Ask the forge for the objects of a merge's named paths in the indexer, the one reader of a manifest's paths, and narrow the module's tree from the answer (issue 1758, I6 reworked; ADR 0499 §2 §3, ADR 0495 §1, L8)

The manifest invokes gitea.gitea_commit_trees. A forge that cannot say gives the module none with its words.

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/bus.go

@@ -0,0 +1,159 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-builder/internal/build"
+)
+
+// bucketOpener is the part of the bus the watches use.
+type bucketOpener interface {
+	KeyValue(ctx context.Context, bucket string) (jetstream.KeyValue, error)
+}
+
+// kvStore is the builds bucket as the builder's store: create and compare-and-set.
+type kvStore struct{ kv jetstream.KeyValue }
+
+func conflict(err error) error {
+	if errors.Is(err, jetstream.ErrKeyExists) || errors.Is(err, jetstream.ErrKeyRevisionMismatch) {
+		return build.ErrConflict
+	}
+	return err
+}
+
+func (s kvStore) Get(ctx context.Context, key string) ([]byte, uint64, bool, error) {
+	e, err := s.kv.Get(ctx, key)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, 0, false, nil
+	}
+	if err != nil {
+		return nil, 0, false, err
+	}
+	return e.Value(), e.Revision(), true, nil
+}
+
+func (s kvStore) Create(ctx context.Context, key string, value []byte) (uint64, error) {
+	rev, err := s.kv.Create(ctx, key, value)
+	return rev, conflict(err)
+}
+
+func (s kvStore) Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error) {
+	rev, err := s.kv.Update(ctx, key, value, revision)
+	return rev, conflict(err)
+}
+
+func (s kvStore) Keys(ctx context.Context) ([]string, error) {
+	keys, err := s.kv.Keys(ctx)
+	if errors.Is(err, jetstream.ErrNoKeysFound) {
+		return nil, nil
+	}
+	return keys, err
+}
+
+func opOf(e jetstream.KeyValueEntry) bool { return e.Operation() == jetstream.KeyValuePut }
+
+// settle reads the entries a watcher holds now, up to its mark of the last values, and returns the watcher for the
+// changes that follow.
+func settle(ctx context.Context, kv jetstream.KeyValue, each func(jetstream.KeyValueEntry)) (jetstream.KeyWatcher, error) {
+	w, err := kv.WatchAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			w.Stop()
+			return nil, ctx.Err()
+		case e, ok := <-w.Updates():
+			if !ok {
+				return nil, errors.New("the watch ended")
+			}
+			if e == nil {
+				return w, nil
+			}
+			each(e)
+		}
+	}
+}
+
+// follow hands each change of a watcher to each until ctx ends; a watch that ends is an error, and the process manager
+// starts the program again.
+func follow(ctx context.Context, w jetstream.KeyWatcher, each func(jetstream.KeyValueEntry)) error {
+	defer w.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case e, ok := <-w.Updates():
+			if !ok {
+				return errors.New("a watch ended")
+			}
+			if e != nil {
+				each(e)
+			}
+		}
+	}
+}
+
+// stepsWaiter waits for a build module's step by watching its key in the module's steps bucket (ADR 0469 clause 2): the
+// watch hands over the value the key holds now, so a step that ended before the watch began is read at once, and every
+// change after. No timer: the caller bounds the wait with its context.
+type stepsWaiter struct{ js bucketOpener }
+
+func (w stepsWaiter) Wait(ctx context.Context, module, key string) (delivery.Step, error) {
+	kv, err := w.js.KeyValue(ctx, delivery.StepsBucket(module))
+	if err != nil {
+		return delivery.Step{}, fmt.Errorf("the bucket %s: %w", delivery.StepsBucket(module), err)
+	}
+	watch, err := kv.Watch(ctx, key)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	defer watch.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return delivery.Step{}, ctx.Err()
+		case e, ok := <-watch.Updates():
+			if !ok {
+				return delivery.Step{}, errors.New("the watch of the step ended")
+			}
+			if e == nil || !opOf(e) {
+				continue
+			}
+			step, err := delivery.DecodeStep(e.Value())
+			if err != nil {
+				return delivery.Step{}, fmt.Errorf("the step %s is not a step: %w", key, err)
+			}
+			if step.State != delivery.StepRunning {
+				return step, nil
+			}
+		}
+	}
+}
+
+// manifestReader reads manifests.<digest> of the indexer and parses the manifest it holds.
+type manifestReader struct{ kv jetstream.KeyValue }
+
+func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.Manifest, error) {
+	key, err := delivery.ManifestsKey(digest)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	e, err := m.kv.Get(ctx, key)
+	if err != nil {
+		return catalogue.Manifest{}, fmt.Errorf("manifests.%s: %w", key, err)
+	}
+	kept, err := delivery.DecodeManifest(e.Value())
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/integration_test.go

@@ -0,0 +1,715 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// busConf is the shape of the composed accounts file (mesh-controller internal/broker): one account with JetStream, the
+// controller's user and the builder's own principals <node>.<module> (two instances, for the test of one build).
+const busConf = `
+listen: 127.0.0.1:-1
+jetstream { store_dir: %q }
+accounts {
+  MESH {
+    jetstream: enabled
+    users = [
+      { user: "ctl", password: "pw" }
+      { user: "n1.mesh-delivery-builder", password: "pw" }
+      { user: "n2.mesh-delivery-builder", password: "pw" }
+    ]
+  }
+}
+`
+
+const (
+	commit = "7a74cee83f88e6585a5511c3cc53bdf0f5303d20"
+	fp     = "src2:3333333333333333333333333333333333333333333333333333333333333333"
+)
+
+// fakeBuildModules serve the tools of mesh-build-go and mesh-build-node as the real ones do (ADR 0469 clause 2): a call on
+// mesh.mod.<module>.call.<tool>.<node>.<caller> answers at once with the step and its key, and the step's end is written to
+// the key <node>.<id> of the module's steps bucket, some milliseconds later.
+type fakeBuildModules struct {
+	js        jetstream.JetStream
+	ctx       context.Context
+	n         atomic.Int64
+	failBuild atomic.Bool
+	// refusePush makes every bundle and archive build fail as a push the artifact store refused (ADR 0498 clause 2).
+	refusePush atomic.Bool
+	mu         sync.Mutex
+	calls      map[string]int // by `<module>.<tool>`
+	fetches    []map[string]any
+	builds     []map[string]any // the arguments of every build call
+}
+
+func (f *fakeBuildModules) count(tool string) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.calls[tool]
+}
+
+// digestOf is what every node builds an artifact to.
+func digestOf(artifact string) string {
+	sum := sha256.Sum256([]byte(artifact))
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+func (f *fakeBuildModules) serve(t *testing.T, nc *nats.Conn, module string) {
+	steps, err := f.js.CreateKeyValue(f.ctx, jetstream.KeyValueConfig{Bucket: delivery.StepsBucket(module), History: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sub, err := nc.Subscribe("mesh.mod."+module+".call.>", func(m *nats.Msg) {
+		tokens := strings.Split(m.Subject, ".") // mesh mod <module> call <tool> <node> <caller>
+		tool, node := tokens[4], tokens[5]
+		f.mu.Lock()
+		f.calls[module+"."+tool]++
+		f.mu.Unlock()
+		var args map[string]any
+		_ = json.Unmarshal(m.Data, &args)
+		if strings.HasSuffix(tool, "_fetch") {
+			f.mu.Lock()
+			f.fetches = append(f.fetches, args)
+			f.mu.Unlock()
+		} else {
+			f.mu.Lock()
+			f.builds = append(f.builds, args)
+			f.mu.Unlock()
+		}
+		id := fmt.Sprintf("s%d", f.n.Add(1))
+		key, _ := delivery.StepKey(node, id)
+		put := func(s delivery.Step) {
+			data, err := delivery.EncodeStep(s)
+			if err == nil {
+				_, err = steps.Put(f.ctx, key, data)
+			}
+			if err != nil {
+				t.Errorf("writing step %s: %v", key, err)
+			}
+		}
+		step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: time.Now().UTC()}
+		put(step)
+		answer, _ := json.Marshal(map[string]any{"result": map[string]any{"step": id, "key": key, "state": "running"}, "error": "", "node": node})
+		_ = m.Respond(answer)
+		go func() {
+			time.Sleep(30 * time.Millisecond)
+			step.Ended = time.Now().UTC()
+			switch {
+			case strings.HasSuffix(tool, "_fetch"):
+				merge := ""
+				if args["base"] != nil { // a fetch with a base answers the merge commit (mesh-build-go FetchResult)
+					merge = `,"merge":"` + strings.Repeat("9", 40) + `"`
+				}
+				step.State, step.Result = delivery.StepPassed, json.RawMessage(`{"workspace":"w`+id+`","commit":"`+commit+`"`+merge+`}`)
+			case f.failBuild.Load() && tool != "build_image_copy": // every node's build fails: one node builds a fingerprint
+				step.State, step.Reason = delivery.StepFailed, fmt.Sprintf("go build of %v: boom", args["artifact"])
+			case tool == "build_image_copy": // the upstream copy answers the digest and the registry's reference (ADR 0498 clause 4)
+				d := digestOf(fmt.Sprint(args["artifact"]))
+				step.State, step.Result = delivery.StepPassed, json.RawMessage(`{"artifact":"`+fmt.Sprint(args["artifact"])+`","digest":"`+d+`","reference":"registry.example/`+fmt.Sprint(args["module"])+`/`+fmt.Sprint(args["artifact"])+`@`+d+`","pushed":true}`)
+			case tool != "build_image_build" && f.refusePush.Load():
+				step.State, step.Reason = delivery.StepFailed, fmt.Sprintf("%s%v: the artifact store answered 507 Insufficient Storage", delivery.NotStored, args["artifact"])
+			case tool != "build_image_build": // a bundle or an archive is pushed and its reference answered (ADR 0498 clause 1)
+				d := digestOf(fmt.Sprint(args["artifact"]))
+				step.State, step.Result = delivery.StepPassed, json.RawMessage(`{"digest":"`+d+`","reference":"artifact-store://`+filepath.Base(fmt.Sprint(args["module"]))+`/`+fmt.Sprint(args["artifact"])+`/blobs/`+d+`"}`)
+			case tool == "build_image_build" && args["publish"] == true: // a trunk image is pushed: the digest and the reference
+				d := digestOf(fmt.Sprint(args["artifact"]))
+				step.State, step.Result = delivery.StepPassed, json.RawMessage(`{"digest":"`+d+`","reference":"registry.example/imaged/server@`+d+`"}`)
+			default:
+				step.State, step.Result = delivery.StepPassed, json.RawMessage(`{"digest":"`+digestOf(fmt.Sprint(args["artifact"]))+`"}`)
+			}
+			put(step)
+		}()
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+}
+
+type bed struct {
+	ctx        context.Context
+	js         jetstream.JetStream
+	modules    jetstream.KeyValue
+	candidates jetstream.KeyValue
+	builds     jetstream.KeyValue
+	tools      map[string]jetstream.KeyValue
+	presence   jetstream.KeyValue
+	have       jetstream.KeyValue
+	fake       *fakeBuildModules
+	srvURL     string
+	dir        string
+}
+
+// startBed starts the bus, the buckets the controller makes from the builder's and the build modules' manifests, the
+// build modules' streams and the builder's durable consumers on them, two nodes' toolchains, the indexer's manifests, and
+// the fake build modules. It runs no builder.
+func startBed(t *testing.T) *bed {
+	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "b")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	conf := filepath.Join(dir, "bus.conf")
+	if err := os.WriteFile(conf, []byte(fmt.Sprintf(busConf, filepath.Join(dir, "js"))), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	opts, err := server.ProcessConfigFile(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	opts.NoLog, opts.NoSigs = true, true
+	srv, err := server.NewServer(opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	go srv.Start()
+	if !srv.ReadyForConnections(10 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(srv.Shutdown)
+	ctl, err := nats.Connect(srv.ClientURL(), nats.UserInfo("ctl", "pw"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(ctl.Close)
+	js, err := jetstream.New(ctl)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	t.Cleanup(cancel)
+	b := &bed{ctx: ctx, js: js, tools: map[string]jetstream.KeyValue{}, srvURL: srv.ClientURL(), dir: dir}
+	for module, stream := range toolchainStreams {
+		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: stream, Subjects: []string{"mesh.stream." + module + ".event.toolchain.reported"}}); err != nil {
+			t.Fatal(err)
+		}
+		for _, node := range []string{"n1", "n2"} {
+			if _, err := js.CreateOrUpdateConsumer(ctx, stream, jetstream.ConsumerConfig{Durable: node + "_mesh-delivery-builder", AckPolicy: jetstream.AckExplicitPolicy}); err != nil {
+				t.Fatal(err)
+			}
+		}
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ToolchainsBucket(module), History: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.tools[module] = kv
+	}
+	mk := func(name string, history int) jetstream.KeyValue {
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: uint8(history)})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return kv
+	}
+	b.modules = mk(delivery.ModulesBucket, delivery.ModulesHistory)
+	b.candidates = mk(delivery.CandidatesBucket, delivery.CandidatesHistory)
+	mk(delivery.ManifestsBucket, delivery.ManifestsHistory)
+	b.builds = mk(delivery.BuilderBuildsBucket, delivery.BuilderBuildsHistory)
+	presence := mk(delivery.PresenceBucket, delivery.PresenceHistory)
+	b.presence, b.have = presence, mk(delivery.HaveBucket, delivery.HaveHistory)
+	for _, node := range []string{"n1", "n2"} {
+		b.setOnline(t, node, true)
+		for _, module := range []string{"mesh-build-go", "mesh-build-node"} {
+			b.setHealth(t, node, module, delivery.HealthOK)
+		}
+	}
+	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
+	b.fake.serve(t, ctl, "mesh-build-go")
+	b.fake.serve(t, ctl, "mesh-build-node")
+	b.fake.serve(t, ctl, "mesh-build-image")
+	b.setHealth(t, "n1", "mesh-build-image", delivery.HealthOK) // the image build module runs on n1 only
+	b.report(t, "mesh-build-go", "n1", "go", "go1.27.1", "1")
+	b.report(t, "mesh-build-go", "n2", "go", "go1.27.1", "1")
+	b.report(t, "mesh-build-node", "n1", "typescript", "tsc5", "1")
+	b.report(t, "mesh-build-node", "n2", "typescript", "tsc5", "1")
+	return b
+}
+
+// setOnline writes the watchman's presence of a node.
+func (b *bed) setOnline(t *testing.T, node string, online bool) {
+	t.Helper()
+	data, _ := delivery.EncodePresence(delivery.Presence{Online: online})
+	if _, err := b.presence.Put(b.ctx, node, data); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// setHealth writes the node-engine's have of a build module on a node, running with this health.
+func (b *bed) setHealth(t *testing.T, node, module string, health delivery.Health) {
+	t.Helper()
+	data, err := delivery.EncodeHave(delivery.Have{Phase: delivery.PhaseRunning, Health: health})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.HaveKey(node, module)
+	if _, err := b.have.Put(b.ctx, key, data); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// report writes a node's toolchains key of a build module and says so on the module's stream, as the module does.
+func (b *bed) report(t *testing.T, module, node, language, version, recipe string) {
+	t.Helper()
+	data, err := delivery.EncodeToolchain(delivery.Toolchain{Language: language, Version: version, Recipe: recipe, At: time.Now().UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.ToolchainKey(node, language)
+	if _, err := b.tools[module].Put(b.ctx, key, data); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.js.Publish(b.ctx, "mesh.stream."+module+".event.toolchain.reported", []byte(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// module writes modules.<name> as the indexer does for a module with a new-form fingerprint, and its manifest by digest.
+func (b *bed) module(t *testing.T, name, fixture, path string) string {
+	return b.moduleWith(t, name, fixture, path, map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.1", Recipe: "1"}, "typescript": {Version: "tsc5", Recipe: "1"}})
+}
+
+// moduleWith is module with the toolchains its fingerprint was computed with.
+func (b *bed) moduleWith(t *testing.T, name, fixture, path string, toolchains map[string]delivery.ToolchainUsed) string {
+	return b.moduleCommit(t, name, fixture, path, toolchains, commit)
+}
+
+func (b *bed) moduleCommit(t *testing.T, name, fixture, path string, toolchains map[string]delivery.ToolchainUsed, at string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", fixture))
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := delivery.ManifestDigest(raw)
+	manifests, err := b.js.KeyValue(b.ctx, delivery.ManifestsBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mv, err := delivery.EncodeManifest(delivery.Manifest{Module: name, JSON: string(raw)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := manifests.Put(b.ctx, digest, mv); err != nil {
+		t.Fatal(err)
+	}
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: at, FP: "src1:" + strings.Repeat("f", 64), FP2: fp,
+		Manifest: digest, Path: path, Toolchains: toolchains})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.modules.Put(b.ctx, name, data); err != nil {
+		t.Fatal(err)
+	}
+	return digest
+}
+
+// archive writes modules.<name> as the real indexer does for a module of an archive only: its fingerprint names no
+// toolchain (mesh-delivery-indexer internal/index inputs.go languagesOf gives an archive no language), so Toolchains is empty.
+func (b *bed) archive(t *testing.T, name, path, at string) string {
+	t.Helper()
+	return b.moduleCommit(t, name, "catalogue-a67f0196-ca-trust.module.json", path, nil, at)
+}
+
+// start runs the program as the builder of a node.
+func (b *bed) start(t *testing.T, node string, env map[string]string) {
+	t.Helper()
+	broker := filepath.Join(t.TempDir(), "broker")
+	cred, _ := json.Marshal(credential{URL: b.srvURL, Node: node, Module: "mesh-delivery-builder", User: node + ".mesh-delivery-builder", Password: "pw"})
+	if err := os.WriteFile(broker, cred, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	e := map[string]string{"MESH_BROKER_FILE": broker}
+	for k, v := range env {
+		e[k] = v
+	}
+	runCtx, stop := context.WithCancel(b.ctx)
+	done := make(chan error, 1)
+	go func() { done <- run(runCtx, func(k string) string { return e[k] }, io.Discard) }()
+	t.Cleanup(func() { stop(); <-done })
+}
+
+// await reads the build key until pred holds of it, within 20 s.
+func (b *bed) await(t *testing.T, module string, pred func(delivery.BuilderBuild) bool) delivery.BuilderBuild {
+	t.Helper()
+	key, err := delivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var last delivery.BuilderBuild
+	for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		e, err := b.builds.Get(b.ctx, key)
+		if err != nil {
+			continue
+		}
+		if last, err = delivery.DecodeBuilderBuild(e.Value()); err == nil && pred(last) {
+			return last
+		}
+	}
+	t.Fatalf("builds.%s = %+v within 20 s", key, last)
+	return last
+}
+
+func isState(state string) func(delivery.BuilderBuild) bool {
+	return func(v delivery.BuilderBuild) bool { return v.State == state }
+}
+
+// TestBuilderMakesADoneKeyWithTheDigests: modules.netcheck (a Go and a TypeScript bundle) and its manifest are in the
+// indexer's buckets, and two nodes report each build module's toolchain; the program writes builds.netcheck.<fp> done,
+// the digests of both bundles, both build modules' toolchains, after a fetch and a build on one node (ADR 0478 clause 4).
+func TestBuilderMakesADoneKeyWithTheDigests(t *testing.T) { // 1607/AC7
+	b := startBed(t)
+	digest := b.module(t, "netcheck", "catalogue-a67f0196-netcheck.module.json", "modules/netcheck")
+	b.start(t, "n1", nil)
+	v := b.await(t, "netcheck", isState(delivery.BuildDone))
+	if v.By != "n1.mesh-delivery-builder" || v.Manifest != digest || len(v.Artifacts) != 2 {
+		t.Fatalf("build = %+v", v)
+	}
+	for _, a := range v.Artifacts {
+		if a.Digest != digestOf(a.Name) || a.Kind != "bundle" || a.Reference != "artifact-store://netcheck/"+a.Name+"/blobs/"+a.Digest {
+			t.Errorf("artifact = %+v, want the digest every node built and the reference its push answered (ADR 0498 clause 1)", a)
+		}
+	}
+	if v.Toolchains["go"].Version != "go1.27.1" || v.Toolchains["typescript"].Version != "tsc5" {
+		t.Errorf("toolchains = %+v", v.Toolchains)
+	}
+	for tool, want := range map[string]int{"mesh-build-go.build_go_fetch": 1, "mesh-build-go.build_go_build": 1, "mesh-build-node.build_node_fetch": 1, "mesh-build-node.build_node_build": 1} {
+		if got := b.fake.count(tool); got != want {
+			t.Errorf("%s called %d times, want %d (on one node, ADR 0478 clause 4)", tool, got, want)
+		}
+	}
+}
+
+// TestTwoBuilderInstancesStartingTogetherEndWithOneDoneKey: two builders on two nodes start together on one module key of an
+// archive only (no toolchain named, as the indexer writes it); the second takes over the key the first holds building
+// (ADR 0478 clause 6), and the key ends done, written once.
+func TestTwoBuilderInstancesStartingTogetherEndWithOneDoneKey(t *testing.T) { // 1607/AC7
+	b := startBed(t)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	b.start(t, "n2", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if len(v.Artifacts) != 1 || v.Artifacts[0].Kind != "archive" || v.Artifacts[0].Digest != digestOf("files") {
+		t.Fatalf("build = %+v, want the archive's digest", v)
+	}
+	if n := b.fake.count("mesh-build-go.build_go_build"); n < 1 { // each instance that built, on one node
+		t.Errorf("build_go_build was called %d times, want one for each instance that built", n)
+	}
+}
+
+// TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt: the indexer gives an archive no language, so modules.ca-trust has no
+// toolchains; the builder builds it on the build module's nodes all the same (review round 4).
+func TestAnArchiveOnlyModuleNamingNoToolchainIsBuilt(t *testing.T) {
+	b := startBed(t)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if len(v.Toolchains) != 0 || len(v.Artifacts) != 1 || strings.HasPrefix(v.Step, "one node (") {
+		t.Errorf("build = %+v, want done naming no toolchain", v)
+	}
+}
+
+// TestANodeWhoseBuildModuleIsUnhealthyIsNotUsed: the node-engine's have of mesh-build-go on n2 says failed, so only n1 builds.
+func TestANodeWhoseBuildModuleIsUnhealthyIsNotUsed(t *testing.T) {
+	b := startBed(t)
+	b.setHealth(t, "n2", "mesh-build-go", delivery.HealthFailed)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if !strings.Contains(v.Step, "on n1") {
+		t.Errorf("build = %+v, want it built on n1 alone", v)
+	}
+}
+
+// TestAFailedKeyIsBuiltAgainAsANewRevisionFromANewModulesValueWithTheSameFingerprint: a build step fails on one node, so the
+// key is failed naming it; the indexer writing modules.<m> again with the same fingerprint wakes the builder, which builds
+// the key again as a new revision of the same key, now done.
+func TestAFailedKeyIsBuiltAgainAsANewRevisionFromANewModulesValueWithTheSameFingerprint(t *testing.T) { // 1607/AC6, AC7
+	b := startBed(t)
+	b.fake.failBuild.Store(true)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildFailed))
+	if !strings.Contains(v.Error, " on n") || !strings.Contains(v.Error, "boom") {
+		t.Errorf("build = %+v, want failed naming the node and the step's reason", v)
+	}
+	key, _ := delivery.BuilderBuildKey("ca-trust", fp)
+	failed, err := b.builds.Get(b.ctx, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.fake.failBuild.Store(false)
+	// The indexer writes the module again (here at a later commit), with the same fingerprint.
+	b.archive(t, "ca-trust", "modules/ca-trust", "89abcdef0123456789abcdef0123456789abcdef")
+	b.await(t, "ca-trust", isState(delivery.BuildDone))
+	done, err := b.builds.Get(b.ctx, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if done.Revision() <= failed.Revision() {
+		t.Errorf("revision %d, was %d: the key was not written as a new revision", done.Revision(), failed.Revision())
+	}
+}
+
+// TestAToolchainChangeDoesNotBuildTheOldFingerprint: the fingerprint names go1.27.1, the nodes then agree on go1.27.2 (a
+// report of both nodes), and the builder writes no key for the old fingerprint although it was woken by the report; a
+// module value naming go1.27.2 (the new fingerprint, computed by the indexer) is built.
+func TestAToolchainChangeDoesNotBuildTheOldFingerprint(t *testing.T) { // 1615/AC4
+	b := startBed(t)
+	b.report(t, "mesh-build-go", "n1", "go", "go1.27.2", "1")
+	b.report(t, "mesh-build-go", "n2", "go", "go1.27.2", "1")
+	b.module(t, "netcheck", "catalogue-a67f0196-netcheck.module.json", "modules/netcheck") // names go1.27.1
+	b.start(t, "n1", nil)
+	// Another module, whose fingerprint names the new toolchain, is built; by then the old one has been looked at.
+	b.moduleCommit(t, "netcheck2", "catalogue-a67f0196-netcheck.module.json", "modules/netcheck",
+		map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.2", Recipe: "1"}, "typescript": {Version: "tsc5", Recipe: "1"}}, commit)
+	b.await(t, "netcheck2", isState(delivery.BuildDone))
+	if _, err := b.builds.Get(b.ctx, mustKey(t, "netcheck")); err == nil {
+		t.Error("the old fingerprint, naming go1.27.1, was built with go1.27.2")
+	}
+	if n := b.fake.count("mesh-build-go.build_go_build"); n != 1 {
+		t.Errorf("build_go_build was called %d times, want 1 (the new fingerprint on one node only)", n)
+	}
+}
+
+// TestARootModuleIsBuilt: a module whose path is "." is given to the build tools as it is.
+func TestARootModuleIsBuilt(t *testing.T) { // 1615/AC4
+	b := startBed(t)
+	b.archive(t, "ca-trust", delivery.RootPath, commit)
+	b.start(t, "n1", nil)
+	b.await(t, "ca-trust", isState(delivery.BuildDone))
+}
+
+func mustKey(t *testing.T, module string) string {
+	k, err := delivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return k
+}
+
+// moduleAt is module with the go toolchain version the fingerprint names and the commit it was computed at.
+func (b *bed) moduleAt(t *testing.T, name, fixture, path, goVersion, at string) {
+	t.Helper()
+	b.moduleCommit(t, name, fixture, path, map[string]delivery.ToolchainUsed{"go": {Version: goVersion, Recipe: "1"}}, at)
+}
+
+// TestAKeyLeftBuildingForAModuleThatIsGoneIsClosedAtStart: the builds bucket holds a key left building by another node for
+// a module the indexer no longer has; the program, at start, fails it naming why (issue 1660, ADR 0478 clause 6).
+func TestAKeyLeftBuildingForAModuleThatIsGoneIsClosedAtStart(t *testing.T) {
+	b := startBed(t)
+	data, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildBuilding, By: "n2.mesh-delivery-builder", Manifest: strings.Repeat("a", 64)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.builds.Put(b.ctx, mustKey(t, "ghost"), data); err != nil {
+		t.Fatal(err)
+	}
+	b.start(t, "n1", nil)
+	v := b.await(t, "ghost", isState(delivery.BuildFailed))
+	if !strings.Contains(v.Error, "no longer has this fingerprint") || !strings.Contains(v.Error, "n2.mesh-delivery-builder") {
+		t.Errorf("build = %+v, want it closed naming who left it", v)
+	}
+}
+
+// TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk: the trunk's record of netcheck carries a fingerprint of its
+// own; a candidate the indexer wrote gives netcheck the fingerprint fp at a pull request's head; the program writes
+// builds.netcheck.<fp> done, its fetch given the head, the ref that carries it and the trunk commit (issue 1684).
+func TestBuilderBuildsACandidatesFingerprintFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1
+	b := startBed(t)
+	other := "src2:" + strings.Repeat("e", 64)
+	digest := b.module(t, "netcheck", "catalogue-a67f0196-netcheck.module.json", "modules/netcheck")
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: commit, FP: "src1:" + strings.Repeat("f", 64), FP2: other,
+		Manifest: digest, Path: "modules/netcheck", Toolchains: map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.1", Recipe: "1"}, "typescript": {Version: "tsc5", Recipe: "1"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.modules.Put(b.ctx, "netcheck", data); err != nil {
+		t.Fatal(err)
+	}
+	const head = "1111111111111111111111111111111111111111"
+	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"netcheck"},
+		Fps: map[string]delivery.CandidateModule{"netcheck": {FP2: fp, Manifest: digest}}}}
+	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ckey, err := delivery.CandidatesKey("feat/x")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.candidates.Put(b.ctx, ckey, cand); err != nil {
+		t.Fatal(err)
+	}
+	b.start(t, "n1", nil)
+	v := b.await(t, "netcheck", isState(delivery.BuildDone))
+	if len(v.Artifacts) != 2 {
+		t.Fatalf("build = %+v", v)
+	}
+	b.fake.mu.Lock()
+	defer b.fake.mu.Unlock()
+	found := false
+	for _, f := range b.fake.fetches {
+		if f["commit"] == head && f["ref"] == "refs/pull/7/head" && f["base"] == commit {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("fetches = %v, want one of the candidate's head with its ref and the trunk commit", b.fake.fetches)
+	}
+}
+
+// TestAnImageIsBuiltOnOneNodeAndOnlyATrunkKeyPublishes: modules.imaged (one image artifact) is built on n1, where
+// mesh-build-image runs: a trunk record's key is done with the digest and the reference, its build call carrying publish; a
+// candidate's key for the same module is built first with no publish and no reference; when the pull request is merged and the
+// trunk's record names the candidate's fingerprint, the key is built again with publish and ends with a reference
+// (ADR 0487 clauses 5 and 12).
+func TestAnImageIsBuiltOnOneNodeAndOnlyATrunkKeyPublishes(t *testing.T) { // 1705
+	b := startBed(t)
+	other := "src2:" + strings.Repeat("e", 64)
+	digest := b.moduleCommit(t, "imaged", "catalogue-a67f0196-imaged.module.json", "modules/imaged", nil, commit)
+	// The trunk carries `other`; its key is built and published.
+	trunk := func(fp2 string) {
+		data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: commit, FP: "src1:" + strings.Repeat("f", 64), FP2: fp2,
+			Manifest: digest, Path: "modules/imaged"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := b.modules.Put(b.ctx, "imaged", data); err != nil {
+			t.Fatal(err)
+		}
+	}
+	trunk(other)
+	b.start(t, "n1", nil)
+	okey, _ := delivery.BuilderBuildKey("imaged", other)
+	awaitKey := func(key string, pred func(delivery.BuilderBuild) bool) delivery.BuilderBuild {
+		var last delivery.BuilderBuild
+		for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+			if e, err := b.builds.Get(b.ctx, key); err == nil {
+				if last, err = delivery.DecodeBuilderBuild(e.Value()); err == nil && pred(last) {
+					return last
+				}
+			}
+		}
+		t.Fatalf("builds.%s = %+v within 20 s", key, last)
+		return last
+	}
+	v := awaitKey(okey, isState(delivery.BuildDone))
+	if len(v.Artifacts) != 1 || v.Artifacts[0].Digest != digestOf("server") || !strings.HasSuffix(v.Artifacts[0].Reference, "@"+digestOf("server")) {
+		t.Fatalf("trunk build = %+v, want the digest and the reference", v)
+	}
+	// The candidate carries fp: built, not published.
+	const head = "1111111111111111111111111111111111111111"
+	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: head}, Modules: []string{"imaged"},
+		Fps: map[string]delivery.CandidateModule{"imaged": {FP2: fp, Manifest: digest}}}}
+	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
+	cand, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ckey, _ := delivery.CandidatesKey("feat/x")
+	if _, err := b.candidates.Put(b.ctx, ckey, cand); err != nil {
+		t.Fatal(err)
+	}
+	v = b.await(t, "imaged", isState(delivery.BuildDone))
+	if len(v.Artifacts) != 1 || v.Artifacts[0].Reference != "" {
+		t.Fatalf("candidate build = %+v, want done with no reference", v)
+	}
+	b.fake.mu.Lock()
+	if len(b.fake.builds) != 2 || b.fake.builds[0]["publish"] != true || b.fake.builds[1]["publish"] != nil {
+		t.Errorf("builds = %v, want the trunk's with publish, then the candidate's with none", b.fake.builds)
+	}
+	b.fake.mu.Unlock()
+	// The pull request is merged: the trunk's record names fp, and its key ends published, built once more with publish.
+	trunk(fp)
+	v = b.await(t, "imaged", func(v delivery.BuilderBuild) bool {
+		return v.State == delivery.BuildDone && len(v.Artifacts) == 1 && v.Artifacts[0].Reference != ""
+	})
+	if v.Artifacts[0].Digest != digestOf("server") {
+		t.Errorf("merged build = %+v", v)
+	}
+	b.fake.mu.Lock()
+	defer b.fake.mu.Unlock()
+	published := 0
+	for _, a := range b.fake.builds {
+		if a["publish"] == true {
+			published++
+		}
+	}
+	if len(b.fake.builds) != 3 || published != 2 {
+		t.Errorf("builds = %v, want three, two of them with publish (the trunk's two fingerprints)", b.fake.builds)
+	}
+}
+
+// TestEveryDoneKeyNamesItsReferencesAndARefusedPushIsBuiltAgain: with the artifact store refusing pushes, the key of an
+// archive module ends failed opening "not stored:"; once it takes them, a new modules value builds the key again, done, its
+// every artifact naming a reference (issue 1587, B8, ADR 0498 clauses 1, 2 and 8).
+func TestEveryDoneKeyNamesItsReferencesAndARefusedPushIsBuiltAgain(t *testing.T) {
+	b := startBed(t)
+	b.fake.refusePush.Store(true)
+	b.archive(t, "ca-trust", "modules/ca-trust", commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "ca-trust", isState(delivery.BuildFailed))
+	if !strings.HasPrefix(v.Error, delivery.NotStored) || !strings.Contains(v.Error, "507") {
+		t.Fatalf("build = %+v, want failed opening %q with the store's words", v, delivery.NotStored)
+	}
+	b.fake.refusePush.Store(false)
+	b.archive(t, "ca-trust", "modules/ca-trust", "89abcdef0123456789abcdef0123456789abcdef")
+	v = b.await(t, "ca-trust", isState(delivery.BuildDone))
+	if ok, missing := v.Referenced(); !ok {
+		t.Errorf("build = %+v, artifacts naming no reference: %v", v, missing)
+	}
+}
+
+// TestAPinnedUpstreamIsCopiedByTheImageBuildModule: hello-web's manifest (captured from mesh-catalog 49caf17f) names an
+// upstream image pinned by its digest and an archive; the upstream is copied on n1, where mesh-build-image runs, with no
+// fetch of the image module, and the key ends done with both references (issue 1587, B8, ADR 0498 clause 4).
+func TestAPinnedUpstreamIsCopiedByTheImageBuildModule(t *testing.T) {
+	b := startBed(t)
+	b.moduleCommit(t, "hello-web", "catalogue-49caf17f-hello-web.module.json", "modules/hello-web", nil, commit)
+	b.start(t, "n1", nil)
+	v := b.await(t, "hello-web", isState(delivery.BuildDone))
+	if ok, missing := v.Referenced(); !ok {
+		t.Fatalf("build = %+v, artifacts naming no reference: %v", v, missing)
+	}
+	if n := b.fake.count("mesh-build-image.build_image_copy"); n != 1 {
+		t.Errorf("build_image_copy called %d times, want once", n)
+	}
+	if n := b.fake.count("mesh-build-image.build_image_fetch"); n != 0 {
+		t.Errorf("build_image_fetch called %d times, want none for a copy", n)
+	}
+}
+
+// TestAManifestFallingBackToAPredefinedKeyIsBuilt: claude-code's manifest (mesh-catalog 835bf22b) has a config value falling
+// back to a predefined key; the builder, which holds no published list of them, reads it and builds the key done (issue
+// 1751, mesh-sdk catalogue.ParseManifestForInputs).
+func TestAManifestFallingBackToAPredefinedKeyIsBuilt(t *testing.T) {
+	b := startBed(t)
+	b.module(t, "claude-code", "catalogue-835bf22b-claude-code.module.json", "modules/claude-code")
+	b.start(t, "n1", nil)
+	v := b.await(t, "claude-code", func(v delivery.BuilderBuild) bool {
+		return v.State == delivery.BuildDone || v.State == delivery.BuildFailed
+	})
+	if v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want done: the manifest is read", v)
+	}
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/main.go

@@ -0,0 +1,289 @@
+// Command mesh-delivery-builder is delivery's builder (novox/hq ADR 0453 clause 4, ADR 0478, issue 1607): it builds every
+// new-form fingerprint the indexer writes, dark, into its own build keys (builds.<module>.<fingerprint>), through the build
+// modules' fetch and build tools. Nothing reads its keys to deliver until release R4e. It serves no request subject and
+// holds no timer: every reaction is a watch or a bus event (ADR 0437 §8).
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"io"
+	"log"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"mesh-delivery-builder/internal/build"
+)
+
+const (
+	// defaultStepBound is how long the builder waits for one step of a build module (a fetch downloads the Go modules, a
+	// build compiles).
+	defaultStepBound = 30 * time.Minute
+)
+
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	if err := run(ctx, os.Getenv, os.Stderr); err != nil {
+		fmt.Fprintln(os.Stderr, "mesh-delivery-builder:", err)
+		os.Exit(1)
+	}
+}
+
+// credential is the broker file the controller issues to the module: JSON of the bus address, the certificate
+// fingerprint to pin, the principal and its password (as the indexer reads it; issue 1242 moves this into the SDK).
+type credential struct {
+	URL         string `json:"url"`
+	Fingerprint string `json:"fingerprint"`
+	Node        string `json:"node"`
+	Module      string `json:"module"`
+	User        string `json:"user"`
+	Password    string `json:"password"`
+}
+
+func readCredential(path string) (credential, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return credential{}, err
+	}
+	var c credential
+	if err := json.Unmarshal(raw, &c); err != nil {
+		return credential{}, fmt.Errorf("the broker credential is not one: %w", err)
+	}
+	if c.URL == "" || c.User == "" {
+		return credential{}, errors.New("the broker credential names no bus address or user")
+	}
+	return c, nil
+}
+
+// pinned accepts exactly the certificate with this SHA-256 and no other.
+func pinned(want string) *tls.Config {
+	return &tls.Config{
+		InsecureSkipVerify: true, //nolint:gosec // replaced by the pin below, which is stricter
+		MinVersion:         tls.VersionTLS12,
+		VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+			if len(rawCerts) == 0 {
+				return errors.New("the bus presented no certificate")
+			}
+			sum := sha256.Sum256(rawCerts[0])
+			if got := "sha256:" + hex.EncodeToString(sum[:]); got != want {
+				return fmt.Errorf("the bus presented a certificate this mesh does not know (%.23s…)", got)
+			}
+			return nil
+		},
+	}
+}
+
+// run is the program: it returns when ctx ends or the bus cannot be used.
+func run(ctx context.Context, getenv func(string) string, logOut io.Writer) error {
+	logger := log.New(logOut, "mesh-delivery-builder: ", log.LstdFlags)
+	path := strings.TrimSpace(getenv("MESH_BROKER_FILE"))
+	if path == "" {
+		return errors.New("MESH_BROKER_FILE is not set, so there is no credential to hear the bus with")
+	}
+	cred, err := readCredential(path)
+	if err != nil {
+		return err
+	}
+	opts := []nats.Option{
+		nats.Name(cred.Node + "." + cred.Module),
+		nats.UserInfo(cred.User, cred.Password),
+		nats.CustomInboxPrefix("_INBOX." + cred.User),
+		nats.MaxReconnects(-1),
+		nats.RetryOnFailedConnect(true),
+	}
+	if strings.TrimSpace(cred.Fingerprint) != "" {
+		opts = append(opts, nats.Secure(pinned(cred.Fingerprint)))
+	}
+	conn, err := nats.Connect(cred.URL, opts...)
+	if err != nil {
+		return fmt.Errorf("connecting to the bus: %w", err)
+	}
+	defer conn.Close()
+	js, err := jetstream.New(conn)
+	if err != nil {
+		return err
+	}
+	bucket := func(name string) (jetstream.KeyValue, error) {
+		kv, err := js.KeyValue(ctx, name)
+		if err != nil {
+			return nil, fmt.Errorf("the bucket %s: %w", name, err)
+		}
+		return kv, nil
+	}
+	builds, err := bucket(delivery.BuilderBuildsBucket)
+	if err != nil {
+		return err
+	}
+	modules, err := bucket(delivery.ModulesBucket)
+	if err != nil {
+		return err
+	}
+	manifests, err := bucket(delivery.ManifestsBucket)
+	if err != nil {
+		return err
+	}
+	candidates, err := bucket(delivery.CandidatesBucket)
+	if err != nil {
+		return err
+	}
+	// Calls to the build modules go out as this module's own account, naming the machine (mesh-sdk process.CallOn); the
+	// buckets are read and written on the connection above.
+	account, err := process.ReadAccount(path)
+	if err != nil {
+		return err
+	}
+	caller, err := process.Connect(account, nats.Name(cred.Node+"."+cred.Module+".calls"), nats.RetryOnFailedConnect(true))
+	if err != nil {
+		return err
+	}
+	defer caller.Close()
+
+	bound := defaultStepBound
+	if v := strings.TrimSpace(getenv("MESH_BUILDER_STEP_BOUND")); v != "" {
+		if bound, err = time.ParseDuration(v); err != nil {
+			return fmt.Errorf("MESH_BUILDER_STEP_BOUND: %w", err)
+		}
+	}
+	capacity, err := capacityFrom(strings.TrimSpace(getenv("MESH_BUILDER_SETTINGS")), getenv("MESH_BUILDER_CAPACITY"))
+	if err != nil {
+		return fmt.Errorf("the build capacity setting: %w", err)
+	}
+	tools := &buildrun.ToolchainSet{}
+	presence := &buildrun.PresenceSet{}
+	have := &buildrun.HaveSet{}
+	b := &build.Builder{
+		Claimer:    build.Claimer{Store: kvStore{builds}, By: cred.Node + "." + cred.Module},
+		Runner:     buildrun.Runner{Caller: caller, Steps: stepsWaiter{js}, Bound: bound},
+		Toolchains: tools,
+		Presence:   presence,
+		Health:     have,
+		Places:     &buildrun.Places{Capacity: capacity},
+		Manifests:  manifestReader{manifests},
+		Logf:       logger.Printf,
+	}
+	// The toolchains first, so a build that starts from the first modules value finds the nodes.
+	watch := newToolchainWatch(ctx, js, tools, b.NodesChanged, logger)
+	if err := watch.start(); err != nil {
+		return err
+	}
+	// A build module says each time it wrote its toolchains key: its stream, and the builder's durable consumer on it, are
+	// made by the controller. Where the stream is not there yet the builder says so and is started again with the build
+	// module.
+	for _, module := range []string{buildrun.GoBuildModule, buildrun.NodeBuildModule} {
+		stream := toolchainStreams[module]
+		cons, err := js.Consumer(ctx, stream, cred.Node+"_"+cred.Module)
+		if err != nil {
+			logger.Printf("the consumer %s_%s on %s does not exist yet, so %s's reports are not heard until the builder starts again: %v", cred.Node, cred.Module, stream, module, err)
+			continue
+		}
+		cc, err := cons.Consume(func(m jetstream.Msg) { watch.Reported(m) },
+			jetstream.ConsumeErrHandler(func(_ jetstream.ConsumeContext, err error) { logger.Printf("hearing the bus: %v", err) }))
+		if err != nil {
+			return err
+		}
+		defer cc.Stop()
+	}
+	// The watchman's presence says which nodes are asleep. Where its bucket is not there yet no node is online, so nothing
+	// builds; the builder says so and is started again with the watchman.
+	presenceErrs := make(chan error, 1)
+	switch kv, err := js.KeyValue(ctx, delivery.PresenceBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no node counts as online until the builder starts again", delivery.PresenceBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.PresenceBucket, err)
+	default:
+		pw, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) { presence.Put(e.Key(), e.Value(), !opOf(e)) })
+		if err != nil {
+			return err
+		}
+		go func() {
+			presenceErrs <- follow(ctx, pw, func(e jetstream.KeyValueEntry) {
+				if presence.Put(e.Key(), e.Value(), !opOf(e)) {
+					b.NodesChanged(ctx) // a node came online or went: a build that waited for one may go on
+				}
+			})
+		}()
+	}
+	// The node-engine's have says whether a node's build module runs and is healthy: a node whose build module is not is not
+	// chosen (ADR 0478 clause 3). Where its bucket is not there yet no build module counts as healthy, so nothing builds.
+	haveErrs := make(chan error, 1)
+	switch kv, err := js.KeyValue(ctx, delivery.HaveBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no build module counts as healthy until the builder starts again", delivery.HaveBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.HaveBucket, err)
+	default:
+		hw, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) { have.Put(e.Key(), e.Value(), !opOf(e)) })
+		if err != nil {
+			return err
+		}
+		go func() {
+			haveErrs <- follow(ctx, hw, func(e jetstream.KeyValueEntry) {
+				if have.Put(e.Key(), e.Value(), !opOf(e)) {
+					b.NodesChanged(ctx) // a build module became healthy or stopped being: a build that waited may go on
+				}
+			})
+		}()
+	}
+	each := func(e jetstream.KeyValueEntry) {
+		if opOf(e) {
+			b.Module(ctx, e.Key(), e.Value())
+		} else {
+			b.Forget(e.Key())
+		}
+	}
+	w, err := settle(ctx, modules, each)
+	if err != nil {
+		return err
+	}
+	// A key left building for a fingerprint its module no longer has is closed (issue 1660); the modules are all known now.
+	if err := b.Sweep(ctx); err != nil {
+		return err
+	}
+	// The fingerprints the indexer gives the candidates' modules are built too (issue 1684), once the trunk's modules are known.
+	eachCandidate := func(e jetstream.KeyValueEntry) {
+		if opOf(e) {
+			b.Candidate(ctx, e.Key(), e.Value())
+		} else {
+			b.ForgetCandidate(e.Key())
+		}
+	}
+	cw, err := settle(ctx, candidates, eachCandidate)
+	if err != nil {
+		return err
+	}
+	logger.Printf("started on %s", cred.Node)
+	errs := make(chan error, 2)
+	go func() { errs <- follow(ctx, w, each) }()
+	go func() { errs <- follow(ctx, cw, eachCandidate) }()
+	select {
+	case <-ctx.Done():
+		b.Wait()
+		return nil
+	case err := <-errs:
+		return err
+	case err := <-watch.errs:
+		return err
+	case err := <-presenceErrs:
+		return err
+	case err := <-haveErrs:
+		return err
+	}
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/settings.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"os"
+)
+
+// capacityFrom is the build capacity of each node (ADR 0478 clause 3): the module's setting `capacity`, `<node>=<steps at
+// once>` pairs separated by commas, laid into the settings file the controller composes (issue 1661); empty is one step at a
+// time on every node. With no settings file named, fallback is read instead, for a run outside the module's launch.
+func capacityFrom(path, fallback string) (map[string]int, error) {
+	if path == "" {
+		return buildrun.ParseCapacity(fallback)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("the settings file: %w", err)
+	}
+	var s struct {
+		Capacity string `json:"capacity"`
+	}
+	if err := json.Unmarshal(raw, &s); err != nil {
+		return nil, fmt.Errorf("the settings file %s is not JSON: %w", path, err)
+	}
+	return buildrun.ParseCapacity(s.Capacity)
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/settings_test.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func settingsFile(t *testing.T, body string) string {
+	t.Helper()
+	p := filepath.Join(t.TempDir(), "settings.json")
+	if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// 1661: the build capacity is the module's setting `capacity`, laid into the settings file: empty is one step at a time everywhere.
+func TestCapacityIsReadFromTheSettingsFile(t *testing.T) {
+	for body, want := range map[string]map[string]int{
+		`{"capacity": "shanks=3,ace=2"}`: {"shanks": 3, "ace": 2},
+		`{"capacity": ""}`:               {},
+		`{}`:                             {},
+	} {
+		got, err := capacityFrom(settingsFile(t, body), "")
+		if err != nil || len(got) != len(want) || got["shanks"] != want["shanks"] || got["ace"] != want["ace"] {
+			t.Errorf("%s: capacity %v, %v, want %v", body, got, err, want)
+		}
+	}
+	p := &buildrun.Places{Capacity: mustCapacity(t, settingsFile(t, `{"capacity": ""}`))}
+	if p.CapacityOf("shanks") != 1 || p.CapacityOf("ace") != 1 {
+		t.Errorf("an empty setting gives %d and %d, want 1 everywhere", p.CapacityOf("shanks"), p.CapacityOf("ace"))
+	}
+}
+
+func mustCapacity(t *testing.T, path string) map[string]int {
+	t.Helper()
+	c, err := capacityFrom(path, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+func TestACapacitySettingThatIsNotOneIsRefusedNamingIt(t *testing.T) {
+	if _, err := capacityFrom(settingsFile(t, `{"capacity": "shanks=-1"}`), ""); err == nil {
+		t.Error("shanks=-1 accepted")
+	}
+	if c, err := capacityFrom(settingsFile(t, `{"capacity": "shanks=3,ace=2,g14=0,novox=0"}`), ""); err != nil || c["g14"] != 0 || len(c) != 4 {
+		t.Errorf("the starting value: %v, %v", c, err)
+	}
+	if _, err := capacityFrom(settingsFile(t, `not json`), ""); err == nil {
+		t.Error("a file that is not JSON accepted")
+	}
+	if _, err := capacityFrom(filepath.Join(t.TempDir(), "none"), ""); err == nil {
+		t.Error("a settings file that is not there accepted")
+	}
+}
+
+// With no settings file named (a run outside the module's launch, as the tests do), the capacity is the environment's.
+func TestWithNoSettingsFileTheCapacityIsTheEnvironments(t *testing.T) {
+	got, err := capacityFrom("", "ace=2")
+	if err != nil || got["ace"] != 2 {
+		t.Errorf("capacity %v, %v", got, err)
+	}
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/testdata/catalogue-49caf17f-hello-web.module.json

@@ -0,0 +1,82 @@
+{
+  "module": "hello-web",
+  "slug": "hello",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "hello",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the demo web page; only the route-proxy reaches it, and the public name is a route grant"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "page",
+      "type": "file",
+      "path": "${dir:state}/index.html",
+      "mode": "0644",
+      "template": "files/index.html"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "hello-web"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "hello-web",
+      "network": "hello-web",
+      "ports": [
+        "8080"
+      ],
+      "volumes": [
+        "${dir:state}/index.html:/www/index.html:ro"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "while true; do { printf 'HTTP/1.1 200 OK\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n'; cat /www/index.html; } | nc -l -p 8080; done"
+      ],
+      "artifact": "server"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "upstream",
+        "from": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/testdata/catalogue-835bf22b-claude-code.module.json

@@ -0,0 +1,249 @@
+{
+  "module": "claude-code",
+  "version": "1",
+  "moved": true,
+  "slug": "agent",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
+  ],
+  "binds": {
+    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
+  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "servers",
+    "holdings",
+    "config",
+    "proposals",
+    "questions",
+    "memory",
+    "waits"
+  ],
+  "reads": [
+    "claude-licence-manager.bindings"
+  ],
+  "tools": [
+    "claude_code_status",
+    "claude_code_render",
+    "claude_code_guard",
+    "claude_code_pull",
+    "claude_code_grant",
+    "claude_code_add_api_key",
+    "claude_code_registrations",
+    "claude_code_memory",
+    "claude_code_mcp_list",
+    "claude_code_mcp_register",
+    "claude_code_mcp_unregister",
+    "claude_code_skill_list",
+    "claude_code_skill_register",
+    "claude_code_skill_unregister",
+    "claude_code_agent_list",
+    "claude_code_agent_register",
+    "claude_code_agent_unregister",
+    "claude_code_command_list",
+    "claude_code_command_register",
+    "claude_code_command_unregister",
+    "claude_code_hook_list",
+    "claude_code_hook_register",
+    "claude_code_hook_unregister",
+    "claude_code_output_style_list",
+    "claude_code_output_style_register",
+    "claude_code_output_style_unregister",
+    "claude_code_instructions_list",
+    "claude_code_instructions_register",
+    "claude_code_instructions_unregister",
+    "claude_code_instructions_propose",
+    "claude_code_proposals",
+    "claude_code_ask",
+    "claude_code_answer",
+    "claude_code_wait",
+    "claude_code_settings_get",
+    "claude_code_settings_set",
+    "claude_code_settings_clear",
+    "claude_code_permission_add",
+    "claude_code_permission_remove",
+    "claude_code_config_list",
+    "claude_code_config_show",
+    "claude_code_config_status",
+    "claude_code_config_import",
+    "claude_code_home_show",
+    "claude_code_home_remove",
+    "claude_code_home_removed",
+    "claude_code_home_restore",
+    "claude_code_judge",
+    "claude_code_judged"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "agent-home",
+        "path": "${dir:agent-home}",
+        "class": "valuable",
+        "why": "the operator's agent's own files: its memory, history and projects"
+      }
+    ]
+  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "claude-code"
+    },
+    {
+      "id": "managed",
+      "type": "directory",
+      "path": "/etc/claude-code",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/claude-agent",
+      "mode": "0755",
+      "template": "files/claude-agent"
+    },
+    {
+      "id": "agent-account-name",
+      "type": "file",
+      "path": "/etc/claude-code/agent-account",
+      "mode": "0644",
+      "template": "files/agent-account"
+    },
+    {
+      "id": "agent-account",
+      "type": "user",
+      "name": "${machine:agent-account}",
+      "home": "${machine:agent-home}",
+      "root": "${machine:agent-root}"
+    },
+    {
+      "id": "agent-home",
+      "type": "directory",
+      "path": "${machine:agent-home}/.claude",
+      "mode": "0700",
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "facts",
+      "type": "file",
+      "path": "${dir:state}/facts.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "template": "files/facts.json"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-code",
+        "binary": "claude-code",
+        "loads": [
+          "claude-code"
+        ],
+        "env": {
+          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
+          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
+          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/testdata/catalogue-a67f0196-ca-trust.module.json

@@ -0,0 +1,66 @@
+{
+  "module": "ca-trust",
+  "version": "1",
+  "slug": "catrust",
+  "capabilities": [
+    "service-manager"
+  ],
+  "requires": [
+    "internal-acme-ca"
+  ],
+  "seats": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "claims": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "anchor",
+      "type": "file",
+      "path": "${dir:state}/anchor",
+      "mode": "0755",
+      "template": "files/anchor"
+    },
+    {
+      "id": "unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-ca-trust.service",
+      "mode": "0644",
+      "template": "files/mesh-ca-trust.service"
+    },
+    {
+      "id": "trust",
+      "type": "service",
+      "unit": "mesh-ca-trust.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "anchor",
+        "unit"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/testdata/catalogue-a67f0196-imaged.module.json

@@ -0,0 +1,14 @@
+{
+  "module": "imaged",
+  "version": "1",
+  "slug": "imaged",
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/testdata/catalogue-a67f0196-netcheck.module.json

@@ -0,0 +1,57 @@
+{
+  "module": "netcheck",
+  "version": "1",
+  "emits": [
+    "tunnel.endpoint-changed",
+    "tunnel.handshake-stale",
+    "tunnel.handshake-fresh"
+  ],
+  "tools": [
+    "netcheck_tunnel",
+    "netcheck_tcp",
+    "netcheck_dns",
+    "netcheck_http",
+    "netcheck_listening"
+  ],
+  "replaces": {
+    "netcheck_listening": [
+      "ss -lunt",
+      "ss -ltn",
+      "netstat -lnt"
+    ],
+    "netcheck_dns": [
+      "dig",
+      "nslookup"
+    ],
+    "netcheck_tunnel": [
+      "wg show",
+      "wg show mesh0 dump"
+    ]
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/netcheck",
+        "binary": "netcheck",
+        "loads": [
+          "netcheck"
+        ]
+      },
+      {
+        "name": "tools-typescript",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/toolchains.go

