go
index 64b50cea..2e1e3ad1 100644
--- a/modules/mesh-delivery-checker/internal/check/package_cause_test.go
+++ b/modules/mesh-delivery-checker/internal/check/package_cause_test.go
@@ -1,6 +1,7 @@
 package check
 
 import (
+	"mesh-delivery-checker/rules"
 	"strings"
 	"testing"
 )
@@ -32,14 +33,14 @@ func TestAPackageFailureIsNeverWordedPass(t *testing.T) { // 1901/AC5
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			v := levelFailure(&target{}, "integration", Tested{Failed: []Failure{{Package: "github.com/novox/mesh-controller/cmd/mesh-controller", Output: c.output}}})
+			v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "github.com/novox/mesh-controller/cmd/mesh-controller", Output: c.output}}})
 			for _, l := range strings.Split(v.Failed.Words, "\n") {
 				if l = strings.TrimSpace(l); l == "PASS" || strings.HasPrefix(l, "ok ") || strings.HasPrefix(l, "ok\t") {
 					t.Errorf("1901/AC5: the words keep %q: %q", l, v.Failed.Words)
 				}
 			}
 			if !strings.HasPrefix(afterHid(v.Failed.Words), c.want) {
-				t.Errorf("1901/AC5: words after the loud line start %q, want %q", firstLine(afterHid(v.Failed.Words)), c.want)
+				t.Errorf("1901/AC5: words after the loud line start %q, want %q", rules.FirstLine(afterHid(v.Failed.Words)), c.want)
 			}
 			if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.HasSuffix(got, ": PASS") {
 				t.Errorf("1901/AC5, AC8: status = %q", got)
@@ -51,9 +52,9 @@ func TestAPackageFailureIsNeverWordedPass(t *testing.T) { // 1901/AC5
 // A cause the build module told apart is cut to a line's bound, so the words keep their bound (the 1901 review's note).
 func TestALongCauseIsCutToALinesBound(t *testing.T) { // 1901/AC5
 	f := Failure{Package: "p", Test: "TestX", Cause: strings.Repeat("c", 5000), Output: "x_test.go:1: something"}
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
-	if len(v.Failed.Words) > MaxWords+200 {
-		t.Errorf("1901/AC5: words are %d bytes, bound %d", len(v.Failed.Words), MaxWords)
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+	if len(v.Failed.Words) > rules.MaxWords+200 {
+		t.Errorf("1901/AC5: words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
 	}
 }
 
@@ -62,7 +63,7 @@ func TestALongCauseIsCutToALinesBound(t *testing.T) { // 1901/AC5
 // capture of the same name (go-test-json-pkg-timeout, -exiting, -killed): the package's own output, its "FAIL" line.
 func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901/AC5
 	for _, out := range []string{"FAIL\texample.com/timeout\t2.017s", "FAIL\texample.com/exiting\t0.006s", "FAIL\texample.com/killed\t0.006s"} {
-		v := levelFailure(&target{}, "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
+		v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
 		if !strings.HasPrefix(afterHid(v.Failed.Words), "the package failed with no test to name and no panic, signal or build error in its output") {
 			t.Errorf("1901/AC5: %q is worded %q", out, v.Failed.Words)
 		}
@@ -73,19 +74,19 @@ func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901
 // either (review round 1): go prints its summary in exact forms and the runtime's lines at column 0.
 func TestOnlyGosExactFormsAreSummaryOrCause(t *testing.T) { // 1901/AC5
 	out := "    x_test.go:3: ok so far\nok then: the seat is free\n        panic: child retried and recovered\npanic: the real one\nFAIL\tp\t1.0s"
-	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
+	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
 	if !strings.HasPrefix(afterHid(v.Failed.Words), "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
 		t.Errorf("1901/AC5: words = %q", v.Failed.Words)
 	}
 }
 
-// The words keep MaxWords exactly, counting the cause, the marker and the newlines (review round 1).
+// The words keep rules.MaxWords exactly, counting the cause, the marker and the newlines (review round 1).
 func TestTheWordsKeepTheirBoundExactly(t *testing.T) { // 1901/AC5
 	for _, cause := range []string{"", "a cause", strings.Repeat("c", 3000)} {
 		for _, n := range []int{100, 170, 171, 172, 500} {
 			f := Failure{Package: "p", Test: "TestX", Cause: cause, Output: strings.Repeat("a log line of twenty\n", n) + "the end"}
-			if w := failureWords(f); len(w) > MaxWords {
-				t.Errorf("1901/AC5: cause %d bytes, %d lines: words are %d bytes, bound %d", len(cause), n, len(w), MaxWords)
+			if w := rules.FailureWords(f); len(w) > rules.MaxWords {
+				t.Errorf("1901/AC5: cause %d bytes, %d lines: words are %d bytes, bound %d", len(cause), n, len(w), rules.MaxWords)
 			}
 		}
 	}
diff --git a/modules/mesh-delivery-checker/internal/check/results.go b/modules/mesh-delivery-checker/internal/check/results.go
index 8f1cecb8..7d26e72d 100644
--- a/modules/mesh-delivery-checker/internal/check/results.go
+++ b/modules/mesh-delivery-checker/internal/check/results.go
@@ -4,8 +4,8 @@ import (
 	"encoding/json"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"mesh-delivery-checker/rules"
 )
 
 // The shapes of what the build modules' steps answer, as their code writes them (mesh-catalog modules/mesh-build-go
@@ -60,57 +60,13 @@ type ProgramFile struct {
 	Commit string `json:"commit,omitempty"`
 }
 
-// GoPackage is one package of a Go test result.
-type GoPackage struct {
-	Dir     string  `json:"dir"`
-	Package string  `json:"package"`
-	Passed  bool    `json:"passed"`
-	Elapsed float64 `json:"elapsed"`
-	Tests   int     `json:"tests"`
-	NoTests bool    `json:"no_tests,omitempty"`
-	// Skipped is how many of the package's tests skipped; an older build module names none.
-	Skipped int `json:"skipped,omitempty"`
-}
-
-// Failure is a test that failed, or a package that failed with no test to name: the build modules' failure contract
-// (buildstep.Failure, issue 1901), its cause never empty and never a passing line from a build module that keeps it.
-type Failure = buildstep.Failure
-
-// TestTime is one test and the seconds it took.
-type TestTime struct {
-	Package string  `json:"package"`
-	Test    string  `json:"test"`
-	Elapsed float64 `json:"elapsed"`
-}
-
-// Tested is the answer of a test step of either build module (the Go one names packages and counts tests; the Node one
-// names the package directory as Module and counts none).
-type Tested struct {
-	Level    string      `json:"level"`
-	Module   string      `json:"module,omitempty"`
-	Passed   bool        `json:"passed"`
-	Why      string      `json:"why,omitempty"`
-	NoTests  bool        `json:"no_tests,omitempty"`
-	Tests    int         `json:"tests"`
-	Skipped  int         `json:"skipped"`
-	Packages []GoPackage `json:"packages,omitempty"`
-	Elapsed  float64     `json:"elapsed"`
-	Setup    float64     `json:"setup,omitempty"`
-	// Lint is the unit level's gofmt and go vet time, before its tests (mesh-build-go, ADR 0529 §1).
-	Lint       float64    `json:"lint,omitempty"`
-	Bound      float64    `json:"bound"`
-	SetupBound float64    `json:"setup_bound,omitempty"`
-	Slowest    []TestTime `json:"slowest,omitempty"`
-	Failed     []Failure  `json:"failed,omitempty"`
-	OverBound  bool       `json:"over_bound"`
-	OverWhich  string     `json:"over_which,omitempty"`
-	// JudgedBy is the program that ran the step (ADR 0535 §5): "installed", or "candidate <merge commit>" under runner
-	// workspace; absent from a build module that does not take the runner.
-	JudgedBy string `json:"judged_by,omitempty"`
-	// By is the build module that answered and the SDK it was built with (buildstep.By); absent from a build module from
-	// before the failure contract.
-	By string `json:"by,omitempty"`
-}
+// The test step's answer is read by the judging rules (milestone 47/B0); these name their shapes here.
+type (
+	Failure   = rules.Failure
+	TestTime  = rules.TestTime
+	Tested    = rules.Tested
+	GoPackage = rules.GoPackage
+)
 
 // Digested is the answer of the Go build module's digest step: one digest per package that has tests at the level, by import
 // path.
diff --git a/modules/mesh-delivery-checker/rules/facts.go b/modules/mesh-delivery-checker/rules/facts.go
new file mode 100644
index 00000000..d903706e
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/facts.go
@@ -0,0 +1,209 @@
+// Package rules is the checker's judging rules, the checking program's: given the facts of one check (what the build
+// modules, the manifest validator and the composer answered, and what failed in the asking), the verdict (novox/hq ADR
+// 0644, ADR 0656; design 47's bootstrap delivery). The running checker asks, waits, keeps and records; it gathers the
+// facts and has them judged by the checking program built from the change's heads (cmd/mesh-checking-program), which
+// imports this package, so a change to a rule is judged by its own rule.
+//
+// It is the checker module's own package (novox/hq ADR 0634 §1): no seat carries it and no other module imports it.
+package rules
+
+import (
+	"encoding/json"
+	"fmt"
+	"path"
+	"sort"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// FactsVersion is the version of Facts this program reads. A checking program built from a later change reads the facts
+// a running checker of this version writes, so a version is added to, never changed; a program refuses one it does not
+// read, naming it (DecodeFacts).
+const FactsVersion = 1
+
+// Facts are everything one check judges, in the order the running checker met it.
+type Facts struct {
+	V int `json:"v"`
+	// Group and Heads name the check (delivery.Verdict's Group and Heads); Trunk is each repository's trunk head merged.
+	Group   string            `json:"group"`
+	Heads   string            `json:"heads"`
+	Trunk   map[string]string `json:"trunk,omitempty"`
+	Members []Member          `json:"members"`
+	// Steps are, in the order met, each level a build module answered and each failure the asking met.
+	Steps []Step `json:"steps,omitempty"`
+	// CloneMS is how much of the steps' time their levels' running did not take (delivery.Took.Clone).
+	CloneMS int64 `json:"clone-ms,omitempty"`
+	// Notes are the running checker's notes of the check, for a reader.
+	Notes []string `json:"notes,omitempty"`
+}
+
+// Member is one pull request of the check.
+type Member struct {
+	Repository string `json:"repository"`
+	Number     int    `json:"number"`
+	Head       string `json:"head"`
+	Trunk      string `json:"trunk,omitempty"`
+}
+
+// Step is one fact of a member's check step: the node that ran it, and either one level its build module answered
+// (Level, as the build module gave it) or a failure the asking met (Failed: a step not asked, refused or not answered,
+// a conflict, a binary, worded by the running checker). A step with neither only says which node ran it.
+type Step struct {
+	Repository string                `json:"repository"`
+	Number     int                   `json:"number"`
+	Module     string                `json:"module,omitempty"`
+	Node       string                `json:"node,omitempty"`
+	Level      *delivery.LevelAnswer `json:"level,omitempty"`
+	Failed     *delivery.FailedFirst `json:"failed,omitempty"`
+}
+
+// DecodeFacts reads facts, refusing a version this program does not read, naming it.
+func DecodeFacts(data []byte) (Facts, error) {
+	var f Facts
+	if err := json.Unmarshal(data, &f); err != nil {
+		return Facts{}, fmt.Errorf("rules: the facts are not JSON of their shape: %w", err)
+	}
+	if f.V != FactsVersion {
+		return Facts{}, fmt.Errorf("rules: facts of version %d, this checking program reads version %d", f.V, FactsVersion)
+	}
+	return f, nil
+}
+
+// Counts are one level's counts across a check's members.
+type Counts struct {
+	Run, Kept, Skipped int
+	Elapsed, Setup     float64
+	Lint               float64
+	Over               bool
+	Slowest            []TestTime
+}
+
+// Tally is a check's counts by level.
+type Tally map[string]*Counts
+
+// NewTally is a tally of both levels, at nothing.
+func NewTally() Tally {
+	return Tally{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}
+}
+
+// Level judges one level of a member's check step as it was answered: the kept ones taken are counted, and every test
+// result is read and counted, also after one that did not pass, so the verdict names every failed test of the level
+// (issue 1921). It answers the level's failure (nil when it passed), its running time (its tests' and setup's) and the
+// results read, for the running checker to keep the passes from.
+func (t Tally) Level(repository string, number int, module, node string, la delivery.LevelAnswer) (*delivery.Verdict, float64, []Tested) {
+	a := t[la.Level]
+	if a == nil {
+		return failAt(node, fmt.Sprintf("the check of %s#%d answered the level %q, which is no level", repository, number, la.Level)), 0, nil
+	}
+	for _, k := range la.Kept {
+		a.Kept += k.Tests
+	}
+	elapsed := 0.0
+	var results, failed []Tested
+	for _, raw := range la.Tests {
+		var res Tested
+		if err := json.Unmarshal(raw, &res); err != nil {
+			return failAt(node, fmt.Sprintf("the %s level of %s#%d answered what is not a result: %v", la.Level, repository, number, err)), elapsed, results
+		}
+		results = append(results, res)
+		elapsed += res.Elapsed + res.Setup + res.Lint
+		if module == buildrun.NodeBuildModule {
+			if !res.NoTests {
+				a.Run++ // a Node package is counted whole: its build module counts no tests (ADR 0484 clause 10)
+			}
+		} else {
+			a.Run += res.Tests
+			a.Skipped += res.Skipped
+			a.Slowest = append(a.Slowest, res.Slowest...)
+		}
+		a.Elapsed += res.Elapsed
+		a.Setup += res.Setup
+		a.Lint += res.Lint
+		a.Over = a.Over || res.OverBound
+		if !res.Passed {
+			failed = append(failed, res)
+		}
+	}
+	if len(failed) > 0 {
+		return LevelFailure(repository, module, la.Level, failed...), elapsed, results
+	}
+	return nil, elapsed, results
+}
+
+// Judge is the verdict of the facts: every failure in the order met, joined and settled, or a pass; the levels'
+// counts, times, machines and the levels over their bound; the composition not yet run (the running checker composes).
+func Judge(f Facts) delivery.Verdict {
+	tally := NewTally()
+	var failures []*delivery.Verdict
+	nodes := map[string]bool{}
+	for _, s := range f.Steps {
+		if s.Node != "" {
+			nodes[s.Node] = true
+		}
+		switch {
+		case s.Failed != nil:
+			failures = append(failures, &delivery.Verdict{State: delivery.VerdictFail, Failed: *s.Failed})
+		case s.Level != nil:
+			if v, _, _ := tally.Level(s.Repository, s.Number, s.Module, s.Node, *s.Level); v != nil {
+				failures = append(failures, v)
+			}
+		}
+	}
+	v := delivery.Verdict{State: delivery.VerdictPass}
+	if joined := Settled(JoinFailures(failures...)); joined != nil {
+		v = *joined
+	}
+	v.Group, v.Heads, v.Trunk = f.Group, f.Heads, f.Trunk
+	Outcome(&v, tally, f.CloneMS, nodes)
+	return v
+}
+
+// Outcome fills a verdict's levels (on a pass, or when it names none), times, machines and levels over their bound from
+// the tally, and says its composition is not yet run (ADR 0484 clause 6).
+func Outcome(v *delivery.Verdict, tally Tally, cloneMS int64, nodes map[string]bool) {
+	if v.State == delivery.VerdictPass || len(v.Levels) == 0 {
+		v.Levels = map[string]delivery.LevelResult{}
+		for level, a := range tally {
+			v.Levels[level] = delivery.LevelResult{Run: a.Run, Kept: a.Kept, Skipped: a.Skipped}
+		}
+	}
+	ms := func(s float64) int64 { return int64(s * 1000) }
+	u, i := tally[delivery.LevelUnit], tally[delivery.LevelIntegration]
+	v.Took = delivery.Took{Clone: cloneMS, Unit: ms(u.Elapsed), Lint: ms(u.Lint), IntegrationSetup: ms(i.Setup), IntegrationRun: ms(i.Elapsed)}
+	v.Machines = nil
+	for node := range nodes {
+		v.Machines = append(v.Machines, node)
+	}
+	sort.Strings(v.Machines)
+	v.OverBound = nil
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		if tally[level].Over {
+			v.OverBound = append(v.OverBound, level)
+		}
+	}
+	v.Composition = &delivery.Composition{State: delivery.CompositionNotRun}
+}
+
+// Slowest are, of each level over its bound, its three slowest tests, worded for the status line.
+func Slowest(tally Tally) []string {
+	var slow []string
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		a := tally[level]
+		if !a.Over {
+			continue
+		}
+		sort.SliceStable(a.Slowest, func(x, y int) bool { return a.Slowest[x].Elapsed > a.Slowest[y].Elapsed })
+		for n, s := range a.Slowest {
+			if n == 3 {
+				break
+			}
+			slow = append(slow, fmt.Sprintf("%s %s %.1fs", level, path.Base(s.Package)+"."+s.Test, s.Elapsed))
+		}
+	}
+	return slow
+}
+
+func failAt(machine, words string) *delivery.Verdict {
+	return &delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: machine, Words: words}}
+}
diff --git a/modules/mesh-delivery-checker/rules/results.go b/modules/mesh-delivery-checker/rules/results.go
new file mode 100644
index 00000000..cd6c22b7
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/results.go
@@ -0,0 +1,59 @@
+package rules
+
+import "git.novox.be/novox/mesh-sdk/go/buildstep"
+
+// The shapes of a test step's answer, as the build modules' code writes them (mesh-catalog modules/mesh-build-go
+// cmd/mesh-build-go levels.go TestResult; modules/mesh-build-node cmd/mesh-build-node check.go TestResult). Only the
+// fields the rules read are named; the rest is ignored.
+
+// GoPackage is one package of a Go test result.
+type GoPackage struct {
+	Dir     string  `json:"dir"`
+	Package string  `json:"package"`
+	Passed  bool    `json:"passed"`
+	Elapsed float64 `json:"elapsed"`
+	Tests   int     `json:"tests"`
+	NoTests bool    `json:"no_tests,omitempty"`
+	// Skipped is how many of the package's tests skipped; an older build module names none.
+	Skipped int `json:"skipped,omitempty"`
+}
+
+// Failure is a test that failed, or a package that failed with no test to name: the build modules' failure contract
+// (buildstep.Failure, issue 1901), its cause never empty and never a passing line from a build module that keeps it.
+type Failure = buildstep.Failure
+
+// TestTime is one test and the seconds it took.
+type TestTime struct {
+	Package string  `json:"package"`
+	Test    string  `json:"test"`
+	Elapsed float64 `json:"elapsed"`
+}
+
+// Tested is the answer of a test step of either build module (the Go one names packages and counts tests; the Node one
+// names the package directory as Module and counts none).
+type Tested struct {
+	Level    string      `json:"level"`
+	Module   string      `json:"module,omitempty"`
+	Passed   bool        `json:"passed"`
+	Why      string      `json:"why,omitempty"`
+	NoTests  bool        `json:"no_tests,omitempty"`
+	Tests    int         `json:"tests"`
+	Skipped  int         `json:"skipped"`
+	Packages []GoPackage `json:"packages,omitempty"`
+	Elapsed  float64     `json:"elapsed"`
+	Setup    float64     `json:"setup,omitempty"`
+	// Lint is the unit level's gofmt and go vet time, before its tests (mesh-build-go, ADR 0529 §1).
+	Lint       float64    `json:"lint,omitempty"`
+	Bound      float64    `json:"bound"`
+	SetupBound float64    `json:"setup_bound,omitempty"`
+	Slowest    []TestTime `json:"slowest,omitempty"`
+	Failed     []Failure  `json:"failed,omitempty"`
+	OverBound  bool       `json:"over_bound"`
+	OverWhich  string     `json:"over_which,omitempty"`
+	// JudgedBy is the program that ran the step (ADR 0535 §5): "installed", or "candidate <merge commit>" under runner
+	// workspace; absent from a build module that does not take the runner.
+	JudgedBy string `json:"judged_by,omitempty"`
+	// By is the build module that answered and the SDK it was built with (buildstep.By); absent from a build module from
+	// before the failure contract.
+	By string `json:"by,omitempty"`
+}
diff --git a/modules/mesh-delivery-checker/rules/words.go b/modules/mesh-delivery-checker/rules/words.go
new file mode 100644
index 00000000..7571e809
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/words.go
@@ -0,0 +1,280 @@
+package rules
+
+import (
+	"fmt"
+	"strings"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The words rules: how a failed test, a failed package and a list of failures are worded in a verdict (issue 1901, issue
+// 1921). Moved whole from the running checker's package (milestone 47/B0): they are the checking program's.
+
+// FailedName names a failure: its package and test.
+func FailedName(f Failure) string {
+	if f.Test == "" {
+		return f.Package
+	}
+	return f.Package + "." + f.Test
+}
+
+// MaxWords is the most a failed test's words in a verdict hold (issue 1901). **The words keep the failure's last lines**,
+// where a test says why it failed: the first line is often something it logged before (the group r4g verdict kept a
+// "judged against" line and lost the t.Fatalf after it), and the 120 characters kept before cut a docker command's echo
+// before docker's own error. Four kilobytes holds a long message and is small beside a verdict's other parts.
+const MaxWords = 4096
+
+// FailureWords is a failure's words: its output's last lines up to MaxWords, with the line the build module told apart as
+// the test's error first when the output does not start with it, so the first line of the words is the cause and the
+// status line, which is cut short, names it. **A failure's words are never "PASS" or "ok"** (issue 1901, its third
+// meeting: a package that failed after its tests passed was worded "PASS"): go test's summary lines are dropped, and with
+// no cause told apart (an older build module) the cause is the output's first "panic:", "fatal error:" or "signal:"
+// line, read before the output is cut, or the words say the tests passed and the program failed after them.
+func FailureWords(f Failure) string {
+	return FailureWordsAfter(f, "")
+}
+
+// FailureWordsAfter is FailureWords with the line loud put first, within the same MaxWords: what the checker itself says of
+// the failure (that the build module hid it), which the status line then names.
+func FailureWordsAfter(f Failure, loud string) string {
+	out, passed := DropSummary(strings.TrimSpace(f.Output))
+	cause := strings.TrimSpace(f.Cause)
+	if cause == "" {
+		cause = CauseIn(out)
+	}
+	switch {
+	case cause == "" && out == "" && passed:
+		cause = "the tests passed, then the test program exited with a failure: an os.Exit or a panic in TestMain or after the tests"
+	case cause == "" && out == "":
+		// The build module on main sends a package that stopped (a timeout, an exit, a kill) as its "FAIL" line alone.
+		cause = "the package failed with no test to name and no panic, signal or build error in its output (an older build module sent no cause)"
+	}
+	if len(cause) > MaxCause {
+		cause = strings.ToValidUTF8(cause[:MaxCause], "") + "..."
+	}
+	// The words keep MaxWords exactly: the loud line, the cause and their newlines, the marker and the kept lines.
+	budget := MaxWords
+	if cause != "" {
+		budget -= len(cause) + 1
+	}
+	if loud != "" {
+		budget -= len(loud) + 1
+	}
+	if len(out) > budget {
+		const marker = "... "
+		tail := out[len(out)-(budget-len(marker)):]
+		// Start on a whole line, and a whole character.
+		if i := strings.IndexByte(tail, '\n'); i >= 0 {
+			tail = strings.TrimLeft(tail[i:], "\n")
+		}
+		out = marker + strings.ToValidUTF8(tail, "")
+	}
+	if cause != "" && !strings.HasPrefix(FirstLine(out), cause) {
+		out = strings.TrimRight(cause+"\n"+out, "\n")
+	}
+	if loud != "" {
+		out = strings.TrimRight(loud+"\n"+out, "\n")
+	}
+	return out
+}
+
+// HidWords is the checker's loud line for a failure the build module sent hiding its cause (issue 1901, its thorough
+// fix): with no cause, or a passing line as its cause, under the failure contract (buildstep.Hidden). It names the build
+// module and the version it says it is (Tested.By, "<module> with mesh-sdk <version>"); one from before the contract
+// says nothing of itself. "" when the failure keeps the contract. The check fails either way: only its words change.
+func HidWords(module, by string, f Failure) string {
+	why := buildstep.Hidden(f)
+	if why == "" {
+		return ""
+	}
+	version := "a version before the failure contract"
+	if module == "" {
+		module = "an unnamed build module"
+	}
+	if m, v, ok := strings.Cut(by, " with "); ok && m != "" {
+		module, version = m, v
+	}
+	return fmt.Sprintf("the build module hid the failure (%s at %s): %s", module, version, why)
+}
+
+// MaxCause is the most a cause in a failure's words holds: one long line (the 1901 review: a cause of a kilobyte could
+// push the words past MaxWords).
+const MaxCause = 1024
+
+// DropSummary drops go test's summary lines from a failure's output ("PASS", "FAIL", "ok <pkg>", "FAIL <pkg>"), and says
+// whether a "PASS" was among them: the package's tests passed before it failed.
+func DropSummary(out string) (string, bool) {
+	passed := false
+	lines := strings.Split(out, "\n")
+	kept := lines[:0]
+	for _, l := range lines {
+		// go's exact forms only (review round 1): "PASS" or "FAIL" alone, "ok  \t<pkg>\t<time>", "FAIL\t<pkg>\t<time>".
+		switch t := strings.TrimRight(l, "\r"); {
+		case t == "PASS":
+			passed = true
+		case t == "FAIL", strings.HasPrefix(t, "ok  \t"), strings.HasPrefix(t, "FAIL\t"):
+		default:
+			kept = append(kept, l)
+		}
+	}
+	return strings.TrimSpace(strings.Join(kept, "\n")), passed
+}
+
+// CauseIn is a race the race detector reported, as its heading, its access and the frame that made it ("WARNING: DATA
+// RACE: Write at 0x... by goroutine 9 in pkg.F.func1()"); else the first "panic:", "fatal error:" or "signal:" line of a
+// failure's output, in that order; or "". **Only lines at column 0**, where go prints the runtime's: a test's indented log
+// line holding the same words is not the cause (review round 1).
+func CauseIn(out string) string {
+	lines := strings.Split(out, "\n")
+	for i, l := range lines {
+		if strings.TrimRight(l, "\r") != "WARNING: DATA RACE" {
+			continue
+		}
+		words := "WARNING: DATA RACE"
+		if i+1 < len(lines) && strings.TrimSpace(lines[i+1]) != "" {
+			words += ": " + strings.TrimSuffix(strings.TrimSpace(lines[i+1]), ":")
+			if i+2 < len(lines) && strings.HasPrefix(lines[i+2], "  ") {
+				words += " in " + strings.TrimSpace(lines[i+2])
+			}
+		}
+		return words
+	}
+	for _, prefix := range []string{"panic: ", "fatal error: ", "signal: "} {
+		for _, l := range lines {
+			if l = strings.TrimRight(l, "\r"); strings.HasPrefix(l, prefix) {
+				return l
+			}
+		}
+	}
+	return ""
+}
+
+// FirstLine is the first non-empty line of a failure's words.
+func FirstLine(s string) string {
+	for _, l := range strings.Split(s, "\n") {
+		if l = strings.TrimSpace(l); l != "" {
+			return l
+		}
+	}
+	return ""
+}
+
+// MaxFailureLine is the most bytes of a failure's line in a verdict's Failures: the first line of its words, which is
+// its cause where the build module told one apart (issue 1901). Failed keeps the first failure's words whole.
+const MaxFailureLine = 300
+
+// LevelFailure turns a level that did not pass into a verdict: Failed names what failed first with its words whole,
+// and Failures every failed test of the level's results with its first line, at most delivery.MaxFailures and an entry
+// saying how many more (issue 1921).
+func LevelFailure(repository, module, level string, results ...Tested) *delivery.Verdict {
+	v := delivery.Verdict{State: delivery.VerdictFail}
+	var all []delivery.FailedFirst
+	for _, res := range results {
+		if len(res.Failed) == 0 {
+			why := res.Why
+			if why == "" {
+				why = "the " + level + " level did not pass"
+			}
+			all = append(all, delivery.FailedFirst{Test: level + ": " + repository, Words: why})
+			continue
+		}
+		for _, f := range res.Failed {
+			name := FailedName(f)
+			if module == buildrun.NodeBuildModule && f.Package == "" {
+				name = res.Module
+			}
+			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: FailureWordsAfter(f, HidWords(module, res.By, f))})
+		}
+	}
+	if len(all) == 0 { // no result: a level said failed with nothing to name
+		all = append(all, delivery.FailedFirst{Test: level + ": " + repository, Words: "the " + level + " level did not pass"})
+	}
+	v.Failed = all[0]
+	v.Failures = all // whole: Settled cuts them to their first lines once every failure of the check is joined
+	return &v
+}
+
+// JoinFailures is one failed verdict of every failure of vs, in the order given (a nil one passed), unsettled: Failed is
+// the first whole, and Failures every failure whole, or none when the one failure is no level's (a conflict, a refused
+// step: one line, as before issue 1921). Nil when none failed.
+func JoinFailures(vs ...*delivery.Verdict) *delivery.Verdict {
+	var out *delivery.Verdict
+	var all []delivery.FailedFirst
+	listed := false
+	for _, v := range vs {
+		if v == nil {
+			continue
+		}
+		if out == nil {
+			out = &delivery.Verdict{State: delivery.VerdictFail, Failed: v.Failed}
+		}
+		if len(v.Failures) > 0 {
+			all, listed = append(all, v.Failures...), true
+			continue
+		}
+		all = append(all, v.Failed)
+	}
+	if out != nil && (listed || len(all) > 1) {
+		out.Failures = all
+	}
+	return out
+}
+
+// Settled is a joined verdict as it is written: each failure of its list cut to its first line, at most
+// delivery.MaxFailures and then how many more (FailureLines).
+func Settled(v *delivery.Verdict) *delivery.Verdict {
+	if v != nil && len(v.Failures) > 0 {
+		v.Failures = FailureLines(v.Failures)
+	}
+	return v
+}
+
+// AddFailure is a Settled list of failures with one more at its end: the first failure is put first when the list is
+// empty (a verdict of one failure keeps none), and past delivery.MaxFailures the last entry counts one more.
+func AddFailure(v *delivery.Verdict, f delivery.FailedFirst) {
+	if len(v.Failures) == 0 {
+		v.Failures = FailureLines([]delivery.FailedFirst{v.Failed})
+	}
+	if n := len(v.Failures); n > delivery.MaxFailures {
+		v.Failures[n-1].Test = fmt.Sprintf("and %d more", FailedCount(*v)-delivery.MaxFailures+1)
+		return
+	}
+	v.Failures = append(v.Failures, FailureLines([]delivery.FailedFirst{f})...)
+}
+
+// FailureLines is every failure with the first line of its words, cut to MaxFailureLine, at most delivery.MaxFailures
+// and then one entry saying how many more failed.
+func FailureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
+	n := min(len(all), delivery.MaxFailures)
+	out := make([]delivery.FailedFirst, 0, n+1)
+	for _, f := range all[:n] {
+		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: ClipLine(FirstLine(f.Words), MaxFailureLine)})
+	}
+	if more := len(all) - n; more > 0 {
+		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})
+	}
+	return out
+}
+
+// ClipLine cuts a line to at most n bytes on a whole character, marking the cut.
+func ClipLine(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	s = strings.ToValidUTF8(s[:n-3], "")
+	return s + "..."
+}
+
+// FailedCount is how many failures a verdict names, the ones after delivery.MaxFailures counted too.
+func FailedCount(v delivery.Verdict) int {
+	n := len(v.Failures)
+	if n > delivery.MaxFailures {
+		var more int
+		if _, err := fmt.Sscanf(v.Failures[n-1].Test, "and %d more", &more); err == nil {
+			return delivery.MaxFailures + more
+		}
+	}
+	return n
+}

From 61aa338887e7bb63edc421fe9a614016545bb413 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:13:37 +0100
Subject: [PATCH 02/17] Add the checking program: it answers the verdict of a
 check's facts (issue 1921)

mesh-checking-program -verdict reads the facts from the file the build
seat's run step names, judges them with the rules package and answers
one versioned line; facts of a version it does not read are refused,
naming it, because the running checker of B0 runs G's programs
(milestone 47/B0, ADR 0644, ADR 0656).

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-checking-program/main.go         | 59 +++++++++++++++
 .../cmd/mesh-checking-program/main_test.go    | 74 +++++++++++++++++++
 modules/mesh-delivery-checker/rules/facts.go  |  9 +++
 3 files changed, 142 insertions(+)
 create mode 100644 modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
 create mode 100644 modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go

diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
new file mode 100644
index 00000000..82e45fc6
--- /dev/null
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
@@ -0,0 +1,59 @@
+// Command mesh-checking-program is the checker's checking program (novox/hq ADR 0644, ADR 0656; design 47's bootstrap
+// delivery): built from a check's heads and run in the build seat's sandbox through the seat node-build-go's ask run,
+// with no network and no bus account, it reads the check's facts from the file MESH_RUN_INPUT names and answers the
+// verdict the judging rules give them, as one JSON line on its standard output (rules.Answer).
+//
+//	mesh-checking-program -verdict
+//
+// It refuses facts of a version it does not read, naming it, with exit 2.
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"mesh-delivery-checker/rules"
+)
+
+func main() {
+	os.Exit(run(os.Args[1:], os.Getenv, os.Stdout, os.Stderr))
+}
+
+// run is the command over its arguments, environment and outputs, answering its exit.
+func run(args []string, getenv func(string) string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("mesh-checking-program", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	verdict := fs.Bool("verdict", false, "answer the verdict of the facts in the input")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	refuse := func(format string, a ...any) int {
+		fmt.Fprintf(stderr, "mesh-checking-program: "+format+"\n", a...)
+		return 2
+	}
+	if !*verdict {
+		return refuse("nothing asked: give -verdict")
+	}
+	file := getenv(delivery.RunInputEnv)
+	if file == "" {
+		return refuse("no input: %s names no file", delivery.RunInputEnv)
+	}
+	data, err := os.ReadFile(file)
+	if err != nil {
+		return refuse("the input cannot be read: %v", err)
+	}
+	facts, err := rules.DecodeFacts(data)
+	if err != nil {
+		return refuse("%v", err)
+	}
+	line, err := json.Marshal(rules.Answer{V: rules.AnswerVersion, Verdict: rules.Judge(facts)})
+	if err != nil {
+		return refuse("the verdict cannot be written: %v", err)
+	}
+	fmt.Fprintf(stdout, "%s\n", line)
+	return 0
+}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
new file mode 100644
index 00000000..b45af7c6
--- /dev/null
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
@@ -0,0 +1,74 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"mesh-delivery-checker/rules"
+)
+
+// 1921 (B0, D2): the checking program answers, on its last line, the verdict the rules give the facts in its input, and
+// refuses facts of a version it does not read, an input it is not given, and a question it is not asked, naming each.
+func TestTheCheckingProgramAnswersTheVerdictOfItsFacts(t *testing.T) {
+	failing, _ := json.Marshal(rules.Tested{Level: delivery.LevelUnit, Tests: 3, Failed: []rules.Failure{{Package: "x/a", Test: "TestA", Cause: "a_test.go:9: boom"}}})
+	facts := rules.Facts{V: rules.FactsVersion, Group: "feat/x", Heads: "0123456789ab", Members: []rules.Member{{Repository: "novox/x", Number: 3, Head: "h"}},
+		Steps: []rules.Step{
+			{Repository: "novox/x", Number: 3, Module: "mesh-build-go", Node: "laptop", Level: &delivery.LevelAnswer{Level: delivery.LevelUnit, Tests: []json.RawMessage{failing}}},
+			{Repository: "novox/x", Number: 3, Failed: &delivery.FailedFirst{Machine: "laptop", Words: "novox/x#3 has files in conflict: go.mod"}},
+		}}
+	dir := t.TempDir()
+	write := func(name string, v any) string {
+		data, _ := json.Marshal(v)
+		p := filepath.Join(dir, name)
+		if err := os.WriteFile(p, data, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return p
+	}
+	v1 := write("v1.json", facts)
+	later := facts
+	later.V = rules.FactsVersion + 1
+	v2 := write("v2.json", later)
+	for name, c := range map[string]struct {
+		args  []string
+		input string
+		exit  int
+		said  string
+	}{
+		"the facts":         {[]string{"-verdict"}, v1, 0, ""},
+		"a later version":   {[]string{"-verdict"}, v2, 2, "facts of version 2, this checking program reads version 1"},
+		"no input":          {[]string{"-verdict"}, "", 2, delivery.RunInputEnv + " names no file"},
+		"nothing asked":     {nil, v1, 2, "nothing asked"},
+		"an unknown asking": {[]string{"-judge"}, v1, 2, "-judge"},
+	} {
+		var out, errs bytes.Buffer
+		exit := run(c.args, func(k string) string {
+			if k == delivery.RunInputEnv {
+				return c.input
+			}
+			return ""
+		}, &out, &errs)
+		if exit != c.exit || !strings.Contains(errs.String(), c.said) {
+			t.Errorf("%s: exit %d, said %q; want %d and %q", name, exit, errs.String(), c.exit, c.said)
+			continue
+		}
+		if c.exit != 0 {
+			continue
+		}
+		lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+		var a rules.Answer
+		if err := json.Unmarshal([]byte(lines[len(lines)-1]), &a); err != nil || a.V != rules.AnswerVersion {
+			t.Fatalf("%s: the last line %q: %v", name, lines[len(lines)-1], err)
+		}
+		if want := rules.Judge(facts); !reflect.DeepEqual(a.Verdict, want) || a.Verdict.State != delivery.VerdictFail || len(a.Verdict.Failures) != 2 ||
+			a.Verdict.Failures[1].Words != "novox/x#3 has files in conflict: go.mod" || a.Verdict.Machines[0] != "laptop" || a.Verdict.Levels[delivery.LevelUnit].Run != 3 {
+			t.Errorf("%s: the verdict %+v, want %+v", name, a.Verdict, want)
+		}
+	}
+}
diff --git a/modules/mesh-delivery-checker/rules/facts.go b/modules/mesh-delivery-checker/rules/facts.go
index d903706e..b3f33e28 100644
--- a/modules/mesh-delivery-checker/rules/facts.go
+++ b/modules/mesh-delivery-checker/rules/facts.go
@@ -207,3 +207,12 @@ func Slowest(tally Tally) []string {
 func failAt(machine, words string) *delivery.Verdict {
 	return &delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: machine, Words: words}}
 }
+
+// AnswerVersion is the version of Answer this program writes.
+const AnswerVersion = 1
+
+// Answer is what the checking program answers on the last line of its standard output: its version and the verdict.
+type Answer struct {
+	V       int              `json:"v"`
+	Verdict delivery.Verdict `json:"verdict"`
+}

From cd201a79f1057f6cb379c84e3670b67748af7c81 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:20:42 +0100
Subject: [PATCH 03/17] Every failure the asking meets is a fact of the check,
 and the verdict is the rules' of the facts (issue 1921)

The running checker records each failure where it is met and the node of each step it reads; the verdict is
rules.Judge of those facts, so the checking program, given the same facts, gives the same verdict. Its own
second outcome and its node set are gone.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../internal/check/binaries.go                |  2 +-
 .../internal/check/every_failure_test.go      |  2 +-
 .../internal/check/examiner_test.go           |  4 ++
 .../internal/check/graph_cycle.go             |  4 +-
 .../internal/check/judge.go                   | 57 +++++++++++--------
 .../internal/check/manifests_judge.go         | 18 +++---
 6 files changed, 50 insertions(+), 37 deletions(-)

diff --git a/modules/mesh-delivery-checker/internal/check/binaries.go b/modules/mesh-delivery-checker/internal/check/binaries.go
index 5329c61d..1835be61 100644
--- a/modules/mesh-delivery-checker/internal/check/binaries.go
+++ b/modules/mesh-delivery-checker/internal/check/binaries.go
@@ -36,7 +36,7 @@ func (st *state) checkBinariesOf(t *target) verdictPtr {
 		found = append(found, p.Path+": a compiled program is build output: remove it and add it to .gitignore (issue 1577)")
 	}
 	if len(found) > 0 {
-		return failed(t.node, fmt.Sprintf("%s: %s", key, strings.Join(found, "; ")))
+		return st.fail(t.node, fmt.Sprintf("%s: %s", key, strings.Join(found, "; ")))
 	}
 	return nil
 }
diff --git a/modules/mesh-delivery-checker/internal/check/every_failure_test.go b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
index d4ba7709..162f19b5 100644
--- a/modules/mesh-delivery-checker/internal/check/every_failure_test.go
+++ b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
@@ -23,7 +23,7 @@ func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
 
 func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
 	t.Helper()
-	st := &state{j: &Examiner{}, c: &Case{}, levels: rules.NewTally(), nodes: map[string]bool{}}
+	st := &state{j: &Examiner{}, c: &Case{}, levels: rules.NewTally()}
 	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
 	v = rules.Settled(rules.JoinFailures(v))
 	// 1921 (B0, D1a): the facts the running checker gathered, judged by the rules, give the same failures and counts.
diff --git a/modules/mesh-delivery-checker/internal/check/examiner_test.go b/modules/mesh-delivery-checker/internal/check/examiner_test.go
index e0c03e66..4965b20f 100644
--- a/modules/mesh-delivery-checker/internal/check/examiner_test.go
+++ b/modules/mesh-delivery-checker/internal/check/examiner_test.go
@@ -550,6 +550,10 @@ func TestAHeadThatDoesNotMergeEndsFailedNamingTheFilesAndRunsNoTest(t *testing.T
 	if n := len(b.steps.tool("digest")) + len(b.steps.tool("test")); n != 0 {
 		t.Errorf("%d digest and test steps ran after a conflict", n)
 	}
+	// 1921/D1c: the node that ran the step is a fact, so the verdict judged from the facts names its machine.
+	if m := out.Verdict.Machines; len(m) != 1 || m[0] != "shanks" {
+		t.Errorf("machines = %v, want the node that ran the step", m)
+	}
 }
 
 func TestALevelWhoseDigestIsNotNamedRunsWholeAndKeepsNothing(t *testing.T) { // 1287/AC4
diff --git a/modules/mesh-delivery-checker/internal/check/graph_cycle.go b/modules/mesh-delivery-checker/internal/check/graph_cycle.go
index b3209485..1aa6804a 100644
--- a/modules/mesh-delivery-checker/internal/check/graph_cycle.go
+++ b/modules/mesh-delivery-checker/internal/check/graph_cycle.go
@@ -51,7 +51,7 @@ func (st *state) refuseCycle(ctx context.Context) *delivery.Verdict {
 	}
 	change, err := read(req.Cases[0].Manifests)
 	if err != nil {
-		return fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
+		return st.fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
 	}
 	cycle := graph.OfManifests(change).Cycle()
 	if cycle == nil {
@@ -71,6 +71,6 @@ func (st *state) refuseCycle(ctx context.Context) *delivery.Verdict {
 			return nil
 		}
 	}
-	return fail(goModule, fmt.Sprintf("the change's module graph has the cycle %s: these modules would each wait for the other for "+
+	return st.fail(goModule, fmt.Sprintf("the change's module graph has the cycle %s: these modules would each wait for the other for "+
 		"good, through their bases, the provisions and bus state they await, or the verbs they invoke (ADR 0603 §2, ADR 0614 §6)", words))
 }
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index e9981b10..2826afd7 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -50,8 +50,6 @@ const (
 // verdictPtr is a verdict of failure a step of the check ends with.
 type verdictPtr = *delivery.Verdict
 
-func failed(machine, words string) verdictPtr { return fail(machine, words) }
-
 // Asks puts a check's ask on its build seat's stream and waits for its step (buildrun.Asker; ADR 0525 §1, §6): the
 // checker chooses no node, starts no step and holds none; whichever build node pulls the ask runs the check.
 type Asks interface {
@@ -236,7 +234,6 @@ type state struct {
 	levels  rules.Tally
 	// facts are the facts of the check met so far, in order: what the checking program judges (milestone 47/B0).
 	facts []rules.Step
-	nodes map[string]bool
 	clone time.Duration
 	slow  []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
@@ -298,16 +295,16 @@ func (st *state) takeTryCandidate(ctx context.Context) {
 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
 // be judged at all.
 func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
-	st := &state{j: j, c: c, levels: rules.NewTally(), nodes: map[string]bool{},
+	st := &state{j: j, c: c, levels: rules.NewTally(),
 		beside: map[string]string{}}
 	// Every member and level runs to its end, and every manifest the change touches is judged by the indexer's judge (ADR
 	// 0578 §2), also after a failure: the verdict names every failure, not only the first (the operator, 2026-11-02).
-	tests := st.judgeAll(ctx)
+	// Each failure is a fact recorded where it is met; the verdict is the judging rules' of the facts.
+	st.judgeAll(ctx)
 	st.takeTryCandidate(ctx)
-	if v := rules.Settled(rules.JoinFailures(tests, st.judgeManifests(ctx), st.refuseCycle(ctx))); v != nil {
-		return st.finish(ctx, *v), nil
-	}
-	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
+	st.judgeManifests(ctx)
+	st.refuseCycle(ctx)
+	return st.finish(ctx, rules.Judge(st.factsOf())), nil
 }
 