@@ -0,0 +1,103 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"log"
+	"strings"
+	"sync"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// toolchainStreams are the stream each build module carries its toolchain.reported event on, as the bus names it
+// (declared by the build modules, heard by this module through consumes).
+var toolchainStreams = map[string]string{buildrun.GoBuildModule: "TOOLCHAINS_GO", buildrun.NodeBuildModule: "TOOLCHAINS_NODE"}
+
+// toolchainWatch keeps the build modules' toolchains in a buildrun.ToolchainSet and tells the builder when one changed. A
+// build module's bucket is made when it is assigned, after the builder started, and the builder holds no timer (ADR 0437
+// §8): it watches the buckets that exist at start, and a build module says each time it wrote its toolchains key
+// (toolchain.reported, handled by Reported); a bucket not watched yet is then watched.
+type toolchainWatch struct {
+	ctx     context.Context
+	js      bucketOpener
+	set     *buildrun.ToolchainSet
+	changed func(ctx context.Context) // a language's entries changed: the failed builds are tried again
+	logger  *log.Logger
+	errs    chan error
+	mu      sync.Mutex
+	watched map[string]bool
+}
+
+func newToolchainWatch(ctx context.Context, js bucketOpener, set *buildrun.ToolchainSet, changed func(context.Context), logger *log.Logger) *toolchainWatch {
+	return &toolchainWatch{ctx: ctx, js: js, set: set, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
+}
+
+// start watches the buckets that exist now; a missing one is said and waits for its build module's event.
+func (w *toolchainWatch) start() error {
+	for module := range buildrun.LanguageOf {
+		if err := w.ensure(module); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (w *toolchainWatch) ensure(module string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.watched[module] {
+		return nil
+	}
+	name := delivery.ToolchainsBucket(module)
+	kv, err := w.js.KeyValue(w.ctx, name)
+	switch {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		w.logger.Printf("the bucket %s does not exist yet: it is watched when %s reports a toolchain", name, module)
+		return nil
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", name, err)
+	}
+	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.set.Put(module, e.Key(), e.Value(), !opOf(e)) })
+	if err != nil {
+		return err
+	}
+	w.watched[module] = true
+	go func() {
+		w.errs <- follow(w.ctx, watcher, func(e jetstream.KeyValueEntry) {
+			if w.set.Put(module, e.Key(), e.Value(), !opOf(e)) {
+				w.changed(w.ctx)
+			}
+		})
+	}()
+	w.changed(w.ctx) // what the settle read is new to the builder
+	return nil
+}
+
+// delivered is the part of a JetStream message the watch uses.
+type delivered interface {
+	Subject() string
+	Ack() error
+	Term() error
+}
+
+// Reported takes one toolchain.reported event of a build module in: the module is read off the subject,
+// mesh.stream.<module>.event.toolchain.reported, and its bucket is watched if it is not. A subject of no build module is
+// terminated; a failure stays unacknowledged, and the server delivers it again.
+func (w *toolchainWatch) Reported(m delivered) {
+	module, _, _ := strings.Cut(strings.TrimPrefix(m.Subject(), "mesh.stream."), ".event.")
+	if _, known := buildrun.LanguageOf[module]; !known || !strings.HasPrefix(m.Subject(), "mesh.stream.") {
+		w.logger.Printf("%s: not a build module's event, dropped", m.Subject())
+		_ = m.Term()
+		return
+	}
+	if err := w.ensure(module); err != nil {
+		w.logger.Printf("%s: left for redelivery: %v", m.Subject(), err)
+		return
+	}
+	_ = m.Ack()
+}

modules/mesh-delivery-builder/files/settings.json

@@ -0,0 +1,3 @@
+{
+  "capacity": "shanks=3,ace=2,g14=0,novox=0"
+}

modules/mesh-delivery-builder/go.mod

@@ -0,0 +1,22 @@
+module mesh-delivery-builder
+
+go 1.26.0
+
+require (
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b
+	github.com/nats-io/nats-server/v2 v2.11.17
+	github.com/nats-io/nats.go v1.54.0
+)
+
+require (
+	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/minio/highwayhash v1.0.4 // indirect
+	github.com/nats-io/jwt/v2 v2.8.1 // indirect
+	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+)

modules/mesh-delivery-builder/go.sum

@@ -0,0 +1,33 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc h1:ZJScJSnF6LgFl55/VJ9RT/lNroVWun469sXtx0nlVYw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022154726-a90f523edc75 h1:e/aOJLHaNSBPFFHHjUF+0fAfjmtMUy/vDWqetauWp/U=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022154726-a90f523edc75/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022160024-9cb4d59093a7 h1:wK9O1CgNk7mo3IdJqW/CCx/hebg+1F0rkvW8CvJfnRM=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022160024-9cb4d59093a7/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b h1:OjlhfiGr+wKLWxafV+BRjZx3TbBtwRYcm9mgoam/jv8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
+github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
+github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
+github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
+github.com/nats-io/nats-server/v2 v2.11.17 h1:GKEghcFK6A+aFx11Yf1LjgLC3txAwvyhnYzhBIQZA8I=
+github.com/nats-io/nats-server/v2 v2.11.17/go.mod h1:B1sFVz4StNosQ903ak4N1G01Fl/9f8e06mXpFIE2K24=
+github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
+github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

modules/mesh-delivery-builder/internal/build/candidates.go

@@ -0,0 +1,108 @@
+package build
+
+import (
+	"context"
+	"fmt"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// How a candidate's fingerprint is built (novox/hq ADR 0484 clause 3, issue 1684): the indexer writes, for each module a
+// pull request touches, the fingerprint of the new form it has at the head merged onto the trunk (candidates.<group>), and
+// the builder builds each, once, as a key of its own (builds.<module>.<fingerprint>) that the checker's line reads. The
+// build is the trunk module's: the same build modules, the same nodes and capacity; what differs is where the source comes
+// from: the fetch step is given the pull request's head, the ref that carries it and the trunk commit to merge it onto, as
+// the checker's fetch is, and builds the merge's module directory.
+
+// via is how a build's fetch step reaches its source when it is a candidate's: the ref that carries the head and the trunk
+// commit the head is merged onto.
+type via struct{ Ref, Base string }
+
+// Candidate takes one value of the indexer's candidates bucket in (the key is the group) and builds the fingerprints it
+// carries. A value that is not a candidate is said and left.
+func (b *Builder) Candidate(ctx context.Context, key string, value []byte) {
+	b.init()
+	c, err := delivery.DecodeCandidate(value)
+	if err != nil {
+		b.logf("candidates.%s holds what is not a candidate, left: %v", key, err)
+		return
+	}
+	b.mu.Lock()
+	b.cands[key] = c
+	b.mu.Unlock()
+	b.considerCandidate(ctx, c)
+}
+
+// ForgetCandidate takes a candidate out (its key was deleted).
+func (b *Builder) ForgetCandidate(key string) {
+	b.init()
+	b.mu.Lock()
+	delete(b.cands, key)
+	b.mu.Unlock()
+}
+
+func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
+	for _, p := range c.Pulls {
+		names := make([]string, 0, len(p.Fps))
+		for name := range p.Fps {
+			names = append(names, name)
+		}
+		sort.Strings(names)
+		for _, name := range names {
+			cm := p.Fps[name]
+			if cm.FP2 == "" || cm.Manifest == "" {
+				continue // no fingerprint of the new form for it (a reason in none2) or no manifest to build by
+			}
+			b.mu.Lock()
+			trunk, known := b.known[name]
+			b.mu.Unlock()
+			if !known || trunk.Path == "" {
+				b.logf("candidates.%s: the module %s has no record of the trunk yet, so its fingerprint %s is not built", c.Group, name, cm.FP2)
+				continue
+			}
+			key, err := delivery.BuilderBuildKey(name, cm.FP2)
+			if err != nil {
+				b.logf("candidates.%s: %v", c.Group, err)
+				continue
+			}
+			m := delivery.Module{Repository: p.Repository, Commit: p.Head.Head, FP2: cm.FP2, Manifest: cm.Manifest, Path: trunk.Path,
+				Toolchains: b.agreedFor(ctx, cm.Manifest)}
+			if len(cm.Paths) > 0 {
+				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
+				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}
+			}
+			b.mu.Lock()
+			if _, onTrunk := b.trunkFP[key]; !onTrunk {
+				b.via[key] = via{Ref: fmt.Sprintf("refs/pull/%d/head", p.Number), Base: trunk.Commit}
+			}
+			b.mu.Unlock()
+			b.consider(ctx, name, m)
+		}
+	}
+}
+
+// agreedFor are the toolchains the build nodes agree on now, for the languages of the manifest's plan: the toolchains the
+// candidate's fingerprint was computed with, as the indexer recomputes it whenever they change. A language with none agreed
+// is left out, and the build then waits for it as the trunk's does.
+func (b *Builder) agreedFor(ctx context.Context, manifest string) map[string]delivery.ToolchainUsed {
+	plan, err, _ := b.planOf(ctx, manifest)
+	if err != nil {
+		return nil
+	}
+	out := map[string]delivery.ToolchainUsed{}
+	for _, bm := range plan.Modules() {
+		if !plan.NeedsToolchain(bm) {
+			continue
+		}
+		language := buildrun.LanguageOf[bm]
+		if tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language)); none == "" {
+			out[language] = delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}

modules/mesh-delivery-builder/internal/build/candidates_test.go

@@ -0,0 +1,114 @@
+package build
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// trunkModule writes the trunk's record of the module m at a fingerprint of its own, so that the candidate's fingerprint (fp1)
+// is one the trunk does not carry.
+func trunkModule(t *testing.T, r *rig) {
+	t.Helper()
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP: "src1:" + hex64('f'),
+		FP2: "src2:" + hex64('e'), Manifest: mdigest('a'), Path: "modules/m", Toolchains: agreedToolchains})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.b.Module(context.Background(), "m", data)
+	r.b.Wait()
+	r.bm.mu.Lock()
+	r.bm.calls = nil
+	r.bm.mu.Unlock()
+}
+
+func candidateValue(t *testing.T, group string, number int, head string) []byte {
+	t.Helper()
+	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: number, Head: head}, Modules: []string{"m"},
+		Fps: map[string]delivery.CandidateModule{"m": {FP2: fp1, Manifest: mdigest('a')}}}}
+	hash, err := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: group, HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+const (
+	headX = "1111111111111111111111111111111111111111"
+	headY = "2222222222222222222222222222222222222222"
+)
+
+func TestACandidatesFingerprintIsBuiltOnceAsAKeyOfItsOwnFromTheHeadMergedOntoTheTrunk(t *testing.T) { // N7/AC1, N7/AC2 (issue 1684)
+	r := newRig(t, goBundle)
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 {
+		t.Fatalf("build = %+v, want the candidate's fingerprint built", v)
+	}
+	fetches := r.bm.callsOf("build_go_fetch")
+	if len(fetches) != 1 { // one node per fingerprint (ADR 0478 clause 4)
+		t.Fatalf("%d fetches, want one", len(fetches))
+	}
+	f := fetches[0].body.(map[string]any)
+	if f["commit"] != headX || f["ref"] != "refs/pull/7/head" || f["base"] != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" || f["repository"] != "novox/mesh-catalog" {
+		t.Errorf("fetch args = %+v, want the head, its ref and the trunk commit to merge onto", f)
+	}
+	if b := r.bm.callsOf("build_go_build")[0].body.(map[string]any); b["module"] != "modules/m" {
+		t.Errorf("build args = %+v", b)
+	}
+	// Two heads carrying one fingerprint are one build.
+	r.b.Candidate(context.Background(), "feat%2Fy", candidateValue(t, "feat/y", 8, headY))
+	r.b.Wait()
+	if n := len(r.bm.callsOf("build_go_fetch")); n != 1 {
+		t.Errorf("%d fetches after a second head with the same fingerprint, want no more", n)
+	}
+}
+
+func TestACandidateWhoseModuleHasNoTrunkRecordIsNotBuilt(t *testing.T) {
+	r := newRig(t, goBundle)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	if _, ok := r.st.vals[r.key]; ok {
+		t.Error("a build key was written for a module the builder knows no directory of")
+	}
+}
+
+func TestAFingerprintTheTrunkCarriesIsBuiltFromTheTrunksCommit(t *testing.T) { // the trunk's source wins
+	r := newRig(t, goBundle)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m")) // the trunk now carries fp1
+	r.b.Wait()
+	for _, c := range r.bm.callsOf("build_go_fetch") {
+		if f := c.body.(map[string]any); f["ref"] != nil || f["base"] != nil {
+			t.Errorf("fetch args = %+v: a trunk fingerprint is built from the trunk's commit alone", f)
+		}
+	}
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v", v)
+	}
+}
+
+func TestACandidateWhoseHeadDoesNotMergeIsFailedAndNoTrunkBuildIsStoredUnderIt(t *testing.T) { // review D4
+	for name, set := range map[string]func(*rig){
+		"conflict": func(r *rig) { r.bm.conflicts = "go.mod" },
+		"no merge": func(r *rig) { r.bm.noMerge = true },
+	} {
+		r := newRig(t, goBundle)
+		trunkModule(t, r)
+		set(r)
+		r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+		r.b.Wait()
+		v := valueOf(t, r.st, r.key)
+		if v.State != delivery.BuildFailed || (name == "conflict" && !strings.Contains(v.Error, "go.mod")) || len(r.bm.callsOf("build_go_build")) != 0 {
+			t.Errorf("%s: build = %+v, builds %d, want failed and nothing built", name, v, len(r.bm.callsOf("build_go_build")))
+		}
+	}
+}

modules/mesh-delivery-builder/internal/build/claim.go

@@ -0,0 +1,206 @@
+package build
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// ErrConflict is what a Store answers when a Create finds the key or an Update finds another revision than the one given.
+var ErrConflict = errors.New("the key exists or changed")
+
+// Store is the builder's bucket (builds): create and compare-and-set, each answering the key's new revision. Only the
+// builder's credential writes it (ADR 0429 clause 5).
+type Store interface {
+	Get(ctx context.Context, key string) (value []byte, revision uint64, found bool, err error)
+	Create(ctx context.Context, key string, value []byte) (uint64, error)
+	Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error)
+	// Keys are every key of the bucket.
+	Keys(ctx context.Context) ([]string, error)
+}
+
+// Claimer claims fingerprints for the builder instance By (ADR 0429 clause 5: a builder claims a fingerprint by creating
+// its key and moves it by compare-and-set).
+type Claimer struct {
+	Store Store
+	By    string
+}
+
+// Claim is a build the builder holds: its key, the revision the next write must be made at and the value last written.
+type Claim struct {
+	Key   string
+	Rev   uint64
+	Build delivery.BuilderBuild
+}
+
+// ClaimOptions say what the builder knows about the moment of a claim.
+type ClaimOptions struct {
+	// TakeOver takes a key found building whoever holds it: the builder has just started and looks at the key for the first
+	// time, and a build left building by a builder that is gone, on this node or another, is nobody's (ADR 0478 clause 6).
+	TakeOver bool
+	// ImageBuilder says whether a node runs a healthy image build module now: a key failed for NoImageBuilderPrefix is taken
+	// again only then. Nil means none does.
+	ImageBuilder func() bool
+	// Trunk is whether the trunk's record names this fingerprint. A done key whose image or package has no reference was
+	// built as a candidate's, which never pushes or publishes (ADR 0487 clause 12, ADR 0498 clauses 5 and 6); on the trunk it
+	// is taken again to publish them, an image only when an image builder runs (ImageBuilder).
+	Trunk bool
+	// Published says whether a package version `<name>@<version>` is published: one of the builder's done keys names it as
+	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
+	// clause 6). Nil means none is.
+	Published func(ref string) bool
+}
+
+// Unpublished is whether a done build holds an image built without a push or a package built without a publish: it has
+// no reference (a candidate's, ADR 0487 clause 12, ADR 0498 clauses 5 and 6).
+func Unpublished(b delivery.BuilderBuild) bool { return len(UnpublishedModules(b)) > 0 }
+
+// UnpublishedModules are the build modules that publish what a done build holds unpublished: the image build module for
+// an image, the Node build module for a package; sorted, none when it holds nothing unpublished.
+func UnpublishedModules(b delivery.BuilderBuild) []string {
+	if b.State != delivery.BuildDone {
+		return nil
+	}
+	var image, pkg bool
+	for _, a := range b.Artifacts {
+		image = image || (a.Kind == catalogue.ArtifactImage && a.Reference == "")
+		pkg = pkg || (a.Kind == catalogue.ArtifactPackage && a.Reference == "")
+	}
+	var out []string
+	if image {
+		out = append(out, ImageBuildModule)
+	}
+	if pkg {
+		out = append(out, buildrun.NodeBuildModule)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// publishable are the build modules of UnpublishedModules that can publish now: the image build module only while a node
+// runs it (imageBuilder).
+func publishable(b delivery.BuilderBuild, imageBuilder func() bool) []string {
+	var out []string
+	for _, bm := range UnpublishedModules(b) {
+		if bm != ImageBuildModule || (imageBuilder != nil && imageBuilder()) {
+			out = append(out, bm)
+		}
+	}
+	return out
+}
+
+// Unreferenced is whether a done build holds a bundle, an archive or an upstream copy that names no reference: a key done
+// before R4e, whose artifacts stayed on their build nodes (ADR 0498 clause 8). An artifact of no kind (a key written before
+// kinds) is one too. Claim takes such a key again, once: its new revision names them.
+func Unreferenced(b delivery.BuilderBuild) bool {
+	if b.State != delivery.BuildDone {
+		return false
+	}
+	for _, a := range b.Artifacts {
+		if a.Reference == "" && (a.Kind == "" || stored(a.Kind)) {
+			return true
+		}
+	}
+	return false
+}
+
+// Claim takes the build of module at fingerprint, or answers nil when it is not this builder's to build now:
+//   - no key: it is created building, by this builder; a create that finds the key made meanwhile gets nothing;
+//   - a done key is not taken again (the same source is never built twice), except one whose bundle, archive or upstream
+//     copy names no reference (Unreferenced, a key done before R4e: ADR 0498 clause 8), which is claimed building as a new
+//     revision and built whole, and one whose image or package was built unpublished as a candidate's once the trunk
+//     names it (ClaimOptions.Trunk): that is taken as it stands, with the done value, and its builder writes the new
+//     revision when the publishing build ends (ADR 0498 clause 6). From R4e one node builds each fingerprint (ADR 0478
+//     clause 4), so a key built on one node is never built again for a second;
+//   - a failed key is taken again as a new revision of the same key (ADR 0429 clause 18), except one failed for a kind no
+//     builder builds, for an upstream pinned by no digest or a package version taken (delivery.FailedUntilChanged: ADR 0478
+//     clause 2, ADR 0498 clauses 4 and 5) or for digests that differ (buildrun.DigestsDifferPrefix, clause 4),
+//     which wait for another fingerprint, and one failed for want of an image builder (NoImageBuilderPrefix), which waits for
+//     another fingerprint or a node that runs the image build module (ClaimOptions.ImageBuilder);
+//   - a key queued waiting for a package version (Waits) is claimed building as a new revision once that version is
+//     published (ClaimOptions.Published, ADR 0500 clause 6), and not before;
+//   - a key left queued or building by this builder is taken as it stands (ADR 0478 clause 5: a stopped builder takes its
+//     own again when it starts), and so is one left by another builder when ClaimOptions.TakeOver (clause 6).
+func (c Claimer) Claim(ctx context.Context, module, fingerprint, manifest string, opt ClaimOptions) (*Claim, error) {
+	key, err := delivery.BuilderBuildKey(module, fingerprint)
+	if err != nil {
+		return nil, err
+	}
+	building := delivery.BuilderBuild{State: delivery.BuildBuilding, By: c.By, Step: "claimed", Manifest: manifest}
+	value, rev, found, err := c.Store.Get(ctx, key)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", key, err)
+	}
+	if !found {
+		return c.write(ctx, key, building, func(data []byte) (uint64, error) { return c.Store.Create(ctx, key, data) })
+	}
+	cur, err := delivery.DecodeBuilderBuild(value)
+	if err != nil {
+		return nil, fmt.Errorf("%s holds what is not a build: %w", key, err)
+	}
+	switch {
+	case cur.State == delivery.BuildDone:
+		if Unreferenced(cur) {
+			return c.write(ctx, key, building, func(data []byte) (uint64, error) { return c.Store.Update(ctx, key, data, rev) })
+		}
+		if opt.Trunk && len(publishable(cur, opt.ImageBuilder)) > 0 {
+			return &Claim{Key: key, Rev: rev, Build: cur}, nil
+		}
+		return nil, nil
+	case cur.State == delivery.BuildFailed && (delivery.FailedUntilChanged(cur.Error) || strings.HasPrefix(cur.Error, buildrun.DigestsDifferPrefix)):
+		return nil, nil
+	case cur.State == delivery.BuildFailed && strings.HasPrefix(cur.Error, NoImageBuilderPrefix) && (opt.ImageBuilder == nil || !opt.ImageBuilder()):
+		return nil, nil
+	case cur.State == delivery.BuildFailed:
+		return c.write(ctx, key, building, func(data []byte) (uint64, error) { return c.Store.Update(ctx, key, data, rev) })
+	case cur.State == delivery.BuildQueued && cur.Waits != "":
+		if opt.Published == nil || !opt.Published(cur.Waits) {
+			return nil, nil // the package it waits for is not published yet
+		}
+		return c.write(ctx, key, building, func(data []byte) (uint64, error) { return c.Store.Update(ctx, key, data, rev) })
+	case cur.By == c.By || opt.TakeOver:
+		return &Claim{Key: key, Rev: rev, Build: cur}, nil
+	}
+	return nil, nil
+}
+
+func (c Claimer) write(_ context.Context, key string, b delivery.BuilderBuild, put func([]byte) (uint64, error)) (*Claim, error) {
+	data, err := delivery.EncodeBuilderBuild(b)
+	if err != nil {
+		return nil, err
+	}
+	rev, err := put(data)
+	if errors.Is(err, ErrConflict) {
+		return nil, nil // another builder made it first
+	}
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", key, err)
+	}
+	b.V = delivery.Version
+	return &Claim{Key: key, Rev: rev, Build: b}, nil
+}
+
+// Finish moves the claimed key to b by compare-and-set at the claim's revision, and writes nothing when b is the value
+// the key holds. A key that changed meanwhile is ErrConflict: the claim is no longer this builder's.
+func (c Claimer) Finish(ctx context.Context, cl *Claim, b delivery.BuilderBuild) error {
+	b.V = delivery.Version
+	if delivery.SameBuilderBuild(cl.Build, b) {
+		return nil
+	}
+	data, err := delivery.EncodeBuilderBuild(b)
+	if err != nil {
+		return err
+	}
+	rev, err := c.Store.Update(ctx, cl.Key, data, cl.Rev)
+	if err != nil {
+		return fmt.Errorf("%s: %w", cl.Key, err)
+	}
+	cl.Rev, cl.Build = rev, b
+	return nil
+}

modules/mesh-delivery-builder/internal/build/claim_test.go

@@ -0,0 +1,219 @@
+package build
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// memStore is a bucket's create and compare-and-set in memory, with a revision per write.
+type memStore struct {
+	mu     sync.Mutex
+	vals   map[string][]byte
+	revs   map[string]uint64
+	next   uint64
+	writes int
+	// before runs once ahead of the next write, so a test changes the key under the writer.
+	before func()
+}
+
+func newMem() *memStore { return &memStore{vals: map[string][]byte{}, revs: map[string]uint64{}} }
+
+func (m *memStore) Get(_ context.Context, key string) ([]byte, uint64, bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	v, ok := m.vals[key]
+	return v, m.revs[key], ok, nil
+}
+
+func (m *memStore) Keys(_ context.Context) ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	var keys []string
+	for k := range m.vals {
+		keys = append(keys, k)
+	}
+	return keys, nil
+}
+
+func (m *memStore) hook() {
+	if h := m.before; h != nil {
+		m.before = nil
+		h()
+	}
+}
+
+func (m *memStore) put(key string, value []byte) uint64 {
+	m.next++
+	m.writes++
+	m.vals[key], m.revs[key] = value, m.next
+	return m.next
+}
+
+func (m *memStore) Create(_ context.Context, key string, value []byte) (uint64, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.hook()
+	if _, ok := m.vals[key]; ok {
+		return 0, ErrConflict
+	}
+	return m.put(key, value), nil
+}
+
+func (m *memStore) Update(_ context.Context, key string, value []byte, rev uint64) (uint64, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.hook()
+	if _, ok := m.vals[key]; !ok || m.revs[key] != rev {
+		return 0, ErrConflict
+	}
+	return m.put(key, value), nil
+}
+
+const (
+	fp1    = "src2:1111111111111111111111111111111111111111111111111111111111111111"
+	digest = "sha256:2222222222222222222222222222222222222222222222222222222222222222"
+)
+
+func seed(t *testing.T, st *memStore, b delivery.BuilderBuild) string {
+	t.Helper()
+	key, err := delivery.BuilderBuildKey("m", fp1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, err := delivery.EncodeBuilderBuild(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	st.put(key, data)
+	return key
+}
+
+func valueOf(t *testing.T, st *memStore, key string) delivery.BuilderBuild {
+	t.Helper()
+	b, err := delivery.DecodeBuilderBuild(st.vals[key])
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestClaimCreatesTheKeyBuildingAndASecondBuilderGetsNothing(t *testing.T) { // 1607/AC3
+	st := newMem()
+	a, b := Claimer{Store: st, By: "novox.a"}, Claimer{Store: st, By: "novox.b"}
+	got, err := a.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{})
+	if err != nil || got == nil {
+		t.Fatalf("first claim = %v, %v, want a claim", got, err)
+	}
+	if v := valueOf(t, st, got.Key); v.State != delivery.BuildBuilding || v.By != "novox.a" || v.Manifest != hex64('a') {
+		t.Errorf("the key holds %+v, want building by novox.a with the manifest digest", v)
+	}
+	if second, err := b.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{}); err != nil || second != nil {
+		t.Errorf("second builder's claim = %v, %v, want none: the same source is never built twice", second, err)
+	}
+}
+
+func TestClaimLosingTheCreateRaceGetsNothing(t *testing.T) { // 1607/AC3
+	st := newMem()
+	st.before = func() { seed(t, st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "novox.b"}) }
+	got, err := Claimer{Store: st, By: "novox.a"}.Claim(context.Background(), "m", fp1, "", ClaimOptions{})
+	if err != nil || got != nil {
+		t.Errorf("claim = %v, %v, want none: the create failed because the key exists", got, err)
+	}
+}
+
+func TestADoneKeyIsNeverTakenAgain(t *testing.T) { // 1607/AC3; a key whose artifacts name references (ADR 0498 clause 8)
+	st := newMem()
+	seed(t, st, delivery.BuilderBuild{State: delivery.BuildDone, By: "novox.a", Manifest: hex64('a'), Artifacts: []delivery.BuiltArtifact{{Name: "x", Kind: "bundle", Digest: digest, Reference: "artifact-store://m/x/blobs/" + digest}}})
+	writes := st.writes
+	got, err := Claimer{Store: st, By: "novox.a"}.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{})
+	if err != nil || got != nil || st.writes != writes {
+		t.Errorf("claim = %v, %v, writes %d (was %d), want none and no write", got, err, st.writes, writes)
+	}
+}
+
+func TestAFailedKeyIsTakenAgainAsANewRevisionExceptARefusedKind(t *testing.T) { // 1607/AC3, ADR 0478 clause 2
+	st := newMem()
+	key := seed(t, st, delivery.BuilderBuild{State: delivery.BuildFailed, By: "novox.a", Error: "the step failed"})
+	rev := st.revs[key]
+	got, err := Claimer{Store: st, By: "novox.a"}.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{})
+	if err != nil || got == nil || st.revs[key] <= rev {
+		t.Fatalf("claim = %v, %v, revision %d (was %d), want a claim as a new revision of the same key", got, err, st.revs[key], rev)
+	}
+	if v := valueOf(t, st, key); v.State != delivery.BuildBuilding || v.Error != "" {
+		t.Errorf("the key holds %+v, want building with no error", v)
+	}
+
+	st = newMem()
+	key = seed(t, st, delivery.BuilderBuild{State: delivery.BuildFailed, By: "novox.a", Error: delivery.RefusedKind + "package of language \"python\" (artifact x)"})
+	writes := st.writes
+	if got, err := (Claimer{Store: st, By: "novox.a"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{}); err != nil || got != nil || st.writes != writes {
+		t.Errorf("a refused kind: claim = %v, %v, writes %d (was %d), want none and no write", got, err, st.writes, writes)
+	}
+	for _, e := range []string{delivery.NotPinned + "up: nats:2 names no digest", delivery.VersionTaken + "@novox/mesh-sdk@0.1.15"} { // B3, B5: ADR 0498 clauses 4, 5
+		st = newMem()
+		seed(t, st, delivery.BuilderBuild{State: delivery.BuildFailed, By: "novox.a", Error: e})
+		writes = st.writes
+		if got, err := (Claimer{Store: st, By: "novox.a"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{}); err != nil || got != nil || st.writes != writes {
+			t.Errorf("%s: claim = %v, %v, writes %d (was %d), want none until the fingerprint changes", e, got, err, st.writes, writes)
+		}
+	}
+}
+
+func TestAKeyFailedForNoImageBuilderIsTakenAgainOnlyWhenANodeHasTheModule(t *testing.T) { // 1705b
+	st := newMem()
+	key := seed(t, st, delivery.BuilderBuild{State: delivery.BuildFailed, By: "novox.a", Error: NoImageBuilderPrefix + " no node has mesh-build-image"})
+	writes := st.writes
+	c := Claimer{Store: st, By: "novox.a"}
+	for _, opt := range []ClaimOptions{{}, {ImageBuilder: func() bool { return false }}} {
+		if got, err := c.Claim(context.Background(), "m", fp1, "", opt); err != nil || got != nil || st.writes != writes {
+			t.Errorf("claim = %v, %v, writes %d (was %d), want none and no write", got, err, st.writes, writes)
+		}
+	}
+	got, err := c.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{ImageBuilder: func() bool { return true }})
+	if err != nil || got == nil || valueOf(t, st, key).State != delivery.BuildBuilding {
+		t.Errorf("claim = %v, %v, want a claim with the key building", got, err)
+	}
+}
+
+func TestFinishMovesTheKeyByCompareAndSetAndWritesOnlyADifferentValue(t *testing.T) { // 1607/AC3
+	st := newMem()
+	c := Claimer{Store: st, By: "novox.a"}
+	got, _ := c.Claim(context.Background(), "m", fp1, hex64('a'), ClaimOptions{})
+	done := delivery.BuilderBuild{State: delivery.BuildDone, By: "novox.a", Manifest: hex64('a'), Artifacts: []delivery.BuiltArtifact{{Name: "x", Kind: "archive", Digest: digest}}}
+	if err := c.Finish(context.Background(), got, done); err != nil {
+		t.Fatal(err)
+	}
+	if v := valueOf(t, st, got.Key); v.State != delivery.BuildDone || v.Artifacts[0].Digest != digest {
+		t.Errorf("the key holds %+v", v)
+	}
+	writes := st.writes
+	if err := c.Finish(context.Background(), got, done); err != nil && !errors.Is(err, ErrConflict) {
+		t.Fatal(err)
+	}
+	if st.writes != writes {
+		t.Errorf("the same value was written again (%d writes, was %d)", st.writes, writes)
+	}
+}
+
+func TestFinishAfterTheKeyChangedIsAConflictNotAnOverwrite(t *testing.T) { // 1607/AC3
+	st := newMem()
+	c := Claimer{Store: st, By: "novox.a"}
+	got, _ := c.Claim(context.Background(), "m", fp1, "", ClaimOptions{})
+	st.put(got.Key, []byte(`{"v":1,"state":"failed","error":"someone else"}`))
+	err := c.Finish(context.Background(), got, delivery.BuilderBuild{State: delivery.BuildFailed, Error: "mine"})
+	if !errors.Is(err, ErrConflict) {
+		t.Errorf("Finish = %v, want ErrConflict", err)
+	}
+}
+
+func hex64(c byte) string {
+	b := make([]byte, 64)
+	for i := range b {
+		b[i] = c
+	}
+	return string(b)
+}

modules/mesh-delivery-builder/internal/build/fakes_test.go

@@ -0,0 +1,94 @@
+package build
+
+// The fakes of the build modules the builder tests run against: a caller answering a long tool at once with the step and its key,
+// and the steps watch. The caller, the steps watch and the runner themselves are the SDK's (mesh-sdk go/delivery/buildrun, issue 1671).
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+type call struct {
+	node, key string
+	body      any
+}
+
+// fakeCaller answers a long tool as the build modules do: at once, with the step and its key.
+type fakeCaller struct {
+	calls  []call
+	answer string
+	err    error
+}
+
+func (f *fakeCaller) CallOn(node, key string, body any) (json.RawMessage, error) {
+	f.calls = append(f.calls, call{node, key, body})
+	if f.err != nil {
+		return nil, f.err
+	}
+	return json.RawMessage(f.answer), nil
+}
+
+// fakeSteps holds the steps values by `<module>/<key>`; Wait on a key it does not hold blocks until the context ends.
+type fakeSteps struct {
+	mu    sync.Mutex
+	steps map[string]delivery.Step
+	// during, when set, is called as a wait starts and the function it answers as the wait ends.
+	during func(key string) func()
+}
+
+func (f *fakeSteps) Wait(ctx context.Context, module, key string) (delivery.Step, error) {
+	f.mu.Lock()
+	s, ok := f.steps[module+"/"+key]
+	during := f.during
+	f.mu.Unlock()
+	if ok {
+		if during != nil {
+			defer during(key)()
+		}
+		return s, nil
+	}
+	<-ctx.Done()
+	return delivery.Step{}, context.Cause(ctx)
+}
+
+func stepAt(node, id, state, reason string, result string) delivery.Step {
+	s := delivery.Step{ID: id, Tool: "build_go_fetch", Node: node, State: state, Reason: reason}
+	if result != "" {
+		s.Result = json.RawMessage(result)
+	}
+	return s
+}
+
+// presenceValue is a watchman presence value, as its writer encodes it (mesh-sdk go/delivery EncodePresence).
+func presenceValue(t *testing.T, online bool) []byte {
+	t.Helper()
+	b, err := delivery.EncodePresence(delivery.Presence{Online: online})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// tcValue is a toolchains value, as the build module's writer encodes it (mesh-sdk go/delivery EncodeToolchain).
+func tcValue(t *testing.T, language, version string) []byte {
+	t.Helper()
+	b, err := delivery.EncodeToolchain(delivery.Toolchain{Language: language, Version: version, Recipe: "1", At: time.Now()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// tcs are the toolchain entries of a language on nodes, as the toolchains set gives them.
+func tcs(language, version string, nodes ...string) []delivery.NodeToolchain {
+	var out []delivery.NodeToolchain
+	for _, n := range nodes {
+		out = append(out, delivery.NodeToolchain{Node: n, Toolchain: delivery.Toolchain{Language: language, Version: version, Recipe: "1"}})
+	}
+	return out
+}

modules/mesh-delivery-builder/internal/build/fixtures_test.go

@@ -0,0 +1,41 @@
+package build
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// result reads a captured step value of mesh-build-image (testdata/captured/README) and returns its result.
+func captured(t *testing.T, name string) json.RawMessage {
+	t.Helper()
+	raw, err := os.ReadFile("testdata/captured/" + name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var step delivery.Step
+	if err := json.Unmarshal(raw, &step); err != nil {
+		t.Fatalf("%s: %v", name, err)
+	}
+	if step.State != delivery.StepPassed || len(step.Result) == 0 {
+		t.Fatalf("%s: state %q, result %s, want a passed step with a result", name, step.State, step.Result)
+	}
+	return step.Result
+}
+
+func TestCapturedImageStepsDecodeWithTheBuildersOwnTypes(t *testing.T) { // review r2, mesh-catalog 2; ADR 0487 clause 1
+	var f fetchResult
+	if err := json.Unmarshal(captured(t, "fetch.json"), &f); err != nil || f.Workspace == "" {
+		t.Errorf("fetch = %+v, %v, want a workspace (the field the builder reads)", f, err)
+	}
+	var trunk buildResult
+	if err := json.Unmarshal(captured(t, "build-trunk.json"), &trunk); err != nil || trunk.Digest == "" || trunk.Reference == "" {
+		t.Errorf("trunk build = %+v, %v, want a digest and a reference", trunk, err)
+	}
+	var cand buildResult
+	if err := json.Unmarshal(captured(t, "build-candidate.json"), &cand); err != nil || cand.Digest == "" || cand.Reference != "" {
+		t.Errorf("candidate build = %+v, %v, want a digest and no reference", cand, err)
+	}
+}

modules/mesh-delivery-builder/internal/build/followups_test.go

@@ -0,0 +1,46 @@
+package build
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// 1660: at start the builder closes a key left building for a fingerprint the module no longer has.
+func TestAKeyLeftBuildingForAFingerprintTheModuleNoLongerHasIsClosedAtStart(t *testing.T) { // issue 1660
+	r := newRig(t, goBundle)
+	stale := seed(t, r.st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "ace.builder", Manifest: manifestD}) // m at fp1
+	other, _ := delivery.BuilderBuildKey("gone", fp1)
+	data, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildBuilding, By: "ace.builder", Manifest: manifestD})
+	r.st.put(other, data)
+	// The module m has moved on to another fingerprint.
+	moved := delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP: "src1:" + hex64('f'),
+		FP2: "src2:" + hex64('7'), Manifest: manifestD, Path: "modules/m", Toolchains: agreedToolchains}
+	enc, _ := delivery.EncodeModule(moved)
+	r.b.Module(context.Background(), "m", enc)
+	r.b.Wait()
+	if err := r.b.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	for _, k := range []string{stale, other} {
+		v := valueOf(t, r.st, k)
+		if v.State != delivery.BuildFailed || !strings.Contains(v.Error, "no longer") || !strings.Contains(v.Error, "ace.builder") {
+			t.Errorf("%s = %+v, want it closed as failed, naming why and who left it", k, v)
+		}
+	}
+}
+
+func TestSweepLeavesAKeyOfTheModulesCurrentFingerprintForTheBuildToTakeOver(t *testing.T) { // issue 1660
+	r := newRig(t, goBundle)
+	seed(t, r.st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "ace.builder", Manifest: manifestD})
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m")) // takes it over and builds it
+	r.b.Wait()
+	if err := r.b.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone || v.By != "novox.builder" {
+		t.Errorf("build = %+v, want done by novox.builder", v)
+	}
+}

modules/mesh-delivery-builder/internal/build/manifests.go

@@ -0,0 +1,12 @@
+package build
+
+import (
+	"context"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Manifests reads a module's manifest by its digest, the key of the indexer's manifests bucket.
+type Manifests interface {
+	Manifest(ctx context.Context, digest string) (catalogue.Manifest, error)
+}

modules/mesh-delivery-builder/internal/build/plan.go

@@ -0,0 +1,118 @@
+// Package build is the builder's logic (novox/hq ADR 0453 clause 4, ADR 0478), apart from the bus: what a manifest asks
+// to be built and where, the claim of a build key, the choice of build nodes, the build modules' long steps and the run of
+// one build. The bus is reached through the small interfaces here, so each part is tested with fakes.
+package build
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// ImageBuildModule is the build module that builds an image artifact (novox/hq ADR 0487): buildah, rootless, on the nodes that
+// run it. It has no toolchain language; the builder finds its nodes from the node-engine's have.
+const ImageBuildModule = "mesh-build-image"
+
+// NoImageBuilderPrefix opens the error of a build key failed because no node runs ImageBuildModule (ADR 0487 clause 5): such a
+// key is not built again as a new revision, only when a node reports the module (ClaimOptions.ImageBuilder) or the fingerprint
+// changes.
+const NoImageBuilderPrefix = "no image builder:"
+
+// Task is one artifact to build: its name and kind in the manifest, the build module that builds it and the language
+// of the toolchain it is built with.
+type Task struct {
+	Artifact string
+	Kind     string
+	Module   string
+	Language string
+	// From is, for an upstream artifact, the reference its manifest pins, which the image build module copies (ADR 0498
+	// clause 4).
+	From string
+}
+
+// Plan is what a manifest asks the builder to build, by artifact name.
+type Plan struct{ Tasks []Task }
+
+// Modules are the build modules the plan calls, sorted.
+func (p Plan) Modules() []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, t := range p.Tasks {
+		if !seen[t.Module] {
+			seen[t.Module] = true
+			out = append(out, t.Module)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// NeedsToolchain is whether any task the build module builds is built with a toolchain: a bundle is, an archive is not
+// (the indexer gives an archive no language, so a fingerprint names no toolchain for it; ADR 0478 clause 1).
+func (p Plan) NeedsToolchain(module string) bool {
+	for _, t := range p.Tasks {
+		if t.Module == module && t.Kind != catalogue.ArtifactArchive && t.Kind != catalogue.ArtifactImage && t.Kind != catalogue.ArtifactUpstream {
+			return true
+		}
+	}
+	return false
+}
+
+// Refused is the error of a plan the builder does not build: an artifact of a kind (or of a language) no build module
+// builds. It opens delivery.RefusedKind, so its key is not built again until the fingerprint changes.
+type Refused struct{ Artifact, What string }
+
+func (r *Refused) Error() string {
+	return fmt.Sprintf("%s%s (artifact %s): no build module builds it; the builder builds Go and TypeScript bundles, archives, images, upstream copies and TypeScript packages", delivery.RefusedKind, r.What, r.Artifact)
+}
+
+// NotPinned is the error of a plan with an upstream artifact whose reference names no digest (ADR 0498 clause 4): it opens
+// delivery.NotPinned, so its key is not built again until the fingerprint changes.
+type NotPinned struct{ Artifact, From string }
+
+func (n *NotPinned) Error() string {
+	return fmt.Sprintf("%s%s: %q names no digest (@sha256:), so what would be copied is whatever its tag means today", delivery.NotPinned, n.Artifact, n.From)
+}
+
+// PlanOf is the plan of a manifest (ADR 0478 clauses 1 and 2, ADR 0498 clauses 4 and 5): a Go bundle and an archive are
+// built by the Go build module, an image by the image build module (ADR 0487), which also copies an upstream image pinned
+// by its digest, and a TypeScript bundle or package by the Node one, each in the order of the artifacts' names. A manifest
+// with an upstream artifact pinned by no digest, or a bundle or a package of another language, or a kind no build module
+// builds, is refused as a whole, naming the first such artifact by name. A manifest with no artifact has an empty plan.
+func PlanOf(m catalogue.Manifest) (Plan, error) {
+	if m.Build == nil {
+		return Plan{}, nil
+	}
+	artifacts := append([]catalogue.Artifact(nil), m.Build.Artifacts...)
+	sort.Slice(artifacts, func(i, j int) bool { return artifacts[i].Name < artifacts[j].Name })
+	var p Plan
+	for _, a := range artifacts {
+		switch {
+		case a.Kind == catalogue.ArtifactArchive:
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: buildrun.GoBuildModule, Language: "go"})
+		case a.Kind == catalogue.ArtifactBundle && a.Language == "go":
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: buildrun.GoBuildModule, Language: "go"})
+		case a.Kind == catalogue.ArtifactBundle && a.Language == "typescript":
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: buildrun.NodeBuildModule, Language: "typescript"})
+		case a.Kind == catalogue.ArtifactImage:
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: ImageBuildModule})
+		case a.Kind == catalogue.ArtifactUpstream && !strings.Contains(a.From, "@sha256:"):
+			return Plan{}, &NotPinned{Artifact: a.Name, From: a.From}
+		case a.Kind == catalogue.ArtifactUpstream:
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: ImageBuildModule, From: a.From})
+		case a.Kind == catalogue.ArtifactPackage && a.Language == "typescript":
+			p.Tasks = append(p.Tasks, Task{Artifact: a.Name, Kind: a.Kind, Module: buildrun.NodeBuildModule, Language: "typescript"})
+		case a.Kind == catalogue.ArtifactBundle:
+			return Plan{}, &Refused{Artifact: a.Name, What: fmt.Sprintf("bundle of language %q", a.Language)}
+		case a.Kind == catalogue.ArtifactPackage:
+			return Plan{}, &Refused{Artifact: a.Name, What: fmt.Sprintf("package of language %q", a.Language)}
+		default:
+			return Plan{}, &Refused{Artifact: a.Name, What: a.Kind}
+		}
+	}
+	return p, nil
+}

modules/mesh-delivery-builder/internal/build/plan_test.go

@@ -0,0 +1,96 @@
+package build
+
+import (
+	"errors"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// manifestOf is a manifest holding these artifacts: the plan reads only their name, kind and language.
+func manifestOf(artifacts ...catalogue.Artifact) catalogue.Manifest {
+	return catalogue.Manifest{Module: "m", Build: &catalogue.Build{Artifacts: artifacts}}
+}
+
+func TestPlanRoutesEachKindToItsBuildModule(t *testing.T) { // 1607/AC2
+	m := manifestOf(
+		catalogue.Artifact{Name: "tool", Kind: "bundle", Language: "go"},
+		catalogue.Artifact{Name: "web", Kind: "bundle", Language: "typescript"},
+		catalogue.Artifact{Name: "files", Kind: "archive"})
+	p, err := PlanOf(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []Task{
+		{Artifact: "files", Kind: "archive", Module: buildrun.GoBuildModule, Language: "go"},
+		{Artifact: "tool", Kind: "bundle", Module: buildrun.GoBuildModule, Language: "go"},
+		{Artifact: "web", Kind: "bundle", Module: buildrun.NodeBuildModule, Language: "typescript"},
+	}
+	if len(p.Tasks) != len(want) {
+		t.Fatalf("tasks = %+v, want %+v", p.Tasks, want)
+	}
+	for i := range want {
+		if p.Tasks[i] != want[i] {
+			t.Errorf("task %d = %+v, want %+v", i, p.Tasks[i], want[i])
+		}
+	}
+	if modules := p.Modules(); len(modules) != 2 || modules[0] != buildrun.GoBuildModule || modules[1] != buildrun.NodeBuildModule {
+		t.Errorf("modules = %v", modules)
+	}
+}
+
+const pinned = "nats:2.11.17-alpine@sha256:3333333333333333333333333333333333333333333333333333333333333333"
+
+func TestPlanSendsAPinnedUpstreamToTheImageBuildModulesCopyAndRefusesAnUnpinnedOne(t *testing.T) { // B3, ADR 0498 clause 4
+	p, err := PlanOf(manifestOf(catalogue.Artifact{Name: "ok", Kind: "archive"}, catalogue.Artifact{Name: "up", Kind: "upstream", From: pinned}))
+	if err != nil || len(p.Tasks) != 2 {
+		t.Fatalf("plan %+v, error %v", p, err)
+	}
+	if up := p.Tasks[1]; up.Artifact != "up" || up.Kind != "upstream" || up.Module != ImageBuildModule || up.From != pinned || up.Language != "" {
+		t.Errorf("task = %+v, want the upstream sent to %s with its pinned reference and no toolchain", up, ImageBuildModule)
+	}
+	if p.NeedsToolchain(ImageBuildModule) {
+		t.Error("a copy needs no toolchain")
+	}
+	_, err = PlanOf(manifestOf(catalogue.Artifact{Name: "up", Kind: "upstream", From: "nats:2.11.17-alpine"}))
+	if err == nil || !strings.HasPrefix(err.Error(), delivery.NotPinned+"up") || !delivery.FailedUntilChanged(err.Error()) {
+		t.Errorf("an upstream with no digest: error = %v, want it to open %q naming the artifact", err, delivery.NotPinned)
+	}
+}
+
+func TestPlanRefusesAPackageOfAnotherLanguageByName(t *testing.T) { // ADR 0498 clause 5
+	_, err := PlanOf(manifestOf(catalogue.Artifact{Name: "ok", Kind: "archive"}, catalogue.Artifact{Name: "pkg", Kind: "package", Language: "python"}))
+	var r *Refused
+	if err == nil || !asRefused(err, &r) || !strings.HasPrefix(err.Error(), delivery.RefusedKind) || !strings.Contains(err.Error(), "python") || !strings.Contains(err.Error(), "pkg") {
+		t.Errorf("error = %v, want it to open %q naming the artifact and its language", err, delivery.RefusedKind)
+	}
+}
+
+func TestPlanRefusesABundleOfAnotherLanguageAndAModuleWithNoArtifact(t *testing.T) {
+	if _, err := PlanOf(manifestOf(catalogue.Artifact{Name: "x", Kind: "bundle", Language: "python"})); err == nil || !strings.HasPrefix(err.Error(), delivery.RefusedKind) {
+		t.Errorf("a python bundle: error = %v, want a refusal", err)
+	}
+	p, err := PlanOf(manifestOf())
+	if err != nil || len(p.Tasks) != 0 {
+		t.Errorf("no artifact: plan %+v error %v, want an empty plan", p, err)
+	}
+}
+
+func asRefused(err error, target **Refused) bool { return errors.As(err, target) }
+
+func TestPlanSendsAnImageToMeshBuildImageWithNoToolchain(t *testing.T) { // 1705a, ADR 0487 clause 5
+	p, err := PlanOf(manifestOf(catalogue.Artifact{Name: "img", Kind: "image"}, catalogue.Artifact{Name: "files", Kind: "archive"}))
+	if err != nil || len(p.Tasks) != 2 {
+		t.Fatalf("plan %+v, error %v", p, err)
+	}
+	if p.Tasks[1].Artifact != "img" || p.Tasks[1].Module != ImageBuildModule {
+		t.Errorf("task = %+v, want the image on %s", p.Tasks[1], ImageBuildModule)
+	}
+	if p.NeedsToolchain(ImageBuildModule) {
+		t.Error("an image needs no toolchain")
+	}
+}

modules/mesh-delivery-builder/internal/build/r4e_test.go

@@ -0,0 +1,385 @@
+package build
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// R4e: references in the key (novox/hq ADR 0498), upstream copies, packages published from the trunk, the package wait
+// (ADR 0500 clause 6) and one node per fingerprint (ADR 0478 clause 4).
+
+func TestACandidatesBundleKeyNamesItsReferenceAndTheTrunkBuildsItNoMore(t *testing.T) { // B1, ADR 0498 clause 3 and its check 3
+	r := newRig(t, goBundle, archiveA)
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone {
+		t.Fatalf("build = %+v, want done", v)
+	}
+	if ok, missing := v.Referenced(); !ok {
+		t.Fatalf("a candidate's bundle and archive name no reference: %v (%+v)", missing, v.Artifacts)
+	}
+	rev := r.st.revs[r.key]
+	r.bm.mu.Lock()
+	r.bm.calls = nil
+	r.bm.mu.Unlock()
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m")) // the merge: the trunk now names the same fingerprint
+	r.b.Wait()
+	if n := len(r.bm.calls); n != 0 || r.st.revs[r.key] != rev {
+		t.Errorf("the trunk built its candidate's fingerprint again: %d calls, revision %d (was %d)", n, r.st.revs[r.key], rev)
+	}
+}
+
+func TestABundleWhosePushAnsweredNoReferenceFailsNotStoredAndIsBuiltAgain(t *testing.T) { // B1, ADR 0498 clauses 1 and 2
+	r := newRig(t, goBundle)
+	r.bm.noRef["ace/tool"] = true
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.NotStored) || !strings.Contains(v.Error, "tool") {
+		t.Fatalf("build = %+v, want failed opening %q and naming the artifact", v, delivery.NotStored)
+	}
+	delete(r.bm.noRef, "ace/tool")
+	if v = r.consider(t, "modules/m"); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want a not-stored key built again as a new revision", v)
+	}
+}
+
+func TestAPushRefusedByTheStoreFailsTheKeyOpeningNotStored(t *testing.T) { // B1, ADR 0498 clause 2
+	r := newRig(t, goBundle)
+	r.bm.fails["ace/build_go_build"] = delivery.NotStored + "tool: the artifact store answered 507 insufficient storage"
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.NotStored) || !strings.Contains(v.Error, "507") || !strings.Contains(v.Error, "ace") {
+		t.Fatalf("build = %+v, want failed opening %q with the store's words and the node", v, delivery.NotStored)
+	}
+}
+
+func TestOnlyATrunkKeysBuildsAreAskedToPublish(t *testing.T) { // B1, the lead's interface (a): publish only for a trunk key
+	r := newRig(t, goBundle)
+	r.consider(t, "modules/m")
+	for _, c := range r.bm.callsOf("build_go_build") {
+		if c.body.(map[string]any)["publish"] != true {
+			t.Errorf("trunk build args = %+v, want publish", c.body)
+		}
+	}
+	c := newRig(t, goBundle)
+	trunkModule(t, c)
+	c.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	c.b.Wait()
+	for _, call := range c.bm.callsOf("build_go_build") {
+		if _, ok := call.body.(map[string]any)["publish"]; ok {
+			t.Errorf("candidate build args = %+v, want no publish", call.body)
+		}
+	}
+}
+
+// putBuild writes a builder key's value as the store would hold it.
+func putBuild(t *testing.T, st *memStore, key string, b delivery.BuilderBuild) uint64 {
+	t.Helper()
+	data, err := delivery.EncodeBuilderBuild(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	st.mu.Lock()
+	defer st.mu.Unlock()
+	return st.put(key, data)
+}
+
+func TestADoneKeyWrittenBeforeR4eIsBuiltAgainOnceAsANewRevision(t *testing.T) { // B2, ADR 0498 clause 8
+	r := newRig(t, goBundle, archiveA)
+	rev := putBuild(t, r.st, r.key, delivery.BuilderBuild{State: delivery.BuildDone, By: "novox.builder", Manifest: manifestD, Step: "built mesh-build-go on ace and novox",
+		Artifacts: []delivery.BuiltArtifact{{Name: "files", Kind: "archive", Digest: digest}, {Name: "tool", Kind: "bundle", Digest: digest}}})
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || r.st.revs[r.key] <= rev {
+		t.Fatalf("build = %+v at revision %d (was %d), want built again as a new revision", v, r.st.revs[r.key], rev)
+	}
+	if ok, missing := v.Referenced(); !ok {
+		t.Fatalf("the new revision names no reference for %v", missing)
+	}
+	rev = r.st.revs[r.key]
+	r.b.tried = map[string]bool{} // a builder started anew looks again
+	r.consider(t, "modules/m")
+	if r.st.revs[r.key] != rev {
+		t.Errorf("a key whose artifacts all name references was built again (revision %d, was %d): once only", r.st.revs[r.key], rev)
+	}
+}
+
+func TestAPinnedUpstreamIsCopiedOnceOnOneImageNodeWithNoFetchAndItsKeyNamesTheReference(t *testing.T) { // B4, ADR 0498 clause 4
+	up := catalogue.Artifact{Name: "up", Kind: "upstream", From: "nats:2.11.17-alpine@" + digest}
+	r := newRig(t, up)
+	r.b.Health = imageHave(t, "ace", "novox")
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 {
+		t.Fatalf("build = %+v, want done with the copy", v)
+	}
+	if a := v.Artifacts[0]; a.Kind != "upstream" || a.Digest != digest || a.Reference != "registry.example/m/up@"+digest {
+		t.Errorf("artifact = %+v, want the upstream's digest and the registry's reference", a)
+	}
+	copies := r.bm.callsOf("build_image_copy")
+	if len(copies) != 1 {
+		t.Fatalf("%d copies, want one on one node", len(copies))
+	}
+	if args := copies[0].body.(map[string]any); args["module"] != "m" || args["artifact"] != "up" || args["from"] != up.From || len(args) != 3 {
+		t.Errorf("copy args = %+v, want the module's name, the artifact and the pinned reference", args)
+	}
+	if n := len(r.bm.callsOf("build_image_fetch")) + len(r.bm.callsOf("build_image_build")); n != 0 {
+		t.Errorf("%d fetch or build calls for a copy, want none", n)
+	}
+}
+
+func TestAnUpstreamBesideAnImageIsCopiedAndTheImageFetchedAndBuiltOnTheSameNode(t *testing.T) { // B4
+	r := newRig(t, imageArt, catalogue.Artifact{Name: "up", Kind: "upstream", From: "nats:2.11.17-alpine@" + digest})
+	r.b.Health = imageHave(t, "ace")
+	v := r.consider(t, "modules/m")
+	if ok, missing := v.Referenced(); !ok {
+		t.Fatalf("build = %+v, missing references %v", v, missing)
+	}
+	if f, b, c := len(r.bm.callsOf("build_image_fetch")), len(r.bm.callsOf("build_image_build")), len(r.bm.callsOf("build_image_copy")); f != 1 || b != 1 || c != 1 {
+		t.Errorf("fetch %d, build %d, copy %d; want one each", f, b, c)
+	}
+}
+
+func TestACopyThatFailsNotStoredFailsTheKeyAndIsBuiltAgain(t *testing.T) { // B4, ADR 0498 clause 2
+	r := newRig(t, catalogue.Artifact{Name: "up", Kind: "upstream", From: "nats:2.11.17-alpine@" + digest})
+	r.b.Health = imageHave(t, "ace")
+	r.bm.fails["ace/build_image_copy"] = delivery.NotStored + "up: the registry answered 500"
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.NotStored) || delivery.FailedUntilChanged(v.Error) {
+		t.Fatalf("build = %+v, want failed 'not stored:' and built again", v)
+	}
+	delete(r.bm.fails, "ace/build_image_copy")
+	if v = r.consider(t, "modules/m"); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want done on the new revision", v)
+	}
+}
+
+var tsPackage = catalogue.Artifact{Name: "lib", Kind: "package", Language: "typescript"}
+
+func TestATypeScriptPackageIsBuiltByTheNodeModuleAndPublishedOnlyForTheTrunk(t *testing.T) { // B5, ADR 0498 clause 5, ADR 0500 clause 4
+	c := newRig(t, tsPackage)
+	c.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	trunkModule(t, c)
+	c.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	c.b.Wait()
+	v := valueOf(t, c.st, c.key)
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 || v.Artifacts[0].Kind != "package" || v.Artifacts[0].Reference != "" {
+		t.Fatalf("candidate build = %+v, want done with the packed digest and no reference", v)
+	}
+	for _, call := range c.bm.callsOf("build_node_build") {
+		if _, ok := call.body.(map[string]any)["publish"]; ok {
+			t.Errorf("a candidate's package build was asked to publish: %+v", call.body)
+		}
+	}
+
+	r := newRig(t, tsPackage)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	v = r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || v.Artifacts[0].Reference != "@novox/mesh-sdk@0.1.15" {
+		t.Fatalf("trunk build = %+v, want done naming the published version", v)
+	}
+	if n := len(r.bm.callsOf("build_node_build")); n == 0 {
+		t.Error("the package was not built by the Node build module")
+	}
+}
+
+func TestAVersionTakenFailsTheKeyUntilTheFingerprintChanges(t *testing.T) { // B5, ADR 0498 clause 5
+	r := newRig(t, tsPackage)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	r.bm.fails["ace/build_node_build"] = delivery.VersionTaken + "@novox/mesh-sdk@0.1.15 is published with another packed file"
+	r.bm.fails["novox/build_node_build"] = r.bm.fails["ace/build_node_build"]
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.VersionTaken) || !strings.Contains(v.Error, "0.1.15") {
+		t.Fatalf("build = %+v, want failed opening %q naming the version", v, delivery.VersionTaken)
+	}
+	writes := r.st.writes
+	r.consider(t, "modules/m")
+	if r.st.writes != writes {
+		t.Errorf("a version-taken key was built again (%d writes, was %d)", r.st.writes, writes)
+	}
+}
+
+func TestACandidatesPackageIsPublishedOnceWhenTheTrunkNamesItsFingerprint(t *testing.T) { // B6, ADR 0498 clause 6
+	r := newRig(t, tsPackage, tsBundle)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone {
+		t.Fatalf("candidate build = %+v", v)
+	}
+	rev := r.st.revs[r.key]
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m")) // the merge names the candidate's fingerprint
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if r.st.revs[r.key] <= rev {
+		t.Fatalf("the trunk did not build the unpublished package again (revision %d, was %d)", r.st.revs[r.key], rev)
+	}
+	if ok, missing := v.Referenced(); !ok {
+		t.Fatalf("build = %+v, missing references %v", v, missing)
+	}
+	rev = r.st.revs[r.key]
+	r.b.tried = map[string]bool{}
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if r.st.revs[r.key] != rev {
+		t.Error("a published package was built again: once only")
+	}
+}
+
+func TestAPublishThatFailsVersionTakenOnTheTrunkKeepsThePrefixFirst(t *testing.T) { // B6, ADR 0498 clauses 5 and 6
+	r := newRig(t, tsPackage)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	for _, n := range []string{"ace", "novox"} {
+		r.bm.fails[n+"/build_node_build"] = delivery.VersionTaken + "@novox/mesh-sdk@0.1.15 is published with another packed file"
+	}
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.VersionTaken) {
+		t.Errorf("build = %+v, want failed opening %q", v, delivery.VersionTaken)
+	}
+}
+
+// sdkModule adds to the rig a module "sdk" whose manifest (digest b) holds the TypeScript package lib, published as ref.
+func sdkModule(t *testing.T, r *rig, ref string) []byte {
+	t.Helper()
+	r.mf.byDigest[mdigest('b')] = catalogue.Manifest{Module: "sdk", Build: &catalogue.Build{Artifacts: []catalogue.Artifact{tsPackage}}}
+	r.bm.packages["lib"] = ref
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-sdk", Commit: "8a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP2: "src2:" + hex64('5'),
+		Manifest: mdigest('b'), Path: ".", Toolchains: agreedToolchains})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func TestAModuleWhoseLockNamesAnUnpublishedPackageWaitsQueuedAndIsBuiltOncePublished(t *testing.T) { // B7, ADR 0500 clause 6
+	const ref = "@novox/mesh-sdk@0.1.15"
+	r := newRig(t, tsBundle)
+	for _, n := range []string{"ace", "novox"} {
+		r.bm.fails[n+"/build_node_fetch"] = waitsFor + ref + ": the lock names a version the registry does not hold"
+	}
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildQueued || v.Waits != ref || v.Error != "" {
+		t.Fatalf("build = %+v, want queued, waiting for %s, not failed", v, ref)
+	}
+	delete(r.bm.fails, "ace/build_node_fetch")
+	delete(r.bm.fails, "novox/build_node_fetch")
+	writes := r.st.writes
+	r.b.tried = map[string]bool{}
+	r.consider(t, "modules/m")
+	if r.st.writes != writes {
+		t.Fatalf("a key waiting for an unpublished package was claimed (%d writes, was %d)", r.st.writes, writes)
+	}
+	r.b.Module(context.Background(), "sdk", sdkModule(t, r, ref)) // the package's trunk key is built and published
+	r.b.Wait()
+	if v = valueOf(t, r.st, r.key); v.State != delivery.BuildDone || v.Waits != "" {
+		t.Errorf("build = %+v, want built once the package it waits for is published", v)
+	}
+}
+
+func TestAKeyWaitingForAPackageAlreadyPublishedIsBuiltWhenTheBuilderStarts(t *testing.T) { // B7: the scan at start
+	const ref = "@novox/mesh-sdk@0.1.15"
+	r := newRig(t, tsBundle)
+	putBuild(t, r.st, r.key, delivery.BuilderBuild{State: delivery.BuildQueued, By: "novox.builder", Manifest: manifestD, Waits: ref, Step: "waits"})
+	sdkKey, _ := delivery.BuilderBuildKey("sdk", "src2:"+hex64('5'))
+	putBuild(t, r.st, sdkKey, delivery.BuilderBuild{State: delivery.BuildDone, By: "novox.builder", Manifest: mdigest('b'), Step: "built",
+		Artifacts: []delivery.BuiltArtifact{{Name: "lib", Kind: "package", Digest: digest, Reference: ref}}})
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	if err := r.b.Sweep(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want built: the package it waits for was published before the builder started", v)
+	}
+}
+
+func TestTheFetchOfAModuleNamingItsPathsCarriesItsDirectoryAndThosePaths(t *testing.T) { // the lead's interface (c), ADR 0499 clause 4
+	r := newRig(t, tsPackage)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	paths := map[string]string{"src": hex40('1'), "package.json": hex40('2')}
+	tree, err := delivery.NamedTree(manifestD, paths)
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-sdk", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP2: fp1, Manifest: manifestD, Path: ".",
+		Toolchains: agreedToolchains, Inputs2: &delivery.KeptInputs2{Tree: tree, Paths: paths}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.b.Module(context.Background(), "m", data)
+	r.b.Wait()
+	f := r.bm.callsOf("build_node_fetch")
+	if len(f) == 0 {
+		t.Fatal("no fetch")
+	}
+	req, err := buildstep.ParseFetchRequest(f[0].body.(map[string]any))
+	if err != nil || req.Dir != "." || strings.Join(req.Paths, ",") != "package.json,src" || req.Commit != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" {
+		t.Errorf("fetch request = %+v, %v; want dir . and the kept paths, sorted", req, err)
+	}
+	r2 := newRig(t, goBundle)
+	r2.consider(t, "modules/m")
+	if a := r2.bm.callsOf("build_go_fetch")[0].body.(map[string]any); a["dir"] != nil || a["paths"] != nil {
+		t.Errorf("fetch args = %+v, want no dir or paths for a module naming none", a)
+	}
+}
+
+func hex40(c byte) string { return strings.Repeat(string(c), 40) }
+
+func TestOneNodeBuildsEachFingerprint(t *testing.T) { // B9, ADR 0478 clause 4: "From R4e one node builds each fingerprint"
+	r := newRig(t, goBundle, archiveA, tsBundle) // ace and novox both qualify for both build modules
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || strings.Contains(v.Step, " and ") || strings.HasPrefix(v.Step, "one node (") {
+		t.Fatalf("build = %+v, want done on one node of each build module, unmarked", v)
+	}
+	if f, b := len(r.bm.callsOf("build_go_fetch")), len(r.bm.callsOf("build_go_build")); f != 1 || b != 2 {
+		t.Errorf("go fetches %d, builds %d; want one fetch and one build of each artifact, on one node", f, b)
+	}
+	if f := len(r.bm.callsOf("build_node_fetch")); f != 1 {
+		t.Errorf("node fetches %d, want one", f)
+	}
+}
+
+func TestAKeyDoneOnOneNodeIsNeverBuiltAgainForASecondNode(t *testing.T) { // B9: the second-node retake is gone
+	r := newRig(t, goBundle)
+	putBuild(t, r.st, r.key, delivery.BuilderBuild{State: delivery.BuildDone, By: "novox.builder", Manifest: manifestD,
+		Step:      "one node (mesh-build-go): built mesh-build-go on one node, novox",
+		Artifacts: []delivery.BuiltArtifact{{Name: "tool", Kind: "bundle", Digest: digest, Reference: "artifact-store://m/tool/blobs/" + digest}}})
+	writes := r.st.writes
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.NodesChanged(context.Background())
+	r.b.Wait()
+	if r.st.writes != writes || len(r.bm.calls) != 0 {
+		t.Errorf("a key done on one node was built again (%d writes, was %d; %d calls)", r.st.writes, writes, len(r.bm.calls))
+	}
+}
+
+func TestACandidatesFetchNamesTheNamedPathsTheIndexerGaveIt(t *testing.T) { // ADR 0499 clause 4, mesh-sdk CandidateModule.Paths
+	r := newRig(t, tsPackage)
+	r.bm.packages["lib"] = "@novox/mesh-sdk@0.1.15"
+	trunkModule(t, r)
+	pulls := []delivery.CandidatePull{{Head: delivery.Head{Repository: "novox/mesh-catalog", Number: 7, Head: headX}, Modules: []string{"m"},
+		Fps: map[string]delivery.CandidateModule{"m": {FP2: fp1, Manifest: mdigest('a'), Paths: map[string]string{"src": hex40('1'), "package.json": hex40('2')}}}}}
+	hash, _ := delivery.HeadsHash([]delivery.Head{pulls[0].Head})
+	data, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: "feat/x", HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.b.Candidate(context.Background(), "feat%2Fx", data)
+	r.b.Wait()
+	f := r.bm.callsOf("build_node_fetch")
+	if len(f) == 0 {
+		t.Fatal("no fetch")
+	}
+	req, err := buildstep.ParseFetchRequest(f[0].body.(map[string]any))
+	if err != nil || req.Dir != "modules/m" || strings.Join(req.Paths, ",") != "package.json,src" || req.Base == "" {
+		t.Errorf("fetch request = %+v, %v; want the candidate's base, the module's directory and its named paths", req, err)
+	}
+}

modules/mesh-delivery-builder/internal/build/round4_test.go

@@ -0,0 +1,214 @@
+package build
+
+import (
+	"context"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func haveValue(t *testing.T, phase delivery.Phase, health delivery.Health) []byte {
+	t.Helper()
+	b, err := delivery.EncodeHave(delivery.Have{Phase: phase, Health: health})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// 1. A module of an archive only: the real indexer gives an archive no language (inputs.go languagesOf), so its
+// fingerprint names no toolchain, and the builder builds it on the build module's nodes with no toolchain agreed.
+func TestAnArchiveOnlyModuleIsBuiltAlthoughItsFingerprintNamesNoToolchain(t *testing.T) { // review round 4, 1
+	r := newRig(t, archiveA)
+	v := func() delivery.BuilderBuild {
+		r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", nil))
+		r.b.Wait()
+		if _, ok := r.st.vals[r.key]; !ok {
+			t.Fatal("no build key was written for the archive-only module")
+		}
+		return valueOf(t, r.st, r.key)
+	}()
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 || v.Artifacts[0].Kind != "archive" || len(v.Toolchains) != 0 {
+		t.Fatalf("build = %+v, want done with the archive and no toolchain named", v)
+	}
+	if n := len(r.bm.callsOf("build_go_build")); n != 1 {
+		t.Errorf("%d go builds, want one, on one node (ADR 0478 clause 4)", n)
+	}
+}
+
+func TestAnArchiveOnlyModuleNeedsNoAgreedToolchainButNeedsNodesThatQualify(t *testing.T) { // review round 4, 1
+	r := newRig(t, archiveA)
+	r.tools.Put(buildrun.GoBuildModule, "ace.go", tcValue(t, "go", "go1.26.0"), false) // the nodes disagree: a bundle would wait
+	r.b.Health = &buildrun.HaveSet{}                                                   // no build module is healthy anywhere
+	r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", nil))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildFailed || !strings.Contains(v.Error, "healthy") {
+		t.Errorf("build = %+v, want failed: no node's build module is healthy", v)
+	}
+	have := &buildrun.HaveSet{}
+	have.Put("novox.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+	r.b.Health = have
+	r.b.Reconsider(context.Background())
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || !strings.Contains(v.Step, "on novox") {
+		t.Errorf("build = %+v, want done on novox, the one node that qualifies", v)
+	}
+}
+
+func TestABundleAndAnArchiveOfOneBuildModuleStillNeedTheAgreedToolchain(t *testing.T) { // review round 4, 1
+	p, err := PlanOf(catalogue.Manifest{Module: "m", Build: &catalogue.Build{Artifacts: []catalogue.Artifact{goBundle, archiveA}}})
+	if err != nil || !p.NeedsToolchain(buildrun.GoBuildModule) {
+		t.Errorf("a plan with a Go bundle: %v, %v", p.NeedsToolchain(buildrun.GoBuildModule), err)
+	}
+	p, _ = PlanOf(catalogue.Manifest{Module: "m", Build: &catalogue.Build{Artifacts: []catalogue.Artifact{archiveA}}})
+	if p.NeedsToolchain(buildrun.GoBuildModule) {
+		t.Error("a plan of an archive needs a toolchain")
+	}
+}
+
+func TestClaimLeavesAKeyFailedForDifferingDigestsAlone(t *testing.T) { // review round 4, 2
+	st := newMem()
+	seed(t, st, delivery.BuilderBuild{State: delivery.BuildFailed, Error: buildrun.DigestsDifferPrefix + " the nodes built tool to different digests: ace x; novox y"})
+	writes := st.writes
+	got, err := (Claimer{Store: st, By: "novox.a"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{TakeOver: true})
+	if err != nil || got != nil || st.writes != writes {
+		t.Errorf("claim = %v, %v, %d writes (was %d), want none and no write", got, err, st.writes, writes)
+	}
+}
+
+// 4. A step never waits on a full node while another qualifying node has room.
+func TestChoosesMadeAtOnceSeeEachOthersReservationsSoNoLaneWaitsWhileANodeHasRoom(t *testing.T) { // review round 4, 4
+	p := &buildrun.Places{Capacity: map[string]int{"ace": 2, "g14": 1, "novox": 1, "shanks": 3}}
+	entries := tcs("go", "go1.27.1", "ace", "g14", "novox", "shanks")
+	total := 2 + 1 + 1 + 3
+	var waiting int
+	for i := 1; i <= 4; i++ { // four modules choose before any lane has started
+		room := 0
+		for _, n := range []string{"ace", "g14", "novox", "shanks"} {
+			room += p.CapacityOf(n) - p.Running()[n] - p.Reserved()[n]
+		}
+		nodes, _, err := buildrun.ChooseNodes("go", entries, p, nil, 2)
+		if err != nil || len(nodes) != 2 {
+			t.Fatalf("choice %d: %v, %v", i, nodes, err)
+		}
+		if room >= 2 {
+			for _, n := range nodes {
+				if p.Reserved()[n] > p.CapacityOf(n) {
+					t.Errorf("choice %d: %v put a lane on full %s while %d places were free", i, nodes, n, room)
+				}
+			}
+		} else {
+			waiting += 2 - room
+		}
+	}
+	if want := 4*2 - total; waiting != want {
+		t.Errorf("%d lanes wait, want %d: the 8 lanes less the %d places", waiting, want, total)
+	}
+	loads := p.Reserved()
+	for n, c := range loads {
+		if c > p.CapacityOf(n) && n != "shanks" && n != "ace" && n != "g14" && n != "novox" {
+			t.Errorf("unknown node %s", n)
+		}
+	}
+	if loads["shanks"] != 3 || loads["ace"] != 2 || loads["g14"]+loads["novox"] != 3 {
+		t.Errorf("reservations = %v, want shanks 3, ace 2 and the single-place nodes taking the rest", loads)
+	}
+}
+
+func TestACancelledReservationFreesTheChoiceAndAnAcquireTakesItsReservation(t *testing.T) { // review round 4, 4
+	p := &buildrun.Places{}
+	nodes, _, _ := buildrun.ChooseNodes("go", tcs("go", "go1.27.1", "ace"), p, nil, 1)
+	if len(nodes) != 1 || p.Reserved()["ace"] != 1 {
+		t.Fatalf("nodes %v, reserved %v", nodes, p.Reserved())
+	}
+	release, err := p.Acquire(context.Background(), "ace")
+	if err != nil || p.Reserved()["ace"] != 0 || p.Running()["ace"] != 1 {
+		t.Fatalf("acquire: %v, reserved %v, running %v", err, p.Reserved(), p.Running())
+	}
+	release()
+	buildrun.ChooseNodes("go", tcs("go", "go1.27.1", "ace"), p, nil, 1)
+	p.Cancel("ace")
+	if len(p.Reserved()) != 0 {
+		t.Errorf("reserved after Cancel = %v", p.Reserved())
+	}
+}
+
+// 5. A node whose build module is not healthy is not chosen.
+func TestHaveSetKnowsOnlyBuildModulesRunningAndHealthy(t *testing.T) { // review round 4, 5
+	var s buildrun.HaveSet
+	if s.Healthy("ace", buildrun.GoBuildModule) {
+		t.Error("a module with no have is healthy")
+	}
+	if !s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false) || !s.Healthy("ace", buildrun.GoBuildModule) {
+		t.Error("a running, healthy module is not")
+	}
+	if s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false) {
+		t.Error("the same state counted as a change")
+	}
+	if !s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthFailed), false) || s.Healthy("ace", buildrun.GoBuildModule) {
+		t.Error("a module whose health failed is healthy")
+	}
+	s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+	if !s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseFailed, delivery.HealthOK), false) || s.Healthy("ace", buildrun.GoBuildModule) {
+		t.Error("a module whose phase failed is healthy")
+	}
+	s.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+	if !s.Put("ace.mesh-build-go", nil, true) || s.Healthy("ace", buildrun.GoBuildModule) {
+		t.Error("a deleted have is healthy")
+	}
+	if s.Put("ace.node", []byte(`{}`), false) || s.Put("ace.mesh-build-go", []byte(`not json`), false) {
+		t.Error("a node's key or a non-have counted")
+	}
+}
+
+func TestANodeWhoseBuildModuleIsNotHealthyIsNotChosen(t *testing.T) { // review round 4, 5
+	r := newRig(t, goBundle)
+	have := &buildrun.HaveSet{}
+	have.Put("ace.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthFailed), false) // go is not the recipe's
+	have.Put("novox.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+	r.b.Health = have
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || !strings.Contains(v.Step, "on novox") {
+		t.Fatalf("build = %+v, want done on novox alone", v)
+	}
+	for _, c := range r.bm.calls {
+		if c.node == "ace" {
+			t.Errorf("a step was called on ace, whose build module is unhealthy: %+v", c)
+		}
+	}
+	have.Put("novox.mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthFailed), false)
+	r.st.vals = map[string][]byte{} // a fresh key
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildFailed || !strings.Contains(v.Error, "healthy") {
+		t.Errorf("build = %+v, want failed: no node has a healthy build module", v)
+	}
+}
+
+// 6. A key found building is taken over, whoever holds it.
+func TestABuildLeftBuildingByAnyBuilderIsTakenOverAtStart(t *testing.T) { // review round 4, 6; 1607/AC3, ADR 0478 clauses 5, 6
+	st := newMem()
+	seed(t, st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "novox.a"})
+	if got, err := (Claimer{Store: st, By: "novox.a"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{}); err != nil || got == nil {
+		t.Errorf("own building key: claim = %v, %v, want it taken again", got, err)
+	}
+	if got, err := (Claimer{Store: st, By: "ace.b"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{TakeOver: true}); err != nil || got == nil || got.Build.By != "novox.a" {
+		t.Errorf("another node's building key at start: claim = %v, %v, want it taken over", got, err)
+	}
+	if got, _ := (Claimer{Store: st, By: "ace.b"}).Claim(context.Background(), "m", fp1, "", ClaimOptions{}); got != nil {
+		t.Errorf("another builder's building key after the start was taken: a running builder's key is its own")
+	}
+}
+
+func TestABuilderFindingAKeyBuildingByAnotherNodeBuildsItOnStart(t *testing.T) { // review round 4, 6
+	r := newRig(t, goBundle)
+	seed(t, r.st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "ace.builder", Manifest: manifestD})
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || v.By != "novox.builder" {
+		t.Errorf("build = %+v, want it taken over and done by novox.builder", v)
+	}
+}