 // finish is the outcome of the verdict with the state of the builds the candidate's modules carry and the assigner's
@@ -361,9 +358,8 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 	}
 }
 
-// outcome fills the verdict's levels, times, machines and composition from what ran.
+// outcome is the verdict judged from the facts with the slowest tests, the siblings read and what judged a build module.
 func (st *state) outcome(v delivery.Verdict) Outcome {
-	rules.Outcome(&v, st.levels, st.clone.Milliseconds(), st.nodes)
 	slow := rules.Slowest(st.levels)
 	out := Outcome{Verdict: v, Slowest: slow}
 	if len(st.beside) > 0 {
@@ -380,6 +376,19 @@ func (st *state) outcome(v delivery.Verdict) Outcome {
 	return out
 }
 
+// fail records a failure the asking met as a fact of the check, where it is met, and answers it as a verdict of failure
+// at a machine: the verdict is the judging rules' of the facts (rules.Judge), so a failure only returned is no failure
+// (milestone 47/B0).
+func (st *state) fail(machine, words string) *delivery.Verdict {
+	st.facts = append(st.facts, rules.Step{Failed: &delivery.FailedFirst{Machine: machine, Words: words}})
+	return fail(machine, words)
+}
+
+// factsOf are the check's facts as met: what the checking program judges.
+func (st *state) factsOf() rules.Facts {
+	return rules.Facts{V: rules.FactsVersion, Steps: st.facts, CloneMS: st.clone.Milliseconds(), Notes: st.c.Notes()}
+}
+
 // fail is a verdict of failure at a machine.
 func fail(machine, words string) *delivery.Verdict {
 	v := failure(machine, words)
@@ -416,7 +425,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 	for _, p := range pulls {
 		if ctx.Err() != nil {
 			if len(failures) == 0 { // an ask that ended with the context said it already
-				failures = append(failures, fail(delivery.CheckerModule, ctx.Err().Error()))
+				failures = append(failures, st.fail(delivery.CheckerModule, ctx.Err().Error()))
 			}
 			break
 		}
@@ -435,7 +444,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			if bm == buildrun.GoBuildModule {
 				beside, err := st.j.besideFor(ctx, st.c, p)
 				if err != nil {
-					failures = append(failures, fail(forgeMachine(err, bm), err.Error()+unheardWords(err)))
+					failures = append(failures, st.fail(forgeMachine(err, bm), err.Error()+unheardWords(err)))
 					continue
 				}
 				if len(beside) > 0 {
@@ -495,7 +504,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			err = fmt.Errorf("no node record is on the bus")
 		}
 		if err != nil {
-			return fail(t.module, fmt.Sprintf("the check of %s#%d is not asked: the nodes' names the names check needs cannot be read: %v", p.Repository, p.Number, err))
+			return st.fail(t.module, fmt.Sprintf("the check of %s#%d is not asked: the nodes' names the names check needs cannot be read: %v", p.Repository, p.Number, err))
 		}
 		job.NodeNames = names
 	}
@@ -524,7 +533,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		st.c.Progress.Set(what, "")
 		st.c.Asked(a.ID)
 		if err := st.j.Asks.Put(ctx, a); err != nil {
-			return fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
+			return st.fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
 		}
 		waiting := ctx
 		if watch := st.c.Watch; watch != nil {
@@ -536,9 +545,9 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		step, err = st.j.Asks.Wait(waiting, a)
 		if err != nil {
 			if ctx.Err() != nil {
-				return fail(t.module, ctx.Err().Error())
+				return st.fail(t.module, ctx.Err().Error())
 			}
-			return fail(t.module, fmt.Sprintf("the check of %s#%d: %v", p.Repository, p.Number, err))
+			return st.fail(t.module, fmt.Sprintf("the check of %s#%d: %v", p.Repository, p.Number, err))
 		}
 		d, declined := delivery.DeclinedOf(step)
 		if !declined {
@@ -559,7 +568,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			if lacks == "" {
 				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
 			}
-			return fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
+			return st.fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
 				p.Repository, p.Number, lacks, bound, step.Node))
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
@@ -572,23 +581,23 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		took = step.Ended.Sub(step.Started)
 	}
 	t.node = step.Node
-	st.nodes[step.Node] = true
+	st.facts = append(st.facts, rules.Step{Repository: p.Repository, Number: p.Number, Module: t.module, Node: step.Node})
 	st.c.Progress.Set(fmt.Sprintf("judge the check of %s#%d", p.Repository, p.Number), step.Node)
 	if step.State != delivery.StepPassed {
-		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
+		return st.fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
 	}
 	var answer delivery.CheckAnswer
 	if err := json.Unmarshal(step.Result, &answer); err != nil {
-		return fail(step.Node, fmt.Sprintf("the check of %s#%d answered what is not a check: %s", p.Repository, p.Number, step.Result))
+		return st.fail(step.Node, fmt.Sprintf("the check of %s#%d answered what is not a check: %s", p.Repository, p.Number, step.Result))
 	}
 	if err := json.Unmarshal(answer.Fetch, &t.fetched); err != nil || t.fetched.Workspace == "" {
-		return fail(step.Node, fmt.Sprintf("the fetch of %s#%d answered no workspace: %s", p.Repository, p.Number, answer.Fetch))
+		return st.fail(step.Node, fmt.Sprintf("the fetch of %s#%d answered no workspace: %s", p.Repository, p.Number, answer.Fetch))
 	}
 	if len(t.fetched.Conflicts) > 0 {
 		if !st.narrowTry() {
 			st.j.writePreview(ctx, p, append(*merged, t.fetched))
 		}
-		return fail(step.Node, fmt.Sprintf("%s#%d %s%s", p.Repository, p.Number, ConflictWords, strings.Join(t.fetched.Conflicts, ", ")))
+		return st.fail(step.Node, fmt.Sprintf("%s#%d %s%s", p.Repository, p.Number, ConflictWords, strings.Join(t.fetched.Conflicts, ", ")))
 	}
 	t.changed = t.fetched.Changed
 	if !changesBuildGo(p.Repository, t.changed) {
@@ -605,7 +614,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		if placed {
 			if len(la.Unmet) > 0 {
 				st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
-				return fail(step.Node, fmt.Sprintf("the %s level of %s#%d left %s untested on %s, which was asked for a node with %s",
+				return st.fail(step.Node, fmt.Sprintf("the %s level of %s#%d left %s untested on %s, which was asked for a node with %s",
 					la.Level, p.Repository, p.Number, unmetNames(la.Unmet), step.Node, strings.Join(needs, ", ")))
 			}
 			la.Kept = nil // it names its packages and takes no other's kept verdict; this is only a guard against an older module
diff --git a/modules/mesh-delivery-checker/internal/check/manifests_judge.go b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
index 3b192271..fc63f5fb 100644
--- a/modules/mesh-delivery-checker/internal/check/manifests_judge.go
+++ b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
@@ -112,7 +112,7 @@ func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
 		at = "mesh-delivery's trunk " + commit
 	}
 	if commit == "" {
-		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
+		return st.fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
 	}
 	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
 	// when the change alters it, else the one the indexer keeps.
@@ -169,7 +169,7 @@ func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
 		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
 	}
 	if len(refused) > 0 {
-		return fail(goModule, strings.Join(refused, "\n"))
+		return st.fail(goModule, strings.Join(refused, "\n"))
 	}
 	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
 	return nil
@@ -180,7 +180,7 @@ func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
 func (st *state) runJudge(ctx context.Context, req composer.Request, touched []string, commit, at string, versions delivery.PackageVersions) (change, trunk composer.CaseVerdict, v *delivery.Verdict) {
 	raw, err := json.Marshal(req)
 	if err != nil {
-		return change, trunk, fail(goModule, err.Error())
+		return change, trunk, st.fail(goModule, err.Error())
 	}
 	job := delivery.ComposeJob{Fetch: withPackages(map[string]any{"repository": DeliveryRepository, "commit": commit}, versions), Dir: JudgeDir,
 		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
@@ -189,15 +189,15 @@ func (st *state) runJudge(ctx context.Context, req composer.Request, touched []s
 	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
 	st.c.Asked(a.ID)
 	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return change, trunk, fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
+		return change, trunk, st.fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
 	}
 	step, err := st.j.Asks.Wait(ctx, a)
 	if err != nil {
-		return change, trunk, fail(goModule, "the judge of the change's manifests: "+err.Error())
+		return change, trunk, st.fail(goModule, "the judge of the change's manifests: "+err.Error())
 	}
 	change, trunk, why := judgeAnswer(step)
 	if why != "" {
-		return change, trunk, fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
+		return change, trunk, st.fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
 	}
 	return change, trunk, nil
 }
@@ -221,7 +221,7 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 	for _, module := range touched {
 		m, err := st.j.Read.Manifest(ctx, req.Cases[0].Manifests[module].Digest)
 		if err != nil {
-			return fail(goModule, fmt.Sprintf("the manifest of %s cannot be read, so the indexer cannot be ruled out: %v", module, err))
+			return st.fail(goModule, fmt.Sprintf("the manifest of %s cannot be read, so the indexer cannot be ruled out: %v", module, err))
 		}
 		for _, c := range m.Claims {
 			if c.Name == CatalogSeat {
@@ -241,7 +241,7 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 			trunk = st.j.Trunks.Heads()[DeliveryRepository]
 		}
 		if trunk == "" {
-			return fail(goModule, "the new indexer cannot be judged by the trunk's manifest validator: the trunk head of "+DeliveryRepository+" is not known")
+			return st.fail(goModule, "the new indexer cannot be judged by the trunk's manifest validator: the trunk head of "+DeliveryRepository+" is not known")
 		}
 		var v *delivery.Verdict
 		judgedAt = "mesh-delivery's trunk " + trunk
@@ -262,7 +262,7 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 		problems = append(problems, "the manifest validator does not know its fields "+r.SetAside+", so it waits")
 	}
 	if len(problems) > 0 {
-		return fail(goModule, fmt.Sprintf("the indexer %s, the holder of the seat %s, would never run: the trunk's manifest validator at %s does not accept its manifest: %s",
+		return st.fail(goModule, fmt.Sprintf("the indexer %s, the holder of the seat %s, would never run: the trunk's manifest validator at %s does not accept its manifest: %s",
 			indexer, CatalogSeat, judgedAt, strings.Join(problems, "; ")))
 	}
 	st.c.note(fmt.Sprintf("the new indexer's manifest of %s is accepted by the trunk's manifest validator at %s", indexer, judgedAt))

From e96f8fd1b6f83ec142afd328d2ab780b61afa163 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:31:22 +0100
Subject: [PATCH 04/17] The manifests, compiled-programs and composition rules
 judge facts in the checker's rules (issue 1921)

The running checker records the manifest validator's cases, each fetch's programs and the engines' answers as facts,
and the rules package judges them, with the notes it gives a reader, so the checking program judges every rule the
running checker judged. The module graph's cycle stays with the asking: its facts are whole manifests, over a run's
input bound; G's program reads them from the heads.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-checking-program/main.go         |   2 +-
 .../internal/check/binaries.go                |  29 +-
 .../internal/check/builds.go                  |  26 +-
 .../internal/check/composition.go             |  29 --
 .../internal/check/composition_test.go        |  33 ++-
 .../internal/check/engines.go                 |  63 +---
 .../internal/check/engines_test.go            |  20 +-
 .../internal/check/every_failure_test.go      |   3 +-
 .../internal/check/examiner_test.go           |   5 +-
 .../internal/check/graph_cycle.go             |  16 +-
 .../internal/check/judge.go                   |  64 ++--
 .../internal/check/manifests_judge.go         | 153 ++++------
 .../internal/check/results.go                 |   9 +-
 .../internal/check/try_test.go                |  15 +-
 modules/mesh-delivery-checker/rules/facts.go  |  42 ++-
 modules/mesh-delivery-checker/rules/judged.go | 277 ++++++++++++++++++
 16 files changed, 481 insertions(+), 305 deletions(-)
 delete mode 100644 modules/mesh-delivery-checker/internal/check/composition.go
 create mode 100644 modules/mesh-delivery-checker/rules/judged.go

diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
index 82e45fc6..e18efc5c 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
@@ -50,7 +50,7 @@ func run(args []string, getenv func(string) string, stdout, stderr io.Writer) in
 	if err != nil {
 		return refuse("%v", err)
 	}
-	line, err := json.Marshal(rules.Answer{V: rules.AnswerVersion, Verdict: rules.Judge(facts)})
+	line, err := json.Marshal(rules.Judged(facts))
 	if err != nil {
 		return refuse("the verdict cannot be written: %v", err)
 	}
diff --git a/modules/mesh-delivery-checker/internal/check/binaries.go b/modules/mesh-delivery-checker/internal/check/binaries.go
index 1835be61..1fd9d02c 100644
--- a/modules/mesh-delivery-checker/internal/check/binaries.go
+++ b/modules/mesh-delivery-checker/internal/check/binaries.go
@@ -2,7 +2,8 @@ package check
 
 import (
 	"fmt"
-	"strings"
+
+	"mesh-delivery-checker/rules"
 )
 
 // A change that adds or modifies a compiled program fails (issue 1577): it is build output, `go build` in a module's folder
@@ -13,30 +14,20 @@ import (
 // tell, so the check does not refuse a program it did not look for.
 const NoProgramsReported = "the build module did not report programs: a compiled program in the change is not refused"
 
-// checkBinariesOf fails a pull request whose change adds or modifies a compiled program, naming each file. It judges the
-// first fetch answer of the pull request, whichever build module gave it; a build module that reports no programs leaves a
-// warning on the check and passes it.
-func (st *state) checkBinariesOf(t *target) verdictPtr {
+// checkBinariesOf records what a pull request's first fetch answer read of compiled programs, whichever build module
+// gave it, as a fact the rules judge (rules.JudgePrograms); a build module that reports no programs leaves a warning on
+// the check and passes it.
+func (st *state) checkBinariesOf(t *target) {
 	key := fmt.Sprintf("%s#%d", t.pull.Repository, t.pull.Number)
 	if t.fetched.Merge == "" {
-		return nil // no merge was made: nothing was changed to judge
+		return // no merge was made: nothing was changed to judge
 	}
 	if t.fetched.Programs == nil {
 		st.c.note(fmt.Sprintf("%s: %s (%s)", key, NoProgramsReported, t.module))
 		st.c.warn(key, fmt.Sprintf("a compiled program is not refused: %s reported no programs", t.module))
 		st.j.logf("%s: %s (%s)", key, NoProgramsReported, t.module)
-		return nil
+		return
 	}
-	var found []string
-	for _, p := range *t.fetched.Programs {
-		if p.Commit != "" {
-			found = append(found, fmt.Sprintf("%s: a compiled program added in %s and removed later: it stays in history; squash the branch (issue 1577)", p.Path, short12(p.Commit)))
-			continue
-		}
-		found = append(found, p.Path+": a compiled program is build output: remove it and add it to .gitignore (issue 1577)")
-	}
-	if len(found) > 0 {
-		return st.fail(t.node, fmt.Sprintf("%s: %s", key, strings.Join(found, "; ")))
-	}
-	return nil
+	st.facts = append(st.facts, rules.Step{Repository: t.pull.Repository, Number: t.pull.Number, Module: t.module, Node: t.node,
+		Programs: &rules.Programs{Key: key, Files: t.fetched.Programs}})
 }
diff --git a/modules/mesh-delivery-checker/internal/check/builds.go b/modules/mesh-delivery-checker/internal/check/builds.go
index 82e79c2c..a35b51ec 100644
--- a/modules/mesh-delivery-checker/internal/check/builds.go
+++ b/modules/mesh-delivery-checker/internal/check/builds.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"maps"
-	"mesh-delivery-checker/rules"
 	"slices"
 	"sort"
 	"strings"
@@ -124,19 +123,20 @@ func (j *Examiner) buildWait() time.Duration {
 // awaitBuilds waits for the candidate's builds before the check composes (ADR 0603 §10): the check builds what the builder
 // builds of the candidate and composes with it. A failed build fails the check, naming the module and the builder's words;
 // a build not ended within the bound is named, and the check composes without it. It answers the words of the composition's
-// warnings: what the check composes without waiting on its build, and why.
-func (st *state) awaitBuilds(ctx context.Context, v *delivery.Verdict) []string {
+// warnings (what the check composes without waiting on its build, and why) and the failures of the builds that failed, for
+// the rules to take in (rules.JudgeComposition); failed says the check has failed already.
+func (st *state) awaitBuilds(ctx context.Context, failed bool) ([]string, []delivery.FailedFirst) {
 	wait, words := st.buildsOfTheCheck(ctx)
 	if len(wait) == 0 {
-		return words
+		return words, nil
 	}
 	modules := slices.Sorted(maps.Keys(wait))
-	if v.State == delivery.VerdictFail {
+	if failed {
 		// The check has failed already: its red status is never held back by a build (the lead, 2026-11-03).
-		return append(words, fmt.Sprintf("the check failed before its builds were waited on, so it composes at once, without waiting on the builds of %s (ADR 0603 §10)", strings.Join(modules, ", ")))
+		return append(words, fmt.Sprintf("the check failed before its builds were waited on, so it composes at once, without waiting on the builds of %s (ADR 0603 §10)", strings.Join(modules, ", "))), nil
 	}
 	if st.j.BuildEnds == nil {
-		return append(words, fmt.Sprintf("the builds of %s cannot be heard, so the check composes without waiting on them (ADR 0603 §10)", strings.Join(modules, ", ")))
+		return append(words, fmt.Sprintf("the builds of %s cannot be heard, so the check composes without waiting on them (ADR 0603 §10)", strings.Join(modules, ", "))), nil
 	}
 	bound := st.j.buildWait()
 	waits := fmt.Sprintf("waits on the builder's builds of %s before it composes, at most %s (ADR 0603 §10)", strings.Join(modules, ", "), bound)
@@ -147,25 +147,21 @@ func (st *state) awaitBuilds(ctx context.Context, v *delivery.Verdict) []string
 	cancel()
 	if err != nil {
 		st.j.logf("%s: the builds of %s cannot be heard: %v", st.c.Key, strings.Join(modules, ", "), err)
-		return append(words, fmt.Sprintf("the builds of %s cannot be heard (%v), so the check composes without waiting on them (ADR 0603 §10)", strings.Join(modules, ", "), err))
+		return append(words, fmt.Sprintf("the builds of %s cannot be heard (%v), so the check composes without waiting on them (ADR 0603 §10)", strings.Join(modules, ", "), err)), nil
 	}
 	var late []string
+	var builds []delivery.FailedFirst
 	for _, module := range modules {
 		b, done := ended[module]
 		switch {
 		case !done:
 			late = append(late, module)
 		case b.State == delivery.BuildFailed:
-			f := delivery.FailedFirst{Test: BuildFailedTest + module, Words: fmt.Sprintf("the candidate's build at %s failed (rebuild with builder_build_again; the check asks itself again when the build is done): %s", wait[module], b.Error)}
-			if v.State != delivery.VerdictFail {
-				v.State, v.Failed = delivery.VerdictFail, f
-				continue
-			}
-			rules.AddFailure(v, f)
+			builds = append(builds, delivery.FailedFirst{Test: BuildFailedTest + module, Words: fmt.Sprintf("the candidate's build at %s failed (rebuild with builder_build_again; the check asks itself again when the build is done): %s", wait[module], b.Error)})
 		}
 	}
 	if len(late) > 0 && ctx.Err() == nil {
 		words = append(words, fmt.Sprintf("the builds of %s did not end within the build-wait-bound of %s, so the check composes without them (ADR 0603 §10)", strings.Join(late, ", "), bound))
 	}
-	return words
+	return words, builds
 }
diff --git a/modules/mesh-delivery-checker/internal/check/composition.go b/modules/mesh-delivery-checker/internal/check/composition.go
deleted file mode 100644
index 18944c34..00000000
--- a/modules/mesh-delivery-checker/internal/check/composition.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package check
-
-import (
-	"mesh-delivery-checker/rules"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// withComposition is v with the check's composition taken in: a failed one fails the check, naming its machine.
-func withComposition(v *delivery.Verdict, comp delivery.CompositionVerdict) {
-	v.Composition = comp.Composition()
-	v.Took.Composition = comp.Took
-	if comp.State == delivery.CompositionPass && len(comp.Warnings) > 0 && v.Composition != nil {
-		v.Composition.Words = strings.Join(comp.Warnings, "; ") // passed with a warning (ADR 0593 §9)
-	}
-	if comp.State == delivery.CompositionFail {
-		machine := comp.Machine
-		if machine == "" {
-			machine = "the composition"
-		}
-		f := delivery.FailedFirst{Machine: machine, Words: comp.Words}
-		if v.State == delivery.VerdictFail {
-			rules.AddFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
-			return
-		}
-		v.State, v.Failed = delivery.VerdictFail, f
-	}
-}
diff --git a/modules/mesh-delivery-checker/internal/check/composition_test.go b/modules/mesh-delivery-checker/internal/check/composition_test.go
index 9ba4c332..e6ae1535 100644
--- a/modules/mesh-delivery-checker/internal/check/composition_test.go
+++ b/modules/mesh-delivery-checker/internal/check/composition_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"maps"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"strings"
 	"testing"
@@ -14,28 +15,43 @@ import (
 
 // fakeCompositions answers a check's composition from memory, recording the keys asked.
 type fakeCompositions struct {
-	v     delivery.CompositionVerdict
+	v     rules.Composed
 	err   error
 	asked []string
 	// waits answers only when its context ends.
 	waits bool
 }
 
-func (f *fakeCompositions) Compose(ctx context.Context, c *Case) (delivery.CompositionVerdict, error) {
+func (f *fakeCompositions) Compose(ctx context.Context, c *Case) (rules.Composed, error) {
 	f.asked = append(f.asked, c.Key)
 	if f.waits {
 		<-ctx.Done()
-		return delivery.CompositionVerdict{}, ctx.Err()
+		return rules.Composed{}, ctx.Err()
 	}
 	return f.v, f.err
 }
 
+// composedOn is the engines' answers of a composition by composer on the nodes, each composing it, taking took ms.
+func composedOn(composer string, took int64, nodes ...string) rules.Composed {
+	c := rules.Composed{Group: "feat/x", Heads: "0123456789ab", Composer: composer, Nodes: nodes, Took: took, Answers: map[string]delivery.ComposeCandidateAnswer{}}
+	for _, n := range nodes {
+		c.Answers[n] = delivery.ComposeCandidateAnswer{Node: n, Verdict: delivery.ComposeCandidateComposed}
+	}
+	return c
+}
+
+// refusedOn is the engines' answers of a composition the node refuses with the words.
+func refusedOn(composer, node, words string) rules.Composed {
+	return rules.Composed{Group: "feat/x", Heads: "0123456789ab", Composer: composer, Nodes: []string{node},
+		Answers: map[string]delivery.ComposeCandidateAnswer{node: {Node: node, Verdict: delivery.ComposeCandidateRefused, Refused: words}}}
+}
+
 // 1297/AC3 (its unit half): a check whose tests pass takes the assigner's composition of it, by the check's own key,
 // into its verdict: a pass says it passed with the mesh-sdk and machines it composed, and is no longer "not run".
 func TestAPassingCheckTakesTheAssignersComposition(t *testing.T) {
 	t.Run("a change to a build module or base names the modules built on it", aChangeToABuildModuleOrBaseNamesTheModulesBuiltOnIt)
 	b := newBench(t)
-	f := &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionPass, SDK: "v0.1.14-x", Machines: []string{"g14"}, Took: 40}}
+	f := &fakeCompositions{v: composedOn("v0.1.14-x", 40, "g14")}
 	b.ex.Compositions = f
 	cs := caseOf(t, pullOf(repoA, 7, head1))
 	cs.FPSet = "fps-of-the-candidate"
@@ -67,8 +83,7 @@ func compositionMentions(v delivery.Verdict, word string) bool {
 // 1297/AC2 at the checker: a failed composition fails the check, naming the machine it failed at and its words.
 func TestAFailedCompositionFailsTheCheck(t *testing.T) {
 	b := newBench(t)
-	b.ex.Compositions = &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionFail, SDK: "x",
-		Machine: "g14", Words: "g14 runs web, which the change removes from its source"}}
+	b.ex.Compositions = &fakeCompositions{v: refusedOn("x", "g14", "g14 runs web, which the change removes from its source")}
 	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
 	if v.State != delivery.VerdictFail || v.Failed.Machine != "g14" || v.Composition == nil || v.Composition.State != delivery.CompositionFail {
 		t.Fatalf("verdict = %+v", v)
@@ -89,7 +104,7 @@ func TestACompositionNotHadIsNotRun(t *testing.T) {
 		t.Fatalf("verdict = %+v", v)
 	}
 	b2 := newBench(t)
-	f2 := &fakeCompositions{v: delivery.CompositionVerdict{State: delivery.CompositionFail, Words: "w", SDK: "x"}}
+	f2 := &fakeCompositions{v: refusedOn("x", "g14", "w")}
 	b2.ex.Compositions = f2
 	cs := caseOf(t, pullOf(repoA, 7, head1))
 	cs.Try = &TryOptions{}
@@ -212,7 +227,7 @@ func aChangeToABuildModuleOrBaseNamesTheModulesBuiltOnIt(t *testing.T) {
 				return r, nil
 			}
 		}
-		comps := &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionPass, SDK: "x", Machines: []string{"g14"}}}
+		comps := &fakeCompositions{v: composedOn("x", 0, "g14")}
 		b.ex.Compositions = comps
 		var ends *fakeEnds
 		if row.builds != nil {
@@ -265,3 +280,5 @@ func aChangeToABuildModuleOrBaseNamesTheModulesBuiltOnIt(t *testing.T) {
 		}
 	}
 }
+
+func ptr[T any](v T) *T { return &v }
diff --git a/modules/mesh-delivery-checker/internal/check/engines.go b/modules/mesh-delivery-checker/internal/check/engines.go
index 91342266..f0cadd76 100644
--- a/modules/mesh-delivery-checker/internal/check/engines.go
+++ b/modules/mesh-delivery-checker/internal/check/engines.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"mesh-delivery-checker/rules"
 	"sort"
 	"strings"
 	"sync"
@@ -68,17 +69,18 @@ func composerHead(c *Case) string {
 	return ""
 }
 
-// Compose asks every placed node and judges their answers (JudgeEngines). An error is only a case it cannot ask at all.
-func (e EngineCompositions) Compose(ctx context.Context, c *Case) (delivery.CompositionVerdict, error) {
+// Compose asks every placed node and answers their answers, for the rules to judge (rules.JudgeEngines). An error is only a
+// case it cannot ask at all.
+func (e EngineCompositions) Compose(ctx context.Context, c *Case) (rules.Composed, error) {
 	began := time.Now()
 	key, err := delivery.CompositionKey(c.Group, c.HeadsHash)
 	if err != nil {
-		return delivery.CompositionVerdict{}, err
+		return rules.Composed{}, err
 	}
 	var nodes []string
 	if e.Placed != nil {
 		if nodes, err = e.Placed(); err != nil {
-			return delivery.CompositionVerdict{}, fmt.Errorf("the placement cannot be read, so no node can be asked: %w", err)
+			return rules.Composed{}, fmt.Errorf("the placement cannot be read, so no node can be asked: %w", err)
 		}
 	}
 	bound := e.Bound
@@ -129,7 +131,7 @@ func (e EngineCompositions) Compose(ctx context.Context, c *Case) (delivery.Comp
 	} else if e.Composer != nil && e.Composer() != "" {
 		composerName = e.Composer()
 	}
-	v := JudgeEngines(c.Group, c.HeadsHash, composerName, nodes, answers, silent)
+	v := rules.Composed{Group: c.Group, Heads: c.HeadsHash, Composer: composerName, Nodes: nodes, Answers: answers, Silent: silent}
 	if head != "" && e.Sandbox == nil {
 		v.Warnings = append(v.Warnings, "the group changes the node-engine's composition code and was composed by the running engines")
 	}
@@ -137,57 +139,6 @@ func (e EngineCompositions) Compose(ctx context.Context, c *Case) (delivery.Comp
 	return v, nil
 }
 
-// JudgeEngines is the check's composition verdict from the engines' answers (ADR 0593 §7, §9): failed when any node's
-// answer is refused, naming each node and each module refused with its words (the first refusing node is the machine);
-// passed otherwise. Every node in nodes without an answer (silent, by node with why, for the journal only) is named
-// with delivery.ComposeNoAnswer as a warning. composer names what composed, for the line. Pure.
-func JudgeEngines(group, heads, composerName string, nodes []string, answers map[string]delivery.ComposeCandidateAnswer, silent map[string]string) delivery.CompositionVerdict {
-	v := delivery.CompositionVerdict{Group: group, Heads: heads, State: delivery.CompositionPass, SDK: composerName}
-	sorted := append([]string(nil), nodes...)
-	sort.Strings(sorted)
-	var fails []string
-	for _, node := range sorted {
-		a, answered := answers[node]
-		if !answered {
-			v.Warnings = append(v.Warnings, node+": "+delivery.ComposeNoAnswer)
-			continue
-		}
-		if a.Verdict == delivery.ComposeCandidateNotJudged {
-			// Composed in the sandbox and not judged (ADR 0593 §9): named as no answer, with the composer's words; decided by the
-			// verdict, never by the words (ADR 0601 §4's kind).
-			v.Warnings = append(v.Warnings, node+": "+delivery.ComposeNoAnswer+" ("+a.Refused+")")
-			continue
-		}
-		v.Machines = append(v.Machines, node)
-		if a.Verdict != delivery.ComposeCandidateRefused {
-			continue
-		}
-		if v.Machine == "" {
-			v.Machine = node
-		}
-		var words []string
-		if a.Refused != "" {
-			words = append(words, a.Refused)
-		}
-		for _, m := range append(append([]delivery.ModuleComposed(nil), a.Modules...), a.Own) {
-			if m.State == delivery.ModuleRefusedState {
-				words = append(words, m.Module+": "+m.Words)
-			}
-		}
-		if len(words) == 0 {
-			words = append(words, "refused, naming no module")
-		}
-		fails = append(fails, "not composed on "+node+": "+strings.Join(words, "; "))
-	}
-	if len(fails) > 0 {
-		v.State, v.Words = delivery.CompositionFail, strings.Join(fails, "; ")
-	}
-	if len(sorted) == 0 {
-		v.Warnings = append(v.Warnings, "no node is placed, so the change was composed on none")
-	}
-	return v
-}
-
 // inSandbox composes a node's answer again with the composer built from the node-engine member's head, over the input the
 // node's engine composed from: the node's answer becomes the sandbox's, refused with the composer's words where the
 // composer refuses the node.
diff --git a/modules/mesh-delivery-checker/internal/check/engines_test.go b/modules/mesh-delivery-checker/internal/check/engines_test.go
index 259fd122..189fedb5 100644
--- a/modules/mesh-delivery-checker/internal/check/engines_test.go
+++ b/modules/mesh-delivery-checker/internal/check/engines_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"mesh-delivery-checker/rules"
 	"strings"
 	"sync"
 	"testing"
@@ -80,15 +81,17 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 	}
 	cs := caseOf(t, pullOf(repoA, 7, head1))
 	key, _ := delivery.CompositionKey(cs.Group, cs.HeadsHash)
+	var last rules.Composed // the engines' answers of the last compose, for the check's verdict to take in
 	compose := func(e *fakeEngines, nodes ...string) delivery.CompositionVerdict {
 		t.Helper()
 		ec := EngineCompositions{Asker: e, Placed: func() ([]string, error) { return nodes, nil }, Bound: 50 * time.Millisecond,
 			Composer: func() string { return strings.Repeat("7", 40) }}
-		v, err := ec.Compose(context.Background(), cs)
+		raw, err := ec.Compose(context.Background(), cs)
 		if err != nil {
 			t.Fatal(err)
 		}
-		return v
+		last = raw
+		return rules.JudgeEngines(raw)
 	}
 
 	t.Run("one node refusing fails the composition, naming the node and the module", func(t *testing.T) {
@@ -106,7 +109,7 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 			t.Errorf("asked %+v, want the check's candidate %s and no input", e.asked, key)
 		}
 		var ver delivery.Verdict
-		withComposition(&ver, v)
+		rules.JudgeComposition(&ver, rules.Composition{Composed: &last})
 		if ver.State != delivery.VerdictFail || ver.Failed.Machine != "laptop" {
 			t.Errorf("the check's verdict = %+v", ver)
 		}
@@ -131,7 +134,7 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 		}
 		var ver delivery.Verdict
 		ver.State = delivery.VerdictPass
-		withComposition(&ver, v)
+		rules.JudgeComposition(&ver, rules.Composition{Composed: &last})
 		if ver.State != delivery.VerdictPass || !strings.Contains(composition(ver.Composition, 0, false), "laptop: "+delivery.ComposeNoAnswer) {
 			t.Errorf("the line = %q", composition(ver.Composition, 0, false))
 		}
@@ -152,7 +155,8 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 		}}
 		ec := EngineCompositions{Asker: e, Placed: func() ([]string, error) { return []string{"anchor"}, nil }, Bound: time.Second,
 			Sandbox: sb, Manifests: digests{"web": "sha256:" + strings.Repeat("c", 64)}, Published: published{}}
-		v, err := ec.Compose(context.Background(), host)
+		raw, err := ec.Compose(context.Background(), host)
+		v := rules.JudgeEngines(raw)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -186,7 +190,8 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 			sb.v = func(node string) composer.Verdict {
 				return composer.Verdict{V: composer.Version, Cases: []composer.CaseVerdict{{Name: "change", Machines: map[string]composer.Machine{node: row.m}}}}
 			}
-			v, err = ec.Compose(context.Background(), host)
+			raw, err = ec.Compose(context.Background(), host)
+			v = rules.JudgeEngines(raw)
 			named := len(v.Warnings) == 1 && strings.Contains(v.Warnings[0], "anchor: "+delivery.ComposeNoAnswer+" (its node-engine sends no running state for web)")
 			if err != nil || (v.State == delivery.CompositionPass) != row.pass || named != row.pass {
 				t.Errorf("%+v: verdict %+v, %v", row.m, v, err)
@@ -195,7 +200,8 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 		// Review finding 3 (ADR 0593 §9 lets only a node that does not answer pass): a composer at the head that cannot
 		// run fails the composition, naming the head, never passing as a silent node.
 		sb.err = errors.New("the build of mesh-compose failed")
-		v, err = ec.Compose(context.Background(), host)
+		raw, err = ec.Compose(context.Background(), host)
+		v = rules.JudgeEngines(raw)
 		if err != nil || v.State != delivery.CompositionFail || !strings.Contains(v.Words, head2) ||
 			!strings.Contains(v.Words, "the build of mesh-compose failed") || len(v.Warnings) != 0 {
 			t.Errorf("a composer that cannot run: %+v, %v", v, err)
diff --git a/modules/mesh-delivery-checker/internal/check/every_failure_test.go b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
index 162f19b5..a845e029 100644
--- a/modules/mesh-delivery-checker/internal/check/every_failure_test.go
+++ b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
@@ -91,7 +91,8 @@ func TestFailuresAreCappedWithHowManyMore(t *testing.T) {
 		t.Errorf("line %q", line)
 	}
 	// A composition failing after them is counted in the last entry (the operator, 2026-11-02).
-	withComposition(v, delivery.CompositionVerdict{State: delivery.CompositionFail, Machine: "g14", Words: "route-proxy is defined twice"})
+	refused := refusedOn("x", "g14", "route-proxy is defined twice")
+	rules.JudgeComposition(v, rules.Composition{Composed: &refused})
 	if n := rules.FailedCount(*v); n != 61 || v.Failed.Test != "integration: x/p0.TestT" {
 		t.Errorf("after the composition failedCount = %d, failed %+v", n, v.Failed)
 	}
diff --git a/modules/mesh-delivery-checker/internal/check/examiner_test.go b/modules/mesh-delivery-checker/internal/check/examiner_test.go
index 4965b20f..2fa8dab3 100644
--- a/modules/mesh-delivery-checker/internal/check/examiner_test.go
+++ b/modules/mesh-delivery-checker/internal/check/examiner_test.go
@@ -445,8 +445,7 @@ func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1
 func TestEveryFailureOfEveryMemberLevelAndTheCompositionIsNamed(t *testing.T) {
 	for _, conflicts := range []bool{false, true} {
 		b := newBench(t)
-		comps := &fakeCompositions{v: delivery.CompositionVerdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.CompositionFail, SDK: "x",
-			Machine: "g14", Words: "route-proxy is defined twice"}, waits: conflicts}
+		comps := &fakeCompositions{v: refusedOn("x", "g14", "route-proxy is defined twice"), waits: conflicts}
 		b.ex.Compositions = comps
 		b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 		b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
@@ -480,7 +479,7 @@ func TestEveryFailureOfEveryMemberLevelAndTheCompositionIsNamed(t *testing.T) {
 			got = append(got, firstFailed(delivery.Verdict{Failed: f}))
 		}
 		tests := []string{"unit: fixture/failing/bad.TestThreeIsFour", "integration: fixture/failing/bad.TestThreeIsFour"}
-		want := append(append(slices.Clone(tests), tests...), "g14: route-proxy is defined twice") // both members fail their tests
+		want := append(append(slices.Clone(tests), tests...), "g14: not composed on g14: route-proxy is defined twice") // both members fail their tests
 		if conflicts {
 			want = append([]string{"shanks: novox/mesh-sdk#12 does not merge into the trunk: files in conflict: a.go"}, tests...)
 		}
diff --git a/modules/mesh-delivery-checker/internal/check/graph_cycle.go b/modules/mesh-delivery-checker/internal/check/graph_cycle.go
index 1aa6804a..48981459 100644
--- a/modules/mesh-delivery-checker/internal/check/graph_cycle.go
+++ b/modules/mesh-delivery-checker/internal/check/graph_cycle.go
@@ -9,7 +9,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/composer"
-	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"git.novox.be/novox/mesh-delivery/sdk/graph"
 )
@@ -29,14 +28,14 @@ type ManifestReader interface {
 
 // refuseCycle fails the check for a cycle of the change's module graph, naming it; nil when the case touches no manifest,
 // when nothing reads manifests, or when there is none. A manifest that cannot be read fails the check, said, never passes it.
-func (st *state) refuseCycle(ctx context.Context) *delivery.Verdict {
+func (st *state) refuseCycle(ctx context.Context) {
 	if st.j.Manifests == nil || st.j.Read == nil || st.narrowTry() {
-		return nil
+		return
 	}
 	trunk := st.j.Manifests.ManifestDigests()
 	req, touched := judgeRequest(trunk, st.c.Pulls)
 	if len(touched) == 0 {
-		return nil
+		return
 	}
 	read := func(digests map[string]composer.Manifest) (map[string]catalogue.Manifest, error) {
 		out := map[string]catalogue.Manifest{}
@@ -51,12 +50,13 @@ func (st *state) refuseCycle(ctx context.Context) *delivery.Verdict {
 	}
 	change, err := read(req.Cases[0].Manifests)
 	if err != nil {
-		return st.fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
+		st.fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
+		return
 	}
 	cycle := graph.OfManifests(change).Cycle()
 	if cycle == nil {
 		st.c.note("the change's module graph has no cycle")
-		return nil
+		return
 	}
 	words := strings.Join(cycle, " -> ")
 	if before, err := read(req.Cases[1].Manifests); err == nil {
@@ -68,9 +68,9 @@ func (st *state) refuseCycle(ctx context.Context) *delivery.Verdict {
 		}
 		if among.Cycle() != nil {
 			st.c.note("the module graph has the cycle " + words + ", which the trunk already has among the same modules (ADR 0603 §2)")
-			return nil
+			return
 		}
 	}
-	return st.fail(goModule, fmt.Sprintf("the change's module graph has the cycle %s: these modules would each wait for the other for "+
+	st.fail(goModule, fmt.Sprintf("the change's module graph has the cycle %s: these modules would each wait for the other for "+
 		"good, through their bases, the provisions and bus state they await, or the verbs they invoke (ADR 0603 §2, ADR 0614 §6)", words))
 }
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 2826afd7..5faa8b33 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -151,9 +151,10 @@ type TryCandidates interface {
 	TryCandidate(ctx context.Context, group, heads string, bound time.Duration) (delivery.Candidate, error)
 }
 
-// CompositionReader makes a check's composition verdict; an error is only a case that cannot be composed at all.
+// CompositionReader composes a check: the engines' answers, which the rules judge (rules.JudgeEngines); an error is only
+// a case that cannot be composed at all.
 type CompositionReader interface {
-	Compose(ctx context.Context, c *Case) (delivery.CompositionVerdict, error)
+	Compose(ctx context.Context, c *Case) (rules.Composed, error)
 }
 
 func (j *Examiner) now() time.Time {
@@ -234,8 +235,10 @@ type state struct {
 	levels  rules.Tally
 	// facts are the facts of the check met so far, in order: what the checking program judges (milestone 47/B0).
 	facts []rules.Step
-	clone time.Duration
-	slow  []string
+	// composition is how the check composed, recorded after every step (compose).
+	composition *rules.Composition
+	clone       time.Duration
+	slow        []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
 	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
@@ -304,26 +307,24 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	st.takeTryCandidate(ctx)
 	st.judgeManifests(ctx)
 	st.refuseCycle(ctx)
-	return st.finish(ctx, rules.Judge(st.factsOf())), nil
-}
-
-// finish is the outcome of the verdict with the state of the builds the candidate's modules carry and the assigner's
-// composition of it, read also when the tests failed, so a failed composition is named beside them.
-func (st *state) finish(ctx context.Context, v delivery.Verdict) Outcome {
-	out := st.outcome(v)
-	st.composed(ctx, &out.Verdict)
+	st.compose(ctx)
+	answer := rules.Judged(st.factsOf())
+	for _, n := range answer.Notes {
+		st.c.note(n)
+	}
+	out := st.outcome(answer.Verdict)
 	out.Builds = st.j.buildNotes(ctx, st.c)
-	return out
+	return out, nil
 }
 
-// composed makes the check's composition from the engines' answers into its verdict (ADR 0593 §7, §9): a failed
-// composition fails the check, naming the machine it failed at; a node that did not answer is a warning. A try is not
-// composed (it has no candidate); a composition that cannot be made leaves it not run, said.
-func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
+// compose records how the check composed as the facts' composition, after every step (ADR 0593 §7, §9): kept by a carry,
+// not run (said why), or the engines' answers with the candidate's builds awaited first (ADR 0603 §10). A narrowed try
+// and an examiner that composes nothing record none.
+func (st *state) compose(ctx context.Context) {
 	if st.c.Composition != nil && st.c.Try == nil {
 		// A carry whose candidate's fingerprints did not change keeps the composition it passed (ADR 0548 §5).
 		kept := *st.c.Composition
-		v.Composition = &kept
+		st.composition = &rules.Composition{Kept: &kept}
 		st.c.note("the composition is kept: no fingerprint of a module it composed changed")
 		return
 	}
@@ -331,7 +332,7 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 		return
 	}
 	if st.noCandidate != "" {
-		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: st.noCandidate}
+		st.composition = &rules.Composition{NotRun: st.noCandidate}
 		return
 	}
 	if st.j.Compositions == nil {
@@ -339,23 +340,24 @@ func (st *state) composed(ctx context.Context, v *delivery.Verdict) {
 	}
 	if len(st.unpreviewed) > 0 {
 		// An engine would only say it cannot read a manifest the indexer will not have: the check does not ask it.
-		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: "no preview of a merge of " +
-			strings.Join(st.unpreviewed, ", ") + " (its head does not merge or its fetch did not answer), so the change cannot be composed"}
+		st.composition = &rules.Composition{NotRun: "no preview of a merge of " + strings.Join(st.unpreviewed, ", ") +
+			" (its head does not merge or its fetch did not answer), so the change cannot be composed"}
 		return
 	}
-	words := st.awaitBuilds(ctx, v) // ADR 0603 §10: the check composes with the candidate's builds
+	// ADR 0603 §10: the check composes with the candidate's builds; whether it failed already is the running rules' word
+	// on the facts so far, an asking choice only (the verdict is the rules' of every fact).
+	failed := rules.Judge(st.factsOf()).State == delivery.VerdictFail
+	words, builds := st.awaitBuilds(ctx, failed)
+	c := &rules.Composition{Waits: words, BuildsFailed: builds, FPSet: st.c.FPSet}
+	st.composition = c
 	comp, err := st.j.Compositions.Compose(ctx, st.c)
 	if err != nil {
 		// Said in the verdict, never left as a composition not yet run (review finding 4).
 		st.j.logf("%s: the composition could not be made, so it is said as not run: %v", st.c.Key, err)
-		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: "not made: " + err.Error()}
+		c.NotRun = "not made: " + err.Error()
 		return
 	}
-	comp.Warnings = append(comp.Warnings, words...) // ADR 0603 §10
-	withComposition(v, comp)
-	if v.Composition != nil && v.Composition.State != delivery.CompositionNotRun {
-		v.Composition.FPSet = st.c.FPSet // a carry keeps it while the fingerprints stay the same (ADR 0548 §5)
-	}
+	c.Composed = &comp
 }
 