modules/mesh-delivery-builder/internal/build/run.go

@@ -0,0 +1,763 @@
+package build
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// ToolchainEntries are the nodes' toolchain entries of a language (buildrun.ToolchainSet).
+type ToolchainEntries interface {
+	Entries(language string) []delivery.NodeToolchain
+}
+
+// toolPrefix is the start of each build module's tool names: <prefix>fetch and <prefix>build.
+var toolPrefix = map[string]string{buildrun.GoBuildModule: "build_go_", buildrun.NodeBuildModule: "build_node_", ImageBuildModule: "build_image_"}
+
+// Builder builds, dark, every new-form fingerprint the indexer writes (novox/hq ADR 0453 clause 4, ADR 0478): it is
+// handed each modules value as the watch of the indexer's bucket sees it, and for each module with a fingerprint and an
+// artifact to build claims the fingerprint's build key, builds it through the build modules on the nodes
+// the toolchains choose, and writes the key done or failed. It holds no timer; a build starts from a modules value or a
+// change of the toolchains.
+type Builder struct {
+	Claimer    Claimer
+	Runner     buildrun.Runner
+	Toolchains ToolchainEntries
+	// Presence says which nodes are online (the watchman's); a node that is not is not chosen.
+	Presence  interface{ Online(node string) bool }
+	Manifests Manifests
+	// Health says whether a node's build module is running and healthy (the node-engine's have); a node whose build module
+	// is not is not chosen. Nil means every node's is.
+	Health interface {
+		Healthy(node, module string) bool
+	}
+	// buildrun.Places holds a step back while its node is at its build capacity; a Builder with none runs one step at a time on each node.
+	Places *buildrun.Places
+	// Limit is how many builds run at once; four when 0.
+	Limit int
+	Logf  func(format string, args ...any)
+
+	once     sync.Once
+	sem      chan struct{}
+	wg       sync.WaitGroup
+	mu       sync.Mutex
+	known    map[string]delivery.Module    // by modules key
+	inflight map[string]bool               // by build key
+	again    map[string]delivery.Module    // by build key: the newest value that arrived while the key was being built
+	plans    map[string]planned            // by manifest digest
+	cands    map[string]delivery.Candidate // by candidates key (candidates.go)
+	via      map[string]via                // by build key: a candidate's fetch (candidates.go)
+	trunkFP  map[string]bool               // by build key: a trunk module value carries this fingerprint
+	tried    map[string]bool               // by build key: looked at since this process started
+	// published are the package versions `<name>@<version>` a done key of this bucket names as a package's reference: a key
+	// waiting for one is built once it is here (ADR 0500 clause 6).
+	published map[string]bool
+}
+
+type planned struct {
+	plan Plan
+	err  error
+}
+
+func (b *Builder) init() {
+	b.once.Do(func() {
+		limit := b.Limit
+		if limit <= 0 {
+			limit = 4
+		}
+		b.sem = make(chan struct{}, limit)
+		b.cands, b.via, b.trunkFP = map[string]delivery.Candidate{}, map[string]via{}, map[string]bool{}
+		b.known, b.inflight, b.again, b.plans, b.tried = map[string]delivery.Module{}, map[string]bool{}, map[string]delivery.Module{}, map[string]planned{}, map[string]bool{}
+		b.published = map[string]bool{}
+		if b.Places == nil {
+			b.Places = &buildrun.Places{}
+		}
+	})
+}
+
+func (b *Builder) logf(format string, args ...any) {
+	if b.Logf != nil {
+		b.Logf(format, args...)
+	}
+}
+
+// Wait returns when every build started so far has ended.
+func (b *Builder) Wait() { b.wg.Wait() }
+
+// Module takes one value of the indexer's modules bucket in (the key is the module's name) and builds it if it is
+// to be built. A value that is not a module is said and left.
+func (b *Builder) Module(ctx context.Context, key string, value []byte) {
+	b.init()
+	m, err := delivery.DecodeModule(value)
+	if err != nil {
+		b.logf("modules.%s holds what is not a module, left: %v", key, err)
+		return
+	}
+	b.mu.Lock()
+	b.known[key] = m
+	if bk, err := delivery.BuilderBuildKey(key, m.FP2); err == nil && m.FP2 != "" {
+		// A fingerprint the trunk carries is built from the trunk's commit, whoever asked for it first.
+		b.trunkFP[bk] = true
+		delete(b.via, bk)
+	}
+	b.mu.Unlock()
+	b.consider(ctx, key, m)
+}
+
+// NodesChanged is Reconsider after a change of the nodes: one came online or went, a build module became healthy or
+// stopped being, or a toolchain moved, so a build that waited for a node may go on.
+func (b *Builder) NodesChanged(ctx context.Context) { b.Reconsider(ctx) }
+
+// Sweep reads, at start, every key of the bucket: it keeps the package versions done keys name as published (a key
+// waiting for one is then looked at again, ADR 0500 clause 6), and closes every key left building for a fingerprint its
+// module no longer has (issue 1660, ADR 0478 clause 6): the key can never be built, since nothing asks for it, and would
+// stay building for ever. It fails the key naming who left it. A key of the fingerprint the module has now is not
+// touched: the build takes it over. Call it once the modules bucket has been read, so every module is known.
+func (b *Builder) Sweep(ctx context.Context) error {
+	b.init()
+	keys, err := b.Claimer.Store.Keys(ctx)
+	if err != nil {
+		return err
+	}
+	b.mu.Lock()
+	current := map[string]bool{}
+	for name, m := range b.known {
+		if m.FP2 != "" {
+			if k, err := delivery.BuilderBuildKey(name, m.FP2); err == nil {
+				current[k] = true
+			}
+		}
+	}
+	b.mu.Unlock()
+	newly := false
+	for _, key := range keys {
+		value, rev, found, err := b.Claimer.Store.Get(ctx, key)
+		if err != nil || !found {
+			continue
+		}
+		cur, err := delivery.DecodeBuilderBuild(value)
+		if err != nil {
+			continue
+		}
+		newly = b.notePublished(cur) || newly
+		if current[key] || cur.State != delivery.BuildBuilding {
+			continue
+		}
+		closed := delivery.BuilderBuild{State: delivery.BuildFailed, By: b.Claimer.By, Manifest: cur.Manifest, Step: cur.Step,
+			Error: fmt.Sprintf("closed at start: left building by %s, and the module no longer has this fingerprint, so nothing will build it", cur.By)}
+		data, err := delivery.EncodeBuilderBuild(closed)
+		if err != nil {
+			return err
+		}
+		if _, err := b.Claimer.Store.Update(ctx, key, data, rev); err != nil && !errors.Is(err, ErrConflict) {
+			return fmt.Errorf("%s: %w", key, err)
+		}
+		b.logf("%s: closed, left building by %s for a fingerprint the module no longer has", key, cur.By)
+	}
+	if newly {
+		// A key read before the scan may wait for a package the scan found published (ADR 0500 clause 6).
+		b.Reconsider(ctx)
+	}
+	return nil
+}
+
+// notePublished keeps the package versions a done build names as references, and says whether one was new.
+func (b *Builder) notePublished(v delivery.BuilderBuild) bool {
+	if v.State != delivery.BuildDone {
+		return false
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	newly := false
+	for _, a := range v.Artifacts {
+		if a.Kind == catalogue.ArtifactPackage && a.Reference != "" && !b.published[a.Reference] {
+			b.published[a.Reference] = true
+			newly = true
+		}
+	}
+	return newly
+}
+
+func (b *Builder) isPublished(ref string) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.published[ref]
+}
+
+// Forget takes a module out (its key was deleted).
+func (b *Builder) Forget(key string) {
+	b.init()
+	b.mu.Lock()
+	delete(b.known, key)
+	b.mu.Unlock()
+}
+
+// Reconsider looks at every module again: the toolchains changed, so a build that failed for them may build now.
+func (b *Builder) Reconsider(ctx context.Context) {
+	b.init()
+	b.mu.Lock()
+	known := make(map[string]delivery.Module, len(b.known))
+	for k, m := range b.known {
+		known[k] = m
+	}
+	b.mu.Unlock()
+	for _, k := range sortedKeys(known) {
+		b.consider(ctx, k, known[k])
+	}
+	b.mu.Lock()
+	cands := make([]delivery.Candidate, 0, len(b.cands))
+	for _, c := range b.cands {
+		cands = append(cands, c)
+	}
+	b.mu.Unlock()
+	sort.Slice(cands, func(i, j int) bool { return cands[i].Group < cands[j].Group })
+	for _, c := range cands {
+		b.considerCandidate(ctx, c)
+	}
+}
+
+func sortedKeys(m map[string]delivery.Module) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// planOf is the plan of the manifest with this digest, read once: a manifest by digest never changes. A manifest that
+// cannot be read is not kept, so it is read again when the module is.
+func (b *Builder) planOf(ctx context.Context, digest string) (Plan, error, bool) {
+	b.mu.Lock()
+	p, ok := b.plans[digest]
+	b.mu.Unlock()
+	if ok {
+		return p.plan, p.err, true
+	}
+	m, err := b.Manifests.Manifest(ctx, digest)
+	if err != nil {
+		return Plan{}, fmt.Errorf("its manifest %s cannot be read: %w", digest, err), false
+	}
+	plan, err := PlanOf(m)
+	b.mu.Lock()
+	b.plans[digest] = planned{plan, err}
+	b.mu.Unlock()
+	return plan, err, true
+}
+
+func (b *Builder) consider(ctx context.Context, module string, m delivery.Module) {
+	if m.FP2 == "" || m.Manifest == "" {
+		return
+	}
+	key, err := delivery.BuilderBuildKey(module, m.FP2)
+	if err != nil {
+		b.logf("modules.%s: %v", module, err)
+		return
+	}
+	b.mu.Lock()
+	if b.inflight[key] {
+		b.again[key] = m // looked at once more when the build ends, so a change is never lost
+		b.mu.Unlock()
+		return
+	}
+	b.inflight[key] = true
+	b.mu.Unlock()
+	b.wg.Add(1)
+	go func() {
+		defer b.wg.Done()
+		b.sem <- struct{}{}
+		defer func() { <-b.sem }()
+		for {
+			b.try(ctx, module, m)
+			b.mu.Lock()
+			next, more := b.again[key]
+			delete(b.again, key)
+			if !more || ctx.Err() != nil {
+				delete(b.inflight, key)
+				b.mu.Unlock()
+				return
+			}
+			b.mu.Unlock()
+			m = next
+		}
+	}()
+}
+
+// try claims the fingerprint and builds it, writing the key done or failed. A build that ends because ctx did is left
+// building by this builder: it takes it again when it starts (ADR 0478 clause 5).
+func (b *Builder) try(ctx context.Context, module string, m delivery.Module) {
+	plan, planErr, read := b.planOf(ctx, m.Manifest)
+	nothing := read && planErr == nil && len(plan.Tasks) == 0
+	if planErr == nil && !nothing {
+		if why := b.stale(m, plan); why != "" {
+			// The fingerprint names a toolchain the build nodes no longer agree on: a new fingerprint is coming, and a build
+			// now would be of this source with another toolchain (ADR 0477 clause 2). Nothing is written.
+			b.logf("%s at %s is not built: %s", module, m.FP2, why)
+			return
+		}
+	}
+	key, _ := delivery.BuilderBuildKey(module, m.FP2)
+	b.mu.Lock()
+	trunk := b.trunkFP[key]
+	first := !b.tried[key]
+	b.tried[key] = true
+	b.mu.Unlock()
+	cl, err := b.Claimer.Claim(ctx, module, m.FP2, m.Manifest, ClaimOptions{TakeOver: first, ImageBuilder: b.imageBuilderRuns, Trunk: trunk, Published: b.isPublished})
+	if err != nil {
+		b.logf("%s: %v", module, err)
+		return
+	}
+	if cl == nil {
+		return
+	}
+	// A done key taken again builds only what is missing: the image or the package built unpublished as a candidate's; the
+	// other artifacts stay as the done key has them (ADR 0487 clauses 5 and 8, ADR 0498 clause 6).
+	var prior *delivery.BuilderBuild
+	var only map[string]bool
+	publishing := false
+	if cl.Build.State == delivery.BuildDone {
+		prior, only = &cl.Build, map[string]bool{}
+		if trunk {
+			for _, bm := range publishable(cl.Build, b.imageBuilderRuns) {
+				only[bm] = true
+				publishing = true
+			}
+		}
+	}
+	var result delivery.BuilderBuild
+	if nothing {
+		// A manifest with no artifact is built by building nothing: its key is done with no artifact, claimed and written as
+		// any other, so the controller has a done key to register it from (issue 1613, ADR 0478 clause 1, ADR 0501 clause 1).
+		result = delivery.BuilderBuild{State: delivery.BuildDone, Step: "nothing to build: the manifest names no artifact"}
+	} else {
+		result = b.build(ctx, module, m, plan, planErr, prior, only)
+	}
+	if ctx.Err() != nil {
+		return
+	}
+	if result.State == "" {
+		b.logf("%s: left building, the toolchains moved under it", cl.Key)
+		return
+	}
+	result.By, result.Manifest = b.Claimer.By, m.Manifest
+	if publishing && result.State == delivery.BuildFailed {
+		// The trunk's image or package was built only as a candidate's and its push or publish failed: the key says so, so the builds view, the
+		// checker and the failed-key retake see it, and a look does not build the image again for nothing.
+		result.Error = keyError([]string{"publishing what the merged commit built failed: " + result.Error})
+	}
+	if err := b.Claimer.Finish(ctx, cl, result); err != nil {
+		b.logf("%s: the build could not be written: %v", cl.Key, err)
+		return
+	}
+	if result.State == delivery.BuildFailed {
+		b.logf("%s: failed: %s", cl.Key, result.Error)
+	}
+	if result.State == delivery.BuildQueued {
+		b.logf("%s: waits for the package %s to be published", cl.Key, result.Waits)
+	}
+	if b.notePublished(result) {
+		// A key may wait for the package this build published (ADR 0500 clause 6).
+		b.Reconsider(ctx)
+	}
+}
+
+// stale is why the module's fingerprint is not built now, or empty when it is: the toolchain each language of the plan
+// has agreed (novox/hq ADR 0465) must be the one the fingerprint was computed with (Module.Toolchains).
+func (b *Builder) stale(m delivery.Module, plan Plan) string {
+	for _, bm := range plan.Modules() {
+		if !plan.NeedsToolchain(bm) {
+			continue // an archive is packed with no toolchain
+		}
+		language := buildrun.LanguageOf[bm]
+		tc, none := delivery.AgreedToolchain(b.Toolchains.Entries(language))
+		if none != "" {
+			return fmt.Sprintf("the %s toolchain is not agreed: %s", language, none)
+		}
+		want, ok := m.Toolchains[language]
+		if !ok || want.Version != tc.Version || want.Recipe != tc.Recipe {
+			return fmt.Sprintf("the fingerprint names %s %s (recipe %s) and the nodes agree on %s (recipe %s)", language, want.Version, want.Recipe, tc.Version, tc.Recipe)
+		}
+	}
+	return ""
+}
+
+func failed(format string, args ...any) delivery.BuilderBuild {
+	return delivery.BuilderBuild{State: delivery.BuildFailed, Error: fmt.Sprintf(format, args...)}
+}
+
+// lane is the build of a plan's tasks of one build module on one node.
+type lane struct {
+	module, node string
+	tasks        []Task
+	digests      map[string]string // artifact -> digest
+	references   map[string]string // artifact -> the reference an image was pushed to (a trunk build only)
+	err          error
+}
+
+func (b *Builder) build(ctx context.Context, module string, m delivery.Module, plan Plan, planErr error, prior *delivery.BuilderBuild, only map[string]bool) delivery.BuilderBuild {
+	switch {
+	case planErr != nil:
+		return failed("%s", planErr)
+	case m.Path == "":
+		// Empty is not known (a root module's path is "."): the indexer writes it again (issue 1615).
+		return failed("the module's key names no directory (path), so the build tools cannot be told where %s lives", module)
+	}
+	repository := delivery.RepositoryName(m.Repository)
+	var lanes []*lane
+	used := map[string]delivery.ToolchainUsed{}
+	var steps []string
+	// Every node chosen holds a reservation until its lane takes the place; a build that ends before its lanes start gives them up.
+	giveUp := func(nodes ...string) {
+		for _, n := range nodes {
+			b.Places.Cancel(n)
+		}
+	}
+	giveUpLanes := func() {
+		for _, l := range lanes {
+			b.Places.Cancel(l.node)
+		}
+	}
+	var kept []string // build modules whose artifacts stay as the prior done key has them
+	for _, bm := range plan.Modules() {
+		if prior != nil && len(only) > 0 && !only[bm] {
+			kept = append(kept, bm)
+			continue
+		}
+		language := buildrun.LanguageOf[bm]
+		entries := b.Toolchains.Entries(language)
+		qualifies := func(node string) bool { return b.qualifies(node, bm) }
+		var nodes []string
+		if bm == ImageBuildModule {
+			// An image is built on one node, chosen from the nodes whose image build module runs healthy (ADR 0487 clause 8):
+			// the module has no toolchain language, so no toolchain entry names its nodes, and a second build would only
+			// push the image again.
+			ns, err := buildrun.ChooseAnyNodes("image", b.imageEntries(), b.Places, qualifies, 1)
+			if err != nil {
+				giveUpLanes()
+				return failed("%s no node has %s, so the image cannot be built: the provision rootless-image-build is held by the module buildah; assign buildah and %s to a node (%v)", NoImageBuilderPrefix, ImageBuildModule, ImageBuildModule, err)
+			}
+			nodes = ns
+		} else if plan.NeedsToolchain(bm) {
+			ns, tc, err := buildrun.ChooseNodes(language, entries, b.Places, qualifies, 1)
+			if err != nil {
+				giveUpLanes()
+				return failed("%s", err)
+			}
+			if want := m.Toolchains[language]; want.Version != tc.Version || want.Recipe != tc.Recipe {
+				giveUp(ns...)
+				giveUpLanes()
+				return delivery.BuilderBuild{} // the agreed toolchain moved since try looked: nothing is written
+			}
+			used[language] = delivery.ToolchainUsed{Version: tc.Version, Recipe: tc.Recipe}
+			nodes = ns
+		} else {
+			// An archive is packed with no toolchain (the fingerprint names none): any node of the build module that qualifies.
+			ns, err := buildrun.ChooseAnyNodes(language, entries, b.Places, qualifies, 1)
+			if err != nil {
+				giveUpLanes()
+				return failed("%s", err)
+			}
+			nodes = ns
+		}
+		// One node builds each fingerprint (ADR 0478 clause 4, from R4e).
+		steps = append(steps, fmt.Sprintf("%s on %s", bm, nodes[0]))
+		var tasks []Task
+		for _, t := range plan.Tasks {
+			if t.Module == bm {
+				tasks = append(tasks, t)
+			}
+		}
+		for _, n := range nodes {
+			lanes = append(lanes, &lane{module: bm, node: n, tasks: tasks, digests: map[string]string{}, references: map[string]string{}})
+		}
+	}
+	var wg sync.WaitGroup
+	for _, l := range lanes {
+		wg.Add(1)
+		go func() { defer wg.Done(); b.runLane(ctx, l, repository, m, module) }()
+	}
+	wg.Wait()
+	var errs []string
+	for _, l := range lanes {
+		if l.err != nil {
+			errs = append(errs, l.err.Error())
+		}
+	}
+	if len(errs) > 0 {
+		if ref := waitsOf(errs); ref != "" {
+			// The module's lock names a version of a package the registry does not hold yet: the key waits for it, queued, and
+			// is not failed (ADR 0500 clause 6).
+			return delivery.BuilderBuild{State: delivery.BuildQueued, Waits: ref, Step: "waits for the package " + ref + " to be published"}
+		}
+		return failed("%s", keyError(errs))
+	}
+	var artifacts []delivery.BuiltArtifact
+	keptModule := map[string]bool{}
+	for _, bm := range kept {
+		keptModule[bm] = true
+	}
+	for _, t := range plan.Tasks {
+		if keptModule[t.Module] {
+			found := false
+			for _, a := range prior.Artifacts {
+				if a.Name == t.Artifact {
+					artifacts, found = append(artifacts, a), true
+				}
+			}
+			if !found {
+				return failed("the done build holds no artifact %s to keep", t.Artifact)
+			}
+			continue
+		}
+		byNode := map[string]string{}
+		for _, l := range lanes {
+			if d, ok := l.digests[t.Artifact]; ok && l.module == t.Module {
+				byNode[l.node] = d
+			}
+		}
+		d, err := buildrun.Agree(t.Artifact, byNode)
+		if err != nil {
+			return failed("%s", err)
+		}
+		built := delivery.BuiltArtifact{Name: t.Artifact, Kind: t.Kind, Digest: d}
+		for _, l := range lanes {
+			if l.module != t.Module {
+				continue
+			}
+			r := l.references[t.Artifact]
+			if r == "" && stored(t.Kind) {
+				// A bundle, an archive or an upstream copy is done only when its push was answered with where it is (ADR 0498
+				// clause 1); a candidate's included (clause 3).
+				return failed("%s%s on %s: the build answered no reference, so its push to the artifact store was not answered", delivery.NotStored, t.Artifact, l.node)
+			}
+			if r != "" {
+				built.Reference = r
+			}
+		}
+		artifacts = append(artifacts, built)
+	}
+	for _, bm := range kept {
+		steps = append(steps, bm+" kept")
+		for lang, u := range prior.Toolchains {
+			if _, ok := used[lang]; !ok && buildrun.LanguageOf[bm] == lang {
+				used[lang] = u
+			}
+		}
+	}
+	step := "built " + strings.Join(steps, "; ")
+	if len(used) == 0 {
+		used = nil
+	}
+	done := delivery.BuilderBuild{State: delivery.BuildDone, By: b.Claimer.By, Manifest: m.Manifest, Step: step, Artifacts: artifacts, Toolchains: used}
+	if _, err := delivery.EncodeBuilderBuild(done); err != nil {
+		// A reference the build module answered that does not name the artifact and its digest is no reference.
+		return failed("%s%v", delivery.NotStored, err)
+	}
+	return done
+}
+
+// stored is whether an artifact of this kind is in the artifact store once built, a candidate's too, so its done key
+// names its reference (ADR 0498 clauses 1, 3 and 4); an image or a package names one only when built for the trunk.
+func stored(kind string) bool {
+	return kind == catalogue.ArtifactBundle || kind == catalogue.ArtifactArchive || kind == catalogue.ArtifactUpstream
+}
+
+// waitsFor opens the reason of a fetch step whose module's lock names a package version the registry does not hold, then
+// `<name>@<version>` (the Node build module's, ADR 0500 clause 6).
+const waitsFor = delivery.WaitsFor
+
+// waitsOf is the package version a lane's error says the module waits for, or "" when none does or what it names is not
+// `<name>@<version>`.
+func waitsOf(errs []string) string {
+	for _, e := range errs {
+		at := strings.Index(e, waitsFor)
+		if at < 0 {
+			continue
+		}
+		ref, _, _ := strings.Cut(e[at+len(waitsFor):], " ")
+		ref = strings.TrimRight(ref, ":;,")
+		if _, err := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildQueued, Waits: ref}); err == nil {
+			return ref
+		}
+	}
+	return ""
+}
+
+// keyPrefixes are the errors a build module's step may open its reason with that the key's error must open with too, so
+// the claim reads them (delivery.FailedUntilChanged), first the ones not built again.
+var keyPrefixes = []string{delivery.NotPinned, delivery.VersionTaken, delivery.RefusedKind, delivery.NotStored}
+
+// keyError is the error of a key from its lanes' errors: when one names a prefix of keyPrefixes inside the step's words
+// (`<tool> on <node>: the step <key> failed: not stored: ...`), the key's error opens with that prefix, so a reader of the
+// key need not search for it.
+func keyError(errs []string) string {
+	for _, prefix := range keyPrefixes {
+		for i, e := range errs {
+			if strings.HasPrefix(e, prefix) {
+				return strings.Join(errs, "; ")
+			}
+			if at := strings.Index(e, prefix); at >= 0 {
+				rest := append([]string{prefix + e[:at] + e[at+len(prefix):]}, append(append([]string(nil), errs[:i]...), errs[i+1:]...)...)
+				return strings.Join(rest, "; ")
+			}
+		}
+	}
+	return strings.Join(errs, "; ")
+}
+
+func (b *Builder) online(node string) bool { return b.Presence == nil || b.Presence.Online(node) }
+
+// qualifies is whether the node can build with the build module now: it is online and the build module on it is healthy.
+func (b *Builder) qualifies(node, bm string) bool {
+	return b.Places.CapacityOf(node) > 0 && b.online(node) && (b.Health == nil || b.Health.Healthy(node, bm))
+}
+
+// imageEntries are the nodes an image may be built on, as toolchain entries for the chooser: every node the builder has a
+// capacity for or a build module toolchain from. Whether the image build module runs there is qualifies', from the have.
+func (b *Builder) imageEntries() []delivery.NodeToolchain {
+	seen := map[string]bool{}
+	var entries []delivery.NodeToolchain
+	add := func(n string) {
+		if !seen[n] {
+			seen[n] = true
+			entries = append(entries, delivery.NodeToolchain{Node: n})
+		}
+	}
+	for n := range b.Places.Capacity {
+		add(n)
+	}
+	for _, language := range []string{"go", "typescript"} {
+		for _, e := range b.Toolchains.Entries(language) {
+			add(e.Node)
+		}
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Node < entries[j].Node })
+	return entries
+}
+
+// imageBuilderRuns is whether a node can build an image now.
+func (b *Builder) imageBuilderRuns() bool {
+	for _, e := range b.imageEntries() {
+		if b.qualifies(e.Node, ImageBuildModule) {
+			return true
+		}
+	}
+	return false
+}
+
+// step runs one step of a build module; the lane that runs it holds its node's place.
+func (b *Builder) step(ctx context.Context, bm, node, tool string, args map[string]any) (json.RawMessage, error) {
+	return b.Runner.Run(ctx, bm, node, toolPrefix[bm]+tool, args)
+}
+
+// fetchResult and buildResult are the results of a build module's fetch and build steps as the builder reads them.
+type fetchResult struct {
+	Workspace string   `json:"workspace"`
+	Merge     string   `json:"merge"`
+	Conflicts []string `json:"conflicts"`
+}
+
+type buildResult struct {
+	Digest    string `json:"digest"`
+	Reference string `json:"reference"`
+}
+
+// runLane takes a place on the node, fetches the commit there and builds each of the lane's artifacts, one step at a time.
+// An upstream artifact is copied by its pinned reference with no fetch (ADR 0498 clause 4); a lane of copies alone fetches
+// nothing.
+func (b *Builder) runLane(ctx context.Context, l *lane, repository string, m delivery.Module, module string) {
+	release, err := b.Places.Acquire(ctx, l.node)
+	if err != nil {
+		l.err = err
+		return
+	}
+	defer release()
+	req := buildstep.FetchRequest{Repository: repository, Commit: m.Commit}
+	if key, err := delivery.BuilderBuildKey(module, m.FP2); err == nil {
+		b.mu.Lock()
+		v, candidate := b.via[key]
+		b.mu.Unlock()
+		if candidate {
+			req.Ref, req.Base = v.Ref, v.Base
+		}
+	}
+	if m.Inputs2 != nil && len(m.Inputs2.Paths) > 0 {
+		// A module whose every artifact names its paths is built from those alone (ADR 0499 clause 4): the paths come from
+		// the indexer's kept inputs, never from a manifest (the lead's decision L8 of R4e).
+		req.Dir = m.Path
+		for p := range m.Inputs2.Paths {
+			req.Paths = append(req.Paths, p)
+		}
+		sort.Strings(req.Paths)
+	}
+	fetchArgs := req.Args()
+	candidate := req.Base != ""
+	var fetched fetchResult
+	if needsFetch(l.tasks) {
+		raw, err := b.step(ctx, l.module, l.node, "fetch", fetchArgs)
+		if err != nil {
+			l.err = err
+			return
+		}
+		if err := json.Unmarshal(raw, &fetched); err != nil || fetched.Workspace == "" {
+			l.err = fmt.Errorf("the fetch on %s answered no workspace: %s", l.node, raw)
+			return
+		}
+		// A candidate is built from its head merged onto the trunk. A head that does not merge ends the fetch passed with the tree at
+		// the trunk, and building that would store the trunk's build under the candidate's fingerprint.
+		if candidate {
+			if len(fetched.Conflicts) > 0 {
+				l.err = fmt.Errorf("the head does not merge into the trunk on %s: files in conflict: %s", l.node, strings.Join(fetched.Conflicts, ", "))
+				return
+			}
+			if fetched.Merge == "" {
+				l.err = fmt.Errorf("the fetch with a base on %s answered no merge: %s", l.node, raw)
+				return
+			}
+		}
+	}
+	for _, t := range l.tasks {
+		tool, args := "build", map[string]any{"workspace": fetched.Workspace, "module": m.Path, "artifact": t.Artifact}
+		if t.Kind == catalogue.ArtifactUpstream {
+			// The copy runs no code of a change: the module's name (the reference's path), the artifact and its pin.
+			tool, args = "copy", map[string]any{"module": module, "artifact": t.Artifact, "from": t.From}
+		} else if !candidate {
+			// Only a trunk key's build pushes an image or publishes a package; a candidate's never does (ADR 0487 clause 12,
+			// ADR 0498 clauses 5 and 6). A bundle or an archive is pushed either way (clause 3).
+			args["publish"] = true
+		}
+		raw, err := b.step(ctx, l.module, l.node, tool, args)
+		if err != nil {
+			l.err = err
+			return
+		}
+		var built buildResult
+		if err := json.Unmarshal(raw, &built); err != nil || built.Digest == "" {
+			l.err = fmt.Errorf("the %s of %s of %s on %s answered no digest: %s", tool, t.Artifact, module, l.node, raw)
+			return
+		}
+		l.digests[t.Artifact] = built.Digest
+		if built.Reference != "" && (stored(t.Kind) || !candidate) {
+			l.references[t.Artifact] = built.Reference
+		}
+	}
+}
+
+// needsFetch is whether any of the tasks builds from the module's source: every one but an upstream copy.
+func needsFetch(tasks []Task) bool {
+	for _, t := range tasks {
+		if t.Kind != catalogue.ArtifactUpstream {
+			return true
+		}
+	}
+	return false
+}

modules/mesh-delivery-builder/internal/build/run_test.go

@@ -0,0 +1,614 @@
+package build
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// buildModules simulates the two build modules on the nodes: a long tool answers a step and key at once and writes the
+// step's end into the steps (as mesh-build-go and mesh-build-node do), with a digest by node and artifact, or a failure.
+type buildModules struct {
+	mu      sync.Mutex
+	n       int
+	calls   []call
+	steps   *fakeSteps
+	digests map[string]string // `<node>/<artifact>` -> digest; the default is `digest`
+	fails   map[string]string // `<node>/<tool>` -> the reason the step fails with
+	// noRef names `<node>/<artifact>` whose bundle or archive build answers no reference (its push not answered).
+	noRef map[string]bool
+	// packages are the package artifacts by name, each with the `<name>@<version>` its trunk build publishes (ADR 0498 clause 5).
+	packages map[string]string
+	// hold, when set before the builds start, blocks every call until it is closed; entered is sent to as a call arrives.
+	// conflicts, when set, is a file a fetch with a base reports in conflict; noMerge makes it answer neither a merge nor a conflict.
+	conflicts string
+	noMerge   bool
+	hold      chan struct{}
+	entered   chan struct{}
+}
+
+func newBuildModules() *buildModules {
+	return &buildModules{steps: &fakeSteps{steps: map[string]delivery.Step{}}, digests: map[string]string{}, fails: map[string]string{}, noRef: map[string]bool{}, packages: map[string]string{}}
+}
+
+func (b *buildModules) CallOn(node, key string, body any) (json.RawMessage, error) {
+	if b.hold != nil {
+		select {
+		case b.entered <- struct{}{}:
+		default:
+		}
+		<-b.hold
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.calls = append(b.calls, call{node, key, body})
+	b.n++
+	id := fmt.Sprintf("s%d", b.n)
+	module, tool, _ := strings.Cut(key, ".")
+	args, _ := body.(map[string]any)
+	step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepPassed}
+	if reason, ok := b.fails[node+"/"+tool]; ok {
+		step.State, step.Reason = delivery.StepFailed, reason
+	} else if strings.HasSuffix(tool, "_fetch") {
+		step.Result = json.RawMessage(`{"workspace":"w-` + node + `"}`)
+		if args["base"] != nil { // a fetch with a base answers the merge, or the files in conflict (mesh-build-go FetchResult)
+			if b.conflicts != "" {
+				step.Result = json.RawMessage(`{"workspace":"w-` + node + `","base":"` + fmt.Sprint(args["base"]) + `","conflicts":["` + b.conflicts + `"]}`)
+			} else if !b.noMerge {
+				step.Result = json.RawMessage(`{"workspace":"w-` + node + `","base":"` + fmt.Sprint(args["base"]) + `","merge":"` + strings.Repeat("9", 40) + `"}`)
+			}
+		}
+	} else {
+		d := digest
+		if v, ok := b.digests[node+"/"+fmt.Sprint(args["artifact"])]; ok {
+			d = v
+		}
+		if tool == "build_image_copy" { // mesh-build-image's copy answers the digest and where it copied to (ADR 0498 clause 4)
+			step.Result = json.RawMessage(`{"artifact":"` + fmt.Sprint(args["artifact"]) + `","digest":"` + d + `","reference":"registry.example/` + fmt.Sprint(args["module"]) + `/` + fmt.Sprint(args["artifact"]) + `@` + d + `","pushed":true}`)
+		} else if pkg, ok := b.packages[fmt.Sprint(args["artifact"])]; ok { // a package names its version only when published
+			step.Result = json.RawMessage(`{"digest":"` + d + `"}`)
+			if args["publish"] == true {
+				step.Result = json.RawMessage(`{"digest":"` + d + `","reference":"` + pkg + `"}`)
+			}
+		} else if tool == "build_image_build" && args["publish"] == true {
+			step.Result = json.RawMessage(`{"digest":"` + d + `","reference":"registry.example/m/` + fmt.Sprint(args["artifact"]) + `@` + d + `"}`)
+		} else if tool != "build_image_build" && !b.noRef[node+"/"+fmt.Sprint(args["artifact"])] {
+			// A bundle or an archive is pushed to the artifact store and its reference answered (ADR 0498 clause 1).
+			step.Result = json.RawMessage(`{"digest":"` + d + `","reference":"artifact-store://m/` + fmt.Sprint(args["artifact"]) + `/blobs/` + d + `"}`)
+		} else {
+			step.Result = json.RawMessage(`{"digest":"` + d + `"}`)
+		}
+	}
+	sk, _ := delivery.StepKey(node, id)
+	b.steps.mu.Lock()
+	b.steps.steps[module+"/"+sk] = step
+	b.steps.mu.Unlock()
+	return json.RawMessage(`{"step":"` + id + `","key":"` + sk + `","state":"running"}`), nil
+}
+
+func (b *buildModules) callsOf(tool string) (out []call) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	for _, c := range b.calls {
+		if strings.HasSuffix(c.key, "."+tool) {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+type fakeManifests struct {
+	byDigest map[string]catalogue.Manifest
+}
+
+func (f *fakeManifests) Manifest(_ context.Context, d string) (catalogue.Manifest, error) {
+	m, ok := f.byDigest[d]
+	if !ok {
+		return catalogue.Manifest{}, fmt.Errorf("manifests.%s is not there", d)
+	}
+	return m, nil
+}
+
+func mdigest(c byte) string { return hex64(c) }
+
+type rig struct {
+	b     *Builder
+	st    *memStore
+	bm    *buildModules
+	tools *buildrun.ToolchainSet
+	pres  *buildrun.PresenceSet
+	mf    *fakeManifests
+	key   string
+}
+
+func newRig(t *testing.T, artifacts ...catalogue.Artifact) *rig {
+	t.Helper()
+	r := &rig{st: newMem(), bm: newBuildModules(), tools: &buildrun.ToolchainSet{}, pres: &buildrun.PresenceSet{}, mf: &fakeManifests{byDigest: map[string]catalogue.Manifest{mdigest('a'): {Module: "m", Build: &catalogue.Build{Artifacts: artifacts}}}}}
+	for _, n := range []string{"ace", "novox"} {
+		r.tools.Put(buildrun.GoBuildModule, n+".go", tcValue(t, "go", "go1.27.1"), false)
+		r.tools.Put(buildrun.NodeBuildModule, n+".typescript", tcValue(t, "typescript", "tsc5"), false)
+		r.pres.Put(n, presenceValue(t, true), false)
+	}
+	r.b = &Builder{
+		Claimer: Claimer{Store: r.st, By: "novox.builder"}, Runner: buildrun.Runner{Caller: r.bm, Steps: r.bm.steps, Bound: time.Second},
+		Toolchains: r.tools, Presence: r.pres, Manifests: r.mf, Logf: t.Logf,
+	}
+	var err error
+	if r.key, err = delivery.BuilderBuildKey("m", fp1); err != nil {
+		t.Fatal(err)
+	}
+	return r
+}
+
+// agreedToolchains are what the rig's nodes report, and so what a fingerprint computed now names.
+var agreedToolchains = map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.1", Recipe: "1"}, "typescript": {Version: "tsc5", Recipe: "1"}}
+
+func moduleValue(t *testing.T, path string) []byte { return moduleValueWith(t, path, agreedToolchains) }
+
+func moduleValueWith(t *testing.T, path string, toolchains map[string]delivery.ToolchainUsed) []byte {
+	t.Helper()
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20", FP: "src1:" + hex64('f'), FP2: fp1, Manifest: mdigest('a'), Path: path, Toolchains: toolchains})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func (r *rig) consider(t *testing.T, path string) delivery.BuilderBuild {
+	t.Helper()
+	r.b.Module(context.Background(), "m", moduleValue(t, path))
+	r.b.Wait()
+	if _, ok := r.st.vals[r.key]; !ok {
+		t.Fatal("no build key was written")
+	}
+	return valueOf(t, r.st, r.key)
+}
+
+var (
+	goBundle  = catalogue.Artifact{Name: "tool", Kind: "bundle", Language: "go"}
+	tsBundle  = catalogue.Artifact{Name: "web", Kind: "bundle", Language: "typescript"}
+	archiveA  = catalogue.Artifact{Name: "files", Kind: "archive"}
+	imageArt  = catalogue.Artifact{Name: "img", Kind: "image"}
+	manifestD = mdigest('a')
+)
+
+func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7, ADR 0478 clauses 1, 4
+	r := newRig(t, goBundle, archiveA, tsBundle)
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || v.By != "novox.builder" || v.Manifest != manifestD || len(v.Artifacts) != 3 {
+		t.Fatalf("build = %+v, want done by novox.builder with three artifacts", v)
+	}
+	for i, want := range []string{"files", "tool", "web"} {
+		if a := v.Artifacts[i]; a.Name != want || a.Digest != digest || a.Reference != "artifact-store://m/"+want+"/blobs/"+digest {
+			t.Errorf("artifact %d = %+v, want %s with the digest and its artifact-store reference (ADR 0498 clause 1)", i, a, want)
+		}
+	}
+	if v.Artifacts[0].Kind != "archive" || v.Artifacts[1].Kind != "bundle" {
+		t.Errorf("kinds = %+v", v.Artifacts)
+	}
+	if got := v.Toolchains["go"]; got.Version != "go1.27.1" || got.Recipe != "1" {
+		t.Errorf("toolchains = %+v, want go and typescript named", v.Toolchains)
+	}
+	if got := v.Toolchains["typescript"]; got.Version != "tsc5" {
+		t.Errorf("toolchains = %+v", v.Toolchains)
+	}
+	// One fetch per build module, on one node (ADR 0478 clause 4); every build names the module's directory.
+	if n := len(r.bm.callsOf("build_go_fetch")); n != 1 {
+		t.Errorf("%d go fetches, want one", n)
+	}
+	if n := len(r.bm.callsOf("build_go_build")); n != 2 { // tool and files
+		t.Errorf("%d go builds, want 2", n)
+	}
+	if n := len(r.bm.callsOf("build_node_build")); n != 1 {
+		t.Errorf("%d node builds, want 1", n)
+	}
+	c := r.bm.callsOf("build_go_build")[0]
+	if args := c.body.(map[string]any); args["module"] != "modules/m" || !strings.HasPrefix(fmt.Sprint(args["workspace"]), "w-") {
+		t.Errorf("build args = %+v, want the module's path and the fetch's workspace", args)
+	}
+	f := r.bm.callsOf("build_go_fetch")[0].body.(map[string]any)
+	if f["repository"] != "novox/mesh-catalog" || f["commit"] != "7a74cee83f88e6585a5511c3cc53bdf0f5303d20" {
+		t.Errorf("fetch args = %+v", f)
+	}
+}
+
+func TestOneQualifyingNodeBuildsOnce(t *testing.T) { // 1607/AC4, ADR 0478 clause 4
+	r := newRig(t, goBundle)
+	r.tools.Put(buildrun.GoBuildModule, "ace.go", nil, true)
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || !strings.Contains(v.Step, "on novox") {
+		t.Errorf("build = %+v, want done with its step saying novox", v)
+	}
+	if n := len(r.bm.callsOf("build_go_build")); n != 1 {
+		t.Errorf("%d builds, want one", n)
+	}
+}
+
+func TestAFailingStepFailsTheBuildWithItsReasonAndNodeAndIsTriedAgainAsANewRevision(t *testing.T) { // 1607/AC7, ADR 0429 clause 18
+	r := newRig(t, goBundle)
+	r.bm.fails["ace/build_go_build"] = "go build of tool: undefined: x"
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.Contains(v.Error, "ace") || !strings.Contains(v.Error, "undefined: x") {
+		t.Fatalf("build = %+v, want failed with the node and the reason", v)
+	}
+	rev := r.st.revs[r.key]
+	delete(r.bm.fails, "ace/build_go_build")
+	v = r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || r.st.revs[r.key] <= rev {
+		t.Errorf("build = %+v at revision %d (was %d), want done as a new revision of the same key", v, r.st.revs[r.key], rev)
+	}
+}
+
+// imageHave marks mesh-build-image running and healthy on these nodes.
+func imageHave(t *testing.T, nodes ...string) *buildrun.HaveSet {
+	t.Helper()
+	have := &buildrun.HaveSet{}
+	for _, n := range nodes {
+		have.Put(n+".mesh-build-go", haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+		have.Put(n+"."+ImageBuildModule, haveValue(t, delivery.PhaseRunning, delivery.HealthOK), false)
+	}
+	return have
+}
+
+func TestAnImageGoesToOneNodeAndGetsOneDoneKeyWithItsReference(t *testing.T) { // 1705a, ADR 0487 clause 5
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "ace", "novox") // two nodes qualify; an image still builds on one
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 || v.Artifacts[0].Kind != "image" || v.Artifacts[0].Digest != digest {
+		t.Fatalf("build = %+v, want done with one image artifact and its digest", v)
+	}
+	if v.Artifacts[0].Reference == "" {
+		t.Errorf("a trunk image has no reference: %+v", v.Artifacts[0])
+	}
+	if n := len(r.bm.callsOf("build_image_fetch")); n != 1 {
+		t.Errorf("%d image fetches, want one", n)
+	}
+	writes := r.st.writes
+	r.consider(t, "modules/m")
+	if r.st.writes != writes || len(r.bm.callsOf("build_image_build")) != 1 {
+		t.Errorf("a done image key was built again")
+	}
+}
+
+func TestAnImageIsBuiltOnlyWhereMeshBuildImageIsHealthy(t *testing.T) { // 1705a
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "novox")
+	r.consider(t, "modules/m")
+	c := r.bm.callsOf("build_image_build")
+	if len(c) != 1 || c[0].node != "novox" {
+		t.Errorf("calls = %+v, want one on novox", c)
+	}
+}
+
+func TestABundleAndAnImageOfOneModuleBuildOnOneNodeEach(t *testing.T) { // 1705a
+	r := newRig(t, goBundle, imageArt)
+	r.b.Health = imageHave(t, "ace", "novox")
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 2 {
+		t.Fatalf("build = %+v", v)
+	}
+	if n := len(r.bm.callsOf("build_go_build")); n != 1 {
+		t.Errorf("%d go builds, want 1 (one node per fingerprint, ADR 0478 clause 4)", n)
+	}
+	if n := len(r.bm.callsOf("build_image_build")); n != 1 {
+		t.Errorf("%d image builds, want 1", n)
+	}
+}
+
+func TestWithNoImageNodeTheKeyFailsNamingTheProvisionAndIsNotRetakenUntilANodeReportsTheModule(t *testing.T) { // 1705b, lead's decision
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t) // mesh-build-image runs nowhere
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, NoImageBuilderPrefix) || !strings.Contains(v.Error, "rootless-image-build") || !strings.Contains(v.Error, "buildah") || !strings.Contains(v.Error, ImageBuildModule) {
+		t.Fatalf("build = %+v, want failed naming rootless-image-build, buildah and mesh-build-image", v)
+	}
+	if len(r.bm.calls) != 0 {
+		t.Errorf("%d calls, want none", len(r.bm.calls))
+	}
+	writes := r.st.writes
+	r.consider(t, "modules/m")
+	r.consider(t, "modules/m")
+	if r.st.writes != writes {
+		t.Errorf("the failed key was written again (%d writes, was %d)", r.st.writes, writes)
+	}
+	// A node reports the module: the key is taken again.
+	r.b.Health = imageHave(t, "ace")
+	v = r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want done once a node reports mesh-build-image", v)
+	}
+}
+
+func TestACandidatesImageCallCarriesNoPublishAndItsKeyNoReference(t *testing.T) { // 1705b, lead's decision
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "ace")
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 || v.Artifacts[0].Reference != "" {
+		t.Fatalf("build = %+v, want done with no reference", v)
+	}
+	calls := r.bm.callsOf("build_image_build")
+	if len(calls) != 1 {
+		t.Fatalf("%d image builds, want 1", len(calls))
+	}
+	if _, has := calls[0].body.(map[string]any)["publish"]; has {
+		t.Errorf("a candidate's image call carries publish: %+v", calls[0].body)
+	}
+}
+
+func TestATrunkImageCallCarriesPublish(t *testing.T) { // 1705b
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "ace")
+	r.consider(t, "modules/m")
+	calls := r.bm.callsOf("build_image_build")
+	if len(calls) != 1 || calls[0].body.(map[string]any)["publish"] != true {
+		t.Errorf("calls = %+v, want publish true", calls)
+	}
+}
+
+func TestAnUnpinnedUpstreamFailsNotPinnedAndIsNeverBuiltAgain(t *testing.T) { // B3, ADR 0498 clause 4
+	r := newRig(t, archiveA, catalogue.Artifact{Name: "up", Kind: "upstream", From: "nats:2.11.17-alpine"})
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.HasPrefix(v.Error, delivery.NotPinned) || !strings.Contains(v.Error, "up") {
+		t.Fatalf("build = %+v, want failed 'not pinned:' naming the artifact", v)
+	}
+	if len(r.bm.calls) != 0 {
+		t.Errorf("%d calls, want none for an unpinned upstream", len(r.bm.calls))
+	}
+	writes := r.st.writes
+	r.consider(t, "modules/m")
+	if r.st.writes != writes {
+		t.Errorf("an unpinned upstream's key was written again (%d writes, was %d)", r.st.writes, writes)
+	}
+}
+
+func TestAModuleKeyWithNoPathFailsNamingThatReason(t *testing.T) { // 1607/AC8, ADR 0478 clause 8
+	r := newRig(t, goBundle)
+	v := r.consider(t, "")
+	if v.State != delivery.BuildFailed || !strings.Contains(v.Error, "path") || len(r.bm.calls) != 0 {
+		t.Errorf("build = %+v with %d calls, want failed naming the missing path and nothing called", v, len(r.bm.calls))
+	}
+}
+
+func TestAnUnreadableManifestFailsTheBuild(t *testing.T) {
+	r := newRig(t, goBundle)
+	delete(r.mf.byDigest, mdigest('a'))
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildFailed || !strings.Contains(v.Error, "manifest") {
+		t.Errorf("build = %+v, want failed naming the manifest", v)
+	}
+}
+
+func TestAModuleWithNoFingerprintIsNotBuilt(t *testing.T) { // 1607/AC2
+	r := newRig(t)
+	data, _ := delivery.EncodeModule(delivery.Module{Repository: "novox/r", Commit: "c", FP: "src1:" + hex64('f'), None2: "toolchain not yet reported"})
+	r.b.Module(context.Background(), "n", data)
+	r.b.Wait()
+	if len(r.st.vals) != 0 {
+		t.Errorf("keys %v were written: a module with no new-form fingerprint has nothing to build", r.st.vals)
+	}
+}
+
+func TestAModuleWithNoArtifactGetsADoneKeyWithNoArtifactAndNoBuildCall(t *testing.T) { // issue 1613, ADR 0478 clause 1
+	for name, manifest := range map[string]catalogue.Manifest{"no build": {Module: "m"}, "no artifact": {Module: "m", Build: &catalogue.Build{}}} {
+		r := newRig(t)
+		r.mf.byDigest[mdigest('a')] = manifest
+		v := r.consider(t, "") // a module with nothing to build needs no directory
+		if v.State != delivery.BuildDone || len(v.Artifacts) != 0 || v.Manifest != manifestD || v.By != "novox.builder" {
+			t.Errorf("%s: build = %+v, want done with no artifact", name, v)
+		}
+		if len(r.bm.calls) != 0 {
+			t.Errorf("%s: %d build module calls, want none", name, len(r.bm.calls))
+		}
+		writes := r.st.writes
+		r.b.tried = map[string]bool{}
+		r.consider(t, "")
+		if r.st.writes != writes {
+			t.Errorf("%s: the done key was written again", name)
+		}
+	}
+}
+
+func TestAKeyTheBuilderLeftBuildingIsBuiltAtStartAndDoneKeysAreNotBuiltTwice(t *testing.T) { // 1607/AC3, AC7
+	r := newRig(t, goBundle)
+	seed(t, r.st, delivery.BuilderBuild{State: delivery.BuildBuilding, By: "novox.builder", Manifest: manifestD})
+	if v := r.consider(t, "modules/m"); v.State != delivery.BuildDone {
+		t.Fatalf("build = %+v, want the builder's own building key built", v)
+	}
+	calls := len(r.bm.calls)
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Reconsider(context.Background())
+	r.b.Wait()
+	if len(r.bm.calls) != calls {
+		t.Errorf("a done key was built again (%d calls, was %d)", len(r.bm.calls), calls)
+	}
+}
+
+// Two instances that start together on one key: the second finds the key building and takes it over (ADR 0478 clause 6:
+// a key found building at start is taken over, whoever holds it), so both may build; the key is written once, by the one
+// whose compare-and-set comes first, and the other's write is refused, never overwriting it.
+func TestTwoInstancesStartingTogetherEndWithOneDoneKey(t *testing.T) { // 1607/AC7, review round 4
+	r := newRig(t, goBundle)
+	other := &Builder{Claimer: Claimer{Store: r.st, By: "ace.builder"}, Runner: r.b.Runner, Toolchains: r.tools, Presence: r.pres, Manifests: r.mf, Logf: t.Logf}
+	value := moduleValue(t, "modules/m")
+	var wg sync.WaitGroup
+	for _, b := range []*Builder{r.b, other} {
+		wg.Add(1)
+		go func() { defer wg.Done(); b.Module(context.Background(), "m", value); b.Wait() }()
+	}
+	wg.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone || len(v.Artifacts) != 1 {
+		t.Errorf("build = %+v, want one done key", v)
+	}
+	if n := len(r.bm.callsOf("build_go_build")); n < 1 {
+		t.Errorf("%d builds, want one for each instance that built", n)
+	}
+}
+
+func TestAModulesValueThatArrivesWhileItsKeyIsBeingBuiltIsLookedAtAgainWhenItEnds(t *testing.T) { // 1607/AC6 (no event is dropped, no timer)
+	r := newRig(t, goBundle)
+	r.bm.fails["ace/build_go_build"] = "go build of tool: boom"
+	r.bm.hold, r.bm.entered = make(chan struct{}), make(chan struct{}, 8)
+	value := moduleValue(t, "modules/m")
+	r.b.Module(context.Background(), "m", value)
+	<-r.bm.entered // the first build is under way
+	r.b.Module(context.Background(), "m", value)
+	r.b.Reconsider(context.Background())
+	delete(r.bm.fails, "ace/build_go_build") // what the event is about: the build can succeed now
+	close(r.bm.hold)
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want the failed key built again as a new revision after the first build ended", v)
+	}
+}
+
+func TestAKeyIsBuiltOnlyWithTheToolchainItsFingerprintNamesAndNothingIsWrittenOtherwise(t *testing.T) { // 1615/AC4
+	r := newRig(t, goBundle)
+	old := map[string]delivery.ToolchainUsed{"go": {Version: "go1.26.0", Recipe: "1"}}
+	r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", old))
+	r.b.Wait()
+	if len(r.st.vals) != 0 || len(r.bm.calls) != 0 {
+		t.Errorf("keys %v and %d calls for a fingerprint of go1.26.0 while the nodes agree on go1.27.1, want neither", r.st.vals, len(r.bm.calls))
+	}
+	// A recipe that differs is a different toolchain too, and a value that names none (written before) is not built.
+	r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.1", Recipe: "0"}}))
+	r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", nil))
+	r.b.Wait()
+	if len(r.st.vals) != 0 || len(r.bm.calls) != 0 {
+		t.Errorf("keys %v and %d calls for a recipe that differs or a value that names no toolchain", r.st.vals, len(r.bm.calls))
+	}
+	// The toolchain moves under a key that is not built yet: the old fingerprint stays unbuilt, the new one builds.
+	r.tools.Put(buildrun.GoBuildModule, "ace.go", tcValue(t, "go", "go1.27.2"), false)
+	r.tools.Put(buildrun.GoBuildModule, "novox.go", tcValue(t, "go", "go1.27.2"), false)
+	r.b.Reconsider(context.Background())
+	r.b.Wait()
+	if len(r.st.vals) != 0 {
+		t.Errorf("keys %v: the old fingerprint was built with the new toolchain", r.st.vals)
+	}
+	r.b.Module(context.Background(), "m", moduleValueWith(t, "modules/m", map[string]delivery.ToolchainUsed{"go": {Version: "go1.27.2", Recipe: "1"}}))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone || v.Toolchains["go"].Version != "go1.27.2" {
+		t.Errorf("build = %+v, want done with go1.27.2", v)
+	}
+}
+
+func TestNodesTheyDisagreeOnLeaveTheKeyUnwritten(t *testing.T) { // 1615/AC4
+	r := newRig(t, goBundle)
+	r.tools.Put(buildrun.GoBuildModule, "ace.go", tcValue(t, "go", "go1.26.0"), false)
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if len(r.st.vals) != 0 || len(r.bm.calls) != 0 {
+		t.Errorf("keys %v and %d calls while the nodes disagree", r.st.vals, len(r.bm.calls))
+	}
+}
+
+func TestARootModulesPathIsDotAndIsGivenToTheBuildTools(t *testing.T) { // 1615/AC4
+	r := newRig(t, goBundle)
+	if v := r.consider(t, delivery.RootPath); v.State != delivery.BuildDone {
+		t.Fatalf("build = %+v, want done for a root module", v)
+	}
+	if args := r.bm.callsOf("build_go_build")[0].body.(map[string]any); args["module"] != "." {
+		t.Errorf("build args = %+v, want module \".\"", args)
+	}
+}
+
+func TestANodeThatIsNotOnlineIsNotChosenAndComingBackWakesTheBuild(t *testing.T) { // 1607 review 3
+	r := newRig(t, goBundle)
+	r.tools.Put(buildrun.GoBuildModule, "g14.go", tcValue(t, "go", "go1.27.1"), false) // a laptop that reports its toolchain and sleeps
+	v := r.consider(t, "modules/m")
+	if v.State != delivery.BuildDone {
+		t.Fatalf("build = %+v", v)
+	}
+	for _, c := range r.bm.calls {
+		if c.node == "g14" {
+			t.Errorf("a call went to g14, which is not online: %+v", c)
+		}
+	}
+	// With no node online the key fails naming why; a node coming online builds it as a new revision.
+	r2 := newRig(t, goBundle)
+	r2.pres.Put("ace", nil, true)
+	r2.pres.Put("novox", nil, true)
+	if v := r2.consider(t, "modules/m"); v.State != delivery.BuildFailed || !strings.Contains(v.Error, "online") {
+		t.Fatalf("build = %+v, want failed because no node is online", v)
+	}
+	r2.pres.Put("ace", presenceValue(t, true), false)
+	r2.b.Reconsider(context.Background())
+	r2.b.Wait()
+	if v := valueOf(t, r2.st, r2.key); v.State != delivery.BuildDone {
+		t.Errorf("build = %+v, want done once a node is online", v)
+	}
+}
+
+func TestACandidatesImageIsPublishedOnceWhenTheTrunkNamesItsFingerprint(t *testing.T) { // review r1, mesh-delivery 1; ADR 0487 clause 5
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "ace")
+	trunkModule(t, r) // the trunk carries another fingerprint; fp1 is the candidate's
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || v.Artifacts[0].Reference != "" {
+		t.Fatalf("candidate build = %+v, want done with no reference", v)
+	}
+	if n := len(r.bm.callsOf("build_image_build")); n != 1 {
+		t.Fatalf("%d image builds after the candidate, want 1", n)
+	}
+	// The pull request is merged: the trunk's record names the candidate's fingerprint.
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	v = valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildDone || len(v.Artifacts) != 1 || v.Artifacts[0].Reference == "" {
+		t.Fatalf("trunk build = %+v, want done with a reference", v)
+	}
+	calls := r.bm.callsOf("build_image_build")
+	published := 0
+	for _, c := range calls {
+		if c.body.(map[string]any)["publish"] == true {
+			published++
+		}
+	}
+	if len(calls) != 2 || published != 1 {
+		t.Errorf("%d image builds, %d with publish, want 2 and exactly 1", len(calls), published)
+	}
+	// Written once more only: looking again builds nothing.
+	rev := r.st.revs[r.key]
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if r.st.revs[r.key] != rev || len(r.bm.callsOf("build_image_build")) != 2 {
+		t.Error("a published key was built again")
+	}
+}
+
+func TestAFailedPublishOfACandidatesImageIsWrittenToTheKey(t *testing.T) { // review r2, mesh-delivery 1; ADR 0487 clause 5
+	r := newRig(t, imageArt)
+	r.b.Health = imageHave(t, "ace")
+	trunkModule(t, r)
+	r.b.Candidate(context.Background(), "feat%2Fx", candidateValue(t, "feat/x", 7, headX))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone {
+		t.Fatalf("candidate build = %+v", v)
+	}
+	r.bm.fails["ace/build_image_build"] = "push to the registry: connection refused"
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m")) // the merge: the trunk names the fingerprint
+	r.b.Wait()
+	v := valueOf(t, r.st, r.key)
+	if v.State != delivery.BuildFailed || !strings.Contains(v.Error, "connection refused") || !strings.Contains(v.Error, "publish") {
+		t.Fatalf("build = %+v, want failed naming the publish and its reason", v)
+	}
+	// The failed key is retaken as any failed key is, and ends published once the registry answers.
+	delete(r.bm.fails, "ace/build_image_build")
+	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	r.b.Wait()
+	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildDone || v.Artifacts[0].Reference == "" {
+		t.Errorf("build = %+v, want done with a reference", v)
+	}
+}

modules/mesh-delivery-builder/internal/build/testdata/captured/README

@@ -0,0 +1,4 @@
+Captured step values of mesh-build-image (fetch, a candidate's build, a trunk's build), copied from
+novox/mesh-catalog modules/mesh-build-image/cmd/mesh-build-image/testdata/captured/. Both copies must change together: the
+module's capture test writes them, and the builder's TestCapturedImageStepsDecodeWithTheBuildersOwnTypes (internal/build,
+fixtures_test.go) decodes these with the types the builder reads results with and fails on a missing field.

modules/mesh-delivery-builder/internal/build/testdata/captured/build-candidate.json