 // outcome is the verdict judged from the facts with the slowest tests, the siblings read and what judged a build module.
@@ -386,7 +388,7 @@ func (st *state) fail(machine, words string) *delivery.Verdict {
 
 // factsOf are the check's facts as met: what the checking program judges.
 func (st *state) factsOf() rules.Facts {
-	return rules.Facts{V: rules.FactsVersion, Steps: st.facts, CloneMS: st.clone.Milliseconds(), Notes: st.c.Notes()}
+	return rules.Facts{V: rules.FactsVersion, Steps: st.facts, CloneMS: st.clone.Milliseconds(), Composition: st.composition, Notes: st.c.Notes()}
 }
 
 // fail is a verdict of failure at a machine.
@@ -605,9 +607,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	}
 	if !placed { // the placed ask fetched the same merge: its preview was read from the first
 		*merged = append(*merged, t.fetched)
-		if v := st.checkBinariesOf(t); v != nil {
-			failures = append(failures, v) // the levels still run: the verdict names every failure
-		}
+		st.checkBinariesOf(t) // the levels still run: the verdict names every failure
 	}
 	ran := 0.0
 	for _, la := range answer.Levels {
diff --git a/modules/mesh-delivery-checker/internal/check/manifests_judge.go b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
index fc63f5fb..718cebd5 100644
--- a/modules/mesh-delivery-checker/internal/check/manifests_judge.go
+++ b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"strings"
 
@@ -31,7 +32,7 @@ const (
 	JudgeCase  = "change"
 	JudgeTrunk = "trunk"
 	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
-	judgeBetween = "(between manifests)"
+	judgeBetween = rules.BetweenManifests
 )
 
 // judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
@@ -93,16 +94,17 @@ func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request,
 		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
 }
 
-// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
-// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
-// cannot be asked or does not answer fails the check, said, never passes it.
-func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
+// judgeManifests runs the indexer's judge over the case's manifests and records its answers as a fact the rules judge
+// (rules.JudgeManifests), with the trunk validator's answer on a new indexer (ADR 0633 clause 6). A case that touches no
+// manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that cannot be asked or does not answer
+// is a failure, said, never a pass.
+func (st *state) judgeManifests(ctx context.Context) {
 	if st.j.Manifests == nil || st.narrowTry() {
-		return nil
+		return
 	}
 	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
 	if len(touched) == 0 {
-		return nil
+		return
 	}
 	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
 	if commit == "" {
@@ -112,7 +114,8 @@ func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
 		at = "mesh-delivery's trunk " + commit
 	}
 	if commit == "" {
-		return st.fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
+		st.fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
+		return
 	}
 	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
 	// when the change alters it, else the one the indexer keeps.
@@ -120,67 +123,24 @@ func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
 		req.Predefined = list
 		st.c.note("the manifests are judged against the predefined keys of " + from)
 	}
-	cv, trunkCase, v := st.runJudge(ctx, req, touched, commit, at, st.packagesOf(DeliveryRepository))
-	if v != nil {
-		return v
+	cv, trunkCase, ok := st.runJudge(ctx, req, touched, commit, at, st.packagesOf(DeliveryRepository))
+	if !ok {
+		return
 	}
-	if v := st.refuseUnmovableIndexer(ctx, req, touched, cv, at); v != nil {
-		return v
+	m := rules.Manifests{Touched: touched, At: at, Change: cv, Trunk: trunkCase}
+	if !st.indexerOf(ctx, req, touched, cv, at, &m) {
+		return
 	}
-	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
-	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
-	// lacks, fails the check as the change's (ADR 0579 §2).
-	var refused, warned []string
-	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
-		r := cv.Manifests[module]
-		if r.Accepted {
-			continue
-		}
-		if r.Refused == "" { // held: a verdict not given is not one given (ADR 0633 clause 6)
-			if slices.Contains(touched, module) {
-				refused = append(refused, fmt.Sprintf("the indexer's judge at %s holds the manifest of %s: it gave no verdict", at, module))
-			}
-			continue
-		}
-		had := map[string]bool{}
-		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
-			had[p] = true
-		}
-		var caused, old []string
-		for _, p := range strings.Split(r.Refused, "\n") {
-			if slices.Contains(touched, module) || !had[p] {
-				caused = append(caused, p)
-			} else {
-				old = append(old, p)
-			}
-		}
-		if len(caused) > 0 {
-			what := "the manifest of " + module
-			if module == judgeBetween {
-				what = "the catalogue"
-			}
-			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
-		}
-		if len(old) > 0 {
-			warned = append(warned, module+": "+strings.Join(old, "; "))
-		}
-	}
-	if len(warned) > 0 {
-		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
-	}
-	if len(refused) > 0 {
-		return st.fail(goModule, strings.Join(refused, "\n"))
-	}
-	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
-	return nil
+	st.facts = append(st.facts, rules.Step{Module: goModule, Manifests: &m})
 }
 
 // runJudge asks the Go build seat to build the judge at the commit and run it over the request, and reads its change and
-// trunk cases; a failed verdict when it cannot be asked or does not answer.
-func (st *state) runJudge(ctx context.Context, req composer.Request, touched []string, commit, at string, versions delivery.PackageVersions) (change, trunk composer.CaseVerdict, v *delivery.Verdict) {
+// trunk cases; false, the failure recorded, when it cannot be asked or does not answer.
+func (st *state) runJudge(ctx context.Context, req composer.Request, touched []string, commit, at string, versions delivery.PackageVersions) (change, trunk composer.CaseVerdict, ok bool) {
 	raw, err := json.Marshal(req)
 	if err != nil {
-		return change, trunk, st.fail(goModule, err.Error())
+		st.fail(goModule, err.Error())
+		return change, trunk, false
 	}
 	job := delivery.ComposeJob{Fetch: withPackages(map[string]any{"repository": DeliveryRepository, "commit": commit}, versions), Dir: JudgeDir,
 		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
@@ -189,48 +149,48 @@ func (st *state) runJudge(ctx context.Context, req composer.Request, touched []s
 	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
 	st.c.Asked(a.ID)
 	if err := st.j.Asks.Put(ctx, a); err != nil {
-		return change, trunk, st.fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
+		st.fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
+		return change, trunk, false
 	}
 	step, err := st.j.Asks.Wait(ctx, a)
 	if err != nil {
-		return change, trunk, st.fail(goModule, "the judge of the change's manifests: "+err.Error())
+		st.fail(goModule, "the judge of the change's manifests: "+err.Error())
+		return change, trunk, false
 	}
 	change, trunk, why := judgeAnswer(step)
 	if why != "" {
-		return change, trunk, st.fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
+		st.fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
+		return change, trunk, false
 	}
-	return change, trunk, nil
+	return change, trunk, true
 }
 
-// CatalogSeat is the seat the indexer holds: the module whose manifest claims it is the indexer, found by the claim and
-// never by its name (novox/hq ADR 0633 clause 6, ADR 0601 §4).
-const CatalogSeat = "mesh-catalog"
+// CatalogSeat is the seat the indexer holds (rules.CatalogSeat).
+const CatalogSeat = rules.CatalogSeat
 
-// refuseUnmovableIndexer fails the check when the trunk's manifest validator, the one the running parts hold, would
-// refuse or hold the change's new indexer manifest: such an indexer would never run, and every revision behind it would
-// wait for ever (ADR 0633 clause 6). The indexer is the touched module whose manifest claims the seat mesh-catalog.
-// When the change judges with its own head's manifest validator (it changes it), the manifest is judged by the trunk's
-// as well. The verdicts read are the trunk's manifest validator's: its change case, where refused, held (not accepted
-// with no reason) or with a field set aside (a field the running manifest validator does not know waits, ADR 0601 §3)
-// each fail it, naming the module and the problems.
-func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Request, touched []string, cv composer.CaseVerdict, judgedAt string) *delivery.Verdict {
+// indexerOf finds the touched module whose manifest claims the seat mesh-catalog, the indexer, and puts in m the trunk's
+// manifest validator's change case on it, the one the running parts hold (ADR 0633 clause 6): when the change judges
+// with its own head's validator, or at other package versions than the latest published, the trunk's is asked as well.
+// False, the failure recorded, when a manifest cannot be read or the trunk's validator cannot be asked.
+func (st *state) indexerOf(ctx context.Context, req composer.Request, touched []string, cv composer.CaseVerdict, judgedAt string, m *rules.Manifests) bool {
 	if st.j.Read == nil {
-		return nil
+		return true
 	}
 	var indexer string
 	for _, module := range touched {
-		m, err := st.j.Read.Manifest(ctx, req.Cases[0].Manifests[module].Digest)
+		man, err := st.j.Read.Manifest(ctx, req.Cases[0].Manifests[module].Digest)
 		if err != nil {
-			return st.fail(goModule, fmt.Sprintf("the manifest of %s cannot be read, so the indexer cannot be ruled out: %v", module, err))
+			st.fail(goModule, fmt.Sprintf("the manifest of %s cannot be read, so the indexer cannot be ruled out: %v", module, err))
+			return false
 		}
-		for _, c := range m.Claims {
+		for _, c := range man.Claims {
 			if c.Name == CatalogSeat {
 				indexer = module
 			}
 		}
 	}
 	if indexer == "" {
-		return nil
+		return true
 	}
 	// The validator the running parts hold is the trunk's, built at the latest published versions alone, never at the group's
 	// heads (ADR 0633 clause 6): a group's mesh-sdk or mesh-contracts head must not change the validator that judges the new
@@ -241,32 +201,17 @@ func (st *state) refuseUnmovableIndexer(ctx context.Context, req composer.Reques
 			trunk = st.j.Trunks.Heads()[DeliveryRepository]
 		}
 		if trunk == "" {
-			return st.fail(goModule, "the new indexer cannot be judged by the trunk's manifest validator: the trunk head of "+DeliveryRepository+" is not known")
+			st.fail(goModule, "the new indexer cannot be judged by the trunk's manifest validator: the trunk head of "+DeliveryRepository+" is not known")
+			return false
 		}
-		var v *delivery.Verdict
 		judgedAt = "mesh-delivery's trunk " + trunk
-		if cv, _, v = st.runJudge(ctx, req, touched, trunk, judgedAt, trunkVersions); v != nil {
-			return v
+		var ok bool
+		if cv, _, ok = st.runJudge(ctx, req, touched, trunk, judgedAt, trunkVersions); !ok {
+			return false
 		}
 	}
-	r, ok := cv.Manifests[indexer]
-	var problems []string
-	switch {
-	case !ok:
-		problems = append(problems, "the manifest validator gave no verdict")
-	case r.Refused != "":
-		problems = append(problems, strings.Split(r.Refused, "\n")...)
-	case !r.Accepted:
-		problems = append(problems, "the manifest validator holds it, with no verdict yet")
-	case r.SetAside != "":
-		problems = append(problems, "the manifest validator does not know its fields "+r.SetAside+", so it waits")
-	}
-	if len(problems) > 0 {
-		return st.fail(goModule, fmt.Sprintf("the indexer %s, the holder of the seat %s, would never run: the trunk's manifest validator at %s does not accept its manifest: %s",
-			indexer, CatalogSeat, judgedAt, strings.Join(problems, "; ")))
-	}
-	st.c.note(fmt.Sprintf("the new indexer's manifest of %s is accepted by the trunk's manifest validator at %s", indexer, judgedAt))
-	return nil
+	m.Indexer, m.IndexerAt, m.OfIndexer = indexer, judgedAt, &cv
+	return true
 }
 
 // judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
diff --git a/modules/mesh-delivery-checker/internal/check/results.go b/modules/mesh-delivery-checker/internal/check/results.go
index 7d26e72d..4095b9c1 100644
--- a/modules/mesh-delivery-checker/internal/check/results.go
+++ b/modules/mesh-delivery-checker/internal/check/results.go
@@ -52,13 +52,8 @@ type Fetched struct {
 	Programs *[]ProgramFile `json:"programs,omitempty"`
 }
 
-// ProgramFile is a changed file that is a compiled program, and its format (ELF, Mach-O or PE).
-type ProgramFile struct {
-	Path string `json:"path"`
-	Kind string `json:"kind"`
-	// Commit is set for a program a commit of the branch added and a later one removed: it stays in history once merged.
-	Commit string `json:"commit,omitempty"`
-}
+// ProgramFile is a changed file that is a compiled program (rules.ProgramFile).
+type ProgramFile = rules.ProgramFile
 
 // The test step's answer is read by the judging rules (milestone 47/B0); these name their shapes here.
 type (
diff --git a/modules/mesh-delivery-checker/internal/check/try_test.go b/modules/mesh-delivery-checker/internal/check/try_test.go
index a5de63fb..d3eb73ff 100644
--- a/modules/mesh-delivery-checker/internal/check/try_test.go
+++ b/modules/mesh-delivery-checker/internal/check/try_test.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"mesh-delivery-checker/rules"
 	"slices"
 	"strings"
 	"testing"
@@ -167,7 +168,7 @@ func (f *fakeTryCandidates) TryCandidate(_ context.Context, group, heads string,
 // wholeBench makes the bench judge a whole try as the checker does: the composition on every placed node and the
 // indexer's candidate of the try's group.
 func wholeBench(b *bench, cand delivery.Candidate) (*fakeCompositions, *fakeTryCandidates) {
-	comps := &fakeCompositions{v: delivery.CompositionVerdict{State: delivery.CompositionPass, SDK: "v0.1.14-x", Machines: []string{"g14", "shanks"}, Took: 40}}
+	comps := &fakeCompositions{v: composedOn("v0.1.14-x", 40, "g14", "shanks")}
 	cands := &fakeTryCandidates{cand: cand}
 	b.ex.Compositions, b.ex.Candidates = comps, cands
 	return comps, cands
@@ -366,21 +367,21 @@ func TestAFailingTryNamesWhatFailedAndAStepThatCannotRunIsAnError(t *testing.T)
 	for _, row := range []struct {
 		name        string
 		cand        *fakeTryCandidates
-		comp        delivery.CompositionVerdict
+		comp        *rules.Composed
 		state, said string
 	}{
 		{name: "the indexer wrote no candidate", cand: &fakeTryCandidates{err: errors.New("the indexer wrote no candidate within 5m0s")}, state: TryError, said: "the indexer wrote no candidate within 5m0s"},
-		{name: "a node that gave no composition answer", cand: &fakeTryCandidates{}, comp: delivery.CompositionVerdict{State: delivery.CompositionPass, SDK: "x", Warnings: []string{"g14: " + delivery.ComposeNoAnswer}},
+		{name: "a node that gave no composition answer", cand: &fakeTryCandidates{}, comp: &rules.Composed{Composer: "x", Nodes: []string{"g14"}},
 			state: TryError, said: "g14: " + delivery.ComposeNoAnswer},
-		{name: "a composition refused on a node", cand: &fakeTryCandidates{}, comp: delivery.CompositionVerdict{State: delivery.CompositionFail, Machine: "g14", Words: "not composed on g14: web: needs a state mail does not keep"},
+		{name: "a composition refused on a node", cand: &fakeTryCandidates{}, comp: ptr(refusedOn("x", "g14", "web: needs a state mail does not keep")),
 			state: TryFail, said: "not composed on g14: web: needs a state mail does not keep"},
 	} {
 		kv := newMemKV()
 		b := newBench(t)
 		comps, _ := wholeBench(b, delivery.Candidate{})
-		b.ex.Candidates, comps.v = row.cand, row.comp
-		if row.comp.State == "" {
-			comps.v.State = delivery.CompositionPass
+		b.ex.Candidates = row.cand
+		if row.comp != nil {
+			comps.v = *row.comp
 		}
 		id, _ := AskTry(memTries{kv}, tryTrunks, TryAsk{Repository: repoA, Head: head1}, time.Now())
 		var ends []string
diff --git a/modules/mesh-delivery-checker/rules/facts.go b/modules/mesh-delivery-checker/rules/facts.go
index b3f33e28..874dfdc9 100644
--- a/modules/mesh-delivery-checker/rules/facts.go
+++ b/modules/mesh-delivery-checker/rules/facts.go
@@ -34,6 +34,9 @@ type Facts struct {
 	Steps []Step `json:"steps,omitempty"`
 	// CloneMS is how much of the steps' time their levels' running did not take (delivery.Took.Clone).
 	CloneMS int64 `json:"clone-ms,omitempty"`
+	// Composition is how the check composed, after every step; nil when it was not composed (a narrowed try, a checker
+	// that composes nothing): its composition is then not run, unsaid.
+	Composition *Composition `json:"composition,omitempty"`
 	// Notes are the running checker's notes of the check, for a reader.
 	Notes []string `json:"notes,omitempty"`
 }
@@ -46,9 +49,10 @@ type Member struct {
 	Trunk      string `json:"trunk,omitempty"`
 }
 
-// Step is one fact of a member's check step: the node that ran it, and either one level its build module answered
-// (Level, as the build module gave it) or a failure the asking met (Failed: a step not asked, refused or not answered,
-// a conflict, a binary, worded by the running checker). A step with neither only says which node ran it.
+// Step is one fact of the check, in the order met: the node that ran it, and one of a level its build module answered
+// (Level, as the build module gave it), what its fetch read of compiled programs (Programs), the manifest validator's
+// answers (Manifests) or a failure the asking met (Failed: a step not asked, refused or not answered, a conflict, worded
+// by the running checker). A step with none only says which node ran it.
 type Step struct {
 	Repository string                `json:"repository"`
 	Number     int                   `json:"number"`
@@ -56,6 +60,8 @@ type Step struct {
 	Node       string                `json:"node,omitempty"`
 	Level      *delivery.LevelAnswer `json:"level,omitempty"`
 	Failed     *delivery.FailedFirst `json:"failed,omitempty"`
+	Programs   *Programs             `json:"programs,omitempty"`
+	Manifests  *Manifests            `json:"manifests,omitempty"`
 }
 
 // DecodeFacts reads facts, refusing a version this program does not read, naming it.
@@ -131,9 +137,14 @@ func (t Tally) Level(repository string, number int, module, node string, la deli
 	return nil, elapsed, results
 }
 
-// Judge is the verdict of the facts: every failure in the order met, joined and settled, or a pass; the levels'
-// counts, times, machines and the levels over their bound; the composition not yet run (the running checker composes).
-func Judge(f Facts) delivery.Verdict {
+// Judge is the verdict of the facts (Judged without its notes).
+func Judge(f Facts) delivery.Verdict { return Judged(f).Verdict }
+
+// Judged is the answer of the facts: every failure in the order met, joined and settled, or a pass; the levels'
+// counts, times, machines and the levels over their bound; then the composition taken in; and the notes the rules give
+// a reader (the manifest validator's warnings and acceptances).
+func Judged(f Facts) Answer {
+	var notes []string
 	tally := NewTally()
 	var failures []*delivery.Verdict
 	nodes := map[string]bool{}
@@ -148,6 +159,16 @@ func Judge(f Facts) delivery.Verdict {
 			if v, _, _ := tally.Level(s.Repository, s.Number, s.Module, s.Node, *s.Level); v != nil {
 				failures = append(failures, v)
 			}
+		case s.Programs != nil:
+			if ff := JudgePrograms(s.Node, *s.Programs); ff != nil {
+				failures = append(failures, &delivery.Verdict{State: delivery.VerdictFail, Failed: *ff})
+			}
+		case s.Manifests != nil:
+			ff, said := JudgeManifests(*s.Manifests)
+			notes = append(notes, said...)
+			if ff != nil {
+				failures = append(failures, &delivery.Verdict{State: delivery.VerdictFail, Failed: *ff})
+			}
 		}
 	}
 	v := delivery.Verdict{State: delivery.VerdictPass}
@@ -156,7 +177,10 @@ func Judge(f Facts) delivery.Verdict {
 	}
 	v.Group, v.Heads, v.Trunk = f.Group, f.Heads, f.Trunk
 	Outcome(&v, tally, f.CloneMS, nodes)
-	return v
+	if f.Composition != nil {
+		JudgeComposition(&v, *f.Composition)
+	}
+	return Answer{V: AnswerVersion, Verdict: v, Notes: notes}
 }
 
 // Outcome fills a verdict's levels (on a pass, or when it names none), times, machines and levels over their bound from
@@ -211,8 +235,10 @@ func failAt(machine, words string) *delivery.Verdict {
 // AnswerVersion is the version of Answer this program writes.
 const AnswerVersion = 1
 
-// Answer is what the checking program answers on the last line of its standard output: its version and the verdict.
+// Answer is what the checking program answers on the last line of its standard output: its version, the verdict and the
+// notes its rules give a reader of the check.
 type Answer struct {
 	V       int              `json:"v"`
 	Verdict delivery.Verdict `json:"verdict"`
+	Notes   []string         `json:"notes,omitempty"`
 }
diff --git a/modules/mesh-delivery-checker/rules/judged.go b/modules/mesh-delivery-checker/rules/judged.go
new file mode 100644
index 00000000..6d1b52f0
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/judged.go
@@ -0,0 +1,277 @@
+package rules
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The facts the manifest validator, the fetch's programs and the composer answered, and the rules that judge them
+// (milestone 47/B0, D1b): the running checker asks and records; these rules give the verdict.
+
+// manifestsMachine is the machine a manifest's failure names: the build seat that ran the manifest validator.
+const manifestsMachine = buildrun.GoBuildModule
+
+// CatalogSeat is the seat the indexer holds: the module whose manifest claims it is the indexer, found by the claim and
+// never by its name (novox/hq ADR 0633 clause 6, ADR 0601 §4).
+const CatalogSeat = "mesh-catalog"
+
+// BetweenManifests is the manifest validator's name for what it judges between manifests (the catalogue as a whole).
+const BetweenManifests = "(between manifests)"
+
+// Manifests are the manifest validator's answers on the manifests a check touches (ADR 0578 §2, ADR 0579 §2, ADR 0633
+// clause 6): its change and trunk cases where it judged (At), and, when a touched module claims the seat mesh-catalog,
+// that indexer and the trunk validator's change case on it (IndexerAt names where it judged).
+type Manifests struct {
+	Touched   []string              `json:"touched"`
+	At        string                `json:"at"`
+	Change    composer.CaseVerdict  `json:"change"`
+	Trunk     composer.CaseVerdict  `json:"trunk"`
+	Indexer   string                `json:"indexer,omitempty"`
+	IndexerAt string                `json:"indexer-at,omitempty"`
+	OfIndexer *composer.CaseVerdict `json:"of-indexer,omitempty"`
+}
+
+// Programs are what one member's fetch read of the change's compiled programs (issue 1577): Files nil when the build
+// module reported none (an older module: not refused, the running checker warns), else each changed file that is one.
+type Programs struct {
+	Key   string         `json:"key"`
+	Files *[]ProgramFile `json:"files"`
+}
+
+// ProgramFile is a changed file that is a compiled program, its format (ELF, Mach-O or PE) and, when it was added in an
+// earlier commit of the branch and removed later, that commit.
+type ProgramFile struct {
+	Path   string `json:"path"`
+	Kind   string `json:"kind"`
+	Commit string `json:"commit,omitempty"`
+}
+
+// Composition is how the check's composition went (ADR 0593 §7, §9; ADR 0603 §10; ADR 0548 §5): kept from the check it
+// carries, not run (NotRun says why), or composed by the engines; BuildsFailed are the candidate's builds that failed
+// before it composed, worded by the running checker; Waits are what it composed without waiting on, as warnings.
+type Composition struct {
+	Kept         *delivery.Composition  `json:"kept,omitempty"`
+	NotRun       string                 `json:"not-run,omitempty"`
+	BuildsFailed []delivery.FailedFirst `json:"builds-failed,omitempty"`
+	Waits        []string               `json:"waits,omitempty"`
+	Composed     *Composed              `json:"composed,omitempty"`
+	FPSet        string                 `json:"fp-set,omitempty"`
+}
+
+// Composed are the engines' answers to one composition: the nodes placed, each answering node's answer, each silent
+// node with why (for the journal only), what composed (the node-engine's commit), the composer's own warnings and how
+// long it took in milliseconds.
+type Composed struct {
+	Group    string                                     `json:"group"`
+	Heads    string                                     `json:"heads"`
+	Composer string                                     `json:"composer"`
+	Nodes    []string                                   `json:"nodes"`
+	Answers  map[string]delivery.ComposeCandidateAnswer `json:"answers,omitempty"`
+	Silent   map[string]string                          `json:"silent,omitempty"`
+	Warnings []string                                   `json:"warnings,omitempty"`
+	Took     int64                                      `json:"took,omitempty"`
+}
+
+// JudgeManifests is the failure of the manifests' facts (nil when they pass) and the notes a reader gets: the trunk
+// validator refusing, holding or setting aside the new indexer's manifest fails first (ADR 0633 clause 6); else a new or
+// changed manifest is judged in full, a held one is refused, and of one the change leaves as it is a problem the trunk
+// already had is a warning while one the change causes fails the check (ADR 0579 §2).
+func JudgeManifests(m Manifests) (*delivery.FailedFirst, []string) {
+	var notes []string
+	if m.Indexer != "" {
+		var problems []string
+		ok := false
+		var iv composer.ManifestRead
+		if m.OfIndexer != nil {
+			iv, ok = m.OfIndexer.Manifests[m.Indexer]
+		}
+		switch {
+		case !ok:
+			problems = append(problems, "the manifest validator gave no verdict")
+		case iv.Refused != "":
+			problems = append(problems, strings.Split(iv.Refused, "\n")...)
+		case !iv.Accepted:
+			problems = append(problems, "the manifest validator holds it, with no verdict yet")
+		case iv.SetAside != "":
+			problems = append(problems, "the manifest validator does not know its fields "+iv.SetAside+", so it waits")
+		}
+		if len(problems) > 0 {
+			return &delivery.FailedFirst{Machine: manifestsMachine, Words: fmt.Sprintf("the indexer %s, the holder of the seat %s, would never run: the trunk's manifest validator at %s does not accept its manifest: %s",
+				m.Indexer, CatalogSeat, m.IndexerAt, strings.Join(problems, "; "))}, nil
+		}
+		notes = append(notes, fmt.Sprintf("the new indexer's manifest of %s is accepted by the trunk's manifest validator at %s", m.Indexer, m.IndexerAt))
+	}
+	var refused, warned []string
+	for _, module := range slices.Sorted(maps.Keys(m.Change.Manifests)) {
+		r := m.Change.Manifests[module]
+		if r.Accepted {
+			continue
+		}
+		if r.Refused == "" { // held: a verdict not given is not one given (ADR 0633 clause 6)
+			if slices.Contains(m.Touched, module) {
+				refused = append(refused, fmt.Sprintf("the indexer's judge at %s holds the manifest of %s: it gave no verdict", m.At, module))
+			}
+			continue
+		}
+		had := map[string]bool{}
+		for _, p := range strings.Split(m.Trunk.Manifests[module].Refused, "\n") {
+			had[p] = true
+		}
+		var caused, old []string
+		for _, p := range strings.Split(r.Refused, "\n") {
+			if slices.Contains(m.Touched, module) || !had[p] {
+				caused = append(caused, p)
+			} else {
+				old = append(old, p)
+			}
+		}
+		if len(caused) > 0 {
+			what := "the manifest of " + module
+			if module == BetweenManifests {
+				what = "the catalogue"
+			}
+			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", m.At, what, strings.Join(caused, "; ")))
+		}
+		if len(old) > 0 {
+			warned = append(warned, module+": "+strings.Join(old, "; "))
+		}
+	}
+	if len(warned) > 0 {
+		notes = append(notes, "warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): "+strings.Join(warned, " | "))
+	}
+	if len(refused) > 0 {
+		return &delivery.FailedFirst{Machine: manifestsMachine, Words: strings.Join(refused, "\n")}, notes
+	}
+	return nil, append(notes, fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(m.Touched, ", "), m.At))
+}
+
+// JudgePrograms fails a member whose change adds or modifies a compiled program, naming each file (issue 1577); a fetch
+// that reported none, or found none, passes.
+func JudgePrograms(machine string, p Programs) *delivery.FailedFirst {
+	if p.Files == nil {
+		return nil
+	}
+	var found []string
+	for _, f := range *p.Files {
+		if f.Commit != "" {
+			found = append(found, fmt.Sprintf("%s: a compiled program added in %s and removed later: it stays in history; squash the branch (issue 1577)", f.Path, short12(f.Commit)))
+			continue
+		}
+		found = append(found, f.Path+": a compiled program is build output: remove it and add it to .gitignore (issue 1577)")
+	}
+	if len(found) == 0 {
+		return nil
+	}
+	return &delivery.FailedFirst{Machine: machine, Words: fmt.Sprintf("%s: %s", p.Key, strings.Join(found, "; "))}
+}
+
+func short12(s string) string {
+	if len(s) > 12 {
+		return s[:12]
+	}
+	return s
+}
+
+// JudgeEngines is the check's composition verdict from the engines' answers (ADR 0593 §7, §9): failed when any node's
+// answer is refused, naming each node and each module refused with its words (the first refusing node is the machine);
+// passed otherwise. Every placed node without an answer is named with delivery.ComposeNoAnswer as a warning.
+func JudgeEngines(c Composed) delivery.CompositionVerdict {
+	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, State: delivery.CompositionPass, SDK: c.Composer, Took: c.Took}
+	sorted := append([]string(nil), c.Nodes...)
+	sort.Strings(sorted)
+	var fails []string
+	for _, node := range sorted {
+		a, answered := c.Answers[node]
+		if !answered {
+			v.Warnings = append(v.Warnings, node+": "+delivery.ComposeNoAnswer)
+			continue
+		}
+		if a.Verdict == delivery.ComposeCandidateNotJudged {
+			// Composed in the sandbox and not judged (ADR 0593 §9): named as no answer, with the composer's words; decided
+			// by the verdict, never by the words (ADR 0601 §4's kind).
+			v.Warnings = append(v.Warnings, node+": "+delivery.ComposeNoAnswer+" ("+a.Refused+")")
+			continue
+		}
+		v.Machines = append(v.Machines, node)
+		if a.Verdict != delivery.ComposeCandidateRefused {
+			continue
+		}
+		if v.Machine == "" {
+			v.Machine = node
+		}
+		var words []string
+		if a.Refused != "" {
+			words = append(words, a.Refused)
+		}
+		for _, m := range append(append([]delivery.ModuleComposed(nil), a.Modules...), a.Own) {
+			if m.State == delivery.ModuleRefusedState {
+				words = append(words, m.Module+": "+m.Words)
+			}
+		}
+		if len(words) == 0 {
+			words = append(words, "refused, naming no module")
+		}
+		fails = append(fails, "not composed on "+node+": "+strings.Join(words, "; "))
+	}
+	if len(fails) > 0 {
+		v.State, v.Words = delivery.CompositionFail, strings.Join(fails, "; ")
+	}
+	if len(sorted) == 0 {
+		v.Warnings = append(v.Warnings, "no node is placed, so the change was composed on none")
+	}
+	v.Warnings = append(v.Warnings, c.Warnings...)
+	return v
+}
+
+// JudgeComposition takes the composition's facts into the verdict: a failed build of the candidate fails it, named after
+// the tests' failures; a failed composition fails it, naming its machine; a passed one with warnings says them.
+func JudgeComposition(v *delivery.Verdict, c Composition) {
+	if c.Kept != nil {
+		kept := *c.Kept
+		v.Composition = &kept
+		return
+	}
+	for _, f := range c.BuildsFailed {
+		if v.State != delivery.VerdictFail {
+			v.State, v.Failed = delivery.VerdictFail, f
+			continue
+		}
+		AddFailure(v, f)
+	}
+	if c.NotRun != "" {
+		v.Composition = &delivery.Composition{State: delivery.CompositionNotRun, Words: c.NotRun}
+		return
+	}
+	if c.Composed == nil {
+		return
+	}
+	comp := JudgeEngines(*c.Composed)
+	comp.Warnings = append(comp.Warnings, c.Waits...) // ADR 0603 §10
+	v.Composition = comp.Composition()
+	v.Took.Composition = comp.Took
+	if comp.State == delivery.CompositionPass && len(comp.Warnings) > 0 && v.Composition != nil {
+		v.Composition.Words = strings.Join(comp.Warnings, "; ") // passed with a warning (ADR 0593 §9)
+	}
+	if comp.State == delivery.CompositionFail {
+		machine := comp.Machine
+		if machine == "" {
+			machine = "the composition"
+		}
+		f := delivery.FailedFirst{Machine: machine, Words: comp.Words}
+		if v.State == delivery.VerdictFail {
+			AddFailure(v, f) // the tests failed too: the composition is named after them (the operator, 2026-11-02)
+		} else {
+			v.State, v.Failed = delivery.VerdictFail, f
+		}
+	}
+	if v.Composition != nil && v.Composition.State != delivery.CompositionNotRun {
+		v.Composition.FPSet = c.FPSet // a carry keeps it while the fingerprints stay the same (ADR 0548 §5)
+	}
+}

From 1b9a2bc3021f09691a9fc577598b9d075e2b9c25 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:32:51 +0100
Subject: [PATCH 05/17] The running checker's asking records facts and returns
 no verdict (issue 1921)

Every asking function only records what it met; the one verdict is the rules' of the facts, so nothing in the
running checker judges beside the checking program.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../internal/check/every_failure_test.go      | 16 ++--
 .../internal/check/judge.go                   | 89 ++++++++++---------
 2 files changed, 52 insertions(+), 53 deletions(-)

diff --git a/modules/mesh-delivery-checker/internal/check/every_failure_test.go b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
index a845e029..a25dac1b 100644
--- a/modules/mesh-delivery-checker/internal/check/every_failure_test.go
+++ b/modules/mesh-delivery-checker/internal/check/every_failure_test.go
@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"mesh-delivery-checker/rules"
-	"reflect"
 	"strings"
 	"testing"
 
@@ -24,17 +23,16 @@ func failingResult(t *testing.T, tests int, failed ...Failure) json.RawMessage {
 func judgeLevel(t *testing.T, tests ...json.RawMessage) (*delivery.Verdict, *state) {
 	t.Helper()
 	st := &state{j: &Examiner{}, c: &Case{}, levels: rules.NewTally()}
-	v, _ := st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
-	v = rules.Settled(rules.JoinFailures(v))
-	// 1921 (B0, D1a): the facts the running checker gathered, judged by the rules, give the same failures and counts.
+	st.level(t.Context(), &target{pull: Pull{Repository: "novox/x"}}, delivery.LevelAnswer{Level: delivery.LevelIntegration, Tests: tests})
+	// 1921 (B0, D1a): the running checker only gathers the level as a fact; the rules judge it, and count what it kept.
 	judged := rules.Judge(rules.Facts{V: rules.FactsVersion, Steps: st.facts})
-	switch {
-	case v == nil && judged.State != delivery.VerdictPass, v != nil && (judged.Failed != v.Failed || !reflect.DeepEqual(judged.Failures, v.Failures)):
-		t.Errorf("the rules judge the facts %+v, the running checker %+v", judged, v)
-	case judged.Levels[delivery.LevelIntegration] != (delivery.LevelResult{Run: st.levels[delivery.LevelIntegration].Run}):
+	if judged.Levels[delivery.LevelIntegration] != (delivery.LevelResult{Run: st.levels[delivery.LevelIntegration].Run}) {
 		t.Errorf("the rules count %+v, the running checker %+v", judged.Levels, *st.levels[delivery.LevelIntegration])
 	}
-	return v, st
+	if judged.State == delivery.VerdictPass {
+		return nil, st
+	}
+	return &judged, st
 }
 
 // Issue 1921: two failing tests in two packages are two entries of the verdict's Failures and two lines of a try's
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 5faa8b33..78856a58 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -47,9 +47,6 @@ const (
 	judgedByCandidate    = "judged by the candidate's mesh-build-go at "
 )
 
-// verdictPtr is a verdict of failure a step of the check ends with.
-type verdictPtr = *delivery.Verdict
-
 // Asks puts a check's ask on its build seat's stream and waits for its step (buildrun.Asker; ADR 0525 §1, §6): the
 // checker chooses no node, starts no step and holds none; whichever build node pulls the ask runs the check.
 type Asks interface {
@@ -381,9 +378,8 @@ func (st *state) outcome(v delivery.Verdict) Outcome {
 // fail records a failure the asking met as a fact of the check, where it is met, and answers it as a verdict of failure
 // at a machine: the verdict is the judging rules' of the facts (rules.Judge), so a failure only returned is no failure
 // (milestone 47/B0).
-func (st *state) fail(machine, words string) *delivery.Verdict {
+func (st *state) fail(machine, words string) {
 	st.facts = append(st.facts, rules.Step{Failed: &delivery.FailedFirst{Machine: machine, Words: words}})
-	return fail(machine, words)
 }
 
 // factsOf are the check's facts as met: what the checking program judges.
@@ -391,12 +387,6 @@ func (st *state) factsOf() rules.Facts {
 	return rules.Facts{V: rules.FactsVersion, Steps: st.facts, CloneMS: st.clone.Milliseconds(), Composition: st.composition, Notes: st.c.Notes()}
 }
 
-// fail is a verdict of failure at a machine.
-func fail(machine, words string) *delivery.Verdict {
-	v := failure(machine, words)
-	return &v
-}
-
 // levels are the levels a case's asks run: both, or the one a try names.
 func (st *state) levelsOf() []string {
 	if st.c.Try != nil && st.c.Try.Level != "" {
@@ -409,7 +399,7 @@ func (st *state) levelsOf() []string {
 // judges each answer. A head that does not merge, a pin that is not allowed or a level that fails is a failure of that
 // member; every other member is still judged, and the verdict names every failure (the operator, 2026-11-02), unjoined
 // to its first lines (settled does that). Only a check whose context ended stops.
-func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
+func (st *state) judgeAll(ctx context.Context) {
 	// The mesh-sdk member first: whether its merge changes the TypeScript package's paths decides whether the other members'
 	// Node fetches take the group's package (ADR 0500 §5).
 	pulls := slices.Clone(st.c.Pulls)
@@ -423,11 +413,11 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		return 0
 	})
 	var groupPackage map[string]any
-	var failures []*delivery.Verdict
+	met := len(st.facts)
 	for _, p := range pulls {
 		if ctx.Err() != nil {
-			if len(failures) == 0 { // an ask that ended with the context said it already
-				failures = append(failures, st.fail(delivery.CheckerModule, ctx.Err().Error()))
+			if !st.failedSince(met) { // an ask that ended with the context said it already
+				st.fail(delivery.CheckerModule, ctx.Err().Error())
 			}
 			break
 		}
@@ -446,7 +436,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			if bm == buildrun.GoBuildModule {
 				beside, err := st.j.besideFor(ctx, st.c, p)
 				if err != nil {
-					failures = append(failures, st.fail(forgeMachine(err, bm), err.Error()+unheardWords(err)))
+					st.fail(forgeMachine(err, bm), err.Error()+unheardWords(err))
 					continue
 				}
 				if len(beside) > 0 {
@@ -460,9 +450,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			}
 			t.fetchArgs = args
 			st.targets = append(st.targets, t)
-			if v := st.ask(ctx, t, &merged); v != nil {
-				failures = append(failures, v)
-			}
+			st.ask(ctx, t, &merged)
 		}
 		// Every build module's fetch merged (each is in merged once): the preview is written, also when the member's tests
 		// failed, so the indexer holds its manifests and the assigner can compose the change (review of 650a1d0).
@@ -478,7 +466,16 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
 	}
-	return rules.JoinFailures(failures...)
+}
+
+// failedSince says a failure was recorded among the facts from the nth on.
+func (st *state) failedSince(n int) bool {
+	for _, f := range st.facts[n:] {
+		if f.Failed != nil {
+			return true
+		}
+	}
+	return false
 }
 
 // DefaultDeclineBound is an Examiner's DeclineBound when it names none: longer than a check runs, so a node with the
@@ -489,14 +486,14 @@ const DefaultDeclineBound = 30 * time.Minute
 // each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
 // their tests needing what that node lacks (issue 890), the passes are kept and the levels from the first such one are
 // asked again of a node that has it (placed).
-func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
-	return st.askNeeding(ctx, t, merged, st.levelsOf(), nil, nil)
+func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) {
+	st.askNeeding(ctx, t, merged, st.levelsOf(), nil, nil)
 }
 
 // askNeeding is ask with the levels to run, what the node must have and the packages it tests: none for the first ask
 // of a target; for the placed one the unmet packages' needs and those packages alone, so no package the first ask judged
 // is run or counted again (ADR 0552 §4).
-func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) *delivery.Verdict {
+func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, levels, needs, packages []string) {
 	p := t.pull
 	placed := len(needs) > 0
 	job := &delivery.CheckJob{Fetch: t.fetchArgs, Levels: levels, Kept: true, Packages: packages, Toolchain: t.agreed}
@@ -506,7 +503,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			err = fmt.Errorf("no node record is on the bus")
 		}
 		if err != nil {
-			return st.fail(t.module, fmt.Sprintf("the check of %s#%d is not asked: the nodes' names the names check needs cannot be read: %v", p.Repository, p.Number, err))
+			st.fail(t.module, fmt.Sprintf("the check of %s#%d is not asked: the nodes' names the names check needs cannot be read: %v", p.Repository, p.Number, err))
+			return
 		}
 		job.NodeNames = names
 	}
@@ -535,7 +533,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		st.c.Progress.Set(what, "")
 		st.c.Asked(a.ID)
 		if err := st.j.Asks.Put(ctx, a); err != nil {
-			return st.fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
+			st.fail(t.module, fmt.Sprintf("the check of %s#%d could not be asked: %v", p.Repository, p.Number, err))
+			return
 		}
 		waiting := ctx
 		if watch := st.c.Watch; watch != nil {
@@ -547,9 +546,11 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		step, err = st.j.Asks.Wait(waiting, a)
 		if err != nil {
 			if ctx.Err() != nil {
-				return st.fail(t.module, ctx.Err().Error())
+				st.fail(t.module, ctx.Err().Error())
+				return
 			}
-			return st.fail(t.module, fmt.Sprintf("the check of %s#%d: %v", p.Repository, p.Number, err))
+			st.fail(t.module, fmt.Sprintf("the check of %s#%d: %v", p.Repository, p.Number, err))
+			return
 		}
 		d, declined := delivery.DeclinedOf(step)
 		if !declined {
@@ -570,13 +571,13 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			if lacks == "" {
 				lacks = strings.Join(d.Lacks, ", ") // a node off the agreed toolchain declined it (ADR 0584)
 			}
-			return st.fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
+			st.fail(step.Node, fmt.Sprintf("the check of %s#%d needs a node with %s, and none took it in %s: every node that pulled it lacks it (last %s)",
 				p.Repository, p.Number, lacks, bound, step.Node))
+			return
 		}
 		st.j.logf("%s#%d: the ask %s was declined on %s, which lacks %s; asked again", p.Repository, p.Number, a.ID, step.Node, strings.Join(d.Lacks, ", "))
 		a.ID, a.At = buildstep.NewID(), now.UTC()
 	}
-	var failures []*delivery.Verdict
 	// The fetch and the digests are what of the ask's time its levels' running did not take (Took.Clone).
 	took := time.Duration(0)
 	if !step.Started.IsZero() && step.Ended.After(step.Started) {
@@ -586,20 +587,24 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	st.facts = append(st.facts, rules.Step{Repository: p.Repository, Number: p.Number, Module: t.module, Node: step.Node})
 	st.c.Progress.Set(fmt.Sprintf("judge the check of %s#%d", p.Repository, p.Number), step.Node)
 	if step.State != delivery.StepPassed {
-		return st.fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
+		st.fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
+		return
 	}
 	var answer delivery.CheckAnswer
 	if err := json.Unmarshal(step.Result, &answer); err != nil {
-		return st.fail(step.Node, fmt.Sprintf("the check of %s#%d answered what is not a check: %s", p.Repository, p.Number, step.Result))
+		st.fail(step.Node, fmt.Sprintf("the check of %s#%d answered what is not a check: %s", p.Repository, p.Number, step.Result))
+		return
 	}
 	if err := json.Unmarshal(answer.Fetch, &t.fetched); err != nil || t.fetched.Workspace == "" {
-		return st.fail(step.Node, fmt.Sprintf("the fetch of %s#%d answered no workspace: %s", p.Repository, p.Number, answer.Fetch))
+		st.fail(step.Node, fmt.Sprintf("the fetch of %s#%d answered no workspace: %s", p.Repository, p.Number, answer.Fetch))
+		return
 	}
 	if len(t.fetched.Conflicts) > 0 {
 		if !st.narrowTry() {
 			st.j.writePreview(ctx, p, append(*merged, t.fetched))
 		}
-		return st.fail(step.Node, fmt.Sprintf("%s#%d %s%s", p.Repository, p.Number, ConflictWords, strings.Join(t.fetched.Conflicts, ", ")))
+		st.fail(step.Node, fmt.Sprintf("%s#%d %s%s", p.Repository, p.Number, ConflictWords, strings.Join(t.fetched.Conflicts, ", ")))
+		return
 	}
 	t.changed = t.fetched.Changed
 	if !changesBuildGo(p.Repository, t.changed) {
@@ -614,16 +619,13 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		if placed {
 			if len(la.Unmet) > 0 {
 				st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
-				return st.fail(step.Node, fmt.Sprintf("the %s level of %s#%d left %s untested on %s, which was asked for a node with %s",
+				st.fail(step.Node, fmt.Sprintf("the %s level of %s#%d left %s untested on %s, which was asked for a node with %s",
 					la.Level, p.Repository, p.Number, unmetNames(la.Unmet), step.Node, strings.Join(needs, ", ")))
+				return
 			}
 			la.Kept = nil // it names its packages and takes no other's kept verdict; this is only a guard against an older module
 		}
-		v, elapsed := st.level(ctx, t, la)
-		ran += elapsed
-		if v != nil {
-			failures = append(failures, v) // the next level was run too (buildstep): its failures are named as well
-		}
+		ran += st.level(ctx, t, la) // the next level was run too (buildstep): its failures are named as well
 	}
 	st.clone += max(0, took-time.Duration(ran*float64(time.Second)))
 	if unmet := delivery.UnmetNeeds(answer.Levels); len(unmet) > 0 && !placed {
@@ -643,9 +645,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 			}
 		}
 		st.j.logf("%s#%d: %s on %s left untested; asked of a node with %s", p.Repository, p.Number, unmetOf(answer.Levels), step.Node, strings.Join(unmet, ", "))
-		failures = append(failures, st.askNeeding(ctx, t, merged, again, unmet, packages))
+		st.askNeeding(ctx, t, merged, again, unmet, packages)
 	}
-	return rules.JoinFailures(failures...)
 }
 
 // unmetNames names the unmet packages and their needs.
@@ -672,14 +673,14 @@ func unmetOf(levels []delivery.LevelAnswer) string {
 // of the packages that passed, the kept ones taken are counted, and every test result is read and counted, also after
 // one that did not pass, so the verdict names every failed test of the level (issue 1921). It answers the level's
 // running time (its tests' and setup's).
-func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) (*delivery.Verdict, float64) {
+func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer) float64 {
 	if t.runner != "" && t.module == buildrun.GoBuildModule && la.Digest != nil {
 		t.judgedBy(la.Digest.JudgedBy) // the installed module judged it: the runner is not used again
 	}
 	if t.runner != "" && la.Judged != "" {
 		t.judgedBy(la.Judged) // the candidate judged the level: nothing is kept (ADR 0535 §4)
 	}
-	v, elapsed, results := st.levels.Level(t.pull.Repository, t.pull.Number, t.module, t.node, la)
+	_, elapsed, results := st.levels.Level(t.pull.Repository, t.pull.Number, t.module, t.node, la)
 	st.facts = append(st.facts, rules.Step{Repository: t.pull.Repository, Number: t.pull.Number, Module: t.module, Node: t.node, Level: &la})
 	var digests map[string]string
 	if t.module == buildrun.GoBuildModule && la.Digest != nil {
@@ -696,7 +697,7 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 			}
 		}
 	}
-	return v, elapsed
+	return elapsed
 }
 
 // changesPackage says whether the merge of a pull request changes a file inside the named paths of one of its repository's

From 35da943fb571ecd163e225d837bceb85f41f1dc0 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:35:40 +0100
Subject: [PATCH 06/17] The checking program answers the seat list of the heads
 laid for it (issue 1921)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Asked -seats, it reads every seat definition the heads carry, resolves the parts it includes and answers the list
with what it left out and why, so the running checker hands the manifest validator and the composer a list it does not
read itself (ADR 0636 §4, ADR 0644 §1).