@@ -0,0 +1,14 @@
+{
+  "ended": "2026-10-22T08:00:01Z",
+  "id": "STEPID",
+  "node": "ace",
+  "result": {
+    "artifact": "server",
+    "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+    "pushed": false
+  },
+  "started": "2026-10-22T08:00:00Z",
+  "state": "passed",
+  "tool": "build_image_build",
+  "v": 1
+}

modules/mesh-delivery-builder/internal/build/testdata/captured/build-trunk.json

@@ -0,0 +1,15 @@
+{
+  "ended": "2026-10-22T08:00:01Z",
+  "id": "STEPID",
+  "node": "ace",
+  "result": {
+    "artifact": "server",
+    "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+    "pushed": true,
+    "reference": "REGISTRY/fixture-image/server@sha256:1111111111111111111111111111111111111111111111111111111111111111"
+  },
+  "started": "2026-10-22T08:00:00Z",
+  "state": "passed",
+  "tool": "build_image_build",
+  "v": 1
+}

modules/mesh-delivery-builder/internal/build/testdata/captured/fetch.json

@@ -0,0 +1,13 @@
+{
+  "ended": "2026-10-22T08:00:01Z",
+  "id": "STEPID",
+  "node": "ace",
+  "result": {
+    "commit": "COMMIT",
+    "workspace": "WORKSPACE"
+  },
+  "started": "2026-10-22T08:00:00Z",
+  "state": "passed",
+  "tool": "build_image_fetch",
+  "v": 1
+}

modules/mesh-delivery-builder/manifest_test.go

@@ -0,0 +1,195 @@
+package manifest
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+)
+
+// The controller's manifest reader is mesh-controller internal/catalogue (Manifest, manifest.go: Consumes :521,
+// Invokes :590, Streams :613, Reads :659; StreamDeclaration, streams.go), an internal package of another repository.
+// These tests decode the manifest strictly into the fields those types name (DisallowUnknownFields) and hold the
+// rules of issue 1607 (ADR 0453 §4, ADR 0478). The merge gate's module check proves the controller takes the manifest.
+
+type state struct {
+	Name    string `json:"name"`
+	History int    `json:"history,omitempty"`
+}
+
+type artifact struct {
+	Name     string `json:"name"`
+	Kind     string `json:"kind"`
+	Language string `json:"language"`
+	System   string `json:"system"`
+	From     string `json:"from"`
+	Binary   string `json:"binary"`
+}
+
+type manifest struct {
+	Module   string   `json:"module"`
+	Version  string   `json:"version"`
+	Slug     string   `json:"slug"`
+	Consumes []string `json:"consumes"`
+	State    []state  `json:"state"`
+	Reads    []string `json:"reads"`
+	Invokes  []string `json:"invokes"`
+	Config   map[string]struct {
+		Type        string `json:"type"`
+		Description string `json:"description"`
+		Pattern     string `json:"pattern"`
+		Default     string `json:"default"`
+	} `json:"config"`
+	OwnSecrets   map[string]string `json:"own-secrets"`
+	SecretsOwner string            `json:"secrets-owner"`
+	Resources    []map[string]any  `json:"resources"`
+	Build        struct {
+		Artifacts []artifact `json:"artifacts"`
+	} `json:"build"`
+}
+
+func load(t *testing.T) (manifest, map[string]json.RawMessage) {
+	t.Helper()
+	raw, err := os.ReadFile("module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&m); err != nil {
+		t.Fatalf("the controller's reader refuses a key this manifest has: %v", err)
+	}
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &top); err != nil {
+		t.Fatal(err)
+	}
+	return m, top
+}
+
+func sorted(s []string) []string {
+	s = slices.Clone(s)
+	slices.Sort(s)
+	return s
+}
+
+func TestManifestDeclarations(t *testing.T) { // 1607/AC1
+	m, top := load(t)
+	if m.Module != "mesh-delivery-builder" {
+		t.Errorf("module = %q", m.Module)
+	}
+	if want := []state{{Name: "builds", History: 5}}; !reflect.DeepEqual(m.State, want) { // delivery.BuilderBuildsHistory
+		t.Errorf("state = %+v, want %+v", m.State, want)
+	}
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-image.steps", "mesh-build-node.steps", "mesh-build-node.toolchains",
+		"mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		t.Errorf("reads = %v, want %v", m.Reads, want)
+	}
+	if want := []string{"mesh-build-go.build_go_build", "mesh-build-go.build_go_fetch", "mesh-build-image.build_image_build", "mesh-build-image.build_image_copy", "mesh-build-image.build_image_fetch", "mesh-build-node.build_node_build", "mesh-build-node.build_node_fetch"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
+		t.Errorf("invokes = %v, want only the build modules' fetch and build (go, image, node) and the image module's copy (ADR 0498 clause 4)", m.Invokes)
+	}
+	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it starts.
+	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+		t.Errorf("consumes = %v, want %v", m.Consumes, want)
+	}
+	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
+		t.Errorf("own-secrets = %v, want exactly broker", m.OwnSecrets)
+	}
+	if m.SecretsOwner != "mesh-delivery-builder" {
+		t.Errorf("secrets-owner = %q", m.SecretsOwner)
+	}
+	for _, k := range []string{"streams", "logs", "emits", "claims", "provides", "requires", "uses", "defines-seats", "tools", "seat", "seats", "bus"} {
+		if _, ok := top[k]; ok {
+			t.Errorf("the manifest declares %q: the builder has none", k)
+		}
+	}
+}
+
+func TestManifestProcess(t *testing.T) { // 1607/AC1
+	m, _ := load(t)
+	var procs []map[string]any
+	for _, r := range m.Resources {
+		if r["type"] == "process" {
+			procs = append(procs, r)
+		}
+		if r["type"] == "tool" || r["type"] == "seat" {
+			t.Errorf("resource %v: the builder serves no tool and holds no seat", r)
+		}
+	}
+	if len(procs) != 1 {
+		t.Fatalf("%d process resources, want one", len(procs))
+	}
+	p := procs[0]
+	if p["artifact"] != "program" || !reflect.DeepEqual(p["run"], []any{"./mesh-delivery-builder"}) {
+		t.Errorf("process = %v", p)
+	}
+	env, _ := p["env"].(map[string]any)
+	// The build capacity of each node is the module's setting `capacity` (issue 1661, ADR 0478 clause 3), laid into the
+	// settings file the program reads; empty is one step at a time everywhere. The environment holds no capacity.
+	if len(env) != 2 || env["MESH_BROKER_FILE"] != "${dir:state}/broker" || env["MESH_BUILDER_SETTINGS"] != "${dir:state}/settings.json" {
+		t.Errorf("env = %v", p["env"])
+	}
+	if !reflect.DeepEqual(p["restart-on"], []any{"settings"}) {
+		t.Errorf("restart-on = %v, want the settings file, so a changed capacity reaches the running program", p["restart-on"])
+	}
+	c, ok := m.Config["capacity"]
+	if !ok || len(m.Config) != 1 || c.Type != "string" || c.Default != "shanks=3,ace=2,g14=0,novox=0" || c.Description == "" {
+		t.Errorf("config = %+v, want one string setting, capacity, shanks=3,ace=2,g14=0,novox=0 to start", m.Config)
+	}
+	var settings map[string]any
+	for _, r := range m.Resources {
+		if r["id"] == "settings" {
+			settings = r
+		}
+	}
+	if settings == nil || settings["type"] != "file" || settings["merge"] != "json" || !reflect.DeepEqual(settings["takes-config"], []any{"capacity"}) || settings["path"] != "${dir:state}/settings.json" {
+		t.Errorf("settings resource = %v", settings)
+	}
+	if raw, err := os.ReadFile("files/settings.json"); err != nil || !strings.Contains(string(raw), `"capacity": "shanks=3,ace=2,g14=0,novox=0"`) {
+		t.Errorf("files/settings.json = %q, %v, want the setting's starting value", raw, err)
+	}
+	if _, bus := p["bus"]; bus {
+		t.Errorf("the process declares a bus: it runs on its own broker credential")
+	}
+	if len(m.Build.Artifacts) != 2 || m.Build.Artifacts[1].Name != "files" || m.Build.Artifacts[1].Kind != "archive" || m.Build.Artifacts[1].From != "files" {
+		t.Fatalf("artifacts = %+v, want the program and the files", m.Build.Artifacts)
+	}
+	a := m.Build.Artifacts[0]
+	if st, err := os.Stat(a.From); err != nil || !st.IsDir() || a.Binary != "mesh-delivery-builder" || !strings.HasSuffix(a.From, a.Binary) || a.Kind != "bundle" || a.Language != "go" {
+		t.Errorf("artifact = %+v", a)
+	}
+}
+
+func TestServesNoRequestSubjectAndHoldsNoTicker(t *testing.T) { // 1607/AC6 (ADR 0437 §8: no timer, a wait is a context's bound)
+	forbidden := []string{"Subscribe(", "QueueSubscribe", "ChanSubscribe", "time.NewTicker", "time.Tick", "time.NewTimer", "time.AfterFunc", "time.After(", "time.Sleep"}
+	var files int
+	for _, root := range []string{"cmd", "internal"} {
+		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+				return err
+			}
+			files++
+			src, err := os.ReadFile(path)
+			if err != nil {
+				return err
+			}
+			for _, f := range forbidden {
+				if strings.Contains(string(src), f) {
+					t.Errorf("%s holds %s: the builder serves no request subject and holds no timer", path, f)
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if files < 1 {
+		t.Fatalf("read %d source files, want the program's", files)
+	}
+}

modules/mesh-delivery-builder/module.json

@@ -0,0 +1,110 @@
+{
+  "module": "mesh-delivery-builder",
+  "version": "1",
+  "slug": "builder",
+  "consumes": [
+    "mesh-build-go.toolchain.reported",
+    "mesh-build-node.toolchain.reported"
+  ],
+  "state": [
+    { "name": "builds", "history": 5 }
+  ],
+  "reads": [
+    "mesh-build-go.steps",
+    "mesh-build-go.toolchains",
+    "mesh-build-image.steps",
+    "mesh-build-node.steps",
+    "mesh-build-node.toolchains",
+    "mesh-delivery-indexer.candidates",
+    "mesh-delivery-indexer.manifests",
+    "mesh-delivery-indexer.modules",
+    "mesh-delivery-watchman.presence",
+    "node-engine.have"
+  ],
+  "invokes": [
+    "mesh-build-go.build_go_build",
+    "mesh-build-go.build_go_fetch",
+    "mesh-build-image.build_image_build",
+    "mesh-build-image.build_image_copy",
+    "mesh-build-image.build_image_fetch",
+    "mesh-build-node.build_node_build",
+    "mesh-build-node.build_node_fetch"
+  ],
+  "config": {
+    "capacity": {
+      "type": "string",
+      "description": "How many build steps the builder runs at once on each node, as node=steps pairs separated by commas, such as shanks=3,ace=2 (ADR 0478 clause 3); a node set to 0 never builds, a node not named runs one at a time, and empty is one everywhere. The builder builds on shanks and ace only (the operator, 2026-10-21).",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": "shanks=3,ace=2,g14=0,novox=0"
+    }
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-delivery-builder",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-delivery-builder",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-delivery-builder"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-delivery-builder",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "mesh-delivery-builder",
+      "takes-config": ["capacity"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
+    {
+      "id": "builder",
+      "type": "process",
+      "name": "mesh-delivery-builder",
+      "artifact": "program",
+      "run": [
+        "./mesh-delivery-builder"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "${dir:state}/broker",
+        "MESH_BUILDER_SETTINGS": "${dir:state}/settings.json"
+      },
+      "restart-on": [
+        "settings"
+      ],
+      "user": "mesh-delivery-builder",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "program",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-delivery-builder",
+        "binary": "mesh-delivery-builder"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go

@@ -0,0 +1,71 @@
+// Command mesh-delivery-checker-tools serves the checker's read tools (novox/hq ADR 0484 clause 13, issue 1686): the runtime
+// launches it for a call, it reads the checker's verdicts and kept states and the indexer's candidates through the checker's
+// state and reads, and writes nothing. The checker is the other program: it serves no tool (ADR 0437 §4).
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+func read(s stdio.KeptState) check.StateRead {
+	return check.StateRead{Keys: s.Keys, Get: func(key string) (json.RawMessage, error) {
+		e, err := s.Get(key)
+		if err != nil || e == nil {
+			return nil, err
+		}
+		return e.Value, nil
+	}}
+}
+
+// Tools are the read tools over the checker's states.
+func Tools(r check.Reader) []stdio.Tool {
+	return []stdio.Tool{
+		{Name: check.VerdictsReadTool,
+			Description: "The verdicts the checker holds, each as stored under verdicts.<group>.<heads>: its state, what failed first, the tests run, kept and skipped per level, the time of each part, the trunk heads it judged against and the composition, with the full " +
+				"report of the status each pull request carries (the line the forge shows is cut at 140 characters, this is not). With a group, that group's only. Read-only.",
+			Input: map[string]any{"type": "object", "properties": map[string]any{
+				"group": map[string]any{"type": "string", "description": "the delivery group's branch name"}}},
+			Run: func(args map[string]any) (any, error) {
+				group, _ := args["group"].(string)
+				vs, err := r.Verdicts(group)
+				return map[string]any{"verdicts": vs}, err
+			}},
+		{Name: check.PullReadTool,
+			Description: "The verdict that judges one pull request and the full report of its status mesh/check; for an hq pull request, that hq is judged by " +
+				"merge-check.sh until issue 1296. Read-only.",
+			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
+				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
+				"number":     map[string]any{"type": "integer", "description": "the pull request's number"}}},
+			Run: func(args map[string]any) (any, error) {
+				repository, _ := args["repository"].(string)
+				n, _ := args["number"].(float64)
+				return r.Pull(repository, int(n))
+			}},
+		{Name: check.KeptReadTool,
+			Description: "The kept verdicts of passing packages, each as stored under kept.<level>.<digest>: the package, its tests, the time they took, the toolchain " +
+				"and when it was kept. With a level, that level's; with a level and a digest, that one. Read-only.",
+			Input: map[string]any{"type": "object", "properties": map[string]any{
+				"level":  map[string]any{"type": "string", "enum": []string{"unit", "integration"}, "description": "the level"},
+				"digest": map[string]any{"type": "string", "description": "the package's digest, with a level"}}},
+			Run: func(args map[string]any) (any, error) {
+				level, _ := args["level"].(string)
+				digest, _ := args["digest"].(string)
+				kept, err := r.Kept(level, digest)
+				return map[string]any{"kept": kept}, err
+			}},
+	}
+}
+
+func main() {
+	r := check.Reader{VerdictState: read(stdio.State("verdicts")), KeptState: read(stdio.State("kept")), CandidateState: read(stdio.State("mesh-delivery-indexer.candidates"))}
+	if err := stdio.Serve("", Tools(r)); err != nil {
+		fmt.Fprintf(os.Stderr, "[mesh-delivery-checker-tools] %v\n", err)
+		os.Exit(1)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go

@@ -0,0 +1,27 @@
+package main
+
+import (
+	"testing"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+func TestTheToolsServedAreTheThreeReadTools(t *testing.T) {
+	var names []string
+	for _, tl := range Tools(check.Reader{}) {
+		names = append(names, tl.Name)
+		if tl.Description == "" || tl.Run == nil {
+			t.Errorf("%s has no description or no run", tl.Name)
+		}
+	}
+	want := []string{check.VerdictsReadTool, check.PullReadTool, check.KeptReadTool}
+	if len(names) != 3 || names[0] != want[0] || names[1] != want[1] || names[2] != want[2] {
+		t.Errorf("tools = %v, want %v", names, want)
+	}
+	// With nothing to read from a tool says so and changes nothing.
+	for _, tl := range Tools(check.Reader{}) {
+		if _, err := tl.Run(map[string]any{"repository": "novox/x", "number": float64(1)}); err == nil {
+			t.Errorf("%s answered with no state to read", tl.Name)
+		}
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go

@@ -0,0 +1,159 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// bucketOpener is the part of the bus the watches use.
+type bucketOpener interface {
+	KeyValue(ctx context.Context, bucket string) (jetstream.KeyValue, error)
+}
+
+// kvStore is the builds bucket as the builder's store: create and compare-and-set.
+type kvStore struct{ kv jetstream.KeyValue }
+
+func conflict(err error) error {
+	if errors.Is(err, jetstream.ErrKeyExists) || errors.Is(err, jetstream.ErrKeyRevisionMismatch) {
+		return check.ErrConflict
+	}
+	return err
+}
+
+func (s kvStore) Get(ctx context.Context, key string) ([]byte, uint64, bool, error) {
+	e, err := s.kv.Get(ctx, key)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, 0, false, nil
+	}
+	if err != nil {
+		return nil, 0, false, err
+	}
+	return e.Value(), e.Revision(), true, nil
+}
+
+func (s kvStore) Create(ctx context.Context, key string, value []byte) (uint64, error) {
+	rev, err := s.kv.Create(ctx, key, value)
+	return rev, conflict(err)
+}
+
+func (s kvStore) Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error) {
+	rev, err := s.kv.Update(ctx, key, value, revision)
+	return rev, conflict(err)
+}
+
+func (s kvStore) Keys(ctx context.Context) ([]string, error) {
+	keys, err := s.kv.Keys(ctx)
+	if errors.Is(err, jetstream.ErrNoKeysFound) {
+		return nil, nil
+	}
+	return keys, err
+}
+
+func opOf(e jetstream.KeyValueEntry) bool { return e.Operation() == jetstream.KeyValuePut }
+
+// settle reads the entries a watcher holds now, up to its mark of the last values, and returns the watcher for the
+// changes that follow.
+func settle(ctx context.Context, kv jetstream.KeyValue, each func(jetstream.KeyValueEntry)) (jetstream.KeyWatcher, error) {
+	w, err := kv.WatchAll(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			w.Stop()
+			return nil, ctx.Err()
+		case e, ok := <-w.Updates():
+			if !ok {
+				return nil, errors.New("the watch ended")
+			}
+			if e == nil {
+				return w, nil
+			}
+			each(e)
+		}
+	}
+}
+
+// follow hands each change of a watcher to each until ctx ends; a watch that ends is an error, and the process manager
+// starts the program again.
+func follow(ctx context.Context, w jetstream.KeyWatcher, each func(jetstream.KeyValueEntry)) error {
+	defer w.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case e, ok := <-w.Updates():
+			if !ok {
+				return errors.New("a watch ended")
+			}
+			if e != nil {
+				each(e)
+			}
+		}
+	}
+}
+
+// stepsWaiter waits for a build module's step by watching its key in the module's steps bucket (ADR 0469 clause 2): the
+// watch hands over the value the key holds now, so a step that ended before the watch began is read at once, and every
+// change after. No timer: the caller bounds the wait with its context.
+type stepsWaiter struct{ js bucketOpener }
+
+func (w stepsWaiter) Wait(ctx context.Context, module, key string) (delivery.Step, error) {
+	kv, err := w.js.KeyValue(ctx, delivery.StepsBucket(module))
+	if err != nil {
+		return delivery.Step{}, fmt.Errorf("the bucket %s: %w", delivery.StepsBucket(module), err)
+	}
+	watch, err := kv.Watch(ctx, key)
+	if err != nil {
+		return delivery.Step{}, err
+	}
+	defer watch.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return delivery.Step{}, ctx.Err()
+		case e, ok := <-watch.Updates():
+			if !ok {
+				return delivery.Step{}, errors.New("the watch of the step ended")
+			}
+			if e == nil || !opOf(e) {
+				continue
+			}
+			step, err := delivery.DecodeStep(e.Value())
+			if err != nil {
+				return delivery.Step{}, fmt.Errorf("the step %s is not a step: %w", key, err)
+			}
+			if step.State != delivery.StepRunning {
+				return step, nil
+			}
+		}
+	}
+}
+
+// manifestReader reads manifests.<digest> of the indexer and parses the manifest it holds.
+type manifestReader struct{ kv jetstream.KeyValue }
+
+func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.Manifest, error) {
+	key, err := delivery.ManifestsKey(digest)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	e, err := m.kv.Get(ctx, key)
+	if err != nil {
+		return catalogue.Manifest{}, fmt.Errorf("manifests.%s: %w", key, err)
+	}
+	kept, err := delivery.DecodeManifest(e.Value())
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	return catalogue.ParseManifest([]byte(kept.JSON))
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge.go

@@ -0,0 +1,91 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// The forge's tools the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
+// of a file at a ref, and gitea_compare answers {total_commits, commits}, what head holds that base does not. The checker
+// writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
+const (
+	getFileTool = "gitea.gitea_get_file"
+	compareTool = "gitea.gitea_compare"
+	commitsTool = "gitea.gitea_commits"
+)
+
+// notFoundStatus is the 404 of the forge's error, `Gitea API <path>: <status> <body>`.
+var notFoundStatus = regexp.MustCompile(`: 404( |$)`)
+
+// forgeReads reads the forge through call (mesh-sdk process.Conn.Call as the checker's own account).
+type forgeReads struct {
+	call func(key string, body any) (json.RawMessage, error)
+}
+
+func ownerRepo(repository string) (string, string) {
+	owner, repo, _ := strings.Cut(repository, "/")
+	return owner, repo
+}
+
+// File is the text of a file of a repository at a ref.
+func (f forgeReads) File(_ context.Context, repository, path, ref string) (string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.call(getFileTool, map[string]string{"owner": owner, "repo": repo, "path": path, "ref": ref})
+	if err != nil {
+		if notFoundStatus.MatchString(err.Error()) {
+			// The forge answers 404 for a file the ref does not hold (issue 1845). The status is matched in its own place,
+			// after the path's colon: the path carries a sha that may hold the digits 404.
+			return "", fmt.Errorf("%w: %v", check.ErrNotFound, err)
+		}
+		return "", err
+	}
+	var a struct {
+		File *struct {
+			Content *string `json:"content"`
+		} `json:"file"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.File == nil || a.File.Content == nil {
+		return "", fmt.Errorf("the answer of %s is not {file: {content}}: %v", getFileTool, err)
+	}
+	return *a.File.Content, nil
+}
+
+// OnTrunk says whether the commit is already on the repository's main: main holds it when the commit holds nothing main does
+// not.
+func (f forgeReads) OnTrunk(_ context.Context, repository, commit string) (bool, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.call(compareTool, map[string]string{"owner": owner, "repo": repo, "base": "main", "head": commit})
+	if err != nil {
+		return false, err
+	}
+	var a struct {
+		Total *int `json:"total_commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || a.Total == nil {
+		return false, fmt.Errorf("the answer of %s is not {total_commits}: %v", compareTool, err)
+	}
+	return *a.Total == 0, nil
+}
+
+// FullSHA is the whole sha of a commit named by its first digits: the newest commit of the history at that ref.
+func (f forgeReads) FullSHA(_ context.Context, repository, commit string) (string, error) {
+	owner, repo := ownerRepo(repository)
+	raw, err := f.call(commitsTool, map[string]any{"owner": owner, "repo": repo, "ref": commit, "limit": 1})
+	if err != nil {
+		return "", err
+	}
+	var a struct {
+		Commits []struct {
+			SHA string `json:"sha"`
+		} `json:"commits"`
+	}
+	if err := json.Unmarshal(raw, &a); err != nil || len(a.Commits) == 0 || len(a.Commits[0].SHA) != 40 || !strings.HasPrefix(a.Commits[0].SHA, commit) {
+		return "", fmt.Errorf("the answer of %s for %s is not a commit that starts with it: %v", commitsTool, commit, err)
+	}
+	return a.Commits[0].SHA, nil
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// capturedAnswer is what the forge's tool answered (internal/check/testdata/captured/README).
+func capturedAnswer(t *testing.T, name string) json.RawMessage {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "internal", "check", "testdata", "captured", name+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+func TestTheForgeReadsParseWhatTheForgeAnswered(t *testing.T) { // 1624/AC4
+	var asked []string
+	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
+		b, _ := json.Marshal(body)
+		asked = append(asked, key+" "+string(b))
+		switch {
+		case key == getFileTool:
+			return capturedAnswer(t, "forge-get-file-go-mod"), nil
+		case strings.Contains(string(b), "cb54756c3865"):
+			return capturedAnswer(t, "forge-compare-trunk"), nil
+		}
+		return capturedAnswer(t, "forge-compare-branch"), nil
+	}}
+	text, err := f.File(context.Background(), "novox/mesh-delivery", "modules/mesh-delivery-builder/go.mod", "main")
+	if err != nil || !strings.Contains(text, "git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865") {
+		t.Errorf("file = %q, %v", text, err)
+	}
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || !on {
+		t.Errorf("a commit on the trunk: %v, %v", on, err)
+	}
+	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "9aaa5c80ac5c"); err != nil || on {
+		t.Errorf("a commit of the branch: %v, %v", on, err)
+	}
+	if len(asked) != 3 || !strings.Contains(asked[0], `"owner":"novox"`) || !strings.Contains(asked[2], `"base":"main"`) {
+		t.Errorf("asked %v", asked)
+	}
+	bad := forgeReads{call: func(string, any) (json.RawMessage, error) { return json.RawMessage(`{}`), nil }}
+	if _, err := bad.File(context.Background(), "novox/x", "go.mod", "main"); err == nil {
+		t.Error("an answer with no file was taken")
+	}
+	if _, err := bad.OnTrunk(context.Background(), "novox/x", "abc"); err == nil {
+		t.Error("an answer with no total was taken")
+	}
+}
+
+func TestTheForgeNamesTheWholeShaOfAShortCommit(t *testing.T) { // review D2
+	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
+		if key != commitsTool {
+			t.Errorf("called %s", key)
+		}
+		return capturedAnswer(t, "forge-commits"), nil
+	}}
+	if sha, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || sha != "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1" {
+		t.Errorf("sha = %q, %v", sha, err)
+	}
+	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "deadbeefdead"); err == nil {
+		t.Error("a commit that does not start with the pin was taken")
+	}
+}
+
+func TestAFileTheRefDoesNotHoldIsNotFoundAndOtherFailuresAreNot(t *testing.T) { // 1845/AC1, AC4
+	f := forgeReads{call: func(string, any) (json.RawMessage, error) {
+		return nil, errors.New("Gitea API contents/checks/particulars/go.mod?ref=98ca97fc: 404 object does not exist")
+	}}
+	if _, err := f.File(context.Background(), "novox/mesh-catalog", "checks/particulars/go.mod", "98ca97fc"); !errors.Is(err, check.ErrNotFound) {
+		t.Errorf("a 404 is %v, want ErrNotFound", err)
+	}
+	f = forgeReads{call: func(string, any) (json.RawMessage, error) {
+		return nil, errors.New("Gitea API contents/go.mod?ref=1111111111111111111111111111111404abcde: 500 internal error")
+	}}
+	if _, err := f.File(context.Background(), "novox/mesh-catalog", "go.mod", "main"); err == nil || errors.Is(err, check.ErrNotFound) {
+		t.Errorf("a 500 is %v, want a failure that is not ErrNotFound", err)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/heard.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"github.com/nats-io/nats.go"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// heardCaller is the build runner's caller with the calls that reached nobody marked: no responders, or none answering within
+// the call's bound. The step never began there, so the check may give it to another node (issue 1820). A call that was
+// answered, with a failure or not, is left as it is.
+type heardCaller struct {
+	call func(node, key string, body any) (json.RawMessage, error)
+}
+
+func (h heardCaller) CallOn(node, key string, body any) (json.RawMessage, error) {
+	raw, err := h.call(node, key, body)
+	if errors.Is(err, nats.ErrNoResponders) || errors.Is(err, nats.ErrTimeout) || errors.Is(err, context.DeadlineExceeded) {
+		return nil, &check.Unheard{Err: err}
+	}
+	return raw, err
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/heard_test.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+func TestACallThatReachedNobodyIsMarkedAndAnAnsweredFailureIsNot(t *testing.T) { // 1820/AC6
+	for _, err := range []error{nats.ErrNoResponders, nats.ErrTimeout, context.DeadlineExceeded} {
+		h := heardCaller{call: func(string, string, any) (json.RawMessage, error) { return nil, fmt.Errorf("call: %w", err) }}
+		_, got := h.CallOn("g14", "m.t", nil)
+		var u *check.Unheard
+		if !errors.As(got, &u) {
+			t.Errorf("%v: %v is not marked unheard", err, got)
+		}
+	}
+	h := heardCaller{call: func(string, string, any) (json.RawMessage, error) { return nil, errors.New("the module refused") }}
+	_, got := h.CallOn("g14", "m.t", nil)
+	var u *check.Unheard
+	if errors.As(got, &u) {
+		t.Errorf("an answered failure %v is marked unheard", got)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/hold.go

@@ -0,0 +1,101 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"sync"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// holdWatch holds the checker back while a delivery builds (ADR 0484 clause 12): whether one does is the list of the keys of
+// the controller's bucket of the delivery plans in their build phase, read each time a check is about to start. Its keys age
+// out (a time to live, and no delete marker), which a watch never hears, so a watch cannot decide it (mesh-controller
+// internal/link/holds.go lists the keys too); the watch is only the wake-up, for a plan that ended by a delete. The bucket
+// is read as empty where it is absent (issue 1652 makes it) or cannot be read, saying so once. It may come into being after
+// the checker started and the checker holds no timer (ADR 0437 §8), so each time a check is about to start and the bucket is
+// not known yet, the checker looks for it.
+type holdWatch struct {
+	ctx     context.Context
+	js      bucketOpener
+	keys    func(ctx context.Context) ([]string, error)
+	changed func(ctx context.Context) // a plan key changed: the checks that waited may start
+	logger  *log.Logger
+	errs    chan error
+	mu      sync.Mutex
+	watched bool
+	said    bool
+}
+
+func newHoldWatch(ctx context.Context, js bucketOpener, changed func(context.Context), logger *log.Logger) *holdWatch {
+	return &holdWatch{ctx: ctx, js: js, changed: changed, logger: logger, errs: make(chan error, 1)}
+}
+
+// Held says whether a delivery builds now.
+func (w *holdWatch) Held() bool {
+	w.ensure()
+	w.mu.Lock()
+	keys := w.keys
+	w.mu.Unlock()
+	if keys == nil {
+		return false
+	}
+	list, err := keys(w.ctx)
+	if err != nil {
+		w.say("the keys of %s cannot be listed, so it is read as empty: %v", check.PlansBuildingBucket, err)
+		return false
+	}
+	return len(list) > 0
+}
+
+func (w *holdWatch) say(format string, args ...any) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if !w.said {
+		w.said = true
+		w.logger.Printf(format, args...)
+	}
+}
+
+// ensure finds the bucket if it is not known and exists, and starts the wake-up watch.
+func (w *holdWatch) ensure() {
+	w.mu.Lock()
+	if w.watched || w.js == nil {
+		w.mu.Unlock()
+		return
+	}
+	w.mu.Unlock()
+	kv, err := w.js.KeyValue(w.ctx, check.PlansBuildingBucket)
+	switch {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		w.say("the bucket %s does not exist yet: it is read as empty, so no check is held back", check.PlansBuildingBucket)
+		return
+	case err != nil:
+		w.say("the bucket %s cannot be read, so it is read as empty: %v", check.PlansBuildingBucket, err)
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.watched {
+		return
+	}
+	w.watched, w.said = true, false
+	w.keys = func(ctx context.Context) ([]string, error) {
+		list, err := kv.Keys(ctx)
+		if errors.Is(err, jetstream.ErrNoKeysFound) {
+			return nil, nil
+		}
+		return list, err
+	}
+	go func() {
+		wake, err := kv.WatchAll(w.ctx)
+		if err != nil {
+			w.errs <- err
+			return
+		}
+		w.errs <- follow(w.ctx, wake, func(jetstream.KeyValueEntry) { w.changed(w.ctx) })
+	}()
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/hold_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"io"
+	"log"
+	"testing"
+)
+
+// The controller's plans-building keys age out of the bucket (a time to live, no delete marker), which a watch never hears:
+// whether a delivery builds is the list of the keys now, and the watch is only a wake-up (review D3).
+func TestADeliveryHoldsWhileItsKeyIsListedAndNotWhenItAgedOutWithNoEvent(t *testing.T) {
+	listed := []string{"plan-1"}
+	w := &holdWatch{watched: true, logger: log.New(io.Discard, "", 0), keys: func(context.Context) ([]string, error) { return listed, nil }}
+	if !w.Held() {
+		t.Fatal("a plan key is listed and nothing holds")
+	}
+	listed = nil // the key aged out: no delete reached the watch
+	if w.Held() {
+		t.Error("the key is gone from the bucket and the checker is still held")
+	}
+}
+
+func TestABucketThatCannotBeListedIsReadAsEmpty(t *testing.T) {
+	w := &holdWatch{watched: true, logger: log.New(io.Discard, "", 0), keys: func(context.Context) ([]string, error) { return []string{"plan-1"}, errors.New("the bus is down") }}
+	if w.Held() {
+		t.Error("an unreadable bucket held the checker")
+	}
+	var absent holdWatch
+	absent.logger = log.New(io.Discard, "", 0)
+	if absent.Held() {
+		t.Error("a watch with no bucket held the checker")
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go

@@ -0,0 +1,592 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/nats-io/nats-server/v2/server"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// busConf is the shape of the composed accounts file (mesh-controller internal/broker): one account with JetStream, the
+// controller's user and the checker's own principal <node>.<module>. It carries no per-principal permissions: the grants
+// the controller composes from the manifest's state and reads (only the checker writes its buckets) are the controller's,
+// and are proved by its own module check, not here.
+const busConf = `
+listen: 127.0.0.1:-1
+jetstream { store_dir: %q }
+accounts {
+  MESH {
+    jetstream: enabled
+    users = [
+      { user: "ctl", password: "pw" }
+      { user: "n1.mesh-delivery-checker", password: "pw" }
+    ]
+  }
+}
+`
+
+const (
+	repo   = "novox/mesh-delivery"
+	head1  = "1111111111111111111111111111111111111111"
+	head2  = "2222222222222222222222222222222222222222"
+	trunk  = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	merged = "fedcba9876543210fedcba9876543210fedcba98" // the merge commit of the captured fetch answer
+	digU   = "aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11"
+	digI   = "bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22"
+)
+
+var captured = filepath.Join("..", "..", "internal", "check", "testdata", "captured")
+
+func readCaptured(t *testing.T, name string) map[string]any {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(captured, name+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var v map[string]any
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+// fakeBuildModules serve the tools of mesh-build-go and mesh-build-node as the real ones do (ADR 0469 clause 2): a call on
+// mesh.mod.<module>.call.<tool>.<node>.<caller> answers at once with the step and its key, and the step's end is written to
+// the key <node>.<id> of the module's steps bucket. What the steps end with are the results the build modules' own code
+// marshalled (internal/check/testdata/captured, README).
+type fakeBuildModules struct {
+	js       jetstream.JetStream
+	ctx      context.Context
+	n        atomic.Int64
+	conflict atomic.Bool
+	mu       sync.Mutex
+	calls    map[string]int // by `<module>.<tool>`
+	testTool *testing.T
+}
+
+func (f *fakeBuildModules) count(tool string) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.calls[tool]
+}
+
+func (f *fakeBuildModules) result(t *testing.T, tool string, args map[string]any) json.RawMessage {
+	level, _ := args["level"].(string)
+	var v any
+	switch {
+	case strings.HasSuffix(tool, "_fetch"):
+		name := "go-fetch-clean"
+		if f.conflict.Load() {
+			name = "go-fetch-conflict"
+		}
+		fetched := readCaptured(t, name)
+		fetched["commit"], fetched["base"] = args["commit"], args["base"]
+		v = fetched
+	case strings.HasSuffix(tool, "_digest"):
+		d := map[string]string{"unit": digU, "integration": digI}[level]
+		v = map[string]any{"level": level, "packages": map[string]string{"fixture/slow": d}}
+	case strings.HasSuffix(tool, "_test"):
+		r := readCaptured(t, "go-test-slow")
+		r["level"] = level
+		v = r
+	}
+	data, _ := json.Marshal(v)
+	return data
+}
+
+func (f *fakeBuildModules) serve(t *testing.T, nc *nats.Conn, module string) {
+	steps, err := f.js.CreateKeyValue(f.ctx, jetstream.KeyValueConfig{Bucket: delivery.StepsBucket(module), History: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	sub, err := nc.Subscribe("mesh.mod."+module+".call.>", func(m *nats.Msg) {
+		tokens := strings.Split(m.Subject, ".") // mesh mod <module> call <tool> <node> <caller>
+		tool, node := tokens[4], tokens[5]
+		f.mu.Lock()
+		f.calls[module+"."+tool]++
+		f.mu.Unlock()
+		var args map[string]any
+		_ = json.Unmarshal(m.Data, &args)
+		id := fmt.Sprintf("s%d", f.n.Add(1))
+		key, _ := delivery.StepKey(node, id)
+		put := func(s delivery.Step) {
+			data, err := delivery.EncodeStep(s)
+			if err == nil {
+				_, err = steps.Put(f.ctx, key, data)
+			}
+			if err != nil {
+				t.Errorf("writing step %s: %v", key, err)
+			}
+		}
+		step := delivery.Step{ID: id, Tool: tool, Node: node, State: delivery.StepRunning, Started: time.Now().UTC()}
+		put(step)
+		answer, _ := json.Marshal(map[string]any{"result": map[string]any{"step": id, "key": key, "state": "running"}, "error": "", "node": node})
+		_ = m.Respond(answer)
+		go func() {
+			time.Sleep(20 * time.Millisecond)
+			step.Ended = time.Now().UTC()
+			step.State, step.Result = delivery.StepPassed, f.result(t, tool, args)
+			put(step)
+		}()
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+}
+
+// serveForge answers the forge's two reads as its tools do, with the answers the forge gave (internal/check/testdata/captured):
+// the go.mod of the captured file, whose mesh-sdk pin is cb54756c3865, and gitea_compare for the pin: on the trunk, unless the
+// pin is the one the test set as stale.
+func (b *bed) serveForge(t *testing.T, nc *nats.Conn) {
+	reply := func(m *nats.Msg, name string) {
+		var result map[string]any
+		_ = json.Unmarshal(mustRead(t, name), &result)
+		answer, _ := json.Marshal(map[string]any{"result": result, "error": "", "node": "n0"})
+		_ = m.Respond(answer)
+	}
+	for _, tool := range []string{"gitea_get_file", "gitea_compare"} {
+		tool := tool
+		sub, err := nc.Subscribe("mesh.mod.gitea.tool."+tool, func(m *nats.Msg) {
+			var a map[string]string
+			_ = json.Unmarshal(m.Data, &a)
+			switch {
+			case tool == "gitea_get_file" && b.stalePin.Load():
+				content := strings.Replace(string(mustRead(t, "forge-get-file-go-mod")), "cb54756c3865", "9aaa5c80ac5c", 1)
+				var result map[string]any
+				_ = json.Unmarshal([]byte(content), &result)
+				answer, _ := json.Marshal(map[string]any{"result": result, "error": "", "node": "n0"})
+				_ = m.Respond(answer)
+			case tool == "gitea_get_file":
+				reply(m, "forge-get-file-go-mod")
+			case strings.HasPrefix(a["head"], "9aaa5c80ac5c"):
+				reply(m, "forge-compare-branch")
+			default:
+				reply(m, "forge-compare-trunk")
+			}
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = sub.Unsubscribe() })
+	}
+}
+
+func mustRead(t *testing.T, name string) []byte {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(captured, name+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+type bed struct {
+	stalePin atomic.Bool
+	ctx      context.Context
+	js       jetstream.JetStream
+	buckets  map[string]jetstream.KeyValue
+	tools    map[string]jetstream.KeyValue
+	fake     *fakeBuildModules
+	srvURL   string
+	announce []string
+	mu       sync.Mutex
+}
+
+// startBed starts the bus, the buckets the controller makes from the checker's and the other parts' manifests, the build
+// modules' streams and the checker's durable consumers on them, one node's toolchains, the gate's source naming the trunk, and
+// the fake build modules. It runs no checker.
+func startBed(t *testing.T) *bed {
+	dir, err := os.MkdirTemp(os.Getenv("TMPDIR"), "c")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	conf := filepath.Join(dir, "bus.conf")
+	if err := os.WriteFile(conf, []byte(fmt.Sprintf(busConf, filepath.Join(dir, "js"))), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	opts, err := server.ProcessConfigFile(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	opts.NoLog, opts.NoSigs = true, true
+	srv, err := server.NewServer(opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	go srv.Start()
+	if !srv.ReadyForConnections(10 * time.Second) {
+		t.Fatal("the bus did not come up")
+	}
+	t.Cleanup(srv.Shutdown)
+	ctl, err := nats.Connect(srv.ClientURL(), nats.UserInfo("ctl", "pw"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(ctl.Close)
+	js, err := jetstream.New(ctl)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	t.Cleanup(cancel)
+	b := &bed{ctx: ctx, js: js, buckets: map[string]jetstream.KeyValue{}, tools: map[string]jetstream.KeyValue{}, srvURL: srv.ClientURL()}
+	for module, stream := range toolchainStreams {
+		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: stream, Subjects: []string{"mesh.stream." + module + ".event.toolchain.reported"}}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := js.CreateOrUpdateConsumer(ctx, stream, jetstream.ConsumerConfig{Durable: "n1_mesh-delivery-checker", AckPolicy: jetstream.AckExplicitPolicy}); err != nil {
+			t.Fatal(err)
+		}
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.ToolchainsBucket(module), History: 1})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.tools[module] = kv
+	}
+	// The checker's stream of events, which the indexer and the forge bridge hear.
+	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "CHECKS", Subjects: []string{"mesh.stream.mesh-delivery-checker.event.>"}}); err != nil {
+		t.Fatal(err)
+	}
+	for name, history := range map[string]int{delivery.CheckerVerdictsBucket: delivery.CheckerVerdictsHistory, delivery.CheckerKeptBucket: delivery.CheckerKeptHistory,
+		delivery.CheckerOwedBucket: delivery.CheckerOwedHistory, delivery.PreviewsBucket: delivery.PreviewsHistory, delivery.CandidatesBucket: delivery.CandidatesHistory,
+		delivery.ModulesBucket: delivery.ModulesHistory, delivery.ManifestsBucket: delivery.ManifestsHistory, delivery.SourceBucket: delivery.SourceHistory,
+		delivery.PresenceBucket: delivery.PresenceHistory, delivery.HaveBucket: delivery.HaveHistory} {
+		kv, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: uint8(history)})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.buckets[name] = kv
+	}
+	b.setOnline(t, "n1", true)
+	for _, module := range []string{"mesh-build-go", "mesh-build-node"} {
+		b.setHealth(t, "n1", module)
+	}
+	b.serveForge(t, ctl)
+	b.fake = &fakeBuildModules{js: js, ctx: ctx, calls: map[string]int{}}
+	b.fake.serve(t, ctl, "mesh-build-go")
+	b.fake.serve(t, ctl, "mesh-build-node")
+	b.report(t, "mesh-build-go", "n1", "go", "go1.27.1", "1")
+	b.report(t, "mesh-build-node", "n1", "typescript", "tsc5", "1")
+	b.setTrunk(t, map[string]string{repo: trunk})
+	return b
+}
+
+func (b *bed) setTrunk(t *testing.T, heads map[string]string) {
+	t.Helper()
+	data, err := delivery.EncodeSource(delivery.Source{Group: "g", Heads: heads})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.buckets[delivery.SourceBucket].Put(b.ctx, delivery.SourceMainKey, data); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (b *bed) setOnline(t *testing.T, node string, online bool) {
+	t.Helper()
+	data, _ := delivery.EncodePresence(delivery.Presence{Online: online})
+	if _, err := b.buckets[delivery.PresenceBucket].Put(b.ctx, node, data); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (b *bed) setHealth(t *testing.T, node, module string) {
+	t.Helper()
+	data, err := delivery.EncodeHave(delivery.Have{Phase: delivery.PhaseRunning, Health: delivery.HealthOK})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.HaveKey(node, module)
+	if _, err := b.buckets[delivery.HaveBucket].Put(b.ctx, key, data); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func (b *bed) report(t *testing.T, module, node, language, version, recipe string) {
+	t.Helper()
+	data, err := delivery.EncodeToolchain(delivery.Toolchain{Language: language, Version: version, Recipe: recipe, At: time.Now().UTC()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.ToolchainKey(node, language)
+	if _, err := b.tools[module].Put(b.ctx, key, data); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.js.Publish(b.ctx, "mesh.stream."+module+".event.toolchain.reported", []byte(`{}`)); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// candidate writes candidates.<group> as the indexer does (the SDK's EncodeCandidate is the indexer's own encoder).
+func (b *bed) candidate(t *testing.T, group string, pulls ...delivery.CandidatePull) string {
+	t.Helper()
+	heads := make([]delivery.Head, len(pulls))
+	for i, p := range pulls {
+		heads[i] = p.Head
+	}
+	hash, err := delivery.HeadsHash(heads)
+	if err != nil {
+		t.Fatal(err)
+	}
+	data, err := delivery.EncodeCandidate(delivery.Candidate{V: delivery.Version, Group: group, HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.CandidatesKey(group)
+	if _, err := b.buckets[delivery.CandidatesBucket].Put(b.ctx, key, data); err != nil {
+		t.Fatal(err)
+	}
+	vk, _ := delivery.CheckerVerdictKey(group, hash)
+	return vk
+}
+
+func pull(repository string, number int, head string) delivery.CandidatePull {
+	return delivery.CandidatePull{Head: delivery.Head{Repository: repository, Number: number, Head: head}, Modules: []string{}}
+}
+
+// start runs the program as the checker of a node.
+func (b *bed) start(t *testing.T, env map[string]string) {
+	t.Helper()
+	broker := filepath.Join(t.TempDir(), "broker")
+	cred, _ := json.Marshal(credential{URL: b.srvURL, Node: "n1", Module: "mesh-delivery-checker", User: "n1.mesh-delivery-checker", Password: "pw"})
+	if err := os.WriteFile(broker, cred, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	e := map[string]string{"MESH_BROKER_FILE": broker}
+	for k, v := range env {
+		e[k] = v
+	}
+	runCtx, stop := context.WithCancel(b.ctx)
+	done := make(chan error, 1)
+	go func() { done <- run(runCtx, func(k string) string { return e[k] }, io.Discard) }()
+	t.Cleanup(func() { stop(); <-done })
+}
+
+// verdict reads the verdict key until pred holds of it, within 20 s.
+func (b *bed) verdict(t *testing.T, key string, pred func(delivery.Verdict) bool) delivery.Verdict {
+	t.Helper()
+	var last delivery.Verdict
+	for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		e, err := b.buckets[delivery.CheckerVerdictsBucket].Get(b.ctx, key)
+		if err != nil {
+			continue
+		}
+		if last, err = delivery.DecodeVerdict(e.Value()); err == nil && pred(last) {
+			return last
+		}
+	}
+	t.Fatalf("verdicts.%s = %+v within 20 s", key, last)
+	return last
+}
+
+func ended(v delivery.Verdict) bool { return v.State != delivery.VerdictRunning }
+
+// owed reads the status the checker owes on a head.
+func (b *bed) owed(t *testing.T, number int, head, state string) delivery.Owed {
+	t.Helper()
+	key, err := delivery.CheckerOwedKey(repo, number, head)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var last delivery.Owed
+	for deadline := time.Now().Add(20 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		e, err := b.buckets[delivery.CheckerOwedBucket].Get(b.ctx, key)
+		if err != nil {
+			continue
+		}
+		if last, err = delivery.DecodeCheckerOwed(e.Value()); err == nil && last.State == state {
+			return last
+		}
+	}
+	t.Fatalf("owed.%s = %+v within 20 s, want the state %s", key, last, state)
+	return last
+}
+
+// TestCheckerJudgesACandidateAndOwesItsStatus: a candidate the indexer wrote, one pull request of mesh-delivery, is fetched
+// merged onto the trunk the gate names, digested and tested at both levels on the node, kept, previewed; the verdict passes
+// with the counts of both levels and the composition not run, and the status mesh/check is owed on the head as success.
+func TestCheckerJudgesACandidateAndOwesItsStatus(t *testing.T) { // N6/AC5, 1300/AC5, 1445/AC1
+	b := startBed(t)
+	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	b.start(t, nil)
+	v := b.verdict(t, key, ended)
+	if v.State != delivery.VerdictPass || v.Levels[delivery.LevelUnit].Run != 2 || v.Levels[delivery.LevelIntegration].Run != 2 || v.Trunk[repo] != trunk {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if v.Composition == nil || v.Composition.State != delivery.CompositionNotRun || len(v.Machines) != 1 || v.Machines[0] != "n1" {
+		t.Errorf("composition %+v machines %v", v.Composition, v.Machines)
+	}
+	o := b.owed(t, 7, head1, "success")
+	if o.Context != delivery.StatusContextCheck || !strings.HasPrefix(o.Text, "pass 111111111111 on aaaaaaaaaaaa") || !strings.Contains(o.Text, "unit 2 run") {
+		t.Errorf("owed = %+v", o)
+	}
+	for tool, want := range map[string]int{"mesh-build-go.build_go_fetch": 1, "mesh-build-go.build_go_digest": 2, "mesh-build-go.build_go_test": 2} {
+		if got := b.fake.count(tool); got != want {
+			t.Errorf("%s called %d times, want %d", tool, got, want)
+		}
+	}
+	// What passed is kept once under each level's digest.
+	for _, k := range []string{"unit." + digU, "integration." + digI} {
+		if _, err := b.buckets[delivery.CheckerKeptBucket].Get(b.ctx, k); err != nil {
+			t.Errorf("kept.%s: %v", k, err)
+		}
+	}
+	// The preview of the head merged onto the trunk, with the tree and the manifest digest the fetch named.
+	pk, _ := delivery.PreviewKey(repo, head1, trunk)
+	e, err := b.buckets[delivery.PreviewsBucket].Get(b.ctx, pk)
+	if err != nil {
+		t.Fatalf("previews.%s: %v", pk, err)
+	}
+	pv, err := delivery.DecodePreview(e.Value())
+	if err != nil || pv.Merge != merged || pv.Modules["modules/m"].Tree != "1111111111111111111111111111111111111111" {
+		t.Errorf("preview = %+v, %v", pv, err)
+	}
+}
+
+// TestACheckOfEqualInputsRunsNothing: a second candidate (another head, the same digests) is checked with every package
+// taken from the first's kept verdicts: no test step runs and no second kept key appears.
+func TestACheckOfEqualInputsRunsNothing(t *testing.T) { // 1287/AC5, 1288/AC6
+	b := startBed(t)
+	first := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	b.start(t, nil)
+	b.verdict(t, first, ended)
+	tests, kept := b.fake.count("mesh-build-go.build_go_test"), keptCount(t, b)
+	second := b.candidate(t, "feat/y", pull(repo, 8, head2))
+	v := b.verdict(t, second, ended)
+	if v.State != delivery.VerdictPass || v.Levels[delivery.LevelUnit].Run != 0 || v.Levels[delivery.LevelUnit].Kept != 2 || v.Levels[delivery.LevelIntegration].Run != 0 {
+		t.Fatalf("verdict = %+v, want everything taken from the kept verdicts", v)
+	}
+	if got := b.fake.count("mesh-build-go.build_go_test"); got != tests {
+		t.Errorf("build_go_test called %d times, was %d: a test ran for equal inputs", got, tests)
+	}
+	if got := keptCount(t, b); got != kept {
+		t.Errorf("%d kept keys, was %d", got, kept)
+	}
+}
+
+func keptCount(t *testing.T, b *bed) int {
+	t.Helper()
+	keys, err := b.buckets[delivery.CheckerKeptBucket].Keys(b.ctx)
+	if err != nil {
+		return 0
+	}
+	return len(keys)
+}
+
+// TestAHeadThatDoesNotMergeFailsNamingTheFilesAndRunsNoTest: the fetch answers the files in conflict; the verdict fails naming
+// them, no test or digest step is run, a preview of the conflicts alone is written and the status is owed as failure.
+func TestAHeadThatDoesNotMergeFailsNamingTheFilesAndRunsNoTest(t *testing.T) { // 1289/AC4
+	b := startBed(t)
+	b.fake.conflict.Store(true)
+	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	b.start(t, nil)
+	v := b.verdict(t, key, ended)
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "files in conflict: a.go, sub/b.go") {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if o := b.owed(t, 7, head1, "failure"); !strings.HasPrefix(o.Text, "failed: n1: ") || !strings.Contains(o.Text, "files in conflict: a.go, sub/b.go") {
+		t.Errorf("owed = %+v", o)
+	}
+	if n := b.fake.count("mesh-build-go.build_go_digest") + b.fake.count("mesh-build-go.build_go_test"); n != 0 {
+		t.Errorf("%d digest and test steps ran after a conflict", n)
+	}
+	pk, _ := delivery.PreviewKey(repo, head1, trunk)
+	if e, err := b.buckets[delivery.PreviewsBucket].Get(b.ctx, pk); err != nil {
+		t.Errorf("previews.%s: %v", pk, err)
+	} else if pv, err := delivery.DecodePreview(e.Value()); err != nil || strings.Join(pv.Conflicts, ",") != "a.go,sub/b.go" || pv.Merge != "" {
+		t.Errorf("preview = %+v, %v, want the files in conflict alone", pv, err)
+	}
+}
+
+// TestAnHqPullRequestGetsNoVerdictAndAnotherDoes: hq's pull request is judged by no one (ADR 0484 clause 8), the other one in
+// the same run is.
+func TestAnHqPullRequestGetsNoVerdictAndAnotherDoes(t *testing.T) { // ADR 0484 clause 8
+	b := startBed(t)
+	hq := b.candidate(t, "feat/hq", pull("novox/hq", 3, head1))
+	other := b.candidate(t, "feat/x", pull(repo, 7, head2))
+	b.start(t, nil)
+	b.verdict(t, other, ended)
+	if _, err := b.buckets[delivery.CheckerVerdictsBucket].Get(b.ctx, hq); err == nil {
+		t.Error("hq's pull request has a verdict")
+	}
+}
+
+// TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts: the verdict key holds running, left by a checker that stopped; the
+// started checker judges it again and ends it (ADR 0478 clause 6, as the builder's).
+func TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts(t *testing.T) { // N6/AC2
+	b := startBed(t)
+	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	group, heads, _ := delivery.ParseCheckerVerdictKey(key)
+	left, err := delivery.EncodeVerdict(delivery.Verdict{Group: group, Heads: heads, Trunk: map[string]string{repo: trunk}, State: delivery.VerdictRunning})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := b.buckets[delivery.CheckerVerdictsBucket].Create(b.ctx, key, left); err != nil {
+		t.Fatal(err)
+	}
+	b.start(t, nil)
+	if v := b.verdict(t, key, ended); v.State != delivery.VerdictPass {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+// TestNoCheckStartsWhileADeliveryBuildsAndOneStartsWhenItEnds: the controller's bucket of the plans in their build phase
+// holds a plan's key; the candidate waits, no step is called; the key deleted, the check starts and passes (ADR 0484 clause 12).
+func TestNoCheckStartsWhileADeliveryBuildsAndOneStartsWhenItEnds(t *testing.T) { // N8/AC1
+	b := startBed(t)
+	plans, err := b.js.CreateKeyValue(b.ctx, jetstream.KeyValueConfig{Bucket: "mesh-controller_plans-building", History: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := plans.Put(b.ctx, "plan-1", []byte(`{"plan":"plan-1","since":"2026-10-21T19:00:00Z","seen":1}`)); err != nil {
+		t.Fatal(err)
+	}
+	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	b.start(t, nil)
+	time.Sleep(1500 * time.Millisecond) // a wait for nothing to happen: there is no event to wait on
+	if _, err := b.buckets[delivery.CheckerVerdictsBucket].Get(b.ctx, key); err == nil {
+		t.Fatal("a check started while a delivery builds")
+	}
+	if n := b.fake.count("mesh-build-go.build_go_fetch"); n != 0 {
+		t.Fatalf("%d fetches while a delivery builds", n)
+	}
+	if err := plans.Delete(b.ctx, "plan-1"); err != nil {
+		t.Fatal(err)
+	}
+	if v := b.verdict(t, key, ended); v.State != delivery.VerdictPass {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+// TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit: the go.mod the forge answers names a commit that main does not
+// hold; the verdict fails naming the member and the commit and no test runs (ADR 0484 clause 9).
+func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2
+	b := startBed(t)
+	b.stalePin.Store(true)
+	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
+	b.start(t, nil)
+	v := b.verdict(t, key, ended)
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, repo+"#7") {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := b.fake.count("mesh-build-go.build_go_test"); n != 0 {
+		t.Errorf("%d test steps ran after a stale pin", n)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go

@@ -0,0 +1,140 @@
+package main
+
+import (
+	"context"
+	"sort"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// judgeDeps are the parts the judge of a check is made of.
+type judgeDeps struct {
+	runner   buildrun.Runner
+	tools    *buildrun.ToolchainSet
+	presence *buildrun.PresenceSet
+	have     *buildrun.HaveSet
+	places   *buildrun.Places
+	trunks   *check.Trunks
+	kept     check.KV
+	previews check.KV
+	repos    *repoModules
+	forge    check.Forge
+	announce check.Announcer
+	builds   check.BuildStates
+	logf     func(format string, args ...any)
+}
+
+func newJudge(d judgeDeps) check.Judge {
+	return &check.Examiner{Steps: d.runner, Toolchains: d.tools, Presence: d.presence, Health: d.have, Places: d.places,
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
+}
+
+// manifestKV reads a manifest by its digest.
+type manifestKV interface {
+	Get(ctx context.Context, key string) (value []byte, revision uint64, found bool, err error)
+}
+
+// repoModules knows which build modules judge a repository, from the indexer's modules and their manifests: the Go build
+// module always (a repository's go.mod files are its own), the Node one when a module of the repository has a TypeScript
+// artifact (ADR 0484 clause 10). Safe for use from the watch and from a check at once.
+type repoModules struct {
+	manifests manifestKV
+	logf      func(format string, args ...any)
+
+	mu     sync.Mutex
+	langs  map[string]map[string]bool // by manifest digest: the languages of its artifacts
+	repoOf map[string]string          // by module: its repository
+	commit map[string]string          // by module: the commit its record was computed at (the commit the mesh runs)
+	typed  map[string]string          // by module: its manifest digest
+}
+
+// Put takes a change of the indexer's modules bucket in: a module's repository and the languages its manifest names.
+func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted bool) {
+	r.mu.Lock()
+	if r.repoOf == nil {
+		r.repoOf, r.typed, r.langs, r.commit = map[string]string{}, map[string]string{}, map[string]map[string]bool{}, map[string]string{}
+	}
+	if deleted {
+		delete(r.repoOf, key)
+		delete(r.typed, key)
+		delete(r.commit, key)
+		r.mu.Unlock()
+		return
+	}
+	r.mu.Unlock()
+	m, err := delivery.DecodeModule(value)
+	if err != nil {
+		return
+	}
+	r.mu.Lock()
+	r.repoOf[key] = m.Repository
+	r.typed[key] = m.Manifest
+	r.commit[key] = m.Commit
+	_, known := r.langs[m.Manifest]
+	r.mu.Unlock()
+	if m.Manifest == "" || known {
+		return
+	}
+	set := map[string]bool{}
+	if mk, err := delivery.ManifestsKey(m.Manifest); err == nil {
+		if raw, _, found, err := r.manifests.Get(ctx, mk); err == nil && found {
+			if kept, err := delivery.DecodeManifest(raw); err == nil {
+				if man, err := catalogue.ParseManifest([]byte(kept.JSON)); err == nil && man.Build != nil {
+					for _, a := range man.Build.Artifacts {
+						if a.Language != "" {
+							set[a.Language] = true
+						}
+					}
+				} else if err != nil && r.logf != nil {
+					r.logf("the manifest %s cannot be read, so its module counts as no TypeScript: %v", m.Manifest, err)
+				}
+			}
+		}
+	}
+	r.mu.Lock()
+	r.langs[m.Manifest] = set
+	r.mu.Unlock()
+}
+
+// BuildModules are the build modules that judge a repository, sorted.
+func (r *repoModules) BuildModules(repository string) []string {
+	out := []string{buildrun.GoBuildModule}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	for module, repo := range r.repoOf {
+		if repo == repository && r.langs[r.typed[module]]["typescript"] {
+			out = append(out, buildrun.NodeBuildModule)
+			break
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// buildReader reads the builder's build of a module at a fingerprint (mesh-delivery-builder_builds).
+type buildReader struct{ kv kvStore }
+
+func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.BuilderBuild, bool, error) {
+	key, err := delivery.BuilderBuildKey(module, fp2)
+	if err != nil {
+		return delivery.BuilderBuild{}, false, err
+	}
+	value, _, found, err := r.kv.Get(ctx, key)
+	if err != nil || !found {
+		return delivery.BuilderBuild{}, false, err
+	}
+	b, err := delivery.DecodeBuilderBuild(value)
+	return b, err == nil, err
+}
+
+// CommitOf is the commit the indexer's record of the module was computed at: the commit of its repository the mesh runs.
+func (r *repoModules) CommitOf(module string) string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.commit[module]
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge_test.go

@@ -0,0 +1,75 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+type memManifests map[string][]byte
+
+func (m memManifests) Get(_ context.Context, key string) ([]byte, uint64, bool, error) {
+	v, ok := m[key]
+	return v, 1, ok, nil
+}
+
+func putModule(t *testing.T, r *repoModules, name, repository, manifest string) {
+	t.Helper()
+	data, err := delivery.EncodeModule(delivery.Module{Repository: repository, Commit: strings.Repeat("a", 40), FP: "src1:" + strings.Repeat("a", 64), Manifest: delivery.ManifestDigest([]byte(manifest))})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Put(context.Background(), name, data, false)
+}
+
+func TestARepositoryWithATypeScriptModuleIsJudgedByTheNodeBuildModuleToo(t *testing.T) { // 1292/AC2
+	own, err := os.ReadFile("../../module.json") // a manifest with a Go bundle: this module's own
+	if err != nil {
+		t.Fatal(err)
+	}
+	goManifest := string(own)
+	// A TypeScript bundle names neither a system nor a directory it is built from (the catalogue's parser says so).
+	var doc map[string]any
+	if err := json.Unmarshal(own, &doc); err != nil {
+		t.Fatal(err)
+	}
+	artifacts := doc["build"].(map[string]any)["artifacts"].([]any)
+	program := artifacts[0].(map[string]any)
+	program["language"] = "typescript"
+	delete(program, "system")
+	delete(program, "from")
+	delete(program, "binary")
+	tsRaw, err := json.Marshal(doc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tsManifest := string(tsRaw)
+	store := memManifests{}
+	for _, m := range []string{goManifest, tsManifest} {
+		data, err := delivery.EncodeManifest(delivery.Manifest{Module: "demo", JSON: m})
+		if err != nil {
+			t.Fatal(err)
+		}
+		store[delivery.ManifestDigest([]byte(m))] = data
+	}
+	r := &repoModules{manifests: store}
+	putModule(t, r, "mesh-delivery-checker", "novox/mesh-delivery", goManifest)
+	putModule(t, r, "mesh-ui", "novox/mesh-catalog", tsManifest)
+	if got := r.BuildModules("novox/mesh-delivery"); strings.Join(got, ",") != buildrun.GoBuildModule {
+		t.Errorf("mesh-delivery: %v, want the Go build module alone", got)
+	}
+	if got := r.BuildModules("novox/mesh-catalog"); strings.Join(got, ",") != buildrun.GoBuildModule+","+buildrun.NodeBuildModule {
+		t.Errorf("mesh-catalog: %v, want both", got)
+	}
+	if got := r.CommitOf("mesh-delivery-checker"); got != strings.Repeat("a", 40) || r.CommitOf("gone") != "" {
+		t.Errorf("the commit the mesh runs = %q", got)
+	}
+	if got := r.BuildModules("novox/mesh-sdk"); strings.Join(got, ",") != buildrun.GoBuildModule {
+		t.Errorf("a repository with no module: %v, want the Go build module", got)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go

@@ -0,0 +1,352 @@
+// Command mesh-delivery-checker is delivery's checker (novox/hq ADR 0453 clause 4, ADR 0447, ADR 0484, issues 1678 to 1686): for
+// each candidate the indexer writes it judges every pull request's head merged onto its trunk, through the build modules'
+// fetch, digest and test steps, keeps the passing packages' verdicts, writes the verdict, and owes the forge the status
+// `mesh/check`, which the forge bridge sets. It runs dark: nothing reads its answers to merge or deliver (ADR 0453 clause 4).
+// It serves no request subject and holds no timer: every reaction is a watch or a bus event (ADR 0437 §8).
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"mesh-delivery-checker/internal/check"
+)
+
+// eventSubject is the subject of an event of the checker's stream checks (the bus names the stream CHECKS): the indexer's
+// watch of the previews bucket and the forge bridge's watch of the owed bucket are woken by them.
+func eventSubject(event string) string {
+	return "mesh.stream." + delivery.CheckerModule + ".event." + event
+}
+
+const (
+	// defaultStepBound is how long the checker waits for one step of a build module (a fetch downloads the Go modules, a
+	// test level runs a repository's tests).
+	defaultStepBound = 30 * time.Minute
+	// defaultLink is the base of the address a status points at; the verdict key follows.
+	defaultLink = "mesh-delivery-view/checks"
+)
+
+func main() {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	if err := run(ctx, os.Getenv, os.Stderr); err != nil {
+		fmt.Fprintln(os.Stderr, "mesh-delivery-checker:", err)
+		os.Exit(1)
+	}
+}
+
+// credential is the broker file the controller issues to the module: JSON of the bus address, the certificate
+// fingerprint to pin, the principal and its password (as the indexer reads it; issue 1242 moves this into the SDK).
+type credential struct {
+	URL         string `json:"url"`
+	Fingerprint string `json:"fingerprint"`
+	Node        string `json:"node"`
+	Module      string `json:"module"`
+	User        string `json:"user"`
+	Password    string `json:"password"`
+}
+
+func readCredential(path string) (credential, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return credential{}, err
+	}
+	var c credential
+	if err := json.Unmarshal(raw, &c); err != nil {
+		return credential{}, fmt.Errorf("the broker credential is not one: %w", err)
+	}
+	if c.URL == "" || c.User == "" {
+		return credential{}, errors.New("the broker credential names no bus address or user")
+	}
+	return c, nil
+}
+
+// pinned accepts exactly the certificate with this SHA-256 and no other.
+func pinned(want string) *tls.Config {
+	return &tls.Config{
+		InsecureSkipVerify: true, //nolint:gosec // replaced by the pin below, which is stricter
+		MinVersion:         tls.VersionTLS12,
+		VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+			if len(rawCerts) == 0 {
+				return errors.New("the bus presented no certificate")
+			}
+			sum := sha256.Sum256(rawCerts[0])
+			if got := "sha256:" + hex.EncodeToString(sum[:]); got != want {
+				return fmt.Errorf("the bus presented a certificate this mesh does not know (%.23s…)", got)
+			}
+			return nil
+		},
+	}
+}
+
+// durationEnv reads a duration setting from the environment, def when it is not set.
+func durationEnv(getenv func(string) string, name string, def time.Duration) (time.Duration, error) {
+	v := strings.TrimSpace(getenv(name))
+	if v == "" {
+		return def, nil
+	}
+	d, err := time.ParseDuration(v)
+	if err != nil || d <= 0 {
+		return 0, fmt.Errorf("%s: %q is not a duration of more than 0", name, v)
+	}
+	return d, nil
+}
+
+// run is the program: it returns when ctx ends or the bus cannot be used.
+func run(ctx context.Context, getenv func(string) string, logOut io.Writer) error {
+	logger := log.New(logOut, "mesh-delivery-checker: ", log.LstdFlags)
+	path := strings.TrimSpace(getenv("MESH_BROKER_FILE"))
+	if path == "" {
+		return errors.New("MESH_BROKER_FILE is not set, so there is no credential to hear the bus with")
+	}
+	cred, err := readCredential(path)
+	if err != nil {
+		return err
+	}
+	opts := []nats.Option{
+		nats.Name(cred.Node + "." + cred.Module),
+		nats.UserInfo(cred.User, cred.Password),
+		nats.CustomInboxPrefix("_INBOX." + cred.User),
+		nats.MaxReconnects(-1),
+		nats.RetryOnFailedConnect(true),
+	}
+	if strings.TrimSpace(cred.Fingerprint) != "" {
+		opts = append(opts, nats.Secure(pinned(cred.Fingerprint)))
+	}
+	conn, err := nats.Connect(cred.URL, opts...)
+	if err != nil {
+		return fmt.Errorf("connecting to the bus: %w", err)
+	}
+	defer conn.Close()
+	js, err := jetstream.New(conn)
+	if err != nil {
+		return err
+	}
+	bucket := func(name string) (jetstream.KeyValue, error) {
+		kv, err := js.KeyValue(ctx, name)
+		if err != nil {
+			return nil, fmt.Errorf("the bucket %s: %w", name, err)
+		}
+		return kv, nil
+	}
+	buckets := map[string]jetstream.KeyValue{}
+	for _, name := range []string{delivery.CheckerVerdictsBucket, delivery.CheckerKeptBucket, delivery.CheckerOwedBucket, delivery.PreviewsBucket,
+		delivery.CandidatesBucket, delivery.ModulesBucket, delivery.ManifestsBucket} {
+		if buckets[name], err = bucket(name); err != nil {
+			return err
+		}
+	}
+	// Calls to the build modules go out as this module's own account, naming the machine (mesh-sdk process.CallOn); the
+	// buckets are read and written on the connection above.
+	account, err := process.ReadAccount(path)
+	if err != nil {
+		return err
+	}
+	caller, err := process.Connect(account, nats.Name(cred.Node+"."+cred.Module+".calls"), nats.RetryOnFailedConnect(true))
+	if err != nil {
+		return err
+	}
+	defer caller.Close()
+
+	stepBound, err := durationEnv(getenv, "MESH_CHECKER_STEP_BOUND", defaultStepBound)
+	if err != nil {
+		return err
+	}
+	checkBound, err := durationEnv(getenv, "MESH_CHECKER_BOUND", check.DefaultBound)
+	if err != nil {
+		return err
+	}
+	capacity, err := capacityFrom(strings.TrimSpace(getenv("MESH_CHECKER_SETTINGS")), getenv("MESH_CHECKER_CAPACITY"))
+	if err != nil {
+		return fmt.Errorf("the capacity setting: %w", err)
+	}
+	link := strings.TrimSpace(getenv("MESH_CHECKER_LINK"))
+	if link == "" {
+		link = defaultLink
+	}
+	tools := &buildrun.ToolchainSet{}
+	presence := &buildrun.PresenceSet{}
+	have := &buildrun.HaveSet{}
+	trunks := &check.Trunks{}
+	places := &buildrun.Places{Capacity: capacity}
+	runner := buildrun.Runner{Caller: heardCaller{caller.CallOn}, Steps: stepsWaiter{js}, Bound: stepBound}
+	ch := &check.Checker{
+		Verdicts: kvStore{buckets[delivery.CheckerVerdictsBucket]},
+		Owed:     kvStore{buckets[delivery.CheckerOwedBucket]},
+		Trunks:   trunks,
+		Bound:    checkBound,
+		Link:     link,
+		Logf:     logger.Printf,
+	}
+	// The builder's builds say how the candidates' fingerprints stand (issue 1684); where its bucket is not there yet the line
+	// says nothing of the builds, until the checker starts again.
+	var builds check.BuildStates
+	switch kv, err := js.KeyValue(ctx, delivery.BuilderBuildsBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: the line says nothing of the builds until the checker starts again", delivery.BuilderBuildsBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.BuilderBuildsBucket, err)
+	default:
+		builds = buildReader{kvStore{kv}}
+	}
+	holds := newHoldWatch(ctx, js, ch.Reconsider, logger)
+	ch.Hold = holds.Held
+	announce := func(ctx context.Context, event, key string) {
+		body, _ := json.Marshal(map[string]string{"key": key})
+		if _, err := js.Publish(ctx, eventSubject(event), body); err != nil {
+			logger.Printf("%s of %s was written and the part that reads it could not be told: %v", event, key, err)
+		}
+	}
+	repos := &repoModules{manifests: kvStore{buckets[delivery.ManifestsBucket]}, logf: logger.Printf}
+	ch.Judge = newJudge(judgeDeps{
+		runner: runner, tools: tools, presence: presence, have: have, places: places, trunks: trunks,
+		kept: kvStore{buckets[delivery.CheckerKeptBucket]}, previews: kvStore{buckets[delivery.PreviewsBucket]},
+		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
+		announce: announce,
+	})
+	ch.Announce = announce
+
+	// The toolchains first, so a check that starts from the first candidate finds the nodes.
+	watch := newToolchainWatch(ctx, js, tools, ch.NodesChanged, logger)
+	if err := watch.start(); err != nil {
+		return err
+	}
+	// A build module says each time it wrote its toolchains key: its stream, and the checker's durable consumer on it, are
+	// made by the controller. Where the stream is not there yet the checker says so and is started again with the build
+	// module.
+	for _, module := range []string{buildrun.GoBuildModule, buildrun.NodeBuildModule} {
+		stream := toolchainStreams[module]
+		cons, err := js.Consumer(ctx, stream, cred.Node+"_"+cred.Module)
+		if err != nil {
+			logger.Printf("the consumer %s_%s on %s does not exist yet, so %s's reports are not heard until the checker starts again: %v", cred.Node, cred.Module, stream, module, err)
+			continue
+		}
+		cc, err := cons.Consume(func(m jetstream.Msg) { watch.Reported(m) },
+			jetstream.ConsumeErrHandler(func(_ jetstream.ConsumeContext, err error) { logger.Printf("hearing the bus: %v", err) }))
+		if err != nil {
+			return err
+		}
+		defer cc.Stop()
+	}
+	errs := make(chan error, 8)
+	// The watchman's presence says which nodes are asleep. Where its bucket is not there yet no node is online, so nothing
+	// is checked; the checker says so and is started again with the watchman.
+	switch kv, err := js.KeyValue(ctx, delivery.PresenceBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no node counts as online until the checker starts again", delivery.PresenceBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.PresenceBucket, err)
+	default:
+		pw, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) { presence.Put(e.Key(), e.Value(), !opOf(e)) })
+		if err != nil {
+			return err
+		}
+		go func() {
+			errs <- follow(ctx, pw, func(e jetstream.KeyValueEntry) {
+				if presence.Put(e.Key(), e.Value(), !opOf(e)) {
+					ch.NodesChanged(ctx) // a node came online or went: a check that waited for one may go on
+				}
+			})
+		}()
+	}
+	// The node-engine's have says whether a node's build module runs and is healthy: a node whose build module is not is not
+	// chosen. Where its bucket is not there yet no build module counts as healthy, so nothing is checked.
+	switch kv, err := js.KeyValue(ctx, delivery.HaveBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no build module counts as healthy until the checker starts again", delivery.HaveBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.HaveBucket, err)
+	default:
+		hw, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) { have.Put(e.Key(), e.Value(), !opOf(e)) })
+		if err != nil {
+			return err
+		}
+		go func() {
+			errs <- follow(ctx, hw, func(e jetstream.KeyValueEntry) {
+				if have.Put(e.Key(), e.Value(), !opOf(e)) {
+					ch.NodesChanged(ctx)
+				}
+			})
+		}()
+	}
+	// The gate's source says the trunk head of each repository, which a pull request is merged onto. Where it is not there
+	// yet no trunk is known, so nothing is checked.
+	switch kv, err := js.KeyValue(ctx, delivery.SourceBucket); {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		logger.Printf("the bucket %s does not exist yet: no trunk is known until the checker starts again", delivery.SourceBucket)
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", delivery.SourceBucket, err)
+	default:
+		sw, err := settle(ctx, kv, func(e jetstream.KeyValueEntry) {
+			if e.Key() == delivery.SourceMainKey {
+				trunks.Put(e.Value(), !opOf(e))
+			}
+		})
+		if err != nil {
+			return err
+		}
+		go func() {
+			errs <- follow(ctx, sw, func(e jetstream.KeyValueEntry) {
+				if e.Key() == delivery.SourceMainKey && trunks.Put(e.Value(), !opOf(e)) {
+					ch.Reconsider(ctx) // the trunk moved: a verdict for the old trunk is judged again
+				}
+			})
+		}()
+	}
+	// The modules say which repository holds a TypeScript module, so the Node build module judges it too.
+	mw, err := settle(ctx, buckets[delivery.ModulesBucket], func(e jetstream.KeyValueEntry) { repos.Put(ctx, e.Key(), e.Value(), !opOf(e)) })
+	if err != nil {
+		return err
+	}
+	go func() {
+		errs <- follow(ctx, mw, func(e jetstream.KeyValueEntry) { repos.Put(ctx, e.Key(), e.Value(), !opOf(e)) })
+	}()
+	each := func(e jetstream.KeyValueEntry) {
+		if opOf(e) {
+			ch.Candidate(ctx, e.Key(), e.Value())
+		} else {
+			ch.Forget(e.Key())
+		}
+	}
+	w, err := settle(ctx, buckets[delivery.CandidatesBucket], each)
+	if err != nil {
+		return err
+	}
+	// A key left running for heads no candidate holds is closed; the candidates are all known now.
+	if err := ch.Sweep(ctx); err != nil {
+		return err
+	}
+	logger.Printf("started on %s", cred.Node)
+	go func() { errs <- follow(ctx, w, each) }()
+	select {
+	case <-ctx.Done():
+		ch.Wait()
+		return nil
+	case err := <-errs:
+		return err
+	case err := <-watch.errs:
+		return err
+	case err := <-holds.errs:
+		return err
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/settings.go

@@ -0,0 +1,29 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// capacityFrom is the build capacity of each node (ADR 0478 clause 3): the module's setting `capacity`, `<node>=<steps at
+// once>` pairs separated by commas, laid into the settings file the controller composes (issue 1661); empty is one step at a
+// time on every node. With no settings file named, fallback is read instead, for a run outside the module's launch.
+func capacityFrom(path, fallback string) (map[string]int, error) {
+	if path == "" {
+		return buildrun.ParseCapacity(fallback)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("the settings file: %w", err)
+	}
+	var s struct {
+		Capacity string `json:"capacity"`
+	}
+	if err := json.Unmarshal(raw, &s); err != nil {
+		return nil, fmt.Errorf("the settings file %s is not JSON: %w", path, err)
+	}
+	return buildrun.ParseCapacity(s.Capacity)
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/settings_test.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+func settingsFile(t *testing.T, body string) string {
+	t.Helper()
+	p := filepath.Join(t.TempDir(), "settings.json")
+	if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// ADR 0484 clause 12: the build capacity is the module's setting `capacity`, laid into the settings file: empty is one step at a time everywhere.
+func TestCapacityIsReadFromTheSettingsFile(t *testing.T) {
+	for body, want := range map[string]map[string]int{
+		`{"capacity": "shanks=3,ace=2"}`: {"shanks": 3, "ace": 2},
+		`{"capacity": ""}`:               {},
+		`{}`:                             {},
+	} {
+		got, err := capacityFrom(settingsFile(t, body), "")
+		if err != nil || len(got) != len(want) || got["shanks"] != want["shanks"] || got["ace"] != want["ace"] {
+			t.Errorf("%s: capacity %v, %v, want %v", body, got, err, want)
+		}
+	}
+	p := &buildrun.Places{Capacity: mustCapacity(t, settingsFile(t, `{"capacity": ""}`))}
+	if p.CapacityOf("shanks") != 1 || p.CapacityOf("ace") != 1 {
+		t.Errorf("an empty setting gives %d and %d, want 1 everywhere", p.CapacityOf("shanks"), p.CapacityOf("ace"))
+	}
+}
+
+func mustCapacity(t *testing.T, path string) map[string]int {
+	t.Helper()
+	c, err := capacityFrom(path, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+
+func TestACapacitySettingThatIsNotOneIsRefusedNamingIt(t *testing.T) {
+	if _, err := capacityFrom(settingsFile(t, `{"capacity": "shanks=-1"}`), ""); err == nil {
+		t.Error("shanks=-1 accepted")
+	}
+	if c, err := capacityFrom(settingsFile(t, `{"capacity": "shanks=3,ace=2,g14=0,novox=0"}`), ""); err != nil || c["g14"] != 0 || len(c) != 4 {
+		t.Errorf("the starting value: %v, %v", c, err)
+	}
+	if _, err := capacityFrom(settingsFile(t, `not json`), ""); err == nil {
+		t.Error("a file that is not JSON accepted")
+	}
+	if _, err := capacityFrom(filepath.Join(t.TempDir(), "none"), ""); err == nil {
+		t.Error("a settings file that is not there accepted")
+	}
+}
+
+// With no settings file named (a run outside the module's launch, as the tests do), the capacity is the environment's.
+func TestWithNoSettingsFileTheCapacityIsTheEnvironments(t *testing.T) {
+	got, err := capacityFrom("", "ace=2")
+	if err != nil || got["ace"] != 2 {
+		t.Errorf("capacity %v, %v", got, err)
+	}
+}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/toolchains.go

@@ -0,0 +1,104 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"sync"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// toolchainStreams are the stream each build module carries its toolchain.reported event on, as the bus names it
+// (declared by the build modules, heard by this module through consumes).
+var toolchainStreams = map[string]string{buildrun.GoBuildModule: "TOOLCHAINS_GO", buildrun.NodeBuildModule: "TOOLCHAINS_NODE"}
+
+// toolchainWatch keeps the build modules' toolchains in a buildrun.ToolchainSet and tells the builder when one changed. A
+// build module's bucket is made when it is assigned, after the builder started, and the builder holds no timer (ADR 0437
+// §8): it watches the buckets that exist at start, and a build module says each time it wrote its toolchains key
+// (toolchain.reported, handled by Reported); a bucket not watched yet is then watched.
+type toolchainWatch struct {
+	ctx     context.Context
+	js      bucketOpener
+	set     *buildrun.ToolchainSet
+	changed func(ctx context.Context) // a language's entries changed: the failed builds are tried again
+	logger  *log.Logger
+	errs    chan error
+	mu      sync.Mutex
+	watched map[string]bool
+}
+
+func newToolchainWatch(ctx context.Context, js bucketOpener, set *buildrun.ToolchainSet, changed func(context.Context), logger *log.Logger) *toolchainWatch {
+	return &toolchainWatch{ctx: ctx, js: js, set: set, changed: changed, logger: logger, errs: make(chan error, len(buildrun.LanguageOf)), watched: map[string]bool{}}
+}
+
+// start watches the buckets that exist now; a missing one is said and waits for its build module's event.
+func (w *toolchainWatch) start() error {
+	for module := range buildrun.LanguageOf {
+		if err := w.ensure(module); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (w *toolchainWatch) ensure(module string) error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.watched[module] {
+		return nil
+	}
+	name := delivery.ToolchainsBucket(module)
+	kv, err := w.js.KeyValue(w.ctx, name)
+	switch {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		w.logger.Printf("the bucket %s does not exist yet: it is watched when %s reports a toolchain", name, module)
+		return nil
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", name, err)
+	}
+	watcher, err := settle(w.ctx, kv, func(e jetstream.KeyValueEntry) { w.set.Put(module, e.Key(), e.Value(), !opOf(e)) })
+	if err != nil {
+		return err
+	}
+	w.watched[module] = true
+	go func() {
+		w.errs <- follow(w.ctx, watcher, func(e jetstream.KeyValueEntry) {
+			if w.set.Put(module, e.Key(), e.Value(), !opOf(e)) {
+				w.changed(w.ctx)
+			}
+		})
+	}()
+	w.changed(w.ctx) // what the settle read is new to the builder
+	return nil
+}
+
+// delivered is the part of a JetStream message the watch uses.
+type delivered interface {
+	Subject() string
+	Ack() error
+	Term() error
+}
+
+// Reported takes one toolchain.reported event of a build module in: the module is read off the subject,
+// mesh.stream.<module>.event.toolchain.reported, and its bucket is watched if it is not. A subject of no build module is
+// terminated; a failure stays unacknowledged, and the server delivers it again.
+func (w *toolchainWatch) Reported(m delivered) {
+	module, _, _ := strings.Cut(strings.TrimPrefix(m.Subject(), "mesh.stream."), ".event.")
+	if _, known := buildrun.LanguageOf[module]; !known || !strings.HasPrefix(m.Subject(), "mesh.stream.") {
+		w.logger.Printf("%s: not a build module's event, dropped", m.Subject())
+		_ = m.Term()
+		return
+	}
+	if err := w.ensure(module); err != nil {
+		w.logger.Printf("%s: left for redelivery: %v", m.Subject(), err)
+		return
+	}
+	_ = m.Ack()
+}

modules/mesh-delivery-checker/files/settings.json

@@ -0,0 +1,3 @@
+{
+  "capacity": ""
+}

modules/mesh-delivery-checker/go.mod

@@ -0,0 +1,22 @@
+module mesh-delivery-checker
+
+go 1.26.0
+
+require (
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b
+	github.com/nats-io/nats-server/v2 v2.11.17
+	github.com/nats-io/nats.go v1.54.0
+)
+
+require (
+	github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/minio/highwayhash v1.0.4 // indirect
+	github.com/nats-io/jwt/v2 v2.8.1 // indirect
+	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+)

modules/mesh-delivery-checker/go.sum

@@ -0,0 +1,31 @@
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc h1:ZJScJSnF6LgFl55/VJ9RT/lNroVWun469sXtx0nlVYw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021192148-78364e318bdc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022160024-9cb4d59093a7 h1:wK9O1CgNk7mo3IdJqW/CCx/hebg+1F0rkvW8CvJfnRM=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022160024-9cb4d59093a7/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b h1:OjlhfiGr+wKLWxafV+BRjZx3TbBtwRYcm9mgoam/jv8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
+github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
+github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
+github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
+github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
+github.com/nats-io/nats-server/v2 v2.11.17 h1:GKEghcFK6A+aFx11Yf1LjgLC3txAwvyhnYzhBIQZA8I=
+github.com/nats-io/nats-server/v2 v2.11.17/go.mod h1:B1sFVz4StNosQ903ak4N1G01Fl/9f8e06mXpFIE2K24=
+github.com/nats-io/nats.go v1.54.0 h1:vsXoOxjHp/GmPUN+EcI7uOf/uB+iAP+kEsAFNQN0yzA=
+github.com/nats-io/nats.go v1.54.0/go.mod h1:y+DZoD1oBOYfZTU681eTUiUjI0vbqYGixNVFHcjHJ0k=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

modules/mesh-delivery-checker/internal/check/beside.go

@@ -0,0 +1,101 @@
+package check
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+)
+
+// BesideRef is a sibling repository a repository's tests read, placed beside the fetched tree as a plain directory (ADR
+// 0484 clause 4). Ref names the pull request's head when the commit is only there.
+type BesideRef struct {
+	Repository string `json:"repository"`
+	Commit     string `json:"commit"`
+	Ref        string `json:"ref,omitempty"`
+}
+
+const (
+	catalogueRepository = "novox/mesh-catalog"
+	nodeEngineRepo      = "novox/mesh-host"
+	nodeEngineModule    = "mesh-host"
+	controllerRepo      = "novox/mesh-controller"
+)
+
+// besideRules are the repositories each core repository's tests read, as the tests state it (mesh-sdk go/internal/beside
+// beside.go): the catalogue, the node-engine, the SDK, and the delivery's pinned forge dependencies (mesh-catalog
+// checks/deps). Which commit of each is besideCommit's rule.
+var besideRules = map[string][]string{
+	controllerRepo:        {catalogueRepository, nodeEngineRepo, SDKRepository},
+	nodeEngineRepo:        {catalogueRepository, SDKRepository},
+	SDKRepository:         {catalogueRepository, nodeEngineRepo},
+	catalogueRepository:   {SDKRepository, controllerRepo},
+	"novox/mesh-delivery": {SDKRepository, catalogueRepository},
+}
+
+// besideFor are the siblings a pull request's tests read (ADR 0484 clause 4): the catalogue at its trunk, always, even in a
+// group holding a catalogue pull request; the node-engine at the commit the mesh runs (the commit of the indexer's module
+// mesh-host, its trunk head when none is known); mesh-sdk, for the controller's tests, at the commit the controller's go.mod
+// pins; any other sibling at the head of the group's pull request for it when the group holds one, else at its trunk.
+func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef, error) {
+	var heads map[string]string
+	if j.Trunks != nil {
+		heads = j.Trunks.Heads()
+	}
+	var out []BesideRef
+	for _, repo := range besideRules[p.Repository] {
+		switch {
+		case repo == catalogueRepository:
+			if head := heads[repo]; head != "" {
+				out = append(out, BesideRef{Repository: repo, Commit: head})
+			}
+		case repo == nodeEngineRepo:
+			commit := ""
+			if j.Runs != nil {
+				commit = j.Runs.CommitOf(nodeEngineModule)
+			}
+			if commit == "" {
+				commit = heads[repo]
+			}
+			if commit != "" {
+				out = append(out, BesideRef{Repository: repo, Commit: commit})
+			}
+		case repo == SDKRepository && p.Repository == controllerRepo && j.Forge != nil:
+			text, err := j.Forge.File(ctx, p.Repository, "go.mod", p.Head)
+			if err != nil {
+				return nil, fmt.Errorf("go.mod of %s#%d cannot be read to place the mesh-sdk its tests read: %w", p.Repository, p.Number, err)
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				return nil, fmt.Errorf("go.mod of %s#%d names no mesh-sdk commit, so the mesh-sdk its tests read cannot be placed", p.Repository, p.Number)
+			}
+			full, err := j.Forge.FullSHA(ctx, SDKRepository, pin)
+			if err != nil {
+				return nil, fmt.Errorf("mesh-sdk %s, which %s#%d pins, cannot be found: %w", pin, p.Repository, p.Number, err)
+			}
+			out = append(out, BesideRef{Repository: repo, Commit: full})
+		default:
+			if member := c.member(repo); member != nil {
+				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})
+			} else if head := heads[repo]; head != "" {
+				out = append(out, BesideRef{Repository: repo, Commit: head})
+			}
+		}
+	}
+	return out, nil
+}
+
+func (c *Case) member(repository string) *Pull {
+	for i := range c.Pulls {
+		if c.Pulls[i].Repository == repository {
+			return &c.Pulls[i]
+		}
+	}
+	return nil
+}
+
+func refOf(number int) string {
+	if number <= 0 {
+		return ""
+	}
+	return "refs/pull/" + strconv.Itoa(number) + "/head"
+}

modules/mesh-delivery-checker/internal/check/builds.go

@@ -0,0 +1,66 @@
+package check
+
+import (
+	"context"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The states of a build the status line says (ADR 0484 clause 7).
+const (
+	BuildBuilt   = "built"
+	BuildFailed  = "failed"
+	BuildWaiting = "waiting"
+)
+
+// BuildStates reads the builder's build of a module at a fingerprint of the new form (builds.<module>.<fingerprint>): the
+// value and whether the key exists.
+type BuildStates interface {
+	Build(ctx context.Context, module, fp2 string) (delivery.BuilderBuild, bool, error)
+}
+
+// NoteOf is the state of a build as the line says it: done is built, failed is failed, and one queued, building or not
+// begun is waiting.
+func NoteOf(b delivery.BuilderBuild, found bool) string {
+	switch {
+	case !found:
+		return BuildWaiting
+	case b.State == delivery.BuildDone:
+		return BuildBuilt
+	case b.State == delivery.BuildFailed:
+		return BuildFailed
+	}
+	return BuildWaiting
+}
+
+// buildNotes are the state of each build the case's modules carry a fingerprint of, by module, sorted. A module two pull
+// requests give is said once.
+func (j *Examiner) buildNotes(ctx context.Context, c *Case) []BuildNote {
+	if j.Builds == nil {
+		return nil
+	}
+	fps := map[string]string{}
+	for _, p := range c.Pulls {
+		for module, cm := range p.Fps {
+			if cm.FP2 != "" {
+				fps[module] = cm.FP2
+			}
+		}
+	}
+	modules := make([]string, 0, len(fps))
+	for m := range fps {
+		modules = append(modules, m)
+	}
+	sort.Strings(modules)
+	var notes []BuildNote
+	for _, m := range modules {
+		b, found, err := j.Builds.Build(ctx, m, fps[m])
+		if err != nil {
+			j.logf("the build of %s at %s cannot be read: %v", m, fps[m], err)
+			found = false
+		}
+		notes = append(notes, BuildNote{Module: m, State: NoteOf(b, found)})
+	}
+	return notes
+}

modules/mesh-delivery-checker/internal/check/case.go

@@ -0,0 +1,135 @@
+package check
+
+import (
+	"fmt"
+	"maps"
+	"sort"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// HQRepository is the repository the dark checker writes no status for (ADR 0484 clause 8): hq builds no module and its
+// check is a script no build module can run, so it is judged by its merge-check.sh until issue 1296 settles how.
+const HQRepository = "novox/hq"
+
+// HQNote is what the read tools say of an hq pull request (ADR 0484 clause 8).
+const HQNote = "hq: judged by merge-check.sh until issue 1296"
+
+// Pull is one pull request the checker judges: its head, the trunk head of its repository it is merged onto and the
+// modules the indexer says it touches, with the fingerprints the indexer wrote for them.
+type Pull struct {
+	Repository string
+	Number     int
+	Head       string
+	Trunk      string
+	Modules    []string
+	Fps        map[string]delivery.CandidateModule
+}
+
+// Case is one check: a candidate's pull requests that are judged (those of hq and of a repository whose trunk is not known
+// are left out), the trunk head of each repository and the key of the verdict.
+type Case struct {
+	// Key is the verdict key, `<group>.<heads hash>`.
+	Key       string
+	Group     string
+	HeadsHash string
+	Pulls     []Pull
+	// Trunk is the trunk head of each repository of Pulls.
+	Trunk map[string]string
+	// Left says why pull requests of the candidate are not judged (hq's, a repository with no known trunk); empty when all are.
+	Left []string
+	// Queued is when the checker took the case up, for the time of its queue.
+	Queued time.Time
+	// Progress says what the check is doing, so a check that ran past its bound names the step it was stuck at.
+	Progress *Progress
+}
+
+// Progress is the step a check is at, written by the check and read when its bound passes.
+type Progress struct {
+	mu          sync.Mutex
+	stage, node string
+}
+
+// Set records the step now running and the node it runs on, empty for none.
+func (p *Progress) Set(stage, node string) {
+	p.mu.Lock()
+	p.stage, p.node = stage, node
+	p.mu.Unlock()
+}
+
+// Now is the step recorded last and its node.
+func (p *Progress) Now() (stage, node string) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.stage, p.node
+}
+
+// CaseOf is the check of a candidate against the trunk heads (the gate's source.main): the pull requests that are judged.
+// The checker judges pull requests into main only (ADR 0484 clause 11): the pull message carries no base, a merge into
+// another branch is a closed message, so every candidate is into the trunk; a repository whose trunk head is not known has
+// none to merge onto. It answers nil when no pull request is left to judge.
+func CaseOf(c delivery.Candidate, trunk map[string]string) *Case {
+	key, err := delivery.CheckerVerdictKey(c.Group, c.HeadsHash)
+	if err != nil {
+		return nil
+	}
+	cs := &Case{Key: key, Group: c.Group, HeadsHash: c.HeadsHash, Trunk: map[string]string{}, Progress: &Progress{}}
+	for _, p := range c.Pulls {
+		switch head, known := trunk[p.Repository]; {
+		case p.Repository == HQRepository:
+			cs.Left = append(cs.Left, fmt.Sprintf("%s#%d: %s", p.Repository, p.Number, HQNote))
+		case !known || head == "":
+			cs.Left = append(cs.Left, fmt.Sprintf("%s#%d: the trunk head of %s is not known", p.Repository, p.Number, p.Repository))
+		default:
+			cs.Pulls = append(cs.Pulls, Pull{Repository: p.Repository, Number: p.Number, Head: p.Head.Head, Trunk: head, Modules: p.Modules, Fps: p.Fps})
+			cs.Trunk[p.Repository] = head
+		}
+	}
+	if len(cs.Pulls) == 0 {
+		return nil
+	}
+	sort.SliceStable(cs.Pulls, func(i, j int) bool {
+		if cs.Pulls[i].Repository != cs.Pulls[j].Repository {
+			return cs.Pulls[i].Repository < cs.Pulls[j].Repository
+		}
+		return cs.Pulls[i].Number < cs.Pulls[j].Number
+	})
+	return cs
+}
+
+// sameTrunk says whether two verdicts' trunk heads are the same.
+func sameTrunk(a, b map[string]string) bool { return maps.Equal(a, b) }
+
+// Trunks holds the trunk head of each repository, as the gate's source.main says (a watch puts it in).
+type Trunks struct {
+	mu    sync.Mutex
+	heads map[string]string
+}
+
+// Put takes a source.main value in and answers whether the heads changed.
+func (t *Trunks) Put(value []byte, deleted bool) bool {
+	var heads map[string]string
+	if !deleted {
+		s, err := delivery.DecodeSource(value)
+		if err != nil {
+			return false
+		}
+		heads = s.Heads
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if maps.Equal(t.heads, heads) {
+		return false
+	}
+	t.heads = maps.Clone(heads)
+	return true
+}
+
+// Heads are the trunk heads now (a copy).
+func (t *Trunks) Heads() map[string]string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return maps.Clone(t.heads)
+}

modules/mesh-delivery-checker/internal/check/checker.go

@@ -0,0 +1,469 @@
+package check
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// DefaultBound is how long a check may run before it is ended failed naming the step it was stuck at (ADR 0484, issue 1678).
+const DefaultBound = 30 * time.Minute
+
+// NodesWords is in the Words of a failure that is the build nodes' (none qualifies, the toolchains disagree): such a verdict
+// is judged again when the nodes change, by a watch and never a timer (ADR 0437 §8).
+const NodesWords = "build node qualifies"
+
+// The events the checker says on its stream checks (module.json): a preview or a status was written, so a part that reads
+// the bucket, which is made when the checker is assigned and may not exist when that part starts, finds it (ADR 0437 §8: no
+// timer). The body is {"key": ...}.
+const (
+	EventPreviewWritten = "preview.written"
+	EventOwedWritten    = "owed.written"
+)
+
+// Announcer says an event of the checker's stream, with the key written.
+type Announcer func(ctx context.Context, event, key string)
+
+// Outcome is what judging a case gives: the verdict (state, failure, levels, times, composition; the checker adds the
+// group, the heads and the trunk) and, for the line, what the check knows of the builds of the modules it touches.
+type Outcome struct {
+	Verdict delivery.Verdict
+	Builds  []BuildNote
+	// Slowest names the slowest tests of a level that went over its bound ("unit pkg.Test 1.2s").
+	Slowest []string
+}
+
+// BuildNote is the state of a candidate's module build, by module: built, failed or waiting (ADR 0484 clause 7).
+type BuildNote struct {
+	Module string
+	State  string
+}
+
+// Judge runs the check of a case: the merge, the levels. It writes what it is doing to c.Progress. It answers an error
+// only when it could not judge at all; a failure of the change is a Verdict.
+type Judge interface {
+	Judge(ctx context.Context, c *Case) (Outcome, error)
+}
+
+// Checker judges the candidates the indexer writes, dark (ADR 0453 clause 4, ADR 0484): for each candidate it claims a
+// verdict key, runs the check through its Judge, writes the verdict and, for each pull request judged, the owed status
+// `mesh/check` the forge bridge performs. It holds no timer; a check starts from a candidate or from a change of the
+// nodes, the trunk or the controller's plan, and ends when its judge does or its bound passes.
+type Checker struct {
+	Verdicts KV
+	Owed     KV
+	Judge    Judge
+	Trunks   interface{ Heads() map[string]string }
+	// Bound is how long one check may run; DefaultBound when 0.
+	Bound time.Duration
+	// Limit is how many checks run at once; two when 0.
+	Limit int
+	// Hold says whether a delivery builds, so no new check starts (ADR 0484 clause 12); nil never holds.
+	Hold func() bool
+	// Link is the base of the address a status points at; the verdict key follows.
+	Link string
+	// Announce says a status was written (EventOwedWritten); nil says nothing.
+	Announce Announcer
+	Now      func() time.Time
+	Logf     func(format string, args ...any)
+
+	once      sync.Once
+	sem       chan struct{}
+	wg        sync.WaitGroup
+	mu        sync.Mutex
+	known     map[string]delivery.Candidate // by candidates key
+	inflight  map[string]bool               // by verdict key
+	again     map[string]bool               // by verdict key: asked again while it ran
+	tried     map[string]bool               // by verdict key: looked at since this process started
+	epoch     uint64                        // changes of the nodes seen since this process started
+	nodesFail map[string]uint64             // by verdict key: the epoch a failure of the nodes was written at
+}
+
+func (ch *Checker) init() {
+	ch.once.Do(func() {
+		limit := ch.Limit
+		if limit <= 0 {
+			limit = 2
+		}
+		ch.sem = make(chan struct{}, limit)
+		ch.known, ch.inflight, ch.again, ch.tried = map[string]delivery.Candidate{}, map[string]bool{}, map[string]bool{}, map[string]bool{}
+		ch.nodesFail = map[string]uint64{}
+	})
+}
+
+func (ch *Checker) logf(format string, args ...any) {
+	if ch.Logf != nil {
+		ch.Logf(format, args...)
+	}
+}
+
+func (ch *Checker) now() time.Time {
+	if ch.Now != nil {
+		return ch.Now()
+	}
+	return time.Now()
+}
+
+func (ch *Checker) bound() time.Duration {
+	if ch.Bound > 0 {
+		return ch.Bound
+	}
+	return DefaultBound
+}
+
+// Wait returns when every check started so far has ended.
+func (ch *Checker) Wait() { ch.wg.Wait() }
+
+// Candidate takes one value of the indexer's candidates bucket in (the key is the group) and checks it if it is to be
+// checked. A value that is not a candidate is said and left.
+func (ch *Checker) Candidate(ctx context.Context, key string, value []byte) {
+	ch.init()
+	c, err := delivery.DecodeCandidate(value)
+	if err != nil {
+		ch.logf("candidates.%s holds what is not a candidate, left: %v", key, err)
+		return
+	}
+	ch.mu.Lock()
+	ch.known[key] = c
+	ch.mu.Unlock()
+	ch.consider(ctx, key, c)
+}
+
+// Forget takes a candidate out (its key was deleted).
+func (ch *Checker) Forget(key string) {
+	ch.init()
+	ch.mu.Lock()
+	delete(ch.known, key)
+	ch.mu.Unlock()
+}
+
+// NodesChanged is Reconsider after a change of the nodes: one came online or went, a build module became healthy or
+// stopped being, or a toolchain moved. A check that failed because no node qualified is run again only after such a change.
+func (ch *Checker) NodesChanged(ctx context.Context) {
+	ch.init()
+	ch.mu.Lock()
+	ch.epoch++
+	ch.mu.Unlock()
+	ch.Reconsider(ctx)
+}
+
+// Reconsider looks at every candidate again: the trunk moved, the nodes changed or a delivery ended. A candidate whose
+// verdict stands for the trunk it was judged against is left.
+func (ch *Checker) Reconsider(ctx context.Context) {
+	ch.init()
+	ch.mu.Lock()
+	known := make(map[string]delivery.Candidate, len(ch.known))
+	for k, c := range ch.known {
+		known[k] = c
+	}
+	ch.mu.Unlock()
+	for k, c := range known {
+		ch.consider(ctx, k, c)
+	}
+}
+
+func (ch *Checker) heads() map[string]string {
+	if ch.Trunks == nil {
+		return nil
+	}
+	return ch.Trunks.Heads()
+}
+
+func (ch *Checker) consider(ctx context.Context, key string, c delivery.Candidate) {
+	cs := CaseOf(c, ch.heads())
+	if cs == nil {
+		return // nothing to judge: hq's pull requests, or no trunk known
+	}
+	if ch.Hold != nil && ch.Hold() {
+		ch.logf("%s: not started, a delivery builds", cs.Key)
+		return // started when the plan bucket empties (Reconsider)
+	}
+	cs.Queued = ch.now()
+	ch.mu.Lock()
+	if ch.inflight[cs.Key] {
+		ch.again[cs.Key] = true // looked at once more when the check ends, so a change of the trunk is never lost
+		ch.mu.Unlock()
+		return
+	}
+	ch.inflight[cs.Key] = true
+	ch.mu.Unlock()
+	ch.wg.Add(1)
+	go func() {
+		defer ch.wg.Done()
+		ch.sem <- struct{}{}
+		defer func() { <-ch.sem }()
+		for {
+			ch.try(ctx, key, cs)
+			ch.mu.Lock()
+			more := ch.again[cs.Key]
+			delete(ch.again, cs.Key)
+			if !more || ctx.Err() != nil {
+				delete(ch.inflight, cs.Key)
+				ch.mu.Unlock()
+				return
+			}
+			ch.mu.Unlock()
+			if next := CaseOf(ch.candidate(key, c), ch.heads()); next != nil {
+				cs = next
+			}
+		}
+	}()
+}
+
+func (ch *Checker) candidate(key string, fallback delivery.Candidate) delivery.Candidate {
+	ch.mu.Lock()
+	defer ch.mu.Unlock()
+	if c, ok := ch.known[key]; ok {
+		return c
+	}
+	return fallback
+}
+
+// claimed is a verdict key the checker holds: the revision the next write is made at.
+type claimed struct{ rev uint64 }
+
+// claim takes the check of the case, or answers nil when it is not this checker's to run now:
+//   - no key: it is created running; a create that finds the key made meanwhile gets nothing;
+//   - a key left running is taken over as it stands when this process looks at it for the first time (it was left by the
+//     checker that stopped; there is one instance, as there is one builder per node, ADR 0478 clause 6), and left otherwise;
+//   - a pass or a failure for the trunk heads the case has stands; one for other trunk heads (the trunk moved) is taken
+//     again by compare-and-set on the same key, and so is a failure of the nodes after the nodes changed.
+func (ch *Checker) claim(ctx context.Context, cs *Case, first bool, epoch uint64) (*claimed, error) {
+	running := delivery.Verdict{Group: cs.Group, Heads: cs.HeadsHash, Trunk: cs.Trunk, State: delivery.VerdictRunning}
+	data, err := delivery.EncodeVerdict(running)
+	if err != nil {
+		return nil, err
+	}
+	value, rev, found, err := ch.Verdicts.Get(ctx, cs.Key)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", cs.Key, err)
+	}
+	if !found {
+		rev, err := ch.Verdicts.Create(ctx, cs.Key, data)
+		if errors.Is(err, ErrConflict) {
+			return nil, nil // another checker made it first
+		}
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", cs.Key, err)
+		}
+		return &claimed{rev}, nil
+	}
+	cur, err := delivery.DecodeVerdict(value)
+	if err != nil {
+		return nil, fmt.Errorf("%s holds what is not a verdict: %w", cs.Key, err)
+	}
+	retake := false
+	switch {
+	case cur.State == delivery.VerdictRunning:
+		if first {
+			return &claimed{rev}, nil
+		}
+		return nil, nil
+	case !sameTrunk(cur.Trunk, cs.Trunk):
+		retake = true
+	case cur.State == delivery.VerdictFail && IsNodesFailure(cur):
+		ch.mu.Lock()
+		at, ok := ch.nodesFail[cs.Key]
+		ch.mu.Unlock()
+		retake = !ok || epoch > at
+	}
+	if !retake {
+		return nil, nil
+	}
+	rev, err = ch.Verdicts.Update(ctx, cs.Key, data, rev)
+	if errors.Is(err, ErrConflict) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", cs.Key, err)
+	}
+	return &claimed{rev}, nil
+}
+
+// IsNodesFailure says whether a verdict failed because no build node could take the check.
+func IsNodesFailure(v delivery.Verdict) bool {
+	return v.State == delivery.VerdictFail && strings.Contains(v.Failed.Words, NodesWords)
+}
+
+// try claims the check, judges it within its bound and writes the verdict and the owed statuses. A check that ends
+// because ctx did is left running: the checker takes it again when it starts.
+func (ch *Checker) try(ctx context.Context, key string, cs *Case) {
+	ch.mu.Lock()
+	first := !ch.tried[cs.Key]
+	ch.tried[cs.Key] = true
+	epoch := ch.epoch
+	ch.mu.Unlock()
+	cl, err := ch.claim(ctx, cs, first, epoch)
+	if err != nil {
+		ch.logf("%s: %v", cs.Key, err)
+		return
+	}
+	if cl == nil {
+		return
+	}
+	began := ch.now()
+	ch.writeOwed(ctx, cs, delivery.Verdict{State: delivery.VerdictRunning}, nil, nil)
+	out := ch.judge(ctx, cs)
+	if ctx.Err() != nil {
+		return
+	}
+	v := out.Verdict
+	v.Group, v.Heads, v.Trunk = cs.Group, cs.HeadsHash, cs.Trunk
+	if v.Took.Queue == 0 && !cs.Queued.IsZero() && began.After(cs.Queued) {
+		v.Took.Queue = began.Sub(cs.Queued).Milliseconds()
+	}
+	data, err := delivery.EncodeVerdict(v)
+	if err != nil {
+		ch.logf("%s: the verdict cannot be written: %v", cs.Key, err)
+		v = delivery.Verdict{Group: cs.Group, Heads: cs.HeadsHash, Trunk: cs.Trunk, State: delivery.VerdictFail,
+			Failed: delivery.FailedFirst{Machine: "checker", Words: "the verdict could not be written: " + err.Error()}}
+		if data, err = delivery.EncodeVerdict(v); err != nil {
+			return
+		}
+	}
+	if _, err := ch.Verdicts.Update(ctx, cs.Key, data, cl.rev); err != nil {
+		ch.logf("%s: the verdict could not be written: %v", cs.Key, err)
+		return
+	}
+	if IsNodesFailure(v) {
+		ch.mu.Lock()
+		ch.nodesFail[cs.Key] = epoch
+		ch.mu.Unlock()
+	}
+	ch.writeOwed(ctx, cs, v, out.Builds, out.Slowest)
+	ch.logf("%s: %s", cs.Key, v.State)
+}
+
+// judge runs the case within the bound. A judge that fails to judge, and a check that ran past its bound, are verdicts of
+// failure naming the machine and the step.
+func (ch *Checker) judge(ctx context.Context, cs *Case) Outcome {
+	bound := ch.bound()
+	run, cancel := context.WithTimeoutCause(ctx, bound, errBound)
+	defer cancel()
+	out, err := ch.Judge.Judge(run, cs)
+	stage, node := cs.Progress.Now()
+	if node == "" {
+		node = "checker"
+	}
+	switch {
+	case ctx.Err() != nil:
+		return Outcome{}
+	case context.Cause(run) == errBound:
+		if stage == "" {
+			stage = "starting"
+		}
+		return Outcome{Verdict: failure(node, fmt.Sprintf("the check ran past its bound of %s, stuck at: %s", bound, stage))}
+	case err != nil:
+		return Outcome{Verdict: failure(node, err.Error())}
+	}
+	return out
+}
+
+var errBound = errors.New("the check ran past its bound")
+
+func failure(machine, words string) delivery.Verdict {
+	return delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: machine, Words: words}}
+}
+
+// writeOwed writes, for each pull request judged, the status the forge bridge performs: pending while the check runs, success
+// or failure at its end (ADR 0484 clause 2). A key already holding the same value is not written again, so the bridge
+// performs one act for each change; an older head's key is never touched.
+func (ch *Checker) writeOwed(ctx context.Context, cs *Case, v delivery.Verdict, builds []BuildNote, slowest []string) {
+	for _, p := range cs.Pulls {
+		key, err := delivery.CheckerOwedKey(p.Repository, p.Number, p.Head)
+		if err != nil {
+			ch.logf("%s: %v", cs.Key, err)
+			continue
+		}
+		state := map[string]string{delivery.VerdictRunning: "pending", delivery.VerdictPass: "success", delivery.VerdictFail: "failure"}[v.State]
+		o := delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: state,
+			Target: strings.TrimSuffix(ch.Link, "/") + "/" + cs.Key, Text: Line(v, cs, p, builds, slowest)}
+		data, err := delivery.EncodeCheckerOwed(o)
+		if err != nil {
+			ch.logf("%s: the status of %s cannot be written: %v", cs.Key, key, err)
+			continue
+		}
+		wrote, err := putOnce(ctx, ch.Owed, key, data, func(cur []byte) bool {
+			held, err := delivery.DecodeCheckerOwed(cur)
+			o.V = delivery.Version
+			return err == nil && delivery.SameOwed(held, o)
+		})
+		if err != nil {
+			ch.logf("%s: the status of %s cannot be written: %v", cs.Key, key, err)
+		} else if wrote && ch.Announce != nil {
+			ch.Announce(ctx, EventOwedWritten, key)
+		}
+	}
+}
+
+// putOnce writes data under key by create, or by compare-and-set when the key exists, and writes nothing when same says the
+// key holds the value already.
+func putOnce(ctx context.Context, kv KV, key string, data []byte, same func(cur []byte) bool) (bool, error) {
+	for try := 0; try < 4; try++ {
+		cur, rev, found, err := kv.Get(ctx, key)
+		if err != nil {
+			return false, err
+		}
+		if found && same(cur) {
+			return false, nil
+		}
+		if !found {
+			_, err = kv.Create(ctx, key, data)
+		} else {
+			_, err = kv.Update(ctx, key, data, rev)
+		}
+		if errors.Is(err, ErrConflict) {
+			continue
+		}
+		return err == nil, err
+	}
+	return false, fmt.Errorf("%s changed under every one of 4 tries", key)
+}
+
+// Sweep closes, at start, every verdict left running for a candidate that no longer holds those heads: nothing will check
+// them again, and the key would stay running for ever (the builder's Sweep, issue 1660). Call it once the candidates have been
+// read. A key of heads a candidate holds now is not touched: the check takes it over.
+func (ch *Checker) Sweep(ctx context.Context) error {
+	ch.init()
+	keys, err := ch.Verdicts.Keys(ctx)
+	if err != nil {
+		return err
+	}
+	ch.mu.Lock()
+	current := map[string]bool{}
+	for _, c := range ch.known {
+		if k, err := delivery.CheckerVerdictKey(c.Group, c.HeadsHash); err == nil {
+			current[k] = true
+		}
+	}
+	ch.mu.Unlock()
+	for _, key := range keys {
+		if current[key] {
+			continue
+		}
+		value, rev, found, err := ch.Verdicts.Get(ctx, key)
+		if err != nil || !found {
+			continue
+		}
+		cur, err := delivery.DecodeVerdict(value)
+		if err != nil || cur.State != delivery.VerdictRunning {
+			continue
+		}
+		cur.State = delivery.VerdictFail
+		cur.Failed = delivery.FailedFirst{Machine: "checker", Words: "closed at start: left running, and no candidate holds these heads any more, so nothing will check them"}
+		data, err := delivery.EncodeVerdict(cur)
+		if err != nil {
+			return err
+		}
+		if _, err := ch.Verdicts.Update(ctx, key, data, rev); err != nil && !errors.Is(err, ErrConflict) {
+			return fmt.Errorf("%s: %w", key, err)
+		}
+		ch.logf("%s: closed, left running for heads no candidate holds", key)
+	}
+	return nil
+}

modules/mesh-delivery-checker/internal/check/checker_test.go

@@ -0,0 +1,387 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const (
+	repoA   = "novox/mesh-delivery"
+	repoSDK = "novox/mesh-sdk"
+	head1   = "1111111111111111111111111111111111111111"
+	head2   = "2222222222222222222222222222222222222222"
+	trunkA  = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	trunkA2 = "abababababababababababababababababababab"
+	trunkS  = "5555555555555555555555555555555555555555"
+)
+
+// candidateOf is a candidate of a group with the given pull requests, as the indexer writes one.
+func candidateOf(t testing.TB, group string, pulls ...delivery.CandidatePull) []byte {
+	t.Helper()
+	heads := make([]delivery.Head, len(pulls))
+	for i, p := range pulls {
+		heads[i] = p.Head
+	}
+	hash, err := delivery.HeadsHash(heads)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := delivery.Candidate{V: delivery.Version, Group: group, HeadsHash: hash, Pulls: pulls, FPSet: delivery.FingerprintSet(pulls)}
+	data, err := delivery.EncodeCandidate(c)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
+
+func pullOf(repo string, number int, head string) delivery.CandidatePull {
+	return delivery.CandidatePull{Head: delivery.Head{Repository: repo, Number: number, Head: head}, Modules: []string{}}
+}
+
+// judgeFunc is a Judge written as a function; it counts its calls.
+type judgeFunc struct {
+	mu    sync.Mutex
+	calls int
+	f     func(ctx context.Context, c *Case, call int) (Outcome, error)
+}
+
+func (j *judgeFunc) Judge(ctx context.Context, c *Case) (Outcome, error) {
+	j.mu.Lock()
+	j.calls++
+	n := j.calls
+	j.mu.Unlock()
+	return j.f(ctx, c, n)
+}
+
+func (j *judgeFunc) count() int { j.mu.Lock(); defer j.mu.Unlock(); return j.calls }
+
+func passing() delivery.Verdict {
+	return delivery.Verdict{State: delivery.VerdictPass, Levels: map[string]delivery.LevelResult{
+		delivery.LevelUnit: {Run: 2, Kept: 3}, delivery.LevelIntegration: {Run: 1}}}
+}
+
+func passJudge() *judgeFunc {
+	return &judgeFunc{f: func(context.Context, *Case, int) (Outcome, error) { return Outcome{Verdict: passing()}, nil }}
+}
+
+type rig struct {
+	ch       *Checker
+	verdicts *memKV
+	owed     *memKV
+	trunks   *Trunks
+}
+
+func newRig(t testing.TB, j Judge) *rig {
+	t.Helper()
+	r := &rig{verdicts: newMemKV(), owed: newMemKV(), trunks: &Trunks{}}
+	r.setTrunks(t, map[string]string{repoA: trunkA, repoSDK: trunkS})
+	r.ch = &Checker{Verdicts: r.verdicts, Owed: r.owed, Judge: j, Trunks: r.trunks, Link: "https://view.invalid/checks", Now: time.Now}
+	return r
+}
+
+func (r *rig) setTrunks(t testing.TB, heads map[string]string) bool {
+	t.Helper()
+	data, err := delivery.EncodeSource(delivery.Source{Group: "g", Heads: heads})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return r.trunks.Put(data, false)
+}
+
+func (r *rig) verdict(t testing.TB, key string) delivery.Verdict {
+	t.Helper()
+	raw, _, found, _ := r.verdicts.Get(context.Background(), key)
+	if !found {
+		t.Fatalf("no verdict %s; the bucket holds %v", key, r.verdicts.vals)
+	}
+	v, err := delivery.DecodeVerdict(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+func keyOf(t testing.TB, group string, value []byte) string {
+	t.Helper()
+	c, err := delivery.DecodeCandidate(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k, err := delivery.CheckerVerdictKey(group, c.HeadsHash)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return k
+}
+
+func TestACandidateNotYetCheckedGetsItsVerdictKeyCreatedOnceAndIsJudged(t *testing.T) { // N6/AC1, 1678
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	key := keyOf(t, "feat/x", cand)
+	if v := r.verdict(t, key); v.State != delivery.VerdictPass || v.Group != "feat/x" || v.Trunk[repoA] != trunkA {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if r.verdicts.creates[key] != 1 || j.count() != 1 {
+		t.Errorf("creates = %d, judged = %d, want one each", r.verdicts.creates[key], j.count())
+	}
+	// The same candidate heard again, with nothing changed, is not judged again.
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Errorf("judged %d times after the same candidate again, want once", j.count())
+	}
+}
+
+// racyKV lets another instance create the key just before this one's create.
+type racyKV struct {
+	*memKV
+	other []byte
+}
+
+func (r racyKV) Create(ctx context.Context, key string, value []byte) (uint64, error) {
+	if r.other != nil {
+		_, _ = r.memKV.Create(ctx, key, r.other)
+	}
+	return r.memKV.Create(ctx, key, value)
+}
+
+func TestASecondInstancesCreateIsRefusedAndItDoesNothing(t *testing.T) { // N6/AC1
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	key := keyOf(t, "feat/x", cand)
+	other, _ := delivery.EncodeVerdict(delivery.Verdict{Group: "feat/x", Heads: strings.SplitN(key, ".", 2)[1], State: delivery.VerdictRunning})
+	r.ch.Verdicts = racyKV{r.verdicts, other}
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	if j.count() != 0 {
+		t.Errorf("the instance that lost the create judged %d times, want none", j.count())
+	}
+	if v := r.verdict(t, key); v.State != delivery.VerdictRunning {
+		t.Errorf("the other instance's key was changed: %+v", v)
+	}
+}
+
+func TestARestartWithARunningKeyJudgesItAgain(t *testing.T) { // N6/AC2
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	key := keyOf(t, "feat/x", cand)
+	left, _ := delivery.EncodeVerdict(delivery.Verdict{Group: "feat/x", Heads: strings.SplitN(key, ".", 2)[1], Trunk: map[string]string{repoA: trunkA}, State: delivery.VerdictRunning})
+	if _, err := r.verdicts.Create(ctx, key, left); err != nil {
+		t.Fatal(err)
+	}
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	if j.count() != 1 || r.verdict(t, key).State != delivery.VerdictPass {
+		t.Fatalf("judged %d times, verdict %+v, want the left check judged once and passed", j.count(), r.verdict(t, key))
+	}
+}
+
+func TestACheckPastItsBoundFailsNamingTheStuckStep(t *testing.T) { // N6/AC3
+	ctx := context.Background()
+	j := &judgeFunc{f: func(ctx context.Context, c *Case, _ int) (Outcome, error) {
+		c.Progress.Set("test the unit level of mesh-delivery", "shanks")
+		<-ctx.Done()
+		return Outcome{}, ctx.Err()
+	}}
+	r := newRig(t, j)
+	r.ch.Bound = 30 * time.Millisecond
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	v := r.verdict(t, keyOf(t, "feat/x", cand))
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "shanks" || !strings.Contains(v.Failed.Words, "stuck at: test the unit level of mesh-delivery") {
+		t.Fatalf("verdict = %+v, want a failure naming shanks and the stuck step", v)
+	}
+}
+
+func TestNoQualifyingNodeFailsWithTheReasonAndIsJudgedAgainWhenTheNodesChange(t *testing.T) { // N6/AC4
+	ctx := context.Background()
+	j := &judgeFunc{f: func(_ context.Context, _ *Case, n int) (Outcome, error) {
+		if n == 1 {
+			return Outcome{Verdict: failure("shanks", "no go "+NodesWords+": none is online")}, nil
+		}
+		return Outcome{Verdict: passing()}, nil
+	}}
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	key := keyOf(t, "feat/x", cand)
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	if v := r.verdict(t, key); !IsNodesFailure(v) {
+		t.Fatalf("verdict = %+v, want a failure of the nodes", v)
+	}
+	r.ch.Reconsider(ctx) // nothing changed: not judged again
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Fatalf("judged %d times with the nodes unchanged, want once", j.count())
+	}
+	r.ch.NodesChanged(ctx)
+	r.ch.Wait()
+	if j.count() != 2 || r.verdict(t, key).State != delivery.VerdictPass {
+		t.Fatalf("after the nodes changed: judged %d times, verdict %+v", j.count(), r.verdict(t, key))
+	}
+}
+
+func TestHqAndARepositoryWithNoTrunkGetNoVerdict(t *testing.T) { // N6/AC6, ADR 0484 clauses 8 and 11
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	r.ch.Candidate(ctx, "feat/hq", candidateOf(t, "feat/hq", pullOf(HQRepository, 3, head1)))
+	r.ch.Candidate(ctx, "feat/y", candidateOf(t, "feat/y", pullOf("novox/unknown", 4, head1)))
+	r.ch.Wait()
+	if j.count() != 0 || len(r.verdicts.vals) != 0 || len(r.owed.vals) != 0 {
+		t.Errorf("judged %d times, %d verdicts, %d statuses, want none", j.count(), len(r.verdicts.vals), len(r.owed.vals))
+	}
+}
+
+func TestAGroupWithHqJudgesItsOtherMembersAndWritesNoStatusForHq(t *testing.T) { // ADR 0484 clause 8
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	r.ch.Candidate(ctx, "feat/x", candidateOf(t, "feat/x", pullOf(HQRepository, 3, head1), pullOf(repoA, 7, head2)))
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Fatalf("judged %d times, want once", j.count())
+	}
+	keys, _ := r.owed.Keys(ctx)
+	if len(keys) != 1 || !strings.HasPrefix(keys[0], "novox/mesh-delivery.7.") && !strings.Contains(keys[0], "mesh-delivery") {
+		t.Errorf("statuses %v, want one for mesh-delivery#7 only", keys)
+	}
+}
+
+func TestATrunkMoveRewritesTheSameVerdictKeyAndTheHeadsStatus(t *testing.T) { // 1300/AC7
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	key := keyOf(t, "feat/x", cand)
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	_, rev1, _, _ := r.verdicts.Get(ctx, key)
+	owedKey, _ := delivery.CheckerOwedKey(repoA, 7, head1)
+	_, orev1, _, _ := r.owed.Get(ctx, owedKey)
+	if !r.setTrunks(t, map[string]string{repoA: trunkA2, repoSDK: trunkS}) {
+		t.Fatal("the trunks did not change")
+	}
+	r.ch.Reconsider(ctx)
+	r.ch.Wait()
+	_, rev2, _, _ := r.verdicts.Get(ctx, key)
+	if j.count() != 2 || rev2 <= rev1 || r.verdict(t, key).Trunk[repoA] != trunkA2 {
+		t.Fatalf("judged %d times, revisions %d then %d, trunk %v", j.count(), rev1, rev2, r.verdict(t, key).Trunk)
+	}
+	if r.verdicts.creates[key] != 1 {
+		t.Errorf("the key was created %d times, want the same key rewritten", r.verdicts.creates[key])
+	}
+	if _, orev2, _, _ := r.owed.Get(ctx, owedKey); orev2 <= orev1 {
+		// the line is the same when nothing differs; the status is rewritten when the words change, here the trunk is in them
+		t.Logf("the status keeps revision %d (its words did not change)", orev2)
+	}
+	// A new head is another key, and the older head's status is not touched.
+	older, _, _, _ := r.owed.Get(ctx, owedKey)
+	cand2 := candidateOf(t, "feat/x", pullOf(repoA, 7, head2))
+	r.ch.Candidate(ctx, "feat%2Fx", cand2)
+	r.ch.Wait()
+	if again, _, _, _ := r.owed.Get(ctx, owedKey); string(again) != string(older) {
+		t.Errorf("the older head's status was rewritten")
+	}
+	if n := len(r.owed.vals); n != 2 {
+		t.Errorf("%d statuses, want one for each head", n)
+	}
+}
+
+func TestNoCheckStartsWhileADeliveryBuildsAndOneStartsWhenItEnds(t *testing.T) { // N8/AC1
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	held := true
+	r.ch.Hold = func() bool { return held }
+	r.ch.Candidate(ctx, "feat/x", candidateOf(t, "feat/x", pullOf(repoA, 7, head1)))
+	r.ch.Wait()
+	if j.count() != 0 {
+		t.Fatalf("judged %d times while held", j.count())
+	}
+	held = false
+	r.ch.Reconsider(ctx)
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Fatalf("judged %d times after the hold ended, want once", j.count())
+	}
+}
+
+func TestTheStatusIsPendingWhileTheCheckRunsAndEndsSuccessOrFailure(t *testing.T) { // 1300/AC5 (unit part)
+	ctx := context.Background()
+	var seen []string
+	var r *rig
+	j := &judgeFunc{f: func(ctx context.Context, c *Case, _ int) (Outcome, error) {
+		key, _ := delivery.CheckerOwedKey(repoA, 7, head1)
+		raw, _, _, _ := r.owed.Get(ctx, key)
+		o, _ := delivery.DecodeCheckerOwed(raw)
+		seen = append(seen, o.State)
+		return Outcome{Verdict: delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "m/a.TestX"}}}, nil
+	}}
+	r = newRig(t, j)
+	r.ch.Candidate(ctx, "feat/x", candidateOf(t, "feat/x", pullOf(repoA, 7, head1)))
+	r.ch.Wait()
+	key, _ := delivery.CheckerOwedKey(repoA, 7, head1)
+	raw, _, _, _ := r.owed.Get(ctx, key)
+	o, err := delivery.DecodeCheckerOwed(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(seen) != 1 || seen[0] != "pending" || o.State != "failure" || o.Context != delivery.StatusContextCheck || !strings.HasPrefix(o.Target, "https://view.invalid/checks/") {
+		t.Errorf("while running %v, at the end %+v", seen, o)
+	}
+}
+
+func TestSweepClosesARunningKeyNoCandidateHoldsAndLeavesOneItDoes(t *testing.T) {
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	live := keyOf(t, "feat/x", cand)
+	dead, _ := delivery.CheckerVerdictKey("feat/gone", "0123456789ab")
+	for _, k := range []string{live, dead} {
+		group, heads, _ := delivery.ParseCheckerVerdictKey(k)
+		raw, _ := delivery.EncodeVerdict(delivery.Verdict{Group: group, Heads: heads, State: delivery.VerdictRunning})
+		_, _ = r.verdicts.Create(ctx, k, raw)
+	}
+	r.ch.init()
+	var c delivery.Candidate
+	_ = json.Unmarshal(cand, &c)
+	r.ch.known["feat%2Fx"] = c
+	if err := r.ch.Sweep(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if v := r.verdict(t, dead); v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "closed at start") {
+		t.Errorf("the dead key = %+v", v)
+	}
+	if v := r.verdict(t, live); v.State != delivery.VerdictRunning {
+		t.Errorf("the live key = %+v, want it left for the check to take over", v)
+	}
+}
+
+func TestTheForgeBridgeIsToldOnceForEachChangeOfAStatus(t *testing.T) { // 1683 (the checker's half of AC5)
+	ctx, j := context.Background(), passJudge()
+	r := newRig(t, j)
+	var told []string
+	r.ch.Announce = func(_ context.Context, event, key string) { told = append(told, event+" "+key) }
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1))
+	r.ch.Candidate(ctx, "feat%2Fx", cand)
+	r.ch.Wait()
+	key, _ := delivery.CheckerOwedKey(repoA, 7, head1)
+	want := []string{EventOwedWritten + " " + key, EventOwedWritten + " " + key} // pending, then success
+	if len(told) != 2 || told[0] != want[0] || told[1] != want[1] {
+		t.Fatalf("told %v, want the status said when pending and when success", told)
+	}
+	r.ch.Candidate(ctx, "feat%2Fx", cand) // nothing changed: nothing written, nothing said
+	r.ch.Wait()
+	if len(told) != 2 {
+		t.Errorf("told %v after a check that changed nothing", told)
+	}
+}

modules/mesh-delivery-checker/internal/check/doc.go

@@ -0,0 +1,6 @@
+// Package check is the checker's logic (novox/hq ADR 0484, ADR 0453 clause 4, ADR 0447, ADR 0444), apart from the bus: the
+// claim of a verdict key, the judging of a pull request's head merged onto its trunk through the build modules' fetch,
+// digest and test steps, the kept verdicts, the line of the status and the act the forge bridge performs. The bus is
+// reached through the small interfaces here, so each part is tested with fakes. The checker runs dark: nothing reads its
+// answers to merge or deliver (ADR 0453 clause 4).
+package check