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-checking-program/main.go         |  19 ++-
 .../cmd/mesh-checking-program/main_test.go    |  62 ++++++--
 modules/mesh-delivery-checker/rules/seats.go  | 142 ++++++++++++++++++
 3 files changed, 212 insertions(+), 11 deletions(-)
 create mode 100644 modules/mesh-delivery-checker/rules/seats.go

diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
index e18efc5c..21279f08 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
@@ -28,6 +28,7 @@ func run(args []string, getenv func(string) string, stdout, stderr io.Writer) in
 	fs := flag.NewFlagSet("mesh-checking-program", flag.ContinueOnError)
 	fs.SetOutput(stderr)
 	verdict := fs.Bool("verdict", false, "answer the verdict of the facts in the input")
+	seats := fs.Bool("seats", false, "answer the seat list of the heads laid for it")
 	if err := fs.Parse(args); err != nil {
 		return 2
 	}
@@ -35,8 +36,24 @@ func run(args []string, getenv func(string) string, stdout, stderr io.Writer) in
 		fmt.Fprintf(stderr, "mesh-checking-program: "+format+"\n", a...)
 		return 2
 	}
+	if *seats {
+		dir := getenv(delivery.RunHeadsEnv)
+		if dir == "" {
+			return refuse("no heads: %s names no directory", delivery.RunHeadsEnv)
+		}
+		answer, err := rules.SeatsOf(os.DirFS(dir))
+		if err != nil {
+			return refuse("%v", err)
+		}
+		line, err := json.Marshal(answer)
+		if err != nil {
+			return refuse("the seat list cannot be written: %v", err)
+		}
+		fmt.Fprintf(stdout, "%s\n", line)
+		return 0
+	}
 	if !*verdict {
-		return refuse("nothing asked: give -verdict")
+		return refuse("nothing asked: give -verdict or -seats")
 	}
 	file := getenv(delivery.RunInputEnv)
 	if file == "" {
diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
index b45af7c6..352c822a 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
@@ -15,6 +15,8 @@ import (
 
 // 1921 (B0, D2): the checking program answers, on its last line, the verdict the rules give the facts in its input, and
 // refuses facts of a version it does not read, an input it is not given, and a question it is not asked, naming each.
+// 1921 (B0, D3): asked -seats, it answers the seat list of the heads laid for it: a definition a head adds, resolved with
+// the parts it includes; what it left out, and why; and an empty list for heads with no definition.
 func TestTheCheckingProgramAnswersTheVerdictOfItsFacts(t *testing.T) {
 	failing, _ := json.Marshal(rules.Tested{Level: delivery.LevelUnit, Tests: 3, Failed: []rules.Failure{{Package: "x/a", Test: "TestA", Cause: "a_test.go:9: boom"}}})
 	facts := rules.Facts{V: rules.FactsVersion, Group: "feat/x", Heads: "0123456789ab", Members: []rules.Member{{Repository: "novox/x", Number: 3, Head: "h"}},
@@ -35,22 +37,45 @@ func TestTheCheckingProgramAnswersTheVerdictOfItsFacts(t *testing.T) {
 	later := facts
 	later.V = rules.FactsVersion + 1
 	v2 := write("v2.json", later)
+	heads := filepath.Join(dir, "heads")
+	for p, body := range map[string]string{
+		"novox/mesh-contracts/contracts/seats/node-build-x/seat.json": `{"format":1,"seat":"node-build-x","scope":"node","description":"kept","includes":["build"],"verbs":[{"name":"own"}]}`,
+		"novox/mesh-contracts/contracts/parts/build.json":             `{"part":"build","verbs":[{"name":"current"}],"events":[{"name":"ended"}]}`,
+		"novox/mesh-contracts/contracts/seats/broken/seat.json":       `{"format":1,"seat":"broken","scope":"nowhere"}`,
+	} {
+		if err := os.MkdirAll(filepath.Dir(filepath.Join(heads, p)), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(heads, p), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	none := filepath.Join(dir, "no-heads")
+	if err := os.MkdirAll(filepath.Join(none, "novox/x"), 0o755); err != nil {
+		t.Fatal(err)
+	}
 	for name, c := range map[string]struct {
-		args  []string
-		input string
-		exit  int
-		said  string
+		args         []string
+		input, heads string
+		exit         int
+		said         string
 	}{
-		"the facts":         {[]string{"-verdict"}, v1, 0, ""},
-		"a later version":   {[]string{"-verdict"}, v2, 2, "facts of version 2, this checking program reads version 1"},
-		"no input":          {[]string{"-verdict"}, "", 2, delivery.RunInputEnv + " names no file"},
-		"nothing asked":     {nil, v1, 2, "nothing asked"},
-		"an unknown asking": {[]string{"-judge"}, v1, 2, "-judge"},
+		"the seats":         {args: []string{"-seats"}, heads: heads},
+		"no seats":          {args: []string{"-seats"}, heads: none},
+		"no heads laid":     {args: []string{"-seats"}, exit: 2, said: delivery.RunHeadsEnv + " names no directory"},
+		"the facts":         {args: []string{"-verdict"}, input: v1},
+		"a later version":   {args: []string{"-verdict"}, input: v2, exit: 2, said: "facts of version 2, this checking program reads version 1"},
+		"no input":          {args: []string{"-verdict"}, exit: 2, said: delivery.RunInputEnv + " names no file"},
+		"nothing asked":     {input: v1, exit: 2, said: "nothing asked"},
+		"an unknown asking": {args: []string{"-judge"}, input: v1, exit: 2, said: "-judge"},
 	} {
 		var out, errs bytes.Buffer
 		exit := run(c.args, func(k string) string {
-			if k == delivery.RunInputEnv {
+			switch k {
+			case delivery.RunInputEnv:
 				return c.input
+			case delivery.RunHeadsEnv:
+				return c.heads
 			}
 			return ""
 		}, &out, &errs)
@@ -62,6 +87,23 @@ func TestTheCheckingProgramAnswersTheVerdictOfItsFacts(t *testing.T) {
 			continue
 		}
 		lines := strings.Split(strings.TrimSpace(out.String()), "\n")
+		if c.heads != "" {
+			var sa rules.SeatsAnswer
+			if err := json.Unmarshal([]byte(lines[len(lines)-1]), &sa); err != nil || sa.V != rules.SeatsVersion || sa.Seats == nil {
+				t.Fatalf("%s: the last line %q: %v", name, lines[len(lines)-1], err)
+			}
+			if c.heads == none {
+				if len(sa.Seats) != 0 || len(sa.Left) != 0 {
+					t.Errorf("%s: %+v, want an empty list", name, sa)
+				}
+				continue
+			}
+			want := `{"description":"kept","events":[{"name":"ended"}],"format":1,"scope":"node","seat":"node-build-x","verbs":[{"name":"current"},{"name":"own"}]}`
+			if len(sa.Seats) != 1 || string(sa.Seats[0]) != want || len(sa.Left) != 1 || !strings.Contains(sa.Left[0].Why, `not "broken" and "nowhere"`) {
+				t.Errorf("%s: seats %s, left %+v; want %s and broken left out", name, sa.Seats, sa.Left, want)
+			}
+			continue
+		}
 		var a rules.Answer
 		if err := json.Unmarshal([]byte(lines[len(lines)-1]), &a); err != nil || a.V != rules.AnswerVersion {
 			t.Fatalf("%s: the last line %q: %v", name, lines[len(lines)-1], err)
diff --git a/modules/mesh-delivery-checker/rules/seats.go b/modules/mesh-delivery-checker/rules/seats.go
new file mode 100644
index 00000000..1ef80fcd
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/seats.go
@@ -0,0 +1,142 @@
+package rules
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"maps"
+	"path"
+	"slices"
+	"strings"
+)
+
+// The seat list a check makes from its heads (novox/hq ADR 0636 §4, ADR 0644 §1; the lead's ruling Q2 on milestone
+// 47/B0): the checking program built from the heads reads the seat definitions they carry and answers them resolved, so
+// the running checker hands the manifest validator and the composer bytes it does not read itself.
+
+// SeatsVersion is the version of SeatsAnswer this program writes.
+const SeatsVersion = 1
+
+// SeatsAnswer is the checking program's `-seats` answer: every seat definition the heads carry, resolved (the verbs and
+// events of the parts it includes put first, as the indexer keeps it), as the requests' field `seats` carries them; and
+// each definition left out, with why.
+type SeatsAnswer struct {
+	V     int               `json:"v"`
+	Seats []json.RawMessage `json:"seats"`
+	Left  []LeftOut         `json:"left,omitempty"`
+}
+
+// LeftOut is a seat definition the list does not hold: its file and why.
+type LeftOut struct {
+	Path string `json:"path"`
+	Why  string `json:"why"`
+}
+
+// SeatsOf reads the seat definitions in heads, a directory holding each head at its repository's path: a definition is a
+// contracts module's `seats/<seat>/seat.json`, with the parts it includes from the `parts/<part>.json` beside that
+// `seats` directory (design 26, *A seat's definition*). A file that is not a definition, a part it names that is not
+// there, and a seat defined in more than one place are left out, said; heads with no definition give an empty list.
+func SeatsOf(heads fs.FS) (SeatsAnswer, error) {
+	out := SeatsAnswer{V: SeatsVersion, Seats: []json.RawMessage{}}
+	var files []string
+	err := fs.WalkDir(heads, ".", func(p string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() && (d.Name() == ".git" || d.Name() == "testdata") {
+			return fs.SkipDir
+		}
+		if !d.IsDir() && d.Name() == "seat.json" && path.Base(path.Dir(path.Dir(p))) == "seats" {
+			files = append(files, p)
+		}
+		return nil
+	})
+	if err != nil {
+		return SeatsAnswer{}, fmt.Errorf("rules: the heads cannot be read: %w", err)
+	}
+	type found struct {
+		path string
+		raw  json.RawMessage
+	}
+	bySeat := map[string][]found{}
+	for _, p := range files {
+		raw, err := resolvedDefinition(heads, p)
+		if err != nil {
+			out.Left = append(out.Left, LeftOut{Path: p, Why: err.Error()})
+			continue
+		}
+		var d definitionHead
+		_ = json.Unmarshal(raw, &d)
+		bySeat[d.Seat] = append(bySeat[d.Seat], found{p, raw})
+	}
+	for _, seat := range slices.Sorted(maps.Keys(bySeat)) {
+		fs := bySeat[seat]
+		if len(fs) > 1 {
+			var paths []string
+			for _, f := range fs {
+				paths = append(paths, f.path)
+			}
+			for _, f := range fs {
+				out.Left = append(out.Left, LeftOut{Path: f.path, Why: "the seat " + seat + " is defined in more than one place: " + strings.Join(paths, ", ")})
+			}
+			continue
+		}
+		out.Seats = append(out.Seats, fs[0].raw)
+	}
+	return out, nil
+}
+
+// definitionHead is what of a definition the list is made by: its seat, its scope and the parts it includes. The rest is
+// carried as written, for the manifest validator and the composer to read (milestone G gives this the domain SDK's one
+// reading).
+type definitionHead struct {
+	Seat     string   `json:"seat"`
+	Scope    string   `json:"scope"`
+	Includes []string `json:"includes"`
+}
+
+// resolvedDefinition is the definition at p with its parts' verbs and events put first and no includes, every field it
+// carries kept as written.
+func resolvedDefinition(heads fs.FS, p string) (json.RawMessage, error) {
+	raw, err := fs.ReadFile(heads, p)
+	if err != nil {
+		return nil, err
+	}
+	var d definitionHead
+	if err := json.Unmarshal(raw, &d); err != nil {
+		return nil, fmt.Errorf("a seat definition is not JSON: %w", err)
+	}
+	if d.Seat == "" || (d.Scope != "mesh" && d.Scope != "node") {
+		return nil, fmt.Errorf("a seat definition names its seat and its scope (mesh or node), not %q and %q", d.Seat, d.Scope)
+	}
+	var whole map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &whole); err != nil {
+		return nil, err
+	}
+	var verbs, events []json.RawMessage
+	partsDir := path.Join(path.Dir(path.Dir(path.Dir(p))), "parts")
+	for _, name := range d.Includes {
+		praw, err := fs.ReadFile(heads, path.Join(partsDir, name+".json"))
+		if err != nil {
+			return nil, fmt.Errorf("the seat %s includes the part %q, which is not at %s", d.Seat, name, partsDir)
+		}
+		var part struct{ Verbs, Events []json.RawMessage }
+		if err := json.Unmarshal(praw, &part); err != nil {
+			return nil, fmt.Errorf("the part %q of the seat %s is not JSON: %w", name, d.Seat, err)
+		}
+		verbs, events = append(verbs, part.Verbs...), append(events, part.Events...)
+	}
+	var own struct{ Verbs, Events []json.RawMessage }
+	_ = json.Unmarshal(raw, &own)
+	verbs, events = append(verbs, own.Verbs...), append(events, own.Events...)
+	delete(whole, "includes")
+	for k, list := range map[string][]json.RawMessage{"verbs": verbs, "events": events} {
+		if len(list) == 0 {
+			delete(whole, k)
+			continue
+		}
+		b, _ := json.Marshal(list)
+		whole[k] = b
+	}
+	return json.Marshal(whole)
+}

From 043e3fb97959943b7d349b247a0606785fe0dde3 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:39:31 +0100
Subject: [PATCH 07/17] Read seat definitions once: the indexer's reading
 becomes a module the checker requires (issue 1921)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The checking program's seat list parsed the definition format a second time beside the
indexer's judge. The indexer's reading moves whole into its own sibling module seatfiles
(a domain path, as takein), with ResolveRaw keeping every field as written for a request's
seats; the judge and the take-in read through it, and the checker's rules only find the
definitions and say why one is left out (the lead's ruling on D3, ADR 0634 §1).

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 modules/mesh-delivery-checker/go.mod          |   4 +
 modules/mesh-delivery-checker/rules/seats.go  |  68 ++-----
 modules/mesh-delivery-indexer/go.mod          |   3 +
 .../internal/index/seatsof.go                 |  19 +-
 modules/mesh-delivery-indexer/judge/judge.go  |   3 +-
 .../mesh-delivery-indexer/judge/judge_test.go |   5 +-
 .../mesh-delivery-indexer/judge/seatfiles.go  | 126 +-----------
 .../mesh-delivery-indexer/seatfiles/go.mod    |   5 +
 .../mesh-delivery-indexer/seatfiles/go.sum    |   2 +
 .../seatfiles/seatfiles.go                    | 181 ++++++++++++++++++
 10 files changed, 228 insertions(+), 188 deletions(-)
 create mode 100644 modules/mesh-delivery-indexer/seatfiles/go.mod
 create mode 100644 modules/mesh-delivery-indexer/seatfiles/go.sum
 create mode 100644 modules/mesh-delivery-indexer/seatfiles/seatfiles.go

diff --git a/modules/mesh-delivery-checker/go.mod b/modules/mesh-delivery-checker/go.mod
index 8c2c7fe6..bbda335b 100644
--- a/modules/mesh-delivery-checker/go.mod
+++ b/modules/mesh-delivery-checker/go.mod
@@ -29,3 +29,7 @@ replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun
 require git.novox.be/novox/mesh-delivery/sdk v0.0.0-00010101000000-000000000000
 
 replace git.novox.be/novox/mesh-delivery/sdk => ../../sdk
+
+require git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles v0.0.0-00010101000000-000000000000
+
+replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles => ../mesh-delivery-indexer/seatfiles
diff --git a/modules/mesh-delivery-checker/rules/seats.go b/modules/mesh-delivery-checker/rules/seats.go
index 1ef80fcd..fda5aa3f 100644
--- a/modules/mesh-delivery-checker/rules/seats.go
+++ b/modules/mesh-delivery-checker/rules/seats.go
@@ -8,11 +8,15 @@ import (
 	"path"
 	"slices"
 	"strings"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles"
 )
 
 // The seat list a check makes from its heads (novox/hq ADR 0636 §4, ADR 0644 §1; the lead's ruling Q2 on milestone
 // 47/B0): the checking program built from the heads reads the seat definitions they carry and answers them resolved, so
-// the running checker hands the manifest validator and the composer bytes it does not read itself.
+// the running checker hands the manifest validator and the composer bytes it does not read itself. A definition is read
+// by the indexer's one reading of the format (package seatfiles); this file finds the definitions and says why one is
+// left out.
 
 // SeatsVersion is the version of SeatsAnswer this program writes.
 const SeatsVersion = 1
@@ -60,14 +64,12 @@ func SeatsOf(heads fs.FS) (SeatsAnswer, error) {
 	}
 	bySeat := map[string][]found{}
 	for _, p := range files {
-		raw, err := resolvedDefinition(heads, p)
+		seat, raw, err := resolvedDefinition(heads, p)
 		if err != nil {
 			out.Left = append(out.Left, LeftOut{Path: p, Why: err.Error()})
 			continue
 		}
-		var d definitionHead
-		_ = json.Unmarshal(raw, &d)
-		bySeat[d.Seat] = append(bySeat[d.Seat], found{p, raw})
+		bySeat[seat] = append(bySeat[seat], found{p, raw})
 	}
 	for _, seat := range slices.Sorted(maps.Keys(bySeat)) {
 		fs := bySeat[seat]
@@ -86,57 +88,21 @@ func SeatsOf(heads fs.FS) (SeatsAnswer, error) {
 	return out, nil
 }
 
-// definitionHead is what of a definition the list is made by: its seat, its scope and the parts it includes. The rest is
-// carried as written, for the manifest validator and the composer to read (milestone G gives this the domain SDK's one
-// reading).
-type definitionHead struct {
-	Seat     string   `json:"seat"`
-	Scope    string   `json:"scope"`
-	Includes []string `json:"includes"`
-}
-
-// resolvedDefinition is the definition at p with its parts' verbs and events put first and no includes, every field it
-// carries kept as written.
-func resolvedDefinition(heads fs.FS, p string) (json.RawMessage, error) {
+// resolvedDefinition is the definition at p resolved with the parts it includes from the `parts` directory beside its
+// `seats` directory, as the indexer's one reading of the format resolves it (seatfiles.ResolveRaw), every field kept as
+// written.
+func resolvedDefinition(heads fs.FS, p string) (string, json.RawMessage, error) {
 	raw, err := fs.ReadFile(heads, p)
 	if err != nil {
-		return nil, err
+		return "", nil, err
 	}
-	var d definitionHead
-	if err := json.Unmarshal(raw, &d); err != nil {
-		return nil, fmt.Errorf("a seat definition is not JSON: %w", err)
-	}
-	if d.Seat == "" || (d.Scope != "mesh" && d.Scope != "node") {
-		return nil, fmt.Errorf("a seat definition names its seat and its scope (mesh or node), not %q and %q", d.Seat, d.Scope)
-	}
-	var whole map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &whole); err != nil {
-		return nil, err
-	}
-	var verbs, events []json.RawMessage
 	partsDir := path.Join(path.Dir(path.Dir(path.Dir(p))), "parts")
-	for _, name := range d.Includes {
+	d, out, err := seatfiles.ResolveRaw(raw, func(name string) ([]byte, error) {
 		praw, err := fs.ReadFile(heads, path.Join(partsDir, name+".json"))
 		if err != nil {
-			return nil, fmt.Errorf("the seat %s includes the part %q, which is not at %s", d.Seat, name, partsDir)
+			return nil, fmt.Errorf("it is not at %s", partsDir)
 		}
-		var part struct{ Verbs, Events []json.RawMessage }
-		if err := json.Unmarshal(praw, &part); err != nil {
-			return nil, fmt.Errorf("the part %q of the seat %s is not JSON: %w", name, d.Seat, err)
-		}
-		verbs, events = append(verbs, part.Verbs...), append(events, part.Events...)
-	}
-	var own struct{ Verbs, Events []json.RawMessage }
-	_ = json.Unmarshal(raw, &own)
-	verbs, events = append(verbs, own.Verbs...), append(events, own.Events...)
-	delete(whole, "includes")
-	for k, list := range map[string][]json.RawMessage{"verbs": verbs, "events": events} {
-		if len(list) == 0 {
-			delete(whole, k)
-			continue
-		}
-		b, _ := json.Marshal(list)
-		whole[k] = b
-	}
-	return json.Marshal(whole)
+		return praw, nil
+	})
+	return d.Seat, out, err
 }
diff --git a/modules/mesh-delivery-indexer/go.mod b/modules/mesh-delivery-indexer/go.mod
index 0f4eee43..35f43f26 100644
--- a/modules/mesh-delivery-indexer/go.mod
+++ b/modules/mesh-delivery-indexer/go.mod
@@ -26,6 +26,7 @@ replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun
 
 require (
 	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-forge-bridge/forgemsg v0.0.0-00010101000000-000000000000
+	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles v0.0.0-00010101000000-000000000000
 	git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/takein v0.0.0-00010101000000-000000000000
 	git.novox.be/novox/mesh-delivery/sdk v0.0.0-00010101000000-000000000000
 )
@@ -34,4 +35,6 @@ replace git.novox.be/novox/mesh-delivery/sdk => ../../sdk
 
 replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/takein => ./takein
 
+replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles => ./seatfiles
+
 replace git.novox.be/novox/mesh-delivery/modules/mesh-delivery-forge-bridge/forgemsg => ../mesh-delivery-forge-bridge/forgemsg
diff --git a/modules/mesh-delivery-indexer/internal/index/seatsof.go b/modules/mesh-delivery-indexer/internal/index/seatsof.go
index 526e6e3b..78a2fb4a 100644
--- a/modules/mesh-delivery-indexer/internal/index/seatsof.go
+++ b/modules/mesh-delivery-indexer/internal/index/seatsof.go
@@ -18,9 +18,8 @@ import (
 	"slices"
 	"strings"
 
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-
-	"mesh-delivery-indexer/judge"
 )
 
 // definitionsDir is the directory of a contracts module's definitions that the module.json at dir names, from the first
@@ -58,7 +57,7 @@ func (ix *Indexer) revisionSeats(ctx context.Context, ready []PendingEntry) ([]c
 	if ix.ReadFile == nil || ix.Files == nil {
 		return nil, nil
 	}
-	var defs []judge.Definition
+	var defs []seatfiles.Definition
 	for _, e := range ready {
 		if e.Covered || e.Forge.Merge == "" {
 			continue
@@ -75,7 +74,7 @@ func (ix *Indexer) revisionSeats(ctx context.Context, ready []PendingEntry) ([]c
 			defs = append(defs, got...)
 		}
 	}
-	seats, err := judge.Seats(defs)
+	seats, err := seatfiles.Seats(defs)
 	if err != nil {
 		return nil, err
 	}
@@ -84,7 +83,7 @@ func (ix *Indexer) revisionSeats(ctx context.Context, ready []PendingEntry) ([]c
 
 // readDefinitions reads the definitions under a contracts module's definitions directory at a commit, resolved with their
 // parts.
-func (ix *Indexer) readDefinitions(ctx context.Context, repository, commit, defsDir string) ([]judge.Definition, error) {
+func (ix *Indexer) readDefinitions(ctx context.Context, repository, commit, defsDir string) ([]seatfiles.Definition, error) {
 	file := func(p string) ([]byte, error) {
 		if defsDir != "." && defsDir != "" {
 			p = defsDir + "/" + p
@@ -103,8 +102,8 @@ func (ix *Indexer) readDefinitions(ctx context.Context, repository, commit, defs
 	if err != nil {
 		return nil, fmt.Errorf("listing %s of %s at %.12s: %w", dir, repository, commit, err)
 	}
-	parts := map[string]judge.Part{}
-	var out []judge.Definition
+	parts := map[string]seatfiles.Part{}
+	var out []seatfiles.Definition
 	for _, p := range slices.Sorted(maps.Keys(listed[dir])) {
 		seat, ok := strings.CutSuffix(p, "/seat.json")
 		if !ok || seat == "" || strings.Contains(seat, "/") {
@@ -114,7 +113,7 @@ func (ix *Indexer) readDefinitions(ctx context.Context, repository, commit, defs
 		if err != nil {
 			return nil, err
 		}
-		d, err := judge.ParseDefinition(raw)
+		d, err := seatfiles.ParseDefinition(raw)
 		if err == nil && d.Seat != seat {
 			err = fmt.Errorf("it names the seat %q, not %q", d.Seat, seat)
 		}
@@ -129,11 +128,11 @@ func (ix *Indexer) readDefinitions(ctx context.Context, repository, commit, defs
 			if perr != nil {
 				return nil, perr
 			}
-			var part judge.Part
+			var part seatfiles.Part
 			if praw == nil {
 				perr = errors.New("the commit holds no such part")
 			} else {
-				part, perr = judge.ParsePart(praw)
+				part, perr = seatfiles.ParsePart(praw)
 			}
 			if perr != nil {
 				err = fmt.Errorf("its part %s: %w", name, perr)
diff --git a/modules/mesh-delivery-indexer/judge/judge.go b/modules/mesh-delivery-indexer/judge/judge.go
index c144cf02..9f39b3ae 100644
--- a/modules/mesh-delivery-indexer/judge/judge.go
+++ b/modules/mesh-delivery-indexer/judge/judge.go
@@ -25,6 +25,7 @@ import (
 	"strings"
 	"sync"
 
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/composer"
 )
@@ -212,7 +213,7 @@ func Request(r composer.Request) (composer.Verdict, error) { return RequestWith(
 // the members' heads' definitions, so a manifest that serves or invokes what the group's definitions add is judged by
 // them. None is Request.
 func RequestWith(r composer.Request, seats [][]byte) (composer.Verdict, error) {
-	over, err := SeatsOfFiles(seats)
+	over, err := seatfiles.SeatsOfFiles(seats)
 	if err != nil {
 		return composer.Verdict{}, fmt.Errorf("a seat definition of the request: %w", err)
 	}
diff --git a/modules/mesh-delivery-indexer/judge/judge_test.go b/modules/mesh-delivery-indexer/judge/judge_test.go
index b57cfe4d..629fbcce 100644
--- a/modules/mesh-delivery-indexer/judge/judge_test.go
+++ b/modules/mesh-delivery-indexer/judge/judge_test.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/overlay"
@@ -155,8 +156,8 @@ func TestTheJudge(t *testing.T) {
 			t.Fatalf("%s: the seats are not put back", row.name)
 		}
 	}
-	parts := map[string]Part{"reads": {Verbs: []DefVerb{{Name: "manifest-reads"}}}}
-	d, _ := ParseDefinition(defs[0])
+	parts := map[string]seatfiles.Part{"reads": {Verbs: []seatfiles.DefVerb{{Name: "manifest-reads"}}}}
+	d, _ := seatfiles.ParseDefinition(defs[0])
 	if d, err := d.Resolve(parts); err != nil || len(d.Verbs) != 2 || d.Verbs[0].Name != "manifest-reads" {
 		t.Errorf("a resolved definition: %+v %v", d, err)
 	}
diff --git a/modules/mesh-delivery-indexer/judge/seatfiles.go b/modules/mesh-delivery-indexer/judge/seatfiles.go
index 384baace..b1921955 100644
--- a/modules/mesh-delivery-indexer/judge/seatfiles.go
+++ b/modules/mesh-delivery-indexer/judge/seatfiles.go
@@ -1,137 +1,15 @@
 package judge
 
-// The seat definitions a revision carries (novox/hq ADR 0633 §1, §6; ADR 0635, ADR 0636 §4): a manifest is judged
-// against the seats of the revision it belongs to, never against the list this program was built with. A definition is
-// the contracts module's `seats/<seat>/seat.json` (design 26 *A seat's definition*), with the parts it includes from
-// `parts/<part>.json`. This reader takes of it only what a manifest is judged by (the seat's scope, what it delivers,
-// its verbs and events) and reads the rest leniently: the format's one strict reader (mesh-sdk seatdef) is not in the
-// mesh-sdk this judge is built with, and the indexer of the revision keeps the definitions whole.
+// The seat list a judge pass judges with: the seats a request or a revision carries (read by the indexer's one reading,
+// package seatfiles) put over the catalogue's list for that pass.
 
 import (
-	"encoding/json"
-	"fmt"
 	"slices"
 	"sync"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
-// Definition is the part of one seat's definition a manifest is judged by.
-type Definition struct {
-	Format          int       `json:"format"`
-	Seat            string    `json:"seat"`
-	Scope           string    `json:"scope"`
-	Decision        string    `json:"decision"`
-	HolderDeclares  bool      `json:"holder-declares"`
-	Delivers        string    `json:"delivers"`
-	Replicated      bool      `json:"replicated"`
-	PulledByKind    bool      `json:"pulled-by-kind"`
-	Yields          bool      `json:"yields"`
-	HeldByTheEngine bool      `json:"held-by-the-engine"`
-	Includes        []string  `json:"includes"`
-	Verbs           []DefVerb `json:"verbs"`
-	Accepts         []DefName `json:"accepts"`
-	Events          []DefName `json:"events"`
-}
-
-// DefVerb is a verb of a definition.
-type DefVerb struct {
-	Name        string   `json:"name"`
-	Description string   `json:"description"`
-	Optional    bool     `json:"optional"`
-	Replaces    []string `json:"replaces"`
-}
-
-// DefName is an accepted message or an event of a definition.
-type DefName struct {
-	Name string `json:"name"`
-}
-
-// Part is a part a definition includes: verbs and events written once for the seats that share them.
-type Part struct {
-	Part   string    `json:"part"`
-	Verbs  []DefVerb `json:"verbs"`
-	Events []DefName `json:"events"`
-}
-
-// ParseDefinition reads one definition; a file that is not one names a seat and a scope.
-func ParseDefinition(raw []byte) (Definition, error) {
-	var d Definition
-	if err := json.Unmarshal(raw, &d); err != nil {
-		return Definition{}, fmt.Errorf("a seat definition is not JSON: %w", err)
-	}
-	if d.Seat == "" || (d.Scope != catalogue.ScopeMesh && d.Scope != catalogue.ScopeNode) {
-		return Definition{}, fmt.Errorf("a seat definition names its seat and its scope (mesh or node), not %q and %q", d.Seat, d.Scope)
-	}
-	return d, nil
-}
-
-// ParsePart reads one part.
-func ParsePart(raw []byte) (Part, error) {
-	var p Part
-	if err := json.Unmarshal(raw, &p); err != nil {
-		return Part{}, fmt.Errorf("a part of a seat definition is not JSON: %w", err)
-	}
-	return p, nil
-}
-
-// Resolve is the definition with the verbs and events of the parts it includes put first, as the indexer keeps it.
-func (d Definition) Resolve(parts map[string]Part) (Definition, error) {
-	out := d
-	out.Includes, out.Verbs, out.Events = nil, nil, nil
-	for _, name := range d.Includes {
-		p, ok := parts[name]
-		if !ok {
-			return Definition{}, fmt.Errorf("the seat %s includes the part %q, which is not given", d.Seat, name)
-		}
-		out.Verbs = append(out.Verbs, p.Verbs...)
-		out.Events = append(out.Events, p.Events...)
-	}
-	out.Verbs = append(out.Verbs, d.Verbs...)
-	out.Events = append(out.Events, d.Events...)
-	return out, nil
-}
-
-// Seats are the seats of resolved definitions, in the catalogue's types; a seat its holder declares itself is left out.
-// A definition still naming parts it includes is refused: resolve it first.
-func Seats(defs []Definition) ([]catalogue.Seat, error) {
-	var out []catalogue.Seat
-	for _, d := range defs {
-		if d.HolderDeclares {
-			continue
-		}
-		if len(d.Includes) > 0 {
-			return nil, fmt.Errorf("the seat %s names parts it includes: resolve it first", d.Seat)
-		}
-		s := catalogue.Seat{Name: d.Seat, Scope: d.Scope, Delivers: d.Delivers, Replicated: d.Replicated,
-			PulledByKind: d.PulledByKind, Yields: d.Yields, HeldByTheEngine: d.HeldByTheEngine, Decision: d.Decision}
-		for _, a := range d.Accepts {
-			s.Accepts = append(s.Accepts, a.Name)
-		}
-		for _, e := range d.Events {
-			s.Emits = append(s.Emits, e.Name)
-		}
-		for _, v := range d.Verbs {
-			s.Serves = append(s.Serves, catalogue.Verb{Name: v.Name, Description: v.Description, Optional: v.Optional, Replaces: v.Replaces})
-		}
-		out = append(out, s)
-	}
-	return out, nil
-}
-
-// SeatsOfFiles are the seats of resolved definitions given as files, as a request carries them.
-func SeatsOfFiles(raws [][]byte) ([]catalogue.Seat, error) {
-	defs := make([]Definition, 0, len(raws))
-	for _, raw := range raws {
-		d, err := ParseDefinition(raw)
-		if err != nil {
-			return nil, err
-		}
-		defs = append(defs, d)
-	}
-	return Seats(defs)
-}
-
 // merged is base with each seat of over put in place of the seat of its name, or added: a definition is a seat's whole
 // contract. A verb the base seat holds keeps its input and output (a definition read here carries none).
 func merged(base, over []catalogue.Seat) []catalogue.Seat {
diff --git a/modules/mesh-delivery-indexer/seatfiles/go.mod b/modules/mesh-delivery-indexer/seatfiles/go.mod
new file mode 100644
index 00000000..4fc2f656
--- /dev/null
+++ b/modules/mesh-delivery-indexer/seatfiles/go.mod
@@ -0,0 +1,5 @@
+module git.novox.be/novox/mesh-delivery/modules/mesh-delivery-indexer/seatfiles
+
+go 1.26.0
+
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104002338-5a38a1221659
diff --git a/modules/mesh-delivery-indexer/seatfiles/go.sum b/modules/mesh-delivery-indexer/seatfiles/go.sum
new file mode 100644
index 00000000..60d9d4a6
--- /dev/null
+++ b/modules/mesh-delivery-indexer/seatfiles/go.sum
@@ -0,0 +1,2 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104002338-5a38a1221659 h1:tK7MzxVm/ECNg1Yblhh1ynVEthbZCg2mSPW0wQZC0b0=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261104002338-5a38a1221659/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
diff --git a/modules/mesh-delivery-indexer/seatfiles/seatfiles.go b/modules/mesh-delivery-indexer/seatfiles/seatfiles.go
new file mode 100644
index 00000000..f28adb67
--- /dev/null
+++ b/modules/mesh-delivery-indexer/seatfiles/seatfiles.go
@@ -0,0 +1,181 @@
+// Package seatfiles is the indexer's one reading of the seat definitions a revision carries (novox/hq ADR 0633 §1, §6;
+// ADR 0635, ADR 0636 §4): a manifest is judged against the seats of the revision it belongs to, never against the list
+// the judge was built with. A definition is the contracts module's `seats/<seat>/seat.json` (design 26 *A seat's
+// definition*), with the parts it includes from `parts/<part>.json`. This reader takes of it only what a manifest is
+// judged by (the seat's scope, what it delivers, its verbs and events) and reads the rest leniently: the format's one
+// strict reader (mesh-sdk seatdef) is not in the mesh-sdk the judge is built with, and the indexer of the revision keeps
+// the definitions whole.
+//
+// It is the indexer's own package, a module of its own so that the checker's rules can require it (the lead's ruling on
+// milestone 47/B0, ADR 0634 §1: shared code lives with its owner): the indexer's judge and the checker's seat list read
+// definitions here and nowhere else. Milestone G's domain SDK reading replaces it.
+package seatfiles
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Definition is the part of one seat's definition a manifest is judged by.
+type Definition struct {
+	Format          int       `json:"format"`
+	Seat            string    `json:"seat"`
+	Scope           string    `json:"scope"`
+	Decision        string    `json:"decision"`
+	HolderDeclares  bool      `json:"holder-declares"`
+	Delivers        string    `json:"delivers"`
+	Replicated      bool      `json:"replicated"`
+	PulledByKind    bool      `json:"pulled-by-kind"`
+	Yields          bool      `json:"yields"`
+	HeldByTheEngine bool      `json:"held-by-the-engine"`
+	Includes        []string  `json:"includes"`
+	Verbs           []DefVerb `json:"verbs"`
+	Accepts         []DefName `json:"accepts"`
+	Events          []DefName `json:"events"`
+}
+
+// DefVerb is a verb of a definition.
+type DefVerb struct {
+	Name        string   `json:"name"`
+	Description string   `json:"description"`
+	Optional    bool     `json:"optional"`
+	Replaces    []string `json:"replaces"`
+}
+
+// DefName is an accepted message or an event of a definition.
+type DefName struct {
+	Name string `json:"name"`
+}
+
+// Part is a part a definition includes: verbs and events written once for the seats that share them.
+type Part struct {
+	Part   string    `json:"part"`
+	Verbs  []DefVerb `json:"verbs"`
+	Events []DefName `json:"events"`
+}
+
+// ParseDefinition reads one definition; a file that is not one names a seat and a scope.
+func ParseDefinition(raw []byte) (Definition, error) {
+	var d Definition
+	if err := json.Unmarshal(raw, &d); err != nil {
+		return Definition{}, fmt.Errorf("a seat definition is not JSON: %w", err)
+	}
+	if d.Seat == "" || (d.Scope != catalogue.ScopeMesh && d.Scope != catalogue.ScopeNode) {
+		return Definition{}, fmt.Errorf("a seat definition names its seat and its scope (mesh or node), not %q and %q", d.Seat, d.Scope)
+	}
+	return d, nil
+}
+
+// ParsePart reads one part.
+func ParsePart(raw []byte) (Part, error) {
+	var p Part
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return Part{}, fmt.Errorf("a part of a seat definition is not JSON: %w", err)
+	}
+	return p, nil
+}
+
+// Resolve is the definition with the verbs and events of the parts it includes put first, as the indexer keeps it.
+func (d Definition) Resolve(parts map[string]Part) (Definition, error) {
+	out := d
+	out.Includes, out.Verbs, out.Events = nil, nil, nil
+	for _, name := range d.Includes {
+		p, ok := parts[name]
+		if !ok {
+			return Definition{}, fmt.Errorf("the seat %s includes the part %q, which is not given", d.Seat, name)
+		}
+		out.Verbs = append(out.Verbs, p.Verbs...)
+		out.Events = append(out.Events, p.Events...)
+	}
+	out.Verbs = append(out.Verbs, d.Verbs...)
+	out.Events = append(out.Events, d.Events...)
+	return out, nil
+}
+
+// Seats are the seats of resolved definitions, in the catalogue's types; a seat its holder declares itself is left out.
+// A definition still naming parts it includes is refused: resolve it first.
+func Seats(defs []Definition) ([]catalogue.Seat, error) {
+	var out []catalogue.Seat
+	for _, d := range defs {
+		if d.HolderDeclares {
+			continue
+		}
+		if len(d.Includes) > 0 {
+			return nil, fmt.Errorf("the seat %s names parts it includes: resolve it first", d.Seat)
+		}
+		s := catalogue.Seat{Name: d.Seat, Scope: d.Scope, Delivers: d.Delivers, Replicated: d.Replicated,
+			PulledByKind: d.PulledByKind, Yields: d.Yields, HeldByTheEngine: d.HeldByTheEngine, Decision: d.Decision}
+		for _, a := range d.Accepts {
+			s.Accepts = append(s.Accepts, a.Name)
+		}
+		for _, e := range d.Events {
+			s.Emits = append(s.Emits, e.Name)
+		}
+		for _, v := range d.Verbs {
+			s.Serves = append(s.Serves, catalogue.Verb{Name: v.Name, Description: v.Description, Optional: v.Optional, Replaces: v.Replaces})
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// SeatsOfFiles are the seats of resolved definitions given as files, as a request carries them.
+func SeatsOfFiles(raws [][]byte) ([]catalogue.Seat, error) {
+	defs := make([]Definition, 0, len(raws))
+	for _, raw := range raws {
+		d, err := ParseDefinition(raw)
+		if err != nil {
+			return nil, err
+		}
+		defs = append(defs, d)
+	}
+	return Seats(defs)
+}
+
+// ResolveRaw is the definition raw resolved with the parts it includes, each read by part, every field it carries kept as
+// written: the verbs and events of its parts put first, then its own, and no includes. It reads raw and every part as
+// ParseDefinition and ParsePart do, and answers the definition read with it. It is how a request's `seats` carry a
+// definition whole (ADR 0636 §4).
+func ResolveRaw(raw []byte, part func(name string) ([]byte, error)) (Definition, json.RawMessage, error) {
+	d, err := ParseDefinition(raw)
+	if err != nil {
+		return Definition{}, nil, err
+	}
+	var whole map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &whole); err != nil {
+		return Definition{}, nil, err
+	}
+	type listed struct{ Verbs, Events []json.RawMessage }
+	var verbs, events []json.RawMessage
+	for _, name := range d.Includes {
+		praw, err := part(name)
+		if err != nil {
+			return Definition{}, nil, fmt.Errorf("the seat %s includes the part %q: %w", d.Seat, name, err)
+		}
+		var l listed
+		if _, err := ParsePart(praw); err != nil {
+			return Definition{}, nil, fmt.Errorf("the part %q of the seat %s: %w", name, d.Seat, err)
+		}
+		_ = json.Unmarshal(praw, &l)
+		verbs, events = append(verbs, l.Verbs...), append(events, l.Events...)
+	}
+	var own listed
+	_ = json.Unmarshal(raw, &own)
+	verbs, events = append(verbs, own.Verbs...), append(events, own.Events...)
+	delete(whole, "includes")
+	for k, list := range map[string][]json.RawMessage{"verbs": verbs, "events": events} {
+		if len(list) == 0 {
+			delete(whole, k)
+			continue
+		}
+		b, err := json.Marshal(list)
+		if err != nil {
+			return Definition{}, nil, err
+		}
+		whole[k] = b
+	}
+	out, err := json.Marshal(whole)
+	return d, out, err
+}

From 63bbabacbf4be923b2dce93b586123cc092b5916 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 22:58:15 +0100
Subject: [PATCH 08/17] Every check is judged by the checking program built
 from its heads (issue 1921)

The running checker asks the checking program twice on the build seat's job run: first the
heads' seat list, which the manifest validator's requests (change and trunk) and the
node-engine composer's carry; then the verdict of the facts it gathered. The program is built
at the group's mesh-delivery head, else at mesh-delivery's trunk, and its input is kept in the
checker's new state inputs as the exact bytes of its digest, read with checker_inputs. A run
ask no build node begins within 5 minutes is put once more, then fails the check naming the
job; a program that does not build or answer fails the check naming it, and the verdict
records who judged it (JudgedBy). A second step-seen hook on a context is added to the
first, so a try still sees its steps.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../mesh-delivery-builder/buildrun/asks.go    |   7 +-
 .../buildrun/asks_test.go                     |  11 +-
 .../cmd/mesh-checking-program/main.go         |  67 ++----
 .../cmd/mesh-delivery-checker-tools/main.go   |  17 +-
 .../mesh-delivery-checker-tools/main_test.go  |   2 +-
 .../cmd/mesh-delivery-checker/bus.go          |  12 +
 .../cmd/mesh-delivery-checker/judge.go        |   4 +-
 .../cmd/mesh-delivery-checker/kept_test.go    |   3 +-
 .../cmd/mesh-delivery-checker/main.go         |   6 +-
 .../internal/check/case.go                    |   4 +
 .../internal/check/engines.go                 |   2 +-
 .../internal/check/engines_test.go            |   4 +-
 .../internal/check/examiner_test.go           | 158 ++++++++++++-
 .../internal/check/fakes_test.go              |  11 +
 .../internal/check/judge.go                   |  14 +-
 .../internal/check/lostask_test.go            |   4 +-
 .../internal/check/manifests_judge.go         |   2 +
 .../internal/check/programs.go                | 223 ++++++++++++++++++
 .../internal/check/read.go                    |  38 +++
 .../internal/check/read_test.go               |  15 ++
 .../internal/check/try_test.go                |   3 +-
 .../mesh-delivery-checker/manifest_test.go    |   5 +-
 modules/mesh-delivery-checker/module.json     |   2 +
 .../mesh-delivery-checker/rules/program.go    |  46 ++++
 24 files changed, 588 insertions(+), 72 deletions(-)
 create mode 100644 modules/mesh-delivery-checker/internal/check/programs.go
 create mode 100644 modules/mesh-delivery-checker/rules/program.go

diff --git a/modules/mesh-delivery-builder/buildrun/asks.go b/modules/mesh-delivery-builder/buildrun/asks.go
index fdaf3057..26e4fd35 100644
--- a/modules/mesh-delivery-builder/buildrun/asks.go
+++ b/modules/mesh-delivery-builder/buildrun/asks.go
@@ -149,8 +149,13 @@ type stepSeenKey struct{}
 
 // WithStepSeen is ctx carrying seen, which Asker.Wait hands every value the ask's step key takes while it waits: the node
 // that took it, each phase it says while running (delivery.Step.Phase), and its end. A try names its asks' progress so
-// (issue 1890). seen runs in the waiting goroutine and must not block.
+// (issue 1890). seen runs in the waiting goroutine and must not block. A seen ctx already carries is kept: both are handed
+// every value, the earlier first (a check's begin bound watches the steps of a try that names them).
 func WithStepSeen(ctx context.Context, seen func(delivery.Step)) context.Context {
+	if before := stepSeenOf(ctx); before != nil {
+		later := seen
+		seen = func(s delivery.Step) { before(s); later(s) }
+	}
 	return context.WithValue(ctx, stepSeenKey{}, seen)
 }
 
diff --git a/modules/mesh-delivery-builder/buildrun/asks_test.go b/modules/mesh-delivery-builder/buildrun/asks_test.go
index ec6b94f9..3011500d 100644
--- a/modules/mesh-delivery-builder/buildrun/asks_test.go
+++ b/modules/mesh-delivery-builder/buildrun/asks_test.go
@@ -26,10 +26,13 @@ func TestAnAskerPutsOnceAndReadsTheStep(t *testing.T) {
 		return delivery.Step{ID: a.ID, Node: "ace", State: delivery.StepPassed, Result: []byte(`{"artifacts":[]}`)}
 	}}
 	k := Asker{Publisher: f, Waiter: f}
-	var seen []delivery.Step // issue 1890: a waiter that asks to see each value of the step sees it
-	step, err := k.Ask(WithStepSeen(context.Background(), func(s delivery.Step) { seen = append(seen, s) }), goAsk("mvl0frv18d1957"))
-	if err != nil || step.Node != "ace" || len(f.Asks()) != 1 || len(seen) != 1 || seen[0].Node != "ace" {
-		t.Fatalf("step %+v, %v, asks %d, seen %+v", step, err, len(f.Asks()), seen)
+	var seen, also []delivery.Step // issue 1890: a waiter that asks to see each value of the step sees it
+	// Issue 1921: a second seen on the same context (a check's begin bound inside a try) is added, never in place of the first.
+	both := WithStepSeen(WithStepSeen(context.Background(), func(s delivery.Step) { seen = append(seen, s) }),
+		func(s delivery.Step) { also = append(also, s) })
+	step, err := k.Ask(both, goAsk("mvl0frv18d1957"))
+	if err != nil || step.Node != "ace" || len(f.Asks()) != 1 || len(seen) != 1 || seen[0].Node != "ace" || len(also) != 1 {
+		t.Fatalf("step %+v, %v, asks %d, seen %+v and %+v", step, err, len(f.Asks()), seen, also)
 	}
 	f.Answer = func(a delivery.StepAsk) delivery.Step {
 		return delivery.Step{ID: a.ID, Node: "shanks", State: delivery.StepRefused, Reason: "go 1.27 installed"}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
index 21279f08..a55d209b 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main.go
@@ -4,16 +4,18 @@
 // verdict the judging rules give them, as one JSON line on its standard output (rules.Answer).
 //
 //	mesh-checking-program -verdict
+//	mesh-checking-program -seats
 //
+// Asked -seats, it answers the seat list of the heads laid in the directory MESH_RUN_HEADS names (rules.SeatsAnswer).
 // It refuses facts of a version it does not read, naming it, with exit 2.
 package main
 
 import (
-	"encoding/json"
-	"flag"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
+	"slices"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"mesh-delivery-checker/rules"
@@ -25,52 +27,25 @@ func main() {
 
 // run is the command over its arguments, environment and outputs, answering its exit.
 func run(args []string, getenv func(string) string, stdout, stderr io.Writer) int {
-	fs := flag.NewFlagSet("mesh-checking-program", flag.ContinueOnError)
-	fs.SetOutput(stderr)
-	verdict := fs.Bool("verdict", false, "answer the verdict of the facts in the input")
-	seats := fs.Bool("seats", false, "answer the seat list of the heads laid for it")
-	if err := fs.Parse(args); err != nil {
+	var heads fs.FS
+	if dir := getenv(delivery.RunHeadsEnv); dir != "" {
+		heads = os.DirFS(dir)
+	}
+	input := func() ([]byte, error) {
+		file := getenv(delivery.RunInputEnv)
+		if file == "" {
+			return nil, fmt.Errorf("%s names no file", delivery.RunInputEnv)
+		}
+		return os.ReadFile(file)
+	}
+	line, err := rules.Program(args, input, heads)
+	if err != nil {
+		if heads == nil && slices.Contains(args, "-seats") {
+			err = fmt.Errorf("no heads: %s names no directory", delivery.RunHeadsEnv)
+		}
+		fmt.Fprintf(stderr, "mesh-checking-program: %v\n", err)
 		return 2
 	}
-	refuse := func(format string, a ...any) int {
-		fmt.Fprintf(stderr, "mesh-checking-program: "+format+"\n", a...)
-		return 2
-	}
-	if *seats {
-		dir := getenv(delivery.RunHeadsEnv)
-		if dir == "" {
-			return refuse("no heads: %s names no directory", delivery.RunHeadsEnv)
-		}
-		answer, err := rules.SeatsOf(os.DirFS(dir))
-		if err != nil {
-			return refuse("%v", err)
-		}
-		line, err := json.Marshal(answer)
-		if err != nil {
-			return refuse("the seat list cannot be written: %v", err)
-		}
-		fmt.Fprintf(stdout, "%s\n", line)
-		return 0
-	}
-	if !*verdict {
-		return refuse("nothing asked: give -verdict or -seats")
-	}
-	file := getenv(delivery.RunInputEnv)
-	if file == "" {
-		return refuse("no input: %s names no file", delivery.RunInputEnv)
-	}
-	data, err := os.ReadFile(file)
-	if err != nil {
-		return refuse("the input cannot be read: %v", err)
-	}
-	facts, err := rules.DecodeFacts(data)
-	if err != nil {
-		return refuse("%v", err)
-	}
-	line, err := json.Marshal(rules.Judged(facts))
-	if err != nil {
-		return refuse("the verdict cannot be written: %v", err)
-	}
 	fmt.Fprintf(stdout, "%s\n", line)
 	return 0
 }
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
index a996d06c..2e29ae40 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
@@ -264,6 +264,17 @@ func Tools(r check.Reader) []stdio.Tool {
 				kept, cut, err := r.Kept(level, digest)
 				return cutAnswer(map[string]any{"kept": kept}, cut), err
 			}},
+		{Name: check.InputsReadTool,
+			Description: "The checking program's inputs the checker keeps, each under the sha256 of its exact bytes (inputs.<digest>, kept a day): " +
+				"the facts of a check its verdict is asked of, or the heads its seat list is asked of. With a digest, that input as kept; " +
+				"without, every digest and its size. Read-only.",
+			Input: map[string]any{"type": "object", "properties": map[string]any{
+				"digest": map[string]any{"type": "string", "description": "the input's sha256, as a run ask names it"}}},
+			Run: func(args map[string]any) (any, error) {
+				digest, _ := args["digest"].(string)
+				inputs, cut, err := r.Inputs(digest)
+				return cutAnswer(map[string]any{"inputs": inputs}, cut), err
+			}},
 		{Name: check.PreviewsReadTool,
 			Description: "The merge previews the checker holds, each as stored under previews.<repository>.<head>.<trunk>: the merge commit, per module directory " +
 				"its tree, manifest digest and lock hashes, or the files in conflict. With a repository, that repository's; with a head (7 or more characters) " +
@@ -325,9 +336,9 @@ func stepBound() time.Duration {
 
 func main() {
 	r := check.Reader{VerdictState: read(stdio.State("verdicts")), KeptState: read(stdio.State("kept")), CandidateState: read(stdio.State("mesh-delivery-indexer.candidates")),
-		PreviewState: read(stdio.State("previews")),
-		StepStates:   map[string]check.StateRead{"mesh-build-go": read(stdio.State("mesh-build-go.steps")), "mesh-build-node": read(stdio.State("mesh-build-node.steps"))},
-		HaveState:    read(stdio.State("node-engine.have")), StepBound: stepBound(),
+		PreviewState: read(stdio.State("previews")), InputState: read(stdio.State(check.InputsStateName)),
+		StepStates: map[string]check.StateRead{"mesh-build-go": read(stdio.State("mesh-build-go.steps")), "mesh-build-node": read(stdio.State("mesh-build-node.steps"))},
+		HaveState:  read(stdio.State("node-engine.have")), StepBound: stepBound(),
 		TurnState: read(stdio.State("mesh-delivery-gate.turns")), HearingState: read(stdio.State(buildrun.HearingState)),
 		AskState: read(stdio.State(check.AsksState)), BuildState: read(stdio.State("mesh-delivery-builder.builds"))}
 	r.Runs = runsOf{read(stdio.State("mesh-delivery-indexer.modules"))} // the node-engine at the commit the mesh runs, as the checker reads it
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
index 08aa1ca0..3ef71945 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
@@ -21,7 +21,7 @@ func TestTheToolsServedAreTheFiveReadTools(t *testing.T) {
 			t.Errorf("%s has no description or no run", tl.Name)
 		}
 	}
-	want := []string{check.VerdictsReadTool, check.PullReadTool, check.KeptReadTool, check.PreviewsReadTool, check.StatusReadTool}
+	want := []string{check.VerdictsReadTool, check.PullReadTool, check.KeptReadTool, check.InputsReadTool, check.PreviewsReadTool, check.StatusReadTool}
 	if !slices.Equal(names, want) {
 		t.Errorf("tools = %v, want %v", names, want)
 	}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go
index 62eccf09..4c3dcd3c 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go
@@ -183,3 +183,15 @@ func (a awaitedKV) Delete(ctx context.Context, key string) error {
 	}
 	return s.Delete(ctx, key)
 }
+
+// runInputs keeps the checking program's inputs in the checker's state inputs (check.InputsBucket), each under the
+// sha256 of its exact bytes: an input already kept under its digest is the same bytes, so a second keep is no error.
+type runInputs struct{ a awaitedKV }
+
+func (r runInputs) Keep(ctx context.Context, digest string, body []byte) error {
+	_, err := r.a.Create(ctx, digest, body)
+	if errors.Is(err, check.ErrConflict) {
+		return nil
+	}
+	return err
+}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
index 72cd4811..863eb35d 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
@@ -24,6 +24,8 @@ import (
 
 // judgeDeps are the parts the judge of a check is made of.
 type judgeDeps struct {
+	// inputs keeps the checking program's inputs (check.InputsState).
+	inputs   check.Inputs
 	asks     check.Asks
 	tools    *buildrun.ToolchainSet
 	trunks   *check.Trunks
@@ -160,7 +162,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	ex := &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Candidates: d.candidates, Modules: d.repos, Packages: d.repos, Published: d.published, Forge: d.forge, Runs: d.repos, Builds: d.builds, BuildEnds: d.ends, BuildWait: d.buildWait, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Read: d.repos, Predefined: d.predefined, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Candidates: d.candidates, Modules: d.repos, Packages: d.repos, Published: d.published, Forge: d.forge, Runs: d.repos, Builds: d.builds, BuildEnds: d.ends, BuildWait: d.buildWait, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Read: d.repos, Predefined: d.predefined, Inputs: d.inputs, Logf: d.logf}
 	if d.nodes != nil && d.builds != nil && d.repos != nil {
 		ex.Serving = runningServes{have: d.nodes, builds: d.builds, read: d.repos, logf: d.logf}
 	}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
index 23f32299..fb84bd24 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
@@ -38,7 +38,8 @@ func TestTheCheckerAnnouncesEveryStateItKeepsAndOwedReadable(t *testing.T) { //
 		t.Errorf("announced %v, the manifest keeps %v", announced, manifest)
 	}
 	// kept is read by the Go build module for a check ask (issue 1887 design limit 1); tries by the delivery view (build_usage).
-	if want := []string{"kept", "owed", "previews", "tries", "verdicts"}; !equal(readable, want) {
+	// inputs by the Go build module, which hands one to the checking program a run ask names (issue 1921).
+	if want := []string{"inputs", "kept", "owed", "previews", "tries", "verdicts"}; !equal(readable, want) {
 		t.Errorf("readable %v, want %v", readable, want)
 	}
 }
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
index 877f3627..8dfe2f28 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
@@ -72,6 +72,9 @@ var keptStates = []announce.State{
 	{Name: "hearing"},
 	// The asks each running check put (check.AsksState): read by the checker's own checker_ask_again alone.
 	{Name: "asks"},
+	// The checking program's inputs by their digest (check.InputsState): read by the Go build module, which hands one to
+	// the program a run ask names (issue 1921).
+	{Name: check.InputsStateName, Readable: true},
 	{Name: "kept", Readable: true},
 	{Name: "owed", Readable: true},
 	{Name: "previews", Readable: true},
@@ -153,6 +156,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	conn.SetReconnectHandler(func(*nats.Conn) { hearing.Again(); heard.Nudge("") })
 	waiter := buildrun.LostAskWaiter{Inner: heard, Dead: dead, Hearing: hearing}
 	asksKV := process.AwaitBucket(ctx, js, conn, check.AsksBucket, "checker_ask_again refuses every check, as it cannot tell whether its ask waits in a stream", logger.Printf)
+	inputsKV := process.AwaitBucket(ctx, js, conn, check.InputsBucket, "no checking program can be asked, so every check fails naming it", logger.Printf)
 	ch := &check.Checker{
 		Asks:     awaitedKV{asksKV},
 		Verdicts: kvStore{buckets[delivery.CheckerVerdictsBucket]},
@@ -226,7 +230,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		asks: buildrun.Asker{Publisher: asks, Waiter: waiter, Bound: stepBound}, tools: tools, trunks: trunks,
 		kept: kvStore{buckets[delivery.CheckerKeptBucket]}, previews: kvStore{buckets[delivery.PreviewsBucket]}, candidates: tryCandidates{buckets[delivery.CandidatesBucket]},
 		repos: repos, published: published, builds: builds, ends: ends, buildWait: set.buildWait, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
-		announce: announce, compositions: compositions,
+		announce: announce, compositions: compositions, inputs: runInputs{awaitedKV{inputsKV}},
 		nodes: openNodeNames(ctx, js, logger.Printf),
 		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
 			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
diff --git a/modules/mesh-delivery-checker/internal/check/case.go b/modules/mesh-delivery-checker/internal/check/case.go
index 050bd601..ba8c72da 100644
--- a/modules/mesh-delivery-checker/internal/check/case.go
+++ b/modules/mesh-delivery-checker/internal/check/case.go
@@ -1,6 +1,7 @@
 package check
 
 import (
+	"encoding/json"
 	"fmt"
 	"maps"
 	"slices"
@@ -39,6 +40,9 @@ type Case struct {
 	Left []string
 	// Queued is when the checker took the case up, for the time of its queue.
 	Queued time.Time
+	// Seats is the heads' seat list the checking program made, which the manifest validator's and the node-engine
+	// composer's requests carry (ADR 0636 §4); none until it is made.
+	Seats []json.RawMessage
 	// Try narrows a try's check (its level, its tests); nil for a pull request's.
 	Try *TryOptions
 
diff --git a/modules/mesh-delivery-checker/internal/check/engines.go b/modules/mesh-delivery-checker/internal/check/engines.go
index f0cadd76..d6159d0e 100644
--- a/modules/mesh-delivery-checker/internal/check/engines.go
+++ b/modules/mesh-delivery-checker/internal/check/engines.go
@@ -171,7 +171,7 @@ func (e EngineCompositions) inSandbox(ctx context.Context, c *Case, head, node s
 		}
 	}
 	req := composer.Request{V: composer.Version, Input: a.Input, Depth: composer.DepthCompose, Machines: []string{node},
-		Cases: []composer.Case{{Name: "change", Manifests: manifests, Verdicts: verdicts}}}
+		Cases: []composer.Case{{Name: "change", Manifests: manifests, Verdicts: verdicts}}, Seats: c.Seats}
 	raw, err := json.Marshal(req)
 	if err != nil {
 		return a, err
diff --git a/modules/mesh-delivery-checker/internal/check/engines_test.go b/modules/mesh-delivery-checker/internal/check/engines_test.go
index 189fedb5..2157321c 100644
--- a/modules/mesh-delivery-checker/internal/check/engines_test.go
+++ b/modules/mesh-delivery-checker/internal/check/engines_test.go
@@ -146,6 +146,7 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 			t.Fatal(err)
 		}
 		host := CaseOf(c, map[string]string{repoA: trunkA, nodeEngineRepo: trunkA})
+		host.Seats = []json.RawMessage{json.RawMessage(`{"seat":"node-x","scope":"node"}`)} // the heads' list (ADR 0636 §4)
 		withInput := composed("anchor")
 		withInput.Input = json.RawMessage(`{"nodes":[{"name":"anchor"}]}`)
 		e := &fakeEngines{answers: map[string]delivery.ComposeCandidateAnswer{"anchor": withInput}}
@@ -167,7 +168,8 @@ func TestTheCompositionIsMadeFromTheEnginesAnswers(t *testing.T) {
 		var req composer.Request
 		_ = json.Unmarshal(job.Request, &req)
 		if job.Fetch["repository"] != nodeEngineRepo || job.Fetch["commit"] != head2 || job.Package != composer.Package ||
-			string(req.Input) != string(withInput.Input) || req.Cases[0].Manifests["web"].Digest == "" {
+			string(req.Input) != string(withInput.Input) || req.Cases[0].Manifests["web"].Digest == "" ||
+			len(req.Seats) != 1 || string(req.Seats[0]) != string(host.Seats[0]) {
 			t.Errorf("job = %+v, request %+v", job, req)
 		}
 		// Issue 1921: the composer is built at the group's heads, also a member that publishes no package yet.
diff --git a/modules/mesh-delivery-checker/internal/check/examiner_test.go b/modules/mesh-delivery-checker/internal/check/examiner_test.go
index 2fa8dab3..efa9362d 100644
--- a/modules/mesh-delivery-checker/internal/check/examiner_test.go
+++ b/modules/mesh-delivery-checker/internal/check/examiner_test.go
@@ -1,12 +1,15 @@
 package check
 
 import (
+	"cmp"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io/fs"
+	"mesh-delivery-checker/rules"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -15,6 +18,7 @@ import (
 	"strings"
 	"sync"
 	"testing"
+	"testing/fstest"
 	"time"
 	"unicode/utf8"
 
@@ -125,6 +129,69 @@ type bench struct {
 	// declines is how many asks naming needs a node lacking them declines before shanks, which has every need, takes
 	// one (issue 890); an ask naming none runs on shanks, which then has none.
 	declines int
+	// inputs are the checking program's kept inputs; heads the heads laid for it (none when nil); run, when set, answers
+	// a run ask in its place (a program that does not build or answer).
+	inputs *memKV
+	heads  fs.FS
+	run    func(a delivery.StepAsk) (delivery.Step, bool)
+	mu     sync.Mutex
+	runs   []delivery.StepAsk // the run asks put
+}
+
+// benchAsks puts the bench's asks: a run ask is answered at once by the checking program's work (answerRun), written by
+// write and kept apart (bench.runs); every other ask goes to inner (the fake bus by default), answered as it answers.
+type benchAsks struct {
+	b     *bench
+	inner buildrun.AskPublisher
+	write func(delivery.Step)
+}
+
+func (b *bench) asker(inner buildrun.AskPublisher, write func(delivery.Step)) benchAsks {
+	return benchAsks{b: b, inner: inner, write: write}
+}
+
+func (p benchAsks) PublishAsk(ctx context.Context, subject, id string, data []byte) error {
+	inner, write := p.inner, p.write
+	if inner == nil {
+		inner, write = p.b.asks, p.b.asks.Write
+	}
+	a, err := delivery.DecodeStepAsk(data)
+	if err != nil || a.Run == nil {
+		return inner.PublishAsk(ctx, subject, id, data)
+	}
+	p.b.mu.Lock()
+	p.b.runs = append(p.b.runs, a)
+	p.b.mu.Unlock()
+	if step := p.b.answerRun(a); step.ID != "" {
+		write(step)
+	}
+	return nil
+}
+
+// trunkD is mesh-delivery's trunk the bench's checking program is built at.
+var trunkD = strings.Repeat("d", 40)
+
+// answerRun answers a run ask as the build module would: the checking program's work (rules.Program) over the input the
+// ask names, read from the kept inputs and checked against its digest.
+func (b *bench) answerRun(a delivery.StepAsk) delivery.Step {
+	began := time.Date(2026, 10, 21, 19, 0, 0, 0, time.UTC)
+	step := delivery.Step{ID: a.ID, Tool: a.Kind + " ask", Node: "shanks", State: delivery.StepPassed, Started: began, Ended: began.Add(time.Second)}
+	if b.run != nil {
+		if s, ok := b.run(a); ok {
+			return s
+		}
+	}
+	answer := delivery.RunAnswer{Built: true, Key: "program-0123456789abcdef"}
+	out, err := rules.Program(a.Run.Args, func() ([]byte, error) {
+		body, _, _, _ := b.inputs.Get(context.Background(), a.Run.Input.Digest)
+		return body, a.Run.Input.Verify(body)
+	}, b.heads)
+	if err != nil {
+		answer.Exit, answer.Said = 2, err.Error()
+	}
+	answer.Output = out
+	step.Result, _ = json.Marshal(answer)
+	return step
 }
 
 // refsOf reads the siblings of a fetch's arguments, as they arrive in an ask (JSON) or as the checker gave them.
@@ -183,7 +250,7 @@ func (b *bench) answer(a delivery.StepAsk) delivery.Step {
 // newBench is an examiner over fake build modules that merge cleanly, digest the captured fixture's packages and pass
 // the captured slow fixture's result at both levels, on shanks.
 func newBench(t testing.TB) *bench {
-	b := &bench{steps: &fakeSteps{}, kept: newMemKV(), prev: newMemKV()}
+	b := &bench{steps: &fakeSteps{}, kept: newMemKV(), prev: newMemKV(), inputs: newMemKV(), heads: fstest.MapFS{}}
 	b.fetch = captured[Fetched](t, "go-fetch-clean")
 	b.fetch.Modules, b.fetch.Changed, b.fetch.Trees = []string{"."}, []string{"README.md"}, nil
 	one := captured[Digested](t, "go-digest")
@@ -207,8 +274,8 @@ func newBench(t testing.TB) *bench {
 	}
 	now := time.Date(2026, 10, 21, 19, 0, 0, 0, time.UTC)
 	b.asks = &buildrun.FakeAsks{Answer: b.answer}
-	b.ex = &Examiner{Asks: buildrun.Asker{Publisher: b.asks, Waiter: b.asks, Bound: 5 * time.Second}, Toolchains: goEntries("shanks"), Kept: Kept{Store: b.kept}, Previews: b.prev,
-		Modules: langs{}, Trunks: &Trunks{}, Now: func() time.Time { now = now.Add(50 * time.Millisecond); return now }}
+	b.ex = &Examiner{Asks: buildrun.Asker{Publisher: b.asker(nil, nil), Waiter: b.asks, Bound: 5 * time.Second}, Toolchains: goEntries("shanks"), Kept: Kept{Store: b.kept}, Previews: b.prev,
+		Modules: langs{}, Trunks: &Trunks{heads: map[string]string{DeliveryRepository: trunkD}}, Inputs: memInputs{b.inputs}, Now: func() time.Time { now = now.Add(50 * time.Millisecond); return now }}
 	return b
 }
 
@@ -299,6 +366,73 @@ func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679
 			t.Errorf("the check ask carries the names %v", asks)
 		}
 	}
+
+	// Issue 1921 (B0, D4 to D6): the check's verdict is the checking program's, built at the group's mesh-delivery head,
+	// else at mesh-delivery's trunk, over the facts kept as its input; a program that is never begun, does not build or
+	// does not answer fails the check naming it, and a rule the change's program alters judges the check.
+	verdictOf := func(state, words string) json.RawMessage {
+		out, _ := json.Marshal(rules.Answer{V: rules.AnswerVersion, Verdict: delivery.Verdict{State: state, Failed: delivery.FailedFirst{Words: words}}})
+		return out
+	}
+	for _, row := range []struct {
+		name  string
+		repo  string // the member's repository: mesh-delivery unless named
+		run   func(a delivery.StepAsk, s delivery.Step) (delivery.Step, bool)
+		at    string // the commit the program is built at; empty when it fails
+		fails string
+		runs  int // the run asks put when it fails: each put twice when never begun
+	}{
+		{name: "at the group's mesh-delivery head", at: head1},
+		{name: "at mesh-delivery's trunk", repo: "novox/mesh-catalog", at: trunkD},
+		{name: "never begun", run: func(delivery.StepAsk, delivery.Step) (delivery.Step, bool) { return delivery.Step{}, true },
+			fails: "no build node began the job run of the asks", runs: 4},
+		{name: "does not build", run: func(_ delivery.StepAsk, s delivery.Step) (delivery.Step, bool) {
+			s.State, s.Reason = delivery.StepFailed, "the program does not build: undefined: rules.Nothing"
+			return s, true
+		}, fails: "by the checking program: its run ask", runs: 2},
+		{name: "a rule the change alters", at: head1, run: func(a delivery.StepAsk, s delivery.Step) (delivery.Step, bool) {
+			if a.Run.Args[0] != "-verdict" {
+				return s, false
+			}
+			s.Result, _ = json.Marshal(delivery.RunAnswer{Key: "program-0123456789abcdef", Output: verdictOf(delivery.VerdictFail, "the change's own rule refuses it")})
+			return s, true
+		}, fails: "the change's own rule refuses it"},
+	} {
+		b := newBench(t)
+		b.ex.BeginBound = 20 * time.Millisecond
+		if row.run != nil {
+			b.run = func(a delivery.StepAsk) (delivery.Step, bool) {
+				return row.run(a, delivery.Step{ID: a.ID, Tool: "check ask", Node: "shanks", State: delivery.StepPassed})
+			}
+		}
+		repo := cmp.Or(row.repo, repoA)
+		v := b.judge(t, caseOf(t, pullOf(repo, 7, head1))).Verdict
+		if row.fails != "" {
+			if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails) {
+				t.Errorf("%s: verdict %+v, want a fail saying %q", row.name, v, row.fails)
+			}
+			if row.at == "" && (len(b.runs) != row.runs || v.JudgedBy != nil) {
+				t.Errorf("%s: %d run asks, judged by %+v: want %d and none judging", row.name, len(b.runs), v.JudgedBy, row.runs)
+			}
+		} else if v.State != delivery.VerdictPass {
+			t.Errorf("%s: verdict %+v", row.name, v)
+		}
+		if row.at == "" {
+			continue
+		}
+		if by := v.JudgedBy; by == nil || by.Program.Commit != row.at || by.Program.Package != CheckingProgramPackage || by.Key == "" ||
+			len(by.Heads) != 1 || by.Heads[0].Repository != repo || by.Heads[0].Commit != head1 {
+			t.Errorf("%s: judged by %+v, want the program at %s over the member's head", row.name, v.JudgedBy, row.at)
+		}
+		if len(b.runs) != 2 || b.runs[0].Run.Args[0] != "-seats" || b.runs[1].Run.Args[0] != "-verdict" {
+			t.Fatalf("%s: run asks %+v, want the seat list and then the verdict", row.name, b.runs)
+		}
+		in := b.runs[1].Run.Input // the facts kept as their exact bytes under their digest
+		if body, _, found, _ := b.inputs.Get(context.Background(), in.Digest); !found || in.Verify(body) != nil || in.State != InputsState ||
+			!strings.Contains(string(body), `"group":"feat/x"`) {
+			t.Errorf("%s: the verdict's input %+v is not kept whole: %s", row.name, in, body)
+		}
+	}
 }
 
 // namesOf is the nodes' names as a test gives them.
@@ -923,7 +1057,7 @@ func TestAnAskWhoseStepNeverEndsEndsTheCheckLoudly(t *testing.T) {
 	b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
 		return delivery.Step{ID: a.ID, Tool: "check ask", Node: "shanks", State: delivery.StepRunning, Started: time.Now()}
 	}
-	b.ex.Asks = buildrun.Asker{Publisher: b.asks, Waiter: b.asks, Bound: 20 * time.Millisecond}
+	b.ex.Asks = buildrun.Asker{Publisher: b.asker(nil, nil), Waiter: b.asks, Bound: 20 * time.Millisecond}
 	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
 	if f := out.Verdict.Failed; out.Verdict.State != delivery.VerdictFail || !strings.Contains(f.Words, "on shanks did not end within") {
 		t.Fatalf("verdict = %+v", out.Verdict)
@@ -959,7 +1093,7 @@ func TestACheckAskWaitingInItsStreamIsNotBounded(t *testing.T) {
 	b := newBench(t)
 	answer := b.asks.Answer
 	b.asks.Answer = nil
-	b.ex.Asks = buildrun.Asker{Publisher: b.asks, Waiter: b.asks, Bound: 20 * time.Millisecond}
+	b.ex.Asks = buildrun.Asker{Publisher: b.asker(nil, nil), Waiter: b.asks, Bound: 20 * time.Millisecond}
 	done := make(chan Outcome, 1)
 	go func() { done <- b.judge(t, caseOf(t, pullOf(repoA, 7, head1))) }()
 	for deadline := time.Now().Add(10 * time.Second); len(b.asks.Asks()) == 0; time.Sleep(time.Millisecond) {
@@ -1047,8 +1181,12 @@ func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
 		// try judges the same change as a whole group try, whose manifests come from the indexer's candidate of the try's
 		// group (issue 1921): the same judge, the same verdicts.
 		try bool
+		// seats lays heads that add a seat: the checking program's seat list is carried by every judge ask's request (ADR
+		// 0636 §4, issue 1921 D4).
+		seats bool
 	}{
 		{name: "accepted"},
+		{name: "the heads' seat list is carried by the head's judge and the trunk's", seats: true, indexer: "ok", ownJudge: true},
 		{name: "accepted in a group try", try: true},
 		{name: "refused in a group try", try: true, refused: "web has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web has no id`},
 		{name: "a cycle the group try makes", try: true, cycle: "provisions", fails: "the change's module graph has the cycle mail -> web -> mail"},
@@ -1069,6 +1207,9 @@ func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
 		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
 	} {
 		b := newBench(t)
+		if row.seats {
+			b.heads = fstest.MapFS{"novox/mesh-contracts/contracts/seats/node-x/seat.json": {Data: []byte(`{"format":1,"seat":"node-x","scope":"node"}`)}}
+		}
 		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
 		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
 		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
@@ -1174,6 +1315,13 @@ func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
 			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
 			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
 		}
+		for _, j := range judged {
+			var seated composer.Request
+			if err := json.Unmarshal(j.Request, &seated); err != nil || (len(seated.Seats) == 1) != row.seats ||
+				(row.seats && !strings.Contains(string(seated.Seats[0]), `"node-x"`)) {
+				t.Errorf("%s: the judge at %v is handed the seats %s, want the heads' list: %v", row.name, j.Fetch["commit"], seated.Seats, err)
+			}
+		}
 		var req composer.Request
 		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
 			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
diff --git a/modules/mesh-delivery-checker/internal/check/fakes_test.go b/modules/mesh-delivery-checker/internal/check/fakes_test.go
index d53f2a14..bade10ab 100644
--- a/modules/mesh-delivery-checker/internal/check/fakes_test.go
+++ b/modules/mesh-delivery-checker/internal/check/fakes_test.go
@@ -68,3 +68,14 @@ func (m *memKV) Delete(_ context.Context, key string) error {
 	delete(m.revs, key)
 	return nil
 }
+
+// memInputs keeps run inputs in a memKV, under their digest.
+type memInputs struct{ kv *memKV }
+
+func (m memInputs) Keep(ctx context.Context, digest string, body []byte) error {
+	if _, _, found, _ := m.kv.Get(ctx, digest); found {
+		return nil
+	}
+	_, err := m.kv.Create(ctx, digest, body)
+	return err
+}
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 78856a58..036f98e8 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -138,6 +138,10 @@ type Examiner struct {
 	// and fingerprints a group try's manifest validator and composition judge (issue 1921); nil leaves a whole try with no
 	// manifest or composition judged, said.
 	Candidates TryCandidates
+	// Inputs keeps the checking program's inputs (the state InputsState); BeginBound is how long a run ask may wait for a
+	// build node to begin it (DefaultBeginBound when zero).
+	Inputs     Inputs
+	BeginBound time.Duration
 	Now        func() time.Time
 	Logf       func(format string, args ...any)
 }
@@ -302,13 +306,17 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	// Each failure is a fact recorded where it is met; the verdict is the judging rules' of the facts.
 	st.judgeAll(ctx)
 	st.takeTryCandidate(ctx)
+	// The heads' seat list, from the checking program, before the validator and the composer are asked (ADR 0636 §4).
+	st.seatList(ctx)
 	st.judgeManifests(ctx)
 	st.refuseCycle(ctx)
 	st.compose(ctx)
-	answer := rules.Judged(st.factsOf())
+	// The verdict is the checking program's of the facts (ADR 0644 §1, ADR 0656 §5).
+	answer, by := st.judged(ctx)
 	for _, n := range answer.Notes {
 		st.c.note(n)
 	}
+	answer.Verdict.JudgedBy = by
 	out := st.outcome(answer.Verdict)
 	out.Builds = st.j.buildNotes(ctx, st.c)
 	return out, nil
@@ -384,7 +392,9 @@ func (st *state) fail(machine, words string) {
 
 // factsOf are the check's facts as met: what the checking program judges.
 func (st *state) factsOf() rules.Facts {
-	return rules.Facts{V: rules.FactsVersion, Steps: st.facts, CloneMS: st.clone.Milliseconds(), Composition: st.composition, Notes: st.c.Notes()}
+	f := st.factsHead()
+	f.Steps, f.CloneMS, f.Composition, f.Notes = st.facts, st.clone.Milliseconds(), st.composition, st.c.Notes()
+	return f
 }
 
 // levels are the levels a case's asks run: both, or the one a try names.
diff --git a/modules/mesh-delivery-checker/internal/check/lostask_test.go b/modules/mesh-delivery-checker/internal/check/lostask_test.go
index 3c547e46..d84a58af 100644
--- a/modules/mesh-delivery-checker/internal/check/lostask_test.go
+++ b/modules/mesh-delivery-checker/internal/check/lostask_test.go
@@ -58,7 +58,7 @@ func (l *losingAsks) PublishAsk(ctx context.Context, subject, id string, data []
 
 func losing(b *bench, lose int) *losingAsks {
 	l := &losingAsks{FakeAsks: &buildrun.FakeAsks{}, answer: b.answer, dead: &buildrun.DeadLetters{}, lose: lose}
-	b.ex.Asks = buildrun.Asker{Publisher: l, Waiter: buildrun.LostAskWaiter{Inner: l.FakeAsks, Dead: l.dead}, Bound: 5 * time.Second}
+	b.ex.Asks = buildrun.Asker{Publisher: b.asker(l, l.FakeAsks.Write), Waiter: buildrun.LostAskWaiter{Inner: l.FakeAsks, Dead: l.dead}, Bound: 5 * time.Second}
 	return l
 }
 