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -0,0 +1,587 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// captured reads a result the build module's own code marshalled (testdata/captured/README).
+func captured[T any](t testing.TB, name string) T {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "captured", name+".json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var v T
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+type stepCall struct {
+	module, node, tool string
+	args               map[string]any
+}
+
+// fakeSteps stands for the build modules: a handler for each tool answers what the module's code answers.
+type fakeSteps struct {
+	mu       sync.Mutex
+	calls    []stepCall
+	handlers map[string]func(c stepCall) (any, error)
+}
+
+func (f *fakeSteps) Run(_ context.Context, module, node, tool string, args map[string]any) (json.RawMessage, error) {
+	c := stepCall{module, node, tool, args}
+	f.mu.Lock()
+	f.calls = append(f.calls, c)
+	h := f.handlers[tool]
+	f.mu.Unlock()
+	if h == nil {
+		return nil, fmt.Errorf("the fake build module has no tool %s", tool)
+	}
+	v, err := h(c)
+	if err != nil {
+		return nil, err
+	}
+	return json.Marshal(v)
+}
+
+func (f *fakeSteps) tool(name string) []stepCall {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	var out []stepCall
+	for _, c := range f.calls {
+		if strings.HasSuffix(c.tool, "_"+name) {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+type entries []delivery.NodeToolchain
+
+func (e entries) Entries(language string) []delivery.NodeToolchain {
+	var out []delivery.NodeToolchain
+	for _, x := range e {
+		if x.Language == language {
+			out = append(out, x)
+		}
+	}
+	return out
+}
+
+type langs map[string][]string
+
+func (l langs) BuildModules(repository string) []string {
+	if m, ok := l[repository]; ok {
+		return m
+	}
+	return []string{buildrun.GoBuildModule}
+}
+
+func goEntries(nodes ...string) entries {
+	var e entries
+	for _, n := range nodes {
+		e = append(e, delivery.NodeToolchain{Node: n, Toolchain: delivery.Toolchain{Language: "go", Version: "go1.27.1", Recipe: "7"}})
+		e = append(e, delivery.NodeToolchain{Node: n, Toolchain: delivery.Toolchain{Language: "typescript", Version: "node24", Recipe: "3"}})
+	}
+	return e
+}
+
+const digC = "cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33cc33"
+const digD = "dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44dd44"
+
+type bench struct {
+	ex     *Examiner
+	steps  *fakeSteps
+	kept   *memKV
+	prev   *memKV
+	fetch  Fetched
+	digest map[string]Digested // by level
+	test   func(c stepCall) (any, error)
+}
+
+// newBench is an examiner over fake build modules that merge cleanly, digest the captured fixture's packages and pass
+// the captured slow fixture's result at both levels, on shanks.
+func newBench(t testing.TB) *bench {
+	b := &bench{steps: &fakeSteps{}, kept: newMemKV(), prev: newMemKV()}
+	b.fetch = captured[Fetched](t, "go-fetch-clean")
+	b.fetch.Modules, b.fetch.Changed, b.fetch.Trees = []string{"."}, []string{"README.md"}, nil
+	one := captured[Digested](t, "go-digest")
+	b.digest = map[string]Digested{
+		delivery.LevelUnit:        {Level: "unit", Packages: map[string]string{"fixture/slow": digA}},
+		delivery.LevelIntegration: {Level: "integration", Packages: map[string]string{"fixture/slow": digB}},
+	}
+	_ = one
+	slow := captured[Tested](t, "go-test-slow")
+	b.test = func(c stepCall) (any, error) {
+		r := slow
+		r.Level, _ = c.args["level"].(string)
+		return r, nil
+	}
+	b.steps.handlers = map[string]func(stepCall) (any, error){
+		"build_go_fetch":   func(stepCall) (any, error) { return b.fetch, nil },
+		"build_node_fetch": func(stepCall) (any, error) { return b.fetch, nil },
+		"build_go_digest":  func(c stepCall) (any, error) { return b.digest[c.args["level"].(string)], nil },
+		"build_go_test":    func(c stepCall) (any, error) { return b.test(c) },
+		"build_node_test":  func(c stepCall) (any, error) { return b.test(c) },
+	}
+	now := time.Date(2026, 10, 21, 19, 0, 0, 0, time.UTC)
+	b.ex = &Examiner{Steps: b.steps, Toolchains: goEntries("shanks"), Places: &buildrun.Places{}, Kept: Kept{Store: b.kept}, Previews: b.prev,
+		Modules: langs{}, Trunks: &Trunks{}, Now: func() time.Time { now = now.Add(50 * time.Millisecond); return now }}
+	return b
+}
+
+func caseOf(t testing.TB, pulls ...delivery.CandidatePull) *Case {
+	t.Helper()
+	raw := candidateOf(t, "feat/x", pulls...)
+	c, err := delivery.DecodeCandidate(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cs := CaseOf(c, map[string]string{repoA: trunkA, repoSDK: trunkS, "novox/mesh-controller": trunkA, "novox/mesh-catalog": trunkA})
+	if cs == nil {
+		t.Fatal("no case")
+	}
+	return cs
+}
+
+func (b *bench) judge(t testing.TB, cs *Case) Outcome {
+	t.Helper()
+	out, err := b.ex.Judge(context.Background(), cs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+func testedWith(t testing.TB, name string, edit func(*Tested)) Tested {
+	r := captured[Tested](t, name)
+	if edit != nil {
+		edit(&r)
+	}
+	return r
+}
+
+func packagesOf(c stepCall) []string {
+	var out []string
+	if l, ok := c.args["packages"].([]string); ok {
+		out = l
+	}
+	return out
+}
+
+func TestACleanMergeIsFetchedAtItsTrunkAndBothLevelsPass(t *testing.T) { // 1679/AC1
+	b := newBench(t)
+	cs := caseOf(t, pullOf(repoA, 7, head1))
+	out := b.judge(t, cs)
+	v := out.Verdict
+	if v.State != delivery.VerdictPass || v.Levels[delivery.LevelUnit].Run != 2 || v.Levels[delivery.LevelIntegration].Run != 2 {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if v.Composition == nil || v.Composition.State != delivery.CompositionNotRun {
+		t.Errorf("composition = %+v, want not run", v.Composition)
+	}
+	if len(v.Machines) != 1 || v.Machines[0] != "shanks" {
+		t.Errorf("machines = %v", v.Machines)
+	}
+	fetch := b.steps.tool("fetch")
+	if len(fetch) != 1 || fetch[0].args["repository"] != repoA || fetch[0].args["commit"] != head1 || fetch[0].args["base"] != trunkA || fetch[0].args["ref"] != "refs/pull/7/head" {
+		t.Fatalf("fetch calls = %+v", fetch)
+	}
+	if v.Took.Clone <= 0 || v.Took.Unit <= 0 {
+		t.Errorf("took = %+v, want the clone and the unit level timed", v.Took)
+	}
+	// What passed is kept under each level's digest.
+	for _, k := range []string{"unit." + digA, "integration." + digB} {
+		if _, _, found, _ := b.kept.Get(context.Background(), k); !found {
+			t.Errorf("%s was not kept", k)
+		}
+	}
+}
+
+func TestOnlyThePackageWithoutAKeptVerdictRuns(t *testing.T) { // 1288/AC1
+	b := newBench(t)
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"fixture/slow": digA, "fixture/other": digC}}
+	if _, err := (Kept{Store: b.kept}).Keep(context.Background(), "unit", digC, keptValue("fixture/other", 40)); err != nil {
+		t.Fatal(err)
+	}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	tests := b.steps.tool("test")
+	if len(tests) != 2 || strings.Join(packagesOf(tests[0]), ",") != "fixture/slow" || tests[0].args["level"] != "unit" {
+		t.Fatalf("test calls = %+v, want the unit level of fixture/slow alone, then the integration level", tests)
+	}
+	if u := out.Verdict.Levels[delivery.LevelUnit]; u.Run != 2 || u.Kept != 40 {
+		t.Errorf("unit = %+v, want 2 run and 40 kept", u)
+	}
+}
+
+func TestAReAskRunsOnlyWhatFailedAndWhatChanged(t *testing.T) { // 1288/AC2, AC3
+	b := newBench(t)
+	failing := captured[Tested](t, "go-test-failing")
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"fixture/failing/bad": digA, "fixture/failing/good": digB}}
+	b.test = func(c stepCall) (any, error) {
+		if c.args["level"] == "unit" {
+			return failing, nil
+		}
+		return captured[Tested](t, "go-test-slow"), nil
+	}
+	cs := caseOf(t, pullOf(repoA, 7, head1))
+	first := b.judge(t, cs).Verdict
+	if first.State != delivery.VerdictFail || first.Failed.Test != "unit: fixture/failing/bad.TestThreeIsFour" {
+		t.Fatalf("first = %+v", first)
+	}
+	if _, _, found, _ := b.kept.Get(context.Background(), "unit."+digB); !found {
+		t.Fatal("the package that passed in the failing run was not kept")
+	}
+	if _, _, found, _ := b.kept.Get(context.Background(), "unit."+digA); found {
+		t.Fatal("the package that failed was kept")
+	}
+	// Asked again with nothing changed: only the failed package runs; the good one is taken.
+	b.steps.calls = nil
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	tests := b.steps.tool("test")
+	if len(tests) == 0 || strings.Join(packagesOf(tests[0]), ",") != "fixture/failing/bad" {
+		t.Fatalf("the re-ask ran %+v, want only fixture/failing/bad", tests)
+	}
+	// The trunk moved and one digest changed: that package runs, the unchanged one is taken.
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"fixture/failing/bad": digA, "fixture/failing/good": digD}}
+	b.steps.calls = nil
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	tests = b.steps.tool("test")
+	if got := strings.Join(packagesOf(tests[0]), ","); got != "fixture/failing/bad,fixture/failing/good" && got != "fixture/failing/good,fixture/failing/bad" {
+		t.Errorf("after a digest changed the run was %q, want the failed package and the changed one", got)
+	}
+}
+
+func TestANodePackageIsNeverKeptAndRunsEveryCheck(t *testing.T) { // 1288/AC4, 1292/AC1
+	b := newBench(t)
+	b.ex.Modules = langs{repoA: {buildrun.NodeBuildModule}}
+	b.fetch = captured[Fetched](t, "node-fetch-clean")
+	b.test = func(c stepCall) (any, error) {
+		return Tested{Level: c.args["level"].(string), Module: "modules/m", Passed: true, Elapsed: 0.4, Bound: 5}, nil
+	}
+	cs := caseOf(t, pullOf(repoA, 7, head1))
+	for i := 0; i < 2; i++ {
+		v := b.judge(t, cs).Verdict
+		if v.State != delivery.VerdictPass || v.Levels[delivery.LevelUnit].Kept != 0 || v.Levels[delivery.LevelUnit].Run != 1 {
+			t.Fatalf("round %d: verdict = %+v", i, v)
+		}
+	}
+	if n := len(b.steps.tool("test")); n != 4 {
+		t.Errorf("%d node test calls in two checks, want 4 (both levels each time)", n)
+	}
+	if n := len(b.steps.tool("digest")); n != 0 {
+		t.Errorf("the node build module was asked for a digest %d times", n)
+	}
+	if keys, _ := b.kept.Keys(context.Background()); len(keys) != 0 {
+		t.Errorf("kept %v for a node package", keys)
+	}
+}
+
+func TestTheChangesOwnFailingTestRunsFirstAndNothingElseRuns(t *testing.T) { // 1289/AC1, AC2
+	b := newBench(t)
+	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
+	failing := captured[Tested](t, "go-test-failing")
+	b.test = func(c stepCall) (any, error) {
+		if got := packagesOf(c); len(got) == 1 && got[0] == "m/internal/b" {
+			return failing, nil
+		}
+		return captured[Tested](t, "go-test-slow"), nil
+	}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Test, "TestThreeIsFour") {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	tests := b.steps.tool("test")
+	if len(tests) != 1 || strings.Join(packagesOf(tests[0]), ",") != "m/internal/b" {
+		t.Fatalf("test calls = %+v, want only m/internal/b, once", tests)
+	}
+	if n := len(b.steps.tool("digest")); n != 1 {
+		t.Errorf("%d digest calls, want the unit level's alone (the check stopped)", n)
+	}
+	if out.Verdict.Composition == nil || out.Verdict.Composition.State != delivery.CompositionNotRun {
+		t.Errorf("composition = %+v", out.Verdict.Composition)
+	}
+}
+
+func TestTheChangesOwnPassingTestRunsFirstAndTheRestFollow(t *testing.T) { // 1289/AC3
+	b := newBench(t)
+	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go", "modules/m/internal/a/a.go"}
+	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if out.Verdict.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	var unit []string
+	for _, c := range b.steps.tool("test") {
+		if c.args["level"] == "unit" {
+			unit = append(unit, strings.Join(packagesOf(c), ","))
+		}
+	}
+	if strings.Join(unit, " | ") != "m/internal/b | m/internal/a" {
+		t.Errorf("the unit level ran %v, want the changed test's package first, then the rest", unit)
+	}
+}
+
+func TestAHeadThatDoesNotMergeEndsFailedNamingTheFilesAndRunsNoTest(t *testing.T) { // 1289/AC4
+	b := newBench(t)
+	b.fetch = captured[Fetched](t, "go-fetch-conflict")
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	f := out.Verdict.Failed
+	if out.Verdict.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, "files in conflict: a.go, sub/b.go") {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	if n := len(b.steps.tool("digest")) + len(b.steps.tool("test")); n != 0 {
+		t.Errorf("%d digest and test steps ran after a conflict", n)
+	}
+}
+
+func TestNoQualifyingNodeIsAFailureOfTheNodes(t *testing.T) { // N6/AC4
+	b := newBench(t)
+	b.ex.Toolchains = entries{}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if !IsNodesFailure(out.Verdict) {
+		t.Fatalf("verdict = %+v, want a failure of the nodes", out.Verdict)
+	}
+	b.ex.Toolchains = goEntries("shanks")
+	b.ex.Presence = offline{}
+	if out = b.judge(t, caseOf(t, pullOf(repoA, 7, head1))); !IsNodesFailure(out.Verdict) {
+		t.Fatalf("an offline node: verdict = %+v", out.Verdict)
+	}
+}
+
+type offline struct{}
+
+func (offline) Online(string) bool { return false }
+
+func TestAStepThatFailsIsAVerdictNamingTheNode(t *testing.T) {
+	b := newBench(t)
+	b.steps.handlers["build_go_fetch"] = func(stepCall) (any, error) { return nil, fmt.Errorf("the step failed: ssh refused") }
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if f := out.Verdict.Failed; out.Verdict.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, "ssh refused") {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+}
+
+func TestALevelWhoseDigestIsNotNamedRunsWholeAndKeepsNothing(t *testing.T) { // 1287/AC4
+	b := newBench(t)
+	b.steps.handlers["build_go_digest"] = func(stepCall) (any, error) { return nil, fmt.Errorf("go list failed") }
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if out.Verdict.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", out.Verdict)
+	}
+	tests := b.steps.tool("test")
+	if len(tests) != 2 || tests[0].args["packages"] != nil {
+		t.Errorf("test calls = %+v, want each level once, whole", tests)
+	}
+	if keys, _ := b.kept.Keys(context.Background()); len(keys) != 0 {
+		t.Errorf("kept %v with no digest", keys)
+	}
+}
+
+func TestALevelOverItsBoundIsNamedWithItsSlowestTestsAndKeepsItsVerdict(t *testing.T) { // 1300/AC3
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		return testedWith(t, "go-test-slow", func(r *Tested) {
+			r.Level = c.args["level"].(string)
+			r.OverBound = true
+			r.OverWhich = "run"
+			r.Elapsed = 7
+		}), nil
+	}
+	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	v := out.Verdict
+	if v.State != delivery.VerdictPass || strings.Join(v.OverBound, ",") != "unit,integration" {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if len(out.Slowest) == 0 || !strings.Contains(out.Slowest[0], "TestTakesAWhile") {
+		t.Errorf("slowest = %v", out.Slowest)
+	}
+}
+
+func TestSkippedTestsAreCountedPerLevel(t *testing.T) { // 1300/AC6, 1251
+	b := newBench(t)
+	b.test = func(c stepCall) (any, error) {
+		return testedWith(t, "go-test-slow", func(r *Tested) { r.Level = c.args["level"].(string); r.Skipped = 3 }), nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.Levels[delivery.LevelUnit].Skipped != 3 || v.Levels[delivery.LevelIntegration].Skipped != 3 {
+		t.Errorf("levels = %+v", v.Levels)
+	}
+}
+
+func TestAGroupIsOneVerdictAndEachMembersTestsReadTheOthersAtTheirHeads(t *testing.T) { // 1624/AC1
+	b := newBench(t)
+	cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
+	v := b.judge(t, cs).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	fetch := b.steps.tool("fetch")
+	if len(fetch) != 2 {
+		t.Fatalf("%d fetches, want one for each member", len(fetch))
+	}
+	var forA []BesideRef
+	for _, f := range fetch {
+		if f.args["repository"] == repoA {
+			forA, _ = f.args["beside"].([]BesideRef)
+		}
+	}
+	found := false
+	for _, r := range forA {
+		if r.Repository == repoSDK && r.Commit == head2 && r.Ref == "refs/pull/12/head" {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("mesh-delivery's tests were not given the SDK member at its head: %+v", forA)
+	}
+}
+
+func TestAnExaminerIsAJudgeOfTheChecker(t *testing.T) {
+	var _ Judge = (*Examiner)(nil)
+}
+
+const (
+	manA = "0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a"
+)
+
+func TestACleanMergeWritesItsPreviewWithTheTreesManifestsAndLocks(t *testing.T) { // 1445/AC1
+	b := newBench(t)
+	b.fetch.Trees = map[string]MergeTree{
+		"modules/avahi": {Tree: "7777777777777777777777777777777777777777", Manifest: manA, Locks: map[string]string{"go.sum": "ff00"}},
+		"modules/bare":  {Tree: "8888888888888888888888888888888888888888"}, // no manifest digest: left out
+	}
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	key, _ := delivery.PreviewKey(repoA, head1, trunkA)
+	raw, _, found, _ := b.prev.Get(context.Background(), key)
+	if !found {
+		t.Fatalf("no preview %s; the bucket holds %v", key, b.prev.vals)
+	}
+	pv, err := delivery.DecodePreview(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := pv.Modules["modules/avahi"]
+	if pv.Merge != b.fetch.Merge || pv.Trunk != trunkA || pv.Head != head1 || len(pv.Modules) != 1 || m.Tree != "7777777777777777777777777777777777777777" || m.Manifest != manA || m.Locks["go.sum"] != "ff00" {
+		t.Errorf("preview = %+v", pv)
+	}
+}
+
+func TestAHeadThatDoesNotMergeWritesAPreviewOfItsConflictsAlone(t *testing.T) { // 1445/AC5
+	b := newBench(t)
+	b.fetch = captured[Fetched](t, "go-fetch-conflict")
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	key, _ := delivery.PreviewKey(repoA, head1, trunkA)
+	raw, _, found, _ := b.prev.Get(context.Background(), key)
+	if !found {
+		t.Fatalf("no preview for a head that does not merge; the bucket holds %v", b.prev.vals)
+	}
+	pv, err := delivery.DecodePreview(raw)
+	if err != nil || strings.Join(pv.Conflicts, ",") != "a.go,sub/b.go" || pv.Merge != "" || len(pv.Modules) != 0 {
+		t.Errorf("preview = %+v, %v, want the files in conflict and no merge", pv, err)
+	}
+}
+
+func TestAPreviewIsWrittenOnceAndAnExistingKeyStands(t *testing.T) {
+	b := newBench(t)
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	b.fetch.Merge = "5656565656565656565656565656565656565656"
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	key, _ := delivery.PreviewKey(repoA, head1, trunkA)
+	if b.prev.creates[key] != 1 {
+		t.Errorf("the preview was created %d times, want once", b.prev.creates[key])
+	}
+	raw, _, _, _ := b.prev.Get(context.Background(), key)
+	if pv, _ := delivery.DecodePreview(raw); pv.Merge == b.fetch.Merge {
+		t.Error("the second merge commit replaced the first")
+	}
+}
+
+func TestTheIndexerIsToldOfAPreviewOnceWhenItIsCreated(t *testing.T) { // 1445/AC4 (the checker's half)
+	b := newBench(t)
+	var told []string
+	b.ex.Announce = func(_ context.Context, event, key string) { told = append(told, event+" "+key) }
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	key, _ := delivery.PreviewKey(repoA, head1, trunkA)
+	if len(told) != 1 || told[0] != EventPreviewWritten+" "+key {
+		t.Errorf("told %v, want once of %s", told, key)
+	}
+}
+
+type fakeBuilds map[string]delivery.BuilderBuild
+
+func (f fakeBuilds) Build(_ context.Context, module, fp2 string) (delivery.BuilderBuild, bool, error) {
+	b, ok := f[module+" "+fp2]
+	return b, ok, nil
+}
+
+func TestTheOutcomeSaysIfEachCandidatesModuleIsBuiltFailedOrWaiting(t *testing.T) { // N7/AC1 (the checker reads the builder's keys)
+	b := newBench(t)
+	fpA := "src2:" + strings.Repeat("a", 64)
+	fpB := "src2:" + strings.Repeat("b", 64)
+	fpC := "src2:" + strings.Repeat("c", 64)
+	b.ex.Builds = fakeBuilds{
+		"avahi " + fpA:      {State: delivery.BuildDone},
+		"mesh-tools " + fpB: {State: delivery.BuildFailed, Error: "boom"},
+		// netcheck has no key yet
+	}
+	p := pullOf(repoA, 7, head1)
+	p.Modules = []string{"avahi", "mesh-tools", "netcheck", "nofp"}
+	p.Fps = map[string]delivery.CandidateModule{"avahi": {FP2: fpA}, "mesh-tools": {FP2: fpB}, "netcheck": {FP2: fpC}, "nofp": {None2: "toolchain not yet reported"}}
+	out := b.judge(t, caseOf(t, p))
+	var got []string
+	for _, n := range out.Builds {
+		got = append(got, n.Module+" "+n.State)
+	}
+	if strings.Join(got, ", ") != "avahi built, mesh-tools failed, netcheck waiting" {
+		t.Errorf("builds = %v, want one note for each module that has a fingerprint, sorted", got)
+	}
+}
+
+// trunksOf are trunk heads of every repository, as the gate's source names them.
+func trunksOf(t *testing.T, heads map[string]string) *Trunks {
+	t.Helper()
+	data, err := delivery.EncodeSource(delivery.Source{Group: "g", Heads: heads})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tr := &Trunks{}
+	tr.Put(data, false)
+	return tr
+}
+
+func TestNothingIsKeptForAWorkspaceGivenSiblingsBeside(t *testing.T) { // review D1, ADR 0444, issue 1287
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{repoSDK: trunkS, "novox/mesh-catalog": trunkA})
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if got := len(b.steps.tool("fetch")); got != 1 || b.steps.tool("fetch")[0].args["beside"] == nil {
+		t.Fatalf("the fetch was not given siblings: %+v", b.steps.tool("fetch"))
+	}
+	if keys, _ := b.kept.Keys(context.Background()); len(keys) != 0 {
+		t.Errorf("kept %v for a package whose tests may read a sibling the digest does not cover", keys)
+	}
+	// And a kept verdict of the same digest from elsewhere is not taken for it: everything runs.
+	if _, err := (Kept{Store: b.kept}).Keep(context.Background(), "unit", digA, keptValue("fixture/slow", 2)); err != nil {
+		t.Fatal(err)
+	}
+	b.steps.calls = nil
+	b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
+	if n := len(b.steps.tool("test")); n != 2 {
+		t.Errorf("%d test steps, want both levels run whole", n)
+	}
+}

modules/mesh-delivery-checker/internal/check/fakes_test.go

@@ -0,0 +1,62 @@
+package check
+
+import (
+	"context"
+	"sort"
+	"sync"
+)
+
+// memKV is a bucket in memory with the revisions a real one gives.
+type memKV struct {
+	mu   sync.Mutex
+	vals map[string][]byte
+	revs map[string]uint64
+	next uint64
+	// creates counts the creates that succeeded, by key.
+	creates map[string]int
+}
+
+func newMemKV() *memKV {
+	return &memKV{vals: map[string][]byte{}, revs: map[string]uint64{}, creates: map[string]int{}}
+}
+
+func (m *memKV) Get(_ context.Context, key string) ([]byte, uint64, bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	v, ok := m.vals[key]
+	return v, m.revs[key], ok, nil
+}
+
+func (m *memKV) Create(_ context.Context, key string, value []byte) (uint64, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if _, ok := m.vals[key]; ok {
+		return 0, ErrConflict
+	}
+	m.next++
+	m.vals[key], m.revs[key] = append([]byte(nil), value...), m.next
+	m.creates[key]++
+	return m.next, nil
+}
+
+func (m *memKV) Update(_ context.Context, key string, value []byte, revision uint64) (uint64, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if _, ok := m.vals[key]; !ok || m.revs[key] != revision {
+		return 0, ErrConflict
+	}
+	m.next++
+	m.vals[key], m.revs[key] = append([]byte(nil), value...), m.next
+	return m.next, nil
+}
+
+func (m *memKV) Keys(context.Context) ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	keys := make([]string, 0, len(m.vals))
+	for k := range m.vals {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys, nil
+}

modules/mesh-delivery-checker/internal/check/heard.go

@@ -0,0 +1,101 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/nats-io/nats.go"
+)
+
+// Unheard is the error of a call that reached nobody: the bus had no responder for it, or none answered within the call's
+// bound. The step it asked for never began, so the same step may be asked of another node (issue 1820). The program wraps
+// the errors of its calls in it where the bus gives a timeout; a no-responders error is known as it is.
+type Unheard struct{ Err error }
+
+func (u *Unheard) Error() string { return u.Err.Error() }
+func (u *Unheard) Unwrap() error { return u.Err }
+
+// isUnheard says whether err is a call that reached nobody. A step that began and failed, or ended failed, is not.
+func isUnheard(err error) bool {
+	var u *Unheard
+	return errors.As(err, &u) || errors.Is(err, nats.ErrNoResponders)
+}
+
+// deafNode is a node that did not answer a build module's call during this judging.
+type deafNode struct{ node, why string }
+
+// markDeaf takes a node out of the choice for a build module for the rest of the judging.
+func (st *state) markDeaf(bm, node string, err error) {
+	if st.deaf == nil {
+		st.deaf = map[string][]deafNode{}
+	}
+	st.deaf[bm] = append(st.deaf[bm], deafNode{node, err.Error()})
+}
+
+func (st *state) isDeaf(bm, node string) bool {
+	for _, d := range st.deaf[bm] {
+		if d.node == node {
+			return true
+		}
+	}
+	return false
+}
+
+// triedWords names every node that did not answer a build module, with what the bus said.
+func (st *state) triedWords(bm string) string {
+	var parts []string
+	for _, d := range st.deaf[bm] {
+		parts = append(parts, fmt.Sprintf("%s (%s)", d.node, d.why))
+	}
+	return strings.Join(parts, "; ")
+}
+
+// moveStep is called when the target's node did not answer: the node is left out of the choice, and another build node of the
+// same build module takes the target's place. It answers an error naming every node tried when none is left (the words hold
+// NodesWords, so the verdict is judged again when the nodes change).
+func (st *state) moveStep(t *target, err error) error {
+	old := t.node
+	st.markDeaf(t.module, old, err)
+	node, _, cerr := st.choose(t.module)
+	if cerr != nil {
+		return fmt.Errorf("%s; tried: %s", cerr, st.triedWords(t.module))
+	}
+	st.j.logf("%s#%d: %s did not answer (%v), the step goes to %s", t.pull.Repository, t.pull.Number, old, err, node)
+	t.node = node
+	other := false
+	for _, o := range st.targets {
+		if o != t && o.node == old {
+			other = true
+		}
+	}
+	if !other {
+		delete(st.nodes, old)
+	}
+	st.nodes[node] = true
+	return nil
+}
+
+// refetch makes the target's workspace again on its new node: the workspace of a step that was lost is on the node that did
+// not answer.
+func (st *state) refetch(ctx context.Context, t *target) error {
+	raw, err := st.step(ctx, t, "fetch", fmt.Sprintf("fetch %s#%d on %s", t.pull.Repository, t.pull.Number, t.node), t.fetchArgs)
+	if err != nil {
+		return err
+	}
+	var f Fetched
+	if err := json.Unmarshal(raw, &f); err != nil || f.Workspace == "" {
+		return fmt.Errorf("the fetch of %s#%d on %s answered no workspace: %s", t.pull.Repository, t.pull.Number, t.node, raw)
+	}
+	t.fetched = f
+	return nil
+}
+
+// stepOnWorkspace sets the workspace a step reads to the target's current one.
+func stepOnWorkspace(t *target, args map[string]any) {
+	if _, ok := args["workspace"]; ok {
+		args["workspace"] = t.fetched.Workspace
+	}
+}

modules/mesh-delivery-checker/internal/check/heard_test.go

@@ -0,0 +1,142 @@
+package check
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/nats-io/nats.go"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Issue 1820: a build step goes to a node whose build module is not heard (a laptop asleep, not yet marked offline by the
+// watchman), and the bus answers "no responders". The check moves the step to another node of the same build module.
+
+// deafNodes makes every tool on the named nodes fail as the bus does when nobody listens there; count says how many
+// times the node was called.
+func deafNodes(b *bench, deaf ...string) {
+	for tool, h := range b.steps.handlers {
+		h := h
+		b.steps.handlers[tool] = func(c stepCall) (any, error) {
+			for _, n := range deaf {
+				if c.node == n {
+					return nil, fmt.Errorf("%s on %s: %w", c.tool, c.node, nats.ErrNoResponders)
+				}
+			}
+			return h(c)
+		}
+	}
+}
+
+func nodesOf(calls []stepCall) []string {
+	var out []string
+	for _, c := range calls {
+		out = append(out, c.node)
+	}
+	return out
+}
+
+func TestAFetchThatNobodyAnswersMovesToAnotherBuildNode(t *testing.T) { // 1820/AC1
+	b := newBench(t)
+	b.ex.Toolchains = goEntries("ace", "g14")
+	deafNodes(b, "ace")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v, want a pass on the node that answers", v)
+	}
+	if got := nodesOf(b.steps.tool("fetch")); len(got) != 2 || got[0] != "ace" || got[1] != "g14" {
+		t.Errorf("fetch went to %v, want ace (no responders) then g14", got)
+	}
+	for _, c := range b.steps.tool("test") {
+		if c.node != "g14" {
+			t.Errorf("a test went to %s, want g14 only", c.node)
+		}
+	}
+	if len(v.Machines) != 1 || v.Machines[0] != "g14" {
+		t.Errorf("machines = %v, want [g14]: ace ran nothing", v.Machines)
+	}
+}
+
+func TestATestStepThatNobodyAnswersIsFetchedAgainOnAnotherNode(t *testing.T) { // 1820/AC2
+	b := newBench(t)
+	b.ex.Toolchains = goEntries("ace", "g14")
+	// ace answers the fetch and the digest, then goes to sleep before the test.
+	test := b.steps.handlers["build_go_test"]
+	b.steps.handlers["build_go_test"] = func(c stepCall) (any, error) {
+		if c.node == "ace" {
+			return nil, fmt.Errorf("test on ace: %w", nats.ErrNoResponders)
+		}
+		return test(c)
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v, want a pass", v)
+	}
+	if got := nodesOf(b.steps.tool("fetch")); len(got) != 2 || got[1] != "g14" {
+		t.Errorf("fetch went to %v, want ace then g14 (the workspace was on ace)", got)
+	}
+	for _, c := range b.steps.tool("test") {
+		if c.node == "g14" && c.args["workspace"] == nil {
+			t.Errorf("a test on g14 has no workspace")
+		}
+	}
+	if len(v.Machines) != 1 || v.Machines[0] != "g14" {
+		t.Errorf("machines = %v, want [g14]", v.Machines)
+	}
+}
+
+func TestWhenNoBuildNodeAnswersTheFailureNamesEveryNodeTried(t *testing.T) { // 1820/AC3
+	b := newBench(t)
+	b.ex.Toolchains = goEntries("ace", "g14", "shanks")
+	deafNodes(b, "ace", "g14", "shanks")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail {
+		t.Fatalf("verdict = %+v, want a failure", v)
+	}
+	for _, n := range []string{"ace", "g14", "shanks"} {
+		if !strings.Contains(v.Failed.Words, n) {
+			t.Errorf("failure %q does not name %s", v.Failed.Words, n)
+		}
+	}
+	if !IsNodesFailure(v) {
+		t.Errorf("failure %q is not a failure of the nodes, so it would not be judged again when they change", v.Failed.Words)
+	}
+	if got := len(b.steps.tool("fetch")); got != 3 {
+		t.Errorf("fetch was tried %d times, want once on each of 3 nodes", got)
+	}
+}
+
+func TestAStepThatFailedForTheChangeIsNotMovedToAnotherNode(t *testing.T) { // 1820/AC4
+	b := newBench(t)
+	b.ex.Toolchains = goEntries("ace", "g14")
+	b.steps.handlers["build_go_fetch"] = func(stepCall) (any, error) { return nil, fmt.Errorf("fetch on ace: the step failed: git exploded") }
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || len(b.steps.tool("fetch")) != 1 {
+		t.Errorf("verdict = %+v after %d fetches, want a failure after one", v, len(b.steps.tool("fetch")))
+	}
+}
+
+func TestACanceledCheckIsNotMovedToAnotherNode(t *testing.T) { // 1820/AC4
+	b := newBench(t)
+	b.ex.Toolchains = goEntries("ace", "g14")
+	ctx, cancel := context.WithCancel(context.Background())
+	b.steps.handlers["build_go_fetch"] = func(stepCall) (any, error) {
+		cancel()
+		return nil, fmt.Errorf("fetch on ace: %w", nats.ErrNoResponders)
+	}
+	_, _ = b.ex.Judge(ctx, caseOf(t, pullOf(repoA, 7, head1)))
+	if n := len(b.steps.tool("fetch")); n != 1 {
+		t.Errorf("fetch was tried %d times after the check ended, want 1", n)
+	}
+}
+
+func TestAPinReadThatNobodyAnswersIsTheForgesFailureNotABuildNodes(t *testing.T) { // 1820/AC5
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("gitea.gitea_get_file: %w", nats.ErrNoResponders)
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
+		t.Errorf("verdict = %+v, want a failure at the forge: no build node was to blame", v)
+	}
+}

modules/mesh-delivery-checker/internal/check/hold.go

@@ -0,0 +1,7 @@
+package check
+
+// PlansBuildingBucket is the controller's bucket of the delivery plans in their build phase, one key for each plan, written
+// by the controller alone (issue 1652): a plan key there means a delivery builds on the build nodes, and no new check starts
+// meanwhile (ADR 0484 clause 12, ADR 0483 clause 6). The keys age out with no delete marker, so the keys are listed, not watched. The bucket may be absent: the controller's issue 1652 is delivered
+// before R4c-5b, and if it is not, the bucket is read as empty.
+const PlansBuildingBucket = "mesh-controller_plans-building"

modules/mesh-delivery-checker/internal/check/hold_test.go

@@ -0,0 +1,38 @@
+package check
+
+import (
+	"context"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func TestARunningCheckIsNotStoppedWhenADeliveryStartsToBuild(t *testing.T) { // ADR 0484 clause 12, ADR 0483 clause 4
+	ctx := context.Background()
+	held := false
+	j := &judgeFunc{f: func(_ context.Context, _ *Case, call int) (Outcome, error) {
+		if call == 1 {
+			held = true // a delivery starts while this check runs
+		}
+		return Outcome{Verdict: passing()}, nil
+	}}
+	r := newRig(t, j)
+	r.ch.Hold = func() bool { return held }
+	r.ch.Candidate(ctx, "feat/x", candidateOf(t, "feat/x", pullOf(repoA, 7, head1)))
+	r.ch.Wait()
+	if v := r.verdict(t, keyOf(t, "feat/x", candidateOf(t, "feat/x", pullOf(repoA, 7, head1)))); v.State != delivery.VerdictPass {
+		t.Errorf("verdict = %+v, want the running check to end as it was", v)
+	}
+	// A new candidate waits while the plan builds.
+	r.ch.Candidate(ctx, "feat/y", candidateOf(t, "feat/y", pullOf(repoA, 8, head2)))
+	r.ch.Wait()
+	if j.count() != 1 {
+		t.Errorf("judged %d times while a delivery builds, want only the one already running", j.count())
+	}
+	held = false
+	r.ch.Reconsider(ctx)
+	r.ch.Wait()
+	if j.count() != 2 {
+		t.Errorf("judged %d times after the delivery ended, want the waiting candidate too", j.count())
+	}
+}

modules/mesh-delivery-checker/internal/check/judge.go

@@ -0,0 +1,525 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"sort"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
+)
+
+// goModule is the build module the Go repositories are judged by.
+const goModule = buildrun.GoBuildModule
+
+// verdictPtr is a verdict of failure a step of the check ends with.
+type verdictPtr = *delivery.Verdict
+
+func failed(machine, words string) verdictPtr { return fail(machine, words) }
+
+// Steps runs a build module's long step on a node and answers its result (buildrun.Runner).
+type Steps interface {
+	Run(ctx context.Context, module, node, tool string, args map[string]any) (json.RawMessage, error)
+}
+
+// ToolchainEntries are the nodes' toolchain entries of a language (buildrun.ToolchainSet).
+type ToolchainEntries interface {
+	Entries(language string) []delivery.NodeToolchain
+}
+
+// BuildModules says which build modules judge a repository: the Go one always, the Node one when the repository holds a
+// TypeScript module.
+type BuildModules interface {
+	BuildModules(repository string) []string
+}
+
+// toolPrefix is the start of each build module's tool names.
+var toolPrefix = map[string]string{buildrun.GoBuildModule: "build_go_", buildrun.NodeBuildModule: "build_node_"}
+
+// Examiner judges a case through the build modules (ADR 0484 clauses 3, 4, 10, 13): for each pull request it fetches the head
+// merged onto its trunk head on a build node, then runs the unit level and the integration level, taking the kept verdicts
+// of unchanged packages, running the change's own tests first and stopping at the first failure.
+type Examiner struct {
+	Steps      Steps
+	Toolchains ToolchainEntries
+	// Presence says which nodes are online; Health whether a node's build module is running and healthy. A node that is not
+	// is not chosen; nil means every node is.
+	Presence interface{ Online(node string) bool }
+	Health   interface {
+		Healthy(node, module string) bool
+	}
+	// Places holds a step back while its node is at the checker's capacity (ADR 0484 clause 12).
+	Places *buildrun.Places
+	Kept   Kept
+	// Previews is the previews bucket; nil writes none.
+	Previews KV
+	Modules  BuildModules
+	// Runs says which commit the mesh runs of a module (the indexer's modules); nil knows none.
+	Runs interface{ CommitOf(module string) string }
+	// Forge reads the go.mod files of the Go members and says whether a mesh-sdk commit is on its trunk (ADR 0484 clause 9);
+	// nil checks no pin.
+	Forge Forge
+	// Builds says how the build of a fingerprint the candidate carries stands (the builder's builds bucket); nil says nothing
+	// of the builds.
+	Builds BuildStates
+	// Announce says a preview was written under the key (EventPreviewWritten); nil says nothing.
+	Announce Announcer
+	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
+	Trunks interface{ Heads() map[string]string }
+	Now    func() time.Time
+	Logf   func(format string, args ...any)
+}
+
+func (j *Examiner) now() time.Time {
+	if j.Now != nil {
+		return j.Now()
+	}
+	return time.Now()
+}
+
+func (j *Examiner) logf(format string, args ...any) {
+	if j.Logf != nil {
+		j.Logf(format, args...)
+	}
+}
+
+// target is a pull request on one build module: the node chosen, the workspace its fetch made and what it said.
+type target struct {
+	pull      Pull
+	module    string
+	node      string
+	toolchain string
+	fetched   Fetched
+	// fetchArgs are the arguments of the target's fetch, so a workspace lost with its node is made again on another.
+	fetchArgs map[string]any
+	// priority are the Go packages (import paths) or the Node module directories whose test files the merge changes.
+	changed []string
+	// beside says the workspace was given siblings: its tests may read what the digest does not cover, so nothing is kept for it.
+	beside bool
+	plans  map[string]*goPlan // by level
+}
+
+// goPlan is what a Go target has to run at one level: the digests, the packages without a kept verdict and the tests taken.
+type goPlan struct {
+	digests map[string]string
+	todo    []string
+	// all says the digest step gave nothing to key a kept verdict by, so the level runs whole and keeps nothing.
+	all bool
+}
+
+// acc collects a level's counts across targets.
+type acc struct {
+	run, kept, skipped int
+	elapsed, setup     float64
+	over               bool
+	slowest            []TestTime
+}
+
+// state is one judging.
+type state struct {
+	j       *Examiner
+	c       *Case
+	targets []*target
+	levels  map[string]*acc
+	nodes   map[string]bool
+	deaf    map[string][]deafNode // by build module: the nodes that did not answer during this judging
+	clone   time.Duration
+	slow    []string
+}
+
+// Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
+// be judged at all.
+func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
+	st := &state{j: j, c: c, levels: map[string]*acc{delivery.LevelUnit: {}, delivery.LevelIntegration: {}}, nodes: map[string]bool{}}
+	if v := st.fetchAll(ctx); v != nil {
+		return st.finish(ctx, *v), nil
+	}
+	if v := st.checkPins(ctx); v != nil {
+		return st.finish(ctx, *v), nil
+	}
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		for _, priority := range []bool{true, false} {
+			for _, t := range st.targets {
+				if v := st.runTarget(ctx, t, level, priority); v != nil {
+					return st.finish(ctx, *v), nil
+				}
+			}
+		}
+	}
+	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
+}
+
+// finish is the outcome of the verdict with the state of the builds the candidate's modules carry.
+func (st *state) finish(ctx context.Context, v delivery.Verdict) Outcome {
+	out := st.outcome(v)
+	out.Builds = st.j.buildNotes(ctx, st.c)
+	return out
+}
+
+// outcome fills the verdict's levels, times, machines and composition from what ran.
+func (st *state) outcome(v delivery.Verdict) Outcome {
+	if v.State == delivery.VerdictPass || len(v.Levels) == 0 {
+		v.Levels = map[string]delivery.LevelResult{}
+		for level, a := range st.levels {
+			v.Levels[level] = delivery.LevelResult{Run: a.run, Kept: a.kept, Skipped: a.skipped}
+		}
+	}
+	ms := func(s float64) int64 { return int64(s * 1000) }
+	u, i := st.levels[delivery.LevelUnit], st.levels[delivery.LevelIntegration]
+	v.Took = delivery.Took{Clone: st.clone.Milliseconds(), Unit: ms(u.elapsed), IntegrationSetup: ms(i.setup), IntegrationRun: ms(i.elapsed)}
+	for node := range st.nodes {
+		v.Machines = append(v.Machines, node)
+	}
+	sort.Strings(v.Machines)
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		if st.levels[level].over {
+			v.OverBound = append(v.OverBound, level)
+		}
+	}
+	// The composition is the assigner's check (issue 1297): until it delivers a verdict says it was not run (ADR 0484 clause 6).
+	v.Composition = &delivery.Composition{State: delivery.CompositionNotRun}
+	var slow []string
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		a := st.levels[level]
+		if !a.over {
+			continue
+		}
+		sort.SliceStable(a.slowest, func(x, y int) bool { return a.slowest[x].Elapsed > a.slowest[y].Elapsed })
+		for n, s := range a.slowest {
+			if n == 3 {
+				break
+			}
+			slow = append(slow, fmt.Sprintf("%s %s %.1fs", level, path.Base(s.Package)+"."+s.Test, s.Elapsed))
+		}
+	}
+	return Outcome{Verdict: v, Slowest: slow}
+}
+
+// fail is a verdict of failure at a machine.
+func fail(machine, words string) *delivery.Verdict {
+	v := failure(machine, words)
+	return &v
+}
+
+// step runs one step of a build module on the node the target is on, holding a place there while it runs. A node that does
+// not answer (the bus has no responder, or none answered) is left out and the step goes to another node of the same build
+// module; a step after the fetch makes its workspace again there first (issue 1820).
+func (st *state) step(ctx context.Context, t *target, tool, label string, args map[string]any) (json.RawMessage, error) {
+	for {
+		raw, err := st.stepOnce(ctx, t, tool, label, args)
+		if err == nil || ctx.Err() != nil || !isUnheard(err) {
+			return raw, err
+		}
+		if merr := st.moveStep(t, err); merr != nil {
+			return nil, merr
+		}
+		if tool != "fetch" {
+			if rerr := st.refetch(ctx, t); rerr != nil {
+				return nil, rerr
+			}
+			stepOnWorkspace(t, args)
+		}
+	}
+}
+
+func (st *state) stepOnce(ctx context.Context, t *target, tool, label string, args map[string]any) (json.RawMessage, error) {
+	st.c.Progress.Set(label, t.node)
+	release, err := st.j.Places.Acquire(ctx, t.node)
+	if err != nil {
+		return nil, err
+	}
+	defer release()
+	return st.j.Steps.Run(ctx, t.module, t.node, toolPrefix[t.module]+tool, args)
+}
+
+// choose picks the build node for a pull request's repository on a build module.
+func (st *state) choose(bm string) (node, toolchain string, err error) {
+	language := buildrun.LanguageOf[bm]
+	qualifies := func(node string) bool {
+		return !st.isDeaf(bm, node) && (st.j.Presence == nil || st.j.Presence.Online(node)) && (st.j.Health == nil || st.j.Health.Healthy(node, bm))
+	}
+	nodes, tc, err := buildrun.ChooseNodes(language, st.j.Toolchains.Entries(language), st.j.Places, qualifies, 1)
+	if err != nil {
+		return "", "", err
+	}
+	return nodes[0], tc.Version, nil
+}
+
+// fetchAll fetches every pull request's head merged onto its trunk on a build node of each build module the repository
+// needs. A head that does not merge, or a step that fails, ends the check at once, running no test (ADR 0484 clause 13).
+func (st *state) fetchAll(ctx context.Context) *delivery.Verdict {
+	began := st.j.now()
+	defer func() { st.clone = st.j.now().Sub(began) }()
+	for _, p := range st.c.Pulls {
+		var merged []Fetched
+		for _, bm := range st.j.Modules.BuildModules(p.Repository) {
+			node, tc, err := st.choose(bm)
+			if err != nil {
+				return fail(bm, err.Error())
+			}
+			t := &target{pull: p, module: bm, node: node, toolchain: tc, plans: map[string]*goPlan{}}
+			st.nodes[node] = true
+			args := map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number), "base": p.Trunk}
+			t.fetchArgs = args
+			if bm == buildrun.GoBuildModule {
+				beside, err := st.j.besideFor(ctx, st.c, p)
+				if err != nil {
+					return fail(node, err.Error())
+				}
+				if len(beside) > 0 {
+					args["beside"] = beside
+					t.beside = true
+				}
+			}
+			raw, err := st.step(ctx, t, "fetch", fmt.Sprintf("fetch %s#%d on %s", p.Repository, p.Number, node), args)
+			node = t.node // the step may have moved to another node
+			if err != nil {
+				return fail(node, fmt.Sprintf("fetch of %s#%d: %v%s", p.Repository, p.Number, err, pinHint(st.c, err.Error())))
+			}
+			if err := json.Unmarshal(raw, &t.fetched); err != nil || t.fetched.Workspace == "" {
+				return fail(node, fmt.Sprintf("the fetch of %s#%d answered no workspace: %s", p.Repository, p.Number, raw))
+			}
+			if len(t.fetched.Conflicts) > 0 {
+				st.j.writePreview(ctx, p, append(merged, t.fetched))
+				return fail(node, fmt.Sprintf("%s#%d does not merge into the trunk: files in conflict: %s", p.Repository, p.Number, strings.Join(t.fetched.Conflicts, ", ")))
+			}
+			t.changed = t.fetched.Changed
+			merged = append(merged, t.fetched)
+			st.targets = append(st.targets, t)
+		}
+		st.j.writePreview(ctx, p, merged)
+	}
+	return nil
+}
+
+// isTestFile says whether a repository-relative path is a test file of the languages the checker judges: Go's _test.go and
+// the TypeScript module's .test. and .spec. files and test directories.
+func isTestFile(p string) bool {
+	switch {
+	case strings.HasSuffix(p, "_test.go"):
+		return true
+	case strings.Contains(p, ".test.") || strings.Contains(p, ".spec."):
+		return true
+	}
+	for _, seg := range strings.Split(path.Dir(p), "/") {
+		if seg == "__tests__" || seg == "test" || seg == "tests" {
+			return true
+		}
+	}
+	return false
+}
+
+// changesTestOf says whether the merge changes a test file of the Go package with the import path pkg: the directory of the
+// file and the import path agree on their last segments, whichever holds the module's directory and path in front.
+func changesTestOf(changed []string, pkg string) bool {
+	for _, f := range changed {
+		if !strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		dir := path.Dir(f)
+		if dir == pkg || strings.HasSuffix(pkg, "/"+dir) || strings.HasSuffix(dir, "/"+pkg) {
+			return true
+		}
+	}
+	return false
+}
+
+// changesTestIn says whether the merge changes a test file inside the directory of a Node module.
+func changesTestIn(changed []string, dir string) bool {
+	for _, f := range changed {
+		if !isTestFile(f) || strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		if dir == "." || dir == "" || strings.HasPrefix(f, strings.TrimSuffix(dir, "/")+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// failedName names a failure: its package and test.
+func failedName(f Failure) string {
+	if f.Test == "" {
+		return f.Package
+	}
+	return f.Package + "." + f.Test
+}
+
+// firstLine is the first non-empty line of a failure's output, shortened.
+func firstLine(s string) string {
+	for _, l := range strings.Split(s, "\n") {
+		if l = strings.TrimSpace(l); l != "" {
+			if len(l) > 120 {
+				l = l[:120]
+			}
+			return l
+		}
+	}
+	return ""
+}
+
+// failure turns a level that did not pass into a verdict naming what failed first.
+func levelFailure(t *target, level string, res Tested) *delivery.Verdict {
+	v := delivery.Verdict{State: delivery.VerdictFail}
+	switch {
+	case len(res.Failed) > 0:
+		f := res.Failed[0]
+		name := failedName(f)
+		if t.module == buildrun.NodeBuildModule && f.Package == "" {
+			name = res.Module
+		}
+		v.Failed = delivery.FailedFirst{Test: level + ": " + name, Words: firstLine(f.Output)}
+	default:
+		why := res.Why
+		if why == "" {
+			why = "the " + level + " level did not pass"
+		}
+		v.Failed = delivery.FailedFirst{Test: level + ": " + t.pull.Repository, Words: why}
+	}
+	return &v
+}
+
+// runTarget runs one level of a target: first the packages the change's own tests are in (priority), then the others.
+func (st *state) runTarget(ctx context.Context, t *target, level string, priority bool) *delivery.Verdict {
+	if t.module == buildrun.NodeBuildModule {
+		return st.runNode(ctx, t, level, priority)
+	}
+	return st.runGo(ctx, t, level, priority)
+}
+
+// A level's work is planned once for a target: the digest of each package, the kept verdicts taken, the packages left to run.
+func (st *state) planGo(ctx context.Context, t *target, level string) *delivery.Verdict {
+	if t.plans[level] != nil {
+		return nil
+	}
+	plan := &goPlan{digests: map[string]string{}}
+	t.plans[level] = plan
+	if t.beside {
+		// The digest covers the package's own files, the toolchain and the header, not the siblings placed beside the tree: a
+		// package whose tests read one must never be kept, nor taken from a verdict kept for other inputs (ADR 0444).
+		plan.all = true
+		return nil
+	}
+	raw, err := st.step(ctx, t, "digest", fmt.Sprintf("digest the %s level of %s#%d on %s", level, t.pull.Repository, t.pull.Number, t.node),
+		map[string]any{"workspace": t.fetched.Workspace, "level": level})
+	var d Digested
+	if err == nil {
+		err = json.Unmarshal(raw, &d)
+	}
+	if ctx.Err() != nil {
+		return fail(t.node, ctx.Err().Error())
+	}
+	if err != nil || len(d.Packages) == 0 {
+		// The build module named no digest (a level it cannot digest here): the level runs whole and keeps nothing.
+		if err != nil {
+			st.j.logf("%s#%d: no digest of the %s level, so it runs whole: %v", t.pull.Repository, t.pull.Number, level, err)
+		}
+		plan.all = true
+		return nil
+	}
+	plan.digests = d.Packages
+	a := st.levels[level]
+	pkgs := make([]string, 0, len(d.Packages))
+	for p := range d.Packages {
+		pkgs = append(pkgs, p)
+	}
+	sort.Strings(pkgs)
+	for _, p := range pkgs {
+		k, found, err := st.j.Kept.Lookup(ctx, level, d.Packages[p])
+		if err != nil {
+			st.j.logf("the kept verdict of %s at %s cannot be read, so it runs: %v", p, level, err)
+		}
+		if found {
+			a.kept += k.Tests
+			continue
+		}
+		plan.todo = append(plan.todo, p)
+	}
+	return nil
+}
+
+func (st *state) runGo(ctx context.Context, t *target, level string, priority bool) *delivery.Verdict {
+	if v := st.planGo(ctx, t, level); v != nil {
+		return v
+	}
+	plan := t.plans[level]
+	var run []string
+	switch {
+	case plan.all:
+		if priority {
+			return nil // nothing to put first: the level runs whole after
+		}
+	default:
+		for _, p := range plan.todo {
+			if changesTestOf(t.changed, p) == priority {
+				run = append(run, p)
+			}
+		}
+		if len(run) == 0 {
+			return nil
+		}
+	}
+	args := map[string]any{"workspace": t.fetched.Workspace, "level": level}
+	if run != nil {
+		args["packages"] = run
+	}
+	raw, err := st.step(ctx, t, "test", fmt.Sprintf("test the %s level of %s#%d on %s", level, t.pull.Repository, t.pull.Number, t.node), args)
+	if err != nil {
+		return fail(t.node, fmt.Sprintf("the %s level of %s#%d: %v", level, t.pull.Repository, t.pull.Number, err))
+	}
+	var res Tested
+	if err := json.Unmarshal(raw, &res); err != nil {
+		return fail(t.node, fmt.Sprintf("the %s level of %s#%d answered what is not a result: %v", level, t.pull.Repository, t.pull.Number, err))
+	}
+	a := st.levels[level]
+	a.run += res.Tests
+	a.skipped += res.Skipped
+	a.elapsed += res.Elapsed
+	a.setup += res.Setup
+	a.over = a.over || res.OverBound
+	a.slowest = append(a.slowest, res.Slowest...)
+	if len(plan.digests) > 0 {
+		if _, err := st.j.Kept.KeepPasses(ctx, t.pull.Repository, level, t.toolchain, res, plan.digests, st.j.now()); err != nil {
+			st.j.logf("%s#%d: a passing package could not be kept: %v", t.pull.Repository, t.pull.Number, err)
+		}
+	}
+	if !res.Passed {
+		return levelFailure(t, level, res)
+	}
+	return nil
+}
+
+func (st *state) runNode(ctx context.Context, t *target, level string, priority bool) *delivery.Verdict {
+	for _, dir := range t.fetched.Modules {
+		if changesTestIn(t.changed, dir) != priority {
+			continue
+		}
+		raw, err := st.step(ctx, t, "test", fmt.Sprintf("test the %s level of %s#%d (%s) on %s", level, t.pull.Repository, t.pull.Number, dir, t.node),
+			map[string]any{"workspace": t.fetched.Workspace, "module": dir, "level": level})
+		if err != nil {
+			return fail(t.node, fmt.Sprintf("the %s level of %s#%d (%s): %v", level, t.pull.Repository, t.pull.Number, dir, err))
+		}
+		var res Tested
+		if err := json.Unmarshal(raw, &res); err != nil {
+			return fail(t.node, fmt.Sprintf("the %s level of %s#%d (%s) answered what is not a result: %v", level, t.pull.Repository, t.pull.Number, dir, err))
+		}
+		if res.Module == "" {
+			res.Module = dir
+		}
+		a := st.levels[level]
+		if !res.NoTests {
+			a.run++ // a Node package is counted whole: its build module counts no tests (ADR 0484 clause 10)
+		}
+		a.elapsed += res.Elapsed
+		a.setup += res.Setup
+		a.over = a.over || res.OverBound
+		if !res.Passed {
+			return levelFailure(t, level, res)
+		}
+	}
+	return nil
+}

modules/mesh-delivery-checker/internal/check/kept.go

@@ -0,0 +1,90 @@
+package check
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Kept is the checker's bucket of kept verdicts (ADR 0444, ADR 0484 clause 13): a passing verdict per package and level,
+// under the digest the language's build module named for it. A key is written once, by a create that fails when it
+// exists, from the result the checker read from the test step and never from anything the code under test wrote; nothing
+// changes it afterwards.
+type Kept struct{ Store KV }
+
+// Lookup is the kept verdict of a level under a digest, or none.
+func (k Kept) Lookup(ctx context.Context, level, digest string) (delivery.Kept, bool, error) {
+	key, err := delivery.KeptKey(level, digest)
+	if err != nil {
+		return delivery.Kept{}, false, err
+	}
+	value, _, found, err := k.Store.Get(ctx, key)
+	if err != nil || !found {
+		return delivery.Kept{}, false, err
+	}
+	v, err := delivery.DecodeKept(value)
+	if err != nil {
+		return delivery.Kept{}, false, fmt.Errorf("%s holds what is not a kept verdict: %w", key, err)
+	}
+	return v, true, nil
+}
+
+// Keep writes v under level and digest by a create. It answers false, and writes nothing, when the key exists: the first
+// value stands.
+func (k Kept) Keep(ctx context.Context, level, digest string, v delivery.Kept) (bool, error) {
+	key, err := delivery.KeptKey(level, digest)
+	if err != nil {
+		return false, err
+	}
+	v.Level = level
+	data, err := delivery.EncodeKept(v)
+	if err != nil {
+		return false, err
+	}
+	if _, err := k.Store.Create(ctx, key, data); err != nil {
+		if errors.Is(err, ErrConflict) {
+			return false, nil
+		}
+		return false, fmt.Errorf("%s: %w", key, err)
+	}
+	return true, nil
+}
+
+// KeepPasses keeps, for the packages of a test result that passed with tests, a verdict under the digest the build module
+// named for the package at the level. A package that failed, has no tests or has no digest is never kept (ADR 0444 clause
+// 1): it runs every check. It answers the packages it kept now.
+func (k Kept) KeepPasses(ctx context.Context, repository, level, toolchain string, res Tested, digests map[string]string, at time.Time) ([]string, error) {
+	var kept []string
+	for _, p := range res.Packages {
+		digest, ok := digests[p.Package]
+		if !ok || !p.Passed || p.NoTests || p.Tests == 0 {
+			continue
+		}
+		if failedIn(res, p.Package) {
+			continue
+		}
+		made, err := k.Keep(ctx, level, digest, delivery.Kept{State: delivery.VerdictPass, Repository: repository, Package: p.Package,
+			Level: level, Tests: p.Tests, Took: int64(p.Elapsed * 1000), Toolchain: toolchain, At: at})
+		if err != nil {
+			return kept, err
+		}
+		if made {
+			kept = append(kept, p.Package)
+		}
+	}
+	sort.Strings(kept)
+	return kept, nil
+}
+
+func failedIn(res Tested, pkg string) bool {
+	for _, f := range res.Failed {
+		if f.Package == pkg {
+			return true
+		}
+	}
+	return false
+}

modules/mesh-delivery-checker/internal/check/kept_test.go

@@ -0,0 +1,102 @@
+package check
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+var at0 = time.Date(2026, 10, 21, 19, 0, 0, 0, time.UTC)
+
+const (
+	digA = "aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11aa11"
+	digB = "bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22bb22"
+)
+
+func keptValue(pkg string, tests int) delivery.Kept {
+	return delivery.Kept{State: delivery.VerdictPass, Repository: "novox/mesh-delivery", Package: pkg, Tests: tests, Took: 120, Toolchain: "go1.26.0", At: at0}
+}
+
+func TestAPassIsKeptByACreateUnderItsLevelAndDigest(t *testing.T) { // 1287/AC1
+	ctx, st := context.Background(), newMemKV()
+	k := Kept{Store: st}
+	made, err := k.Keep(ctx, delivery.LevelUnit, digA, keptValue("m/a", 3))
+	if err != nil || !made {
+		t.Fatalf("Keep = %v, %v, want made", made, err)
+	}
+	key, _ := delivery.KeptKey(delivery.LevelUnit, digA)
+	if st.creates[key] != 1 {
+		t.Fatalf("the key %s was created %d times, want once", key, st.creates[key])
+	}
+	got, found, err := k.Lookup(ctx, delivery.LevelUnit, digA)
+	if err != nil || !found || got.Package != "m/a" || got.Tests != 3 || got.Level != delivery.LevelUnit || got.Toolchain != "go1.26.0" {
+		t.Fatalf("Lookup = %+v, %v, %v", got, found, err)
+	}
+}
+
+func TestASecondKeepUnderTheSameDigestIsRefusedAndTheFirstStands(t *testing.T) { // 1287/AC2
+	ctx, st := context.Background(), newMemKV()
+	k := Kept{Store: st}
+	if made, err := k.Keep(ctx, delivery.LevelUnit, digA, keptValue("m/a", 3)); err != nil || !made {
+		t.Fatal(made, err)
+	}
+	made, err := k.Keep(ctx, delivery.LevelUnit, digA, keptValue("m/other", 9))
+	if err != nil || made {
+		t.Fatalf("the second Keep = %v, %v, want refused without an error", made, err)
+	}
+	got, _, _ := k.Lookup(ctx, delivery.LevelUnit, digA)
+	if got.Package != "m/a" || got.Tests != 3 {
+		t.Errorf("the first value did not stand: %+v", got)
+	}
+}
+
+func TestOnlyPassingPackagesWithADigestAreKept(t *testing.T) { // 1287/AC3, AC4
+	ctx, st := context.Background(), newMemKV()
+	k := Kept{Store: st}
+	res := Tested{Level: "unit", Passed: false, Packages: []GoPackage{
+		{Package: "m/a", Passed: true, Tests: 4, Elapsed: 0.2},
+		{Package: "m/b", Passed: false, Tests: 2},
+		{Package: "m/c", Passed: true, Tests: 1},      // no digest named
+		{Package: "m/d", Passed: true, NoTests: true}, // no tests
+	}, Failed: []Failure{{Package: "m/b", Test: "TestB"}}}
+	kept, err := k.KeepPasses(ctx, "novox/mesh-delivery", "unit", "go1.26.0", res, map[string]string{"m/a": digA, "m/b": digB, "m/d": digB}, at0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(kept, ",") != "m/a" {
+		t.Fatalf("kept %v, want only m/a", kept)
+	}
+	if keys, _ := st.Keys(ctx); len(keys) != 1 {
+		t.Errorf("the bucket holds %v, want one key", keys)
+	}
+}
+
+func TestAKeptValueOfAnotherDigestIsNotRead(t *testing.T) { // 1287/AC7
+	ctx, st := context.Background(), newMemKV()
+	k := Kept{Store: st}
+	if _, err := k.Keep(ctx, delivery.LevelUnit, digA, keptValue("m/a", 3)); err != nil {
+		t.Fatal(err)
+	}
+	// A toolchain change changes the digest, so the new digest finds nothing and the old key is not deleted.
+	if _, found, _ := k.Lookup(ctx, delivery.LevelUnit, digB); found {
+		t.Error("a digest that was not kept was found")
+	}
+	if _, found, _ := k.Lookup(ctx, delivery.LevelIntegration, digA); found {
+		t.Error("a kept unit verdict was found at the integration level")
+	}
+	if keys, _ := st.Keys(ctx); len(keys) != 1 {
+		t.Errorf("the old key was removed: %v", keys)
+	}
+}
+
+func TestAKeptVerdictThatIsNotAPassIsRefused(t *testing.T) {
+	k := Kept{Store: newMemKV()}
+	v := keptValue("m/a", 1)
+	v.State = delivery.VerdictFail
+	if _, err := k.Keep(context.Background(), delivery.LevelUnit, digA, v); err == nil {
+		t.Error("a failure was kept")
+	}
+}