@@ -282,7 +282,7 @@ func TestACheckWhoseAskJudgedNothingIsAskedAgainOrRead(t *testing.T) {
 				tr = &troubled{FakeAsks: &buildrun.FakeAsks{}, answer: b.answer, restarts: row.restarts, deaf: row.deaf,
 					deafIDs: map[string]bool{}, steps: map[string]delivery.Step{}}
 				heard = &buildrun.HeardEnds{Inner: tr, Read: tr}
-				b.ex.Asks = buildrun.Asker{Publisher: tr, Waiter: heard, Bound: 5 * time.Second}
+				b.ex.Asks = buildrun.Asker{Publisher: b.asker(tr, tr.Write), Waiter: heard, Bound: 5 * time.Second}
 				asked = func() int { return len(tr.Asks()) }
 			}
 			r := newRig(t, b.ex)
diff --git a/modules/mesh-delivery-checker/internal/check/manifests_judge.go b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
index 718cebd5..90bba199 100644
--- a/modules/mesh-delivery-checker/internal/check/manifests_judge.go
+++ b/modules/mesh-delivery-checker/internal/check/manifests_judge.go
@@ -123,6 +123,8 @@ func (st *state) judgeManifests(ctx context.Context) {
 		req.Predefined = list
 		st.c.note("the manifests are judged against the predefined keys of " + from)
 	}
+	// The heads' seat list, for the change case and the trunk case both (ADR 0636 §4).
+	req.Seats = st.c.Seats
 	cv, trunkCase, ok := st.runJudge(ctx, req, touched, commit, at, st.packagesOf(DeliveryRepository))
 	if !ok {
 		return
diff --git a/modules/mesh-delivery-checker/internal/check/programs.go b/modules/mesh-delivery-checker/internal/check/programs.go
new file mode 100644
index 00000000..1b5b9cb4
--- /dev/null
+++ b/modules/mesh-delivery-checker/internal/check/programs.go
@@ -0,0 +1,223 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"mesh-delivery-checker/rules"
+)
+
+// The checking program (novox/hq ADR 0644 §1, ADR 0656 §5; design 47's bootstrap delivery; issue 1921): every check has
+// the program built from the group's mesh-delivery member head, else from mesh-delivery's trunk, and run in the build
+// seat's sandbox through the seat node-build-go's ask `run`, with every member's head laid for it. It answers the heads'
+// seat list first (`-seats`), which the manifest validator's and the composer's requests carry, and then the check's
+// verdict of the facts the asking gathered (`-verdict`). The running checker asks, keeps and records; it judges nothing.
+
+const (
+	// InputsStateName is the checker's own state of run inputs, InputsBucket its bucket and InputsState its name as a run
+	// ask's input names it (delivery.RunInput.State): every input by the sha256 of its exact bytes, read by the Go build
+	// module, which checks the digest (delivery.RunInput.Verify).
+	InputsStateName = "inputs"
+	InputsBucket    = delivery.CheckerModule + "_" + InputsStateName
+	InputsState     = delivery.CheckerModule + "." + InputsStateName
+	// CheckingProgramDir and CheckingProgramPackage are where in mesh-delivery the checking program is built.
+	CheckingProgramDir     = "modules/mesh-delivery-checker"
+	CheckingProgramPackage = "mesh-delivery-checker/cmd/mesh-checking-program"
+	// DefaultBeginBound is how long a run ask may wait for a build node to begin its step before it is put once more, and
+	// after that once more before the check fails naming the job: a build module that does not know the job `run` drops
+	// it unanswered (the lead's ruling on milestone 47/B0, 2026-11-06).
+	DefaultBeginBound = 5 * time.Minute
+)
+
+// Inputs keeps a run's input under its digest, exactly its bytes.
+type Inputs interface {
+	Keep(ctx context.Context, digest string, body []byte) error
+}
+
+func (j *Examiner) beginBound() time.Duration {
+	if j.BeginBound > 0 {
+		return j.BeginBound
+	}
+	return DefaultBeginBound
+}
+
+// checkingProgram is where this check's checking program is built: the group's mesh-delivery member head, else
+// mesh-delivery's trunk; false when neither is known.
+func (st *state) checkingProgram() (delivery.RunProgram, string, bool) {
+	p := delivery.RunProgram{Repository: DeliveryRepository, Dir: CheckingProgramDir, Package: CheckingProgramPackage}
+	for _, pull := range st.c.Pulls {
+		if pull.Repository == DeliveryRepository {
+			p.Commit = pull.Head
+			return p, "the group's mesh-delivery head " + pull.Head, true
+		}
+	}
+	if st.j.Trunks != nil {
+		p.Commit = st.j.Trunks.Heads()[DeliveryRepository]
+	}
+	return p, "mesh-delivery's trunk " + p.Commit, p.Commit != ""
+}
+
+// runHeads are the members' heads, as the program reads them.
+func (st *state) runHeads() []delivery.RunHead {
+	out := make([]delivery.RunHead, 0, len(st.c.Pulls))
+	for _, p := range st.c.Pulls {
+		out = append(out, delivery.RunHead{Repository: p.Repository, Commit: p.Head})
+	}
+	return out
+}
+
+// runProgram has the checking program built and run with args over body, and answers its output and what judged; an
+// error says why it did not answer: its input over its bound, no build node beginning the job, a step that did not
+// pass, or a program that exited otherwise than 0.
+func (st *state) runProgram(ctx context.Context, args []string, body []byte) (json.RawMessage, *delivery.JudgedBy, error) {
+	prog, at, ok := st.checkingProgram()
+	if !ok {
+		return nil, nil, fmt.Errorf("it cannot be built: the trunk head of %s is not known", DeliveryRepository)
+	}
+	if st.j.Inputs == nil {
+		return nil, nil, fmt.Errorf("its input cannot be kept: the checker keeps no state %s", InputsState)
+	}
+	in, err := delivery.RunInputOf(InputsState, body)
+	if err != nil {
+		return nil, nil, err
+	}
+	if err := st.j.Inputs.Keep(ctx, in.Digest, body); err != nil {
+		return nil, nil, fmt.Errorf("its input could not be kept in %s: %w", InputsState, err)
+	}
+	job := delivery.RunJob{Program: prog, Heads: st.runHeads(), Input: in, Args: args, Reader: "the checking program at " + at}
+	var ids []string
+	for range 2 {
+		a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
+			At: st.j.now().UTC(), Packages: st.packagesOf(DeliveryRepository), Run: &job}
+		ids = append(ids, a.ID)
+		st.c.Progress.Set(fmt.Sprintf("the run ask %s of the checking program %s", a.ID, strings.Join(args, " ")), "")
+		st.c.Asked(a.ID)
+		if err := st.j.Asks.Put(ctx, a); err != nil {
+			return nil, nil, fmt.Errorf("its run ask could not be put: %w", err)
+		}
+		waiting := ctx
+		if watch := st.c.Watch; watch != nil {
+			id := a.ID
+			watch(id, nil) // a try names it at once (issue 1890)
+			waiting = buildrun.WithStepSeen(ctx, func(s delivery.Step) { watch(id, &s) })
+		}
+		step, begun, err := st.waitBegun(waiting, a)
+		if !begun {
+			continue
+		}
+		if err != nil {
+			return nil, nil, fmt.Errorf("its run ask %s: %w", a.ID, err)
+		}
+		if step.State != delivery.StepPassed {
+			return nil, nil, fmt.Errorf("its run ask %s ended %s on %s: %s", a.ID, step.State, step.Node, step.Reason)
+		}
+		var answer delivery.RunAnswer
+		if err := json.Unmarshal(step.Result, &answer); err != nil {
+			return nil, nil, fmt.Errorf("its run ask %s answered no run answer: %w", a.ID, err)
+		}
+		if answer.Exit != 0 {
+			return nil, nil, fmt.Errorf("it exited %d on %s: %s", answer.Exit, step.Node, answer.Said)
+		}
+		return answer.Output, &delivery.JudgedBy{Program: prog, Key: answer.Key, Built: answer.Built, Heads: job.Heads}, nil
+	}
+	return nil, nil, fmt.Errorf("no build node began the job run of the asks %s within %s each: a build module that does not know the job run drops it",
+		strings.Join(ids, " and "), st.j.beginBound())
+}
+
+// waitBegun waits for a's step, and stops waiting, begun false, when no build node began it within the begin bound: a
+// bound on the wait's context, no timer of its own.
+func (st *state) waitBegun(ctx context.Context, a delivery.StepAsk) (delivery.Step, bool, error) {
+	wait, cancel := context.WithCancel(ctx)
+	defer cancel()
+	begin, stop := context.WithTimeout(ctx, st.j.beginBound())
+	defer stop()
+	seen := make(chan struct{})
+	var once sync.Once
+	type ended struct {
+		step delivery.Step
+		err  error
+	}
+	done := make(chan ended, 1)
+	go func() {
+		step, err := st.j.Asks.Wait(buildrun.WithStepSeen(wait, func(delivery.Step) { once.Do(func() { close(seen) }) }), a)
+		done <- ended{step, err}
+	}()
+	select {
+	case e := <-done:
+		return e.step, true, e.err
+	case <-seen:
+	case <-begin.Done():
+		if ctx.Err() != nil {
+			return delivery.Step{}, true, ctx.Err()
+		}
+		return delivery.Step{}, false, nil
+	}
+	e := <-done
+	return e.step, true, e.err
+}
+
+// seatList asks the checking program for the heads' seat list, which the validator's and the composer's requests carry
+// (ADR 0636 §4); the list and what it left out are the check's notes. A list it cannot make fails the check, naming why.
+func (st *state) seatList(ctx context.Context) {
+	if st.narrowTry() {
+		return
+	}
+	body, err := json.Marshal(st.factsHead())
+	if err == nil {
+		var out json.RawMessage
+		if out, _, err = st.runProgram(ctx, []string{"-seats"}, body); err == nil {
+			var a rules.SeatsAnswer
+			if err = json.Unmarshal(out, &a); err == nil && a.V != rules.SeatsVersion {
+				err = fmt.Errorf("it answered a seat list of version %d, not %d", a.V, rules.SeatsVersion)
+			}
+			if err == nil {
+				st.c.Seats = a.Seats
+				st.c.note(fmt.Sprintf("the heads' seat list holds %d seat definitions", len(a.Seats)))
+				for _, l := range a.Left {
+					st.c.note("the heads' seat list leaves out " + l.Path + ": " + l.Why)
+				}
+				return
+			}
+		}
+	}
+	st.fail(goModule, "the heads' seat list could not be made by the checking program: "+err.Error())
+}
+
+// factsHead are the facts that name the check, without what the asking gathered.
+func (st *state) factsHead() rules.Facts {
+	f := rules.Facts{V: rules.FactsVersion, Group: st.c.Group, Heads: st.c.Heads, Trunk: st.c.Trunk}
+	for _, p := range st.c.Pulls {
+		f.Members = append(f.Members, rules.Member{Repository: p.Repository, Number: p.Number, Head: p.Head, Trunk: p.Trunk})
+	}
+	return f
+}
+
+// judged is the checking program's answer to the check's facts (`-verdict`), with what judged; a program that cannot be
+// asked, built or run, or does not answer a verdict, fails the check naming the checking program, never the running
+// checker's rules in its place: the facts gain the failure and the verdict is worded from them as a failure.
+func (st *state) judged(ctx context.Context) (rules.Answer, *delivery.JudgedBy) {
+	body, err := json.Marshal(st.factsOf())
+	var by *delivery.JudgedBy
+	if err == nil {
+		var out json.RawMessage
+		if out, by, err = st.runProgram(ctx, []string{"-verdict"}, body); err == nil {
+			var a rules.Answer
+			if err = json.Unmarshal(out, &a); err == nil && a.V != rules.AnswerVersion {
+				err = fmt.Errorf("it answered a verdict of version %d, not %d", a.V, rules.AnswerVersion)
+			}
+			if err == nil {
+				return a, by
+			}
+		}
+	}
+	st.fail(goModule, "the check could not be judged by the checking program: "+err.Error())
+	return rules.Answer{V: rules.AnswerVersion, Verdict: rules.Judge(st.factsOf())}, by
+}
diff --git a/modules/mesh-delivery-checker/internal/check/read.go b/modules/mesh-delivery-checker/internal/check/read.go
index af42b94c..3457cd47 100644
--- a/modules/mesh-delivery-checker/internal/check/read.go
+++ b/modules/mesh-delivery-checker/internal/check/read.go
@@ -20,6 +20,7 @@ const (
 	VerdictsReadTool = "checker_verdicts"
 	PullReadTool     = "checker_pull"
 	KeptReadTool     = "checker_kept"
+	InputsReadTool   = "checker_inputs"
 	// PreviewsReadTool reads the previews state (issue 1680); StatusReadTool reads what the checker runs (issue 1685: nothing holds it since R4g).
 	PreviewsReadTool = "checker_previews"
 	StatusReadTool   = "checker_status"
@@ -36,6 +37,7 @@ type Reader struct {
 	VerdictState, KeptState, CandidateState StateRead
 
 	PreviewState StateRead            // the checker's merge previews
+	InputState   StateRead            // the checking program's inputs (InputsState)
 	StepStates   map[string]StateRead // the build modules' steps states, by module
 	HaveState    StateRead            // the node-engine's have: whether a build module is on a node and running
 	StepBound    time.Duration        // how long the checker waits for one step; DefaultStepBound when 0
@@ -257,6 +259,42 @@ func (r Reader) Kept(level, digest string) (map[string]json.RawMessage, string,
 	return out, cut, nil
 }
 
+// Inputs are the checking program's kept inputs: with a digest that input as kept, else every digest with its size.
+func (r Reader) Inputs(digest string) (map[string]json.RawMessage, string, error) {
+	if r.InputState.Keys == nil || r.InputState.Get == nil {
+		return nil, "", fmt.Errorf("the state %s cannot be read here", InputsState)
+	}
+	if digest != "" {
+		raw, err := r.InputState.Get(digest)
+		if err != nil {
+			return nil, "", err
+		}
+		if len(raw) == 0 {
+			return nil, "", fmt.Errorf("no input %s is kept", digest)
+		}
+		return map[string]json.RawMessage{digest: raw}, "", nil
+	}
+	keys, err := r.InputState.Keys()
+	if err != nil {
+		return nil, "", err
+	}
+	sort.Strings(keys)
+	keys, cut := capKeys(keys, "give a digest to read one")
+	sizes := make([]int, len(keys))
+	if err := parallel(len(keys), func(i int) error {
+		raw, err := r.InputState.Get(keys[i])
+		sizes[i] = len(raw)
+		return err
+	}); err != nil {
+		return nil, "", err
+	}
+	out := map[string]json.RawMessage{}
+	for i, k := range keys {
+		out[k] = json.RawMessage(fmt.Sprintf(`{"size":%d}`, sizes[i]))
+	}
+	return out, cut, nil
+}
+
 // PreviewRead is one preview as stored, with the parts of its key.
 type PreviewRead struct {
 	Key        string          `json:"key"`
diff --git a/modules/mesh-delivery-checker/internal/check/read_test.go b/modules/mesh-delivery-checker/internal/check/read_test.go
index 033ba635..c01589be 100644
--- a/modules/mesh-delivery-checker/internal/check/read_test.go
+++ b/modules/mesh-delivery-checker/internal/check/read_test.go
@@ -114,6 +114,21 @@ func TestTheKeptToolAnswersTheKeysAsStoredByLevelAndByDigest(t *testing.T) { //
 	if _, _, err := rd.Kept("unit", digB); err == nil {
 		t.Error("a digest nothing kept was answered")
 	}
+	// Issue 1921: checker_inputs answers the checking program's inputs, every digest with its size, or one as kept.
+	inputs := newMemKV()
+	body := []byte(`{"v":1,"group":"feat/x"}`)
+	in, _ := delivery.RunInputOf(InputsState, body)
+	_ = memInputs{inputs}.Keep(context.Background(), in.Digest, body)
+	rd.InputState = kvRead(inputs)
+	if all, _, err := rd.Inputs(""); err != nil || string(all[in.Digest]) != fmt.Sprintf(`{"size":%d}`, len(body)) {
+		t.Errorf("inputs = %s, %v", all, err)
+	}
+	if one, _, err := rd.Inputs(in.Digest); err != nil || string(one[in.Digest]) != string(body) {
+		t.Errorf("one input = %s, %v", one, err)
+	}
+	if _, _, err := rd.Inputs(strings.Repeat("0", 64)); err == nil {
+		t.Error("an input nothing kept was answered")
+	}
 }
 
 // 1680 live acceptance: checker_previews shows the preview key of an open pull request, as stored, narrowed by repository and head.
diff --git a/modules/mesh-delivery-checker/internal/check/try_test.go b/modules/mesh-delivery-checker/internal/check/try_test.go
index d3eb73ff..21b08c29 100644
--- a/modules/mesh-delivery-checker/internal/check/try_test.go
+++ b/modules/mesh-delivery-checker/internal/check/try_test.go
@@ -254,7 +254,8 @@ func TestATryIsJudgedAsAGroupsCheckAndOwesTheForgeNothing(t *testing.T) { // ADR
 	if len(written.running) < 3 || len(written.running[1].Asks) != 1 || written.running[1].Steps[0].State != TryAsked {
 		t.Errorf("the running try's writes = %+v, want its ask named while it ran", written.running)
 	}
-	if len(got.Steps) != 2 || got.Steps[0].Node != "shanks" || got.Steps[0].State != delivery.StepPassed || len(got.Asks) != 2 {
+	// Two check asks and the checking program's two run asks (the seat list and the verdict).
+	if len(got.Steps) != 4 || got.Steps[0].Node != "shanks" || got.Steps[0].State != delivery.StepPassed || len(got.Asks) != 4 {
 		t.Errorf("the ended try's steps = %+v, asks %v", got.Steps, got.Asks)
 	}
 	for _, a := range got.Asks { // the delivery view counts their steps as a try's (build_usage)
diff --git a/modules/mesh-delivery-checker/manifest_test.go b/modules/mesh-delivery-checker/manifest_test.go
index 1f71c257..c483b32a 100644
--- a/modules/mesh-delivery-checker/manifest_test.go
+++ b/modules/mesh-delivery-checker/manifest_test.go
@@ -20,6 +20,7 @@ import (
 type state struct {
 	Name    string `json:"name"`
 	History int    `json:"history,omitempty"`
+	TTL     int    `json:"ttl-seconds,omitempty"`
 }
 
 type artifact struct {
@@ -101,7 +102,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 		t.Errorf("module = %q", m.Module)
 	}
 	// delivery.CheckerKeptHistory, CheckerOwedHistory, PreviewsHistory, CheckerVerdictsHistory; the names follow the SDK's buckets.
-	if want := []state{{Name: "asks", History: 1}, {Name: "hearing", History: 1}, {Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "tries", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
+	if want := []state{{Name: "asks", History: 1}, {Name: "hearing", History: 1}, {Name: "inputs", TTL: 86400}, {Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "tries", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
@@ -163,7 +164,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	// The read tools (issue 1686) are served by the tools bundle, not by the checker's process.
 	// The try's tools (ADR 0501 §5; the end by hand, issue 734) beside them: mesh-controller's try calls them. A lost check
 	// is asked again by hand (checker_ask_again).
-	if want := []string{"checker_ask_again", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_tries", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"checker_ask_again", "checker_inputs", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_tries", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	// The try is the checker's own seat's verbs (ADR 0547 §10, issue 774), served beside the tools by the same code.
diff --git a/modules/mesh-delivery-checker/module.json b/modules/mesh-delivery-checker/module.json
index 23dcc24a..b162fdeb 100644
--- a/modules/mesh-delivery-checker/module.json
+++ b/modules/mesh-delivery-checker/module.json
@@ -23,6 +23,7 @@
   "state": [
     { "name": "asks", "history": 1 },
     { "name": "hearing", "history": 1 },
+    { "name": "inputs", "ttl-seconds": 86400 },
     { "name": "kept", "history": 1 },
     { "name": "owed", "history": 5 },
     { "name": "previews", "history": 5 },
@@ -52,6 +53,7 @@
   ],
   "tools": [
     "checker_ask_again",
+    "checker_inputs",
     "checker_kept",
     "checker_previews",
     "checker_pull",
diff --git a/modules/mesh-delivery-checker/rules/program.go b/modules/mesh-delivery-checker/rules/program.go
new file mode 100644
index 00000000..ca954634
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/program.go
@@ -0,0 +1,46 @@
+package rules
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"io/fs"
+)
+
+// Program is the checking program's work (cmd/mesh-checking-program; novox/hq ADR 0644, ADR 0656): over its arguments,
+// its input (read only when asked for the verdict) and the heads laid for it (nil when none are), the one JSON line it
+// answers, or why it refuses. `-seats` answers the seat list of the heads (SeatsOf), `-verdict` the verdict of the
+// facts in the input (Judged), refusing facts of a version it does not read.
+func Program(args []string, input func() ([]byte, error), heads fs.FS) ([]byte, error) {
+	set := flag.NewFlagSet("mesh-checking-program", flag.ContinueOnError)
+	set.SetOutput(io.Discard)
+	verdict := set.Bool("verdict", false, "answer the verdict of the facts in the input")
+	seats := set.Bool("seats", false, "answer the seat list of the heads laid for it")
+	if err := set.Parse(args); err != nil {
+		return nil, err
+	}
+	switch {
+	case *seats:
+		if heads == nil {
+			return nil, errors.New("no heads are laid for it")
+		}
+		answer, err := SeatsOf(heads)
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(answer)
+	case *verdict:
+		data, err := input()
+		if err != nil {
+			return nil, fmt.Errorf("the input cannot be read: %w", err)
+		}
+		facts, err := DecodeFacts(data)
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(Judged(facts))
+	}
+	return nil, errors.New("nothing asked: give -verdict or -seats")
+}

From 625007cbc1f6efb5abb7b4f259f139ba1409ae39 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:00:26 +0100
Subject: [PATCH 09/17] The checker's whole-module tests answer the checking
 program's run asks (issue 1921)

The fake build module of the integration tests answers a run ask with the checking program's
work over the input kept in the state inputs, as mesh-build-go does; the whole-module test
reads that the verdict names the program built at the group's mesh-delivery head, and the
keeps test reads inputs as readable.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../mesh-delivery-checker/integration_test.go | 49 +++++++++++++++++--
 1 file changed, 45 insertions(+), 4 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
index 9eeb0c8f..05fe877e 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
@@ -15,6 +15,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"testing"
+	"testing/fstest"
 	"time"
 
 	"github.com/nats-io/nats-server/v2/server"
@@ -28,6 +29,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/process"
 
 	"mesh-delivery-checker/internal/check"
+	"mesh-delivery-checker/rules"
 )
 
 // busConf is the shape of the composed accounts file (mesh-controller internal/broker): one account with JetStream, the
@@ -91,6 +93,33 @@ type fakeBuildModules struct {
 	beside map[string][]string
 	// names are the nodes' names the last check ask carried, for the names check (ADR 0567 §12).
 	names []string
+	// inputs is the checker's state of run inputs; runs counts the run asks answered, and broken, when set, is why the
+	// checking program does not build (issue 1921).
+	inputs jetstream.KeyValue
+	runs   atomic.Int32
+	broken atomic.Value
+}
+
+// run answers a run ask as mesh-build-go does: the checking program's work (rules.Program) over the input the ask names,
+// read from the checker's state inputs and checked against its digest, with no heads of its own laid.
+func (f *fakeBuildModules) run(ctx context.Context, a delivery.StepAsk) (any, error) {
+	f.runs.Add(1)
+	if why, _ := f.broken.Load().(string); why != "" {
+		return nil, errors.New(why)
+	}
+	answer := delivery.RunAnswer{Built: true, Key: "program-0123456789abcdef"}
+	out, err := rules.Program(a.Run.Args, func() ([]byte, error) {
+		e, err := f.inputs.Get(ctx, a.Run.Input.Digest)
+		if err != nil {
+			return nil, err
+		}
+		return e.Value(), a.Run.Input.Verify(e.Value())
+	}, fstest.MapFS{})
+	if err != nil {
+		answer.Exit, answer.Said = 2, err.Error()
+	}
+	answer.Output = out
+	return answer, nil
 }
 
 func (f *fakeBuildModules) count(tool string) int {
@@ -199,6 +228,9 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 				f.names = a.Check.NodeNames
 				f.mu.Unlock()
 			}
+			if a.Run != nil {
+				return f.run(ctx, a)
+			}
 			return gobuild.RunAsk(ctx, steps, a)
 		}}
 	go func() { _ = p.Pull(f.ctx) }()
@@ -398,7 +430,7 @@ func startBed(t *testing.T) *bed {
 		delivery.CheckerOwedBucket: delivery.CheckerOwedHistory, delivery.PreviewsBucket: delivery.PreviewsHistory, delivery.CandidatesBucket: delivery.CandidatesHistory,
 		delivery.ModulesBucket: delivery.ModulesHistory, delivery.ManifestsBucket: delivery.ManifestsHistory, delivery.SourceBucket: delivery.SourceHistory,
 		delivery.PresenceBucket: delivery.PresenceHistory, delivery.HaveBucket: delivery.HaveHistory, check.TriesBucket: 1,
-		delivery.TurnsBucket: delivery.TurnsHistory, delivery.BuilderBuildsBucket: 1} {
+		delivery.TurnsBucket: delivery.TurnsHistory, delivery.BuilderBuildsBucket: 1, check.InputsBucket: 1} {
 		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: uint8(history)})
 		if err != nil {
 			t.Fatal(err)
@@ -420,7 +452,7 @@ func startBed(t *testing.T) *bed {
 		b.setHealth(t, "n1", module)
 	}
 	b.serveForge(t, ctl)
-	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
+	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}, inputs: b.buckets[check.InputsBucket]}
 	b.fake.serve(t, "mesh-build-go", b.buckets[delivery.CheckerKeptBucket])
 	b.fake.serve(t, "mesh-build-node", b.buckets[delivery.CheckerKeptBucket])
 	b.report(t, "mesh-build-go", "n1", "go", "go1.27.1", "1")
@@ -647,6 +679,15 @@ func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300
 	if got := asked(); len(got) == 0 || got[0].Candidate != key {
 		t.Errorf("n1's engine was asked %+v, want the check's candidate %s", got, key)
 	}
+	// Issue 1921 (B0): the verdict is the checking program's, built at the group's mesh-delivery head over its input kept in
+	// the state inputs, two run asks a check (the seat list, the verdict); the verdict names the program's build.
+	if by := v.JudgedBy; by == nil || by.Program.Commit != head1 || by.Program.Package != check.CheckingProgramPackage ||
+		by.Key != "program-0123456789abcdef" || len(by.Heads) != 1 || by.Heads[0].Commit != head1 {
+		t.Errorf("judged by %+v, want the checking program at the head %s", v.JudgedBy, head1)
+	}
+	if n := b.fake.runs.Load(); n != 4 {
+		t.Errorf("%d run asks, want two for each of the two checks", n)
+	}
 	b.fake.mu.Lock()
 	names := b.fake.names
 	b.fake.mu.Unlock()
@@ -978,7 +1019,7 @@ func TestTheCheckerSaysOwedReadableOnTheBus(t *testing.T) { // R2-1
 	}
 	if said.Module != "mesh-delivery-checker" || said.Node != "n1" || !said.Keeps("owed") || !said.Readable("owed") ||
 		!said.Readable("previews") || !said.Readable("verdicts") || !said.Readable("kept") || !said.Readable("tries") || said.Readable("hearing") ||
-		!said.Keeps("asks") || said.Readable("asks") || len(said.States) != 7 {
-		t.Fatalf("the checker said %+v, want its seven states, asks and hearing its own, with kept, owed, previews, tries and verdicts readable, tries by the delivery view (1929/AC4; 1887 A5b; build_usage)", said)
+		!said.Keeps("asks") || said.Readable("asks") || !said.Readable("inputs") || len(said.States) != 8 {
+		t.Fatalf("the checker said %+v, want its eight states, asks and hearing its own, with inputs, kept, owed, previews, tries and verdicts readable, tries by the delivery view, inputs by the Go build module (1929/AC4; 1887 A5b; build_usage; 1921)", said)
 	}
 }

From 4dfb6af6ef340734a397b818669cab88cc190dbb Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:06:21 +0100
Subject: [PATCH 10/17] The begin bound of a run ask is the checker's setting;
 a dropped run ask and a program that does not build fail the whole check
 naming the program (issue 1921)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../mesh-delivery-checker/integration_test.go | 96 ++++++++++++++-----
 .../cmd/mesh-delivery-checker/judge.go        | 16 ++--
 .../cmd/mesh-delivery-checker/main.go         |  7 +-
 3 files changed, 88 insertions(+), 31 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
index 05fe877e..9b53cce8 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
@@ -98,6 +98,30 @@ type fakeBuildModules struct {
 	inputs jetstream.KeyValue
 	runs   atomic.Int32
 	broken atomic.Value
+	// drop, when set, drops every run ask unanswered and counts it in dropped, as a build module that does not know the job
+	// run (the lead's ruling on milestone 47/B0).
+	drop    atomic.Bool
+	dropped atomic.Int32
+}
+
+// droppingAsks is the seat's asks as a build module that does not know the job run takes them: a run ask is acknowledged and
+// never begun while the fake drops them.
+type droppingAsks struct {
+	gobuild.AskSource
+	f *fakeBuildModules
+}
+
+func (d droppingAsks) Next(ctx context.Context, kind string, wait time.Duration) (*gobuild.Pulled, error) {
+	msg, err := d.AskSource.Next(ctx, kind, wait)
+	if err != nil || msg == nil || !d.f.drop.Load() {
+		return msg, err
+	}
+	var a delivery.StepAsk
+	if json.Unmarshal(msg.Data, &a) == nil && a.Run != nil {
+		d.f.dropped.Add(1)
+		return nil, msg.Ack()
+	}
+	return msg, nil
 }
 
 // run answers a run ask as mesh-build-go does: the checking program's work (rules.Program) over the input the ask names,
@@ -220,7 +244,7 @@ func (f *fakeBuildModules) serve(t *testing.T, module string, kept jetstream.Key
 		raw, _ := value.(json.RawMessage)
 		return kv.Put(f.ctx, key, raw)
 	}
-	p := &gobuild.Puller{Source: &gobuild.JetStreamAsks{JS: f.js, Language: language}, Language: language, Node: "n1", Put: put,
+	p := &gobuild.Puller{Source: droppingAsks{&gobuild.JetStreamAsks{JS: f.js, Language: language}, f}, Language: language, Node: "n1", Put: put,
 		Capacity: func() int { return 2 }, PullWait: 200 * time.Millisecond,
 		Run: func(ctx context.Context, a delivery.StepAsk) (any, error) {
 			if a.Check != nil {
@@ -792,28 +816,54 @@ func keptCount(t *testing.T, b *bed) int {
 	return len(keys)
 }
 
-// TestAHeadThatDoesNotMergeFailsNamingTheFilesAndRunsNoTest: the fetch answers the files in conflict; the verdict fails naming
-// them, no test or digest step is run, a preview of the conflicts alone is written and the status is owed as failure.
-func TestAHeadThatDoesNotMergeFailsNamingTheFilesAndRunsNoTest(t *testing.T) { // 1289/AC4
-	b := startBed(t)
-	b.fake.conflict.Store(true)
-	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
-	b.start(t, nil)
-	v := b.verdict(t, key, ended)
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "files in conflict: a.go, sub/b.go") {
-		t.Fatalf("verdict = %+v", v)
-	}
-	if o := b.owed(t, 7, head1, "failure"); !strings.HasPrefix(o.Text, "failed: n1: ") || !strings.Contains(o.Text, "files in conflict: a.go, sub/b.go") {
-		t.Errorf("owed = %+v", o)
-	}
-	if n := b.fake.count("mesh-build-go.build_go_digest") + b.fake.count("mesh-build-go.build_go_test"); n != 0 {
-		t.Errorf("%d digest and test steps ran after a conflict", n)
-	}
-	pk, _ := delivery.PreviewKey(repo, head1, trunk)
-	if e, err := b.buckets[delivery.PreviewsBucket].Get(b.ctx, pk); err != nil {
-		t.Errorf("previews.%s: %v", pk, err)
-	} else if pv, err := delivery.DecodePreview(e.Value()); err != nil || strings.Join(pv.Conflicts, ",") != "a.go,sub/b.go" || pv.Merge != "" {
-		t.Errorf("preview = %+v, %v, want the files in conflict alone", pv, err)
+// TestACheckThatCannotBeJudgedFailsNamingWhy: a head that does not merge fails naming the files in conflict and runs no
+// test (1289/AC4); a checking program whose run asks no build node begins, and one that does not build, fail the check
+// naming the checking program, never judged by the running rules (issue 1921, the lead's ruling on milestone 47/B0: the
+// begin bound is the checker's setting, shortened here).
+func TestACheckThatCannotBeJudgedFailsNamingWhy(t *testing.T) { // 1289/AC4, 1921
+	for _, row := range []struct {
+		name    string
+		set     func(f *fakeBuildModules)
+		env     map[string]string
+		words   string
+		tests   bool  // the digest and test steps ran
+		dropped int32 // the run asks dropped: each put twice, the seat list's and the verdict's
+		program bool  // the checking program judged it
+	}{
+		{name: "a head that does not merge", set: func(f *fakeBuildModules) { f.conflict.Store(true) }, words: "files in conflict: a.go, sub/b.go", program: true},
+		{name: "a run ask no build node begins", set: func(f *fakeBuildModules) { f.drop.Store(true) }, env: map[string]string{"MESH_CHECKER_BEGIN_BOUND": "500ms"},
+			words: "no build node began the job run of the asks", tests: true, dropped: 4},
+		{name: "a program that does not build", set: func(f *fakeBuildModules) { f.broken.Store("go build: undefined: rules.Nothing") },
+			words: "by the checking program: its run ask", tests: true},
+	} {
+		t.Run(row.name, func(t *testing.T) {
+			b := startBed(t)
+			row.set(b.fake)
+			key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+			b.start(t, row.env)
+			v := b.verdict(t, key, ended)
+			if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.words) || (v.JudgedBy != nil) != row.program {
+				t.Fatalf("verdict = %+v, want a fail saying %q, judged by the program %v", v, row.words, row.program)
+			}
+			if o := b.owed(t, 7, head1, "failure"); !strings.HasPrefix(o.Text, "failed") ||
+				!strings.Contains(o.Text, map[bool]string{true: row.words, false: "the checking program"}[row.program]) {
+				t.Errorf("owed = %+v", o)
+			}
+			if n := b.fake.count("mesh-build-go.build_go_digest") + b.fake.count("mesh-build-go.build_go_test"); (n != 0) != row.tests {
+				t.Errorf("%d digest and test steps ran, want them run %v", n, row.tests)
+			}
+			if n := b.fake.dropped.Load(); n != row.dropped {
+				t.Errorf("%d run asks dropped, want %d", n, row.dropped)
+			}
+			if !row.tests {
+				pk, _ := delivery.PreviewKey(repo, head1, trunk)
+				if e, err := b.buckets[delivery.PreviewsBucket].Get(b.ctx, pk); err != nil {
+					t.Errorf("previews.%s: %v", pk, err)
+				} else if pv, err := delivery.DecodePreview(e.Value()); err != nil || strings.Join(pv.Conflicts, ",") != "a.go,sub/b.go" || pv.Merge != "" {
+					t.Errorf("preview = %+v, %v, want the files in conflict alone", pv, err)
+				}
+			}
+		})
 	}
 }
 
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
index 863eb35d..8c2c3430 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
@@ -25,12 +25,14 @@ import (
 // judgeDeps are the parts the judge of a check is made of.
 type judgeDeps struct {
 	// inputs keeps the checking program's inputs (check.InputsState).
-	inputs   check.Inputs
-	asks     check.Asks
-	tools    *buildrun.ToolchainSet
-	trunks   *check.Trunks
-	kept     check.KV
-	previews check.KV
+	inputs check.Inputs
+	// beginBound is how long a run ask may wait for a build node to begin it; check.DefaultBeginBound when 0.
+	beginBound time.Duration
+	asks       check.Asks
+	tools      *buildrun.ToolchainSet
+	trunks     *check.Trunks
+	kept       check.KV
+	previews   check.KV
 	// candidates answers the indexer's candidate of a try's group (try_candidates.go); nil leaves a whole try with no
 	// manifest or composition judged, said.
 	candidates check.TryCandidates
@@ -162,7 +164,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	ex := &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Candidates: d.candidates, Modules: d.repos, Packages: d.repos, Published: d.published, Forge: d.forge, Runs: d.repos, Builds: d.builds, BuildEnds: d.ends, BuildWait: d.buildWait, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Read: d.repos, Predefined: d.predefined, Inputs: d.inputs, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Candidates: d.candidates, Modules: d.repos, Packages: d.repos, Published: d.published, Forge: d.forge, Runs: d.repos, Builds: d.builds, BuildEnds: d.ends, BuildWait: d.buildWait, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Read: d.repos, Predefined: d.predefined, Inputs: d.inputs, BeginBound: d.beginBound, Logf: d.logf}
 	if d.nodes != nil && d.builds != nil && d.repos != nil {
 		ex.Serving = runningServes{have: d.nodes, builds: d.builds, read: d.repos, logf: d.logf}
 	}
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
index 8dfe2f28..375cf192 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
@@ -128,6 +128,11 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err != nil {
 		return err
 	}
+	// The begin bound of a run ask of the checking program (check.DefaultBeginBound, issue 1921).
+	beginBound, err := durationEnv(getenv, "MESH_CHECKER_BEGIN_BOUND", check.DefaultBeginBound)
+	if err != nil {
+		return err
+	}
 	link := strings.TrimSpace(getenv("MESH_CHECKER_LINK"))
 	if link == "" {
 		link = defaultLink
@@ -230,7 +235,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		asks: buildrun.Asker{Publisher: asks, Waiter: waiter, Bound: stepBound}, tools: tools, trunks: trunks,
 		kept: kvStore{buckets[delivery.CheckerKeptBucket]}, previews: kvStore{buckets[delivery.PreviewsBucket]}, candidates: tryCandidates{buckets[delivery.CandidatesBucket]},
 		repos: repos, published: published, builds: builds, ends: ends, buildWait: set.buildWait, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
-		announce: announce, compositions: compositions, inputs: runInputs{awaitedKV{inputsKV}},
+		announce: announce, compositions: compositions, inputs: runInputs{awaitedKV{inputsKV}}, beginBound: beginBound,
 		nodes: openNodeNames(ctx, js, logger.Printf),
 		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
 			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},

From fc921c13d000b390aab2be079329758a321f1efc Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:07:06 +0100
Subject: [PATCH 11/17] checker_verdicts and checker_pull say which checking
 program judged a verdict, its build and the heads it read (issue 1921)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-delivery-checker-tools/main.go   |  4 ++--
 .../internal/check/read.go                    | 23 ++++++++++++++++++-
 .../internal/check/read_test.go               | 14 ++++++++---
 3 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
index 2e29ae40..81101036 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
@@ -233,7 +233,7 @@ func SeatTryTools(tr Trying) []stdio.Tool {
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
 		{Name: check.VerdictsReadTool,
-			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, every failure it names one line each (every member's failed tests, refused steps and conflicts, the manifests' refusals and the composition), the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
+			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, every failure it names one line each (every member's failed tests, refused steps and conflicts, the manifests' refusals and the composition), the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against, the composition and which checking program judged it (judged: its build and the heads it read), with the full " +
 				"report of the status each pull request carries (the line the forge shows is cut at 140 characters, this is not). With a group, that group's only. Read-only.",
 			Input: map[string]any{"type": "object", "properties": map[string]any{
 				"group": map[string]any{"type": "string", "description": "the delivery group's branch name"}}},
@@ -243,7 +243,7 @@ func Tools(r check.Reader) []stdio.Tool {
 				return cutAnswer(map[string]any{"verdicts": vs}, cut), err
 			}},
 		{Name: check.PullReadTool,
-			Description: "The verdict that judges one pull request, every failure it names one line each (all of them, not only the first the status line shows), and the full report of its status mesh/check. Read-only.",
+			Description: "The verdict that judges one pull request, every failure it names one line each (all of them, not only the first the status line shows), which checking program judged it (judged: its build, its key and the heads it read), and the full report of its status mesh/check. Read-only.",
 			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
 				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
 				"number":     map[string]any{"type": "integer", "description": "the pull request's number"}}},
diff --git a/modules/mesh-delivery-checker/internal/check/read.go b/modules/mesh-delivery-checker/internal/check/read.go
index 3457cd47..39c6f61e 100644
--- a/modules/mesh-delivery-checker/internal/check/read.go
+++ b/modules/mesh-delivery-checker/internal/check/read.go
@@ -65,7 +65,10 @@ type VerdictRead struct {
 	Verdict json.RawMessage `json:"verdict"`
 	// Failed is everything the verdict names as failed, one line each, in the order judged (failedLines): every member's
 	// failed tests, refused steps and conflicts, the manifests' refusals and the composition (the operator, 2026-11-02).
-	Failed  []string          `json:"failed,omitempty"`
+	Failed []string `json:"failed,omitempty"`
+	// Judged says which checking program judged the verdict, in one line (judgedLine): where it was built, the key its build
+	// is kept under, whether this check built it, and the heads it read (issue 1921); empty for a verdict written before.
+	Judged  string            `json:"judged,omitempty"`
 	Reports map[string]string `json:"reports,omitempty"`
 	Note    string            `json:"note,omitempty"`
 }
@@ -90,6 +93,7 @@ func (r Reader) read(key string, raw json.RawMessage) (VerdictRead, error) {
 		return out, fmt.Errorf("%s holds what is not a verdict: %w", key, err)
 	}
 	out.Failed = failedLines(v)
+	out.Judged = judgedLine(v.JudgedBy)
 	c, ok := r.candidate(v.Group)
 	if !ok || (c.HeadsHash != v.Heads && GateHeads(c) != v.Heads) {
 		out.Note = "the candidate no longer holds these heads"
@@ -752,3 +756,20 @@ func (r Reader) buildsNotEnded(c delivery.Candidate) string {
 	sort.Strings(out)
 	return strings.Join(slices.Compact(out), ", ")
 }
+
+// judgedLine is a verdict's JudgedBy in one line, as the verdict tools answer it.
+func judgedLine(by *delivery.JudgedBy) string {
+	if by == nil {
+		return ""
+	}
+	built := "kept"
+	if by.Built {
+		built = "built for this check"
+	}
+	heads := make([]string, len(by.Heads))
+	for i, h := range by.Heads {
+		heads[i] = h.Repository + " " + h.Commit
+	}
+	return fmt.Sprintf("by the checking program %s of %s at %s (%s), %s as %s, over %s", by.Program.Package, by.Program.Repository,
+		by.Program.Commit, by.Program.Dir, built, by.Key, strings.Join(heads, ", "))
+}
diff --git a/modules/mesh-delivery-checker/internal/check/read_test.go b/modules/mesh-delivery-checker/internal/check/read_test.go
index c01589be..4da7a1ec 100644
--- a/modules/mesh-delivery-checker/internal/check/read_test.go
+++ b/modules/mesh-delivery-checker/internal/check/read_test.go
@@ -64,15 +64,23 @@ func TestTheVerdictToolsAnswerTheStoredVerdictWithTheFullReportOfEachPullRequest
 	if got := vs[0].Reports["novox/mesh-delivery#7"]; !strings.HasPrefix(got, "pass 111111111111 on aaaaaaaaaaaa") || !strings.Contains(got, "composition not yet run") {
 		t.Errorf("reports = %v", vs[0].Reports)
 	}
+	if vs[0].Judged != "" {
+		t.Errorf("judged = %q of a verdict with no JudgedBy", vs[0].Judged)
+	}
 	if only, _, _ := rd.Verdicts("feat/other"); len(only) != 0 {
 		t.Errorf("another group's verdicts = %+v", only)
 	}
 	// A failed verdict is answered with every failure it names, one line each (the operator, 2026-11-02).
 	raw, _ := delivery.EncodeVerdict(delivery.Verdict{Group: "feat/x", Heads: "0123456789ab", State: delivery.VerdictFail,
 		Failed:   delivery.FailedFirst{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom\nmore"},
-		Failures: []delivery.FailedFirst{{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom"}, {Machine: "g14", Words: "route-proxy is defined twice"}}})
-	if got, _ := rd.read(key, raw); strings.Join(got.Failed, " | ") != "unit: m/a.TestA: a_test.go:3: boom | g14: route-proxy is defined twice" {
-		t.Errorf("failed = %q", got.Failed)
+		Failures: []delivery.FailedFirst{{Test: "unit: m/a.TestA", Words: "a_test.go:3: boom"}, {Machine: "g14", Words: "route-proxy is defined twice"}},
+		// Issue 1921: it names the checking program that judged it, its build and the heads it read.
+		JudgedBy: &delivery.JudgedBy{Program: delivery.RunProgram{Repository: repoA, Commit: head1, Dir: CheckingProgramDir, Package: CheckingProgramPackage},
+			Key: "program-0123456789abcdef", Built: true, Heads: []delivery.RunHead{{Repository: repoA, Commit: head1}}}})
+	want := "by the checking program " + CheckingProgramPackage + " of " + repoA + " at " + head1 + " (" + CheckingProgramDir +
+		"), built for this check as program-0123456789abcdef, over " + repoA + " " + head1
+	if got, _ := rd.read(key, raw); strings.Join(got.Failed, " | ") != "unit: m/a.TestA: a_test.go:3: boom | g14: route-proxy is defined twice" || got.Judged != want {
+		t.Errorf("failed = %q, judged %q, want %q", got.Failed, got.Judged, want)
 	}
 }
 

From 06cb0cdd92bcfed667bbc480869c17b6773df1a1 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:08:49 +0100
Subject: [PATCH 12/17] Merge the line, failure-words and package-cause tests
 into tables: the repository's unit count goes from 805 to 791 (issue 1921)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../internal/check/failure_words_test.go      | 155 +++++++-------
 .../internal/check/line_test.go               | 191 +++++++++---------
 .../internal/check/package_cause_test.go      | 134 ++++++------
 3 files changed, 248 insertions(+), 232 deletions(-)

diff --git a/modules/mesh-delivery-checker/internal/check/failure_words_test.go b/modules/mesh-delivery-checker/internal/check/failure_words_test.go
index 0d9edc4b..b5b59de3 100644
--- a/modules/mesh-delivery-checker/internal/check/failure_words_test.go
+++ b/modules/mesh-delivery-checker/internal/check/failure_words_test.go
@@ -21,81 +21,88 @@ func fatalAfterLog() Failure {
 	}
 }
 