modules/mesh-delivery-checker/internal/check/line.go

@@ -0,0 +1,214 @@
+package check
+
+import (
+	"fmt"
+	"strings"
+	"unicode/utf8"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// MaxLine is the most characters a status's line has: the forge shows a status's description in a short space, and the full
+// report is linked (ADR 0447 clause 3, ADR 0484 clause 7). A line that would be longer drops its lesser parts in a fixed
+// order, and is cut last.
+const MaxLine = 140
+
+// seconds is a time in milliseconds in the unit a person reads: 350ms, 4.1s, 72s.
+func seconds(ms int64) string {
+	switch {
+	case ms < 1000:
+		return fmt.Sprintf("%dms", ms)
+	case ms < 10000:
+		return fmt.Sprintf("%.1fs", float64(ms)/1000)
+	}
+	return fmt.Sprintf("%ds", (ms+500)/1000)
+}
+
+func short12(s string) string {
+	if len(s) > 12 {
+		return s[:12]
+	}
+	return s
+}
+
+// firstFailed is what failed first, in words: a conflict, a refused step or a test, named before anything else.
+func firstFailed(v delivery.Verdict) string {
+	f := v.Failed
+	switch {
+	case f.Test != "":
+		if f.Words != "" {
+			return f.Test + ": " + f.Words
+		}
+		return f.Test
+	case f.Machine != "" && f.Words != "":
+		return f.Machine + ": " + f.Words
+	case f.Machine != "":
+		return f.Machine
+	}
+	return f.Words
+}
+
+// pieces are the parts of a line, from the most to the least needed.
+type pieces struct {
+	head, commits, counts, shortCounts, times, shortTimes, over, builds, composition, group string
+}
+
+func (p pieces) join(drop int) string {
+	parts := []string{p.head, p.commits, p.counts}
+	switch {
+	case drop < 3 && p.times != "":
+		parts = append(parts, p.times)
+	case drop == 3 && p.shortTimes != "":
+		parts = []string{p.head, p.commits, p.shortCounts, p.shortTimes}
+	}
+	if p.over != "" {
+		parts = append(parts, p.over)
+	}
+	if drop < 1 && p.builds != "" {
+		parts = append(parts, p.builds)
+	}
+	if drop < 2 && p.group != "" {
+		parts = append(parts, p.group)
+	}
+	if p.composition != "" {
+		parts = append(parts, p.composition)
+	}
+	out := make([]string, 0, len(parts))
+	for _, s := range parts {
+		if s != "" {
+			out = append(out, s)
+		}
+	}
+	return strings.Join(out, " | ")
+}
+
+func levelWords(name string, r delivery.LevelResult) string {
+	s := fmt.Sprintf("%s %d run, %d kept", name, r.Run, r.Kept)
+	if r.Skipped > 0 {
+		s += fmt.Sprintf(", %d skipped", r.Skipped)
+	}
+	return s
+}
+
+func compositionWords(c *delivery.Composition) string {
+	switch {
+	case c == nil, c.State == delivery.CompositionNotRun:
+		return "composition not yet run"
+	case c.State == delivery.CompositionPass:
+		return "composition passed with " + short12(c.SDK)
+	}
+	return "composition failed: " + c.Words
+}
+
+func buildWords(builds []BuildNote) string {
+	if len(builds) == 0 {
+		return ""
+	}
+	parts := make([]string, len(builds))
+	for i, b := range builds {
+		parts[i] = b.Module + " " + b.State
+	}
+	return "builds: " + strings.Join(parts, ", ")
+}
+
+// parts makes the pieces of the line of a pull request of a case.
+func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string) pieces {
+	var pc pieces
+	commits := short12(p.Head) + " on " + short12(p.Trunk)
+	switch v.State {
+	case delivery.VerdictRunning:
+		pc.head = "checking " + commits
+	case delivery.VerdictPass:
+		pc.head = "pass " + commits
+	default:
+		pc.head = "failed: " + firstFailed(v)
+		pc.commits = commits
+	}
+	var counts []string
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		if r, ok := v.Levels[level]; ok {
+			counts = append(counts, levelWords(level, r))
+		}
+	}
+	pc.counts = strings.Join(counts, " | ")
+	var short []string
+	for _, level := range []string{delivery.LevelUnit, delivery.LevelIntegration} {
+		if r, ok := v.Levels[level]; ok {
+			name := map[string]string{delivery.LevelUnit: "unit", delivery.LevelIntegration: "int"}[level]
+			w := fmt.Sprintf("%s %d run %d kept", name, r.Run, r.Kept)
+			if r.Skipped > 0 {
+				w += fmt.Sprintf(" %d skipped", r.Skipped)
+			}
+			short = append(short, w)
+		}
+	}
+	pc.shortCounts = strings.Join(short, " | ")
+	if v.State != delivery.VerdictRunning {
+		t := v.Took
+		var times []string
+		for _, x := range []struct {
+			name string
+			ms   int64
+		}{{"queue", t.Queue}, {"clone", t.Clone}, {"unit", t.Unit}, {"int setup", t.IntegrationSetup}, {"int run", t.IntegrationRun}, {"composition", t.Composition}} {
+			if x.ms > 0 {
+				times = append(times, x.name+" "+seconds(x.ms))
+			}
+		}
+		if len(times) > 0 {
+			pc.times = strings.Join(times, ", ")
+		}
+		// The compact form for a line that is too long: the parts that dominate, the integration level's setup and run as one.
+		short = short[:0:0]
+		if t.Clone > 0 {
+			short = append(short, "clone "+seconds(t.Clone))
+		}
+		if t.Unit > 0 {
+			short = append(short, "unit "+seconds(t.Unit))
+		}
+		switch {
+		case t.IntegrationSetup > 0 && t.IntegrationRun > 0:
+			short = append(short, "int "+seconds(t.IntegrationSetup)+"+"+seconds(t.IntegrationRun))
+		case t.IntegrationRun > 0:
+			short = append(short, "int "+seconds(t.IntegrationRun))
+		}
+		pc.shortTimes = strings.Join(short, " ")
+	}
+	if len(v.OverBound) > 0 {
+		pc.over = "over bound: " + strings.Join(v.OverBound, ", ")
+		if len(slowest) > 0 {
+			pc.over += " (slowest " + strings.Join(slowest, ", ") + ")"
+		}
+	}
+	pc.builds = buildWords(builds)
+	if v.State != delivery.VerdictRunning {
+		pc.composition = compositionWords(v.Composition)
+	}
+	if cs != nil && len(cs.Pulls) > 1 {
+		pc.group = fmt.Sprintf("group %s of %d pull requests", cs.Group, len(cs.Pulls))
+		if v.State != delivery.VerdictPass {
+			pc.group = fmt.Sprintf("%s#%d in group %s", p.Repository, p.Number, cs.Group)
+		}
+	}
+	return pc
+}
+
+// Report is the full line of a pull request's status, with no limit: what the read tools and the full report say.
+func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string) string {
+	return parts(v, cs, p, builds, slowest).join(0)
+}
+
+// Line is the words of a status for one pull request of a case (ADR 0447 clause 3, ADR 0484 clause 7): the verdict first (a
+// failure names the conflict, the refused step or the test before anything), the head and the trunk commit as twelve
+// characters each, the tests run, kept and skipped per level, the time of each part, a level over its bound with its slowest
+// tests, the builds of the touched modules, and that the composition was not yet run. It is at most MaxLine characters: the
+// builds, then the group drop first, then the times are given in their compact form, then dropped, and the line is cut at last.
+func Line(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string) string {
+	pc := parts(v, cs, p, builds, slowest)
+	for drop := 0; drop <= 4; drop++ {
+		if s := pc.join(drop); utf8.RuneCountInString(s) <= MaxLine {
+			return s
+		}
+	}
+	runes := []rune(pc.join(4))
+	return string(runes[:MaxLine-1]) + "…"
+}

modules/mesh-delivery-checker/internal/check/line_test.go

@@ -0,0 +1,135 @@
+package check
+
+import (
+	"strings"
+	"testing"
+	"unicode/utf8"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func lineCase(t testing.TB, pulls ...delivery.CandidatePull) (*Case, Pull) {
+	cs := caseOf(t, pulls...)
+	return cs, cs.Pulls[0]
+}
+
+func passVerdict() delivery.Verdict {
+	return delivery.Verdict{State: delivery.VerdictPass,
+		Levels:      map[string]delivery.LevelResult{delivery.LevelUnit: {Run: 12, Kept: 301}, delivery.LevelIntegration: {Run: 3, Kept: 40}},
+		Took:        delivery.Took{Queue: 800, Clone: 4100, Unit: 400, IntegrationSetup: 3200, IntegrationRun: 12000},
+		Composition: &delivery.Composition{State: delivery.CompositionNotRun}}
+}
+
+func TestAPassOpensWithTheVerdictAndSaysTheCommitsTheCountsTheTimesAndThatTheCompositionWasNotRun(t *testing.T) { // 1300/AC1
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	full := Report(passVerdict(), cs, p, nil, nil)
+	for _, want := range []string{"pass 111111111111 on aaaaaaaaaaaa", "unit 12 run, 301 kept", "integration 3 run, 40 kept", "queue 800ms", "clone 4.1s", "unit 400ms", "int setup 3.2s", "int run 12s", "composition not yet run"} {
+		if !strings.Contains(full, want) {
+			t.Errorf("the report %q lacks %q", full, want)
+		}
+	}
+	if !strings.HasPrefix(full, "pass ") || strings.Contains(full, "composition passed") {
+		t.Errorf("report = %q", full)
+	}
+	line := Line(passVerdict(), cs, p, nil, nil)
+	if n := utf8.RuneCountInString(line); n > MaxLine {
+		t.Errorf("the line is %d characters, want at most %d: %q", n, MaxLine, line)
+	}
+	if !strings.HasPrefix(line, "pass 111111111111 on aaaaaaaaaaaa") || !strings.Contains(line, "composition not yet run") || !strings.Contains(line, "unit 12 run 301 kept") ||
+		!strings.Contains(line, "clone 4.1s") || !strings.Contains(line, "int 3.2s+12s") {
+		t.Errorf("line = %q", line)
+	}
+}
+
+func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { // 1300/AC2
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	for name, c := range map[string]struct {
+		v    delivery.Verdict
+		want string
+	}{
+		"test":     {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4"}}, "failed: unit: m/a.TestX: want 4"},
+		"conflict": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "shanks", Words: "novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"}}, "failed: shanks: novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"},
+		"refused":  {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "mesh-build-go", Words: "no go build node qualifies: builders disagree"}}, "failed: mesh-build-go: no go build node qualifies"},
+	} {
+		line := Line(c.v, cs, p, nil, nil)
+		if !strings.HasPrefix(line, c.want) || !strings.Contains(line, "111111111111 on aaaaaaaaaaaa") {
+			t.Errorf("%s: line = %q, want it to open with %q and name the commits", name, line, c.want)
+		}
+	}
+}
+
+func TestALevelOverItsBoundIsNamedWithItsSlowestTestsAndTheVerdictIsNotChanged(t *testing.T) { // 1300/AC3
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	v := passVerdict()
+	v.OverBound = []string{"unit"}
+	line := Line(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"})
+	if !strings.HasPrefix(line, "pass ") || !strings.Contains(Report(v, cs, p, nil, []string{"unit pkg.TestSlow 7.0s"}), "over bound: unit (slowest unit pkg.TestSlow 7.0s)") {
+		t.Errorf("line = %q", line)
+	}
+}
+
+func TestSkippedTestsAreSaidAndNeverAFlatPass(t *testing.T) { // 1300/AC6
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	v := passVerdict()
+	v.Levels[delivery.LevelUnit] = delivery.LevelResult{Run: 12, Kept: 301, Skipped: 2}
+	if line := Line(v, cs, p, nil, nil); !strings.Contains(line, "unit 12 run, 301 kept, 2 skipped") {
+		t.Errorf("line = %q", line)
+	}
+}
+
+func TestAGroupsMembersEachCarryTheSameVerdict(t *testing.T) { // 1300/AC4
+	cs := caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))
+	a := Line(passVerdict(), cs, cs.Pulls[0], nil, nil)
+	b := Line(passVerdict(), cs, cs.Pulls[1], nil, nil)
+	if !strings.HasPrefix(a, "pass ") || !strings.HasPrefix(b, "pass ") || !strings.Contains(Report(passVerdict(), cs, cs.Pulls[0], nil, nil), "group feat/x of 2 pull requests") {
+		t.Errorf("lines %q and %q", a, b)
+	}
+	if !strings.Contains(a, "111111111111") || !strings.Contains(b, "222222222222") {
+		t.Errorf("each member's line names its own head: %q and %q", a, b)
+	}
+}
+
+func TestTheBuildsOfTheTouchedModulesAreSaidAndDroppedFirstWhenTheLineIsTooLong(t *testing.T) { // ADR 0484 clause 7
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	builds := []BuildNote{{"avahi", "built"}, {"mesh-tools", "waiting"}}
+	if r := Report(passVerdict(), cs, p, builds, nil); !strings.Contains(r, "builds: avahi built, mesh-tools waiting") {
+		t.Errorf("report = %q", r)
+	}
+	line := Line(passVerdict(), cs, p, builds, nil)
+	if utf8.RuneCountInString(line) > MaxLine {
+		t.Errorf("line %q is too long", line)
+	}
+	short := passVerdict()
+	short.Took = delivery.Took{}
+	if l := Line(short, cs, p, builds[:1], nil); !strings.Contains(l, "builds: avahi built") {
+		t.Errorf("a short line keeps its builds: %q", l)
+	}
+}
+
+func TestALineIsNeverLongerThanTheLimit(t *testing.T) { // 1300/AC1
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	v := delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "integration: " + strings.Repeat("pkg/", 50) + ".TestSomething", Words: strings.Repeat("because ", 40)}}
+	if line := Line(v, cs, p, nil, nil); utf8.RuneCountInString(line) > MaxLine || !strings.HasPrefix(line, "failed: integration: ") {
+		t.Errorf("line = %q (%d)", line, utf8.RuneCountInString(line))
+	}
+}
+
+func TestARunningCheckIsPending(t *testing.T) {
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	if line := Line(delivery.Verdict{State: delivery.VerdictRunning}, cs, p, nil, nil); line != "checking 111111111111 on aaaaaaaaaaaa" {
+		t.Errorf("line = %q", line)
+	}
+}
+
+func TestThePassedCompositionIsSaidOnlyWhenItWasRun(t *testing.T) { // ADR 0484 clause 6
+	cs, p := lineCase(t, pullOf(repoA, 7, head1))
+	v := passVerdict()
+	v.Composition = &delivery.Composition{State: delivery.CompositionPass, SDK: "afbe371003a570f088be4a394d83aa7a9458f7ab"}
+	if r := Report(v, cs, p, nil, nil); !strings.Contains(r, "composition passed with afbe371003a5") {
+		t.Errorf("report = %q", r)
+	}
+	v.Composition = nil
+	if r := Report(v, cs, p, nil, nil); !strings.Contains(r, "composition not yet run") || strings.Contains(r, "composition passed") {
+		t.Errorf("a verdict with no composition: %q", r)
+	}
+}

modules/mesh-delivery-checker/internal/check/pins.go

@@ -0,0 +1,125 @@
+package check
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"regexp"
+	"strings"
+)
+
+// The pin of mesh-sdk in a Go member's go.mod (novox/hq ADR 0484 clause 9, ADR 0482 clause 2, issue 1624): a delivery group
+// has one verdict, and the mesh-sdk its Go members are built and tested with is the group's: a pin to the head of the group's
+// mesh-sdk pull request, or to a commit already on mesh-sdk's trunk. Any other commit is a stale or a foreign pin, and the
+// group fails naming the member and the commit.
+
+// SDKRepository is the repository of mesh-sdk, and SDKModulePath its Go module.
+const (
+	SDKRepository = "novox/mesh-sdk"
+	SDKModulePath = "git.novox.be/novox/mesh-sdk/go"
+)
+
+// Issue1148 is why a pin that only a head carries fails the check.
+const Issue1148 = "issue 1148"
+
+// ErrNotFound is what Forge.File wraps when the ref holds no such file (the forge answered 404): a file the ref does not hold,
+// told from a forge that could not be read (issue 1845).
+var ErrNotFound = errors.New("the ref holds no such file")
+
+// Forge reads a file of a repository at a ref, and says whether a commit is on a repository's trunk.
+type Forge interface {
+	// File is the text of a file at a ref (a branch, a tag or a commit).
+	File(ctx context.Context, repository, path, ref string) (string, error)
+	// OnTrunk says whether commit (a full or a 12-digit sha) is already merged into the trunk of the repository: it holds no
+	// commit the trunk does not.
+	OnTrunk(ctx context.Context, repository, commit string) (bool, error)
+	// FullSHA is the 40-digit sha of a commit named by its first 12 digits.
+	FullSHA(ctx context.Context, repository, commit string) (string, error)
+}
+
+var pseudoVersion = regexp.MustCompile(`-([0-9a-f]{12})$`)
+
+// SDKPin is the commit (12 hex digits) a go.mod names for mesh-sdk by a pseudo-version, or none for a go.mod that does not
+// require mesh-sdk or requires a version that is no pseudo-version (a tag is a release the SDK itself names).
+func SDKPin(goMod string) (commit string, ok bool) {
+	for _, line := range strings.Split(goMod, "\n") {
+		f := strings.Fields(strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(line), "require")))
+		if len(f) >= 2 && f[0] == SDKModulePath {
+			if m := pseudoVersion.FindStringSubmatch(f[1]); m != nil {
+				return m[1], true
+			}
+			return "", false
+		}
+	}
+	return "", false
+}
+
+// checkPins refuses a Go member whose go.mod names a mesh-sdk commit that is neither on mesh-sdk's trunk nor the head of the
+// group's mesh-sdk pull request. It reads each go.mod the fetch named from the forge: the one the check builds, which is the
+// head's when the head holds the file and the trunk's when it does not, since a module added on the trunk after the branch was
+// cut is in the merge and not at the head (issue 1845). It answers nil when every pin is the group's.
+func (st *state) checkPins(ctx context.Context) verdictPtr {
+	if st.j.Forge == nil {
+		return nil
+	}
+	sdk := st.c.member(SDKRepository)
+	for _, t := range st.targets {
+		if t.module != goModule || t.pull.Repository == SDKRepository {
+			continue
+		}
+		for _, dir := range t.fetched.Modules {
+			file := path.Join(dir, "go.mod")
+			st.c.Progress.Set(fmt.Sprintf("read %s of %s#%d", file, t.pull.Repository, t.pull.Number), t.node)
+			text, err := st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Head)
+			if errors.Is(err, ErrNotFound) && t.pull.Trunk != "" {
+				// Only a file the head does not hold is read at the trunk; any other failure fails the check as it did.
+				text, err = st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Trunk)
+			}
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: %s cannot be read to check its mesh-sdk pin: %v", t.pull.Repository, t.pull.Number, file, err))
+			}
+			pin, ok := SDKPin(text)
+			if !ok {
+				continue
+			}
+			if sdk != nil && strings.HasPrefix(sdk.Head, pin) {
+				continue // the group's own head
+			}
+			onTrunk, err := st.j.Forge.OnTrunk(ctx, SDKRepository, pin)
+			if err != nil {
+				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is on its trunk cannot be told: %v", t.pull.Repository, t.pull.Number, pin, err))
+			}
+			if onTrunk {
+				continue
+			}
+			nor := "the group has no mesh-sdk pull request"
+			if sdk != nil {
+				nor = "the head of the group's mesh-sdk pull request is " + short12(sdk.Head)
+			}
+			return failed(t.node, fmt.Sprintf("%s#%d: %s names mesh-sdk %s, which is neither on mesh-sdk's trunk nor the group's head (%s)", t.pull.Repository, t.pull.Number, file, pin, nor))
+		}
+	}
+	return nil
+}
+
+// failureVerdict is a verdict of failure the check ends with.
+
+// pinHint is added to the failure of a Go member's fetch that names mesh-sdk while the group holds a mesh-sdk pull request:
+// a pin to that pull request's head names a commit only the head carries, which go mod download cannot resolve before the
+// pull request is merged (issue 1148), so such a check fails and never passes.
+func pinHint(c *Case, fetchError string) string {
+	if c.member(SDKRepository) == nil || !strings.Contains(fetchError, "mesh-sdk") {
+		return ""
+	}
+	return " (a pin to the head of the group's mesh-sdk pull request names a commit only that head carries, which go mod download cannot resolve; " + Issue1148 + ")"
+}
+
+// forgeMachine is the machine a failed read of the forge is put at: the forge when nobody answered it (no build node is to
+// blame, issue 1820), the build node whose workspace was read otherwise.
+func forgeMachine(err error, node string) string {
+	if isUnheard(err) {
+		return "forge"
+	}
+	return node
+}

modules/mesh-delivery-checker/internal/check/pins_test.go

@@ -0,0 +1,255 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// fakeForge answers the forge's two reads from files and commits it is given.
+type fakeForge struct {
+	goMods  map[string]string // `<repository> <path> <ref>` -> text
+	onTrunk map[string]bool   // by commit prefix
+	err     error
+	errAt   map[string]error // by ref: a read at that ref fails with it
+}
+
+func (f *fakeForge) File(_ context.Context, repository, path, ref string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	if e := f.errAt[ref]; e != nil {
+		return "", e
+	}
+	if s, ok := f.goMods[repository+" "+path+" "+ref]; ok {
+		return s, nil
+	}
+	return "", fmt.Errorf("no file %s of %s at %s: %w", path, repository, ref, ErrNotFound)
+}
+
+func (f *fakeForge) FullSHA(_ context.Context, _ string, commit string) (string, error) {
+	if f.err != nil {
+		return "", f.err
+	}
+	return commit + strings.Repeat("0", 40-len(commit)), nil
+}
+
+func (f *fakeForge) OnTrunk(_ context.Context, _ string, commit string) (bool, error) {
+	if f.err != nil {
+		return false, f.err
+	}
+	return f.onTrunk[commit[:12]], nil
+}
+
+// capturedGoMod is the go.mod the forge answered (testdata/captured/forge-get-file-go-mod.json), pinned to the commit given.
+func capturedGoMod(t *testing.T, pin string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "captured", "forge-get-file-go-mod.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var a struct{ File struct{ Content string } }
+	if err := json.Unmarshal(raw, &a); err != nil {
+		t.Fatal(err)
+	}
+	return strings.Replace(a.File.Content, "cb54756c3865", pin, 1)
+}
+
+func TestTheSDKPinIsTheCommitOfAPseudoVersion(t *testing.T) { // 1624
+	if c, ok := SDKPin(capturedGoMod(t, "cb54756c3865")); !ok || c != "cb54756c3865" {
+		t.Errorf("pin = %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.2.0\n"); ok {
+		t.Error("a tagged version is no commit")
+	}
+	if c, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865\n"); !ok || c != "cb54756c3865" {
+		t.Errorf("a one-line require: %q, %v", c, ok)
+	}
+	if _, ok := SDKPin("module x\n\ngo 1.26\n"); ok {
+		t.Error("a go.mod that does not require mesh-sdk has a pin")
+	}
+}
+
+// groupBench is a group of mesh-delivery#7 and the SDK's pull request 12, mesh-delivery's go.mod at its head naming pin.
+func groupBench(t *testing.T, pin string, trunk ...string) *bench {
+	b := newBench(t)
+	b.fetch.Modules = []string{"modules/m"}
+	forge := &fakeForge{goMods: map[string]string{repoA + " modules/m/go.mod " + head1: capturedGoMod(t, pin)}, onTrunk: map[string]bool{}}
+	for _, c := range trunk {
+		forge.onTrunk[c] = true
+	}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAMemberPinnedToTheSDKMembersHeadPassesAndIsBuiltAgainstIt(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, head2[:12])
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	var besideSDK bool
+	for _, f := range b.steps.tool("fetch") {
+		if f.args["repository"] == repoA {
+			refs, _ := f.args["beside"].([]BesideRef)
+			for _, r := range refs {
+				besideSDK = besideSDK || (r.Repository == repoSDK && r.Commit == head2)
+			}
+		}
+	}
+	if !besideSDK {
+		t.Error("mesh-delivery's tests were not given the SDK member at its head")
+	}
+}
+
+func TestAMemberPinnedToAnOlderHeadOfTheSDKMemberFailsNamingTheMemberAndTheCommit(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "9aaa5c80ac5c") // a commit of the SDK branch, not its head, not on the trunk
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	f := v.Failed
+	if v.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, repoA+"#7") || !strings.Contains(f.Words, "9aaa5c80ac5c") ||
+		!strings.Contains(f.Words, "neither on mesh-sdk's trunk nor the group's head") || !strings.Contains(f.Words, short12(head2)) {
+		t.Fatalf("verdict = %+v", v)
+	}
+	if n := len(b.steps.tool("test")); n != 0 {
+		t.Errorf("%d test steps ran after a stale pin", n)
+	}
+}
+
+func TestAMemberPinnedToACommitOnTheTrunkPasses(t *testing.T) { // 1624/AC2, AC4
+	b := groupBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+	// A lone pull request of a Go member is held to the trunk alone.
+	b = groupBench(t, "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
+		t.Errorf("a foreign pin with no SDK member: %+v", v)
+	}
+}
+
+func TestAPinOnlyTheSDKHeadCarriesThatDownloadCannotResolveFailsNamingIssue1148(t *testing.T) { // 1624/AC5, ADR 0453 clause 12
+	b := groupBench(t, head2[:12])
+	b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
+		if c.args["repository"] == repoA {
+			return nil, fmt.Errorf("go mod download: git.novox.be/novox/mesh-sdk/go@v0.1.14-0.20261021100209-%s: invalid version: unknown revision", head2[:12])
+		}
+		return b.fetch, nil
+	}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "issue 1148") || !strings.Contains(v.Failed.Words, head2[:12]) {
+		t.Errorf("verdict = %+v, want a failure naming issue 1148 and the commit", v)
+	}
+}
+
+func TestAPinThatCannotBeCheckedFailsAndNeverPasses(t *testing.T) { // ADR 0453 clause 12
+	b := groupBench(t, "cb54756c3865")
+	b.ex.Forge.(*fakeForge).err = fmt.Errorf("the forge is down")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the forge is down") {
+		t.Errorf("verdict = %+v", v)
+	}
+}
+
+// trunkOnlyBench is a group of mesh-delivery#7 whose fetch holds two Go modules: modules/m, which the head holds, and
+// modules/new, which only the trunk holds (added on the trunk after the branch was cut). The SDK pin of each go.mod is given.
+func trunkOnlyBench(t *testing.T, headPin, trunkPin string) *bench {
+	b := newBench(t)
+	b.fetch.Modules = []string{"modules/m", "modules/new"}
+	forge := &fakeForge{goMods: map[string]string{
+		repoA + " modules/m/go.mod " + head1:    capturedGoMod(t, headPin),
+		repoA + " modules/m/go.mod " + trunkA:   capturedGoMod(t, headPin),
+		repoA + " modules/new/go.mod " + trunkA: capturedGoMod(t, trunkPin),
+	}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
+	return b
+}
+
+func TestAModuleOnlyTheTrunkHoldsIsReadAtTheTrunkAndPasses(t *testing.T) { // 1845/AC1
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAStalePinOfAModuleOnlyTheTrunkHoldsStillFailsNamingTheFileAndTheCommit(t *testing.T) { // 1845/AC2
+	b := trunkOnlyBench(t, "cb54756c3865", "9aaa5c80ac5c")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, repoA+"#7") || !strings.Contains(v.Failed.Words, "modules/new/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAModuleTheHeadHoldsIsJudgedByTheHeadsPin(t *testing.T) { // 1845/AC3
+	b := trunkOnlyBench(t, "9aaa5c80ac5c", "cb54756c3865") // the head's pin is stale, the trunk's go.mod of the same module is fine
+	b.ex.Forge.(*fakeForge).goMods[repoA+" modules/m/go.mod "+trunkA] = capturedGoMod(t, "cb54756c3865")
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+func TestAReadThatFailsForAnotherReasonStillFailsAndIsNotTriedAtTheTrunk(t *testing.T) { // 1845/AC4
+	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
+	b.ex.Forge.(*fakeForge).errAt = map[string]error{head1: fmt.Errorf("the forge answered 500")}
+	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "the forge answered 500") {
+		t.Fatalf("verdict = %+v", v)
+	}
+}
+
+type runsAt map[string]string
+
+func (r runsAt) CommitOf(module string) string { return r[module] }
+
+func besideOf(t *testing.T, b *bench, repository string) map[string]BesideRef {
+	t.Helper()
+	out := map[string]BesideRef{}
+	for _, f := range b.steps.tool("fetch") {
+		if f.args["repository"] == repository {
+			refs, _ := f.args["beside"].([]BesideRef)
+			for _, r := range refs {
+				out[r.Repository] = r
+			}
+		}
+	}
+	return out
+}
+
+func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR 0484 clause 4
+	const controller, catalogue, host = "novox/mesh-controller", "novox/mesh-catalog", "novox/mesh-host"
+	hostRuns := strings.Repeat("7", 40)
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: "9999999999999999999999999999999999999999"})
+	b.ex.Runs = runsAt{"mesh-host": hostRuns}
+	forge := &fakeForge{goMods: map[string]string{controller + " go.mod " + head1: capturedGoMod(t, "cb54756c3865")}, onTrunk: map[string]bool{"cb54756c3865": true}}
+	b.ex.Forge = forge
+	// A group of the controller and the catalogue: the controller's tests read the catalogue's trunk, not the group's head.
+	b.judge(t, caseOf(t, pullOf(controller, 7, head1), pullOf(catalogue, 12, head2)))
+	got := besideOf(t, b, controller)
+	if c := got[catalogue]; c.Commit != trunkS || c.Ref != "" {
+		t.Errorf("the catalogue beside the controller = %+v, want its trunk %s", c, trunkS)
+	}
+	if h := got[host]; h.Commit != hostRuns {
+		t.Errorf("the node-engine beside the controller = %+v, want the commit the mesh runs %s", h, hostRuns)
+	}
+	if s := got[SDKRepository]; s.Commit != "cb54756c3865"+strings.Repeat("0", 28) {
+		t.Errorf("mesh-sdk beside the controller = %+v, want the commit its go.mod pins, whole", s)
+	}
+}
+
+func TestThePinOfTheControllerThatCannotBeReadFailsTheCheck(t *testing.T) { // review D2
+	b := newBench(t)
+	b.ex.Trunks = trunksOf(t, map[string]string{"novox/mesh-controller": trunkA})
+	b.ex.Forge = &fakeForge{goMods: map[string]string{}, onTrunk: map[string]bool{}}
+	v := b.judge(t, caseOf(t, pullOf("novox/mesh-controller", 7, head1))).Verdict
+	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "go.mod") {
+		t.Errorf("verdict = %+v", v)
+	}
+}

modules/mesh-delivery-checker/internal/check/preview.go

@@ -0,0 +1,86 @@
+package check
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+var digest64 = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
+// PreviewOf is what the fetch steps said of a pull request's head merged onto its trunk head, as the value of a previews
+// key (ADR 0484 clause 3): the merge commit and, for each module directory the fetches named with a manifest, its tree, the
+// digest of its manifest, the hashes of its lock files and its named paths' objects (ADR 0499 clause 2). The fetches of the repository's build modules merge the same
+// trees; the first one's merge commit is kept. A module directory with no tree or no manifest digest is left out, so the
+// indexer gives its module no fingerprint and says why. A head that does not merge has a preview of the files in conflict
+// alone, so the indexer says the candidate's modules have no fingerprint because it does not merge (issue 1445). It
+// answers false when no fetch was made.
+func PreviewOf(p Pull, fetched []Fetched) (delivery.Preview, bool) {
+	var merge string
+	var conflicts []string
+	mods := map[string]delivery.PreviewModule{}
+	for _, f := range fetched {
+		if len(f.Conflicts) > 0 {
+			conflicts = append(conflicts, f.Conflicts...)
+		}
+	}
+	if len(conflicts) > 0 {
+		slices.Sort(conflicts)
+		return delivery.Preview{Repository: p.Repository, Head: p.Head, Trunk: p.Trunk, Conflicts: slices.Compact(conflicts)}, true
+	}
+	for _, f := range fetched {
+		if f.Merge == "" {
+			continue
+		}
+		if merge == "" {
+			merge = f.Merge
+		}
+		for dir, t := range f.Trees {
+			if t.Tree == "" || !digest64.MatchString(t.Manifest) {
+				continue
+			}
+			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths}
+		}
+	}
+	if merge == "" {
+		return delivery.Preview{}, false
+	}
+	pv := delivery.Preview{Repository: p.Repository, Head: p.Head, Trunk: p.Trunk, Merge: merge}
+	if len(mods) > 0 {
+		pv.Modules = mods
+	}
+	return pv, true
+}
+
+// writePreview writes the preview of a pull request by a create: one writer per key, and the same head on the same trunk
+// head merges to the same trees, so a key that exists stands. A head that did not merge has no preview. A failure is said
+// and does not fail the check: the preview is for the indexer's fingerprints, not for the verdict.
+func (j *Examiner) writePreview(ctx context.Context, p Pull, fetched []Fetched) {
+	if j.Previews == nil {
+		return
+	}
+	pv, ok := PreviewOf(p, fetched)
+	if !ok {
+		return
+	}
+	key, err := delivery.PreviewKey(p.Repository, p.Head, p.Trunk)
+	if err == nil {
+		var data []byte
+		if data, err = delivery.EncodePreview(pv); err == nil {
+			_, err = j.Previews.Create(ctx, key, data)
+			if errors.Is(err, ErrConflict) {
+				return
+			}
+			if err == nil && j.Announce != nil {
+				j.Announce(ctx, EventPreviewWritten, key)
+			}
+		}
+	}
+	if err != nil {
+		j.logf("%s#%d: the preview cannot be written: %v", p.Repository, p.Number, fmt.Errorf("%w", err))
+	}
+}

modules/mesh-delivery-checker/internal/check/preview_named_test.go

@@ -0,0 +1,23 @@
+package check
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+// I8, ADR 0499 clause 2: the preview carries each named path's object a fetch's module trees answer (mesh-sdk
+// buildstep.ModuleTree's paths), so the indexer computes the candidate's narrowed tree from them by the one function.
+func TestAPreviewCarriesTheNamedPathsObjectsOfAFetchsModuleTrees(t *testing.T) {
+	var f Fetched
+	// As buildstep.ModuleTrees answers a module naming its paths: the named tree and the objects.
+	raw := `{"workspace":"w","merge":"6666666666666666666666666666666666666666","trees":{".":{"tree":"named:aa","manifest":"` +
+		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"}}}}`
+	if err := json.Unmarshal([]byte(raw), &f); err != nil {
+		t.Fatal(err)
+	}
+	pv, ok := PreviewOf(Pull{Repository: "novox/mesh-sdk", Head: "h", Trunk: "t"}, []Fetched{f})
+	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" {
+		t.Errorf("preview = %+v, want the module's named tree and its objects", pv)
+	}
+}

modules/mesh-delivery-checker/internal/check/read.go

@@ -0,0 +1,193 @@
+package check
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The read tools (novox/hq ADR 0484 clauses 8 and 13, issue 1686): what the checker stored, as stored, with the line of the
+// status it owes in full, so a check is read live without a shell. They write nothing.
+
+// The read tools, named as the module is: checker_ and the noun.
+const (
+	VerdictsReadTool = "checker_verdicts"
+	PullReadTool     = "checker_pull"
+	KeptReadTool     = "checker_kept"
+)
+
+// StateRead reads one state: its keys and a key's stored value (nil for a key with none).
+type StateRead struct {
+	Keys func() ([]string, error)
+	Get  func(key string) (json.RawMessage, error)
+}
+
+// Reader answers the read tools from the checker's verdicts and kept states and the indexer's candidates.
+type Reader struct{ VerdictState, KeptState, CandidateState StateRead }
+
+// VerdictRead is a verdict as stored with the full report of the status of each pull request it judged (Report), when the
+// candidate still holds those heads; without it the report is that of the verdict alone.
+type VerdictRead struct {
+	Key     string            `json:"key"`
+	Verdict json.RawMessage   `json:"verdict"`
+	Reports map[string]string `json:"reports,omitempty"`
+	Note    string            `json:"note,omitempty"`
+}
+
+func (r Reader) candidate(group string) (delivery.Candidate, bool) {
+	key, err := delivery.CandidatesKey(group)
+	if err != nil || r.CandidateState.Get == nil {
+		return delivery.Candidate{}, false
+	}
+	raw, err := r.CandidateState.Get(key)
+	if err != nil || len(raw) == 0 {
+		return delivery.Candidate{}, false
+	}
+	c, err := delivery.DecodeCandidate(raw)
+	return c, err == nil
+}
+
+func (r Reader) read(key string, raw json.RawMessage) (VerdictRead, error) {
+	out := VerdictRead{Key: key, Verdict: raw}
+	v, err := delivery.DecodeVerdict(raw)
+	if err != nil {
+		return out, fmt.Errorf("%s holds what is not a verdict: %w", key, err)
+	}
+	c, ok := r.candidate(v.Group)
+	if !ok || c.HeadsHash != v.Heads {
+		out.Note = "the candidate no longer holds these heads"
+		return out, nil
+	}
+	cs := CaseOf(c, v.Trunk)
+	out.Reports = map[string]string{}
+	if cs == nil {
+		return out, nil
+	}
+	for _, p := range cs.Pulls {
+		out.Reports[fmt.Sprintf("%s#%d", p.Repository, p.Number)] = Report(v, cs, p, nil, nil)
+	}
+	for _, l := range cs.Left {
+		out.Reports[strings.SplitN(l, ": ", 2)[0]] = strings.SplitN(l, ": ", 2)[1]
+	}
+	return out, nil
+}
+
+// Verdicts are the verdicts the checker holds, by key; with a group only that group's.
+func (r Reader) Verdicts(group string) ([]VerdictRead, error) {
+	if r.VerdictState.Keys == nil || r.VerdictState.Get == nil {
+		return nil, fmt.Errorf("the verdicts state cannot be read here")
+	}
+	keys, err := r.VerdictState.Keys()
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(keys)
+	var out []VerdictRead
+	for _, k := range keys {
+		if group != "" {
+			if g, _, err := delivery.ParseCheckerVerdictKey(k); err != nil || g != group {
+				continue
+			}
+		}
+		raw, err := r.VerdictState.Get(k)
+		if err != nil {
+			return nil, err
+		}
+		if len(raw) == 0 {
+			continue
+		}
+		vr, err := r.read(k, raw)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, vr)
+	}
+	return out, nil
+}
+
+// Pull answers for one pull request: the verdict of the candidate that holds it, with its report; for an hq pull request,
+// that hq is judged by merge-check.sh until issue 1296 (HQNote); for one the indexer holds in no candidate, that none does.
+func (r Reader) Pull(repository string, number int) (VerdictRead, error) {
+	if r.CandidateState.Keys == nil || r.CandidateState.Get == nil {
+		return VerdictRead{}, fmt.Errorf("the candidates state cannot be read here")
+	}
+	keys, err := r.CandidateState.Keys()
+	if err != nil {
+		return VerdictRead{}, err
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		raw, err := r.CandidateState.Get(k)
+		if err != nil || len(raw) == 0 {
+			continue
+		}
+		c, err := delivery.DecodeCandidate(raw)
+		if err != nil {
+			continue
+		}
+		for _, p := range c.Pulls {
+			if p.Repository != repository || p.Number != number {
+				continue
+			}
+			if repository == HQRepository {
+				return VerdictRead{Key: k, Note: HQNote}, nil
+			}
+			vkey, err := delivery.CheckerVerdictKey(c.Group, c.HeadsHash)
+			if err != nil {
+				return VerdictRead{}, err
+			}
+			vraw, err := r.VerdictState.Get(vkey)
+			if err != nil {
+				return VerdictRead{}, err
+			}
+			if len(vraw) == 0 {
+				return VerdictRead{Key: vkey, Note: "no verdict yet for the heads of its candidate"}, nil
+			}
+			return r.read(vkey, vraw)
+		}
+	}
+	return VerdictRead{}, fmt.Errorf("no candidate holds %s#%d", repository, number)
+}
+
+// Kept is the kept verdicts: one key's value as stored, or with an empty key the keys of a level (or every level) and their values.
+func (r Reader) Kept(level, digest string) (map[string]json.RawMessage, error) {
+	if r.KeptState.Keys == nil || r.KeptState.Get == nil {
+		return nil, fmt.Errorf("the kept state cannot be read here")
+	}
+	if digest != "" {
+		key, err := delivery.KeptKey(level, digest)
+		if err != nil {
+			return nil, err
+		}
+		raw, err := r.KeptState.Get(key)
+		if err != nil {
+			return nil, err
+		}
+		if len(raw) == 0 {
+			return nil, fmt.Errorf("no kept verdict %s", key)
+		}
+		return map[string]json.RawMessage{key: raw}, nil
+	}
+	keys, err := r.KeptState.Keys()
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(keys)
+	out := map[string]json.RawMessage{}
+	for _, k := range keys {
+		if l, _, err := delivery.ParseKeptKey(k); err != nil || (level != "" && l != level) {
+			continue
+		}
+		raw, err := r.KeptState.Get(k)
+		if err != nil {
+			return nil, err
+		}
+		if len(raw) > 0 {
+			out[k] = raw
+		}
+	}
+	return out, nil
+}

modules/mesh-delivery-checker/internal/check/read_test.go

@@ -0,0 +1,104 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+type fakeState map[string][]byte
+
+func (f fakeState) read() StateRead {
+	return StateRead{
+		Keys: func() ([]string, error) {
+			var k []string
+			for key := range f {
+				k = append(k, key)
+			}
+			return k, nil
+		},
+		Get: func(key string) (json.RawMessage, error) {
+			if v, ok := f[key]; ok {
+				return json.RawMessage(v), nil
+			}
+			return nil, nil
+		},
+	}
+}
+
+// readerOf is a reader over a verdict the checker wrote through its own code and the candidate it judged.
+func readerOf(t *testing.T) (Reader, string) {
+	t.Helper()
+	r := newRig(t, passJudge())
+	cand := candidateOf(t, "feat/x", pullOf(repoA, 7, head1), pullOf(HQRepository, 3, head2))
+	r.ch.Candidate(context.Background(), "feat%2Fx", cand)
+	r.ch.Wait()
+	ckey, _ := delivery.CandidatesKey("feat/x")
+	verdicts, kept := fakeState{}, fakeState{}
+	for k, v := range r.verdicts.vals {
+		verdicts[k] = v
+	}
+	if _, err := (Kept{Store: r.verdicts}).Keep(context.Background(), "unit", digA, keptValue("m/a", 3)); err != nil {
+		t.Fatal(err)
+	}
+	kept["unit."+digA] = r.verdicts.vals["unit."+digA]
+	return Reader{VerdictState: verdicts.read(), KeptState: kept.read(), CandidateState: fakeState{ckey: cand}.read()}, keyOf(t, "feat/x", cand)
+}
+
+func TestTheVerdictToolsAnswerTheStoredVerdictWithTheFullReportOfEachPullRequest(t *testing.T) { // N9/AC1, 1686
+	rd, key := readerOf(t)
+	vs, err := rd.Verdicts("")
+	if err != nil || len(vs) != 1 || vs[0].Key != key {
+		t.Fatalf("verdicts = %+v, %v", vs, err)
+	}
+	if _, err := delivery.DecodeVerdict(vs[0].Verdict); err != nil {
+		t.Errorf("the verdict is not as stored: %v", err)
+	}
+	if got := vs[0].Reports["novox/mesh-delivery#7"]; !strings.HasPrefix(got, "pass 111111111111 on aaaaaaaaaaaa") || !strings.Contains(got, "composition not yet run") {
+		t.Errorf("reports = %v", vs[0].Reports)
+	}
+	if only, _ := rd.Verdicts("feat/other"); len(only) != 0 {
+		t.Errorf("another group's verdicts = %+v", only)
+	}
+}
+
+func TestAnHqPullRequestIsSaidToBeJudgedByMergeCheckUntilIssue1296(t *testing.T) { // ADR 0484 clause 8
+	rd, _ := readerOf(t)
+	hq, err := rd.Pull(HQRepository, 3)
+	if err != nil || hq.Note != "hq: judged by merge-check.sh until issue 1296" || hq.Verdict != nil {
+		t.Errorf("hq pull = %+v, %v", hq, err)
+	}
+	p, err := rd.Pull(repoA, 7)
+	if err != nil || p.Note != "" || !strings.HasPrefix(p.Reports["novox/mesh-delivery#7"], "pass ") {
+		t.Errorf("pull = %+v, %v", p, err)
+	}
+	if _, err := rd.Pull(repoA, 99); err == nil {
+		t.Error("a pull request no candidate holds was answered")
+	}
+}
+
+func TestTheKeptToolAnswersTheKeysAsStoredByLevelAndByDigest(t *testing.T) { // N9/AC1
+	rd, _ := readerOf(t)
+	all, err := rd.Kept("", "")
+	if err != nil || len(all) != 1 {
+		t.Fatalf("kept = %v, %v", all, err)
+	}
+	one, err := rd.Kept("unit", digA)
+	if err != nil || len(one) != 1 {
+		t.Fatalf("one kept = %v, %v", one, err)
+	}
+	for _, raw := range one {
+		if k, err := delivery.DecodeKept(raw); err != nil || k.Package != "m/a" {
+			t.Errorf("kept value = %+v, %v", k, err)
+		}
+	}
+	if none, _ := rd.Kept("integration", ""); len(none) != 0 {
+		t.Errorf("integration = %v", none)
+	}
+	if _, err := rd.Kept("unit", digB); err == nil {
+		t.Error("a digest nothing kept was answered")
+	}
+}

modules/mesh-delivery-checker/internal/check/results.go

@@ -0,0 +1,98 @@
+package check
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+// The shapes of what the build modules' steps answer, as their code writes them (mesh-catalog modules/mesh-build-go
+// cmd/mesh-build-go levels.go TestResult, digest.go DigestResult, fetch.go FetchResult; modules/mesh-build-node
+// cmd/mesh-build-node check.go TestResult, fetch.go FetchResult) with the fields the fetch step adds for a merge (ADR 0484
+// clause 3). Only the fields the checker reads are named; the rest is ignored.
+
+// MergeTree is what a fetch that merged says of one module directory: the tree sha, the digest of its manifest, the
+// hashes of its lock files by name and the objects of its named paths. A bare string is the tree alone.
+type MergeTree struct {
+	Tree     string            `json:"tree"`
+	Manifest string            `json:"manifest,omitempty"`
+	Locks    map[string]string `json:"locks,omitempty"`
+	// Paths are, of a module whose every artifact names its paths, each named path's object; Tree is then their named
+	// tree (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0499 clause 2).
+	Paths map[string]string `json:"paths,omitempty"`
+}
+
+// UnmarshalJSON takes a string as the tree alone, or an object.
+func (t *MergeTree) UnmarshalJSON(data []byte) error {
+	if s := strings.TrimSpace(string(data)); strings.HasPrefix(s, `"`) {
+		return json.Unmarshal(data, &t.Tree)
+	}
+	type plain MergeTree
+	return json.Unmarshal(data, (*plain)(t))
+}
+
+// Fetched is the answer of a build module's fetch step.
+type Fetched struct {
+	Workspace string   `json:"workspace"`
+	Commit    string   `json:"commit"`
+	Modules   []string `json:"modules"`
+	// What a fetch with a base adds: the trunk commit, the merge commit, the files in conflict (a conflict is an answer),
+	// the paths the merge changes and the trees of the module directories.
+	Base      string               `json:"base,omitempty"`
+	Merge     string               `json:"merge,omitempty"`
+	Conflicts []string             `json:"conflicts,omitempty"`
+	Changed   []string             `json:"changed,omitempty"`
+	Trees     map[string]MergeTree `json:"trees,omitempty"`
+}
+
+// GoPackage is one package of a Go test result.
+type GoPackage struct {
+	Dir     string  `json:"dir"`
+	Package string  `json:"package"`
+	Passed  bool    `json:"passed"`
+	Elapsed float64 `json:"elapsed"`
+	Tests   int     `json:"tests"`
+	NoTests bool    `json:"no_tests,omitempty"`
+}
+
+// Failure is a test that failed, or a package that failed with no test to name.
+type Failure struct {
+	Package string `json:"package"`
+	Test    string `json:"test,omitempty"`
+	Output  string `json:"output,omitempty"`
+}
+
+// TestTime is one test and the seconds it took.
+type TestTime struct {
+	Package string  `json:"package"`
+	Test    string  `json:"test"`
+	Elapsed float64 `json:"elapsed"`
+}
+
+// Tested is the answer of a test step of either build module (the Go one names packages and counts tests; the Node one
+// names the package directory as Module and counts none).
+type Tested struct {
+	Level      string      `json:"level"`
+	Module     string      `json:"module,omitempty"`
+	Passed     bool        `json:"passed"`
+	Why        string      `json:"why,omitempty"`
+	NoTests    bool        `json:"no_tests,omitempty"`
+	Tests      int         `json:"tests"`
+	Skipped    int         `json:"skipped"`
+	Packages   []GoPackage `json:"packages,omitempty"`
+	Elapsed    float64     `json:"elapsed"`
+	Setup      float64     `json:"setup,omitempty"`
+	Bound      float64     `json:"bound"`
+	SetupBound float64     `json:"setup_bound,omitempty"`
+	Slowest    []TestTime  `json:"slowest,omitempty"`
+	Failed     []Failure   `json:"failed,omitempty"`
+	OverBound  bool        `json:"over_bound"`
+	OverWhich  string      `json:"over_which,omitempty"`
+}
+
+// Digested is the answer of the Go build module's digest step: one digest per package that has tests at the level, by import
+// path.
+type Digested struct {
+	Level        string            `json:"level"`
+	Packages     map[string]string `json:"packages"`
+	WithoutTests []string          `json:"without_tests,omitempty"`
+}

modules/mesh-delivery-checker/internal/check/store.go

@@ -0,0 +1,19 @@
+package check
+
+import (
+	"context"
+	"errors"
+)
+
+// ErrConflict is what a KV answers when a Create finds the key or an Update finds another revision than the one given.
+var ErrConflict = errors.New("the key exists or changed")
+
+// KV is one of the checker's buckets: read, create and compare-and-set, each write answering the key's new revision. Only
+// the checker's credential writes them (ADR 0444 clause 5, ADR 0484 clause 2).
+type KV interface {
+	Get(ctx context.Context, key string) (value []byte, revision uint64, found bool, err error)
+	Create(ctx context.Context, key string, value []byte) (uint64, error)
+	Update(ctx context.Context, key string, value []byte, revision uint64) (uint64, error)
+	// Keys are every key of the bucket.
+	Keys(ctx context.Context) ([]string, error)
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/README

@@ -0,0 +1,21 @@
+go-test-failing.json, go-test-slow.json, go-test-empty.json and go-digest.json are what mesh-catalog's mesh-build-go answers
+(TestResult and DigestResult, cmd/mesh-build-go levels.go and digest.go), marshalled by the module's own code: a throwaway
+test beside the module's test_test.go and digest_test.go (workspaceFor + runUnit on the fixtures testdata/captured/failing,
+slow and empty, and digestFixture + digests on testdata/repos/digest) at mesh-catalog origin/main cdbdb474, captured on
+2026-10-21 for issue 1679 and not kept there. The fixtures' package names are the build module's own (fixture/failing/bad...).
+
+go-fetch-clean.json and go-fetch-conflict.json are what mesh-build-go's fetch step ends with (FetchResult, cmd/mesh-build-go
+fetch.go and preview.go) for a fetch with a base, the Result bytes of the step in mesh-catalog's own tests
+TestFetchWithABaseMergesAndAnswersThePreview and TestFetchWithAConflictEndsPassedAndNamesTheFiles (preview_test.go), copied
+into a throwaway test that wrote them out, at mesh-catalog feat/r4c5-checker d5804927 (the git commands are the test's fake,
+so the shas are its constants; the shape and the field names are the module's own marshalling). node-fetch-clean.json is the
+FetchResult json.Marshal of mesh-build-node's fetch (fetch.go, preview.go) in its test TestFetchWithABaseMergesAndAnswersThePreview
+(cmd/mesh-build-node/preview_test.go) at the same commit. Captured on 2026-10-21 for issue 1679.
+
+forge-get-file-go-mod.json is the answer of the forge's gitea_get_file (mesh-catalog modules/gitea, tools/index.ts) for modules/mesh-delivery-builder/go.mod of
+novox/mesh-delivery at main, and forge-compare-trunk.json the answer of gitea_compare for novox/mesh-sdk base main, head cb54756c3865 (a commit on the
+trunk: no commit main does not hold); both called through the mesh on 2026-10-21 for issue 1624. forge-compare-branch.json is the answer of the same call for a
+head that is not on the trunk (novox/mesh-sdk base main, head afbe371003a5, the branch feat/r4c5-sdk), shortened to two of its seven commits and one of its
+twenty-six files, with the head and the totals set to match.
+
+forge-commits.json is the answer of the forge's gitea_commits for novox/mesh-sdk, ref cb54756c3865, limit 1, called through the mesh on 2026-10-21 (review D2).

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-commits.json

@@ -0,0 +1,14 @@
+{
+    "commits": [
+        {
+            "author": "mesh-tools",
+            "date": "2026-10-21T10:02:09Z",
+            "sha": "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1",
+            "subject": "Merge pull request 'Give delivery.Module the toolchains its fingerprint was computed with, and '.' as a root module's path, so the builder builds a key only with its own toolchain (issue 1615)' (#55) from fix/1615-module-toolchains-root into main"
+        }
+    ],
+    "more": true,
+    "page": 1,
+    "ref": "cb54756c3865",
+    "repository": "novox/mesh-sdk"
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-compare-branch.json

@@ -0,0 +1,31 @@
+{
+    "base": "main",
+    "commits": [
+        {
+            "author": "jochen",
+            "date": "2026-10-21T19:35:14+02:00",
+            "files": 2,
+            "sha": "9aaa5c80ac5c4820c4eddf488fbb90ac6981a624",
+            "subject": "Accept the gate's recheck status mesh/repo-check among the owed contexts, so a pinned recheck is not refused (issue 1673)"
+        },
+        {
+            "author": "jochen",
+            "date": "2026-10-21T19:26:02+02:00",
+            "files": 3,
+            "sha": "0730ef609216798e787ee8b6542912f5ec613a77",
+            "subject": "Keep the unit level cheap: the merge's real-git tests start processes, so they are integration tests (issue 895)"
+        }
+    ],
+    "files": [
+        {
+            "path": "go/delivery/gate.go",
+            "status": "modified"
+        }
+    ],
+    "head": "9aaa5c80ac5c",
+    "repository": "novox/mesh-sdk",
+    "said": [
+        "9aaa5c80ac5c holds 2 commits main does not, touching 1 files"
+    ],
+    "total_commits": 2
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-compare-trunk.json

@@ -0,0 +1,12 @@
+{
+    "base": "main",
+    "commits": [],
+    "files": [],
+    "head": "cb54756c3865",
+    "repository": "novox/mesh-sdk",
+    "said": [
+        "cb54756c3865 holds 0 commits main does not, touching 0 files",
+        "a file's status is the last listed commit's change to it; for the lines, gitea_pull_request_diff or gitea_get_file"
+    ],
+    "total_commits": 0
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-get-file-go-mod.json

@@ -0,0 +1,9 @@
+{
+    "file": {
+        "content": "module mesh-delivery-builder\n\ngo 1.26.0\n\nrequire (\n\tgit.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865\n\tgithub.com/nats-io/nats-server/v2 v2.11.17\n\tgithub.com/nats-io/nats.go v1.54.0\n)\n\nrequire (\n\tgithub.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op // indirect\n\tgithub.com/google/go-tpm v0.9.8 // indirect\n\tgithub.com/klauspost/compress v1.20.0 // indirect\n\tgithub.com/minio/highwayhash v1.0.4 // indirect\n\tgithub.com/nats-io/jwt/v2 v2.8.1 // indirect\n\tgithub.com/nats-io/nkeys v0.4.16 // indirect\n\tgithub.com/nats-io/nuid v1.0.1 // indirect\n\tgolang.org/x/crypto v0.57.0 // indirect\n\tgolang.org/x/sys v0.48.0 // indirect\n\tgolang.org/x/time v0.15.0 // indirect\n)\n",
+        "path": "modules/mesh-delivery-builder/go.mod",
+        "ref": "main",
+        "sha": "4431597e2e4d2a26b59006f9f8c54659a964ec68",
+        "size": 691
+    }
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-digest.json

@@ -0,0 +1,11 @@
+{
+ "level": "unit",
+ "packages": {
+  "fixture/digest/a": "c288afe6252c38d9e7286ecb5f28b3c961780871fcc253670dcc3151c11c1df2",
+  "fixture/digest/c": "11abf5f32f0f12caafd76c565e4c2c2f3bf2e3ce6c2c7fcb6c2264a06db40087"
+ },
+ "without_tests": [
+  "fixture/digest/b",
+  "fixture/digest/d"
+ ]
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-fetch-clean.json

@@ -0,0 +1 @@
+{"workspace":"mvii1iwu5414e4","commit":"0123456789abcdef0123456789abcdef01234567","modules":["."],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"fedcba9876543210fedcba9876543210fedcba98","changed":["a.go","modules/m/main.go"],"trees":{"modules/m":{"tree":"1111111111111111111111111111111111111111","manifest":"ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356","locks":{"go.sum":"c5fc83c01e92404452b986527d239140ccf9a48b88e0c268fbf38c2e1429e9c9"}}}}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-fetch-conflict.json

@@ -0,0 +1 @@
+{"workspace":"mvii1iwz5050eb","commit":"0123456789abcdef0123456789abcdef01234567","modules":["."],"base":"abcdef0123456789abcdef0123456789abcdef01","conflicts":["a.go","sub/b.go"]}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-test-empty.json

@@ -0,0 +1,21 @@
+{
+ "level": "unit",
+ "passed": true,
+ "why": "the repository has no tests at the unit level",
+ "no_tests": true,
+ "tests": 0,
+ "skipped": 0,
+ "packages": [
+  {
+   "dir": ".",
+   "package": "fixture/empty",
+   "passed": true,
+   "elapsed": 0,
+   "tests": 0,
+   "no_tests": true
+  }
+ ],
+ "elapsed": 0,
+ "bound": 5,
+ "over_bound": false
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-test-failing.json

@@ -0,0 +1,45 @@
+{
+ "level": "unit",
+ "passed": false,
+ "why": "1 failed: fixture/failing/bad TestThreeIsFour",
+ "tests": 2,
+ "skipped": 0,
+ "packages": [
+  {
+   "dir": ".",
+   "package": "fixture/failing/bad",
+   "passed": false,
+   "elapsed": 0.003,
+   "tests": 1
+  },
+  {
+   "dir": ".",
+   "package": "fixture/failing/good",
+   "passed": true,
+   "elapsed": 0.002,
+   "tests": 1
+  }
+ ],
+ "elapsed": 0.003,
+ "bound": 5,
+ "slowest": [
+  {
+   "package": "fixture/failing/bad",
+   "test": "TestThreeIsFour",
+   "elapsed": 0
+  },
+  {
+   "package": "fixture/failing/good",
+   "test": "TestTwo",
+   "elapsed": 0
+  }
+ ],
+ "failed": [
+  {
+   "package": "fixture/failing/bad",
+   "test": "TestThreeIsFour",
+   "output": "    bad_test.go:7: Three() = 3, want 4\n--- FAIL: TestThreeIsFour (0.00s)"
+  }
+ ],
+ "over_bound": false
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/go-test-slow.json

@@ -0,0 +1,30 @@
+{
+ "level": "unit",
+ "passed": true,
+ "tests": 2,
+ "skipped": 0,
+ "packages": [
+  {
+   "dir": ".",
+   "package": "fixture/slow",
+   "passed": true,
+   "elapsed": 0.065,
+   "tests": 2
+  }
+ ],
+ "elapsed": 0.065,
+ "bound": 5,
+ "slowest": [
+  {
+   "package": "fixture/slow",
+   "test": "TestTakesAWhile",
+   "elapsed": 0.06
+  },
+  {
+   "package": "fixture/slow",
+   "test": "TestQuick",
+   "elapsed": 0
+  }
+ ],
+ "over_bound": false
+}

modules/mesh-delivery-checker/internal/check/testdata/captured/node-fetch-clean.json