-func TestAFailedTestsVerdictKeepsItsWholeFailureMessage(t *testing.T) { // 1901/AC1
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
-	for _, want := range []string{"3 subscription(s) derive to a subject no emitter owns:", "a.b.c", "d.e.f", "g.h.i"} {
-		if !strings.Contains(v.Failed.Words, want) {
-			t.Errorf("words lack %q: %q", want, v.Failed.Words)
-		}
-	}
-	if len(v.Failed.Words) > rules.MaxWords+200 {
-		t.Errorf("words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
-	}
-}
-
-func TestTheStatusLineNamesTheFailureNotTheFirstLoggedLine(t *testing.T) { // 1901/AC2
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
-	got := firstFailed(*v)
-	if !strings.Contains(got, "3 subscription(s) derive to a subject no emitter owns:") || strings.Contains(got, "judged against") || strings.Contains(got, "\n") {
-		t.Errorf("firstFailed = %q", got)
-	}
-	// With no cause told apart (an older build module), the words still start at the first line, as before.
-	f := fatalAfterLog()
-	f.Cause = ""
-	v = rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
-	if !strings.HasPrefix(afterHid(v.Failed.Words), "agreement_catalogue_test.go:130") {
-		t.Errorf("words = %q", v.Failed.Words)
-	}
-}
-
-func TestWordsLongerThanTheBoundKeepTheirLastLines(t *testing.T) { // 1901/AC1
-	f := Failure{Output: strings.Repeat("log line of some length\n", 500) + "the cause is here"}
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
-	if !strings.HasSuffix(v.Failed.Words, "the cause is here") || len(v.Failed.Words) > rules.MaxWords+200 {
-		t.Errorf("%d bytes, ends %q", len(v.Failed.Words), v.Failed.Words[len(v.Failed.Words)-30:])
-	}
-	_ = delivery.VerdictFail
-}
-
-// An older build module sends no "cause": its answer is still accepted and the verdict's words are its output, as before
-// (1901/AC3). A failure that hides its cause (none, or a passing line) is said loudly first in the words and in the status
-// line, naming the build module and the version it says it is, and the level still fails; a failure that keeps the
-// contract is worded as before (1901/AC8).
-func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) { // 1901/AC3, AC8
-	old := `{"package":"p","test":"TestX","output":"x_test.go:1: logged\nx_test.go:2: the old kept lines"}`
-	var f Failure
-	if err := json.Unmarshal([]byte(old), &f); err != nil || f.Cause != "" {
-		t.Fatalf("1901/AC3: err = %v, cause = %q", err, f.Cause)
-	}
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
-	if afterHid(v.Failed.Words) != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
-		t.Errorf("1901/AC3: words = %q", v.Failed.Words)
-	}
-	if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.Contains(got, "\n") {
-		t.Errorf("1901/AC3, AC8: status = %q", got)
-	}
-
-	by := "mesh-build-node with mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78"
-	for _, c := range []struct {
-		name, module, by, cause, output, loud string
+// A failed test's words are its whole failure message, kept within their bound by their last lines (issue 1901).
+func TestAFailuresWordsAreItsWholeMessageWithinTheirBound(t *testing.T) {
+	for _, row := range []struct {
+		name string
+		test func(t *testing.T)
 	}{
-		{"no cause", "mesh-build-node", by, "", "test/b.test.ts: something", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): it sent no cause"},
-		{"a passing line as its cause", "mesh-build-node", by, "\u2714 the same merge has the same id (8.006913ms)", "", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): its cause is a passing line"},
-		{"from before the contract", "mesh-build-node", "", "", "\u2714 the same merge has the same id (8.006913ms)", "the build module hid the failure (mesh-build-node at a version before the failure contract): it sent no cause"},
-		{"a real cause", "mesh-build-node", by, "one plus one is not three", "not ok 3 - fails", ""},
+		{"a failed tests verdict keeps its whole failure message", func(t *testing.T) { // 1901/AC1
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
+			for _, want := range []string{"3 subscription(s) derive to a subject no emitter owns:", "a.b.c", "d.e.f", "g.h.i"} {
+				if !strings.Contains(v.Failed.Words, want) {
+					t.Errorf("words lack %q: %q", want, v.Failed.Words)
+				}
+			}
+			if len(v.Failed.Words) > rules.MaxWords+200 {
+				t.Errorf("words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
+			}
+		}},
+		{"the status line names the failure not the first logged line", func(t *testing.T) { // 1901/AC2
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{fatalAfterLog()}})
+			got := firstFailed(*v)
+			if !strings.Contains(got, "3 subscription(s) derive to a subject no emitter owns:") || strings.Contains(got, "judged against") || strings.Contains(got, "\n") {
+				t.Errorf("firstFailed = %q", got)
+			}
+			// With no cause told apart (an older build module), the words still start at the first line, as before.
+			f := fatalAfterLog()
+			f.Cause = ""
+			v = rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+			if !strings.HasPrefix(afterHid(v.Failed.Words), "agreement_catalogue_test.go:130") {
+				t.Errorf("words = %q", v.Failed.Words)
+			}
+		}},
+		{"words longer than the bound keep their last lines", func(t *testing.T) { // 1901/AC1
+			f := Failure{Output: strings.Repeat("log line of some length\n", 500) + "the cause is here"}
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+			if !strings.HasSuffix(v.Failed.Words, "the cause is here") || len(v.Failed.Words) > rules.MaxWords+200 {
+				t.Errorf("%d bytes, ends %q", len(v.Failed.Words), v.Failed.Words[len(v.Failed.Words)-30:])
+			}
+			_ = delivery.VerdictFail
+		}},
+		// An older build module sends no "cause": its answer is still accepted and the verdict's words are its output, as before
+		// (1901/AC3). A failure that hides its cause (none, or a passing line) is said loudly first in the words and in the status
+		// line, naming the build module and the version it says it is, and the level still fails; a failure that keeps the
+		// contract is worded as before (1901/AC8).
+		{"an older build modules failure is accepted with its whole output", func(t *testing.T) { // 1901/AC3, AC8
+			old := `{"package":"p","test":"TestX","output":"x_test.go:1: logged\nx_test.go:2: the old kept lines"}`
+			var f Failure
+			if err := json.Unmarshal([]byte(old), &f); err != nil || f.Cause != "" {
+				t.Fatalf("1901/AC3: err = %v, cause = %q", err, f.Cause)
+			}
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+			if afterHid(v.Failed.Words) != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
+				t.Errorf("1901/AC3: words = %q", v.Failed.Words)
+			}
+			if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.Contains(got, "\n") {
+				t.Errorf("1901/AC3, AC8: status = %q", got)
+			}
+
+			by := "mesh-build-node with mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78"
+			for _, c := range []struct {
+				name, module, by, cause, output, loud string
+			}{
+				{"no cause", "mesh-build-node", by, "", "test/b.test.ts: something", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): it sent no cause"},
+				{"a passing line as its cause", "mesh-build-node", by, "\u2714 the same merge has the same id (8.006913ms)", "", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): its cause is a passing line"},
+				{"from before the contract", "mesh-build-node", "", "", "\u2714 the same merge has the same id (8.006913ms)", "the build module hid the failure (mesh-build-node at a version before the failure contract): it sent no cause"},
+				{"a real cause", "mesh-build-node", by, "one plus one is not three", "not ok 3 - fails", ""},
+			} {
+				t.Run(c.name, func(t *testing.T) {
+					v := rules.LevelFailure("", c.module, "unit", Tested{By: c.by, Failed: []Failure{{Package: "modules/gitea", Test: "fails", Cause: c.cause, Output: c.output}}})
+					if v.State != delivery.VerdictFail {
+						t.Errorf("1901/AC8: the verdict is %q, want it failed", v.State)
+					}
+					line := firstFailed(*v)
+					switch {
+					case c.loud == "" && strings.Contains(v.Failed.Words, "hid the failure"):
+						t.Errorf("1901/AC8: a failure that keeps the contract is said hidden: %q", v.Failed.Words)
+					case c.loud != "" && (!strings.HasPrefix(v.Failed.Words, c.loud) || !strings.Contains(line, c.loud) || !strings.Contains(v.Failures[0].Words, "hid the failure")):
+						t.Errorf("1901/AC8: words %q, status %q, want both to start with %q", v.Failed.Words, line, c.loud)
+					}
+				})
+			}
+		}},
 	} {
-		t.Run(c.name, func(t *testing.T) {
-			v := rules.LevelFailure("", c.module, "unit", Tested{By: c.by, Failed: []Failure{{Package: "modules/gitea", Test: "fails", Cause: c.cause, Output: c.output}}})
-			if v.State != delivery.VerdictFail {
-				t.Errorf("1901/AC8: the verdict is %q, want it failed", v.State)
-			}
-			line := firstFailed(*v)
-			switch {
-			case c.loud == "" && strings.Contains(v.Failed.Words, "hid the failure"):
-				t.Errorf("1901/AC8: a failure that keeps the contract is said hidden: %q", v.Failed.Words)
-			case c.loud != "" && (!strings.HasPrefix(v.Failed.Words, c.loud) || !strings.Contains(line, c.loud) || !strings.Contains(v.Failures[0].Words, "hid the failure")):
-				t.Errorf("1901/AC8: words %q, status %q, want both to start with %q", v.Failed.Words, line, c.loud)
-			}
-		})
+		t.Run(row.name, row.test)
 	}
 }
diff --git a/modules/mesh-delivery-checker/internal/check/line_test.go b/modules/mesh-delivery-checker/internal/check/line_test.go
index 66cbbdb4..9daa92c6 100644
--- a/modules/mesh-delivery-checker/internal/check/line_test.go
+++ b/modules/mesh-delivery-checker/internal/check/line_test.go
@@ -66,100 +66,103 @@ func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { //
 	}
 }
 
-func TestALevelOverItsBoundIsNamedWithItsSlowestTestsAndTheVerdictIsNotChanged(t *testing.T) { // 1300/AC3
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	v := passVerdict()
-	v.OverBound = []string{"unit"}
-	line := Line(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"}, nil)
-	if !strings.HasPrefix(line, "pass ") || !strings.Contains(Report(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"}, nil), "over bound: unit (slowest unit pkg.TestSlow 7.0s)") {
-		t.Errorf("line = %q", line)
-	}
-}
-
-func TestSkippedTestsAreSaidAndNeverAFlatPass(t *testing.T) { // 1300/AC6
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	v := passVerdict()
-	v.Levels[delivery.LevelUnit] = delivery.LevelResult{Run: 12, Kept: 301, Skipped: 2}
-	if line := Line(v, cs, p, nil, nil, nil); !strings.Contains(line, "unit 12 run, 301 kept, 2 skipped") {
-		t.Errorf("line = %q", line)
-	}
-}
-
-func TestAGroupsMembersEachCarryTheSameVerdict(t *testing.T) { // 1300/AC4
-	cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
-	a := Line(passVerdict(), cs, cs.Pulls[0], nil, nil, nil)
-	b := Line(passVerdict(), cs, cs.Pulls[1], nil, nil, nil)
-	if !strings.HasPrefix(a, "pass ") || !strings.HasPrefix(b, "pass ") || !strings.Contains(Report(passVerdict(), cs, cs.Pulls[0], nil, nil, nil), "group feat/x of 2 pull requests") {
-		t.Errorf("lines %q and %q", a, b)
-	}
-	if !strings.Contains(a, "111111111111") || !strings.Contains(b, "222222222222") {
-		t.Errorf("each member's line names its own head: %q and %q", a, b)
-	}
-}
-
-func TestTheBuildsOfTheTouchedModulesAreSaidAndDroppedFirstWhenTheLineIsTooLong(t *testing.T) { // ADR 0484 clause 7
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	builds := []BuildNote{{"avahi", "built"}, {"mesh-tools", "waiting"}}
-	if r := Report(passVerdict(), cs, p, builds, nil, nil); !strings.Contains(r, "builds: avahi built, mesh-tools waiting") {
-		t.Errorf("report = %q", r)
-	}
-	line := Line(passVerdict(), cs, p, builds, nil, nil)
-	if utf8.RuneCountInString(line) > MaxLine {
-		t.Errorf("line %q is too long", line)
-	}
-	short := passVerdict()
-	short.Took = delivery.Took{}
-	if l := Line(short, cs, p, builds[:1], nil, nil); !strings.Contains(l, "builds: avahi built") {
-		t.Errorf("a short line keeps its builds: %q", l)
-	}
-}
-
-func TestALineIsNeverLongerThanTheLimit(t *testing.T) { // 1300/AC1
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "integration: " + strings.Repeat("pkg/", 50) + ".TestSomething", Words: strings.Repeat("because ", 40)}}
-	if line := Line(v, cs, p, nil, nil, nil); utf8.RuneCountInString(line) > MaxLine || !strings.HasPrefix(line, "failed: integration: ") {
-		t.Errorf("line = %q (%d)", line, utf8.RuneCountInString(line))
-	}
-}
-
-func TestARunningCheckIsPending(t *testing.T) {
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	if line := Line(delivery.Verdict{State: delivery.VerdictRunning}, cs, p, nil, nil, nil); line != "checking 111111111111 on aaaaaaaaaaaa" {
-		t.Errorf("line = %q", line)
-	}
-}
-
-func TestThePassedCompositionIsSaidOnlyWhenItWasRun(t *testing.T) { // ADR 0484 clause 6
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	v := passVerdict()
-	v.Composition = &delivery.Composition{State: delivery.CompositionPass, SDK: "afbe371003a570f088be4a394d83aa7a9458f7ab"}
-	if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition passed with afbe371003a5") {
-		t.Errorf("report = %q", r)
-	}
-	v.Composition = nil
-	if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition not yet run") || strings.Contains(r, "composition passed") {
-		t.Errorf("a verdict with no composition: %q", r)
-	}
-}
-
-func TestTheCompositionsTimeAndMachinesAreSaidOnceTheAssignerReportsThem(t *testing.T) { // 1300 (C10), the assigner's verdict (issue 1297)
-	cs, p := lineCase(t, pullOf(repoA, 7, head1))
-	v := passVerdict()
-	v.Took.Composition = 2400
-	v.Composition = &delivery.Composition{State: delivery.CompositionPass, SDK: "afbe371003a570f088be4a394d83aa7a9458f7ab", Machines: []string{"g14", "ace", "novox", "shanks"}}
-	r := Report(v, cs, p, nil, nil, nil)
-	for _, want := range []string{"composition passed in 2.4s with afbe371003a5 on 4 machines: ace, g14, novox, shanks"} {
-		if !strings.Contains(r, want) {
-			t.Errorf("report %q lacks %q", r, want)
-		}
-	}
-	if l := Line(v, cs, p, nil, nil, nil); !strings.Contains(l, "composition passed in 2.4s") || !strings.Contains(l, "on 4 machines") || utf8.RuneCountInString(l) > MaxLine {
-		t.Errorf("line = %q", l)
-	}
-	v.State, v.Failed = delivery.VerdictFail, delivery.FailedFirst{Machine: "novox", Words: "composition refused"}
-	v.Composition = &delivery.Composition{State: delivery.CompositionFail, Words: "novox: two seats claim dns", Machines: []string{"novox"}}
-	if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition failed in 2.4s on novox: novox: two seats claim dns") {
-		t.Errorf("failed composition report = %q", r)
+// The status line and its full report say each part of a verdict, within the forge's limit (issue 1300, ADR 0484).
+func TestTheLineAndTheReportSayEachPartOfTheVerdict(t *testing.T) {
+	for _, row := range []struct {
+		name string
+		test func(t *testing.T)
+	}{
+		{"a level over its bound is named with its slowest tests and the verdict is not changed", func(t *testing.T) { // 1300/AC3
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			v := passVerdict()
+			v.OverBound = []string{"unit"}
+			line := Line(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"}, nil)
+			if !strings.HasPrefix(line, "pass ") || !strings.Contains(Report(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"}, nil), "over bound: unit (slowest unit pkg.TestSlow 7.0s)") {
+				t.Errorf("line = %q", line)
+			}
+		}},
+		{"skipped tests are said and never a flat pass", func(t *testing.T) { // 1300/AC6
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			v := passVerdict()
+			v.Levels[delivery.LevelUnit] = delivery.LevelResult{Run: 12, Kept: 301, Skipped: 2}
+			if line := Line(v, cs, p, nil, nil, nil); !strings.Contains(line, "unit 12 run, 301 kept, 2 skipped") {
+				t.Errorf("line = %q", line)
+			}
+		}},
+		{"a groups members each carry the same verdict", func(t *testing.T) { // 1300/AC4
+			cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
+			a := Line(passVerdict(), cs, cs.Pulls[0], nil, nil, nil)
+			b := Line(passVerdict(), cs, cs.Pulls[1], nil, nil, nil)
+			if !strings.HasPrefix(a, "pass ") || !strings.HasPrefix(b, "pass ") || !strings.Contains(Report(passVerdict(), cs, cs.Pulls[0], nil, nil, nil), "group feat/x of 2 pull requests") {
+				t.Errorf("lines %q and %q", a, b)
+			}
+			if !strings.Contains(a, "111111111111") || !strings.Contains(b, "222222222222") {
+				t.Errorf("each member's line names its own head: %q and %q", a, b)
+			}
+		}},
+		{"the builds of the touched modules are said and dropped first when the line is too long", func(t *testing.T) { // ADR 0484 clause 7
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			builds := []BuildNote{{"avahi", "built"}, {"mesh-tools", "waiting"}}
+			if r := Report(passVerdict(), cs, p, builds, nil, nil); !strings.Contains(r, "builds: avahi built, mesh-tools waiting") {
+				t.Errorf("report = %q", r)
+			}
+			line := Line(passVerdict(), cs, p, builds, nil, nil)
+			if utf8.RuneCountInString(line) > MaxLine {
+				t.Errorf("line %q is too long", line)
+			}
+			short := passVerdict()
+			short.Took = delivery.Took{}
+			if l := Line(short, cs, p, builds[:1], nil, nil); !strings.Contains(l, "builds: avahi built") {
+				t.Errorf("a short line keeps its builds: %q", l)
+			}
+		}},
+		{"a line is never longer than the limit", func(t *testing.T) { // 1300/AC1
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "integration: " + strings.Repeat("pkg/", 50) + ".TestSomething", Words: strings.Repeat("because ", 40)}}
+			if line := Line(v, cs, p, nil, nil, nil); utf8.RuneCountInString(line) > MaxLine || !strings.HasPrefix(line, "failed: integration: ") {
+				t.Errorf("line = %q (%d)", line, utf8.RuneCountInString(line))
+			}
+		}},
+		{"a running check is pending", func(t *testing.T) {
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			if line := Line(delivery.Verdict{State: delivery.VerdictRunning}, cs, p, nil, nil, nil); line != "checking 111111111111 on aaaaaaaaaaaa" {
+				t.Errorf("line = %q", line)
+			}
+		}},
+		{"the passed composition is said only when it was run", func(t *testing.T) { // ADR 0484 clause 6
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			v := passVerdict()
+			v.Composition = &delivery.Composition{State: delivery.CompositionPass, SDK: "afbe371003a570f088be4a394d83aa7a9458f7ab"}
+			if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition passed with afbe371003a5") {
+				t.Errorf("report = %q", r)
+			}
+			v.Composition = nil
+			if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition not yet run") || strings.Contains(r, "composition passed") {
+				t.Errorf("a verdict with no composition: %q", r)
+			}
+		}},
+		{"the compositions time and machines are said once the assigner reports them", func(t *testing.T) { // 1300 (C10), the assigner's verdict (issue 1297)
+			cs, p := lineCase(t, pullOf(repoA, 7, head1))
+			v := passVerdict()
+			v.Took.Composition = 2400
+			v.Composition = &delivery.Composition{State: delivery.CompositionPass, SDK: "afbe371003a570f088be4a394d83aa7a9458f7ab", Machines: []string{"g14", "ace", "novox", "shanks"}}
+			r := Report(v, cs, p, nil, nil, nil)
+			for _, want := range []string{"composition passed in 2.4s with afbe371003a5 on 4 machines: ace, g14, novox, shanks"} {
+				if !strings.Contains(r, want) {
+					t.Errorf("report %q lacks %q", r, want)
+				}
+			}
+			if l := Line(v, cs, p, nil, nil, nil); !strings.Contains(l, "composition passed in 2.4s") || !strings.Contains(l, "on 4 machines") || utf8.RuneCountInString(l) > MaxLine {
+				t.Errorf("line = %q", l)
+			}
+			v.State, v.Failed = delivery.VerdictFail, delivery.FailedFirst{Machine: "novox", Words: "composition refused"}
+			v.Composition = &delivery.Composition{State: delivery.CompositionFail, Words: "novox: two seats claim dns", Machines: []string{"novox"}}
+			if r := Report(v, cs, p, nil, nil, nil); !strings.Contains(r, "composition failed in 2.4s on novox: novox: two seats claim dns") {
+				t.Errorf("failed composition report = %q", r)
+			}
+		}},
+	} {
+		t.Run(row.name, row.test)
 	}
 }
 
diff --git a/modules/mesh-delivery-checker/internal/check/package_cause_test.go b/modules/mesh-delivery-checker/internal/check/package_cause_test.go
index 2e1e3ad1..5e1ada4e 100644
--- a/modules/mesh-delivery-checker/internal/check/package_cause_test.go
+++ b/modules/mesh-delivery-checker/internal/check/package_cause_test.go
@@ -20,75 +20,81 @@ const (
 	oldPassThenRace = "PASS\n==================\nWARNING: DATA RACE\nWrite at 0x000000836428 by goroutine 9:\n  example.com/racemain.TestMain.func1()\n      /tmp/fix-1901b/racemain/p_test.go:15 +0x24\nPrevious write at 0x000000836428 by main goroutine:\n  example.com/racemain.TestMain()\n      /tmp/fix-1901b/racemain/p_test.go:16 +0x44\n  main.main()\n      _testmain.go:48 +0x171\nGoroutine 9 (running) created at:\n  example.com/racemain.TestMain()\n      /tmp/fix-1901b/racemain/p_test.go:15 +0x37\n  main.main()\n      _testmain.go:48 +0x171\n==================\nFound 1 data race(s)\nFAIL\texample.com/racemain\t1.031s"
 )
 
-// A failure with no cause told apart never has "PASS" or "ok" as its words: the checker takes the panic line from the
-// output, or says that the tests passed and the program failed after them (1901/AC5).
-func TestAPackageFailureIsNeverWordedPass(t *testing.T) { // 1901/AC5
-	cases := []struct {
-		name, output, want string
+// A package's failure is worded by its cause, cut to its bound, and never as pass (issue 1901, AC5).
+func TestAPackageFailuresCauseIsWordedNeverPass(t *testing.T) {
+	for _, row := range []struct {
+		name string
+		test func(t *testing.T)
 	}{
-		{"panic after the tests", oldPassThenPanic, "panic: the bus closed after the tests: nats: connection closed"},
-		{"exit after the tests", oldPassThenExit, "the tests passed, then the test program exited with a failure"},
-		{"race after the tests", oldPassThenRace, "WARNING: DATA RACE: Write at 0x000000836428 by goroutine 9 in example.com/racemain.TestMain.func1()"},
-		{"a panic deep in a long output", "PASS\npanic: the seat row vanished\n" + strings.Repeat("goroutine 7 [chan receive]:\n\tsome/frame.go:1 +0x1\n", 300) + "FAIL\tp\t2.0s", "panic: the seat row vanished"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "github.com/novox/mesh-controller/cmd/mesh-controller", Output: c.output}}})
-			for _, l := range strings.Split(v.Failed.Words, "\n") {
-				if l = strings.TrimSpace(l); l == "PASS" || strings.HasPrefix(l, "ok ") || strings.HasPrefix(l, "ok\t") {
-					t.Errorf("1901/AC5: the words keep %q: %q", l, v.Failed.Words)
+		// A failure with no cause told apart never has "PASS" or "ok" as its words: the checker takes the panic line from the
+		// output, or says that the tests passed and the program failed after them (1901/AC5).
+		{"a package failure is never worded pass", func(t *testing.T) { // 1901/AC5
+			cases := []struct {
+				name, output, want string
+			}{
+				{"panic after the tests", oldPassThenPanic, "panic: the bus closed after the tests: nats: connection closed"},
+				{"exit after the tests", oldPassThenExit, "the tests passed, then the test program exited with a failure"},
+				{"race after the tests", oldPassThenRace, "WARNING: DATA RACE: Write at 0x000000836428 by goroutine 9 in example.com/racemain.TestMain.func1()"},
+				{"a panic deep in a long output", "PASS\npanic: the seat row vanished\n" + strings.Repeat("goroutine 7 [chan receive]:\n\tsome/frame.go:1 +0x1\n", 300) + "FAIL\tp\t2.0s", "panic: the seat row vanished"},
+			}
+			for _, c := range cases {
+				t.Run(c.name, func(t *testing.T) {
+					v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "github.com/novox/mesh-controller/cmd/mesh-controller", Output: c.output}}})
+					for _, l := range strings.Split(v.Failed.Words, "\n") {
+						if l = strings.TrimSpace(l); l == "PASS" || strings.HasPrefix(l, "ok ") || strings.HasPrefix(l, "ok\t") {
+							t.Errorf("1901/AC5: the words keep %q: %q", l, v.Failed.Words)
+						}
+					}
+					if !strings.HasPrefix(afterHid(v.Failed.Words), c.want) {
+						t.Errorf("1901/AC5: words after the loud line start %q, want %q", rules.FirstLine(afterHid(v.Failed.Words)), c.want)
+					}
+					if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.HasSuffix(got, ": PASS") {
+						t.Errorf("1901/AC5, AC8: status = %q", got)
+					}
+				})
+			}
+		}},
+		// A cause the build module told apart is cut to a line's bound, so the words keep their bound (the 1901 review's note).
+		{"a long cause is cut to a lines bound", func(t *testing.T) { // 1901/AC5
+			f := Failure{Package: "p", Test: "TestX", Cause: strings.Repeat("c", 5000), Output: "x_test.go:1: something"}
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
+			if len(v.Failed.Words) > rules.MaxWords+200 {
+				t.Errorf("1901/AC5: words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
+			}
+		}},
+		// The build module on main sends a package that stopped (a timeout, an exit, a kill) as only go test's last line, with no
+		// cause: the words then say so, never nothing (review round 1). Each output is what that build module sends for the
+		// capture of the same name (go-test-json-pkg-timeout, -exiting, -killed): the package's own output, its "FAIL" line.
+		{"a package stopped with only its fail line is still worded", func(t *testing.T) { // 1901/AC5
+			for _, out := range []string{"FAIL\texample.com/timeout\t2.017s", "FAIL\texample.com/exiting\t0.006s", "FAIL\texample.com/killed\t0.006s"} {
+				v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
+				if !strings.HasPrefix(afterHid(v.Failed.Words), "the package failed with no test to name and no panic, signal or build error in its output") {
+					t.Errorf("1901/AC5: %q is worded %q", out, v.Failed.Words)
 				}
 			}
-			if !strings.HasPrefix(afterHid(v.Failed.Words), c.want) {
-				t.Errorf("1901/AC5: words after the loud line start %q, want %q", rules.FirstLine(afterHid(v.Failed.Words)), c.want)
+		}},
+		// A line of the test's own that starts as go's summary does, or that holds a runtime's words indented, is not taken for
+		// either (review round 1): go prints its summary in exact forms and the runtime's lines at column 0.
+		{"only gos exact forms are summary or cause", func(t *testing.T) { // 1901/AC5
+			out := "    x_test.go:3: ok so far\nok then: the seat is free\n        panic: child retried and recovered\npanic: the real one\nFAIL\tp\t1.0s"
+			v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
+			if !strings.HasPrefix(afterHid(v.Failed.Words), "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
+				t.Errorf("1901/AC5: words = %q", v.Failed.Words)
 			}
-			if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.HasSuffix(got, ": PASS") {
-				t.Errorf("1901/AC5, AC8: status = %q", got)
+		}},
+		// The words keep rules.MaxWords exactly, counting the cause, the marker and the newlines (review round 1).
+		{"the words keep their bound exactly", func(t *testing.T) { // 1901/AC5
+			for _, cause := range []string{"", "a cause", strings.Repeat("c", 3000)} {
+				for _, n := range []int{100, 170, 171, 172, 500} {
+					f := Failure{Package: "p", Test: "TestX", Cause: cause, Output: strings.Repeat("a log line of twenty\n", n) + "the end"}
+					if w := rules.FailureWords(f); len(w) > rules.MaxWords {
+						t.Errorf("1901/AC5: cause %d bytes, %d lines: words are %d bytes, bound %d", len(cause), n, len(w), rules.MaxWords)
+					}
+				}
 			}
-		})
-	}
-}
-
-// A cause the build module told apart is cut to a line's bound, so the words keep their bound (the 1901 review's note).
-func TestALongCauseIsCutToALinesBound(t *testing.T) { // 1901/AC5
-	f := Failure{Package: "p", Test: "TestX", Cause: strings.Repeat("c", 5000), Output: "x_test.go:1: something"}
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{f}})
-	if len(v.Failed.Words) > rules.MaxWords+200 {
-		t.Errorf("1901/AC5: words are %d bytes, bound %d", len(v.Failed.Words), rules.MaxWords)
-	}
-}
-
-// The build module on main sends a package that stopped (a timeout, an exit, a kill) as only go test's last line, with no
-// cause: the words then say so, never nothing (review round 1). Each output is what that build module sends for the
-// capture of the same name (go-test-json-pkg-timeout, -exiting, -killed): the package's own output, its "FAIL" line.
-func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901/AC5
-	for _, out := range []string{"FAIL\texample.com/timeout\t2.017s", "FAIL\texample.com/exiting\t0.006s", "FAIL\texample.com/killed\t0.006s"} {
-		v := rules.LevelFailure("", "", "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
-		if !strings.HasPrefix(afterHid(v.Failed.Words), "the package failed with no test to name and no panic, signal or build error in its output") {
-			t.Errorf("1901/AC5: %q is worded %q", out, v.Failed.Words)
-		}
-	}
-}
-
-// A line of the test's own that starts as go's summary does, or that holds a runtime's words indented, is not taken for
-// either (review round 1): go prints its summary in exact forms and the runtime's lines at column 0.
-func TestOnlyGosExactFormsAreSummaryOrCause(t *testing.T) { // 1901/AC5
-	out := "    x_test.go:3: ok so far\nok then: the seat is free\n        panic: child retried and recovered\npanic: the real one\nFAIL\tp\t1.0s"
-	v := rules.LevelFailure("", "", "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
-	if !strings.HasPrefix(afterHid(v.Failed.Words), "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
-		t.Errorf("1901/AC5: words = %q", v.Failed.Words)
-	}
-}
-
-// The words keep rules.MaxWords exactly, counting the cause, the marker and the newlines (review round 1).
-func TestTheWordsKeepTheirBoundExactly(t *testing.T) { // 1901/AC5
-	for _, cause := range []string{"", "a cause", strings.Repeat("c", 3000)} {
-		for _, n := range []int{100, 170, 171, 172, 500} {
-			f := Failure{Package: "p", Test: "TestX", Cause: cause, Output: strings.Repeat("a log line of twenty\n", n) + "the end"}
-			if w := rules.FailureWords(f); len(w) > rules.MaxWords {
-				t.Errorf("1901/AC5: cause %d bytes, %d lines: words are %d bytes, bound %d", len(cause), n, len(w), rules.MaxWords)
-			}
-		}
+		}},
+	} {
+		t.Run(row.name, row.test)
 	}
 }
 

From b1d0c6881a84428fb721ab8c0c40fb1892bc47aa Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:24:18 +0100
Subject: [PATCH 13/17] The facts carry a level as the rules read it, and a
 seat list the program cannot make ends the check without a verdict asked
 (issue 1921, B0 review round 1)

A level's digest, unmet packages, kept packages' names and test packages are read by no rule: a mesh-catalog check
step's two levels were 78682 bytes as facts and are 4506. A build node with no job run held a check four begin bounds;
it now holds it two.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../mesh-delivery-checker/integration_test.go |  4 +--
 .../internal/check/examiner_test.go           | 18 +++++++----
 .../internal/check/judge.go                   | 20 ++++++++-----
 .../internal/check/programs.go                | 11 ++++---
 modules/mesh-delivery-checker/rules/facts.go  | 30 +++++++++++++++++++
 5 files changed, 65 insertions(+), 18 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
index 9b53cce8..f85f0add 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
@@ -827,12 +827,12 @@ func TestACheckThatCannotBeJudgedFailsNamingWhy(t *testing.T) { // 1289/AC4, 192
 		env     map[string]string
 		words   string
 		tests   bool  // the digest and test steps ran
-		dropped int32 // the run asks dropped: each put twice, the seat list's and the verdict's
+		dropped int32 // the run asks dropped: the seat list's, put twice, and no verdict asked after it
 		program bool  // the checking program judged it
 	}{
 		{name: "a head that does not merge", set: func(f *fakeBuildModules) { f.conflict.Store(true) }, words: "files in conflict: a.go, sub/b.go", program: true},
 		{name: "a run ask no build node begins", set: func(f *fakeBuildModules) { f.drop.Store(true) }, env: map[string]string{"MESH_CHECKER_BEGIN_BOUND": "500ms"},
-			words: "no build node began the job run of the asks", tests: true, dropped: 4},
+			words: "no build node began the job run of the asks", tests: true, dropped: 2},
 		{name: "a program that does not build", set: func(f *fakeBuildModules) { f.broken.Store("go build: undefined: rules.Nothing") },
 			words: "by the checking program: its run ask", tests: true},
 	} {
diff --git a/modules/mesh-delivery-checker/internal/check/examiner_test.go b/modules/mesh-delivery-checker/internal/check/examiner_test.go
index efa9362d..a755ef7a 100644
--- a/modules/mesh-delivery-checker/internal/check/examiner_test.go
+++ b/modules/mesh-delivery-checker/internal/check/examiner_test.go
@@ -380,16 +380,16 @@ func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679
 		run   func(a delivery.StepAsk, s delivery.Step) (delivery.Step, bool)
 		at    string // the commit the program is built at; empty when it fails
 		fails string
-		runs  int // the run asks put when it fails: each put twice when never begun
+		runs  int // the run asks put when it fails: each put twice when never begun, and none after the seat list's
 	}{
 		{name: "at the group's mesh-delivery head", at: head1},
 		{name: "at mesh-delivery's trunk", repo: "novox/mesh-catalog", at: trunkD},
 		{name: "never begun", run: func(delivery.StepAsk, delivery.Step) (delivery.Step, bool) { return delivery.Step{}, true },
-			fails: "no build node began the job run of the asks", runs: 4},
+			fails: "no build node began the job run of the asks", runs: 2},
 		{name: "does not build", run: func(_ delivery.StepAsk, s delivery.Step) (delivery.Step, bool) {
 			s.State, s.Reason = delivery.StepFailed, "the program does not build: undefined: rules.Nothing"
 			return s, true
-		}, fails: "by the checking program: its run ask", runs: 2},
+		}, fails: "by the checking program: its run ask", runs: 1},
 		{name: "a rule the change alters", at: head1, run: func(a delivery.StepAsk, s delivery.Step) (delivery.Step, bool) {
 			if a.Run.Args[0] != "-verdict" {
 				return s, false
@@ -411,7 +411,7 @@ func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679
 			if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails) {
 				t.Errorf("%s: verdict %+v, want a fail saying %q", row.name, v, row.fails)
 			}
-			if row.at == "" && (len(b.runs) != row.runs || v.JudgedBy != nil) {
+			if row.at == "" && (len(b.runs) != row.runs || v.JudgedBy != nil || slices.ContainsFunc(b.runs, func(a delivery.StepAsk) bool { return a.Run.Args[0] == "-verdict" })) {
 				t.Errorf("%s: %d run asks, judged by %+v: want %d and none judging", row.name, len(b.runs), v.JudgedBy, row.runs)
 			}
 		} else if v.State != delivery.VerdictPass {
@@ -428,10 +428,18 @@ func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679
 			t.Fatalf("%s: run asks %+v, want the seat list and then the verdict", row.name, b.runs)
 		}
 		in := b.runs[1].Run.Input // the facts kept as their exact bytes under their digest
-		if body, _, found, _ := b.inputs.Get(context.Background(), in.Digest); !found || in.Verify(body) != nil || in.State != InputsState ||
+		body, _, found, _ := b.inputs.Get(context.Background(), in.Digest)
+		if !found || in.Verify(body) != nil || in.State != InputsState ||
 			!strings.Contains(string(body), `"group":"feat/x"`) {
 			t.Errorf("%s: the verdict's input %+v is not kept whole: %s", row.name, in, body)
 		}
+		// Review round 1 of milestone 47/B0: a level is carried as the rules read it, without its digest, its packages or
+		// its kept packages' names, so a group's facts stay within the input's bound.
+		for _, unread := range []string{`"digest":{`, `"packages":[`, `"unmet"`, `"package":"m/`} {
+			if strings.Contains(string(body), unread) {
+				t.Errorf("%s: the facts carry %s, which no rule reads: %s", row.name, unread, body)
+			}
+		}
 	}
 }
 
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 036f98e8..246345c4 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -307,12 +307,18 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	st.judgeAll(ctx)
 	st.takeTryCandidate(ctx)
 	// The heads' seat list, from the checking program, before the validator and the composer are asked (ADR 0636 §4).
-	st.seatList(ctx)
-	st.judgeManifests(ctx)
-	st.refuseCycle(ctx)
-	st.compose(ctx)
-	// The verdict is the checking program's of the facts (ADR 0644 §1, ADR 0656 §5).
-	answer, by := st.judged(ctx)
+	// A list it cannot make ends the check there, failed naming the checking program, worded from the facts so far.
+	var answer rules.Answer
+	var by *delivery.JudgedBy
+	if st.seatList(ctx) {
+		st.judgeManifests(ctx)
+		st.refuseCycle(ctx)
+		st.compose(ctx)
+		// The verdict is the checking program's of the facts (ADR 0644 §1, ADR 0656 §5).
+		answer, by = st.judged(ctx)
+	} else {
+		answer = rules.Answer{V: rules.AnswerVersion, Verdict: rules.Judge(st.factsOf())}
+	}
 	for _, n := range answer.Notes {
 		st.c.note(n)
 	}
@@ -691,7 +697,7 @@ func (st *state) level(ctx context.Context, t *target, la delivery.LevelAnswer)
 		t.judgedBy(la.Judged) // the candidate judged the level: nothing is kept (ADR 0535 §4)
 	}
 	_, elapsed, results := st.levels.Level(t.pull.Repository, t.pull.Number, t.module, t.node, la)
-	st.facts = append(st.facts, rules.Step{Repository: t.pull.Repository, Number: t.pull.Number, Module: t.module, Node: t.node, Level: &la})
+	st.facts = append(st.facts, rules.Step{Repository: t.pull.Repository, Number: t.pull.Number, Module: t.module, Node: t.node, Level: rules.LevelFact(la)})
 	var digests map[string]string
 	if t.module == buildrun.GoBuildModule && la.Digest != nil {
 		// The packages come as a list, never keyed by a package path (issue 1930); an answer stored before reads too.
diff --git a/modules/mesh-delivery-checker/internal/check/programs.go b/modules/mesh-delivery-checker/internal/check/programs.go
index 1b5b9cb4..5572a0fc 100644
--- a/modules/mesh-delivery-checker/internal/check/programs.go
+++ b/modules/mesh-delivery-checker/internal/check/programs.go
@@ -165,10 +165,12 @@ func (st *state) waitBegun(ctx context.Context, a delivery.StepAsk) (delivery.St
 }
 
 // seatList asks the checking program for the heads' seat list, which the validator's and the composer's requests carry
-// (ADR 0636 §4); the list and what it left out are the check's notes. A list it cannot make fails the check, naming why.
-func (st *state) seatList(ctx context.Context) {
+// (ADR 0636 §4); the list and what it left out are the check's notes. A list it cannot make fails the check, naming why,
+// and answers false: the check ends there, with no verdict asked of a program that could not answer its list (review
+// round 1 of milestone 47/B0: a build node with no job run would hold the check two begin bounds more).
+func (st *state) seatList(ctx context.Context) bool {
 	if st.narrowTry() {
-		return
+		return true
 	}
 	body, err := json.Marshal(st.factsHead())
 	if err == nil {
@@ -184,11 +186,12 @@ func (st *state) seatList(ctx context.Context) {
 				for _, l := range a.Left {
 					st.c.note("the heads' seat list leaves out " + l.Path + ": " + l.Why)
 				}
-				return
+				return true
 			}
 		}
 	}
 	st.fail(goModule, "the heads' seat list could not be made by the checking program: "+err.Error())
+	return false
 }
 
 // factsHead are the facts that name the check, without what the asking gathered.
diff --git a/modules/mesh-delivery-checker/rules/facts.go b/modules/mesh-delivery-checker/rules/facts.go
index 874dfdc9..573c29de 100644
--- a/modules/mesh-delivery-checker/rules/facts.go
+++ b/modules/mesh-delivery-checker/rules/facts.go
@@ -64,6 +64,36 @@ type Step struct {
 	Manifests  *Manifests            `json:"manifests,omitempty"`
 }
 
+// LevelFact is a level answer as the facts carry it: only what the rules read (Tally.Level), so a group's facts stay
+// within the run input's bound (delivery.RunInputOf). The digest, the unmet packages and the level's judged program
+// are left out, the kept packages are one count, and each test result keeps only the fields Tested names, without its
+// packages, bounds and judged program (review round 1 of milestone 47/B0). An answer this cannot read is carried as given,
+// for the rules to refuse it.
+func LevelFact(la delivery.LevelAnswer) *delivery.LevelAnswer {
+	out := &delivery.LevelAnswer{Level: la.Level}
+	kept := 0
+	for _, k := range la.Kept {
+		kept += k.Tests
+	}
+	if len(la.Kept) > 0 {
+		out.Kept = []delivery.KeptTaken{{Tests: kept}}
+	}
+	for _, raw := range la.Tests {
+		var res Tested
+		if err := json.Unmarshal(raw, &res); err != nil {
+			out.Tests = append(out.Tests, raw)
+			continue
+		}
+		res.Packages, res.JudgedBy, res.Bound, res.SetupBound, res.OverWhich = nil, "", 0, 0, ""
+		small, err := json.Marshal(res)
+		if err != nil {
+			small = raw
+		}
+		out.Tests = append(out.Tests, small)
+	}
+	return out
+}
+
 // DecodeFacts reads facts, refusing a version this program does not read, naming it.
 func DecodeFacts(data []byte) (Facts, error) {
 	var f Facts

From 9290cdda4d5869e4aed49ddf2c56ee0a70b1ca1c Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:28:20 +0100
Subject: [PATCH 14/17] The checking program judges the module graph's cycles
 from the edges the running checker gathers (issue 1921, B0 review round 1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ADR 0656 §5 has every check judged by parts built from the change's heads, and no record keeps the cycle rule in the
running checker. The facts carry each ordering edge's two modules and kind, never manifests: the whole catalogue's
graph is 50 edges, 3195 bytes.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-checking-program/main_test.go    |  25 ++++
 .../internal/check/graph_cycle.go             |  76 ------------
 .../internal/check/graph_edges.go             | 115 +++++++++++++++++
 .../internal/check/judge.go                   |   2 +-
 modules/mesh-delivery-checker/rules/facts.go  |  10 +-
 modules/mesh-delivery-checker/rules/graph.go  | 117 ++++++++++++++++++
 6 files changed, 267 insertions(+), 78 deletions(-)
 delete mode 100644 modules/mesh-delivery-checker/internal/check/graph_cycle.go
 create mode 100644 modules/mesh-delivery-checker/internal/check/graph_edges.go
 create mode 100644 modules/mesh-delivery-checker/rules/graph.go

diff --git a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
index 352c822a..9360368c 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-checking-program/main_test.go
@@ -112,5 +112,30 @@ func TestTheCheckingProgramAnswersTheVerdictOfItsFacts(t *testing.T) {
 			a.Verdict.Failures[1].Words != "novox/x#3 has files in conflict: go.mod" || a.Verdict.Machines[0] != "laptop" || a.Verdict.Levels[delivery.LevelUnit].Run != 3 {
 			t.Errorf("%s: the verdict %+v, want %+v", name, a.Verdict, want)
 		}
+	} // Review round 1 of milestone 47/B0: the module graph's cycle rule is the program's (ADR 0603 §2, ADR 0656 §5), over the
+	// edges the running checker gathers. A cycle the change makes fails; one the trunk has among the same modules is noted.
+	web, mail := rules.Edge{From: "web", To: "mail", Kind: rules.EdgeAwaits}, rules.Edge{From: "mail", To: "web", Kind: rules.EdgeAwaits}
+	only := func(e rules.Edge, where string) rules.Edge { e.Only = where; return e }
+	for _, row := range []struct {
+		name  string
+		graph rules.Graph
+		fails string
+		note  string
+	}{
+		{name: "no cycle", graph: rules.Graph{Trunk: true, Edges: []rules.Edge{web}}, note: "has no cycle"},
+		{name: "a cycle the change makes", graph: rules.Graph{Trunk: true, Edges: []rules.Edge{mail, only(web, rules.EdgeChange)}}, fails: "has the cycle mail -> web -> mail"},
+		{name: "a cycle the trunk has", graph: rules.Graph{Trunk: true, Edges: []rules.Edge{mail, web}}, note: "which the trunk already has"},
+		{name: "the trunk unread", graph: rules.Graph{Edges: []rules.Edge{mail, web}}, fails: "has the cycle mail -> web -> mail"},
+		{name: "a base on itself", graph: rules.Graph{Trunk: true, Edges: []rules.Edge{only(rules.Edge{From: "web", To: "web", Kind: rules.EdgeBase}, rules.EdgeChange)}}, fails: "has the cycle web -> web"},
+		{name: "an edge only the trunk has", graph: rules.Graph{Trunk: true, Edges: []rules.Edge{mail, only(web, rules.EdgeTrunk)}}, note: "has no cycle"},
+	} {
+		g := row.graph
+		a := rules.Judged(rules.Facts{V: rules.FactsVersion, Steps: []rules.Step{{Graph: &g}}})
+		if row.fails != "" && (a.Verdict.State != delivery.VerdictFail || !strings.Contains(a.Verdict.Failed.Words, row.fails)) {
+			t.Errorf("%s: verdict %+v, want a fail saying %q", row.name, a.Verdict, row.fails)
+		}
+		if row.note != "" && (a.Verdict.State != delivery.VerdictPass || !strings.Contains(strings.Join(a.Notes, "\n"), row.note)) {
+			t.Errorf("%s: verdict %s, notes %q, want a pass noting %q", row.name, a.Verdict.State, a.Notes, row.note)
+		}
 	}
 }
diff --git a/modules/mesh-delivery-checker/internal/check/graph_cycle.go b/modules/mesh-delivery-checker/internal/check/graph_cycle.go
deleted file mode 100644
index 48981459..00000000
--- a/modules/mesh-delivery-checker/internal/check/graph_cycle.go
+++ /dev/null
@@ -1,76 +0,0 @@
-package check
-
-import (
-	"context"
-	"fmt"
-	"maps"
-	"slices"
-	"strings"
-
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/composer"
-
-	"git.novox.be/novox/mesh-delivery/sdk/graph"
-)
-
-// The check refuses a change whose module graph has a cycle and names it (novox/hq ADR 0603 §2): modules that would each
-// wait for the other for good, through their bases, the provisions and bus state they await, or the verb edges the graph
-// keeps (ADR 0614 §6). A verb edge on a cycle is left out of the graph, so it is never refused (§3), and a package or a
-// build module's edge is a trigger, never a wait, so a cycle through one is not refused either (§6). The graph is worked out from the
-// catalogue as the change leaves it (every trunk manifest, each one a pull request touches replaced by its candidate's),
-// with the contract's ManifestGraph, the way the indexer works out its graph's edges. A cycle the trunk already has among
-// the same modules is the trunk's: said in the verdict's notes, not the change's failure.
-
-// ManifestReader reads a kept manifest by its digest (the indexer's manifests state).
-type ManifestReader interface {
-	Manifest(ctx context.Context, digest string) (catalogue.Manifest, error)
-}
-
-// refuseCycle fails the check for a cycle of the change's module graph, naming it; nil when the case touches no manifest,
-// when nothing reads manifests, or when there is none. A manifest that cannot be read fails the check, said, never passes it.
-func (st *state) refuseCycle(ctx context.Context) {
-	if st.j.Manifests == nil || st.j.Read == nil || st.narrowTry() {
-		return
-	}
-	trunk := st.j.Manifests.ManifestDigests()
-	req, touched := judgeRequest(trunk, st.c.Pulls)
-	if len(touched) == 0 {
-		return
-	}
-	read := func(digests map[string]composer.Manifest) (map[string]catalogue.Manifest, error) {
-		out := map[string]catalogue.Manifest{}
-		for _, module := range slices.Sorted(maps.Keys(digests)) {
-			m, err := st.j.Read.Manifest(ctx, digests[module].Digest)
-			if err != nil {
-				return nil, fmt.Errorf("the manifest %s of %s: %w", digests[module].Digest, module, err)
-			}
-			out[module] = m
-		}
-		return out, nil
-	}
-	change, err := read(req.Cases[0].Manifests)
-	if err != nil {
-		st.fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
-		return
-	}
-	cycle := graph.OfManifests(change).Cycle()
-	if cycle == nil {
-		st.c.note("the change's module graph has no cycle")
-		return
-	}
-	words := strings.Join(cycle, " -> ")
-	if before, err := read(req.Cases[1].Manifests); err == nil {
-		among := graph.Graph{}
-		for name, n := range graph.OfManifests(before) {
-			if slices.Contains(cycle, name) {
-				among[name] = n
-			}
-		}
-		if among.Cycle() != nil {
-			st.c.note("the module graph has the cycle " + words + ", which the trunk already has among the same modules (ADR 0603 §2)")
-			return
-		}
-	}
-	st.fail(goModule, fmt.Sprintf("the change's module graph has the cycle %s: these modules would each wait for the other for "+
-		"good, through their bases, the provisions and bus state they await, or the verbs they invoke (ADR 0603 §2, ADR 0614 §6)", words))
-}
diff --git a/modules/mesh-delivery-checker/internal/check/graph_edges.go b/modules/mesh-delivery-checker/internal/check/graph_edges.go
new file mode 100644
index 00000000..60b161ac
--- /dev/null
+++ b/modules/mesh-delivery-checker/internal/check/graph_edges.go
@@ -0,0 +1,115 @@
+package check
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+
+	"git.novox.be/novox/mesh-delivery/sdk/graph"
+	"mesh-delivery-checker/rules"
+)
+
+// The module graph of a change (novox/hq ADR 0603 §2, ADR 0614 §6): the running checker gathers its ordering edges, the
+// checking program judges whether it has a cycle (rules.JudgeGraph, ADR 0656 §5). The graph is worked out from the
+// catalogue as the change leaves it (every trunk manifest, each one a pull request touches replaced by its candidate's)
+// and as the trunk has it, with the contract's ManifestGraph, the way the indexer works out its graph's edges; the facts
+// carry only each edge's two modules and its kind.
+
+// ManifestReader reads a kept manifest by its digest (the indexer's manifests state).
+type ManifestReader interface {
+	Manifest(ctx context.Context, digest string) (catalogue.Manifest, error)
+}
+
+// gatherGraph records the change's and the trunk's module graph edges as a fact; none when the case touches no manifest
+// or nothing reads manifests. A change's manifest that cannot be read fails the check, said, never passes it; a trunk's
+// that cannot be read leaves the trunk's graph unread, so no cycle is the trunk's.
+func (st *state) gatherGraph(ctx context.Context) {
+	if st.j.Manifests == nil || st.j.Read == nil || st.narrowTry() {
+		return
+	}
+	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
+	if len(touched) == 0 {
+		return
+	}
+	read := func(digests map[string]composer.Manifest) (map[string]catalogue.Manifest, error) {
+		out := map[string]catalogue.Manifest{}
+		for _, module := range slices.Sorted(maps.Keys(digests)) {
+			m, err := st.j.Read.Manifest(ctx, digests[module].Digest)
+			if err != nil {
+				return nil, fmt.Errorf("the manifest %s of %s: %w", digests[module].Digest, module, err)
+			}
+			out[module] = m
+		}
+		return out, nil
+	}
+	change, err := read(req.Cases[0].Manifests)
+	if err != nil {
+		st.fail(goModule, "the change's module graph cannot be worked out, so no cycle can be ruled out: "+err.Error())
+		return
+	}
+	g := rules.Graph{}
+	changed := orderingEdges(graph.OfManifests(change))
+	trunk := map[[2]string]string{}
+	if before, err := read(req.Cases[1].Manifests); err == nil {
+		g.Trunk = true
+		trunk = orderingEdges(graph.OfManifests(before))
+	}
+	for _, pair := range slices.SortedFunc(maps.Keys(changed), cmpPair) {
+		e := rules.Edge{From: pair[0], To: pair[1], Kind: changed[pair]}
+		if _, both := trunk[pair]; !both && g.Trunk {
+			e.Only = rules.EdgeChange
+		}
+		g.Edges = append(g.Edges, e)
+	}
+	for _, pair := range slices.SortedFunc(maps.Keys(trunk), cmpPair) {
+		if _, both := changed[pair]; !both {
+			g.Edges = append(g.Edges, rules.Edge{From: pair[0], To: pair[1], Kind: trunk[pair], Only: rules.EdgeTrunk})
+		}
+	}
+	st.facts = append(st.facts, rules.Step{Graph: &g})
+}
+
+func cmpPair(a, b [2]string) int {
+	return cmp.Or(strings.Compare(a[0], b[0]), strings.Compare(a[1], b[1]))
+}
+
+// orderingEdges are the graph's ordering edges (graph.Graph.Before) between its modules, each pair once with the kind it
+// is first met by: a base, a provision or bus state awaited of another provider, or a verb the graph keeps served by
+// another module (a base on itself is a cycle). A verb edge the graph leaves out (ADR 0614 §3), a toolchain and a package edge are none (§6).
+func orderingEdges(g graph.Graph) map[[2]string]string {
+	out := map[[2]string]string{}
+	add := func(from, to, kind string) {
+		if _, ours := g[to]; !ours || (from == to && kind != rules.EdgeBase) {
+			return
+		}
+		if _, met := out[[2]string{from, to}]; !met {
+			out[[2]string{from, to}] = kind
+		}
+	}
+	for _, name := range slices.Sorted(maps.Keys(g)) {
+		n := g[name]
+		for _, b := range n.Bases {
+			add(name, b, rules.EdgeBase)
+		}
+		for _, a := range n.Awaits {
+			for _, p := range g.Providers(a) {
+				add(name, p, rules.EdgeAwaits)
+			}
+		}
+		for _, v := range n.Invokes {
+			if slices.Contains(n.LeftOut, v) {
+				continue
+			}
+			for _, s := range g.Servers(v) {
+				add(name, s, rules.EdgeInvokes)
+			}
+		}
+	}
+	return out
+}
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index 246345c4..d448b765 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -312,7 +312,7 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	var by *delivery.JudgedBy
 	if st.seatList(ctx) {
 		st.judgeManifests(ctx)
-		st.refuseCycle(ctx)
+		st.gatherGraph(ctx)
 		st.compose(ctx)
 		// The verdict is the checking program's of the facts (ADR 0644 §1, ADR 0656 §5).
 		answer, by = st.judged(ctx)
diff --git a/modules/mesh-delivery-checker/rules/facts.go b/modules/mesh-delivery-checker/rules/facts.go
index 573c29de..05b67b2b 100644
--- a/modules/mesh-delivery-checker/rules/facts.go
+++ b/modules/mesh-delivery-checker/rules/facts.go
@@ -51,7 +51,7 @@ type Member struct {
 
 // Step is one fact of the check, in the order met: the node that ran it, and one of a level its build module answered
 // (Level, as the build module gave it), what its fetch read of compiled programs (Programs), the manifest validator's
-// answers (Manifests) or a failure the asking met (Failed: a step not asked, refused or not answered, a conflict, worded
+// answers (Manifests), the module graph's ordering edges (Graph) or a failure the asking met (Failed: a step not asked, refused or not answered, a conflict, worded
 // by the running checker). A step with none only says which node ran it.
 type Step struct {
 	Repository string                `json:"repository"`
@@ -62,6 +62,8 @@ type Step struct {
 	Failed     *delivery.FailedFirst `json:"failed,omitempty"`
 	Programs   *Programs             `json:"programs,omitempty"`
 	Manifests  *Manifests            `json:"manifests,omitempty"`
+	// Graph is the module graph's ordering edges, as the change leaves them and as the trunk has them (JudgeGraph).
+	Graph *Graph `json:"graph,omitempty"`
 }
 
 // LevelFact is a level answer as the facts carry it: only what the rules read (Tally.Level), so a group's facts stay
@@ -193,6 +195,12 @@ func Judged(f Facts) Answer {
 			if ff := JudgePrograms(s.Node, *s.Programs); ff != nil {
 				failures = append(failures, &delivery.Verdict{State: delivery.VerdictFail, Failed: *ff})
 			}
+		case s.Graph != nil:
+			ff, said := JudgeGraph(*s.Graph)
+			notes = append(notes, said...)
+			if ff != nil {
+				failures = append(failures, &delivery.Verdict{State: delivery.VerdictFail, Failed: *ff})
+			}
 		case s.Manifests != nil:
 			ff, said := JudgeManifests(*s.Manifests)
 			notes = append(notes, said...)
diff --git a/modules/mesh-delivery-checker/rules/graph.go b/modules/mesh-delivery-checker/rules/graph.go
new file mode 100644
index 00000000..ed729098
--- /dev/null
+++ b/modules/mesh-delivery-checker/rules/graph.go
@@ -0,0 +1,117 @@
+package rules
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The module graph's cycle rule (novox/hq ADR 0603 §2, ADR 0614 §3, §6), judged by the checking program (ADR 0656 §5):
+// the check refuses a change whose module graph has a cycle and names it; a cycle the trunk already has among the same
+// modules is the trunk's, said in the notes. The running checker gathers the graph's ordering edges of the catalogue as
+// the change leaves it and as the trunk has it, worked out with the contract's graph (sdk/graph: bases, the provisions
+// and bus state a module awaits, the verb edges the graph keeps), as module names and the edge's kind, never the
+// manifests themselves, so the facts stay within the run input's bound.
+
+// The kinds of an ordering edge.
+const (
+	EdgeBase    = "base"
+	EdgeAwaits  = "awaits"
+	EdgeInvokes = "invokes"
+)
+
+// Edge is one ordering edge: From waits for To. Only is EdgeChange when only the change's graph has it, EdgeTrunk when
+// only the trunk's does, empty when both have it.
+type Edge struct {
+	From string `json:"from"`
+	To   string `json:"to"`
+	Kind string `json:"kind"`
+	Only string `json:"only,omitempty"`
+}
+
+// Where only one graph has an edge.
+const (
+	EdgeChange = "change"
+	EdgeTrunk  = "trunk"
+)
+
+// Graph is the module graph's facts: every ordering edge of either graph, between modules of the catalogue. Trunk says
+// whether the trunk's graph was read; when it was not, every edge is the change's and no cycle is the trunk's.
+type Graph struct {
+	Edges []Edge `json:"edges"`
+	Trunk bool   `json:"trunk"`
+}
+
+// JudgeGraph is the cycle rule over the graph's facts: the failure of a cycle the change makes, or the note of no cycle
+// or of a cycle the trunk already has.
+func JudgeGraph(g Graph) (*delivery.FailedFirst, []string) {
+	cycle := firstCycle(g.Edges, func(e Edge) bool { return e.Only != EdgeTrunk || !g.Trunk })
+	if cycle == nil {
+		return nil, []string{"the change's module graph has no cycle"}
+	}
+	words := strings.Join(cycle, " -> ")
+	if g.Trunk {
+		among := firstCycle(g.Edges, func(e Edge) bool {
+			return e.Only != EdgeChange && slices.Contains(cycle, e.From) && slices.Contains(cycle, e.To)
+		})
+		if among != nil {
+			return nil, []string{"the module graph has the cycle " + words + ", which the trunk already has among the same modules (ADR 0603 §2)"}
+		}
+	}
+	return &delivery.FailedFirst{Machine: buildrun.GoBuildModule, Words: fmt.Sprintf("the change's module graph has the cycle %s: these modules would "+
+		"each wait for the other for good, through their bases, the provisions and bus state they await, or the verbs they invoke (ADR 0603 §2, ADR 0614 §6)", words)}, nil
+}
+
+// firstCycle is the first cycle of the edges kept, as the modules it passes through with the first named again at its
+// end, visiting the modules and each one's edges in sorted order (as sdk/graph's Cycle does), or nil for none.
+func firstCycle(edges []Edge, keep func(Edge) bool) []string {
+	next := map[string][]string{}
+	for _, e := range edges {
+		if keep(e) && !slices.Contains(next[e.From], e.To) {
+			next[e.From] = append(next[e.From], e.To)
+		}
+	}
+	var names []string
+	for name, to := range next {
+		slices.Sort(to)
+		names = append(names, name)
+	}
+	slices.Sort(names)
+	const (
+		unseen = iota
+		onPath
+		done
+	)
+	state := map[string]int{}
+	var path []string
+	var visit func(string) []string
+	visit = func(name string) []string {
+		state[name] = onPath
+		path = append(path, name)
+		for _, to := range next[name] {
+			switch state[to] {
+			case onPath:
+				i := slices.Index(path, to)
+				return append(slices.Clone(path[i:]), to)
+			case unseen:
+				if c := visit(to); c != nil {
+					return c
+				}
+			}
+		}
+		path = path[:len(path)-1]
+		state[name] = done
+		return nil
+	}
+	for _, name := range names {
+		if state[name] == unseen {
+			if c := visit(name); c != nil {
+				return c
+			}
+		}
+	}
+	return nil
+}

From f4ab7a2bc861a92e7184c6034656147a4d9192f6 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:28:27 +0100
Subject: [PATCH 15/17] Name the file that gathers the module graph's edges
 (issue 1921)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 modules/mesh-delivery-checker/internal/check/judge.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index d448b765..d079873c 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -114,7 +114,7 @@ type Examiner struct {
 	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
 	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
 	Manifests TrunkManifests
-	// Read reads a kept manifest by its digest: the change's module graph is worked out from them (graph_cycle.go, novox/hq
+	// Read reads a kept manifest by its digest: the change's module graph is worked out from them (graph_edges.go, novox/hq
 	// ADR 0603 §2); nil works out no graph.
 	Read ManifestReader
 	// Serving says, from what runs, whether a running healthy build serves a seat verb or module tool (novox/hq ADR 0614

From 9c9ed7a1d8f11b5f7e2449fd2b123bade5ae9b16 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Fri, 6 Nov 2026 23:39:39 +0100
Subject: [PATCH 16/17] The checker serves a checking program's input on its
 seat's verb input, and the build module asks it (issue 1921, B0 review round
 1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The operator's answer: mesh-build-go reading the checker's state inputs broke ADR 0596 §2. The run ask's input now names
the verb seat:mesh-delivery-checker.input; the checker's tools serve it from the state inputs (Reader.Input, checked
against its digest), and the state is the checker's own again, read by no other module.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-delivery-checker-tools/main.go   | 15 +++
 .../mesh-delivery-checker-tools/main_test.go  | 16 ++++
 .../mesh-delivery-checker/integration_test.go | 95 ++++++++++++++++---
 .../cmd/mesh-delivery-checker/judge.go        |  2 +-
 .../cmd/mesh-delivery-checker/kept_test.go    |  4 +-
 .../cmd/mesh-delivery-checker/main.go         |  7 +-
 .../internal/check/examiner_test.go           |  2 +-
 .../internal/check/judge.go                   |  2 +-
 .../internal/check/programs.go                | 17 ++--
 .../internal/check/read.go                    | 29 +++++-
 .../internal/check/read_test.go               | 22 ++++-
 .../mesh-delivery-checker/manifest_test.go    |  7 +-
 modules/mesh-delivery-checker/module.json     |  3 +-
 .../mesh-delivery-indexer/judge/rules_test.go |  2 +-
 14 files changed, 185 insertions(+), 38 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
index 81101036..b800cfae 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go
@@ -229,6 +229,20 @@ func SeatTryTools(tr Trying) []stdio.Tool {
 	return out
 }
 
+// SeatInputTools are the seat's verb input (check.InputVerb): a checking program's input as the checker keeps it, asked by
+// the Go build module that runs the program (delivery.RunInput.Read), never read from the checker's state by it.
+func SeatInputTools(r check.Reader) []stdio.Tool {
+	return []stdio.Tool{{Name: Seat + "." + delivery.CheckerInputVerb,
+		Description: "A checking program's input the checker keeps, by the sha256 of its exact bytes, as a run ask names it: the digest " +
+			"and the bytes, base64. A digest it keeps no input of, or bytes that read back as another digest, is an error. Read-only.",
+		Input: map[string]any{"type": "object", "required": []string{"digest"}, "properties": map[string]any{
+			"digest": map[string]any{"type": "string", "description": "the input's sha256, 64 lowercase hex digits"}}},
+		Run: func(args map[string]any) (any, error) {
+			digest, _ := args["digest"].(string)
+			return r.Input(digest)
+		}}}
+}
+
 // Tools are the read tools over the checker's states.
 func Tools(r check.Reader) []stdio.Tool {
 	return []stdio.Tool{
@@ -381,6 +395,7 @@ func main() {
 		return err
 	}}
 	tools := append(append(append(append(Tools(r), TryTools(trying)...), OpenTriesTools(trying)...), SeatTryTools(trying)...), RecoveryTools(r, written)...)
+	tools = append(tools, SeatInputTools(r)...)
 	if err := stdio.Serve("", logged(tools)); err != nil {
 		fmt.Fprintf(os.Stderr, "[mesh-delivery-checker-tools] %v\n", err)
 		os.Exit(1)
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
index 3ef71945..cb5da15c 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-delivery/sdk/tryevent"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"mesh-delivery-checker/internal/check"
 )
@@ -108,6 +109,21 @@ func TestTheTryToolsAskAndReadATry(t *testing.T) { // ADR 0501 §5, the agreed i
 	if _, err := verbs[0].Run(map[string]any{"repository": "novox/hq", "head": strings.Repeat("1", 40)}); err == nil {
 		t.Error("the verb tried a repository nothing checks")
 	}
+	// The seat's verb input (issue 1921, ADR 0596 §2): a checking program's input as kept, which the Go build module asks.
+	body := []byte(`{"v":1}`)
+	in, _ := delivery.RunInputOf(check.InputVerb, body)
+	inputs := SeatInputTools(check.Reader{InputState: check.StateRead{Get: func(key string) (json.RawMessage, error) {
+		if key == in.Digest {
+			return body, nil
+		}
+		return nil, nil
+	}}})
+	if len(inputs) != 1 || inputs[0].Name != Seat+".input" {
+		t.Fatalf("input verbs = %+v", inputs)
+	}
+	if a, err := inputs[0].Run(map[string]any{"digest": in.Digest}); err != nil || string(a.(delivery.RunInputAnswer).Input) != string(body) {
+		t.Errorf("verb input = %+v, %v", a, err)
+	}
 	// A group try (issue 1921): the members, each an exact commit; members and one repository together are refused; the
 	// description says what it does in the words a search for "try a group" finds.
 	later := TryTools(Trying{Tries: store, Ender: store, Now: func() time.Time { return time.Unix(2, 5) },
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
index f85f0add..6f465286 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
@@ -93,9 +93,7 @@ type fakeBuildModules struct {
 	beside map[string][]string
 	// names are the nodes' names the last check ask carried, for the names check (ADR 0567 §12).
 	names []string
-	// inputs is the checker's state of run inputs; runs counts the run asks answered, and broken, when set, is why the
-	// checking program does not build (issue 1921).
-	inputs jetstream.KeyValue
+	// runs counts the run asks answered, and broken, when set, is why the checking program does not build (issue 1921).
 	runs   atomic.Int32
 	broken atomic.Value
 	// drop, when set, drops every run ask unanswered and counts it in dropped, as a build module that does not know the job
@@ -125,20 +123,20 @@ func (d droppingAsks) Next(ctx context.Context, kind string, wait time.Duration)
 }
 
 // run answers a run ask as mesh-build-go does: the checking program's work (rules.Program) over the input the ask names,
-// read from the checker's state inputs and checked against its digest, with no heads of its own laid.
+// asked of the seat verb it names on the bus and checked against its digest (delivery.RunInput.Read, as mesh-build-go
+// reads it), with no heads of its own laid.
 func (f *fakeBuildModules) run(ctx context.Context, a delivery.StepAsk) (any, error) {
 	f.runs.Add(1)
 	if why, _ := f.broken.Load().(string); why != "" {
 		return nil, errors.New(why)
 	}
 	answer := delivery.RunAnswer{Built: true, Key: "program-0123456789abcdef"}
-	out, err := rules.Program(a.Run.Args, func() ([]byte, error) {
-		e, err := f.inputs.Get(ctx, a.Run.Input.Digest)
-		if err != nil {
-			return nil, err
-		}
-		return e.Value(), a.Run.Input.Verify(e.Value())
-	}, fstest.MapFS{})
+	// As mesh-build-go does, the input is asked before the program runs, and a step whose input cannot be had fails.
+	body, err := a.Run.Input.Read(func(key string, body any) (json.RawMessage, error) { return askVerb(f.js.Conn(), key, body) })
+	if err != nil {
+		return nil, err
+	}
+	out, err := rules.Program(a.Run.Args, func() ([]byte, error) { return body, nil }, fstest.MapFS{})
 	if err != nil {
 		answer.Exit, answer.Said = 2, err.Error()
 	}
@@ -146,6 +144,66 @@ func (f *fakeBuildModules) run(ctx context.Context, a delivery.StepAsk) (any, er
 	return answer, nil
 }
 
+// askVerb asks a seat verb on the subject that names no caller and reads the runtime's reply, {result, error}.
+func askVerb(nc *nats.Conn, key string, body any) (json.RawMessage, error) {
+	seat, verb, ok := strings.Cut(strings.TrimPrefix(key, "seat:"), ".")
+	if !ok || !strings.HasPrefix(key, "seat:") {
+		return nil, fmt.Errorf("%q names no seat verb", key)
+	}
+	data, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	msg, err := nc.Request("mesh.seat."+seat+".tool."+verb, data, 5*time.Second)
+	if err != nil {
+		return nil, err
+	}
+	var r struct {
+		Result json.RawMessage `json:"result"`
+		Error  string          `json:"error"`
+	}
+	if err := json.Unmarshal(msg.Data, &r); err != nil {
+		return nil, err
+	}
+	if r.Error != "" {
+		return nil, errors.New(r.Error)
+	}
+	return r.Result, nil
+}
+
+// serveInputVerb answers the checker seat's verb input on the bus as the checker's tools do (check.Reader.Input over the
+// checker's state inputs), and counts what it answered (issue 1921, ADR 0596 §2).
+func (b *bed) serveInputVerb(t *testing.T, nc *nats.Conn) {
+	t.Helper()
+	kv := b.buckets[check.InputsBucket]
+	r := check.Reader{InputState: check.StateRead{Get: func(key string) (json.RawMessage, error) {
+		e, err := kv.Get(b.ctx, key)
+		if errors.Is(err, jetstream.ErrKeyNotFound) {
+			return nil, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+		return e.Value(), nil
+	}}}
+	if _, err := nc.Subscribe("mesh.seat.mesh-delivery-checker.tool."+delivery.CheckerInputVerb, func(m *nats.Msg) {
+		var ask delivery.RunInputAsk
+		reply := map[string]any{}
+		if err := json.Unmarshal(m.Data, &ask); err != nil {
+			reply["error"] = err.Error()
+		} else if a, err := r.Input(ask.Digest); err != nil {
+			reply["error"] = err.Error()
+		} else {
+			reply["result"] = a
+			b.inputsAnswered.Add(1)
+		}
+		data, _ := json.Marshal(reply)
+		_ = m.Respond(data)
+	}); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func (f *fakeBuildModules) count(tool string) int {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -312,6 +370,8 @@ type bed struct {
 	js       jetstream.JetStream
 	buckets  map[string]jetstream.KeyValue
 	tools    map[string]jetstream.KeyValue
+	// inputsAnswered counts the inputs the seat's verb input answered (issue 1921).
+	inputsAnswered atomic.Int32
 	fake     *fakeBuildModules
 	srvURL   string
 	announce []string
@@ -476,7 +536,8 @@ func startBed(t *testing.T) *bed {
 		b.setHealth(t, "n1", module)
 	}
 	b.serveForge(t, ctl)
-	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}, inputs: b.buckets[check.InputsBucket]}
+	b.serveInputVerb(t, ctl)
+	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
 	b.fake.serve(t, "mesh-build-go", b.buckets[delivery.CheckerKeptBucket])
 	b.fake.serve(t, "mesh-build-node", b.buckets[delivery.CheckerKeptBucket])
 	b.report(t, "mesh-build-go", "n1", "go", "go1.27.1", "1")
@@ -704,7 +765,7 @@ func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300
 		t.Errorf("n1's engine was asked %+v, want the check's candidate %s", got, key)
 	}
 	// Issue 1921 (B0): the verdict is the checking program's, built at the group's mesh-delivery head over its input kept in
-	// the state inputs, two run asks a check (the seat list, the verdict); the verdict names the program's build.
+	// the state inputs and asked of the seat's verb input, two run asks a check (the seat list, the verdict); the verdict names the program's build.
 	if by := v.JudgedBy; by == nil || by.Program.Commit != head1 || by.Program.Package != check.CheckingProgramPackage ||
 		by.Key != "program-0123456789abcdef" || len(by.Heads) != 1 || by.Heads[0].Commit != head1 {
 		t.Errorf("judged by %+v, want the checking program at the head %s", v.JudgedBy, head1)
@@ -712,6 +773,10 @@ func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300
 	if n := b.fake.runs.Load(); n != 4 {
 		t.Errorf("%d run asks, want two for each of the two checks", n)
 	}
+	// The operator's answer on B0: each run's input reached the build module through the seat's verb input on the bus.
+	if n := b.inputsAnswered.Load(); n != 4 {
+		t.Errorf("the verb input answered %d inputs, want one for each run ask", n)
+	}
 	b.fake.mu.Lock()
 	names := b.fake.names
 	b.fake.mu.Unlock()
@@ -1069,7 +1134,7 @@ func TestTheCheckerSaysOwedReadableOnTheBus(t *testing.T) { // R2-1
 	}
 	if said.Module != "mesh-delivery-checker" || said.Node != "n1" || !said.Keeps("owed") || !said.Readable("owed") ||
 		!said.Readable("previews") || !said.Readable("verdicts") || !said.Readable("kept") || !said.Readable("tries") || said.Readable("hearing") ||
-		!said.Keeps("asks") || said.Readable("asks") || !said.Readable("inputs") || len(said.States) != 8 {
-		t.Fatalf("the checker said %+v, want its eight states, asks and hearing its own, with inputs, kept, owed, previews, tries and verdicts readable, tries by the delivery view, inputs by the Go build module (1929/AC4; 1887 A5b; build_usage; 1921)", said)
+		!said.Keeps("asks") || said.Readable("asks") || !said.Keeps("inputs") || said.Readable("inputs") || len(said.States) != 8 {
+		t.Fatalf("the checker said %+v, want its eight states, asks, hearing and inputs its own, with kept, owed, previews, tries and verdicts readable, tries by the delivery view, inputs asked through the seat's verb input (1929/AC4; 1887 A5b; build_usage; 1921)", said)
 	}
 }
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
index 8c2c3430..f90335c2 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go
@@ -24,7 +24,7 @@ import (
 
 // judgeDeps are the parts the judge of a check is made of.
 type judgeDeps struct {
-	// inputs keeps the checking program's inputs (check.InputsState).
+	// inputs keeps the checking program's inputs (check.InputsStateName, served on check.InputVerb).
 	inputs check.Inputs
 	// beginBound is how long a run ask may wait for a build node to begin it; check.DefaultBeginBound when 0.
 	beginBound time.Duration
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
index fb84bd24..c36810ad 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/kept_test.go
@@ -38,8 +38,8 @@ func TestTheCheckerAnnouncesEveryStateItKeepsAndOwedReadable(t *testing.T) { //
 		t.Errorf("announced %v, the manifest keeps %v", announced, manifest)
 	}
 	// kept is read by the Go build module for a check ask (issue 1887 design limit 1); tries by the delivery view (build_usage).
-	// inputs by the Go build module, which hands one to the checking program a run ask names (issue 1921).
-	if want := []string{"inputs", "kept", "owed", "previews", "tries", "verdicts"}; !equal(readable, want) {
+	// inputs are the checker's own: the Go build module asks the seat's verb input for one (ADR 0596 §2, issue 1921).
+	if want := []string{"kept", "owed", "previews", "tries", "verdicts"}; !equal(readable, want) {
 		t.Errorf("readable %v, want %v", readable, want)
 	}
 }
diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
index 375cf192..7d9eb21f 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go
@@ -72,9 +72,10 @@ var keptStates = []announce.State{
 	{Name: "hearing"},
 	// The asks each running check put (check.AsksState): read by the checker's own checker_ask_again alone.
 	{Name: "asks"},
-	// The checking program's inputs by their digest (check.InputsState): read by the Go build module, which hands one to
-	// the program a run ask names (issue 1921).
-	{Name: check.InputsStateName, Readable: true},
+	// The checking program's inputs by their digest (check.InputsStateName): the checker's own, read by its tools alone,
+	// which serve one on the seat's verb input to the Go build module that runs the program (check.InputVerb; ADR 0596 §2,
+	// issue 1921).
+	{Name: check.InputsStateName},
 	{Name: "kept", Readable: true},
 	{Name: "owed", Readable: true},
 	{Name: "previews", Readable: true},
diff --git a/modules/mesh-delivery-checker/internal/check/examiner_test.go b/modules/mesh-delivery-checker/internal/check/examiner_test.go
index a755ef7a..700e9507 100644
--- a/modules/mesh-delivery-checker/internal/check/examiner_test.go
+++ b/modules/mesh-delivery-checker/internal/check/examiner_test.go
@@ -429,7 +429,7 @@ func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679
 		}
 		in := b.runs[1].Run.Input // the facts kept as their exact bytes under their digest
 		body, _, found, _ := b.inputs.Get(context.Background(), in.Digest)
-		if !found || in.Verify(body) != nil || in.State != InputsState ||
+		if !found || in.Verify(body) != nil || in.Verb != InputVerb ||
 			!strings.Contains(string(body), `"group":"feat/x"`) {
 			t.Errorf("%s: the verdict's input %+v is not kept whole: %s", row.name, in, body)
 		}
diff --git a/modules/mesh-delivery-checker/internal/check/judge.go b/modules/mesh-delivery-checker/internal/check/judge.go
index d079873c..bc063e33 100644
--- a/modules/mesh-delivery-checker/internal/check/judge.go
+++ b/modules/mesh-delivery-checker/internal/check/judge.go
@@ -138,7 +138,7 @@ type Examiner struct {
 	// and fingerprints a group try's manifest validator and composition judge (issue 1921); nil leaves a whole try with no
 	// manifest or composition judged, said.
 	Candidates TryCandidates
-	// Inputs keeps the checking program's inputs (the state InputsState); BeginBound is how long a run ask may wait for a
+	// Inputs keeps the checking program's inputs (the state InputsStateName, served on InputVerb); BeginBound is how long a run ask may wait for a
 	// build node to begin it (DefaultBeginBound when zero).
 	Inputs     Inputs
 	BeginBound time.Duration
diff --git a/modules/mesh-delivery-checker/internal/check/programs.go b/modules/mesh-delivery-checker/internal/check/programs.go
index 5572a0fc..802a63fa 100644
--- a/modules/mesh-delivery-checker/internal/check/programs.go
+++ b/modules/mesh-delivery-checker/internal/check/programs.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 
 	"git.novox.be/novox/mesh-delivery/modules/mesh-delivery-builder/buildrun"
@@ -22,12 +23,14 @@ import (
 // verdict of the facts the asking gathered (`-verdict`). The running checker asks, keeps and records; it judges nothing.
 
 const (
-	// InputsStateName is the checker's own state of run inputs, InputsBucket its bucket and InputsState its name as a run
-	// ask's input names it (delivery.RunInput.State): every input by the sha256 of its exact bytes, read by the Go build
-	// module, which checks the digest (delivery.RunInput.Verify).
+	// InputsStateName is the checker's own state of run inputs and InputsBucket its bucket: every input by the sha256 of
+	// its exact bytes, read by the checker alone. InputVerb is the seat verb a run ask's input names
+	// (delivery.RunInput.Verb), which the checker's tools serve from that state (Reader.Input): the Go build module asks it
+	// as its manifest's invokes grants it and checks the digest (delivery.RunInput.Read), never reading the state (ADR 0596
+	// §2; the operator's answer on milestone 47/B0).
 	InputsStateName = "inputs"
 	InputsBucket    = delivery.CheckerModule + "_" + InputsStateName
-	InputsState     = delivery.CheckerModule + "." + InputsStateName
+	InputVerb       = "seat:" + catalogue.CheckerSeat + "." + delivery.CheckerInputVerb
 	// CheckingProgramDir and CheckingProgramPackage are where in mesh-delivery the checking program is built.
 	CheckingProgramDir     = "modules/mesh-delivery-checker"
 	CheckingProgramPackage = "mesh-delivery-checker/cmd/mesh-checking-program"
@@ -83,14 +86,14 @@ func (st *state) runProgram(ctx context.Context, args []string, body []byte) (js
 		return nil, nil, fmt.Errorf("it cannot be built: the trunk head of %s is not known", DeliveryRepository)
 	}
 	if st.j.Inputs == nil {
-		return nil, nil, fmt.Errorf("its input cannot be kept: the checker keeps no state %s", InputsState)
+		return nil, nil, fmt.Errorf("its input cannot be kept: the checker keeps no state %s", InputsStateName)
 	}
-	in, err := delivery.RunInputOf(InputsState, body)
+	in, err := delivery.RunInputOf(InputVerb, body)
 	if err != nil {
 		return nil, nil, err
 	}
 	if err := st.j.Inputs.Keep(ctx, in.Digest, body); err != nil {
-		return nil, nil, fmt.Errorf("its input could not be kept in %s: %w", InputsState, err)
+		return nil, nil, fmt.Errorf("its input could not be kept in %s: %w", InputsStateName, err)
 	}
 	job := delivery.RunJob{Program: prog, Heads: st.runHeads(), Input: in, Args: args, Reader: "the checking program at " + at}
 	var ids []string
diff --git a/modules/mesh-delivery-checker/internal/check/read.go b/modules/mesh-delivery-checker/internal/check/read.go
index 39c6f61e..4722ba0d 100644
--- a/modules/mesh-delivery-checker/internal/check/read.go
+++ b/modules/mesh-delivery-checker/internal/check/read.go
@@ -1,6 +1,8 @@
 package check
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"slices"
@@ -37,7 +39,7 @@ type Reader struct {
 	VerdictState, KeptState, CandidateState StateRead
 
 	PreviewState StateRead            // the checker's merge previews
-	InputState   StateRead            // the checking program's inputs (InputsState)
+	InputState   StateRead            // the checking program's inputs (InputsStateName)
 	StepStates   map[string]StateRead // the build modules' steps states, by module
 	HaveState    StateRead            // the node-engine's have: whether a build module is on a node and running
 	StepBound    time.Duration        // how long the checker waits for one step; DefaultStepBound when 0
@@ -263,10 +265,33 @@ func (r Reader) Kept(level, digest string) (map[string]json.RawMessage, string,
 	return out, cut, nil
 }
 
+// Input is the answer of the seat's verb input (InputVerb): the input kept under digest, its exact bytes, which the Go build
+// module hands the checking program a run ask names (delivery.RunInput.Read). A digest that is no sha256, one the checker
+// keeps nothing under, and bytes that read back as another digest are errors, never an answer.
+func (r Reader) Input(digest string) (delivery.RunInputAnswer, error) {
+	if r.InputState.Get == nil {
+		return delivery.RunInputAnswer{}, fmt.Errorf("the state %s cannot be read here", InputsStateName)
+	}
+	if len(digest) != 64 || strings.Trim(digest, "0123456789abcdef") != "" {
+		return delivery.RunInputAnswer{}, fmt.Errorf("%q is no sha256 digest of 64 lowercase hex digits", digest)
+	}
+	raw, err := r.InputState.Get(digest)
+	if err != nil {
+		return delivery.RunInputAnswer{}, fmt.Errorf("the input %s cannot be read: %w", digest, err)
+	}
+	if len(raw) == 0 {
+		return delivery.RunInputAnswer{}, fmt.Errorf("the checker keeps no input %s (an input is kept a day)", digest)
+	}
+	if sum := sha256.Sum256(raw); hex.EncodeToString(sum[:]) != digest {
+		return delivery.RunInputAnswer{}, fmt.Errorf("the input kept under %s reads back as %d bytes of another digest", digest, len(raw))
+	}
+	return delivery.RunInputAnswer{Digest: digest, Input: raw}, nil
+}
+
 // Inputs are the checking program's kept inputs: with a digest that input as kept, else every digest with its size.
 func (r Reader) Inputs(digest string) (map[string]json.RawMessage, string, error) {
 	if r.InputState.Keys == nil || r.InputState.Get == nil {
-		return nil, "", fmt.Errorf("the state %s cannot be read here", InputsState)
+		return nil, "", fmt.Errorf("the state %s cannot be read here", InputsStateName)
 	}
 	if digest != "" {
 		raw, err := r.InputState.Get(digest)
diff --git a/modules/mesh-delivery-checker/internal/check/read_test.go b/modules/mesh-delivery-checker/internal/check/read_test.go
index 4da7a1ec..4f7cbe19 100644
--- a/modules/mesh-delivery-checker/internal/check/read_test.go
+++ b/modules/mesh-delivery-checker/internal/check/read_test.go
@@ -125,7 +125,7 @@ func TestTheKeptToolAnswersTheKeysAsStoredByLevelAndByDigest(t *testing.T) { //
 	// Issue 1921: checker_inputs answers the checking program's inputs, every digest with its size, or one as kept.
 	inputs := newMemKV()
 	body := []byte(`{"v":1,"group":"feat/x"}`)
-	in, _ := delivery.RunInputOf(InputsState, body)
+	in, _ := delivery.RunInputOf(InputVerb, body)
 	_ = memInputs{inputs}.Keep(context.Background(), in.Digest, body)
 	rd.InputState = kvRead(inputs)
 	if all, _, err := rd.Inputs(""); err != nil || string(all[in.Digest]) != fmt.Sprintf(`{"size":%d}`, len(body)) {
@@ -137,6 +137,26 @@ func TestTheKeptToolAnswersTheKeysAsStoredByLevelAndByDigest(t *testing.T) { //
 	if _, _, err := rd.Inputs(strings.Repeat("0", 64)); err == nil {
 		t.Error("an input nothing kept was answered")
 	}
+	// The operator's answer on B0: the seat's verb input answers the exact bytes, which the build module's read takes;
+	// a digest that is none, one nothing is kept under, and bytes kept under another digest are errors.
+	if got, err := in.Read(func(key string, b any) (json.RawMessage, error) {
+		if key != "seat:mesh-delivery-checker.input" {
+			return nil, fmt.Errorf("asked %s", key)
+		}
+		a, err := rd.Input(b.(delivery.RunInputAsk).Digest)
+		if err != nil {
+			return nil, err
+		}
+		return json.Marshal(a)
+	}); err != nil || string(got) != string(body) {
+		t.Errorf("the input through the verb = %s, %v", got, err)
+	}
+	_, _ = inputs.Create(context.Background(), strings.Repeat("1", 64), []byte(`{"v":2}`))
+	for _, digest := range []string{"d1", strings.Repeat("0", 64), strings.Repeat("1", 64)} {
+		if a, err := rd.Input(digest); err == nil {
+			t.Errorf("the verb answered %s: %+v", digest, a)
+		}
+	}
 }
 
 // 1680 live acceptance: checker_previews shows the preview key of an open pull request, as stored, narrowed by repository and head.
diff --git a/modules/mesh-delivery-checker/manifest_test.go b/modules/mesh-delivery-checker/manifest_test.go
index c483b32a..f088657d 100644
--- a/modules/mesh-delivery-checker/manifest_test.go
+++ b/modules/mesh-delivery-checker/manifest_test.go
@@ -167,10 +167,11 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	if want := []string{"checker_ask_again", "checker_inputs", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_tries", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
-	// The try is the checker's own seat's verbs (ADR 0547 §10, issue 774), served beside the tools by the same code.
+	// The try is the checker's own seat's verbs (ADR 0547 §10, issue 774), served beside the tools by the same code; so is
+	// input, a checking program's input the Go build module asks (issue 1921, ADR 0596 §2).
 	if len(m.Claims) != 1 || m.Claims[0].Name != "mesh-delivery-checker" || m.Claims[0].Scope != "mesh" ||
-		!reflect.DeepEqual(m.Claims[0].Serves, []string{"try", "try-read", "try-end"}) {
-		t.Errorf("claims = %+v, want the mesh seat mesh-delivery-checker serving try, try-read and try-end", m.Claims)
+		!reflect.DeepEqual(m.Claims[0].Serves, []string{"try", "try-read", "try-end", "input"}) {
+		t.Errorf("claims = %+v, want the mesh seat mesh-delivery-checker serving try, try-read, try-end and input", m.Claims)
 	}
 	for _, k := range []string{"logs", "emits", "provides", "requires", "defines-seats", "seat", "seats", "bus"} { // config: compose-answer-bound (ADR 0593 §7)
 		if _, ok := top[k]; ok {
diff --git a/modules/mesh-delivery-checker/module.json b/modules/mesh-delivery-checker/module.json
index b162fdeb..6e6f9c9c 100644
--- a/modules/mesh-delivery-checker/module.json
+++ b/modules/mesh-delivery-checker/module.json
@@ -9,7 +9,8 @@
       "serves": [
         "try",
         "try-read",
-        "try-end"
+        "try-end",
+        "input"
       ]
     }
   ],
diff --git a/modules/mesh-delivery-indexer/judge/rules_test.go b/modules/mesh-delivery-indexer/judge/rules_test.go
index 5e3c4325..d7b8f230 100644
--- a/modules/mesh-delivery-indexer/judge/rules_test.go
+++ b/modules/mesh-delivery-indexer/judge/rules_test.go
@@ -4848,7 +4848,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			}
 		}
 	}
-	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end" {
+	if strings.Join(checkerVerbs, ",") != "try,try-read,try-end,input" { // input: a checking program's input (issue 1921)
 		t.Errorf("the checker seat serves %v", checkerVerbs)
 	}
 	// The four health seats (novox/hq ADR 0564 clause 1): at mesh scope, each held once, each naming ADR 0564, with the

From 35b800aaef684bdbca8b9894bad3c7a0eb837a11 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Sat, 7 Nov 2026 00:22:38 +0100
Subject: [PATCH 17/17] Format the checker's integration test as gofmt writes
 it, which the group check refused (issue 1921, B0)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i
---
 .../cmd/mesh-delivery-checker/integration_test.go      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
index 6f465286..b22cb10f 100644
--- a/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
+++ b/modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go
@@ -372,11 +372,11 @@ type bed struct {
 	tools    map[string]jetstream.KeyValue
 	// inputsAnswered counts the inputs the seat's verb input answered (issue 1921).
 	inputsAnswered atomic.Int32
-	fake     *fakeBuildModules
-	srvURL   string
-	announce []string
-	mu       sync.Mutex
-	logs     saidLog
+	fake           *fakeBuildModules
+	srvURL         string
+	announce       []string
+	mu             sync.Mutex
+	logs           saidLog
 }
 
 // saidLog is what the program said, safe for its goroutines and the test's.