@@ -0,0 +1 @@
+{"workspace":"mvii1sxt979f67","commit":"0123456789abcdef0123456789abcdef01234567","modules":["modules/m"],"installed":[],"refused":[],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"0123456789abcdef0123456789abcdef01234567","changed":["modules/m/package.json"],"trees":{"modules/m":{"tree":"0123456789abcdef0123456789abcdef01234567","manifest":"0581b699d9d05517e69b21f5cedbeb2eee8aba2b205280b561be731594d7feef"}}}

modules/mesh-delivery-checker/manifest_test.go

@@ -0,0 +1,220 @@
+package manifest
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+)
+
+// The controller's manifest reader is mesh-controller internal/catalogue (Manifest, manifest.go: Consumes :521,
+// Invokes :590, Streams :613, Reads :659; StreamDeclaration, streams.go), an internal package of another repository.
+// These tests decode the manifest strictly into the fields those types name (DisallowUnknownFields) and hold the
+// rules of issues 1678 and 1683 (ADR 0453 §4, ADR 0484). The merge gate's module check proves the controller takes the manifest.
+
+type state struct {
+	Name    string `json:"name"`
+	History int    `json:"history,omitempty"`
+}
+
+type artifact struct {
+	Name     string   `json:"name"`
+	Kind     string   `json:"kind"`
+	Language string   `json:"language"`
+	System   string   `json:"system"`
+	From     string   `json:"from"`
+	Binary   string   `json:"binary"`
+	Loads    []string `json:"loads"`
+}
+
+type stream struct {
+	Name   string   `json:"name"`
+	Events []string `json:"events"`
+}
+
+type manifest struct {
+	Streams  []stream `json:"streams"`
+	Tools    []string `json:"tools"`
+	Module   string   `json:"module"`
+	Version  string   `json:"version"`
+	Slug     string   `json:"slug"`
+	Consumes []string `json:"consumes"`
+	State    []state  `json:"state"`
+	Reads    []string `json:"reads"`
+	Invokes  []string `json:"invokes"`
+	Config   map[string]struct {
+		Type        string `json:"type"`
+		Description string `json:"description"`
+		Pattern     string `json:"pattern"`
+		Default     string `json:"default"`
+	} `json:"config"`
+	OwnSecrets   map[string]string `json:"own-secrets"`
+	SecretsOwner string            `json:"secrets-owner"`
+	Resources    []map[string]any  `json:"resources"`
+	Build        struct {
+		Artifacts []artifact `json:"artifacts"`
+	} `json:"build"`
+}
+
+func load(t *testing.T) (manifest, map[string]json.RawMessage) {
+	t.Helper()
+	raw, err := os.ReadFile("module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var m manifest
+	dec := json.NewDecoder(bytes.NewReader(raw))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&m); err != nil {
+		t.Fatalf("the controller's reader refuses a key this manifest has: %v", err)
+	}
+	var top map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &top); err != nil {
+		t.Fatal(err)
+	}
+	return m, top
+}
+
+func sorted(s []string) []string {
+	s = slices.Clone(s)
+	slices.Sort(s)
+	return s
+}
+
+func TestManifestDeclarations(t *testing.T) { // 1678/AC1
+	m, top := load(t)
+	if m.Module != "mesh-delivery-checker" {
+		t.Errorf("module = %q", m.Module)
+	}
+	// delivery.CheckerKeptHistory, CheckerOwedHistory, PreviewsHistory, CheckerVerdictsHistory; the names follow the SDK's buckets.
+	if want := []state{{Name: "kept", History: 1}, {Name: "owed", History: 5}, {Name: "previews", History: 5}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
+		t.Errorf("state = %+v, want %+v", m.State, want)
+	}
+	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
+		"mesh-controller.plans-building", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-indexer.candidates",
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		t.Errorf("reads = %v, want %v", m.Reads, want)
+	}
+	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "mesh-build-go.build_go_digest", "mesh-build-go.build_go_fetch", "mesh-build-go.build_go_test", "mesh-build-node.build_node_fetch", "mesh-build-node.build_node_test"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
+		t.Errorf("invokes = %v, want only the build modules' fetch, digest and test (no run step before issue 1309, ADR 0484 clause 5) and the forge's two reads for a mesh-sdk pin (clause 9)", m.Invokes)
+	}
+	// The checker is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it starts.
+	if want := []string{"mesh-build-go.toolchain.reported", "mesh-build-node.toolchain.reported"}; !reflect.DeepEqual(sorted(m.Consumes), want) {
+		t.Errorf("consumes = %v, want %v", m.Consumes, want)
+	}
+	if b, ok := m.OwnSecrets["broker"]; !ok || len(m.OwnSecrets) != 1 || b != "${dir:state}/broker" {
+		t.Errorf("own-secrets = %v, want exactly broker", m.OwnSecrets)
+	}
+	if m.SecretsOwner != "mesh-delivery-checker" {
+		t.Errorf("secrets-owner = %q", m.SecretsOwner)
+	}
+	// The checker says each time it wrote a preview or a status, so the indexer's and the forge bridge's watches find the buckets (ADR 0484 clauses 2 and 3).
+	if want := []stream{{Name: "checks", Events: []string{"preview.**", "owed.**"}}}; !reflect.DeepEqual(m.Streams, want) {
+		t.Errorf("streams = %+v, want %+v", m.Streams, want)
+	}
+	// The read tools (issue 1686) are served by the tools bundle, not by the checker's process.
+	if want := []string{"checker_kept", "checker_pull", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+		t.Errorf("tools = %v, want %v", m.Tools, want)
+	}
+	for _, k := range []string{"logs", "emits", "claims", "provides", "requires", "uses", "defines-seats", "seat", "seats", "bus"} {
+		if _, ok := top[k]; ok {
+			t.Errorf("the manifest declares %q: the checker has none", k)
+		}
+	}
+}
+
+func TestManifestProcess(t *testing.T) { // 1678/AC1
+	m, _ := load(t)
+	var procs []map[string]any
+	for _, r := range m.Resources {
+		if r["type"] == "process" {
+			procs = append(procs, r)
+		}
+		if r["type"] == "tool" || r["type"] == "seat" {
+			t.Errorf("resource %v: the checker serves no tool and holds no seat", r)
+		}
+	}
+	if len(procs) != 1 {
+		t.Fatalf("%d process resources, want one", len(procs))
+	}
+	p := procs[0]
+	if p["artifact"] != "program" || !reflect.DeepEqual(p["run"], []any{"./mesh-delivery-checker"}) {
+		t.Errorf("process = %v", p)
+	}
+	env, _ := p["env"].(map[string]any)
+	// The capacity of each node is the module's setting `capacity` (ADR 0484 clause 12, as the builder's, issue 1661), laid into the
+	// settings file the program reads; empty is one step at a time everywhere. The environment holds no capacity.
+	if len(env) != 2 || env["MESH_BROKER_FILE"] != "${dir:state}/broker" || env["MESH_CHECKER_SETTINGS"] != "${dir:state}/settings.json" {
+		t.Errorf("env = %v", p["env"])
+	}
+	if !reflect.DeepEqual(p["restart-on"], []any{"settings"}) {
+		t.Errorf("restart-on = %v, want the settings file, so a changed capacity reaches the running program", p["restart-on"])
+	}
+	c, ok := m.Config["capacity"]
+	if !ok || len(m.Config) != 1 || c.Type != "string" || c.Default != "" || c.Description == "" {
+		t.Errorf("config = %+v, want one string setting, capacity, empty (one step at a time on every node) to start", m.Config)
+	}
+	var settings map[string]any
+	for _, r := range m.Resources {
+		if r["id"] == "settings" {
+			settings = r
+		}
+	}
+	if settings == nil || settings["type"] != "file" || settings["merge"] != "json" || !reflect.DeepEqual(settings["takes-config"], []any{"capacity"}) || settings["path"] != "${dir:state}/settings.json" {
+		t.Errorf("settings resource = %v", settings)
+	}
+	if raw, err := os.ReadFile("files/settings.json"); err != nil || !strings.Contains(string(raw), `"capacity": ""`) {
+		t.Errorf("files/settings.json = %q, %v, want the setting's starting value", raw, err)
+	}
+	if _, bus := p["bus"]; bus {
+		t.Errorf("the process declares a bus: it runs on its own broker credential")
+	}
+	if len(m.Build.Artifacts) != 3 || m.Build.Artifacts[2].Name != "files" || m.Build.Artifacts[2].Kind != "archive" || m.Build.Artifacts[2].From != "files" {
+		t.Fatalf("artifacts = %+v, want the program, the tools and the files", m.Build.Artifacts)
+	}
+	if a := m.Build.Artifacts[1]; a.Name != "tools" || a.Kind != "bundle" || a.Language != "go" || a.Binary != "mesh-delivery-checker-tools" ||
+		!reflect.DeepEqual(a.Loads, []string{"mesh-delivery-checker-tools"}) {
+		t.Errorf("tools artifact = %+v", a)
+	}
+	if st, err := os.Stat(m.Build.Artifacts[1].From); err != nil || !st.IsDir() {
+		t.Errorf("the tools' source %s: %v", m.Build.Artifacts[1].From, err)
+	}
+	a := m.Build.Artifacts[0]
+	if st, err := os.Stat(a.From); err != nil || !st.IsDir() || a.Binary != "mesh-delivery-checker" || !strings.HasSuffix(a.From, a.Binary) || a.Kind != "bundle" || a.Language != "go" {
+		t.Errorf("artifact = %+v", a)
+	}
+}
+
+func TestServesNoRequestSubjectAndHoldsNoTicker(t *testing.T) { // 1678/AC6 (ADR 0437 §8: no timer, a wait is a context's bound)
+	forbidden := []string{"Subscribe(", "QueueSubscribe", "ChanSubscribe", "time.NewTicker", "time.Tick", "time.NewTimer", "time.AfterFunc", "time.After(", "time.Sleep"}
+	var files int
+	for _, root := range []string{"cmd", "internal"} {
+		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+				return err
+			}
+			files++
+			src, err := os.ReadFile(path)
+			if err != nil {
+				return err
+			}
+			for _, f := range forbidden {
+				if strings.Contains(string(src), f) {
+					t.Errorf("%s holds %s: the checker serves no request subject and holds no timer", path, f)
+				}
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if files < 1 {
+		t.Fatalf("read %d source files, want the program's", files)
+	}
+}

modules/mesh-delivery-checker/module.json

@@ -0,0 +1,135 @@
+{
+  "module": "mesh-delivery-checker",
+  "version": "1",
+  "slug": "checker",
+  "consumes": [
+    "mesh-build-go.toolchain.reported",
+    "mesh-build-node.toolchain.reported"
+  ],
+  "streams": [
+    { "name": "checks", "events": ["preview.**", "owed.**"] }
+  ],
+  "state": [
+    { "name": "kept", "history": 1 },
+    { "name": "owed", "history": 5 },
+    { "name": "previews", "history": 5 },
+    { "name": "verdicts", "history": 5 }
+  ],
+  "reads": [
+    "mesh-build-go.steps",
+    "mesh-build-go.toolchains",
+    "mesh-build-node.steps",
+    "mesh-build-node.toolchains",
+    "mesh-controller.plans-building",
+    "mesh-delivery-builder.builds",
+    "mesh-delivery-gate.source",
+    "mesh-delivery-indexer.candidates",
+    "mesh-delivery-indexer.manifests",
+    "mesh-delivery-indexer.modules",
+    "mesh-delivery-watchman.presence",
+    "node-engine.have"
+  ],
+  "tools": [
+    "checker_kept",
+    "checker_pull",
+    "checker_verdicts"
+  ],
+  "invokes": [
+    "gitea.gitea_commits",
+    "gitea.gitea_compare",
+    "gitea.gitea_get_file",
+    "mesh-build-go.build_go_digest",
+    "mesh-build-go.build_go_fetch",
+    "mesh-build-go.build_go_test",
+    "mesh-build-node.build_node_fetch",
+    "mesh-build-node.build_node_test"
+  ],
+  "config": {
+    "capacity": {
+      "type": "string",
+      "description": "How many build steps the checker runs at once on each node, as node=steps pairs separated by commas, such as shanks=2,ace=1 (ADR 0484 clause 12); a node set to 0 never checks, a node not named runs one at a time, and empty is one everywhere. The builder's capacity is the builder's own.",
+      "pattern": "|[a-z0-9_-]+=[0-9]+(,[a-z0-9_-]+=[0-9]+)*",
+      "default": ""
+    }
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-delivery-checker",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-delivery-checker",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-delivery-checker"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-delivery-checker",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "mesh-delivery-checker",
+      "takes-config": ["capacity"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
+    {
+      "id": "checker",
+      "type": "process",
+      "name": "mesh-delivery-checker",
+      "artifact": "program",
+      "run": [
+        "./mesh-delivery-checker"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "${dir:state}/broker",
+        "MESH_CHECKER_SETTINGS": "${dir:state}/settings.json"
+      },
+      "restart-on": [
+        "settings"
+      ],
+      "user": "mesh-delivery-checker",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "program",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-delivery-checker",
+        "binary": "mesh-delivery-checker"
+      },
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-delivery-checker-tools",
+        "binary": "mesh-delivery-checker-tools",
+        "loads": [
+          "mesh-delivery-checker-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/call.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -89,3 +90,34 @@ func treesVia(ctx context.Context, call caller) bridge.Trees {
 		return a.Root, a.Trees, nil
 	}
 }
+
+// getFileTool is the forge's tool for one file at a ref (mesh-catalog modules/gitea tools/index.ts gitea_get_file):
+// arguments owner, repo, path and ref, answer {file: {path, ref, sha, size, content}}, the content decoded to text
+// (client.ts getFile). A path the forge does not have fails with `Gitea API <path>: 404 <body>` (client.ts request).
+const getFileTool = "gitea.gitea_get_file"
+
+// notFound is how the forge's error says 404 (client.ts request: `Gitea API ${path}: ${status} ${text}`; client.ts:670
+// recognises it as /: 404 /).
+var notFound = regexp.MustCompile(`: 404 `)
+
+// filesVia asks the forge for a file through call. A file the forge says is not there is bridge.ErrNotFound.
+func filesVia(ctx context.Context, call caller) bridge.Files {
+	return func(owner, repo, path, ref string) ([]byte, error) {
+		raw, err := call(ctx, getFileTool, map[string]string{"owner": owner, "repo": repo, "path": path, "ref": ref})
+		if err != nil {
+			if notFound.MatchString(err.Error()) {
+				return nil, fmt.Errorf("%w: %v", bridge.ErrNotFound, err)
+			}
+			return nil, err
+		}
+		var a struct {
+			File *struct {
+				Content *string `json:"content"`
+			} `json:"file"`
+		}
+		if err := json.Unmarshal(raw, &a); err != nil || a.File == nil || a.File.Content == nil {
+			return nil, fmt.Errorf("the answer of %s is not {file: {content}}: %v", getFileTool, err)
+		}
+		return []byte(*a.File.Content), nil
+	}
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/gate.go

@@ -0,0 +1,187 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strconv"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-forge-bridge/internal/bridge"
+)
+
+// performedBucket is the module's state bucket performed, `<module>_<name>` as heads is: for each key of the gate's
+// buckets the bridge has acted on, the revision it acted at (manifest state entry performed, novox/hq ADR 0437 §8).
+// Its keys are `owed.<owed key>` and `merges.<merges key>`; its value is the revision in decimal.
+const performedBucket = delivery.ForgeBridgeModule + "_performed"
+
+// kvRevisions is the bucket performed as the performer's revisions.
+type kvRevisions struct{ kv jetstream.KeyValue }
+
+func (s kvRevisions) Get(ctx context.Context, key string) (uint64, bool, error) {
+	e, err := s.kv.Get(ctx, key)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return 0, false, nil
+	}
+	if err != nil {
+		return 0, false, err
+	}
+	rev, err := strconv.ParseUint(string(e.Value()), 10, 64)
+	if err != nil {
+		return 0, false, fmt.Errorf("%s holds %q, which is no revision: %w", key, e.Value(), err)
+	}
+	return rev, true, nil
+}
+
+func (s kvRevisions) Put(ctx context.Context, key string, rev uint64) error {
+	_, err := s.kv.PutString(ctx, key, strconv.FormatUint(rev, 10))
+	return err
+}
+
+// revisions is what the performer keeps of the revisions it acted at.
+type revisions interface {
+	Get(ctx context.Context, key string) (rev uint64, found bool, err error)
+	Put(ctx context.Context, key string, rev uint64) error
+}
+
+// performer does on the forge what the gate's keys ask (novox/hq ADR 0437 §8): one act for each revision of an owed
+// key, one merge for each revision of a merges key. A refusal is written on FORGE and the act is not tried again until
+// the key has a new revision; the performer holds no timer and serves no request.
+type performer struct {
+	call   caller
+	pub    publisher
+	done   revisions
+	logger *log.Logger
+}
+
+// seen says whether the revision of the key was acted on already. A revision that cannot be read is not seen, so the
+// act is done: a status set twice is the same status.
+func (p *performer) seen(ctx context.Context, doneKey string, rev uint64) bool {
+	kept, found, err := p.done.Get(ctx, doneKey)
+	if err != nil {
+		p.logger.Printf("%s: the revision acted at could not be read, so the act is done again: %v", doneKey, err)
+		return false
+	}
+	return found && kept >= rev
+}
+
+func (p *performer) keep(ctx context.Context, doneKey string, rev uint64) {
+	if err := p.done.Put(ctx, doneKey, rev); err != nil {
+		p.logger.Printf("%s: revision %d was acted on but could not be kept, so a restart acts on it again: %v", doneKey, rev, err)
+	}
+}
+
+// refuse writes the refused message of an act on FORGE; it reports whether it was written. The message id makes a
+// second write of one revision's refusal the same message to the stream.
+func (p *performer) refuse(ctx context.Context, doneKey string, rev uint64, a bridge.Act, words string) bool {
+	msg, err := bridge.RefusedMessage(a, words)
+	if err != nil {
+		p.logger.Printf("%s: the forge refused %s (%s) and the refusal cannot be said on FORGE: %v", doneKey, a.Name, words, err)
+		return false
+	}
+	id := fmt.Sprintf("refused.%s.%d", doneKey, rev)
+	if _, err := p.pub.Publish(ctx, forgeSubject(msg.Event), msg.Data, jetstream.WithMsgID(id)); err != nil {
+		p.logger.Printf("%s: the forge refused %s (%s) and FORGE could not be written: %v", doneKey, a.Name, words, err)
+		return false
+	}
+	return true
+}
+
+// owed performs the act an owed key of the gate asks at revision rev, once.
+func (p *performer) owed(ctx context.Context, key string, rev uint64, value []byte) {
+	p.perform(ctx, "owed."+key, key, rev, value)
+}
+
+// checkOwed performs the status the checker owes on a head (mesh-delivery-checker_owed; novox/hq ADR 0484 clause 2) at
+// revision rev, once. Its keys are kept apart from the gate's, and a key that is not the checker's one act, the status
+// mesh/check, is left.
+func (p *performer) checkOwed(ctx context.Context, key string, rev uint64, value []byte) {
+	doneKey := "check." + key
+	if p.seen(ctx, doneKey, rev) {
+		return
+	}
+	if _, _, _, err := delivery.ParseCheckerOwedKey(key); err != nil {
+		p.logger.Printf("%s at revision %d is not a status of the checker, and is left: %v", key, rev, err)
+		p.keep(ctx, doneKey, rev)
+		return
+	}
+	if _, err := delivery.DecodeCheckerOwed(value); err != nil {
+		p.logger.Printf("%s at revision %d is not a status of the checker, and is left: %v", key, rev, err)
+		p.keep(ctx, doneKey, rev)
+		return
+	}
+	p.perform(ctx, doneKey, key, rev, value)
+}
+
+// perform does the act of an owed key once for the revision, under the bookkeeping key doneKey.
+func (p *performer) perform(ctx context.Context, doneKey, key string, rev uint64, value []byte) {
+	if p.seen(ctx, doneKey, rev) {
+		return
+	}
+	a, err := bridge.OwedAct(key, value)
+	if err != nil {
+		p.logger.Printf("%s at revision %d is not an act the bridge can perform, and is left: %v", key, rev, err)
+		p.keep(ctx, doneKey, rev)
+		return
+	}
+	if _, err := p.call(ctx, a.Call.Tool, a.Call.Args); err != nil {
+		p.logger.Printf("%s at revision %d: %s refused: %v", key, rev, a.Call.Tool, err)
+		if !p.refuse(ctx, doneKey, rev, a, err.Error()) {
+			return
+		}
+	}
+	p.keep(ctx, doneKey, rev)
+}
+
+// merges performs the merges a merges key hands the bridge at revision rev, once: each pull request in the state
+// merging, in the order the value names them, stopping at the first refusal (novox/hq ADR 0441 §3).
+func (p *performer) merges(ctx context.Context, key string, rev uint64, value []byte) {
+	doneKey := "merges." + key
+	if p.seen(ctx, doneKey, rev) {
+		return
+	}
+	acts, err := bridge.MergeActs(value)
+	if err != nil {
+		p.logger.Printf("%s at revision %d cannot be merged, and is left: %v", key, rev, err)
+		p.keep(ctx, doneKey, rev)
+		return
+	}
+	for _, a := range acts {
+		if _, err := p.call(ctx, a.Call.Tool, a.Call.Args); err != nil {
+			p.logger.Printf("%s at revision %d: the merge of %s#%d refused: %v", key, rev, a.Repository, a.Number, err)
+			if !p.refuse(ctx, doneKey, rev, a, err.Error()) {
+				return
+			}
+			break
+		}
+	}
+	p.keep(ctx, doneKey, rev)
+}
+
+// watch hands each key of a bucket, with the revision it has now and then each new one, to react until ctx ends or the
+// watch fails. A deleted key is not an act.
+func watch(ctx context.Context, kv jetstream.KeyValue, react func(key string, rev uint64, value []byte)) error {
+	w, err := kv.Watch(ctx, ">")
+	if err != nil {
+		return err
+	}
+	defer w.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case e, ok := <-w.Updates():
+			if !ok {
+				return errors.New("the watch ended")
+			}
+			if e == nil || e.Operation() != jetstream.KeyValuePut {
+				continue
+			}
+			react(e.Key(), e.Revision(), e.Value())
+		}
+	}
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/gate_test.go

@@ -0,0 +1,264 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"log"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+const (
+	headA = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	headB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+)
+
+type memRevisions map[string]uint64
+
+func (m memRevisions) Get(_ context.Context, key string) (uint64, bool, error) {
+	r, ok := m[key]
+	return r, ok, nil
+}
+func (m memRevisions) Put(_ context.Context, key string, rev uint64) error { m[key] = rev; return nil }
+
+type tcall struct {
+	key  string
+	body string
+}
+
+// forgeFake records the calls and answers each from refuse, a map from a tool to its refusal.
+type forgeFake struct {
+	calls  []tcall
+	refuse map[string]string
+}
+
+func (f *forgeFake) call(_ context.Context, key string, body any) (json.RawMessage, error) {
+	b, _ := json.Marshal(body)
+	f.calls = append(f.calls, tcall{key, string(b)})
+	if w, ok := f.refuse[key]; ok {
+		return nil, errors.New(w)
+	}
+	return json.RawMessage(`{}`), nil
+}
+
+func newPerformer(f *forgeFake) (*performer, *fakePub, memRevisions, *bytes.Buffer) {
+	pub, done, logs := &fakePub{}, memRevisions{}, &bytes.Buffer{}
+	return &performer{call: f.call, pub: pub, done: done, logger: log.New(logs, "", 0)}, pub, done, logs
+}
+
+// The values are the SDK's own encoding (mesh-sdk go/delivery EncodeOwed, EncodeMerge), the keys its OwedKey.
+func owedKV(t *testing.T, repository string, number int, act string, o delivery.Owed) (string, []byte) {
+	t.Helper()
+	key, err := delivery.OwedKey(repository, number, headA, act)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v, err := delivery.EncodeOwed(o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, v
+}
+
+func TestAnOwedStatusIsSetOnceForARevision(t *testing.T) { // 1341/AC1
+	f := &forgeFake{}
+	p, _, _, _ := newPerformer(f)
+	key, v := owedKV(t, "novox/mesh-delivery", 12, "status=mesh/merge-gate",
+		delivery.Owed{Act: delivery.OwedStatus, Context: "mesh/merge-gate", State: "success", Text: "all green", Target: "https://forge.example/p/12"})
+	p.owed(context.Background(), key, 7, v)
+	if len(f.calls) != 1 || f.calls[0].key != "gitea.gitea_commit_status" ||
+		f.calls[0].body != `{"context":"mesh/merge-gate","description":"all green","owner":"novox","repo":"mesh-delivery","sha":"`+headA+`","state":"success","target_url":"https://forge.example/p/12"}` {
+		t.Fatalf("calls = %+v", f.calls)
+	}
+	p.owed(context.Background(), key, 7, v) // the same revision seen again (a restart's replay)
+	if len(f.calls) != 1 {
+		t.Errorf("the same revision called the tool again: %+v", f.calls)
+	}
+	p.owed(context.Background(), key, 8, v) // a new revision of the key is a new act
+	if len(f.calls) != 2 {
+		t.Errorf("a new revision was not performed: %+v", f.calls)
+	}
+}
+
+func TestViewNoteAndCommentEachCallTheirToolOnce(t *testing.T) { // 1341/AC2
+	f := &forgeFake{}
+	p, _, _, _ := newPerformer(f)
+	for _, c := range []struct {
+		act string
+		o   delivery.Owed
+	}{
+		{"view", delivery.Owed{Act: delivery.OwedView, Text: "the view"}},
+		{"note", delivery.Owed{Act: delivery.OwedNote, Text: "a line", Ref: "mesh-plan"}},
+		{"comment.1", delivery.Owed{Act: delivery.OwedComment, Text: "hello"}},
+	} {
+		key, v := owedKV(t, "novox/mesh-delivery", 12, c.act, c.o)
+		p.owed(context.Background(), key, 1, v)
+		p.owed(context.Background(), key, 1, v)
+	}
+	var tools []string
+	for _, c := range f.calls {
+		tools = append(tools, c.key)
+	}
+	if got := strings.Join(tools, " "); got != "gitea.gitea_delivery_view gitea.gitea_note_append gitea.gitea_add_comment" {
+		t.Errorf("calls = %s", got)
+	}
+}
+
+func TestARefusedActIsWrittenOnForgeOnceAndNotRetried(t *testing.T) { // 1341/AC3
+	f := &forgeFake{refuse: map[string]string{"gitea.gitea_add_comment": "the pull request is locked"}}
+	p, pub, _, _ := newPerformer(f)
+	key, v := owedKV(t, "novox/mesh-delivery", 12, "comment.1", delivery.Owed{Act: delivery.OwedComment, Text: "hello"})
+	p.owed(context.Background(), key, 3, v)
+	p.owed(context.Background(), key, 3, v)
+	if len(f.calls) != 1 {
+		t.Errorf("the refused act was tried %d times at one revision", len(f.calls))
+	}
+	if len(pub.subjects) != 1 || pub.subjects[0] != "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-delivery.refused" {
+		t.Fatalf("published on %v", pub.subjects)
+	}
+	m, err := delivery.DecodeForge(pub.data[0])
+	if err != nil || m.Kind != delivery.ForgeRefused || m.Act != "comment.1" || m.Number != 12 || m.Head != headA || m.Words != "the pull request is locked" {
+		t.Errorf("message %+v err %v", m, err)
+	}
+	f.refuse = nil
+	p.owed(context.Background(), key, 4, v) // only a new revision tries again
+	if len(f.calls) != 2 {
+		t.Errorf("a new revision was not tried: %d calls", len(f.calls))
+	}
+}
+
+func TestAnOwedValueThatCannotBeReadIsLoggedAndNotRetried(t *testing.T) {
+	f := &forgeFake{}
+	p, pub, done, logs := newPerformer(f)
+	p.owed(context.Background(), "not-a-key", 2, []byte(`{}`))
+	if len(f.calls) != 0 || len(pub.subjects) != 0 {
+		t.Errorf("calls %v published %v", f.calls, pub.subjects)
+	}
+	if !strings.Contains(logs.String(), "not-a-key") {
+		t.Errorf("log %q does not name the key", logs.String())
+	}
+	if rev, ok := done["owed.not-a-key"]; !ok || rev != 2 {
+		t.Errorf("revision kept = %v %v", rev, ok)
+	}
+}
+
+func mergeKV(t *testing.T, m delivery.Merge) []byte {
+	t.Helper()
+	v, err := delivery.EncodeMerge(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+func twoMembers(a, b delivery.MergeState) delivery.Merge {
+	return delivery.Merge{Group: "g", Ask: "merge.g.0123456789ab",
+		Approved: map[string]string{delivery.ApprovedKey("novox/mesh-sdk", 4): headB, delivery.ApprovedKey("novox/mesh-delivery", 12): headA},
+		Pulls: []delivery.MergePull{
+			{Head: delivery.Head{Repository: "novox/mesh-delivery", Number: 12, Head: headA}, State: a, Commit: map[bool]string{true: "c1"}[a == delivery.MergeMerged]},
+			{Head: delivery.Head{Repository: "novox/mesh-sdk", Number: 4, Head: headB}, State: b, Commit: map[bool]string{true: "c2"}[b == delivery.MergeMerged]},
+		}}
+}
+
+func TestAMergeRevisionMergesOnlyTheMemberHanded(t *testing.T) { // 1342/AC1
+	f := &forgeFake{}
+	p, _, _, _ := newPerformer(f)
+	m := twoMembers(delivery.MergeMerging, delivery.MergeMerged)
+	p.merges(context.Background(), "g", 5, mergeKV(t, m))
+	want := `{"approved_heads":["novox/mesh-delivery@` + headA + `","novox/mesh-sdk@` + headB + `"],"head":"` + headA + `","number":12,"owner":"novox","repo":"mesh-delivery"}`
+	if len(f.calls) != 1 || f.calls[0].key != "gitea.gitea_merge_pull_request" || f.calls[0].body != want {
+		t.Fatalf("calls = %+v", f.calls)
+	}
+	p.merges(context.Background(), "g", 5, mergeKV(t, m))
+	if len(f.calls) != 1 {
+		t.Errorf("a revision merged twice: %+v", f.calls)
+	}
+}
+
+func TestARefusedMergeIsWrittenOnForgeOnceAndNotRetried(t *testing.T) { // 1342/AC2
+	f := &forgeFake{refuse: map[string]string{"gitea.gitea_merge_pull_request": "novox/mesh-delivery#12 is not merged: its head moved"}}
+	p, pub, _, _ := newPerformer(f)
+	v := mergeKV(t, twoMembers(delivery.MergeMerging, delivery.MergeMerged))
+	p.merges(context.Background(), "g", 5, v)
+	p.merges(context.Background(), "g", 5, v)
+	if len(f.calls) != 1 || len(pub.data) != 1 {
+		t.Fatalf("calls %d messages %d, want one each", len(f.calls), len(pub.data))
+	}
+	m, err := delivery.DecodeForge(pub.data[0])
+	if err != nil || m.Kind != delivery.ForgeRefused || m.Repository != "novox/mesh-delivery" || m.Number != 12 || m.Head != headA ||
+		m.Act != "merge" || m.Words != "novox/mesh-delivery#12 is not merged: its head moved" {
+		t.Errorf("message %+v err %v", m, err)
+	}
+	f.refuse = nil
+	p.merges(context.Background(), "g", 6, v)
+	if len(f.calls) != 2 {
+		t.Errorf("a new revision was not tried: %d calls", len(f.calls))
+	}
+}
+
+func TestAMergeWithTwoHandedStopsAtTheFirstRefusal(t *testing.T) { // ADR 0441 §3
+	f := &forgeFake{refuse: map[string]string{"gitea.gitea_merge_pull_request": "no"}}
+	p, pub, _, _ := newPerformer(f)
+	p.merges(context.Background(), "g", 1, mergeKV(t, twoMembers(delivery.MergeMerging, delivery.MergeMerging)))
+	if len(f.calls) != 1 || len(pub.data) != 1 {
+		t.Errorf("calls %d messages %d, want the first refusal to stop the pass", len(f.calls), len(pub.data))
+	}
+}
+
+// checkerOwed is the status the checker owes, as it writes it (mesh-sdk go/delivery CheckerOwedKey, EncodeCheckerOwed).
+func checkerOwed(t *testing.T, number int, state, text string) (string, []byte) {
+	t.Helper()
+	key, err := delivery.CheckerOwedKey("novox/mesh-delivery", number, headA)
+	if err != nil {
+		t.Fatal(err)
+	}
+	v, err := delivery.EncodeCheckerOwed(delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: state, Text: text, Target: "https://view.example/checks/g.0123456789ab"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key, v
+}
+
+func TestTheCheckersStatusIsSetOncePerRevisionAndAKeyOfTheGateIsNotItsKey(t *testing.T) { // 1683/AC5 (ADR 0484 clause 2)
+	f := &forgeFake{}
+	p, _, done, _ := newPerformer(f)
+	key, v := checkerOwed(t, 12, "success", "pass aaaaaaaaaaaa on bbbbbbbbbbbb")
+	p.checkOwed(context.Background(), key, 3, v)
+	p.checkOwed(context.Background(), key, 3, v)
+	if len(f.calls) != 1 || f.calls[0].key != "gitea.gitea_commit_status" ||
+		f.calls[0].body != `{"context":"mesh/check","description":"pass aaaaaaaaaaaa on bbbbbbbbbbbb","owner":"novox","repo":"mesh-delivery","sha":"`+headA+`","state":"success","target_url":"https://view.example/checks/g.0123456789ab"}` {
+		t.Fatalf("calls = %+v", f.calls)
+	}
+	p.checkOwed(context.Background(), key, 4, v)
+	if len(f.calls) != 2 {
+		t.Errorf("a new revision was not performed: %+v", f.calls)
+	}
+	if _, ok := done["check."+key]; !ok {
+		t.Errorf("revision kept under %v, want check.%s", done, key)
+	}
+	// The gate's own owed bookkeeping is another key: the same owed key seen in the gate's bucket is its own act.
+	if _, ok := done["owed."+key]; ok {
+		t.Errorf("the checker's status was kept under the gate's key: %v", done)
+	}
+}
+
+func TestAnythingButTheCheckersStatusInItsBucketIsLeft(t *testing.T) { // ADR 0484 clause 2: the checker owes one act
+	f := &forgeFake{}
+	p, _, done, logs := newPerformer(f)
+	// A comment, and a status of another context: the SDK refuses both to the checker's encoder, so they are written raw.
+	commentKey, commentValue := owedKV(t, "novox/mesh-delivery", 12, "comment.1", delivery.Owed{Act: delivery.OwedComment, Text: "hello"})
+	gateKey, gateValue := owedKV(t, "novox/mesh-delivery", 12, "status=mesh/merge-gate",
+		delivery.Owed{Act: delivery.OwedStatus, Context: "mesh/merge-gate", State: "success", Text: "x", Target: "https://x.example"})
+	p.checkOwed(context.Background(), commentKey, 1, commentValue)
+	p.checkOwed(context.Background(), gateKey, 1, gateValue)
+	if len(f.calls) != 0 {
+		t.Errorf("the forge was called: %+v", f.calls)
+	}
+	if !strings.Contains(logs.String(), commentKey) || !strings.Contains(logs.String(), gateKey) || len(done) != 2 {
+		t.Errorf("log %q, kept %v: both keys are named and kept so they are not tried again", logs.String(), done)
+	}
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go

@@ -4,6 +4,8 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -25,9 +27,16 @@ import (
 // the controller's user, and the bridge's own principal <node>.<module> with the permissions the controller composes for
 // it, and no others, so a permission the bridge lacks fails a test here and not on the mesh (issue 1279).
 //
+// The gate's buckets mesh-delivery-gate_merges and mesh-delivery-gate_owed are read and watched (the manifest's reads), the
+// bucket performed is the bridge's own (its state), and the five forge tools of the gate's acts are invoked (issue 1341, 1342).
+//
+// The checker's owed bucket is read like the gate's (reads) and the checker's stream checks is heard like EVENTS is (consumes
+// mesh-delivery-checker.owed.written; ADR 0484 clause 2): those entries are written by analogy with the ones the controller
+// composes for the gate's buckets and for the EVENTS consumer, not taken from a composed file.
+//
 // The lists are what mesh-controller's broker.PermissionsFor answers (internal/broker/nats.go:577) for a module principal
-// with the manifest of module.json: consumes the three gitea.pull events, invokes gitea.gitea_open_pulls and
+// with the manifest of module.json: consumes the three gitea.pull events, invokes gitea.gitea_open_pulls,
-// gitea.gitea_commit_trees, state heads, and the stream forge; `**` is written `>` on the wire (modstreams.go
+// gitea.gitea_commit_trees and gitea.gitea_get_file, state heads, and the stream forge; `**` is written `>` on the wire (modstreams.go
 // WirePattern). The consumer's durable is <node>_<module> on EVENTS (nats.go consumerDurable). The controller's own
 // user keeps all rights, as it has.
 const busConf = `
@@ -56,9 +65,57 @@ accounts {
             "mesh.mod.gitea.call.gitea_open_pulls.n1~mesh-delivery-forge-bridge"
             "mesh.mod.gitea.tool.gitea_commit_trees"
             "mesh.mod.gitea.tool.gitea_commit_trees.*"
+            "mesh.mod.gitea.call.gitea_get_file.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_get_file.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_get_file"
+            "mesh.mod.gitea.tool.gitea_get_file.*"
             "mesh.mod.gitea.tool.gitea_open_pulls"
             "mesh.mod.gitea.tool.gitea_open_pulls.*"
+            "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-forge-bridge_performed.>"
+            "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-forge-bridge_performed.>"
+            "$JS.API.DIRECT.GET.KV_mesh-delivery-forge-bridge_performed.>"
+            "$JS.API.STREAM.INFO.KV_mesh-delivery-forge-bridge_performed"
+            "$JS.FC.KV_mesh-delivery-forge-bridge_performed.>"
+            "$KV.mesh-delivery-forge-bridge_performed.>"
+            "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-gate_merges.>"
+            "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-gate_merges.>"
+            "$JS.API.DIRECT.GET.KV_mesh-delivery-gate_merges.>"
+            "$JS.API.STREAM.INFO.KV_mesh-delivery-gate_merges"
+            "$JS.FC.KV_mesh-delivery-gate_merges.>"
+            "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-gate_owed.>"
+            "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-gate_owed.>"
+            "$JS.API.DIRECT.GET.KV_mesh-delivery-gate_owed.>"
+            "$JS.API.STREAM.INFO.KV_mesh-delivery-gate_owed"
+            "$JS.FC.KV_mesh-delivery-gate_owed.>"
+            "mesh.mod.gitea.call.gitea_merge_pull_request.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_merge_pull_request.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_merge_pull_request"
+            "mesh.mod.gitea.tool.gitea_merge_pull_request.*"
+            "mesh.mod.gitea.call.gitea_commit_status.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_commit_status.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_commit_status"
+            "mesh.mod.gitea.tool.gitea_commit_status.*"
+            "mesh.mod.gitea.call.gitea_delivery_view.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_delivery_view.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_delivery_view"
+            "mesh.mod.gitea.tool.gitea_delivery_view.*"
+            "mesh.mod.gitea.call.gitea_note_append.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_note_append.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_note_append"
+            "mesh.mod.gitea.tool.gitea_note_append.*"
+            "mesh.mod.gitea.call.gitea_add_comment.*.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.call.gitea_add_comment.n1~mesh-delivery-forge-bridge"
+            "mesh.mod.gitea.tool.gitea_add_comment"
+            "mesh.mod.gitea.tool.gitea_add_comment.*"
             "mesh.stream.mesh-delivery-forge-bridge.event.forge.>"
+            "$JS.ACK.CHECKS.n1_mesh-delivery-forge-bridge.>"
+            "$JS.API.CONSUMER.INFO.CHECKS.n1_mesh-delivery-forge-bridge"
+            "$JS.API.CONSUMER.MSG.NEXT.CHECKS.n1_mesh-delivery-forge-bridge"
+            "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-checker_owed.>"
+            "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-checker_owed.>"
+            "$JS.API.DIRECT.GET.KV_mesh-delivery-checker_owed.>"
+            "$JS.API.STREAM.INFO.KV_mesh-delivery-checker_owed"
+            "$JS.FC.KV_mesh-delivery-checker_owed.>"
           ] }
           subscribe { allow: [
             "_INBOX.n1.mesh-delivery-forge-bridge.>"
@@ -121,6 +178,21 @@ type bed struct {
 	ctx   context.Context
 	done  <-chan error
 	reply func(string)
+	// files sets what the stand-in forge answers to gitea_get_file from then on; it is asked with the tool's arguments.
+	files func(func(owner, repo, path, ref string) (string, bool))
+}
+
+// getFileReply is the reply envelope for gitea_get_file as mesh-catalog modules/gitea tools/index.ts and client.ts getFile
+// answer it ({file: {path, ref, sha, size, content}}), and for a path the forge does not have the error client.ts request
+// writes: `Gitea API <path>: 404 <body>`.
+func getFileReply(path, ref, content string, found bool) []byte {
+	if !found {
+		b, _ := json.Marshal(map[string]any{"error": "Gitea API /repos/novox/mesh-delivery/contents/" + path + "?ref=" + ref + `: 404 {"message":"GetContentsOrList","url":"https://forge.example/api/swagger"}`})
+		return b
+	}
+	b, _ := json.Marshal(map[string]any{"result": map[string]any{"file": map[string]any{"path": path, "ref": ref, "sha": "0123456789abcdef0123456789abcdef01234567",
+		"size": len(content), "content": content}}, "node": "n0"})
+	return b
 }
 
 // startBed is startBridge with a step between the streams and the consumer: prepare writes what the streams hold before
@@ -145,10 +217,26 @@ func startBed(t *testing.T, openReply string, prepare func(ctx context.Context,
 	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "FORGE", Subjects: []string{"mesh.stream.mesh-delivery-forge-bridge.event.forge.>"}}); err != nil {
 		t.Fatal(err)
 	}
+	// The checker's stream checks and the bridge's durable consumer on its owed.written event; the checker's owed bucket is made
+	// only by the test that needs it, as when the checker is assigned after the bridge started.
+	if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "CHECKS", Subjects: []string{"mesh.stream.mesh-delivery-checker.event.>"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := js.CreateOrUpdateConsumer(ctx, "CHECKS", jetstream.ConsumerConfig{Durable: "n1_mesh-delivery-forge-bridge", AckPolicy: jetstream.AckExplicitPolicy,
+		FilterSubjects: []string{"mesh.stream.mesh-delivery-checker.event.owed.written"}}); err != nil {
+		t.Fatal(err)
+	}
 	// The bridge's state bucket, made by the controller from the manifest's state entry before the process starts.
 	if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: headsBucket, History: 1}); err != nil {
 		t.Fatal(err)
 	}
+	// Its other state bucket, and the gate's buckets the bridge reads, made by the controller from the gate's manifest
+	// (mesh-sdk go/delivery MergesBucket, OwedBucket with their histories).
+	for name, history := range map[string]uint8{performedBucket: 1, delivery.MergesBucket: delivery.MergesHistory, delivery.OwedBucket: delivery.OwedHistory} {
+		if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: name, History: history}); err != nil {
+			t.Fatal(err)
+		}
+	}
 	if prepare != nil {
 		prepare(ctx, js)
 	}
@@ -176,6 +264,26 @@ func startBed(t *testing.T, openReply string, prepare func(ctx context.Context,
 		t.Fatal(err)
 	}
 
+	// A stand-in answers the forge's gitea_get_file: by default a module.json of {} at every path and no other file.
+	var fmu sync.Mutex
+	filesOf := func(_, _, path, _ string) (string, bool) { return "{}", strings.HasSuffix(path, "module.json") }
+	getFile, err := ctl.Subscribe("mesh.mod.gitea.tool.gitea_get_file", func(m *nats.Msg) {
+		var a struct{ Owner, Repo, Path, Ref string }
+		_ = json.Unmarshal(m.Data, &a)
+		fmu.Lock()
+		f := filesOf
+		fmu.Unlock()
+		content, found := f(a.Owner, a.Repo, a.Path, a.Ref)
+		_ = m.Respond(getFileReply(a.Path, a.Ref, content, found))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = getFile.Unsubscribe() })
+	if err := ctl.Flush(); err != nil {
+		t.Fatal(err)
+	}
+
 	broker := filepath.Join(t.TempDir(), "broker")
 	cred, _ := json.Marshal(credential{URL: srv.ClientURL(), Node: "n1", Module: "mesh-delivery-forge-bridge", User: "n1.mesh-delivery-forge-bridge", Password: "pw"})
 	if err := os.WriteFile(broker, cred, 0o600); err != nil {
@@ -186,7 +294,8 @@ func startBed(t *testing.T, openReply string, prepare func(ctx context.Context,
 	done := make(chan error, 1)
 	go func() { done <- run(runCtx, func(k string) string { return env[k] }, io.Discard) }()
 	t.Cleanup(stop)
-	return &bed{srv: srv, ctl: ctl, js: js, ctx: ctx, done: done, reply: func(s string) { mu.Lock(); current = s; mu.Unlock() }}
+	return &bed{srv: srv, ctl: ctl, js: js, ctx: ctx, done: done, reply: func(s string) { mu.Lock(); current = s; mu.Unlock() },
+		files: func(f func(owner, repo, path, ref string) (string, bool)) { fmu.Lock(); filesOf = f; fmu.Unlock() }}
 }
 
 // TestBridgeWritesPullMessages starts the program the way the node does (its entry, run, with MESH_BROKER_FILE).
@@ -224,7 +333,7 @@ func TestBridgeWritesPullMessages(t *testing.T) { // 1235/AC2
 		t.Fatal(err)
 	}
 	want := delivery.Forge{V: delivery.Version, Kind: "pull", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
-		Action: "updated", Dirs: []string{"modules/a"}, DirsKnown: true}
+		Action: "updated", Dirs: []string{"modules/a"}, DirsKnown: true, Manifests: map[string]string{"modules/a": "{}"}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}
@@ -249,8 +358,31 @@ const merge = "89abcdef0123456789abcdef0123456789abcdef"
 // TestBridgeWritesMergedMessage has a stand-in answer the forge's gitea_commit_trees on its tool subject
 // (mesh-control internal/broker/nats.go invokedSubjects: mesh.mod.<module>.tool.<tool>), in the reply envelope of
 // mesh-sdk go/process/call.go ({result, error, node}).
-func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4
+func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
-	ctl, js, ctx, _ := startBridge(t, `{"result":{"pulls":[]}}`)
+	bed := startBed(t, `{"result":{"pulls":[]}}`, nil)
+	ctl, js, ctx := bed.ctl, bed.js, bed.ctx
+	// The stand-in forge's files are two real files of this repository (this module's module.json and go.sum, read from the
+	// working tree), in gitea_get_file's real answer shape: the root has a manifest only, modules/a a manifest and go.sum.
+	manifest, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum, err := os.ReadFile("../../go.sum")
+	if err != nil {
+		t.Fatal(err)
+	}
+	bed.files(func(_, _, path, ref string) (string, bool) {
+		if ref != merge {
+			t.Errorf("the forge was asked for %s at %s, want the merge commit %s", path, ref, merge)
+		}
+		switch path {
+		case "module.json", "modules/a/module.json":
+			return string(manifest), true
+		case "modules/a/go.sum":
+			return string(sum), true
+		}
+		return "", false
+	})
 	var asked chan []byte = make(chan []byte, 4)
 	sub, err := ctl.Subscribe("mesh.mod.gitea.tool.gitea_commit_trees", func(m *nats.Msg) {
 		asked <- m.Data
@@ -296,7 +428,9 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4
 		t.Fatal(err)
 	}
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
-		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"}}
+		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
+		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}
@@ -475,3 +609,183 @@ func TestBridgeReadsTheForgeAtStartAndAfterAReconnectAndHearsNoOlderEvent(t *tes
 		}
 	}
 }
+
+// TestBridgeMergesAGroupOneMemberAtATime: the gate (played by the test) writes merges.g with member A handed and the
+// Approve's heads of A and B; a stand-in forge merges A and announces it; the gate then hands B; both end merged on FORGE
+// (1342/AC3, ADR 0437 §8's check).
+func TestBridgeMergesAGroupOneMemberAtATime(t *testing.T) { // 1342/AC3
+	b := startBed(t, `{"result":{"pulls":[]}}`, nil)
+	const headB = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+	const mergeA, mergeB = "1111111111111111111111111111111111111111", "2222222222222222222222222222222222222222"
+	merges := make(chan string, 4)
+	// The stand-in for gitea_merge_pull_request answers in the reply envelope of mesh-sdk go/process/call.go and publishes
+	// gitea.pull.merged as mesh-catalog modules/gitea/index.ts:186-207 does, with the merge commit of the member merged.
+	sub, err := b.ctl.Subscribe("mesh.mod.gitea.tool.gitea_merge_pull_request", func(m *nats.Msg) {
+		var a struct {
+			Repo string `json:"repo"`
+			Head string `json:"head"`
+		}
+		_ = json.Unmarshal(m.Data, &a)
+		merges <- string(m.Data)
+		commit, number := mergeA, 12
+		if a.Repo == "mesh-sdk" {
+			commit, number = mergeB, 4
+		}
+		ev, _ := json.Marshal(map[string]any{"owner": "novox", "repo": a.Repo, "number": number, "head_sha": a.Head, "head": "feat/x",
+			"base": "main", "merge_commit_sha": commit, "module_dirs": []string{"modules/a"}, "module_dirs_said": true})
+		_, _ = b.js.Publish(b.ctx, "mesh.mod.gitea.event.pull.merged", ev)
+		_ = m.Respond([]byte(`{"result":{"merged":true},"node":"n0"}`))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+	trees, err := b.ctl.Subscribe("mesh.mod.gitea.tool.gitea_commit_trees", func(m *nats.Msg) {
+		_ = m.Respond([]byte(`{"result":{"root":"r0","trees":{"":"t0","modules/a":"t1"}},"node":"n0"}`))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = trees.Unsubscribe() })
+	if err := b.ctl.Flush(); err != nil {
+		t.Fatal(err)
+	}
+
+	kv, err := b.js.KeyValue(b.ctx, delivery.MergesBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	approved := map[string]string{delivery.ApprovedKey("novox/mesh-delivery", 12): head, delivery.ApprovedKey("novox/mesh-sdk", 4): headB}
+	pullA := delivery.MergePull{Head: delivery.Head{Repository: "novox/mesh-delivery", Number: 12, Head: head}, State: delivery.MergeMerging}
+	pullB := delivery.MergePull{Head: delivery.Head{Repository: "novox/mesh-sdk", Number: 4, Head: headB}, State: delivery.MergeMerging}
+	put := func(pulls ...delivery.MergePull) {
+		v, err := delivery.EncodeMerge(delivery.Merge{Group: "g", Ask: "merge.g.0123456789ab", Approved: approved, Pulls: pulls})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := kv.Put(b.ctx, "g", v); err != nil {
+			t.Fatal(err)
+		}
+	}
+	next := func(repo string) {
+		select {
+		case got := <-merges:
+			if !strings.Contains(got, `"repo":"`+repo+`"`) {
+				t.Errorf("the forge was asked %s, want %s", got, repo)
+			}
+			for _, want := range []string{"novox/mesh-delivery@" + head, "novox/mesh-sdk@" + headB} {
+				if !strings.Contains(got, want) {
+					t.Errorf("the merge %s does not carry the approved head %s", got, want)
+				}
+			}
+		case <-time.After(10 * time.Second):
+			t.Fatalf("%s was not merged within 10 s", repo)
+		}
+	}
+	put(pullA)
+	next("mesh-delivery")
+	// The gate hands the next member only after the bridge reported the one before merged (ADR 0441 §5).
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && len(forgeMerged(t, b)) < 1; time.Sleep(50 * time.Millisecond) {
+	}
+	pullA.State, pullA.Commit = delivery.MergeMerged, mergeA
+	put(pullA, pullB)
+	next("mesh-sdk")
+	var got []string
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline); time.Sleep(50 * time.Millisecond) {
+		if got = forgeMerged(t, b); len(got) == 2 {
+			break
+		}
+	}
+	if len(got) != 2 {
+		t.Fatalf("FORGE holds merged messages for %v, want both members", got)
+	}
+	select {
+	case extra := <-merges:
+		t.Errorf("a third merge was asked: %s", extra)
+	default:
+	}
+}
+
+// forgeMerged lists the repositories FORGE holds a merged message for, sorted.
+func forgeMerged(t *testing.T, b *bed) []string {
+	t.Helper()
+	forge, err := b.js.Stream(b.ctx, "FORGE")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []string
+	for _, repo := range []string{"mesh-delivery", "mesh-sdk"} {
+		raw, err := forge.GetLastMsgForSubject(b.ctx, "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox."+repo+".merged")
+		if err != nil {
+			continue
+		}
+		if f, err := delivery.DecodeForge(raw.Data); err == nil && f.Kind == delivery.ForgeMerged {
+			out = append(out, f.Repository)
+		}
+	}
+	return out
+}
+
+func sha256Sum(b []byte) []byte { s := sha256.Sum256(b); return s[:] }
+
+// TestBridgePerformsTheCheckersStatusOncePerRevisionOfItsOwedKey: the checker's owed bucket is made after the bridge started;
+// the checker writes the status mesh/check it owes on a head (the SDK's CheckerOwedKey and EncodeCheckerOwed, which the checker
+// itself writes with) and says so on its stream; the bridge sets the status on the forge within 10 s, with the context
+// mesh/check, the state and the line; the same revision is not set again, a new revision is (ADR 0484 clause 2).
+func TestBridgePerformsTheCheckersStatusOncePerRevisionOfItsOwedKey(t *testing.T) { // 1683/AC5, ADR 0484 §2
+	b := startBed(t, `{"result":{"pulls":[]}}`, nil)
+	calls := make(chan string, 8)
+	sub, err := b.ctl.Subscribe("mesh.mod.gitea.tool.gitea_commit_status", func(m *nats.Msg) {
+		calls <- string(m.Data)
+		_ = m.Respond([]byte(`{"result":{},"node":"n0"}`))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = sub.Unsubscribe() })
+	if err := b.ctl.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	kv, err := b.js.CreateKeyValue(b.ctx, jetstream.KeyValueConfig{Bucket: delivery.CheckerOwedBucket, History: delivery.CheckerOwedHistory})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := delivery.CheckerOwedKey("novox/mesh-delivery", 12, head)
+	if err != nil {
+		t.Fatal(err)
+	}
+	put := func(state, text string) {
+		v, err := delivery.EncodeCheckerOwed(delivery.Owed{Act: delivery.OwedStatus, Context: delivery.StatusContextCheck, State: state, Text: text, Target: "https://view.example/checks/g.0123456789ab"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := kv.Put(b.ctx, key, v); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := b.js.Publish(b.ctx, owedWrittenSubject, []byte(`{"key":"`+key+`"}`)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	next := func() string {
+		select {
+		case got := <-calls:
+			return got
+		case <-time.After(10 * time.Second):
+			t.Fatal("the status was not set within 10 s")
+		}
+		return ""
+	}
+	put("pending", "checking 0123456789ab on aaaaaaaaaaaa")
+	if got := next(); !strings.Contains(got, `"context":"mesh/check"`) || !strings.Contains(got, `"state":"pending"`) || !strings.Contains(got, `"sha":"`+head+`"`) || !strings.Contains(got, `"repo":"mesh-delivery"`) {
+		t.Fatalf("first call = %s", got)
+	}
+	put("success", "pass 0123456789ab on aaaaaaaaaaaa | unit 2 run, 3 kept")
+	if got := next(); !strings.Contains(got, `"state":"success"`) || !strings.Contains(got, "unit 2 run, 3 kept") {
+		t.Fatalf("second call = %s", got)
+	}
+	select {
+	case extra := <-calls:
+		t.Errorf("a third call was made: %s", extra)
+	case <-time.After(500 * time.Millisecond):
+	}
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/late.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strings"
+	"sync"
+
+	"github.com/nats-io/nats.go/jetstream"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// checksStream is the stream the checker carries its events on, as the bus names it (declared by the checker as the stream
+// checks, heard by this module through consumes; novox/hq ADR 0484 clause 2).
+const checksStream = "CHECKS"
+
+// owedWrittenSubject is the subject of the checker's owed.written event.
+const owedWrittenSubject = "mesh.stream." + delivery.CheckerModule + ".event.owed.written"
+
+// lateWatch watches a bucket that may be made after the bridge started: the checker's owed bucket. The bridge holds no timer
+// (ADR 0437 §8), so it watches the bucket where it exists at start, and otherwise when the checker says it wrote a status
+// (owed.written, handled by Written).
+type lateWatch struct {
+	ctx context.Context
+	js  interface {
+		KeyValue(ctx context.Context, bucket string) (jetstream.KeyValue, error)
+	}
+	bucket  string
+	react   func(ctx context.Context, key string, rev uint64, value []byte)
+	logger  *log.Logger
+	errs    chan error
+	mu      sync.Mutex
+	watched bool
+}
+
+// ensure starts the watch if the bucket exists and is not watched.
+func (w *lateWatch) ensure() error {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.watched {
+		return nil
+	}
+	kv, err := w.js.KeyValue(w.ctx, w.bucket)
+	switch {
+	case errors.Is(err, jetstream.ErrBucketNotFound):
+		w.logger.Printf("the bucket %s does not exist yet: it is watched when the checker says it wrote a status", w.bucket)
+		return nil
+	case err != nil:
+		return fmt.Errorf("the bucket %s: %w", w.bucket, err)
+	}
+	w.watched = true
+	go func() {
+		w.errs <- watch(w.ctx, kv, func(key string, rev uint64, value []byte) {
+			hctx, cancel := context.WithTimeout(w.ctx, syncDeadline)
+			defer cancel()
+			w.react(hctx, key, rev, value)
+		})
+	}()
+	return nil
+}
+
+// Written takes one owed.written event of the checker in: its bucket is watched if it is not. A subject that is not the
+// checker's is terminated; a failure stays unacknowledged, and the server delivers it again.
+func (w *lateWatch) Written(m interface {
+	Subject() string
+	Ack() error
+	Term() error
+}) {
+	if !strings.HasPrefix(m.Subject(), owedWrittenSubject) {
+		w.logger.Printf("%s: not the checker's owed.written, dropped", m.Subject())
+		_ = m.Term()
+		return
+	}
+	if err := w.ensure(); err != nil {
+		w.logger.Printf("%s: left for redelivery: %v", m.Subject(), err)
+		return
+	}
+	_ = m.Ack()
+}

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/main.go

@@ -115,8 +115,8 @@ type publisher interface {
 // handle turns one event into its message on FORGE and acknowledges it. An event it cannot read is terminated, never
 // redelivered, and the log names its subject and why. A message it could not write stays unacknowledged: the server
 // delivers it again (the server's ack wait is the only clock).
-func handle(ctx context.Context, m delivered, pub publisher, trees bridge.Trees, logger *log.Logger) {
+func handle(ctx context.Context, m delivered, pub publisher, trees bridge.Trees, files bridge.Files, logger *log.Logger) {
-	msg, err := bridge.Convert(m.Subject(), m.Data(), trees)
+	msg, err := bridge.Convert(m.Subject(), m.Data(), trees, files)
 	switch {
 	case errors.Is(err, bridge.ErrRetry):
 		logger.Printf("%v; heard again in %s", err, retryDelay)
@@ -196,6 +196,53 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	// Everything written on FORGE, an event's and a sync's, keeps the head in the bucket.
 	rec := &recorder{pub: js, heads: heads, logger: logger}
 	said := func(ctx context.Context) error { return syncOpen(ctx, call, rec, heads, &turn, logger) }
+	// What the gate asks of the forge (ADR 0437 §8): its owed acts and its merges, each performed once per revision.
+	performedKV, err := js.KeyValue(ctx, performedBucket)
+	if err != nil {
+		return fmt.Errorf("the bucket %s: %w", performedBucket, err)
+	}
+	perf := &performer{call: call, pub: rec, done: kvRevisions{performedKV}, logger: logger}
+	watching := make(chan error, 3)
+	for _, w := range []struct {
+		bucket string
+		react  func(ctx context.Context, key string, rev uint64, value []byte)
+	}{{delivery.OwedBucket, perf.owed}, {delivery.MergesBucket, perf.merges}} {
+		kv, err := js.KeyValue(ctx, w.bucket)
+		if errors.Is(err, jetstream.ErrBucketNotFound) {
+			// The gate's buckets come with the gate; the bridge does not wait for them (no timer), and is started again
+			// by its delivery when the gate arrives.
+			logger.Printf("the bucket %s does not exist yet: nothing of it is performed until the bridge starts again", w.bucket)
+			continue
+		}
+		if err != nil {
+			return fmt.Errorf("the bucket %s: %w", w.bucket, err)
+		}
+		go func() {
+			watching <- watch(ctx, kv, func(key string, rev uint64, value []byte) {
+				hctx, cancel := context.WithTimeout(ctx, syncDeadline)
+				defer cancel()
+				w.react(hctx, key, rev, value)
+			})
+		}()
+	}
+	// The checker's statuses (mesh/check, unrequired until release R4f): its bucket is made when the checker is assigned, which
+	// may be after the bridge started, and the bridge holds no timer; the checker says on its stream each time it wrote a
+	// status, and the bucket is then watched (late.go).
+	late := &lateWatch{ctx: ctx, js: js, bucket: delivery.CheckerOwedBucket, react: perf.checkOwed, logger: logger, errs: watching}
+	if err := late.ensure(); err != nil {
+		return err
+	}
+	switch ccons, err := js.Consumer(ctx, checksStream, cred.Node+"_"+cred.Module); {
+	case err != nil:
+		logger.Printf("the consumer %s_%s on %s does not exist yet, so the checker's statuses are not heard until the bridge starts again: %v", cred.Node, cred.Module, checksStream, err)
+	default:
+		cc, err := ccons.Consume(func(m jetstream.Msg) { late.Written(m) },
+			jetstream.ConsumeErrHandler(func(_ jetstream.ConsumeContext, err error) { logger.Printf("hearing the bus: %v", err) }))
+		if err != nil {
+			return err
+		}
+		defer cc.Stop()
+	}
 	if err := said(ctx); err != nil {
 		return err
 	}
@@ -209,7 +256,7 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 			// Bounded: the turn is held, and no sync or other event goes on without it.
 			hctx, cancel := context.WithTimeout(ctx, syncDeadline)
 			defer cancel()
-			handle(hctx, m, rec, treesVia(hctx, call), logger)
+			handle(hctx, m, rec, treesVia(hctx, call), filesVia(hctx, call), logger)
 		})
 	},
 		jetstream.ConsumeErrHandler(func(_ jetstream.ConsumeContext, err error) { logger.Printf("hearing the bus: %v", err) }))
@@ -217,6 +264,10 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	defer cc.Stop()
-	<-ctx.Done()
+	select {
-	return nil
+	case <-ctx.Done():
+		return nil
+	case err := <-watching:
+		return fmt.Errorf("watching the gate's keys: %w", err)
+	}
 }

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/main_test.go

@@ -6,7 +6,9 @@ import (
 	"encoding/json"
 	"errors"
 	"log"
+	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -14,6 +16,8 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-forge-bridge/internal/bridge"
 )
 
 const head = "0123456789abcdef0123456789abcdef01234567"
@@ -64,7 +68,7 @@ func body(m map[string]any) []byte {
 func TestReadableEventIsWrittenOnForgeAndAcked(t *testing.T) { // 1235/AC2 (unit part; the bus is the integration test)
 	var logs bytes.Buffer
 	m, pub := &fakeMsg{subject: "mesh.mod.gitea.event.pull.updated", data: body(nil)}, &fakePub{}
-	handle(context.Background(), m, pub, nil, log.New(&logs, "", 0))
+	handle(context.Background(), m, pub, nil, someFiles, log.New(&logs, "", 0))
 	if len(pub.subjects) != 1 || pub.subjects[0] != "mesh.stream.mesh-delivery-forge-bridge.event.forge.novox.mesh-delivery.pull" {
 		t.Fatalf("published on %v", pub.subjects)
 	}
@@ -80,7 +84,7 @@ func TestReadableEventIsWrittenOnForgeAndAcked(t *testing.T) { // 1235/AC2 (unit
 func TestUnreadableEventIsTerminatedAndLogged(t *testing.T) { // 1235/AC5
 	var logs bytes.Buffer
 	m, pub := &fakeMsg{subject: "mesh.mod.gitea.event.pull.updated", data: body(map[string]any{"head_sha": "short"})}, &fakePub{}
-	handle(context.Background(), m, pub, nil, log.New(&logs, "", 0))
+	handle(context.Background(), m, pub, nil, someFiles, log.New(&logs, "", 0))
 	if len(pub.subjects) != 0 {
 		t.Errorf("a message was written: %v", pub.subjects)
 	}
@@ -95,7 +99,7 @@ func TestUnreadableEventIsTerminatedAndLogged(t *testing.T) { // 1235/AC5
 func TestUnwrittenMessageIsNotAcked(t *testing.T) { // 1235 (a failed write is redelivered by the server, not retried here)
 	var logs bytes.Buffer
 	m, pub := &fakeMsg{subject: "mesh.mod.gitea.event.pull.updated", data: body(nil)}, &fakePub{err: errors.New("no stream")}
-	handle(context.Background(), m, pub, nil, log.New(&logs, "", 0))
+	handle(context.Background(), m, pub, nil, someFiles, log.New(&logs, "", 0))
 	if m.acked != 0 || m.termd != 0 {
 		t.Errorf("acked %d terminated %d, want neither", m.acked, m.termd)
 	}
@@ -117,7 +121,7 @@ func TestTreesRefusedLeavesTheEventForTenSecondsAndLogs(t *testing.T) { // 1236/
 	call := func(context.Context, string, any) (json.RawMessage, error) {
 		return nil, errors.New("the tree listing of novox/mesh-delivery was cut")
 	}
-	handle(context.Background(), m, pub, treesVia(context.Background(), call), log.New(&logs, "", 0))
+	handle(context.Background(), m, pub, treesVia(context.Background(), call), filesVia(context.Background(), call), log.New(&logs, "", 0))
 	if len(pub.subjects) != 0 {
 		t.Errorf("a message was written: %v", pub.subjects)
 	}
@@ -136,13 +140,19 @@ func TestMergeCallsTheToolOnceAndWritesTheMergedMessage(t *testing.T) { // 1236/
 	m, pub := &fakeMsg{subject: "mesh.mod.gitea.event.pull.merged", data: mergedEvent()}, &fakePub{}
 	var keys []string
 	var args []any
+	var mu sync.Mutex // the files are asked for concurrently (issue 1458)
 	call := func(_ context.Context, key string, body any) (json.RawMessage, error) {
+		mu.Lock()
 		keys, args = append(keys, key), append(args, body)
+		mu.Unlock()
+		if key == "gitea.gitea_get_file" { // the manifests, 1448; the trees are what this test is about
+			return json.RawMessage(`{"file":{"path":"p","sha":"0123","size":2,"content":"{}"}}`), nil
+		}
 		return json.RawMessage(`{"root":"r0","trees":{"":"t0","modules/a":"t1"}}`), nil
 	}
-	handle(context.Background(), m, pub, treesVia(context.Background(), call), log.New(&logs, "", 0))
+	handle(context.Background(), m, pub, treesVia(context.Background(), call), filesVia(context.Background(), call), log.New(&logs, "", 0))
-	if len(keys) != 1 || keys[0] != "gitea.gitea_commit_trees" {
+	if len(keys) == 0 || keys[0] != "gitea.gitea_commit_trees" || slices.Index(keys[1:], "gitea.gitea_commit_trees") >= 0 {
-		t.Fatalf("calls %v", keys)
+		t.Fatalf("calls %v, want the trees once and first", keys)
 	}
 	if got, _ := json.Marshal(args[0]); string(got) != `{"owner":"novox","repo":"mesh-delivery","sha":"89abcdef0123456789abcdef0123456789abcdef"}` {
 		t.Errorf("arguments %s", got)
@@ -171,3 +181,52 @@ func TestAnAnswerWithoutARootIsNotUsed(t *testing.T) { // 1236 (a shape the tool
 		t.Error("an answer that is not an object was taken")
 	}
 }
+
+// The answer of gitea_get_file as mesh-catalog modules/gitea tools/index.ts and client.ts getFile write it, and the
+// error of a path the forge does not have as client.ts request writes it (`Gitea API ${path}: ${status} ${text}`).
+const getFileAnswer = `{"file":{"path":"modules/a/go.sum","ref":"89abcdef0123456789abcdef0123456789abcdef","sha":"0123","size":4,"content":"x y\n"}}`
+const getFile404 = "Gitea API /repos/novox/mesh-delivery/contents/modules/a/go.sum?ref=89abcdef: 404 {\"message\":\"GetContentsOrList\",\"url\":\"https://forge.example/api/swagger\"}"
+
+func TestFilesViaAsksByOwnerRepoPathRefAndTakesTheContent(t *testing.T) { // 1448/AC4
+	var keys []string
+	var args []any
+	call := func(_ context.Context, key string, body any) (json.RawMessage, error) {
+		keys, args = append(keys, key), append(args, body)
+		return json.RawMessage(getFileAnswer), nil
+	}
+	got, err := filesVia(context.Background(), call)("novox", "mesh-delivery", "modules/a/go.sum", "89abcdef0123456789abcdef0123456789abcdef")
+	if err != nil || string(got) != "x y\n" {
+		t.Fatalf("got %q err %v", got, err)
+	}
+	if len(keys) != 1 || keys[0] != "gitea.gitea_get_file" {
+		t.Fatalf("calls %v", keys)
+	}
+	if b, _ := json.Marshal(args[0]); string(b) != `{"owner":"novox","path":"modules/a/go.sum","ref":"89abcdef0123456789abcdef0123456789abcdef","repo":"mesh-delivery"}` {
+		t.Errorf("arguments %s", b)
+	}
+}
+
+func TestFilesViaTellsNotFoundFromOtherErrorsAndOtherShapes(t *testing.T) { // 1448/AC3
+	call := func(err error, raw string) caller {
+		return func(context.Context, string, any) (json.RawMessage, error) { return json.RawMessage(raw), err }
+	}
+	if _, err := filesVia(context.Background(), call(errors.New(getFile404), ""))("o", "r", "p", "s"); !errors.Is(err, bridge.ErrNotFound) {
+		t.Errorf("a 404 is %v, want ErrNotFound", err)
+	}
+	if _, err := filesVia(context.Background(), call(errors.New("Gitea API /repos/o/r/contents/p: 502 bad gateway"), ""))("o", "r", "p", "s"); err == nil || errors.Is(err, bridge.ErrNotFound) {
+		t.Errorf("a 502 is %v, want an error that is not ErrNotFound", err)
+	}
+	for _, raw := range []string{`{"file":null}`, `{}`, `[1]`, `{"file":{"path":"p"}}`} {
+		if _, err := filesVia(context.Background(), call(nil, raw))("o", "r", "p", "s"); err == nil || errors.Is(err, bridge.ErrNotFound) {
+			t.Errorf("the answer %s gave %v, want an error", raw, err)
+		}
+	}
+}
+
+// someFiles is a forge that has a module.json at every path and no other file, for the tests that are not about the files.
+func someFiles(_, _, path, _ string) ([]byte, error) {
+	if strings.HasSuffix(path, "module.json") {
+		return []byte("{}"), nil
+	}
+	return nil, bridge.ErrNotFound
+}

modules/mesh-delivery-forge-bridge/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261019195003-4580d80a32d9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261022161855-e76a5a31a07b
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )