Merge pull request 'The assigner, builder and grants read off the controller; upgrade compare by watch (design 47 L5, L7)' (#130) from feat/l5-l7-main into main

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/integration_test.go

@@ -167,7 +167,7 @@ func saysWhatItKeeps(t *testing.T, b *bed, done <-chan error) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.ParseManifest(raw)
+	m, err := catalogue.Decode(raw)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -407,7 +407,7 @@ func TestWantsAreWrittenAndNoDifferenceIs(t *testing.T) {
 	for _, fp := range []string{fNew, fOld} {
 		gkey, _ := delivery.ControllerGrantKey("web", fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	}
 	runs := map[string]string{"ace": fOld, "g14": "build-9", "shanks": fOld}
 	for _, node := range []string{"ace", "g14", "shanks"} {
@@ -617,7 +617,7 @@ func TestTheAssignerReplacedResumesWithNothingLostOrRepeated(t *testing.T) {
 		b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 		gkey, _ := delivery.ControllerGrantKey(name, fp)
 		grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-		b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+		b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 		b.compose(t, "ace", name, fp, 'c', delivery.JudgedNeither)
 		b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(fmt.Sprintf(`{"node":"ace","module":%q,"build":"b-%d"}`, name, i)))
 	}
@@ -663,7 +663,7 @@ func TestAWantWaitsForItsComposition(t *testing.T) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey("web", fNew)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace.web", []byte(`{"node":"ace","module":"web","build":"b-1"}`))
@@ -712,7 +712,7 @@ func (b *bed) fixture(t *testing.T, name, fp, manifest string) {
 	b.putJSON(t, delivery.BuilderBuildsBucket, bkey, built)
 	gkey, _ := delivery.ControllerGrantKey(name, fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	b.putJSON(t, delivery.ControllerGrantsBucket, gkey, grant)
+	b.putJSON(t, delivery.PartGrantsBucket, gkey, grant)
 	on, _ := delivery.EncodePresence(delivery.Presence{Online: true})
 	b.putJSON(t, delivery.PresenceBucket, "ace", on)
 	b.putJSON(t, provider.AssignmentsBucket, "ace."+name, []byte(`{"node":"ace","module":"`+name+`","build":"b-1"}`))

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main.go

@@ -59,7 +59,6 @@ func main() {
 var readBuckets = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -219,8 +218,8 @@ func startsWithout(name string) bool {
 	return slices.Contains(seatBuckets, name) || sourceOfGrants(name)
 }
 
-// sourceOfGrants says the bucket is one of the two that choose the grants' source, the grants part's grants and the
-// controller's lease: neither stops the assigner when it is not there (delivery.GrantSource).
+// sourceOfGrants says the bucket is the grants part's grants or the controller's lease: neither stops the assigner when it
+// is not there.
 func sourceOfGrants(name string) bool {
 	return name == delivery.PartGrantsBucket || name == buscompose.LeaseBucket
 }
@@ -333,7 +332,6 @@ func (e emitting) Emit(eventType string, body any) error { return e.Conn.Emit(ev
 var watched = []string{
 	buscompose.ResolvedBucket,
 	provider.AssignmentsBucket,
-	delivery.ControllerGrantsBucket,
 	delivery.PartGrantsBucket,
 	buscompose.LeaseBucket,
 	delivery.ControllerComposedBucket,
@@ -419,11 +417,10 @@ func follow(ctx context.Context, js jetstream.JetStream, nc process.Subscriber,
 					if e.Operation() == jetstream.KeyValuePut {
 						value = e.Value()
 					}
-					before := w.grantsBucket()
+					before := w.handedAway()
 					w.putEntry(name, e.Key(), value, e.Revision(), e.Created())
-					if name == buscompose.LeaseBucket && w.grantsBucket() == before {
-						// The controller renews its lease every few seconds: only a change of where grants are read from
-						// makes a pass (delivery.GrantSource).
+					if name == buscompose.LeaseBucket && w.handedAway() == before {
+						// The controller renews its lease every few seconds: only the lease's being handed away makes a pass.
 						continue
 					}
 					wake()

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/main_test.go

@@ -36,7 +36,7 @@ func TestOpensWhatItsManifestNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.ParseManifest(raw)
+	m, err := catalogue.Decode(raw)
 	if err != nil {
 		t.Fatal(err)
 	}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass_test.go

@@ -272,7 +272,7 @@ func putOfTheBus(t *testing.T) {
 	world(delivery.ControllerComposedBucket, ckey, cd)
 	gkey, _ := delivery.ControllerGrantKey("nats", fp)
 	g, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{})
-	world(delivery.ControllerGrantsBucket, gkey, g)
+	world(delivery.PartGrantsBucket, gkey, g)
 	got := step()
 	akey, _ := delivery.RecordAskKey("novox", "nats", digest)
 	if got.Step != delivery.PutPerson || got.Ask != akey {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat.go

@@ -664,12 +664,25 @@ func (p *passer) compute(prop delivery.PlacementProposal, current map[string]del
 	}
 	get := kvGetter(p.kvs[delivery.ManifestsBucket])
 	r := worldReader{w: p.w, manifests: get}
+	// A read that fails is said, never dropped silently (novox/hq ADR 0578 §3); a refused manifest no longer fails it, and
+	// its module is held, named in the input's Refused.
 	var now, with *compose.Input
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true}); err == nil {
 		now = &in
+	} else if p.logf != nil {
+		p.logf("proposal %s: the current composition input cannot be read, so what it changes is judged without it: %v", prop.ID, err)
 	}
 	if in, err := frombus.Input(context.Background(), r, frombus.Mesh{}, frombus.Scope{Every: true, Placements: laid}); err == nil {
 		with = &in
+	} else if p.logf != nil {
+		p.logf("proposal %s: the composition input with the proposal cannot be read, so what it changes is judged without it: %v", prop.ID, err)
+	}
+	if now != nil && len(now.Refused) > 0 && p.logf != nil {
+		var held []string
+		for _, m := range slices.Sorted(maps.Keys(now.Refused)) {
+			held = append(held, m+" ("+now.Refused[m]+")")
+		}
+		p.logf("proposal %s: held as refused by the indexer's judge: %s", prop.ID, strings.Join(held, "; "))
 	}
 	nodes := map[string]bool{}
 	for n := range current {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/seat_tools_test.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"reflect"
 	"slices"
 	"strings"
 	"testing"
@@ -15,6 +16,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/health"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
 	"github.com/nats-io/nats.go/jetstream"
 
@@ -400,6 +402,47 @@ func wantsVerbs(t *testing.T) {
 	if splits := out.(map[string]any)["splits"].([]assign.Split); len(splits) != 1 || splits[0].Module != "web" || out.(map[string]any)["findings"] == nil {
 		t.Errorf("splits = %+v", splits)
 	}
+	// Read by watch (issue 1953 L5f): the same answer, each watched state started once, and no get per key of the
+	// large states (the modules, their manifests, the composed record).
+	watches := map[string]int{}
+	byWatch := newWantsTools(st, nil, nil)
+	byWatch.watched = stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
+		watches[state]++
+		for k, v := range st[state].values {
+			_ = handle(stdio.StateChange{Key: k, Op: stdio.OpPut, Value: v, Current: true})
+		}
+		return nil
+	}, func(state, key string) ([]byte, bool, error) {
+		watches[state+" by key"]++
+		v, ok := st[state].values[key]
+		return v, ok, nil
+	})
+	for range 2 {
+		wout, werr := byWatch.doUpgrade(map[string]any{"compare": "true"}, "op")
+		if werr != nil {
+			t.Fatal(werr)
+		}
+		if ws := wout.(map[string]any)["splits"].([]assign.Split); len(ws) != 1 || ws[0].Module != "web" {
+			t.Errorf("splits by watch = %+v", ws)
+		}
+	}
+	if n := watches[manifestsState+" by key"]; n == 0 || n > len(st[manifestsState].values) {
+		t.Errorf("the manifests were read by key %d times, want each once", n)
+	}
+	for _, state := range []string{modulesState, composedState, health.FindingsState} {
+		if watches[state] != 1 {
+			t.Errorf("%s was watched %d times, want once", state, watches[state])
+		}
+	}
+	// ADR 0580 clause 3: the compare reads through mesh-sdk's watched reader and the seat keeps no mirror of its own.
+	for f := range reflect.TypeFor[wantsTools]().Fields() {
+		if f.Type.Kind() == reflect.Map || (f.Type.Kind() == reflect.Pointer && f.Type.Elem().Kind() == reflect.Map) {
+			t.Errorf("wantsTools keeps %s, a copy of its own beside the watched reader", f.Name)
+		}
+	}
+	if watches[policiesState] != 0 {
+		t.Errorf("the seat's own small policies state was watched: %v", watches)
+	}
 	// The process says the split as its finding, and deletes it once they agree.
 	findings := map[string][]byte{}
 	p := &passer{w: newWorld(), logf: func(string, ...any) {}, findings: assign.Findings{
@@ -415,7 +458,7 @@ func wantsVerbs(t *testing.T) {
 		mod, _ := delivery.DecodeModule(raw)
 		mraw, _, _, _ := st.get(manifestsState, mod.Manifest)
 		kept, _ := delivery.DecodeManifest(mraw)
-		man[name], _ = catalogue.ParseManifest([]byte(kept.JSON))
+		man[name], _ = catalogue.Decode([]byte(kept.JSON))
 	}
 	findings["module.gone.policy-split"] = []byte("{}")
 	p.policySplits(man, nil)
@@ -464,7 +507,7 @@ func readManifest() (catalogue.Manifest, error) {
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.ParseManifest(raw)
+	return catalogue.Decode(raw)
 }
 
 // countingKV is a memKV that counts its puts.

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/tools.go

@@ -352,10 +352,12 @@ func serveTools() error {
 		}
 	}()
 	tools := append(s.tools(), newSeatTools(runtimeStore{}, stdio.Ask).tools()...)
-	tools = append(tools, newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
+	wants := newWantsTools(runtimeStore{}, stdio.Ask, func(e, id string, b any) error {
 		// The seat's event, said on the seat: a claimed seat's event is never the module's own.
 		return stdio.SeatPublish(wantsEventSubject(e), b, id)
-	}).tools()...)
+	})
+	wants.watched = stdio.NewWatchedStates() // the large states read whole from one watched copy (ADR 0580 clause 3)
+	tools = append(tools, wants.tools()...)
 	return stdio.Serve("", tools)
 }
 

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/wants_tools.go

@@ -41,6 +41,10 @@ type wantsTools struct {
 	ask  func(key string, body any) (json.RawMessage, error)
 	emit func(event, id string, body any) error
 	now  func() time.Time
+	// watched is the copy of the large states it reads whole, each by one watch started on its first read and kept by
+	// its changes after (mesh-sdk's WatchedStates, novox/hq ADR 0580 clause 3), never a get per key, which timed out on
+	// a large state (issue 1953 L5f). Nil reads key by key.
+	watched *stdio.WatchedStates
 }
 
 // wantsEventSubject is the subject of one of the seat's events.
@@ -59,8 +63,16 @@ func (s *wantsTools) leased() bool {
 	return away
 }
 
-// values reads every key of a state.
+// values reads every key of a state: from the watched copy when there is one, else key by key.
 func (s *wantsTools) values(state string) (map[string][]byte, error) {
+	if s.watched != nil {
+		return s.watched.Values(state)
+	}
+	return s.direct(state)
+}
+
+// direct reads a state key by key, for a small state of the seat's own.
+func (s *wantsTools) direct(state string) (map[string][]byte, error) {
 	keys, err := s.st.keys(state)
 	if err != nil {
 		return nil, fmt.Errorf("%s cannot be listed: %w", state, err)
@@ -78,6 +90,16 @@ func (s *wantsTools) values(state string) (map[string][]byte, error) {
 	return out, nil
 }
 
+// manifest reads a manifest by its digest: kept once read when there is a watched copy, a manifest never changing
+// under its digest.
+func (s *wantsTools) manifest(digest string) ([]byte, bool, error) {
+	if s.watched != nil {
+		return s.watched.Once(manifestsState, digest)
+	}
+	raw, _, found, err := s.st.get(manifestsState, digest)
+	return raw, found, err
+}
+
 // manifests is every module the indexer holds, with its trunk manifest and fingerprint.
 func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]delivery.Module, error) {
 	mods, err := s.values(modulesState)
@@ -94,7 +116,7 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if m.Manifest == "" {
 			continue
 		}
-		mraw, _, found, err := s.st.get(manifestsState, m.Manifest)
+		mraw, found, err := s.manifest(m.Manifest)
 		if err != nil || !found {
 			continue
 		}
@@ -102,7 +124,8 @@ func (s *wantsTools) manifests() (map[string]catalogue.Manifest, map[string]deli
 		if err != nil {
 			continue
 		}
-		if man, err := catalogue.ParseManifest([]byte(kept.JSON)); err == nil {
+		// Decoded, never judged (ADR 0578 §3); one that does not decode is left out of the answer, as before.
+		if man, err := catalogue.Decode([]byte(kept.JSON)); err == nil {
 			out[name] = man
 		}
 	}
@@ -125,7 +148,7 @@ func (s *wantsTools) doUpgrade(args map[string]any, by string) (any, error) {
 	if err != nil {
 		return nil, err
 	}
-	raw, err := s.values(policiesState)
+	raw, err := s.direct(policiesState) // the seat's own small state, read whole after its own writes
 	if err != nil {
 		return nil, err
 	}

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world.go

@@ -197,10 +197,10 @@ func (w *world) manifest(ctx context.Context, get getter, digest string) parsed
 	m, err := delivery.DecodeManifest(value)
 	if err != nil {
 		p = parsed{err: err.Error()}
-	} else if man, err := catalogue.ParseManifestForInputs([]byte(m.JSON)); err != nil {
-		// Read as the indexer reads it (issue 1751): a value falling back to a predefined key is judged by the merge gate
-		// in the catalogue, against the predefined.json at its root that this process never holds (ADR 0348 §7).
-		p = parsed{module: m.Module, err: err.Error()}
+	} else if man, err := catalogue.Decode([]byte(m.JSON)); err != nil {
+		// Decoded, never judged (novox/hq ADR 0578 §3): the indexer's judge judged it, and its verdict is taken from the
+		// module's value where it is read (world.mesh).
+		p = parsed{module: m.Module, err: "it does not decode: " + err.Error()}
 	} else {
 		p = parsed{module: m.Module, manifest: man}
 	}
@@ -313,6 +313,18 @@ func (w *world) mesh(ctx context.Context, manifests getter) assign.Mesh {
 			continue
 		}
 		m.Digests[name] = mod.Manifest
+		// The indexer's verdict on it, carried in its value (ADR 0578 §3, §5): a refused module is held and named as one
+		// that cannot be read, and its verdict goes into the composer's input.
+		if v := mod.VerdictOf(name); v != nil {
+			if refused, _ := delivery.TakeManifestVerdict(v); refused {
+				if m.Verdicts == nil {
+					m.Verdicts = map[string]delivery.ManifestVerdict{}
+				}
+				m.Verdicts[name] = *v
+				m.Unreadable[name] = v.Why()
+				continue
+			}
+		}
 		p := w.manifest(ctx, manifests, mod.Manifest)
 		if p.err != "" {
 			m.Unreadable[name] = p.err
@@ -572,15 +584,9 @@ func (w *world) value(bucket, key string) []byte {
 	return w.values[bucket][key]
 }
 
-// grantsBucket is the bucket the grants are read from now (delivery.GrantSource): the grants part's while the controller's
-// lease is handed away, as the lease bucket's key says it (buscompose.LeaseHandedAway), the controller's in every other
-// case, a lease not held here included.
-func (w *world) grantsBucket() string {
-	raw := w.value(buscompose.LeaseBucket, buscompose.ControllerLeaseKey)
-	away, _ := buscompose.LeaseHandedAway(raw, raw != nil, nil)
-	bucket, _ := delivery.GrantSource(away)
-	return bucket
-}
+// grantsBucket is the bucket the grants are read from: the grants part's state `grants`, always (ADR 0571 clause 9); no
+// manifest but the controller's reads the controller's grants.
+func (w *world) grantsBucket() string { return delivery.PartGrantsBucket }
 
 // has says whether a bucket holds a key now.
 func (w *world) has(bucket, key string) bool {

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/world_test.go

@@ -73,10 +73,11 @@ func TestTheChangeOfACandidate(t *testing.T) {
 }
 
 // 1297/B3b: a candidate whose module has no manifest digest yet, or whose manifest the indexer does not hold yet, waits,
-// saying for what; an unreadable manifest is the change's, not a wait.
+// saying for what; a manifest that does not decode is the change's, not a wait (one with a field the assigner does not
+// know is decoded with it set aside, novox/hq ADR 0578 §6).
 func TestAChangeWaitsForItsManifests(t *testing.T) {
 	f := fakeManifests{}
-	bad := f.add(t, "web", `{"module":"web","version":"2","scope":"x"}`)
+	bad := f.add(t, "web", `{"module":"web","version":"2","requires":"x"}`)
 	for _, c := range []delivery.CandidatePull{
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {None2: "no preview yet"}}),
 		pull("novox/web", 1, map[string]delivery.CandidateModule{"web": {FP2: fp('b'), Manifest: strings.Repeat("9", 64)}}),
@@ -127,24 +128,22 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 	if got := w.changed(delivery.HaveBucket, "gone"); got != 0 {
 		t.Errorf("changed = %d for a key never seen", got)
 	}
-	// Issue 774: grants are read from the grants part's bucket only while the controller's lease is handed away: a grant
-	// only the part holds lets a node's put through then, and with a controller's lease (or none, or an unreadable one) it
-	// holds it, a grant only the controller holds being the one that counts instead.
+	// ADR 0571 clause 9: grants are read from the grants part's bucket in every case, a lease held, handed away, absent or
+	// unreadable alike, and the controller's own grants count for nothing.
 	fp := delivery.SourcePrefix2 + strings.Repeat("d", 64)
 	gkey, _ := delivery.ControllerGrantKey("web", fp)
 	grant, _ := delivery.EncodeControllerGrant(delivery.ControllerGrant{Accounts: []string{"ace.web"}})
 	for _, row := range []struct {
 		name, lease          string
 		inPart, inController bool
-		bucket               string
 		granted              bool
 	}{
-		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, delivery.PartGrantsBucket, true},
-		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, delivery.PartGrantsBucket, false},
-		{"a controller holds it, only the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, delivery.ControllerGrantsBucket, false},
-		{"a controller holds it, its own grant", `{"instance":"novox/1"}`, false, true, delivery.ControllerGrantsBucket, true},
-		{"no lease read", ``, true, false, delivery.ControllerGrantsBucket, false},
-		{"an unreadable lease", `[1]`, true, false, delivery.ControllerGrantsBucket, false},
+		{"handed away, the part's grant", `{"handed-to":"the operator's hand-over"}`, true, false, true},
+		{"handed away, only the controller's grant", `{"handed-to":"x"}`, false, true, false},
+		{"a controller holds it, the part's grant", `{"instance":"novox/1","epoch":3}`, true, false, true},
+		{"a controller holds it, only its own grant", `{"instance":"novox/1"}`, false, true, false},
+		{"no lease read", ``, true, false, true},
+		{"an unreadable lease", `[1]`, true, false, true},
 	} {
 		p := newPasser(buckets{}, time.Now())
 		if row.lease != "" {
@@ -156,8 +155,8 @@ func theWorldCountsTheValuesAKeyTakes(t *testing.T) {
 		if row.inController {
 			p.w.put(delivery.ControllerGrantsBucket, gkey, grant)
 		}
-		if got := p.w.grantsBucket(); got != row.bucket {
-			t.Errorf("%s: grants are read from %s, want %s", row.name, got, row.bucket)
+		if got := p.w.grantsBucket(); got != delivery.PartGrantsBucket {
+			t.Errorf("%s: grants are read from %s, want the part's", row.name, got)
 		}
 		if _, granted := p.composedFor("ace", "web", fp); granted != row.granted {
 			t.Errorf("%s: granted = %v, want %v", row.name, granted, row.granted)

modules/mesh-delivery-assigner/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-assigner/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027 h1:a33dsavoaqllh40eVICbhxi6Kero1EGSjt1V+2fa2Hk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-assigner/internal/assign/compose.go

@@ -43,6 +43,9 @@ type Mesh struct {
 	// InputUnread says why that input could not be read from the bus, when it could not: the check then composes the
 	// nodes and their assignments alone, and says so in its warnings.
 	InputUnread string
+	// Verdicts are the indexer's refusals of trunk manifests, by module, as their values carry them (novox/hq ADR 0578
+	// §3): each such module is in Unreadable too, and the composer's input carries the verdict (§5).
+	Verdicts map[string]delivery.ManifestVerdict
 }
 
 // Change is a group's change as the indexer's candidate holds it: the manifest of every module it moves or adds, those

modules/mesh-delivery-assigner/internal/assign/compose_test.go

@@ -42,7 +42,7 @@ func TestAChangeOfOneModuleComposesItsMachine(t *testing.T) {
 	}
 	// 1953/D7 (ADR 0565 §5, ADR 0502 §4): the group's own pull request's held value at its head is laid and named, judged
 	// against the head's declaration; one of another pull request or another head is not laid.
-	web, err := catalogue.ParseManifest([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
+	web, err := catalogue.Decode([]byte(`{"module":"web","version":"2","config":{"port":{"type":"number","default":80,"description":"the port, a number","runtime":true}}}`))
 	if err != nil {
 		t.Fatal(err)
 	}

modules/mesh-delivery-assigner/internal/assign/composer.go

@@ -49,10 +49,18 @@ func HeadJob(m Mesh, c Change) (delivery.ComposeJob, error) {
 		in.Catalogue = nil
 		fromClaims = len(in.Holdings) == 0
 	}
-	changeCase := composer.Case{Name: CaseChange, Manifests: change}
+	// Each trunk manifest the indexer refused goes in with its verdict, so the composer holds and names it (ADR 0578 §5);
+	// a manifest the change brings has no verdict of the indexer yet, and the checker's judge judges it (§2).
+	changeVerdicts := map[string]delivery.ManifestVerdict{}
+	for name, v := range m.Verdicts {
+		if _, changed := c.Digests[name]; !changed {
+			changeVerdicts[name] = v
+		}
+	}
+	changeCase := composer.Case{Name: CaseChange, Manifests: change, Verdicts: changeVerdicts}
 	req := composer.Request{V: composer.Version, Input: in, Depth: composer.DepthResolve,
 		HoldingsFromClaims: fromClaims, Machines: Touched(m, c),
-		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk}, changeCase}}
+		Cases: []composer.Case{{Name: CaseTrunk, Manifests: trunk, Verdicts: m.Verdicts}, changeCase}}
 	return job(SDKRepository, c.SDKHead, SDKDir, req, "the mesh-sdk head of "+c.Group)
 }
 
@@ -139,10 +147,10 @@ type Reader struct {
 
 // FromComposer is the composition check of a group with a mesh-sdk member, judged from the composer built at its head
 // (ADR 0482 clauses 3 to 5, issues 1622 and 1623): the same failures as Compose, read from the composer's two cases, the
-// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk refuses fails too (the
-// group would deliver a reader that refuses it); and each reader that refuses a changed manifest the head reads fails
-// it, naming the module and its words, unless the reader's mesh-sdk has no composer to ask (before issue 1621), which is
-// said and judged nothing.
+// verdict naming the mesh-sdk the composer was built with; a trunk manifest the head's mesh-sdk cannot decode fails too
+// (the group would deliver a reader that cannot read it). A reader that cannot read a changed manifest is a warning,
+// never a failure: it decodes leniently and sets a field it does not know aside (novox/hq ADR 0578 §6, which changes
+// ADR 0482 §5).
 func FromComposer(m Mesh, c Change, head Ran, readers []Reader, took time.Duration) delivery.CompositionVerdict {
 	v := delivery.CompositionVerdict{Group: c.Group, Heads: c.Heads, SDK: "mesh-sdk " + c.SDKHead, Took: took.Milliseconds()}
 	machines := Touched(m, c)
@@ -245,8 +253,10 @@ func judgeReaders(c Change, head composer.CaseVerdict, readers []Reader) (fails,
 			if !head.Manifests[name].Accepted || read.Manifests[name].Accepted {
 				continue
 			}
-			fails = append(fails, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; the group must move %s onto "+
-				"mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, r.Module, c.SDKHead))
+			// ADR 0578 §6: no longer a failure; the reader sets what it does not know aside, and the part that needs it takes
+			// the newer package (ADR 0573 §2).
+			warnings = append(warnings, fmt.Sprintf("the manifest of %s uses what %s (mesh-sdk %s) cannot read: %s; it reads the rest "+
+				"once it takes mesh-sdk %s", name, at, r.Ran.Verdict.SDK, read.Manifests[name].Refused, c.SDKHead))
 		}
 	}
 	return fails, warnings

modules/mesh-delivery-assigner/internal/assign/composer_test.go

@@ -40,9 +40,10 @@ func digestedMesh() Mesh {
 // webShares is a group of mesh-sdk and mesh-catalog whose catalogue member gives web the field only the SDK head reads:
 // the assigner's own reader refuses it (Unreadable), as the indexer's manifest is read in world.change.
 func webShares(members map[string]string) Change {
-	_, err := catalogue.ParseManifest([]byte(raws["d-web2"]))
+	// As an older reader refused it; the field set aside by the lenient decoder is named the same (ADR 0578 §6).
+	m, _ := catalogue.Decode([]byte(raws["d-web2"]))
 	return Change{Group: "g", Heads: "0123456789ab", SDKHead: sdkHead, Manifests: map[string]catalogue.Manifest{},
-		Unreadable: map[string]string{"web": err.Error()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
+		Unreadable: map[string]string{"web": m.SetAside()}, Digests: map[string]string{"web": "d-web2"}, Members: members}
 }
 
 // run is the composer's step for a job, as the build module answers it: the request filled from the indexer's digests
@@ -141,10 +142,11 @@ func TestAFieldTheGroupAddsPassesWithTheHeadsComposer(t *testing.T) {
 	}
 }
 
-// 1623/AC1, AC2: the group of mesh-sdk and mesh-catalog adding and using a field, without a controller member, fails
-// naming the field and mesh-controller, whose running build pins an older mesh-sdk; with a controller member pinned to
-// the SDK head (its composer reads what the head reads) it passes.
-func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
+// 1623/AC1, AC2 as ADR 0578 §6 changes them: the group of mesh-sdk and mesh-catalog adding and using a field, without a
+// controller member, passes with a warning naming the field and mesh-controller, whose running build pins an older
+// mesh-sdk that cannot read it: a reader sets a field it does not know aside, so it fails nothing. With a controller
+// member pinned to the SDK head it passes with no such warning.
+func TestAFieldTheRunningControllerCannotReadIsAWarning(t *testing.T) {
 	c := webShares(nil)
 	job, _ := HeadJob(digestedMesh(), c)
 	head := run(t, job, asTheHeadReads)
@@ -156,10 +158,12 @@ func TestAFieldTheRunningControllerCannotReadFailsTheGroup(t *testing.T) {
 	if rjob.Fetch["commit"] != running || rjob.Dir != delivery.RootPath {
 		t.Fatalf("reader job = %+v", rjob)
 	}
-	old := run(t, rjob, nil) // the running controller's mesh-sdk reads web2 as the assigner's own does: refused
+	// The running controller's mesh-sdk, older than the lenient decoder, refuses web2 for its field.
+	old := Ran{State: delivery.StepPassed, Verdict: &composer.Verdict{V: composer.Version, SDK: "v0.1.13", Cases: []composer.CaseVerdict{
+		{Name: CaseChange, Manifests: map[string]composer.ManifestRead{"web": {Refused: `json: unknown field "shares"`}}}}}}
 	v := FromComposer(digestedMesh(), c, head, []Reader{{Module: "mesh-controller", Commit: running, Ran: old}}, 0)
-	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "shares") || !strings.Contains(v.Words, "move mesh-controller onto mesh-sdk "+sdkHead) {
-		t.Fatalf("without a controller member: %+v, want a fail naming the field and mesh-controller", v)
+	if v.State != delivery.CompositionPass || !hasWarning(v, "shares") || !hasWarning(v, "mesh-controller at "+running) {
+		t.Fatalf("without a controller member: %+v, want a pass warning of the field and mesh-controller", v)
 	}
 	member := "2222222222222222222222222222222222222222"
 	pinned := run(t, rjob, asTheHeadReads)
@@ -196,9 +200,26 @@ func TestTheHeadsComposerFailingOrRefusingTheTrunkFails(t *testing.T) {
 		t.Fatalf("a head composer that did not run: %+v", v)
 	}
 	job, _ := HeadJob(digestedMesh(), c)
-	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "gone": true}`}
+	strict := map[string]string{"d-web2": asTheHeadReads["d-web2"], "d-mail": `{"module": "mail", "version": "1", "requires": "x"}`}
 	v = FromComposer(digestedMesh(), c, run(t, job, strict), nil, 0)
 	if v.State != delivery.CompositionFail || !strings.Contains(v.Words, "refuses the trunk's manifest of mail") {
 		t.Fatalf("a head that refuses a trunk manifest: %+v", v)
 	}
+	// ADR 0578 §5: a trunk manifest the indexer refused goes into the composer's input with its verdict, in both cases;
+	// the composer holds and names it, and the group is not blamed for it.
+	m := digestedMesh()
+	m.Verdicts = map[string]delivery.ManifestVerdict{"mail": {Module: "mail", State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
+	m.Unreadable = map[string]string{"mail": m.Verdicts["mail"].Why()}
+	job, _ = HeadJob(m, c)
+	var req composer.Request
+	if err := json.Unmarshal(job.Request, &req); err != nil || !req.Cases[0].Verdicts["mail"].Refused() || !req.Cases[1].Verdicts["mail"].Refused() {
+		t.Fatalf("the request carries no verdict: %+v %v", req.Cases, err)
+	}
+	head := run(t, job, asTheHeadReads)
+	if trunk, _ := caseOf(head.Verdict, CaseTrunk); !strings.Contains(trunk.Manifests["mail"].Refused, "refused the manifest of mail: it is wrong") {
+		t.Fatalf("the composer did not name the refusal: %+v", trunk.Manifests["mail"])
+	}
+	if v = FromComposer(m, c, head, nil, 0); v.State != delivery.CompositionPass {
+		t.Fatalf("a refusal on the trunk blamed the group: %+v", v)
+	}
 }

modules/mesh-delivery-assigner/manifest_test.go

@@ -16,9 +16,9 @@ func load(t *testing.T) catalogue.Manifest {
 	if err != nil {
 		t.Fatal(err)
 	}
-	m, err := catalogue.ParseManifest(raw)
+	m, err := catalogue.Decode(raw)
 	if err != nil {
-		t.Fatalf("mesh-sdk's manifest reader refuses the manifest: %v", err)
+		t.Fatalf("mesh-sdk cannot decode the manifest: %v", err)
 	}
 	return m
 }
@@ -33,7 +33,7 @@ func TestManifest(t *testing.T) {
 	}
 	reads := slices.Clone(m.Reads)
 	slices.Sort(reads)
-	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.grants", "mesh-controller.lease",
+	want := []string{"mesh-build-go.steps", "mesh-conditions.takeover", "mesh-config.kept", "mesh-config.resolved", "mesh-controller.assignments", "mesh-controller.composed", "mesh-controller.lease",
 		"mesh-delivery-builder.build-log", "mesh-delivery-builder.builds", "mesh-delivery-indexer.candidates", "mesh-delivery-indexer.manifests",
 		"mesh-delivery-indexer.modules", "mesh-delivery-teller.answers", "mesh-delivery-watchman.presence", "mesh-grants.grants", "mesh-provisioner.provisions", "node-engine.have"}
 	if !reflect.DeepEqual(reads, want) {
@@ -59,7 +59,7 @@ func TestManifest(t *testing.T) {
 		t.Errorf("uses = %v, want exactly node-build-go and operator-channel", m.Uses)
 	}
 	// ADR 0546: it serves its own tools (put, release, puts) from its bundle through the tool runner (the artifact loads the
-	// module), says each put's step as the event put, and calls the controller's warranted and the bus node's backup holder.
+	// module), says each put's step as the event put, and calls the hand-act seat and the bus node's backup holder.
 	// ADR 0567 §1, §6-§10: it holds the seat mesh-placement, serving its seven verbs; keeps the seat's events on its stream
 	// placement for 30 days; calls the controller's export, its four verbs that keep its assignments in step and its
 	// hand-act log; and reads mesh-config's resolved values to compose every node a proposal touches.
@@ -82,9 +82,9 @@ func TestManifest(t *testing.T) {
 		!slices.Equal(slices.Sorted(slices.Values(m.Streams[0].Events)), slices.Sorted(slices.Values(delivery.PlacementEvents))) {
 		t.Errorf("streams = %+v, want placement carrying the seat's four events for %d days", m.Streams, delivery.PlacementStreamDays)
 	}
-	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.hand-act", "seat:mesh-controller.pin",
+	if want := []string{"seat:mesh-controller.assign", "seat:mesh-controller.pin",
 		"seat:mesh-controller.placement-export", "seat:mesh-controller.unassign", "seat:mesh-controller.unpin",
-		"seat:mesh-controller.warranted", "seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat, the controller's only while it has no holder
+		"seat:mesh-hand-acts.hand-act", "seat:mesh-hand-acts.hand-acts", "seat:mesh-hand-acts.warranted", // ADR 0565 §9, §11: the seat alone
 		"seat:node-backup.backed-up", "seat:node-backup.now"}; !slices.Equal(slices.Sorted(slices.Values(m.Invokes)), want) {
 		t.Errorf("invokes = %v, want %v", m.Invokes, want)
 	}

modules/mesh-delivery-assigner/module.json

@@ -32,7 +32,6 @@
     "mesh-config.resolved",
     "mesh-controller.assignments",
     "mesh-controller.composed",
-    "mesh-controller.grants",
     "mesh-controller.lease",
     "mesh-delivery-builder.build-log",
     "mesh-delivery-builder.builds",
@@ -51,12 +50,10 @@
   ],
   "invokes": [
     "seat:mesh-controller.assign",
-    "seat:mesh-controller.hand-act",
     "seat:mesh-controller.pin",
     "seat:mesh-controller.placement-export",
     "seat:mesh-controller.unassign",
     "seat:mesh-controller.unpin",
-    "seat:mesh-controller.warranted",
     "seat:mesh-hand-acts.hand-act",
     "seat:mesh-hand-acts.hand-acts",
     "seat:mesh-hand-acts.warranted",

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/bus.go

@@ -123,5 +123,6 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	if err != nil {
 		return catalogue.Manifest{}, err
 	}
-	return catalogue.ParseManifestForInputs([]byte(kept.JSON))
+	// Decoded, never judged (novox/hq ADR 0578 §3): what a build needs of it is read, a field it does not know set aside.
+	return catalogue.Decode([]byte(kept.JSON))
 }

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/gone_integration_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -19,7 +20,7 @@ import (
 // (novox/hq issue 1937): on 2026-10-24 the store's 03:30 collection deleted the bare blobs of three done keys the
 // controller had never taken in, and the builder kept them done.
 
-// heldVerb answers the controller seat's verb held on the bus, as the serving controller does: {result: {output, ok,
+// heldVerb answers the seat mesh-artifact-sweep's verb held on the bus, as its holder does: {result: {output, ok,
 // answer}}; a reference is gone while gone says so.
 type heldVerb struct {
 	mu    sync.Mutex
@@ -29,7 +30,7 @@ type heldVerb struct {
 
 func (h *heldVerb) serve(t *testing.T, b *bed) {
 	t.Helper()
-	sub, err := b.js.Conn().Subscribe("mesh.seat.mesh-controller.call.held.>", func(m *nats.Msg) {
+	sub, err := b.js.Conn().Subscribe("mesh.seat."+catalogue.ArtifactSweepSeat+".call.held.>", func(m *nats.Msg) {
 		var args struct {
 			References []string `json:"references"`
 		}

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/stored.go

@@ -11,7 +11,6 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"git.novox.be/novox/mesh-sdk/go/handacts"
 
 	"mesh-delivery-builder/internal/build"
 )
@@ -26,19 +25,14 @@ const SeatHeld = "seat:" + catalogue.ArtifactSweepSeat + ".held"
 // toolCaller calls a tool or a seat verb as the builder's own account (mesh-sdk process.Conn.Call).
 type toolCaller func(key string, body any) (json.RawMessage, error)
 
-// storedVia is build.Builder's Stored: it asks the controller's verb held (mesh-sdk delivery.HeldVerb; novox/hq issue
-// 1937) and answers the references the store no longer holds. One it could not ask about, with none gone, is an error:
-// the key is then left done, and the controller's take-in still refuses a gone blob.
-//
-// It asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2), and the controller's while that seat has no holder that
-// answers (a named exception of clause 10, until the lease write).
+// storedVia is build.Builder's Stored: it asks the seat mesh-artifact-sweep's `held` (novox/hq ADR 0571 §2, issue 1937)
+// and answers the references the store no longer holds. One it could not ask about, with none gone, is an error: the key
+// is then left done, and the controller's take-in still refuses a gone blob. The controller's `held` is not asked: it
+// is no longer a fallback (issue 1955).
 func storedVia(call toolCaller) func(ctx context.Context, references []string) ([]string, error) {
 	return func(_ context.Context, references []string) ([]string, error) {
 		body := map[string]any{"references": references}
 		raw, err := call(SeatHeld, body)
-		if handacts.NoResponder(err) {
-			raw, err = call(delivery.HeldVerb, body)
-		}
 		if err != nil {
 			return nil, fmt.Errorf("asking held: %w", err)
 		}

modules/mesh-delivery-builder/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-builder/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027 h1:a33dsavoaqllh40eVICbhxi6Kero1EGSjt1V+2fa2Hk=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101085317-790d1c82d027/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-builder/internal/build/candidates.go

@@ -68,7 +68,7 @@ func (b *Builder) considerCandidate(ctx context.Context, c delivery.Candidate) {
 				continue
 			}
 			m := delivery.Module{Repository: p.Repository, Commit: p.Head.Head, FP2: cm.FP2, Manifest: cm.Manifest, Path: trunk.Path,
-				Toolchains: b.agreedFor(ctx, cm.Manifest)}
+				Toolchains: b.agreedFor(ctx, cm.Manifest), Packages: cm.Packages} // the group's package heads (ADR 0573 §4)
 			if len(cm.Paths) > 0 {
 				// The named paths' objects the preview gave it: the fetch names the paths (runLane, ADR 0499 clause 4).
 				m.Inputs2 = &delivery.KeptInputs2{Paths: cm.Paths}

modules/mesh-delivery-builder/internal/build/claim.go

@@ -61,8 +61,8 @@ type ClaimOptions struct {
 	// a package's reference. A key queued waiting for a version (BuilderBuild.Waits) is taken only once it is (ADR 0500
 	// clause 6). Nil means none is.
 	Published func(ref string) bool
-	// Stored answers which of the references given the artifact store no longer holds (the controller's verb held,
-	// mesh-sdk delivery.HeldVerb; novox/hq issue 1937). A done key of the trunk's fingerprint is asked before it is left
+	// Stored answers which of the references given the artifact store no longer holds (the seat mesh-artifact-sweep's verb held,
+	// novox/hq ADR 0571 §2, issue 1937). A done key of the trunk's fingerprint is asked before it is left
 	// done: the store's nightly collector deletes a blob nothing holds, and a key the controller never took in holds
 	// nothing, so a key whose blob is gone is claimed building as a new revision and built again. Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)

modules/mesh-delivery-builder/internal/build/run.go

@@ -51,7 +51,7 @@ type Builder struct {
 	// Answered is told the build module whose step answered a reference (issue 1886): what the builder says it writes
 	// rests on it. Nil tells nobody.
 	Answered func(buildModule string)
-	// Stored answers which references the artifact store no longer holds (the controller's verb held; issue 1937): a done
+	// Stored answers which references the artifact store no longer holds (the seat mesh-artifact-sweep's verb held; issue 1937): a done
 	// key of the trunk's fingerprint is asked before it is left done (ClaimOptions.Stored). Nil asks nothing.
 	Stored func(ctx context.Context, references []string) (gone []string, err error)
 	// Trunk answers the head of a repository in the gate's source revision rev (source.main at that revision): the trunk a
@@ -808,6 +808,11 @@ func (b *Builder) runLane(ctx context.Context, l *lane, repository string, m del
 		job.Fetch = req.Args()
 	}
 	ask := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: language, Asker: delivery.BuilderModule, At: time.Now(), Build: job}
+	if language == delivery.AskGo && job.Fetch != nil && len(m.Packages) > 0 {
+		// The versions of the mesh packages the fingerprint was computed with (novox/hq ADR 0573 §2): the build module writes
+		// them into the workspace, whatever the repository's go.mod names.
+		ask.Packages = maps.Clone(m.Packages)
+	}
 	if id := asked.resume(language); id != "" {
 		ask.ID = id // put before this builder started again: the stream holds it, or a node already ran it
 		if b.Held != nil {

modules/mesh-delivery-builder/internal/build/run_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"reflect"
 	"strconv"
 	"strings"
 	"sync"
@@ -300,7 +301,14 @@ func TestABundleAndAnArchiveAreBuiltOnOneNodeAndDone(t *testing.T) { // 1607/AC7
 func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	r := newRig(t, goBundle)
 	r.asks.Answer = nil // no node has pulled it yet
-	r.b.Module(context.Background(), "m", moduleValue(t, "modules/m"))
+	// Issue 1585 (ADR 0573 §2): the ask carries the package versions the fingerprint was computed with.
+	sdk := delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": hex40('5')}
+	data, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: "7a74cee83f88e6585a5511c3cc53bdf0f5303d20",
+		FP2: fp1, Manifest: mdigest('a'), Path: "modules/m", Toolchains: agreedToolchains, Packages: sdk})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.b.Module(context.Background(), "m", data)
 	var asks []delivery.StepAsk
 	for deadline := time.Now().Add(2 * time.Second); len(asks) == 0; time.Sleep(time.Millisecond) {
 		if time.Now().After(deadline) {
@@ -312,6 +320,9 @@ func TestATrunkFingerprintIsOneAskOnTheDeliveryStream(t *testing.T) {
 	if len(asks) != 1 || a.Kind != delivery.AskDelivery || a.Language != delivery.AskGo || a.Build == nil || a.Build.FP != fp1 {
 		t.Fatalf("asks = %+v, want one Go delivery ask of the fingerprint", asks)
 	}
+	if !reflect.DeepEqual(a.Packages, sdk) {
+		t.Errorf("the ask's packages = %v, want %v", a.Packages, sdk)
+	}
 	if v := valueOf(t, r.st, r.key); v.State != delivery.BuildBuilding || v.Asks[delivery.AskGo] != a.ID {
 		t.Fatalf("the key = %+v, want building naming the ask %s", v, a.ID)
 	}

modules/mesh-delivery-builder/manifest_test.go

@@ -107,8 +107,8 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 	}
 	// 1937/AC3: the builder asks the controller whether the artifact store still holds a done key's blobs (held), and no
 	// other tool; it holds no capacity.
-	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's only while the seat has no holder (clause 10).
-	if want := []string{"seat:mesh-artifact-sweep.held", "seat:mesh-controller.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
+	// 1955/L7 (ADR 0571 §2): the seat mesh-artifact-sweep's held, the controller's `held` is no longer asked (issue 1955).
+	if want := []string{"seat:mesh-artifact-sweep.held"}; !reflect.DeepEqual(sorted(m.Invokes), want) || len(m.Config) != 0 {
 		t.Errorf("invokes = %v, config = %v, want %v and no config", m.Invokes, m.Config, want)
 	}
 	// The builder is woken by a build module's report of a toolchain, as the indexer is: the bucket may not exist when it

modules/mesh-delivery-builder/module.json

@@ -20,8 +20,7 @@
     "mesh-controller.artifacts-gone"
   ],
   "invokes": [
-    "seat:mesh-artifact-sweep.held",
-    "seat:mesh-controller.held"
+    "seat:mesh-artifact-sweep.held"
   ],
   "state": [
     { "name": "builds", "history": 5 },

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/bus.go

@@ -125,11 +125,11 @@ func (m manifestReader) Manifest(ctx context.Context, digest string) (catalogue.
 	return parseManifest(kept.JSON)
 }
 
-// parseManifest reads a manifest the indexer kept as the indexer and the assigner read it (issues 1751, 1906): a config value that
-// falls back to a predefined key is judged by the merge gate in the catalogue, against the predefined.json at its root that this
-// process never holds, so it is not unreadable here (novox/hq ADR 0348 §7).
+// parseManifest decodes a manifest the indexer kept, as every reader does (novox/hq ADR 0578 §3): judged by nothing here,
+// a field it does not know set aside. The checker judges a change's manifests with the indexer's judge, run as a step
+// (judge.go).
 func parseManifest(raw string) (catalogue.Manifest, error) {
-	return catalogue.ParseManifestForInputs([]byte(raw))
+	return catalogue.Decode([]byte(raw))
 }
 
 // awaitedKV is a bucket that may appear after the start (process.AwaitBucket) as a check.KV: a call while it is not on the

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge.go

@@ -13,16 +13,9 @@ import (
 	"mesh-delivery-checker/internal/check"
 )
 
-// The forge's tools the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
-// of a file at a ref, and gitea_compare answers {total_commits, commits}, what head holds that base does not. The checker
-// writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
-const (
-	getFileTool = "gitea.gitea_get_file"
-	compareTool = "gitea.gitea_compare"
-	commitsTool = "gitea.gitea_commits"
-	// gitea_list_branches answers {branches: [{name, commit}]}, every branch with the commit it points at.
-	branchesTool = "gitea.gitea_list_branches"
-)
+// The forge's tool the checker reads with (mesh-catalog modules/gitea): gitea_get_file answers {file: {content}}, the text
+// of a file at a ref. The checker writes nothing to the forge: the forge bridge sets the statuses (ADR 0484 clause 2).
+const getFileTool = "gitea.gitea_get_file"
 
 // notFoundStatus is the 404 of the forge's error, `Gitea API <path>: <status> <body>`.
 var notFoundStatus = regexp.MustCompile(`: 404( |$)`)
@@ -69,61 +62,3 @@ func (f forgeReads) File(_ context.Context, repository, path, ref string) (strin
 	}
 	return *a.File.Content, nil
 }
-
-// OnTrunk says whether the commit is already on the repository's main: main holds it when the commit holds nothing main does
-// not.
-func (f forgeReads) OnTrunk(_ context.Context, repository, commit string) (bool, error) {
-	owner, repo := ownerRepo(repository)
-	raw, err := f.ask(compareTool, map[string]string{"owner": owner, "repo": repo, "base": "main", "head": commit})
-	if err != nil {
-		return false, err
-	}
-	var a struct {
-		Total *int `json:"total_commits"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil || a.Total == nil {
-		return false, fmt.Errorf("the answer of %s is not {total_commits}: %v", compareTool, err)
-	}
-	return *a.Total == 0, nil
-}
-
-// FullSHA is the whole sha of a commit named by its first digits: the newest commit of the history at that ref.
-func (f forgeReads) FullSHA(_ context.Context, repository, commit string) (string, error) {
-	owner, repo := ownerRepo(repository)
-	raw, err := f.ask(commitsTool, map[string]any{"owner": owner, "repo": repo, "ref": commit, "limit": 1})
-	if err != nil {
-		return "", err
-	}
-	var a struct {
-		Commits []struct {
-			SHA string `json:"sha"`
-		} `json:"commits"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil || len(a.Commits) == 0 || len(a.Commits[0].SHA) != 40 || !strings.HasPrefix(a.Commits[0].SHA, commit) {
-		return "", fmt.Errorf("the answer of %s for %s is not a commit that starts with it: %v", commitsTool, commit, err)
-	}
-	return a.Commits[0].SHA, nil
-}
-
-// BranchHeads is the commit each branch of the repository points at.
-func (f forgeReads) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
-	owner, repo := ownerRepo(repository)
-	raw, err := f.ask(branchesTool, map[string]string{"owner": owner, "repo": repo})
-	if err != nil {
-		return nil, err
-	}
-	var a struct {
-		Branches *[]struct {
-			Name   string `json:"name"`
-			Commit string `json:"commit"`
-		} `json:"branches"`
-	}
-	if err := json.Unmarshal(raw, &a); err != nil || a.Branches == nil {
-		return nil, fmt.Errorf("the answer of %s is not {branches: [{name, commit}]}: %v", branchesTool, err)
-	}
-	heads := map[string]string{}
-	for _, b := range *a.Branches {
-		heads[b.Name] = b.Commit
-	}
-	return heads, nil
-}

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/forge_test.go

@@ -29,49 +29,19 @@ func TestTheForgeReadsParseWhatTheForgeAnswered(t *testing.T) { // 1624/AC4
 	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
 		b, _ := json.Marshal(body)
 		asked = append(asked, key+" "+string(b))
-		switch {
-		case key == getFileTool:
-			return capturedAnswer(t, "forge-get-file-go-mod"), nil
-		case strings.Contains(string(b), "cb54756c3865"):
-			return capturedAnswer(t, "forge-compare-trunk"), nil
-		}
-		return capturedAnswer(t, "forge-compare-branch"), nil
+		return capturedAnswer(t, "forge-get-file-go-mod"), nil
 	}}
 	text, err := f.File(context.Background(), "novox/mesh-delivery", "modules/mesh-delivery-builder/go.mod", "main")
 	if err != nil || !strings.Contains(text, "git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865") {
 		t.Errorf("file = %q, %v", text, err)
 	}
-	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || !on {
-		t.Errorf("a commit on the trunk: %v, %v", on, err)
-	}
-	if on, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "9aaa5c80ac5c"); err != nil || on {
-		t.Errorf("a commit of the branch: %v, %v", on, err)
-	}
-	if len(asked) != 3 || !strings.Contains(asked[0], `"owner":"novox"`) || !strings.Contains(asked[2], `"base":"main"`) {
+	if len(asked) != 1 || !strings.Contains(asked[0], `"owner":"novox"`) {
 		t.Errorf("asked %v", asked)
 	}
 	bad := forgeReads{call: func(string, any) (json.RawMessage, error) { return json.RawMessage(`{}`), nil }}
 	if _, err := bad.File(context.Background(), "novox/x", "go.mod", "main"); err == nil {
 		t.Error("an answer with no file was taken")
 	}
-	if _, err := bad.OnTrunk(context.Background(), "novox/x", "abc"); err == nil {
-		t.Error("an answer with no total was taken")
-	}
-}
-
-func TestTheForgeNamesTheWholeShaOfAShortCommit(t *testing.T) { // review D2
-	f := forgeReads{call: func(key string, body any) (json.RawMessage, error) {
-		if key != commitsTool {
-			t.Errorf("called %s", key)
-		}
-		return capturedAnswer(t, "forge-commits"), nil
-	}}
-	if sha, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "cb54756c3865"); err != nil || sha != "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1" {
-		t.Errorf("sha = %q, %v", sha, err)
-	}
-	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "deadbeefdead"); err == nil {
-		t.Error("a commit that does not start with the pin was taken")
-	}
 }
 
 func TestAFileTheRefDoesNotHoldIsNotFoundAndOtherFailuresAreNot(t *testing.T) { // 1845/AC1, AC4
@@ -96,10 +66,4 @@ func TestAForgeReadThatReachesNobodyIsUnheard(t *testing.T) { // 1624 C7: "nats:
 	if !errors.As(err, &u) {
 		t.Errorf("err = %v, want it marked as reaching nobody", err)
 	}
-	if _, err := f.OnTrunk(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
-		t.Errorf("compare: %v", err)
-	}
-	if _, err := f.FullSHA(context.Background(), "novox/mesh-sdk", "abc"); !errors.As(err, &u) {
-		t.Errorf("commits: %v", err)
-	}
 }

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/integration_test.go

@@ -687,18 +687,17 @@ func TestACheckLeftRunningIsTakenOverWhenTheCheckerStarts(t *testing.T) { // N6/
 	}
 }
 
-// TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit: the go.mod the forge answers names a commit that main does not
-// hold; the verdict fails naming the member and the commit and no test runs (ADR 0484 clause 9).
-func TestAMemberNamingAMeshSDKCommitOffTheTrunkFailsNamingTheCommit(t *testing.T) { // 1624/AC2, 1929/AC3
+// TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused: the go.mod the forge answers names a commit that main does
+// not hold; the check is not refused for it, since the build takes the latest published mesh-sdk whatever go.mod names
+// (novox/hq ADR 0573 §2, §4; issue 1585 S14, which retires issue 1624's pin check).
+func TestAMemberNamingAMeshSDKCommitOffTheTrunkIsJudgedAndNotRefused(t *testing.T) { // 1624/AC2 as ADR 0573 §4 changes it
 	b := startBed(t)
 	b.stalePin.Store(true)
 	key := b.candidate(t, "feat/x", pull(repo, 7, head1))
 	b.start(t, nil)
-	v := b.verdict(t, key, ended)
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, repo+"#7") {
+	if v := b.verdict(t, key, ended); v.State != delivery.VerdictPass {
 		t.Fatalf("verdict = %+v", v)
 	}
-	// 1929/AC3: no assertion that no test ran: one ask runs fetch, digest and tests (ADR 0525 §3).
 }
 
 // triesStore is the tries bucket as the tools write it.

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -31,7 +33,31 @@ type judgeDeps struct {
 	compositions check.CompositionReader
 	// nodes names every node with a record; nil hands no names.
 	nodes *nodeNames
-	logf  func(format string, args ...any)
+	// predefined is the indexer's kept list of predefined keys; nil reads none.
+	predefined check.PredefinedList
+	logf       func(format string, args ...any)
+}
+
+// keptPredefined reads the indexer's key predefined.list (delivery.PredefinedKept), bound once its state appears.
+type keptPredefined struct{ b *process.AwaitedBucket }
+
+func (k keptPredefined) PredefinedList(ctx context.Context) (json.RawMessage, error) {
+	kv := k.b.KV()
+	if kv == nil {
+		return nil, process.ErrNotYet
+	}
+	e, err := kv.Get(ctx, delivery.PredefinedListKey)
+	if errors.Is(err, jetstream.ErrKeyNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var kept delivery.PredefinedKept
+	if err := json.Unmarshal(e.Value(), &kept); err != nil {
+		return nil, err
+	}
+	return kept.List, nil
 }
 
 // nodeNames reads every node's name from the node-engine's have, one key `<node>.node` per node with a record (novox/hq
@@ -69,7 +95,7 @@ func newJudge(d judgeDeps) check.Judge {
 		nodes = d.nodes
 	}
 	return &check.Examiner{Nodes: nodes, Compositions: d.compositions, Asks: d.asks, Toolchains: d.tools,
-		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Logf: d.logf}
+		Kept: check.Kept{Store: d.kept}, Previews: d.previews, Modules: d.repos, Packages: d.repos, Published: d.repos, Forge: d.forge, Runs: d.repos, Builds: d.builds, Announce: d.announce, Trunks: d.trunks, Manifests: d.repos, Predefined: d.predefined, Logf: d.logf}
 }
 
 // manifestKV reads a manifest by its digest.
@@ -92,6 +118,7 @@ type repoModules struct {
 	repoOf map[string]string              // by module: its repository
 	commit map[string]string              // by module: the commit its record was computed at (the commit the mesh runs)
 	typed  map[string]string              // by module: its manifest digest
+	uses   map[string][]string            // by module: the mesh packages it uses (Inputs2.Packages, ADR 0573 §2)
 }
 
 // Put takes a change of the indexer's modules bucket in: a module's repository and the languages its manifest names.
@@ -100,6 +127,7 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	if r.repoOf == nil {
 		r.repoOf, r.typed, r.langs, r.commit = map[string]string{}, map[string]string{}, map[string]map[string]bool{}, map[string]string{}
 		r.tsPkgs, r.path, r.named = map[string][]string{}, map[string]string{}, map[string]map[string][]string{}
+		r.uses = map[string][]string{}
 	}
 	if deleted {
 		delete(r.repoOf, key)
@@ -107,6 +135,7 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 		delete(r.commit, key)
 		delete(r.path, key)
 		delete(r.named, key)
+		delete(r.uses, key)
 		r.mu.Unlock()
 		return
 	}
@@ -121,6 +150,10 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.commit[key] = m.Commit
 	r.path[key] = m.Path
 	r.named[key] = m.ArtifactPaths
+	r.uses[key] = nil
+	if m.Inputs2 != nil {
+		r.uses[key] = m.Inputs2.Packages
+	}
 	_, known := r.langs[m.Manifest]
 	r.mu.Unlock()
 	if m.Manifest == "" || known {
@@ -152,6 +185,28 @@ func (r *repoModules) Put(ctx context.Context, key string, value []byte, deleted
 	r.mu.Unlock()
 }
 
+// LatestPackages is the latest published version of each mesh package a module of the mesh uses, and of mesh-sdk's Go
+// module always (novox/hq ADR 0573 §2): the trunk merge of the module whose directory holds it, as the indexer's modules
+// say. A package no module holds is left out: a check builds it at the version go.mod names.
+func (r *repoModules) LatestPackages() delivery.PackageVersions {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	used := map[string]bool{check.SDKModulePath: true}
+	held := map[string]delivery.Module{}
+	for module, repo := range r.repoOf {
+		for _, p := range r.uses[module] {
+			used[p] = true
+		}
+		held[module] = delivery.Module{Repository: repo, Path: r.path[module], Commit: r.commit[module]}
+	}
+	pkgs := make([]string, 0, len(used))
+	for p := range used {
+		pkgs = append(pkgs, p)
+	}
+	versions, _ := delivery.PackageVersionsOf(pkgs, held)
+	return versions
+}
+
 // PackagePaths are the paths, relative to the repository, that the TypeScript package artifacts of a repository's modules
 // are built from, sorted: the named paths the indexer keeps in each module's value (delivery.Module.ArtifactPaths; only the
 // indexer reads them from a manifest, the lead's decision L8), under the module's directory. None for a module whose value
@@ -221,6 +276,20 @@ func (r buildReader) Build(ctx context.Context, module, fp2 string) (delivery.Bu
 	return b, err == nil, err
 }
 
+// ManifestDigests is the manifest digest of every module the indexer holds, by module: the catalogue the indexer's judge
+// judges a change's manifests in (novox/hq ADR 0578 §2).
+func (r *repoModules) ManifestDigests() map[string]string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := map[string]string{}
+	for module, digest := range r.typed {
+		if digest != "" {
+			out[module] = digest
+		}
+	}
+	return out
+}
+
 // CommitOf is the commit the indexer's record of the module names: the commit its fingerprint first appeared at, so the source
 // of the build the mesh runs (a later merge that leaves the module alone writes no record, the operator 2026-10-25).
 func (r *repoModules) CommitOf(module string) string {

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/judge_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"reflect"
 	"strings"
 	"testing"
 
@@ -112,6 +113,20 @@ func TestTheTypeScriptPackagesPathsComeFromTheIndexersModulesNotTheManifest(t *t
 	if got := r.PackagePaths("novox/mesh-delivery"); len(got) != 0 {
 		t.Errorf("another repository: %v", got)
 	}
+	// Issue 1585 (ADR 0573 §2): the latest published version of mesh-sdk's Go module and of every package a module uses is
+	// the commit of the module that holds it; a package no module holds is left out.
+	put(".", nil)
+	const contract = "git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
+	user, err := delivery.EncodeModule(delivery.Module{Repository: "novox/mesh-catalog", Commit: strings.Repeat("b", 40), FP: "src1:" + strings.Repeat("b", 64),
+		Manifest: delivery.ManifestDigest([]byte(sdkManifest)), Path: "modules/x",
+		Inputs2: &delivery.KeptInputs2{Tree: "t", Packages: []string{contract, "git.novox.be/novox/mesh-sdk/go"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Put(context.Background(), "x", user, false)
+	if got := r.LatestPackages(); !reflect.DeepEqual(got, delivery.PackageVersions{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("a", 40)}) {
+		t.Errorf("latest packages = %v, want mesh-sdk at its module's commit and no unheld contract", got)
+	}
 }
 
 // A manifest whose config value falls back to a predefined key (ADR 0348 §7) is read, not logged as unreadable for the

modules/mesh-delivery-checker/cmd/mesh-delivery-checker/main.go

@@ -202,6 +202,8 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		repos: repos, builds: builds, forge: forgeReads{call: caller.Call}, logf: logger.Printf,
 		announce: announce, compositions: compositions,
 		nodes: openNodeNames(ctx, js, logger.Printf),
+		predefined: keptPredefined{process.AwaitBucket(ctx, js, conn, delivery.IndexerModule+"_"+delivery.IndexerPredefinedState,
+			"a change's manifests are judged with no predefined keys, each fallback as its value declares it", logger.Printf)},
 	})
 	ch.Announce = announce
 	tryer.Judge = ch.Judge

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/beside.go

@@ -77,20 +77,6 @@ func (j *Examiner) besideFor(ctx context.Context, c *Case, p Pull) ([]BesideRef,
 				// running commit puts the verdict out of date; at the trunk, a trunk move does (Checker.besideNow).
 				out = append(out, BesideRef{Repository: repo, Commit: commit, atTrunk: atTrunk, runs: !atTrunk})
 			}
-		case repo == SDKRepository && p.Repository == controllerRepo && j.Forge != nil:
-			text, err := j.Forge.File(ctx, p.Repository, "go.mod", p.Head)
-			if err != nil {
-				return nil, fmt.Errorf("go.mod of %s#%d cannot be read to place the mesh-sdk its tests read: %w", p.Repository, p.Number, err)
-			}
-			pin, ok := SDKPin(text)
-			if !ok {
-				return nil, fmt.Errorf("go.mod of %s#%d names no mesh-sdk commit, so the mesh-sdk its tests read cannot be placed", p.Repository, p.Number)
-			}
-			full, err := j.Forge.FullSHA(ctx, SDKRepository, pin)
-			if err != nil {
-				return nil, fmt.Errorf("mesh-sdk %s, which %s#%d pins, cannot be found: %w", pin, p.Repository, p.Number, err)
-			}
-			out = append(out, BesideRef{Repository: repo, Commit: full})
 		default:
 			if member := c.member(repo); member != nil {
 				out = append(out, BesideRef{Repository: repo, Commit: member.Head, Ref: refOf(member.Number)})

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/composer"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/delivery/buildrun"
 )
@@ -928,3 +929,81 @@ func TestASecondCheckOfTheSameHeadsKeepsWhatTheFirstPassed(t *testing.T) {
 		t.Errorf("%d test steps ran on the second check", n)
 	}
 }
+
+// keptList is the indexer's kept predefined list as a test gives it.
+type keptList string
+
+func (k keptList) PredefinedList(context.Context) (json.RawMessage, error) {
+	return json.RawMessage(k), nil
+}
+
+// fixedDigests are the indexer's manifest digests as a test gives them.
+type fixedDigests map[string]string
+
+func (f fixedDigests) ManifestDigests() map[string]string { return f }
+
+// ADR 0578 §2: a change's manifests are judged by the indexer's judge, built at mesh-delivery's trunk and run as the
+// composer is (a compose ask of its command); a refusal fails the check naming the manifest and each problem; a group
+// whose mesh-delivery member changes the judge is judged by that member's head.
+func TestTheIndexersJudgeJudgesTheChangesManifests(t *testing.T) {
+	web, trunk := strings.Repeat("e", 64), strings.Repeat("d", 40)
+	for _, row := range []struct {
+		name    string
+		refused string
+		fails   string
+		// untouched is the judge's refusal of mail, which the change leaves as it is, and trunkMail its refusal on the trunk:
+		// a problem the trunk had is a warning, one the change causes fails (ADR 0579 §2)
+		untouched, trunkMail string
+	}{
+		{name: "accepted"},
+		{name: "an untouched manifest's problem the trunk had", untouched: "mail says no credential form", trunkMail: "mail says no credential form"},
+		{name: "a problem the change causes in an untouched manifest", untouched: "mail reads a state web no longer keeps",
+			fails: "refuses the manifest of mail: mail reads a state web no longer keeps"},
+		{name: "refused", refused: "web requires \"amqp\"\nweb has no id", fails: "the indexer's judge at mesh-delivery's trunk " + strings.Repeat("d", 40) + ` refuses the manifest of web: web requires "amqp"; web has no id`},
+	} {
+		b := newBench(t)
+		b.ex.Manifests = fixedDigests{"mail": strings.Repeat("a", 64), "web": strings.Repeat("b", 64)}
+		b.ex.Trunks = fixedTrunks{heads: map[string]string{DeliveryRepository: trunk}}
+		b.ex.Predefined = keptList(`{"font-size": {"type": "number", "description": "the size"}}`)
+		var judged []delivery.ComposeJob
+		answer := b.asks.Answer
+		b.asks.Answer = func(a delivery.StepAsk) delivery.Step {
+			if a.Compose == nil {
+				return answer(a)
+			}
+			judged = append(judged, *a.Compose)
+			read := composer.ManifestRead{Accepted: row.refused == "", Refused: row.refused}
+			verdict, _ := json.Marshal(composer.Verdict{V: composer.Version, SDK: "exe:1", Cases: []composer.CaseVerdict{{Name: JudgeCase,
+				Manifests: map[string]composer.ManifestRead{"web": read, "mail": {Accepted: row.untouched == "", Refused: row.untouched}}},
+				{Name: JudgeTrunk, Manifests: map[string]composer.ManifestRead{"web": {Accepted: true}, "mail": {Accepted: row.trunkMail == "", Refused: row.trunkMail}}}}})
+			result, _ := json.Marshal(delivery.ComposeAnswer{Key: "k", Verdict: verdict})
+			return delivery.Step{ID: a.ID, State: delivery.StepPassed, Result: result}
+		}
+		p := pullOf(repoA, 7, head1)
+		p.Modules = []string{"web"}
+		p.Fps = map[string]delivery.CandidateModule{"web": {FP2: "src2:" + strings.Repeat("f", 64), Manifest: web}}
+		v := b.judge(t, caseOf(t, p)).Verdict
+		if len(judged) != 1 || judged[0].Fetch["repository"] != DeliveryRepository || judged[0].Fetch["commit"] != trunk ||
+			judged[0].Package != JudgePackage || judged[0].Dir != JudgeDir {
+			t.Fatalf("%s: judged %+v (verdict %+v)", row.name, judged, v)
+		}
+		var req composer.Request
+		if err := json.Unmarshal(judged[0].Request, &req); err != nil || req.Cases[0].Manifests["web"].Digest != web ||
+			req.Cases[1].Name != JudgeTrunk || req.Cases[1].Manifests["web"].Digest != strings.Repeat("b", 64) ||
+			req.Predefined["font-size"].Type != "number" ||
+			req.Cases[0].Manifests["mail"].Digest != strings.Repeat("a", 64) {
+			t.Fatalf("%s: the request %+v: %v", row.name, req, err)
+		}
+		switch {
+		case row.fails == "" && v.State != delivery.VerdictPass:
+			t.Errorf("%s: %+v", row.name, v)
+		case row.fails != "" && (v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, row.fails)):
+			t.Errorf("%s: %+v, want a fail saying %q", row.name, v.Failed, row.fails)
+		}
+	}
+	if !changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) ||
+		changesJudge(DeliveryRepository, []Fetched{{Changed: []string{JudgeDir + "/internal/index/x.go"}}}) ||
+		changesJudge("novox/mesh-catalog", []Fetched{{Changed: []string{JudgeDir + "/judge/judge.go"}}}) {
+		t.Error("which merge changes the judge")
+	}
+}

modules/mesh-delivery-checker/internal/check/heard_test.go

@@ -1,21 +0,0 @@
-package check
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/nats-io/nats.go"
-
-	"git.novox.be/novox/mesh-sdk/go/delivery"
-)
-
-// Issue 1820 AC5: a read of the forge that nobody answers is the forge's failure, not a build node's. (AC1-AC4 moved a
-// step to another node; since R4g an ask whose node stops is delivered again by its stream: ADR 0525 §6.)
-func TestAPinReadThatNobodyAnswersIsTheForgesFailureNotABuildNodes(t *testing.T) { // 1820/AC5
-	b := groupBench(t, "cb54756c3865")
-	b.ex.Forge.(*fakeForge).err = fmt.Errorf("gitea.gitea_get_file: %w", nats.ErrNoResponders)
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
-	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
-		t.Errorf("verdict = %+v, want a failure at the forge: no build node was to blame", v)
-	}
-}

modules/mesh-delivery-checker/internal/check/judge.go

@@ -91,9 +91,14 @@ type Examiner struct {
 	Modules  BuildModules
 	// Runs says which commit the mesh runs of a module (the indexer's modules); nil knows none.
 	Runs interface{ CommitOf(module string) string }
-	// Forge reads the go.mod files of the Go members and says whether a mesh-sdk commit is on its trunk (ADR 0484 clause 9);
-	// nil checks no pin.
+	// Forge reads the forge's files for the siblings a repository's tests read; nil reads none.
 	Forge Forge
+	// Published names the latest published version of every mesh package a module of the mesh uses, by package, from the
+	// indexer's modules (novox/hq ADR 0573 §2): a check builds against those, or against a member's head for a package
+	// its group publishes (§4), whatever go.mod names. Nil names none, and go.mod's versions are built.
+	Published interface {
+		LatestPackages() delivery.PackageVersions
+	}
 	// Builds says how the build of a fingerprint the candidate carries stands (the builder's builds bucket); nil says nothing
 	// of the builds.
 	Builds BuildStates
@@ -106,6 +111,11 @@ type Examiner struct {
 	}
 	// Trunks are the trunk heads of every repository, for the siblings a repository's tests read.
 	Trunks interface{ Heads() map[string]string }
+	// Manifests are the indexer's manifest digests by module: the catalogue a change's manifests are judged in by the
+	// indexer's judge (manifests_judge.go, novox/hq ADR 0578 §2); nil judges no manifest.
+	Manifests TrunkManifests
+	// Predefined reads the catalogue's predefined keys the indexer keeps (manifests_judge.go); nil reads none.
+	Predefined PredefinedList
 	// Compositions answers the assigner's composition check of a check by the check's key (delivery.CompositionKey),
 	// waiting until the assigner wrote a verdict that does not wait, or ctx ends (ADR 0528 clause 5, issue 1297); nil
 	// leaves the composition not run.
@@ -214,6 +224,11 @@ type state struct {
 	slow    []string
 	// beside are the siblings read at their trunk's head, by repository (ADR 0548 §6).
 	beside map[string]string
+	// judgeHead is the group's mesh-delivery member head when its merge changes the judge (ADR 0578 §2); empty judges
+	// with mesh-delivery's trunk.
+	judgeHead string
+	// predefinedHead is the catalogue member's head when its merge changes predefined.json: the list is read there.
+	predefinedHead string
 }
 
 // Judge runs the case (it is the Judge of a Checker). A failure of the change, of a merge or of a step is a verdict; an error is only a case that cannot
@@ -224,6 +239,10 @@ func (j *Examiner) Judge(ctx context.Context, c *Case) (Outcome, error) {
 	if v := st.judgeAll(ctx); v != nil {
 		return st.finish(ctx, *v), nil
 	}
+	// Every manifest the change touches, judged by the indexer's judge (ADR 0578 §2): a refusal fails the check.
+	if v := st.judgeManifests(ctx); v != nil {
+		return st.finish(ctx, *v), nil
+	}
 	return st.finish(ctx, delivery.Verdict{State: delivery.VerdictPass}), nil
 }
 
@@ -383,6 +402,7 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 		if st.c.Try == nil { // a try owes the indexer no preview: no pull request holds its head
 			st.j.writePreview(ctx, p, merged)
 		}
+		st.judgedByMember(p, merged)
 		if p.Repository == SDKRepository && len(st.c.Pulls) > 1 && st.j.changesPackage(p, merged) {
 			groupPackage = map[string]any{"repository": p.Repository, "commit": p.Head, "ref": refOf(p.Number)}
 		}
@@ -394,8 +414,8 @@ func (st *state) judgeAll(ctx context.Context) *delivery.Verdict {
 // need that is busy is waited for, and short enough that a mesh where no node has it says so.
 const DefaultDeclineBound = 30 * time.Minute
 
-// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, the
-// pins of its go.mod files, then each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
+// ask puts the target's check ask, waits for the step of the node that pulled it and judges its answer: the fetch, then
+// each level's digest, kept verdicts and tests. When the answer leaves packages unmet,
 // their tests needing what that node lacks (issue 890), the passes are kept and the levels from the first such one are
 // asked again of a node that has it (placed).
 func (st *state) ask(ctx context.Context, t *target, merged *[]Fetched) *delivery.Verdict {
@@ -431,6 +451,9 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	}
 	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
 		At: st.j.now().UTC(), Check: job, Needs: needs}
+	if a.Language == delivery.AskGo {
+		a.Packages = st.packagesOf(p.Repository)
+	}
 	var step delivery.Step
 	var firstDecline time.Time
 	for {
@@ -487,7 +510,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	st.nodes[step.Node] = true
 	st.c.Progress.Set(fmt.Sprintf("judge the check of %s#%d", p.Repository, p.Number), step.Node)
 	if step.State != delivery.StepPassed {
-		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s%s", p.Repository, p.Number, step.State, step.Reason, pinHint(st.c, step.Reason)))
+		return fail(step.Node, fmt.Sprintf("the check of %s#%d %s: %s", p.Repository, p.Number, step.State, step.Reason))
 	}
 	var answer delivery.CheckAnswer
 	if err := json.Unmarshal(step.Result, &answer); err != nil {
@@ -506,11 +529,8 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 	if !changesBuildGo(p.Repository, t.changed) {
 		t.runner = "" // the build module used no runner: the merge does not change it
 	}
-	if !placed { // the placed ask fetched the same merge: its preview and pins were read from the first
+	if !placed { // the placed ask fetched the same merge: its preview was read from the first
 		*merged = append(*merged, t.fetched)
-		if v := st.checkPinsOf(ctx, t); v != nil {
-			return v
-		}
 		if v := st.checkBinariesOf(t); v != nil {
 			return v
 		}

modules/mesh-delivery-checker/internal/check/manifests_judge.go

@@ -0,0 +1,259 @@
+package check
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A change's manifests are judged by the indexer's judge (novox/hq ADR 0578 §2): the checker asks the Go build seat to
+// build the judge's command (mesh-delivery's modules/mesh-delivery-indexer, cmd/mesh-judge) at mesh-delivery's trunk, or
+// at the group's mesh-delivery member head when that member changes the judge, and to run it in its sandbox over the
+// catalogue as the change leaves it, exactly as the composer is run (delivery.ComposeJob, ADR 0482 §4). A manifest the
+// change touches that the judge refuses fails the check, naming the manifest and each problem. The checker links no
+// judge of its own.
+
+// The judge the checker runs.
+const (
+	DeliveryRepository = "novox/mesh-delivery"
+	JudgeDir           = "modules/mesh-delivery-indexer"
+	JudgePackage       = "mesh-delivery-indexer/cmd/mesh-judge"
+	// JudgeCase is the case of a judge request holding the catalogue as the change leaves it, and JudgeTrunk the one
+	// holding it as the trunk holds it: a problem the change case has and the trunk case lacks is the change's (ADR 0579 §2).
+	JudgeCase  = "change"
+	JudgeTrunk = "trunk"
+	// judgeBetween is how the judge names the problems between manifests that no one module's removal ends.
+	judgeBetween = "(between manifests)"
+)
+
+// judgePaths are the paths of mesh-delivery whose change changes the judge: a group whose mesh-delivery member changes
+// one is judged by that member's head.
+var judgePaths = []string{JudgeDir + "/judge/", JudgeDir + "/cmd/mesh-judge/", JudgeDir + "/go.mod", JudgeDir + "/go.sum"}
+
+// changesJudge says whether a merge of mesh-delivery with these changed paths changes the judge.
+func changesJudge(repository string, merged []Fetched) bool {
+	if repository != DeliveryRepository {
+		return false
+	}
+	for _, f := range merged {
+		for _, p := range f.Changed {
+			for _, j := range judgePaths {
+				if p == j || strings.HasPrefix(p, j) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+// TrunkManifests says the manifest digest of every module the indexer holds (its modules state), by module.
+type TrunkManifests interface {
+	ManifestDigests() map[string]string
+}
+
+// PredefinedList is the catalogue's list of predefined keys the indexer keeps (its state predefined, key list), the one a
+// config value falling back to a key is judged against (ADR 0348 §7); nil when it keeps none.
+type PredefinedList interface {
+	PredefinedList(ctx context.Context) (json.RawMessage, error)
+}
+
+// judgeRequest is the judge's request over the catalogue as the case leaves it: every trunk manifest by its digest, each
+// one a pull request touches replaced by the digest its candidate names; touched are the modules whose manifest the
+// change adds or changes (a digest the trunk does not hold for it), sorted (novox/hq ADR 0579 §2).
+func judgeRequest(trunk map[string]string, pulls []Pull) (req composer.Request, touched []string) {
+	manifests, before := map[string]composer.Manifest{}, map[string]composer.Manifest{}
+	for module, digest := range trunk {
+		if digest != "" {
+			manifests[module] = composer.Manifest{Digest: digest}
+			before[module] = composer.Manifest{Digest: digest}
+		}
+	}
+	seen := map[string]bool{}
+	for _, p := range pulls {
+		for module, cm := range p.Fps {
+			if cm.Manifest == "" {
+				continue
+			}
+			manifests[module] = composer.Manifest{Digest: cm.Manifest}
+			if trunk[module] != cm.Manifest {
+				seen[module] = true
+			}
+		}
+	}
+	return composer.Request{V: composer.Version, Cases: []composer.Case{{Name: JudgeCase, Manifests: manifests},
+		{Name: JudgeTrunk, Manifests: before}}}, slices.Sorted(maps.Keys(seen))
+}
+
+// judgeManifests runs the indexer's judge over the case's manifests and fails the check for each touched manifest it
+// refuses. A case that touches no manifest, or an examiner that reads no trunk manifests, judges nothing; a judge that
+// cannot be asked or does not answer fails the check, said, never passes it.
+func (st *state) judgeManifests(ctx context.Context) *delivery.Verdict {
+	if st.j.Manifests == nil || st.c.Try != nil {
+		return nil
+	}
+	req, touched := judgeRequest(st.j.Manifests.ManifestDigests(), st.c.Pulls)
+	if len(touched) == 0 {
+		return nil
+	}
+	commit, at := st.judgeHead, "the group's mesh-delivery head "+st.judgeHead
+	if commit == "" {
+		if st.j.Trunks != nil {
+			commit = st.j.Trunks.Heads()[DeliveryRepository]
+		}
+		at = "mesh-delivery's trunk " + commit
+	}
+	if commit == "" {
+		return fail(goModule, "the change's manifests cannot be judged: the trunk head of "+DeliveryRepository+" is not known")
+	}
+	// The list of predefined keys the manifests are judged against (ADR 0578 §2): the catalogue member's predefined.json
+	// when the change alters it, else the one the indexer keeps.
+	if list, from := st.predefinedList(ctx); list != nil {
+		req.Predefined = list
+		st.c.note("the manifests are judged against the predefined keys of " + from)
+	}
+	raw, err := json.Marshal(req)
+	if err != nil {
+		return fail(goModule, err.Error())
+	}
+	job := delivery.ComposeJob{Fetch: map[string]any{"repository": DeliveryRepository, "commit": commit}, Dir: JudgeDir,
+		Package: JudgePackage, Request: raw, Reader: "the indexer's judge at " + at}
+	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: delivery.AskCheck, Language: delivery.AskGo, Asker: delivery.CheckerModule,
+		At: st.j.now().UTC(), Compose: &job}
+	st.c.Progress.Set(fmt.Sprintf("the judge ask %s of the manifests of %s", a.ID, strings.Join(touched, ", ")), "")
+	st.c.Asked(a.ID)
+	if err := st.j.Asks.Put(ctx, a); err != nil {
+		return fail(goModule, "the judge of the change's manifests could not be asked: "+err.Error())
+	}
+	step, err := st.j.Asks.Wait(ctx, a)
+	if err != nil {
+		return fail(goModule, "the judge of the change's manifests: "+err.Error())
+	}
+	cv, trunkCase, why := judgeAnswer(step)
+	if why != "" {
+		return fail(goModule, fmt.Sprintf("the indexer's judge at %s did not judge the change's manifests: %s", at, why))
+	}
+	// A new or changed manifest is judged in full; of one the change leaves as it is, a problem the trunk already had is a
+	// warning (it is not refused for a rule it already broke), and a problem the change causes in it, which the trunk case
+	// lacks, fails the check as the change's (ADR 0579 §2).
+	var refused, warned []string
+	for _, module := range slices.Sorted(maps.Keys(cv.Manifests)) {
+		r := cv.Manifests[module]
+		if r.Accepted || r.Refused == "" {
+			continue
+		}
+		had := map[string]bool{}
+		for _, p := range strings.Split(trunkCase.Manifests[module].Refused, "\n") {
+			had[p] = true
+		}
+		var caused, old []string
+		for _, p := range strings.Split(r.Refused, "\n") {
+			if slices.Contains(touched, module) || !had[p] {
+				caused = append(caused, p)
+			} else {
+				old = append(old, p)
+			}
+		}
+		if len(caused) > 0 {
+			what := "the manifest of " + module
+			if module == judgeBetween {
+				what = "the catalogue"
+			}
+			refused = append(refused, fmt.Sprintf("the indexer's judge at %s refuses %s: %s", at, what, strings.Join(caused, "; ")))
+		}
+		if len(old) > 0 {
+			warned = append(warned, module+": "+strings.Join(old, "; "))
+		}
+	}
+	if len(warned) > 0 {
+		st.c.note("warnings of the indexer's judge on manifests the change leaves as they are (ADR 0579 §2): " + strings.Join(warned, " | "))
+	}
+	if len(refused) > 0 {
+		return fail(goModule, strings.Join(refused, "\n"))
+	}
+	st.c.note(fmt.Sprintf("the manifests of %s are accepted by the indexer's judge at %s", strings.Join(touched, ", "), at))
+	return nil
+}
+
+// judgeAnswer reads the judge's change and trunk cases from its step, or why it cannot.
+func judgeAnswer(step delivery.Step) (change, trunk composer.CaseVerdict, why string) {
+	if step.State != delivery.StepPassed {
+		return change, trunk, fmt.Sprintf("its step %s: %s", step.State, step.Reason)
+	}
+	var a delivery.ComposeAnswer
+	if err := json.Unmarshal(step.Result, &a); err != nil {
+		return change, trunk, "its step's answer cannot be read: " + err.Error()
+	}
+	var v composer.Verdict
+	if err := json.Unmarshal(a.Verdict, &v); err != nil || v.V != composer.Version {
+		return change, trunk, fmt.Sprintf("its verdict cannot be read (version %d): %v", v.V, err)
+	}
+	found := 0
+	for _, c := range v.Cases {
+		switch c.Name {
+		case JudgeCase:
+			change, found = c, found+1
+		case JudgeTrunk:
+			trunk, found = c, found+1
+		}
+	}
+	if found != 2 {
+		return change, trunk, "its verdict does not hold both the cases " + JudgeCase + " and " + JudgeTrunk
+	}
+	return change, trunk, ""
+}
+
+// predefinedList is the list of predefined keys a case's manifests are judged against, and where it comes from: the
+// catalogue member's predefined.json at its head when its merge changes it, else the one the indexer keeps; nil when
+// neither can be read, said, and the judge then takes each fallback as its value declares it.
+func (st *state) predefinedList(ctx context.Context) (catalogue.PredefinedList, string) {
+	read := func(raw []byte, from string) (catalogue.PredefinedList, string) {
+		list, err := catalogue.ParsePredefined(raw)
+		if err != nil {
+			st.c.note("the predefined keys of " + from + " cannot be read, so fallbacks are judged as their values declare them: " + err.Error())
+			return nil, ""
+		}
+		return list, from
+	}
+	if st.predefinedHead != "" && st.j.Forge != nil {
+		text, err := st.j.Forge.File(ctx, catalogueRepository, catalogue.PredefinedFile, st.predefinedHead)
+		if err == nil {
+			return read([]byte(text), "the catalogue member's head "+st.predefinedHead)
+		}
+		st.c.note("the catalogue member's predefined.json cannot be read: " + err.Error())
+	}
+	if st.j.Predefined == nil {
+		return nil, ""
+	}
+	raw, err := st.j.Predefined.PredefinedList(ctx)
+	if err != nil || raw == nil {
+		if err != nil {
+			st.c.note("the indexer's predefined keys cannot be read: " + err.Error())
+		}
+		return nil, ""
+	}
+	return read(raw, "the indexer's kept list")
+}
+
+// judgedByMember notes the group's mesh-delivery member head as the judge's when its merge changes the judge, and the
+// catalogue member's head as where the predefined keys are read when its merge changes predefined.json.
+func (st *state) judgedByMember(p Pull, merged []Fetched) {
+	if changesJudge(p.Repository, merged) {
+		st.judgeHead = p.Head
+	}
+	if p.Repository == catalogueRepository {
+		for _, f := range merged {
+			if slices.Contains(f.Changed, catalogue.PredefinedFile) {
+				st.predefinedHead = p.Head
+			}
+		}
+	}
+}

modules/mesh-delivery-checker/internal/check/pins.go

@@ -3,17 +3,17 @@ package check
 import (
 	"context"
 	"errors"
-	"fmt"
-	"path"
-	"regexp"
-	"sort"
-	"strings"
+	"maps"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// The pin of mesh-sdk in a Go member's go.mod (novox/hq ADR 0484 clause 9, ADR 0482 clause 2, issue 1624): a delivery group
-// has one verdict, and the mesh-sdk its Go members are built and tested with is the group's: a pin to the head of the group's
-// mesh-sdk pull request, or to a commit already on mesh-sdk's trunk. Any other commit is a stale or a foreign pin, and the
-// group fails naming the member and the commit.
+// **A check builds against the group's own package heads, not against what a member names** (novox/hq ADR 0573 §2, §4;
+// issue 1585). Every Go check ask carries the version of each mesh package to build against (delivery.StepAsk.Packages):
+// the head of the group's member that publishes it, else its latest published version as the indexer holds it. The build
+// module writes them into the workspace, whatever version or commit a member's go.mod names, so no member is refused
+// for naming no version of the group's package, an older head of it, a merge commit or a commit on no pull request: that
+// refusal (issue 1624's pin check) was a fault of the check (§4), and is gone.
 
 // SDKRepository is the repository of mesh-sdk, and SDKModulePath its Go module.
 const (
@@ -21,142 +21,47 @@ const (
 	SDKModulePath = "git.novox.be/novox/mesh-sdk/go"
 )
 
-// Issue1148 is why a pin that only a head carries fails the check.
-const Issue1148 = "issue 1148"
-
 // ErrNotFound is what Forge.File wraps when the ref holds no such file (the forge answered 404): a file the ref does not hold,
 // told from a forge that could not be read (issue 1845).
 var ErrNotFound = errors.New("the ref holds no such file")
 
-// Forge reads a file of a repository at a ref, and says whether a commit is on a repository's trunk.
+// Forge reads a file of a repository at a ref.
 type Forge interface {
 	// File is the text of a file at a ref (a branch, a tag or a commit).
 	File(ctx context.Context, repository, path, ref string) (string, error)
-	// OnTrunk says whether commit (a full or a 12-digit sha) is already merged into the trunk of the repository: it holds no
-	// commit the trunk does not.
-	OnTrunk(ctx context.Context, repository, commit string) (bool, error)
-	// FullSHA is the 40-digit sha of a commit named by its first 12 digits.
-	FullSHA(ctx context.Context, repository, commit string) (string, error)
-	// BranchHeads is the commit every branch of a repository points at, by branch name (issue 1921).
-	BranchHeads(ctx context.Context, repository string) (map[string]string, error)
 }
 
-var pseudoVersion = regexp.MustCompile(`-([0-9a-f]{12})$`)
-
-// SDKPin is the commit (12 hex digits) a go.mod names for mesh-sdk by a pseudo-version, or none for a go.mod that does not
-// require mesh-sdk or requires a version that is no pseudo-version (a tag is a release the SDK itself names).
-func SDKPin(goMod string) (commit string, ok bool) {
-	for _, line := range strings.Split(goMod, "\n") {
-		f := strings.Fields(strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(line), "require")))
-		if len(f) >= 2 && f[0] == SDKModulePath {
-			if m := pseudoVersion.FindStringSubmatch(f[1]); m != nil {
-				return m[1], true
-			}
-			return "", false
+// packagesOf is the version of each mesh package a Go check of repository builds against (ADR 0573 §2, §4): the latest
+// published version of each package the mesh's modules use (Published), and for a package one of the case's pull
+// requests publishes, that pull request's head (mesh-sdk's Go module whenever mesh-sdk is a member). A package of
+// repository itself comes with the tree the check fetched, and is left out. Nil for none.
+func (st *state) packagesOf(repository string) delivery.PackageVersions {
+	versions := delivery.PackageVersions{}
+	if st.j.Published != nil {
+		maps.Copy(versions, st.j.Published.LatestPackages())
+	}
+	if st.c.member(SDKRepository) != nil {
+		if _, named := versions[SDKModulePath]; !named {
+			versions[SDKModulePath] = ""
 		}
 	}
-	return "", false
-}
-
-// checkPinsOf refuses a Go member whose go.mod names a mesh-sdk commit that is neither on mesh-sdk's trunk nor the head of the
-// group's mesh-sdk pull request. It reads each go.mod the fetch named from the forge: the one the check builds, which is the
-// head's when the head holds the file and the trunk's when it does not, since a module added on the trunk after the branch was
-// cut is in the merge and not at the head (issue 1845). It answers nil when every pin is the group's.
-func (st *state) checkPinsOf(ctx context.Context, t *target) verdictPtr {
-	if st.j.Forge == nil {
+	for pkg := range versions {
+		repo, _, ok := delivery.PackageRepository(pkg)
+		if !ok || delivery.SameRepository(repo, repository) {
+			delete(versions, pkg)
+			continue
+		}
+		if m := st.c.member(repo); m != nil && len(m.Head) == 40 {
+			versions[pkg] = m.Head
+		}
+		if versions[pkg] == "" {
+			delete(versions, pkg)
+		}
+	}
+	if len(versions) == 0 {
 		return nil
 	}
-	sdk := st.c.member(SDKRepository)
-	if t.module != goModule || t.pull.Repository == SDKRepository {
-		return nil
-	}
-	{
-		for _, dir := range t.fetched.Modules {
-			file := path.Join(dir, "go.mod")
-			st.c.Progress.Set(fmt.Sprintf("read %s of %s#%d", file, t.pull.Repository, t.pull.Number), t.node)
-			text, err := st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Head)
-			if errors.Is(err, ErrNotFound) && t.pull.Trunk != "" {
-				// Only a file the head does not hold is read at the trunk; any other failure fails the check as it did.
-				text, err = st.j.Forge.File(ctx, t.pull.Repository, file, t.pull.Trunk)
-			}
-			if err != nil {
-				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: %s cannot be read to check its mesh-sdk pin: %v%s", t.pull.Repository, t.pull.Number, file, err, unheardWords(err)))
-			}
-			pin, ok := SDKPin(text)
-			if !ok {
-				continue
-			}
-			if sdk != nil && strings.HasPrefix(sdk.Head, pin) {
-				continue // the group's own head
-			}
-			onTrunk, err := st.j.Forge.OnTrunk(ctx, SDKRepository, pin)
-			if err != nil {
-				return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is on its trunk cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
-			}
-			if onTrunk {
-				continue
-			}
-			if st.c.Try != nil {
-				// A try only (issue 1921): a repository tried on a branch that mesh-sdk shares by name (a milestone's branch across
-				// repositories) is built with that branch's mesh-sdk head, which no group pull request holds before the pull requests exist.
-				branch, err := st.sameBranchPin(ctx, t, pin)
-				if err != nil {
-					return failed(forgeMachine(err, t.node), fmt.Sprintf("%s#%d: whether mesh-sdk %s is the head of a branch cannot be told: %v%s", t.pull.Repository, t.pull.Number, pin, err, unheardWords(err)))
-				}
-				if branch != "" {
-					st.c.note(fmt.Sprintf("pin accepted: head of mesh-sdk %s", branch))
-					continue
-				}
-			}
-			nor := "the group has no mesh-sdk pull request"
-			if sdk != nil {
-				nor = "the head of the group's mesh-sdk pull request is " + short12(sdk.Head)
-			}
-			return failed(t.node, fmt.Sprintf("%s#%d: %s names mesh-sdk %s, which is neither on mesh-sdk's trunk nor the group's head (%s)", t.pull.Repository, t.pull.Number, file, pin, nor))
-		}
-	}
-	return nil
-}
-
-// sameBranchPin names the branch of the tried repository that points at the tried head and that mesh-sdk also has, at the
-// commit the pin names; empty when there is none.
-func (st *state) sameBranchPin(ctx context.Context, t *target, pin string) (string, error) {
-	mine, err := st.j.Forge.BranchHeads(ctx, t.pull.Repository)
-	if err != nil {
-		return "", err
-	}
-	var same []string
-	for name, head := range mine {
-		if head == t.pull.Head && name != "main" {
-			same = append(same, name)
-		}
-	}
-	if len(same) == 0 {
-		return "", nil
-	}
-	sdk, err := st.j.Forge.BranchHeads(ctx, SDKRepository)
-	if err != nil {
-		return "", err
-	}
-	sort.Strings(same)
-	for _, name := range same {
-		if h, ok := sdk[name]; ok && strings.HasPrefix(h, pin) {
-			return name, nil
-		}
-	}
-	return "", nil
-}
-
-// failureVerdict is a verdict of failure the check ends with.
-
-// pinHint is added to the failure of a Go member's fetch that names mesh-sdk while the group holds a mesh-sdk pull request:
-// a pin to that pull request's head names a commit only the head carries, which go mod download cannot resolve before the
-// pull request is merged (issue 1148), so such a check fails and never passes.
-func pinHint(c *Case, fetchError string) string {
-	if c.member(SDKRepository) == nil || !strings.Contains(fetchError, "mesh-sdk") {
-		return ""
-	}
-	return " (a pin to the head of the group's mesh-sdk pull request names a commit only that head carries, which go mod download cannot resolve; " + Issue1148 + ")"
+	return versions
 }
 
 // unheardWords ends the words of a failed read of the forge that reached nobody: the forge was not heard (UnheardWords).

modules/mesh-delivery-checker/internal/check/pins_test.go

@@ -1,214 +1,63 @@
 package check
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
+	"maps"
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
-// fakeForge answers the forge's two reads from files and commits it is given.
-type fakeForge struct {
-	goMods  map[string]string // `<repository> <path> <ref>` -> text
-	onTrunk map[string]bool   // by commit prefix
-	err     error
-	errAt   map[string]error // by ref: a read at that ref fails with it
-	// branches are the branches of a repository with the commit each points at.
-	branches map[string]map[string]string
+// published is the latest published version of each mesh package, as the indexer's modules say (Examiner.Published).
+type published delivery.PackageVersions
+
+func (p published) LatestPackages() delivery.PackageVersions {
+	return maps.Clone(delivery.PackageVersions(p))
 }
 
-func (f *fakeForge) BranchHeads(_ context.Context, repository string) (map[string]string, error) {
-	if f.err != nil {
-		return nil, f.err
-	}
-	return f.branches[repository], nil
-}
-
-func (f *fakeForge) File(_ context.Context, repository, path, ref string) (string, error) {
-	if f.err != nil {
-		return "", f.err
-	}
-	if e := f.errAt[ref]; e != nil {
-		return "", e
-	}
-	if s, ok := f.goMods[repository+" "+path+" "+ref]; ok {
-		return s, nil
-	}
-	return "", fmt.Errorf("no file %s of %s at %s: %w", path, repository, ref, ErrNotFound)
-}
-
-func (f *fakeForge) FullSHA(_ context.Context, _ string, commit string) (string, error) {
-	if f.err != nil {
-		return "", f.err
-	}
-	return commit + strings.Repeat("0", 40-len(commit)), nil
-}
-
-func (f *fakeForge) OnTrunk(_ context.Context, _ string, commit string) (bool, error) {
-	if f.err != nil {
-		return false, f.err
-	}
-	return f.onTrunk[commit[:12]], nil
-}
-
-// capturedGoMod is the go.mod the forge answered (testdata/captured/forge-get-file-go-mod.json), pinned to the commit given.
-func capturedGoMod(t *testing.T, pin string) string {
+// packagesOfFetch is the package versions the fetch of repository was handed (delivery.StepAsk.Packages, issue 1585).
+func packagesOfFetch(t *testing.T, b *bench, repository string) delivery.PackageVersions {
 	t.Helper()
-	raw, err := os.ReadFile(filepath.Join("testdata", "captured", "forge-get-file-go-mod.json"))
-	if err != nil {
-		t.Fatal(err)
+	for _, f := range b.steps.tool("fetch") {
+		if f.args["repository"] == repository {
+			p, err := buildstep.PackagesArg(f.args["packages"])
+			if err != nil {
+				t.Fatal(err)
+			}
+			return p
+		}
 	}
-	var a struct{ File struct{ Content string } }
-	if err := json.Unmarshal(raw, &a); err != nil {
-		t.Fatal(err)
-	}
-	return strings.Replace(a.File.Content, "cb54756c3865", pin, 1)
+	t.Fatalf("%s was not fetched", repository)
+	return nil
 }
 
-func TestTheSDKPinIsTheCommitOfAPseudoVersion(t *testing.T) { // 1624
-	if c, ok := SDKPin(capturedGoMod(t, "cb54756c3865")); !ok || c != "cb54756c3865" {
-		t.Errorf("pin = %q, %v", c, ok)
-	}
-	if _, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.2.0\n"); ok {
-		t.Error("a tagged version is no commit")
-	}
-	if c, ok := SDKPin("module x\n\nrequire git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261021100209-cb54756c3865\n"); !ok || c != "cb54756c3865" {
-		t.Errorf("a one-line require: %q, %v", c, ok)
-	}
-	if _, ok := SDKPin("module x\n\ngo 1.26\n"); ok {
-		t.Error("a go.mod that does not require mesh-sdk has a pin")
-	}
-}
-
-// groupBench is a group of mesh-delivery#7 and the SDK's pull request 12, mesh-delivery's go.mod at its head naming pin.
-func groupBench(t *testing.T, pin string, trunk ...string) *bench {
+// ADR 0573 §4 (issue 1585 S14): a group's Go member is built against the head of the group's mesh-sdk member, whatever its
+// go.mod names (an older head of it included, which issue 1624's pin check refused), and never refused for its pin; a
+// pull request alone is built against the latest published version of each package, and its own repository's packages
+// come with its tree.
+func TestAGroupMemberIsBuiltAgainstTheSDKMembersHeadWhateverItsGoModNames(t *testing.T) { // 1624/AC2, AC4 as ADR 0573 §4 changes them
+	const contract = "git.novox.be/novox/mesh-delivery/contract"
 	b := newBench(t)
 	b.fetch.Modules = []string{"modules/m"}
-	forge := &fakeForge{goMods: map[string]string{repoA + " modules/m/go.mod " + head1: capturedGoMod(t, pin)}, onTrunk: map[string]bool{}}
-	for _, c := range trunk {
-		forge.onTrunk[c] = true
-	}
-	b.ex.Forge = forge
-	return b
-}
-
-func TestAMemberPinnedToTheSDKMembersHeadPassesAndIsBuiltAgainstIt(t *testing.T) { // 1624/AC2, AC4
-	b := groupBench(t, head2[:12])
+	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
 	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
 	if v.State != delivery.VerdictPass {
 		t.Fatalf("verdict = %+v", v)
 	}
-	var besideSDK bool
-	for _, f := range b.steps.tool("fetch") {
-		if f.args["repository"] == repoA {
-			refs, _ := refsOf(f.args["beside"]), true
-			for _, r := range refs {
-				besideSDK = besideSDK || (r.Repository == repoSDK && r.Commit == head2)
-			}
-		}
+	if got := packagesOfFetch(t, b, repoA); len(got) != 1 || got[SDKModulePath] != head2 {
+		t.Errorf("the member's packages = %v, want mesh-sdk at the group's head %s alone (its own contract comes with its tree)", got, head2)
 	}
-	if !besideSDK {
+	if s := besideOf(t, b, repoA)[repoSDK]; s.Commit != head2 {
 		t.Error("mesh-delivery's tests were not given the SDK member at its head")
 	}
-}
-
-func TestAMemberPinnedToAnOlderHeadOfTheSDKMemberFailsNamingTheMemberAndTheCommit(t *testing.T) { // 1624/AC2, AC4
-	b := groupBench(t, "9aaa5c80ac5c") // a commit of the SDK branch, not its head, not on the trunk
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
-	f := v.Failed
-	if v.State != delivery.VerdictFail || f.Machine != "shanks" || !strings.Contains(f.Words, repoA+"#7") || !strings.Contains(f.Words, "9aaa5c80ac5c") ||
-		!strings.Contains(f.Words, "neither on mesh-sdk's trunk nor the group's head") || !strings.Contains(f.Words, short12(head2)) {
-		t.Fatalf("verdict = %+v", v)
+	b = newBench(t)
+	b.ex.Published = published{SDKModulePath: trunkS, contract: trunkA}
+	if v := b.judge(t, caseOf(t, pullOf("novox/mesh-catalog", 7, head1))).Verdict; v.State != delivery.VerdictPass {
+		t.Fatalf("a pull request alone: verdict = %+v", v)
 	}
-	// Since R4g the levels run in the member's one check ask before its go.mod pins are judged (ADR 0525 §3); the verdict is
-	// still the pin's, whatever the levels said.
-}
-
-func TestAMemberPinnedToACommitOnTheTrunkPasses(t *testing.T) { // 1624/AC2, AC4
-	b := groupBench(t, "cb54756c3865", "cb54756c3865")
-	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict; v.State != delivery.VerdictPass {
-		t.Fatalf("verdict = %+v", v)
-	}
-	// A lone pull request of a Go member is held to the trunk alone.
-	b = groupBench(t, "9aaa5c80ac5c")
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
-		t.Errorf("a foreign pin with no SDK member: %+v", v)
-	}
-}
-
-func TestAPinOnlyTheSDKHeadCarriesThatDownloadCannotResolveFailsNamingIssue1148(t *testing.T) { // 1624/AC5, ADR 0453 clause 12
-	b := groupBench(t, head2[:12])
-	b.steps.handlers["build_go_fetch"] = func(c stepCall) (any, error) {
-		if c.args["repository"] == repoA {
-			return nil, fmt.Errorf("go mod download: git.novox.be/novox/mesh-sdk/go@v0.1.14-0.20261021100209-%s: invalid version: unknown revision", head2[:12])
-		}
-		return b.fetch, nil
-	}
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "issue 1148") || !strings.Contains(v.Failed.Words, head2[:12]) {
-		t.Errorf("verdict = %+v, want a failure naming issue 1148 and the commit", v)
-	}
-}
-
-func TestAPinThatCannotBeCheckedFailsAndNeverPasses(t *testing.T) { // ADR 0453 clause 12
-	b := groupBench(t, "cb54756c3865")
-	b.ex.Forge.(*fakeForge).err = fmt.Errorf("the forge is down")
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1), pullOf(repoSDK, 12, head2))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the forge is down") {
-		t.Errorf("verdict = %+v", v)
-	}
-}
-
-// trunkOnlyBench is a group of mesh-delivery#7 whose fetch holds two Go modules: modules/m, which the head holds, and
-// modules/new, which only the trunk holds (added on the trunk after the branch was cut). The SDK pin of each go.mod is given.
-func trunkOnlyBench(t *testing.T, headPin, trunkPin string) *bench {
-	b := newBench(t)
-	b.fetch.Modules = []string{"modules/m", "modules/new"}
-	forge := &fakeForge{goMods: map[string]string{
-		repoA + " modules/m/go.mod " + head1:    capturedGoMod(t, headPin),
-		repoA + " modules/m/go.mod " + trunkA:   capturedGoMod(t, headPin),
-		repoA + " modules/new/go.mod " + trunkA: capturedGoMod(t, trunkPin),
-	}, onTrunk: map[string]bool{"cb54756c3865": true}}
-	b.ex.Forge = forge
-	return b
-}
-
-func TestAModuleOnlyTheTrunkHoldsIsReadAtTheTrunkAndPasses(t *testing.T) { // 1845/AC1
-	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
-	if v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict; v.State != delivery.VerdictPass {
-		t.Fatalf("verdict = %+v", v)
-	}
-}
-
-func TestAStalePinOfAModuleOnlyTheTrunkHoldsStillFailsNamingTheFileAndTheCommit(t *testing.T) { // 1845/AC2
-	b := trunkOnlyBench(t, "cb54756c3865", "9aaa5c80ac5c")
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, repoA+"#7") || !strings.Contains(v.Failed.Words, "modules/new/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
-		t.Fatalf("verdict = %+v", v)
-	}
-}
-
-func TestAModuleTheHeadHoldsIsJudgedByTheHeadsPin(t *testing.T) { // 1845/AC3
-	b := trunkOnlyBench(t, "9aaa5c80ac5c", "cb54756c3865") // the head's pin is stale, the trunk's go.mod of the same module is fine
-	b.ex.Forge.(*fakeForge).goMods[repoA+" modules/m/go.mod "+trunkA] = capturedGoMod(t, "cb54756c3865")
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") {
-		t.Fatalf("verdict = %+v", v)
-	}
-}
-
-func TestAReadThatFailsForAnotherReasonStillFailsAndIsNotTriedAtTheTrunk(t *testing.T) { // 1845/AC4
-	b := trunkOnlyBench(t, "cb54756c3865", "cb54756c3865")
-	b.ex.Forge.(*fakeForge).errAt = map[string]error{head1: fmt.Errorf("the forge answered 500")}
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "modules/m/go.mod") || !strings.Contains(v.Failed.Words, "the forge answered 500") {
-		t.Fatalf("verdict = %+v", v)
+	if got := packagesOfFetch(t, b, "novox/mesh-catalog"); len(got) != 2 || got[SDKModulePath] != trunkS || got[contract] != trunkA {
+		t.Errorf("a pull request alone is built against %v, want every package at its latest published version", got)
 	}
 }
 
@@ -236,9 +85,6 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	b := newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{controller: trunkA, catalogue: trunkS, host: trunkA2, SDKRepository: "9999999999999999999999999999999999999999"})
 	b.ex.Runs = runsAt{"mesh-host": hostRuns}
-	forge := &fakeForge{goMods: map[string]string{controller + " go.mod " + head1: capturedGoMod(t, "cb54756c3865"),
-		catalogue + " go.mod " + head2: "module git.novox.be/novox/mesh-catalog\n"}, onTrunk: map[string]bool{"cb54756c3865": true}}
-	b.ex.Forge = forge
 	// A group of the controller and the catalogue: the controller's tests read the catalogue's trunk, not the group's head.
 	out := b.judge(t, caseOf(t, pullOf(controller, 7, head1), pullOf(catalogue, 12, head2)))
 	// ADR 0548 §6, issue 568's own example: the verdict names the node-engine at the commit the mesh runs, and mesh-sdk at the
@@ -253,8 +99,10 @@ func TestTheSiblingsAreWhereTheTestsStateThem(t *testing.T) { // review D2, ADR
 	if h := got[host]; h.Commit != hostRuns {
 		t.Errorf("the node-engine beside the controller = %+v, want the commit the mesh runs %s", h, hostRuns)
 	}
-	if s := got[SDKRepository]; s.Commit != "cb54756c3865"+strings.Repeat("0", 28) {
-		t.Errorf("mesh-sdk beside the controller = %+v, want the commit its go.mod pins, whole", s)
+	// ADR 0573 §2: the controller is built against mesh-sdk's latest published version, so its tests read that one too,
+	// not the commit its go.mod names.
+	if s := got[SDKRepository]; s.Commit != "9999999999999999999999999999999999999999" {
+		t.Errorf("mesh-sdk beside the controller = %+v, want its trunk", s)
 	}
 }
 
@@ -283,36 +131,12 @@ func TestTheNodeEnginesTestsHaveTheControllerBesideThem(t *testing.T) {
 	}
 	b = newBench(t)
 	b.ex.Trunks = trunksOf(t, map[string]string{host: trunkA, controllerRepo: trunkA2, catalogueRepository: trunkS, SDKRepository: trunkS})
-	b.ex.Forge = &fakeForge{goMods: map[string]string{controllerRepo + " go.mod " + head2: capturedGoMod(t, "cb54756c3865")},
-		onTrunk: map[string]bool{"cb54756c3865": true}}
 	b.judge(t, hostCase(t, pullOf(host, 5, head1), pullOf(controllerRepo, 9, head2)))
 	if c := besideOf(t, b, host)[controllerRepo]; c.Commit != head2 || c.Ref != "refs/pull/9/head" {
 		t.Errorf("the controller beside the node-engine in a group = %+v, want the member's head %s", c, head2)
 	}
 }
 
-func TestThePinOfTheControllerThatCannotBeReadFailsTheCheck(t *testing.T) { // review D2
-	b := newBench(t)
-	b.ex.Trunks = trunksOf(t, map[string]string{"novox/mesh-controller": trunkA})
-	b.ex.Forge = &fakeForge{goMods: map[string]string{}, onTrunk: map[string]bool{}}
-	v := b.judge(t, caseOf(t, pullOf("novox/mesh-controller", 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "go.mod") {
-		t.Errorf("verdict = %+v", v)
-	}
-}
-
-func TestAForgeThatIsNotHeardFailsAtTheForgeAndIsJudgedAgainWhenTheNodesChange(t *testing.T) { // 1624 C7
-	b := newBench(t)
-	b.ex.Forge = &fakeForge{err: &Unheard{Err: fmt.Errorf("nats: no responders available for request")}}
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict
-	if v.State != delivery.VerdictFail || v.Failed.Machine != "forge" {
-		t.Fatalf("verdict = %+v, want failed at the forge", v)
-	}
-	if !IsNodesFailure(v) {
-		t.Errorf("a forge that was not heard is not the change's failure: %+v is not judged again when the nodes change", v.Failed)
-	}
-}
-
 // 1887/A12: the change's own repository is placed beside it at the trunk it is merged onto, for every repository, so a
 // shrink-only list test reads the trunk's copy at $MESH_CHECK_BESIDE/<name>.
 func TestTheChangesOwnRepositoryIsBesideItAtItsTrunk(t *testing.T) {
@@ -376,44 +200,3 @@ func TestTheNodeEnginesCheckFailsWhereTheControllersTrunkIsNotKnown(t *testing.T
 		t.Fatalf("verdict = %+v", v)
 	}
 }
-
-// sameBranchBench is a try of mesh-delivery's feat/r6 at head1 whose go.mod pins the SDK at pin, with the SDK's feat/r6 at head2.
-func sameBranchBench(t *testing.T, pin string) (*bench, *Case) {
-	b := groupBench(t, pin)
-	b.ex.Forge.(*fakeForge).branches = map[string]map[string]string{
-		repoA:   {"main": trunkA, "feat/r6": head1},
-		repoSDK: {"main": "cb54756c3865" + strings.Repeat("0", 28), "feat/r6": head2},
-	}
-	c := caseOf(t, pullOf(repoA, 7, head1))
-	c.Try = &TryOptions{}
-	return b, c
-}
-
-func TestATryPinnedToTheHeadOfTheSDKBranchOfTheTriedBranchPasses(t *testing.T) { // 1921/AC1
-	b, c := sameBranchBench(t, head2[:12])
-	if v := b.judge(t, c).Verdict; v.State != delivery.VerdictPass {
-		t.Fatalf("verdict = %+v", v)
-	}
-	if n := c.Notes(); len(n) != 1 || n[0] != "pin accepted: head of mesh-sdk feat/r6" {
-		t.Errorf("notes = %q", n)
-	}
-}
-
-func TestATryPinnedToAnotherCommitIsStillRefused(t *testing.T) { // 1921/AC2
-	b, c := sameBranchBench(t, "9aaa5c80ac5c")
-	v := b.judge(t, c).Verdict
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "9aaa5c80ac5c") || !strings.Contains(v.Failed.Words, "neither on mesh-sdk's trunk nor the group's head") {
-		t.Fatalf("verdict = %+v", v)
-	}
-	if len(c.Notes()) != 0 {
-		t.Errorf("notes = %q", c.Notes())
-	}
-}
-
-func TestAMergeCheckWithTheSameBranchPinIsStillRefusedWithoutAGroupPullRequest(t *testing.T) { // 1921/AC3
-	b, _ := sameBranchBench(t, head2[:12])
-	v := b.judge(t, caseOf(t, pullOf(repoA, 7, head1))).Verdict // no Try: a pull request's check
-	if v.State != delivery.VerdictFail || !strings.Contains(v.Failed.Words, "the group has no mesh-sdk pull request") {
-		t.Fatalf("verdict = %+v", v)
-	}
-}

modules/mesh-delivery-checker/internal/check/preview.go

@@ -43,7 +43,7 @@ func PreviewOf(p Pull, fetched []Fetched) (delivery.Preview, bool) {
 			if t.Tree == "" || !digest64.MatchString(t.Manifest) {
 				continue
 			}
-			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths}
+			mods[dir] = delivery.PreviewModule{Tree: t.Tree, Manifest: t.Manifest, Locks: t.Locks, Paths: t.Paths, Packages: t.Packages}
 		}
 	}
 	if merge == "" {

modules/mesh-delivery-checker/internal/check/preview_named_test.go

@@ -12,12 +12,13 @@ func TestAPreviewCarriesTheNamedPathsObjectsOfAFetchsModuleTrees(t *testing.T) {
 	var f Fetched
 	// As buildstep.ModuleTrees answers a module naming its paths: the named tree and the objects.
 	raw := `{"workspace":"w","merge":"6666666666666666666666666666666666666666","trees":{".":{"tree":"named:aa","manifest":"` +
-		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"}}}}`
+		"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" + `","paths":{"src":"1111111111111111111111111111111111111111"},"packages":["git.novox.be/novox/mesh-sdk/go"]}}}`
 	if err := json.Unmarshal([]byte(raw), &f); err != nil {
 		t.Fatal(err)
 	}
 	pv, ok := PreviewOf(Pull{Repository: "novox/mesh-sdk", Head: "h", Trunk: "t"}, []Fetched{f})
-	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" {
+	if !ok || !reflect.DeepEqual(pv.Modules["."].Paths, map[string]string{"src": "1111111111111111111111111111111111111111"}) || pv.Modules["."].Tree != "named:aa" ||
+		!reflect.DeepEqual(pv.Modules["."].Packages, []string{"git.novox.be/novox/mesh-sdk/go"}) { // and the packages it uses (issue 1585)
 		t.Errorf("preview = %+v, want the module's named tree and its objects", pv)
 	}
 }

modules/mesh-delivery-checker/internal/check/results.go

@@ -22,6 +22,8 @@ type MergeTree struct {
 	// Paths are, of a module whose every artifact names its paths, each named path's object; Tree is then their named
 	// tree (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0499 clause 2).
 	Paths map[string]string `json:"paths,omitempty"`
+	// Packages are the mesh packages the directory's go.sum names (mesh-sdk buildstep.ModuleTree, novox/hq ADR 0573 §2).
+	Packages []string `json:"packages,omitempty"`
 }
 
 // UnmarshalJSON takes a string as the tree alone, or an object.

modules/mesh-delivery-checker/internal/check/testdata/captured/README

@@ -17,5 +17,3 @@ novox/mesh-delivery at main, and forge-compare-trunk.json the answer of gitea_co
 trunk: no commit main does not hold); both called through the mesh on 2026-10-21 for issue 1624. forge-compare-branch.json is the answer of the same call for a
 head that is not on the trunk (novox/mesh-sdk base main, head afbe371003a5, the branch feat/r4c5-sdk), shortened to two of its seven commits and one of its
 twenty-six files, with the head and the totals set to match.
-
-forge-commits.json is the answer of the forge's gitea_commits for novox/mesh-sdk, ref cb54756c3865, limit 1, called through the mesh on 2026-10-21 (review D2).

modules/mesh-delivery-checker/internal/check/testdata/captured/forge-commits.json

@@ -1,14 +0,0 @@
-{
-    "commits": [
-        {
-            "author": "mesh-tools",
-            "date": "2026-10-21T10:02:09Z",
-            "sha": "cb54756c3865df5ac9c0dc0481ad9ebe2bf013a1",
-            "subject": "Merge pull request 'Give delivery.Module the toolchains its fingerprint was computed with, and '.' as a root module's path, so the builder builds a key only with its own toolchain (issue 1615)' (#55) from fix/1615-module-toolchains-root into main"
-        }
-    ],
-    "more": true,
-    "page": 1,
-    "ref": "cb54756c3865",
-    "repository": "novox/mesh-sdk"
-}

modules/mesh-delivery-checker/manifest_test.go

@@ -103,7 +103,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	}
 	if want := []string{"mesh-build-go.steps", "mesh-build-go.toolchains", "mesh-build-node.steps", "mesh-build-node.toolchains",
 		"mesh-delivery-assigner.compositions", "mesh-delivery-assigner.placement", "mesh-delivery-builder.builds", "mesh-delivery-gate.source", "mesh-delivery-gate.turns", "mesh-delivery-indexer.candidates",
-		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
+		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-indexer.predefined", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
 	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no

modules/mesh-delivery-checker/module.json

@@ -42,6 +42,7 @@
     "mesh-delivery-indexer.candidates",
     "mesh-delivery-indexer.manifests",
     "mesh-delivery-indexer.modules",
+    "mesh-delivery-indexer.predefined",
     "mesh-delivery-watchman.presence",
     "node-engine.have"
   ],

modules/mesh-delivery-forge-bridge/cmd/mesh-delivery-forge-bridge/integration_test.go

@@ -423,7 +423,9 @@ func TestBridgeWritesMergedMessage(t *testing.T) { // 1236/AC4, 1448/AC5
 	want := delivery.Forge{V: delivery.Version, Kind: "merged", Repository: "novox/mesh-delivery", Branch: "feat/x", Number: 12, Head: head,
 		Merge: merge, Root: "r0", Trees: map[string]string{"": "t0", "modules/a": "t1"},
 		Manifests: map[string]string{"": string(manifest), "modules/a": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}}}
+		Locks:     map[string]map[string]string{"modules/a": {"go.sum": hex.EncodeToString(sha256Sum(sum))}},
+		// The mesh packages its go.sum names (ADR 0573 §2, issue 1585): this module's own go.sum names mesh-sdk.
+		Packages: map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}}
 	if !delivery.SameForge(f, want) {
 		t.Errorf("message = %+v, want %+v", f, want)
 	}

modules/mesh-delivery-forge-bridge/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-forge-bridge
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-forge-bridge/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2 h1:RF73nVI1dTrrmlFosVDTMJmpUQ+rEeB7++BHH/RvZFg=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030201806-eff81f1220e2/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-forge-bridge/internal/bridge/bridge.go

@@ -151,7 +151,7 @@ func ConvertKept(subject string, data []byte, trees Trees, files Files, kept Kep
 	if action == delivery.PullUpdated && p.ModuleDirsSaid {
 		f.Dirs, f.DirsKnown = p.ModuleDirs, true
 		var err error
-		if f.Manifests, f.Locks, err = inputsOf(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
+		if f.Manifests, f.Locks, f.Packages, _, err = inputsRead(p.Owner, p.Repo, p.HeadSHA, p.ModuleDirs, files); err != nil {
 			return Message{}, fmt.Errorf("%w: %s: the manifests of %s/%s at the head %s: %v", ErrRetry, subject, p.Owner, p.Repo, p.HeadSHA, err)
 		}
 	}
@@ -190,14 +190,15 @@ type read struct {
 // order the calls finish in, and the error is that of the first failing file in the order of dirs and LockFiles. After
 // a failure no further file is asked for, and inputsOf returns only when every call it started has returned.
 func inputsOf(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, err error) {
-	manifests, locks, _, err = inputsRead(owner, repo, ref, dirs, files)
+	manifests, locks, _, _, err = inputsRead(owner, repo, ref, dirs, files)
 	return manifests, locks, err
 }
 
-// inputsRead is inputsOf, and also answers, on a failure too, the directories whose manifest and lock files were all
-// read, with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest
-// (issue 1126).
-func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, whole []string, err error) {
+// inputsRead is inputsOf, and also answers the mesh packages each directory's go.sum names (delivery.MeshPackagesOf,
+// novox/hq ADR 0573 §2; issue 1585) and, on a failure too, the directories whose manifest and lock files were all read,
+// with their manifests and lock hashes: a merge keeps them by their tree, so its next try reads only the rest (issue
+// 1126).
+func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, whole []string, err error) {
 	at := func(dir, name string) string {
 		if dir == "" {
 			return name
@@ -241,6 +242,7 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	wg.Wait()
 	manifests = map[string]string{}
 	locks = map[string]map[string]string{}
+	packages = map[string][]string{}
 	broken := map[string]bool{} // a directory with a file not read (failed, or never asked after a failure)
 	for _, r := range reads {
 		switch {
@@ -260,6 +262,11 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 				locks[r.dir] = map[string]string{}
 			}
 			locks[r.dir][path.Base(r.path)] = hex.EncodeToString(sum[:])
+			if path.Base(r.path) == "go.sum" {
+				if p := delivery.MeshPackagesOf(r.raw); len(p) > 0 {
+					packages[r.dir] = p
+				}
+			}
 		}
 	}
 	for _, dir := range dirs {
@@ -271,8 +278,9 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 		for dir := range broken {
 			delete(manifests, dir)
 			delete(locks, dir)
+			delete(packages, dir)
 		}
-		return manifests, locks, whole, err
+		return manifests, locks, packages, whole, err
 	}
 	if len(manifests) == 0 {
 		manifests = nil
@@ -280,7 +288,10 @@ func inputsRead(owner, repo, ref string, dirs []string, files Files) (manifests
 	if len(locks) == 0 {
 		locks = nil
 	}
-	return manifests, locks, whole, nil
+	if len(packages) == 0 {
+		packages = nil
+	}
+	return manifests, locks, packages, whole, nil
 }
 
 // merged is the merged message of a merge into the trunk: the trees of the merge commit, asked once.
@@ -301,15 +312,19 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		names = append(names, dir)
 	}
 	slices.Sort(names)
-	manifests, locks, toRead := keptInputs(names, dirs, kept)
-	read, readLocks, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
+	manifests, locks, packages, toRead := keptInputs(names, dirs, kept)
+	read, readLocks, readPackages, whole, err := inputsRead(p.Owner, p.Repo, p.MergeSHA, toRead, files)
 	if err != nil {
-		keep(whole, dirs, read, readLocks, kept) // what was read whole is not asked again at the next try
+		keep(whole, dirs, read, readLocks, readPackages, kept) // what was read whole is not asked again at the next try
 		return Message{}, fmt.Errorf("%w: %s: the manifests of %s at the merge commit %s (%d of %d module directories read from the forge, the others kept by their tree): %v", ErrRetry, subject, repository, p.MergeSHA, len(toRead), len(names), err)
 	}
-	keep(toRead, dirs, read, readLocks, kept)
+	keep(toRead, dirs, read, readLocks, readPackages, kept)
 	maps.Copy(manifests, read)
 	maps.Copy(locks, readLocks)
+	maps.Copy(packages, readPackages)
+	if len(packages) == 0 {
+		packages = nil
+	}
 	if len(manifests) == 0 {
 		manifests = nil
 	}
@@ -321,7 +336,7 @@ func merged(subject string, p pull, trees Trees, files Files, kept Kept) (Messag
 		return Message{}, unreadable(subject, "%v", err)
 	}
 	f := delivery.Forge{Kind: delivery.ForgeMerged, Repository: repository, Branch: p.Head, Number: p.Number,
-		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks}
+		Head: p.HeadSHA, Merge: p.MergeSHA, Root: root, Trees: dirs, Manifests: manifests, Locks: locks, Packages: packages}
 	if repository == CatalogRepository {
 		// The catalogue's predefined list at the merge (novox/hq ADR 0565 §2): the indexer keeps it for mesh-config.
 		raw, err := files(p.Owner, p.Repo, PredefinedFile, p.MergeSHA)

modules/mesh-delivery-forge-bridge/internal/bridge/files_test.go

@@ -79,6 +79,10 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 	if want := map[string]map[string]string{"modules/a": {"go.sum": hexSum(sum)}}; !reflect.DeepEqual(f.Locks, want) {
 		t.Errorf("locks = %v, want %v", f.Locks, want)
 	}
+	// Issue 1585 (ADR 0573 §2): and the mesh packages each go.sum names.
+	if want := map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}; !reflect.DeepEqual(f.Packages, want) {
+		t.Errorf("packages = %v, want %v", f.Packages, want)
+	}
 	// ADR 0567: placement is the seat mesh-placement's: a merge of the catalogue carries no placement file and asks the
 	// forge for none.
 	forge.calls = nil
@@ -124,14 +128,15 @@ func TestMergedCarriesManifestsAndLocks(t *testing.T) { // 1448/AC1
 
 func TestPullWithKnownDirsCarriesTheSameAtTheHead(t *testing.T) { // 1448/AC2
 	manifest := real(t, "module.json")
-	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest}}
+	forge := &forgeFiles{have: map[string][]byte{"modules/a/module.json": manifest, "modules/a/go.sum": []byte("git.novox.be/novox/mesh-sdk/go v0.1.7 h1:x=\n")}}
 	msg, err := Convert(updatedSubject, updated(nil), nil, forge.get)
 	if err != nil {
 		t.Fatal(err)
 	}
 	f, _ := delivery.DecodeForge(msg.Data)
-	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 0 {
-		t.Errorf("manifests %v locks %v", f.Manifests, f.Locks)
+	if !reflect.DeepEqual(f.Manifests, map[string]string{"modules/a": string(manifest)}) || len(f.Locks) != 1 ||
+		!reflect.DeepEqual(f.Packages, map[string][]string{"modules/a": {"git.novox.be/novox/mesh-sdk/go"}}) {
+		t.Errorf("manifests %v locks %v packages %v", f.Manifests, f.Locks, f.Packages)
 	}
 	if len(forge.calls) == 0 || forge.calls[0].ref != head {
 		t.Errorf("calls %v, want the head %s", forge.calls, head)
@@ -389,4 +394,14 @@ func mergeReadsOnlyChangedDirs(t *testing.T) {
 	if len(failing.calls) != 3 {
 		t.Errorf("the try after a failure read %d files, want only modules/b's 3", len(failing.calls))
 	}
+	// Issue 1585: inputs kept before the bridge read the packages are read again, so no module loses the packages it uses.
+	for tree, in := range kept2 {
+		in.Packages, in.PackagesRead = nil, false
+		kept2[tree] = in
+	}
+	failing.calls = nil
+	again, err = ConvertKept(mergedSubject, mergedBody(nil), treesOf(&calls, "r1", trees, nil), failing.get, kept2)
+	if err != nil || string(again.Data) != string(whole.Data) || len(failing.calls) != 6 {
+		t.Errorf("inputs kept without their packages: %d files read, want 6; same message: %v (%v)", len(failing.calls), string(again.Data) == string(whole.Data), err)
+	}
 }

modules/mesh-delivery-forge-bridge/internal/bridge/kept.go

@@ -7,11 +7,14 @@ package bridge
 // every byte under it, so the manifest and the lock-file hashes read once at a tree hash are those of every later commit
 // whose directory has the same tree: a merge reads the forge only for the directories it changed.
 
-// Inputs is what the bridge read of one module directory at one tree hash: its manifest and its lock files' hex sha256
-// by name (none when it has none).
+// Inputs is what the bridge read of one module directory at one tree hash: its manifest, its lock files' hex sha256
+// by name (none when it has none) and the mesh packages its go.sum names (novox/hq ADR 0573 §2). PackagesRead says the
+// packages were read: a value kept before the bridge read them is not taken, since its packages are not known.
 type Inputs struct {
-	Manifest string            `json:"manifest"`
-	Locks    map[string]string `json:"locks,omitempty"`
+	Manifest     string            `json:"manifest"`
+	Locks        map[string]string `json:"locks,omitempty"`
+	Packages     []string          `json:"packages,omitempty"`
+	PackagesRead bool              `json:"packages-read,omitempty"`
 }
 
 // Kept holds Inputs by a directory's git tree hash (the bridge's state bucket inputs). Get answers false for a tree it
@@ -22,8 +25,8 @@ type Kept interface {
 }
 
 // keptInputs splits dirs into the inputs kept for their tree hash and the directories still to read from the forge.
-func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests map[string]string, locks map[string]map[string]string, read []string) {
-	manifests, locks = map[string]string{}, map[string]map[string]string{}
+func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, read []string) {
+	manifests, locks, packages = map[string]string{}, map[string]map[string]string{}, map[string][]string{}
 	for _, dir := range dirs {
 		tree := trees[dir]
 		if kept == nil || tree == "" {
@@ -31,7 +34,7 @@ func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests ma
 			continue
 		}
 		in, ok := kept.Get(tree)
-		if !ok {
+		if !ok || !in.PackagesRead {
 			read = append(read, dir)
 			continue
 		}
@@ -39,19 +42,22 @@ func keptInputs(dirs []string, trees map[string]string, kept Kept) (manifests ma
 		if len(in.Locks) > 0 {
 			locks[dir] = in.Locks
 		}
+		if len(in.Packages) > 0 {
+			packages[dir] = in.Packages
+		}
 	}
-	return manifests, locks, read
+	return manifests, locks, packages, read
 }
 
 // keep puts what was read of each directory under its tree hash.
-func keep(dirs []string, trees map[string]string, manifests map[string]string, locks map[string]map[string]string, kept Kept) {
+func keep(dirs []string, trees map[string]string, manifests map[string]string, locks map[string]map[string]string, packages map[string][]string, kept Kept) {
 	if kept == nil {
 		return
 	}
 	for _, dir := range dirs {
 		raw, ok := manifests[dir]
 		if tree := trees[dir]; ok && tree != "" {
-			kept.Put(tree, Inputs{Manifest: raw, Locks: locks[dir]})
+			kept.Put(tree, Inputs{Manifest: raw, Locks: locks[dir], Packages: packages[dir], PackagesRead: true})
 		}
 	}
 }

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/integration_test.go

@@ -4,6 +4,9 @@ package main
 
 import (
 	"context"
+	"crypto/ecdh"
+	"crypto/rand"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -20,6 +23,8 @@ import (
 	"github.com/nats-io/nats.go/jetstream"
 
 	"git.novox.be/novox/mesh-sdk/go/buscompose"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/process"
 )
@@ -229,7 +234,12 @@ func TestIndexerWritesModulesAtAMerge(t *testing.T) { // 1239/AC9; I1, I3: the m
 // TestIndexerKeepsManifestsAtAMerge: a merged message of mesh-catalog carrying the real manifest of the module avahi and the
 // hash of its go.sum (the bridge's Manifests and Locks, issue 1448) makes, within 5 s, modules.avahi with its manifest digest,
 // its inputs and the reason it has no fingerprint of the new form, and manifests.<digest> with the manifest byte for byte.
-func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
+//
+// And it judges them (novox/hq ADR 0578, issue 1585): with three manifests more, one valid, one refused and one with a
+// field the decoder does not know, mesh-sdk's bus reader read before the indexer judged composes all three, the field set
+// aside and named (a missing verdict is accepted, §3); the indexer writes the three verdicts, says manifest-refused for
+// each refusal, and the reader then composes the valid one and holds the others, named, never ending its read.
+func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4, 1585
 	// The manifest is avahi's module.json from mesh-catalog at a67f01963f0d9ef0913a63720b89e573ca7a16ef (copied into the
 	// index package's testdata); the lock hash is the sha256 of modules/avahi/go.sum there.
 	manifest, err := os.ReadFile("../../internal/index/testdata/catalogue-a67f0196-avahi.module.json")
@@ -237,14 +247,31 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
 		t.Fatal(err)
 	}
 	const goSum = "3b5028f0c1e9bde04dd766abd63eb5931bc516bae695cf46f00abcd8510b0381"
+	judged := map[string]string{
+		"good":  `{"module":"good","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/good","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
+		"bad":   `{"module":"bad","version":"1","provides":[{"name":"amqp"}],"resources":[{"id":"d","type":"directory","path":"/srv/bad","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
+		"later": `{"module":"later","version":"1","a-field-from-later":1,"resources":[{"id":"d","type":"directory","path":"/srv/later","mode":"0700"}],"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`,
+	}
 	js, ctx, _, modules := startIndexer(t, func(ctx context.Context, builds buildLog) {
 		builds.end(t, "novox/mesh-catalog", "avahi", "modules/avahi")
+	}, func(ctx context.Context, js jetstream.JetStream) {
+		// The verdicts state and the stream of the indexer's events, as the controller makes them from its manifest.
+		if _, err := js.CreateKeyValue(ctx, jetstream.KeyValueConfig{Bucket: delivery.VerdictsBucket, History: delivery.VerdictsHistory}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := js.CreateStream(ctx, jetstream.StreamConfig{Name: "INDEXER_EVENTS", Subjects: []string{"mesh.mod.mesh-delivery-indexer.event.>"}}); err != nil {
+			t.Fatal(err)
+		}
 	})
-	data, err := delivery.EncodeForge(delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
+	forge := delivery.Forge{Kind: delivery.ForgeMerged, Repository: "novox/mesh-catalog", Branch: "feat/x", Number: 301,
 		Head: "0123456789abcdef0123456789abcdef01234567", Merge: "89abcdef0123456789abcdef0123456789abcdef", Root: "r0",
 		Trees:     map[string]string{"modules/avahi": "newtree"},
 		Manifests: map[string]string{"modules/avahi": string(manifest)},
-		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}})
+		Locks:     map[string]map[string]string{"modules/avahi": {"go.sum": goSum}}}
+	for name, raw := range judged {
+		forge.Manifests["modules/"+name], forge.Trees["modules/"+name] = raw, "tree-"+name
+	}
+	data, err := delivery.EncodeForge(forge)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -275,6 +302,156 @@ func TestIndexerKeepsManifestsAtAMerge(t *testing.T) { // 1444/AC4, 1449/AC4
 	if got, err := delivery.DecodeManifest(e.Value()); err != nil || got.Module != "avahi" || got.JSON != string(manifest) {
 		t.Errorf("manifest = %+v err %v, want avahi and the file's bytes", got, err)
 	}
+
+	verdicts, err := js.KeyValue(ctx, delivery.VerdictsBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]string{"good": delivery.VerdictAccepted, "bad": delivery.VerdictRefused, "later": delivery.VerdictRefused}
+	got := map[string]delivery.ManifestVerdict{}
+	for deadline := time.Now().Add(10 * time.Second); time.Now().Before(deadline) && len(got) < len(want); time.Sleep(50 * time.Millisecond) {
+		for name := range want {
+			if e, err := verdicts.Get(ctx, delivery.ManifestDigest([]byte(judged[name]))); err == nil {
+				if v, err := delivery.DecodeManifestVerdict(e.Value()); err == nil {
+					got[name] = v
+				}
+			}
+		}
+	}
+	for name, state := range want {
+		if v := got[name]; v.State != state || v.Module != name || !strings.HasPrefix(v.Judge, "exe:") {
+			t.Errorf("the verdict on %s = %+v within 10 s, want %s by the running judge", name, v, state)
+		}
+	}
+	if !strings.Contains(strings.Join(got["bad"].Problems, " "), `provides "amqp"`) || !strings.Contains(strings.Join(got["later"].Problems, " "), "a-field-from-later") {
+		t.Errorf("the refusals name no problem: %+v", got)
+	}
+	// manifest-refused, said once for each refusal.
+	events, err := js.Stream(ctx, "INDEXER_EVENTS")
+	if err != nil {
+		t.Fatal(err)
+	}
+	said := map[string]bool{}
+	for seq := uint64(1); ; seq++ {
+		msg, err := events.GetMsg(ctx, seq)
+		if err != nil {
+			break
+		}
+		var r delivery.ManifestRefused
+		if msg.Subject == "mesh.mod.mesh-delivery-indexer.event."+delivery.ManifestRefusedEvent && json.Unmarshal(msg.Data, &r) == nil {
+			said[r.Module] = true
+		}
+	}
+	if !said["bad"] || !said["later"] || said["good"] {
+		t.Errorf("manifest-refused said for %v, want bad and later", said)
+	}
+	// mesh-sdk's bus reader over the indexer's modules and manifests: the refused modules held and named, the valid one
+	// composed, the read whole.
+	r := judgedReader{ctx: ctx, js: js, t: t}
+	items, _, held, err := frombus.DataItemsHeld(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
+	if err != nil || len(items["good"]) != 1 || items["bad"] != nil || items["later"] != nil ||
+		!strings.Contains(held["bad"], `provides "amqp"`) || !strings.Contains(held["later"], "a-field-from-later") {
+		t.Errorf("the bus reader after the judge: items %v held %v: %v", items, held, err)
+	}
+	// Before any verdict (a value without one, as an older indexer wrote it), the reader takes each as accepted and names
+	// the field it set aside.
+	for _, name := range []string{"bad", "later"} {
+		e, err := modules.Get(ctx, name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		m, _ := delivery.DecodeModule(e.Value())
+		m.Verdict, m.Problems = "", nil
+		raw, _ := delivery.EncodeModule(m)
+		r.unjudged = append(r.unjudged, raw)
+		if r.values == nil {
+			r.values = map[string][]byte{}
+		}
+		r.values[name] = raw
+	}
+	in, err := frombus.Input(ctx, r, frombus.Mesh{}, frombus.Scope{Node: "n1"})
+	if err != nil || len(in.Refused) != 0 || !strings.Contains(in.SetAside["later"], "a-field-from-later") || in.Catalogue["later"].Stubbed {
+		t.Errorf("the bus reader before the judge: refused %v, set aside %v: %v", in.Refused, in.SetAside, err)
+	}
+}
+
+// judgedReader is mesh-sdk's bus reader over the indexer's modules and manifests on the bus, with good, bad and later placed
+// on n1 and n1's record; values stand in for a module's value where set. It reads nothing else.
+type judgedReader struct {
+	ctx      context.Context
+	js       jetstream.JetStream
+	t        *testing.T
+	values   map[string][]byte
+	unjudged [][]byte
+}
+
+func (r judgedReader) Placements(context.Context) (map[string]delivery.Placement, error) {
+	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
+	for _, m := range []string{"good", "bad", "later"} {
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+	}
+	return map[string]delivery.Placement{"n1": p}, nil
+}
+
+func (r judgedReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
+	k, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: base64.StdEncoding.EncodeToString(k.PublicKey().Bytes()),
+		SealingKey: "sk", Capabilities: []string{"systemd"}}}, nil
+}
+
+func (r judgedReader) Modules(ctx context.Context) (map[string]delivery.Module, error) {
+	kv, err := r.js.KeyValue(ctx, delivery.ModulesBucket)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]delivery.Module{}
+	for _, name := range []string{"good", "bad", "later"} {
+		e, err := kv.Get(ctx, name)
+		if err != nil {
+			return nil, err
+		}
+		raw := e.Value()
+		if v, ok := r.values[name]; ok {
+			raw = v
+		}
+		m, err := delivery.DecodeModule(raw)
+		if err != nil {
+			return nil, err
+		}
+		out[name] = m
+	}
+	return out, nil
+}
+
+func (r judgedReader) Manifest(ctx context.Context, digest string) ([]byte, error) {
+	kv, err := r.js.KeyValue(ctx, delivery.ManifestsBucket)
+	if err != nil {
+		return nil, err
+	}
+	e, err := kv.Get(ctx, digest)
+	if err != nil {
+		return nil, err
+	}
+	m, err := delivery.DecodeManifest(e.Value())
+	return []byte(m.JSON), err
+}
+
+func (judgedReader) Values(context.Context, string, string) (map[string]any, error) { return nil, nil }
+func (judgedReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
+	return nil, nil
+}
+func (judgedReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+	return nil, nil, nil
+}
+func (judgedReader) Build(context.Context, string, string) (*delivery.BuilderBuild, error) {
+	return nil, nil
+}
+func (judgedReader) Archive(context.Context, string, string) ([]byte, error) { return nil, nil }
+func (judgedReader) Served(context.Context, string, string, []string) (map[string]any, error) {
+	return nil, nil
 }
 
 // TestIndexerWritesAGoModuleAgainWhenTheBuildModuleReportsItsToolchain: the bucket mesh-build-go_toolchains exists (the state

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/main.go

@@ -291,7 +291,10 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 		return err
 	}
 	defer calls.Close()
+	// The verdicts on manifests (ADR 0578 §1): a state this delivery brings, bound when it appears.
+	verdicts := process.AwaitBucket(ctx, js, conn, index.VerdictsBucket, "no verdict on a manifest is written", logger.Printf)
 	ix := &index.Indexer{Store: kvStore{candidates}, Modules: kvStore{modules}, Manifests: kvStore{manifests}, Taken: awaitedStore{taken}, Builds: known,
+		Verdicts: awaitedStore{verdicts}, SayRefused: sayRefused(js, cred, logger.Printf),
 		Predefined: awaitedStore{predefined}, ConfigCandidates: awaitedStore{configCandidates}, Logf: logger.Printf,
 		Named: namedVia(calls.Call), Trunk: trunkVia(calls.Call), Contains: containsVia(calls.Call), Read: readVia(calls.Call),
 		ReadOpen: openVia(calls.Call)}
@@ -385,6 +388,19 @@ func run(ctx context.Context, getenv func(string) string, logOut io.Writer) erro
 	if err := ix.Reconcile(ctx); err != nil {
 		logger.Printf("dropping the modules the trunk does not hold at start: %v", err)
 	}
+	// Every manifest judged at the start, so a judge that changed with this program judges every one again (ADR 0578
+	// §1), once the verdicts state is there; each merge judges them again (index.ApplyMessage).
+	verdicts.Ready(func(jetstream.KeyValue) {
+		// A pass that fails (a read the bus did not answer) is judged again at the next message or source revision the
+		// indexer hears (index.kickJudge): no timer.
+		j, err := ix.JudgeAtStart(ctx)
+		if err != nil {
+			logger.Printf("judging the manifests at start: %v; judged again at the next message heard", err)
+			return
+		}
+		logger.Printf("judged %d manifests at start: %d verdicts written, %d with problems, of which outgrown and kept accepted: %v",
+			j.Judged, j.Written, len(j.Refused), j.Outgrown)
+	})
 	// A build module says each time it wrote its toolchains key: its stream, and the indexer's durable consumer on it, are
 	// made by the controller as the forge's are. Where the stream is not there yet the indexer says so and is started again
 	// with the build module, as with the gate's source.

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/named.go

@@ -165,6 +165,14 @@ func readVia(call toolCaller) func(ctx context.Context, repository, sha, dir str
 					out.Locks[dir] = map[string]string{}
 				}
 				out.Locks[dir][name] = hex.EncodeToString(sum[:])
+				if name == "go.sum" {
+					if p := delivery.MeshPackagesOf([]byte(c)); len(p) > 0 {
+						if out.Packages == nil {
+							out.Packages = map[string][]string{}
+						}
+						out.Packages[dir] = p // the mesh packages it uses, as the bridge reads them (ADR 0573 §2)
+					}
+				}
 			}
 		}
 		return out, nil

modules/mesh-delivery-indexer/cmd/mesh-delivery-indexer/verdicts.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/process"
+	"github.com/nats-io/nats.go"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// sayRefused says the indexer's event manifest-refused (novox/hq ADR 0578 §1): mesh.mod.<module>.event.manifest-refused,
+// with the SDK's envelope headers and the digest and judge as the bus's dedup id, so one refusal is said once.
+func sayRefused(js jetstream.JetStream, cred process.Account, logf func(string, ...any)) func(context.Context, delivery.ManifestRefused) {
+	return func(ctx context.Context, r delivery.ManifestRefused) {
+		data, err := json.Marshal(r)
+		if err != nil {
+			logf("judge: %s for %s is not said: %v", delivery.ManifestRefusedEvent, r.Module, err)
+			return
+		}
+		msg := nats.NewMsg(cred.EventSubject(delivery.ManifestRefusedEvent))
+		id := "manifest-refused-" + r.Digest + "-" + r.Judge
+		msg.Header.Set("x-event-id", id)
+		msg.Header.Set("x-source", cred.Module)
+		msg.Header.Set("x-node", cred.Node)
+		msg.Header.Set("x-time", time.Now().UTC().Format(time.RFC3339Nano))
+		msg.Header.Set("content-type", "application/json")
+		msg.Data = data
+		pub, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+		defer cancel()
+		if _, err := js.PublishMsg(pub, msg, jetstream.WithMsgID(id)); err != nil {
+			logf("judge: %s", fmt.Errorf("saying %s for %s: %w", delivery.ManifestRefusedEvent, r.Module, err))
+		}
+	}
+}

modules/mesh-delivery-indexer/cmd/mesh-judge/main.go

@@ -0,0 +1,61 @@
+// Command mesh-judge is the indexer's judge as a program the checker runs (novox/hq ADR 0578 §2): built at the trunk, or
+// at a group's mesh-delivery head when that head changes the judge, and run by a Go build module's compose step in its
+// sandbox exactly as the composer is (ADR 0482 §4; delivery.ComposeJob with this package). It reads a composer request
+// (mesh-sdk composer.Request; `-request <file>`, or its standard input) and writes one line, a composer verdict, whose
+// cases say of each manifest whether the judge accepts it and, when not, every problem. It reads nothing else: no bus,
+// store, network or environment.
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+
+	"git.novox.be/novox/mesh-sdk/go/composer"
+
+	"mesh-delivery-indexer/judge"
+)
+
+// Package is this command's import path in the indexer's Go module (the directory delivery.ComposeJob's Dir names).
+const Package = "mesh-delivery-indexer/cmd/mesh-judge"
+
+func main() { os.Exit(run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr)) }
+
+func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+	flags := flag.NewFlagSet("mesh-judge", flag.ContinueOnError)
+	flags.SetOutput(stderr)
+	file := flags.String("request", "", "the request's file; without it, the standard input")
+	if err := flags.Parse(args); err != nil {
+		return 2
+	}
+	var raw []byte
+	var err error
+	if *file != "" {
+		raw, err = os.ReadFile(*file)
+	} else {
+		raw, err = io.ReadAll(stdin)
+	}
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-judge:", err)
+		return 1
+	}
+	r, err := composer.Decode(raw)
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-judge:", err)
+		return 1
+	}
+	v, err := judge.Request(r)
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-judge:", err)
+		return 1
+	}
+	out, err := json.Marshal(v)
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-judge:", err)
+		return 1
+	}
+	fmt.Fprintln(stdout, string(out))
+	return 0
+}

modules/mesh-delivery-indexer/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-indexer/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a h1:DcSvfEmdPBKqCg5OmXRNb269EkkPe7BsEp+RykEhkgE=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261031084708-acbf80ad910a/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915 h1:x8k7IeMirMTxUo8BH+xUO+MDnHYgU+636jl1NIw1wvs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261101022206-8af6e7266915/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-indexer/internal/beside/beside.go

@@ -0,0 +1,148 @@
+// Package beside is where a test finds another repository of the mesh it reads: the catalogue's manifests,
+// the node-engine's genesis template (novox/hq issue 432), the SDK's conformance fixtures (issue 449).
+//
+// Copied from mesh-controller internal/beside at commit 6c2a8d62 (R4b, issue 1379); the one change is that Dir
+// lays out the captured copy of a repository once per process, not once per test (see laidOut). In mesh-sdk the
+// catalogue's tests read mesh-catalog and mesh-host only; the captured copy holds just what they read.
+//
+// A test used to read the checkout beside this one, `../../../mesh-catalog`, so its verdict depended on
+// whatever sat on the machine running it: a stale or dirty checkout failed it on a desktop, and where none
+// was beside it skipped and said nothing. Now there are two inputs, both named, and no third:
+//
+//   - In a merge check, the build seat clones each core repository beside the one checked (the catalogue
+//     at its main, the node-engine at the commit the mesh runs) and says where in MESH_CHECK_BESIDE. A
+//     test judges against those clones, so agreement with the other repository is checked where
+//     `mesh/repo-check` runs; a repository missing there fails the test, never skips it. Which clones a
+//     check gets is chosen from the inventory: mesh-catalog by the source of the `nats` module, mesh-host
+//     by the source of `mesh-host`, and mesh-sdk as the controller's sibling at the commit the controller's
+//     go.mod pins. Each repository's tests read these siblings, and the checker places exactly these
+//     (mesh-delivery's checker, besideRules, follows this list): mesh-controller's read mesh-catalog,
+//     mesh-host and mesh-sdk; mesh-host's read mesh-catalog, mesh-sdk and mesh-controller (its step-nine
+//     test reads the controller's own manifest, novox/hq issue 1295); mesh-sdk's read mesh-catalog and
+//     mesh-host; mesh-catalog's read mesh-sdk and mesh-controller; mesh-delivery's read mesh-sdk and
+//     mesh-catalog. In a mesh where either module has no source repository nothing is
+//     cloned, and these tests fail loudly with "not beside this check": a cause in the setup, not in the
+//     change. And in a delivery group that holds a mesh-catalog pull request, these tests read the
+//     catalogue's main, not the group's head.
+//   - Anywhere else, the test judges against the copy captured in this repository's testdata/beside, at the
+//     commit testdata/beside/CAPTURED names. Never against a developer's own checkout: to judge one, set
+//     MESH_CHECK_BESIDE to the directory holding it, as the check does.
+//
+// The captured manifests are named module.json.captured, and put back as module.json in a directory of
+// the test's own: a module.json anywhere in this repository is a module of it to the forge's announcer and
+// the planner, and a merge would build and register a hundred copies of the catalogue's.
+package beside
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// Env is where a merge check says the repositories cloned beside the one checked are (internal/builder's
+// EnvBeside, repeated here so a test does not import the builder).
+const Env = "MESH_CHECK_BESIDE"
+
+// CapturedSuffix is what a captured file's name carries that the repository's own does not.
+const CapturedSuffix = ".captured"
+
+// notPlaced are the repositories the checker places beside no mesh-delivery check (besideRules in
+// mesh-delivery-checker/internal/check/beside.go places mesh-sdk and the catalogue): a test reads them from the captured
+// copy even in a merge check, and says so (issue 1585). Every other sibling missing from a merge check fails the test.
+var notPlaced = map[string]bool{"mesh-host": true}
+
+// Dir is the named repository a test reads — the clone beside a merge check, or the captured copy — and
+// says which in the test's log.
+func Dir(t testing.TB, repository string) string {
+	t.Helper()
+	root := os.Getenv(Env)
+	if root != "" {
+		dir := filepath.Join(root, repository)
+		_, err := os.Stat(dir)
+		switch {
+		case err == nil:
+			t.Logf("judged against %s as cloned beside this check", dir)
+			return dir
+		case !notPlaced[repository]:
+			// A sibling the checker places that is missing is the checker's fault, never judged against a stale copy.
+			t.Fatalf("%s is not beside this check in %s=%s, so its agreement with this repository cannot be "+
+				"judged here: %v", repository, Env, root, err)
+		}
+	}
+	from := filepath.Join(Captured(), repository)
+	if _, err := os.Stat(from); err != nil {
+		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
+	}
+	if root != "" {
+		t.Logf("%s is not beside this check in %s=%s (the checker places it beside no mesh-delivery check): read from "+
+			"its captured copy", repository, Env, root)
+	}
+	dir, err := layOut(repository, from)
+	if err != nil {
+		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
+	}
+	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
+		"judges it against the repository's own clone", repository)
+	return dir
+}
+
+// laidOut is the captured copies already put back in place in this process, by repository. A copy is
+// read-only to every test, so it is laid out once per process and not once per test: with a copy per test
+// the catalogue's tests alone took 2.14 s, over mesh-sdk's unit bound of 2 s, and with one 0.81 s (measured
+// 2026-10-20). The directories are in the temp directory, which the system clears; a process cannot remove
+// them while another test may still read them.
+var (
+	laidOutMu sync.Mutex
+	laidOut   = map[string]string{}
+)
+
+func layOut(repository, from string) (string, error) {
+	laidOutMu.Lock()
+	defer laidOutMu.Unlock()
+	if dir, ok := laidOut[repository]; ok {
+		return dir, nil
+	}
+	root, err := os.MkdirTemp("", "beside-")
+	if err != nil {
+		return "", err
+	}
+	dir := filepath.Join(root, repository)
+	err = filepath.WalkDir(from, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		rel, _ := filepath.Rel(from, path)
+		into := filepath.Join(dir, strings.TrimSuffix(rel, CapturedSuffix))
+		if d.IsDir() {
+			return os.MkdirAll(into, 0o755)
+		}
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		return os.WriteFile(into, raw, 0o644)
+	})
+	if err != nil {
+		os.RemoveAll(root)
+		return "", err
+	}
+	laidOut[repository] = dir
+	return dir, nil
+}
+
+// Catalogue is the catalogue's modules directory, as Dir finds the catalogue.
+func Catalogue(t testing.TB) string {
+	t.Helper()
+	return filepath.Join(Dir(t, "mesh-catalog"), "modules")
+}
+
+// Captured is this repository's testdata/beside, found from this file rather than from the working
+// directory, so a test in any package reaches it.
+func Captured() string {
+	_, file, _, _ := runtime.Caller(0)
+	return filepath.Join(filepath.Dir(file), "..", "..", "testdata", "beside")
+}

modules/mesh-delivery-indexer/internal/index/candidates.go

@@ -52,6 +52,12 @@ type Indexer struct {
 	Predefined, ConfigCandidates Store
 	// Taken is the taken bucket: per repository the last merge taken in (taken.go, ADR 0556); nil writes none.
 	Taken Store
+	// Verdicts is the verdicts state (verdicts.go, novox/hq ADR 0578 §1); nil judges nothing.
+	Verdicts Store
+	// JudgeID names the judge a verdict says made it; empty is judge.Identity, the running program's.
+	JudgeID string
+	// SayRefused says the event manifest-refused for a refusal newly written; nil says nothing.
+	SayRefused func(ctx context.Context, r delivery.ManifestRefused)
 	// Now is the clock of a taken value; nil is time.Now.
 	Now    func() time.Time
 	Builds *Builds
@@ -72,19 +78,20 @@ type Indexer struct {
 	// closed message the indexer missed heals at the next one (issue 1126); nil asks none.
 	ReadOpen func(ctx context.Context) ([]delivery.OpenPull, error)
 
-	mu         sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
-	source     sourceNow
-	previews   map[string]delivery.Preview              // by previews key (previews.go)
-	toolchains map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
-	tried      map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
-	unread     map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
-	retrying   atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
-	retryAgain atomic.Bool                              // an event asked for one more RetryUnread after the running one
-	retryWG    sync.WaitGroup                           // the background RetryUnread, for tests to wait on
-	recompute  sync.Mutex                               // one Recompute at a time
-	untaken    map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
-	filling    atomic.Bool                              // a FillTaken runs in the background (KickFill)
-	fillAgain  atomic.Bool                              // a kick arrived while it ran
+	mu           sync.Mutex // guards source, toolchains and previews, which the watches and the forge messages all reach
+	source       sourceNow
+	previews     map[string]delivery.Preview              // by previews key (previews.go)
+	toolchains   map[string]map[string]delivery.Toolchain // language, then node (toolchains.go)
+	tried        map[string]bool                          // repository, commit and directory a registered module's manifest was tried at (registered.go)
+	unread       map[string]bool                          // registered modules whose last read the forge could not answer, read again by RetryUnread
+	retrying     atomic.Bool                              // a RetryUnread runs in the background (kickRetry)
+	retryAgain   atomic.Bool                              // an event asked for one more RetryUnread after the running one
+	retryWG      sync.WaitGroup                           // the background RetryUnread, for tests to wait on
+	recompute    sync.Mutex                               // one Recompute at a time
+	untaken      map[string]string                        // repository to the latest merge applied while the taken state was missing (taken.go)
+	filling      atomic.Bool                              // a FillTaken runs in the background (KickFill)
+	fillAgain    atomic.Bool                              // a kick arrived while it ran
+	judgePending atomic.Bool                              // the start's judge pass failed: judged again at the next message (verdicts.go)
 }
 
 func (ix *Indexer) logf(format string, args ...any) {
@@ -105,6 +112,7 @@ func (ix *Indexer) Apply(ctx context.Context, f delivery.Forge) error {
 // ApplyMessage is Apply, and answers which modules a merged message wrote and kept (for the indexer's heard state). Each
 // applied merged message is said in one line: its repository, commit and pull request, and the modules written.
 func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied, error) {
+	ix.kickJudge(ctx)
 	var applied Applied
 	if f.Kind == delivery.ForgeOpen {
 		return applied, ix.applyOpen(ctx, f)
@@ -131,6 +139,11 @@ func (ix *Indexer) ApplyMessage(ctx context.Context, f delivery.Forge) (Applied,
 			if err := ix.configCandidatesAfterMerge(ctx, f, writtenModules(w.written)); err != nil {
 				return applied, err
 			}
+			// Every manifest judged again: a rule between manifests can turn on the one this merge moved (ADR 0578 §1).
+			// What this take-in newly wrote is fresh: judged in full (ADR 0579 §1).
+			if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
+				ix.logf("judge: the manifests are not judged after %s#%d: %v", f.Repository, f.Number, err)
+			}
 		}
 		ix.kickRetry(ctx) // a registered module the forge could not read is read again on a merge, in the background (issue 1945)
 	}

modules/mesh-delivery-indexer/internal/index/inputs.go

@@ -9,6 +9,8 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-indexer/judge"
 )
 
 // The reasons a module has no fingerprint of the new form while the indexer writes none for any module (novox/hq
@@ -58,7 +60,7 @@ type baseFP func(module string) (fp, none string)
 // here, so a fingerprint is never given for a build that could not run. An archive, an image and an upstream resolve
 // nothing and have no toolchain. A base is a build.on entry that names a module.
 func inputsOf(module, raw, tree string, locks map[string]string, base baseFP) moduleInputs {
-	return inputsOfNamed(module, raw, tree, locks, nil, base)
+	return inputsOfNamed(module, raw, tree, locks, nil, nil, base)
 }
 
 // inputsOfNamed is inputsOf with the git object of each path the message names for the module's directory (delivery
@@ -66,8 +68,11 @@ func inputsOf(module, raw, tree string, locks map[string]string, base baseFP) mo
 // manifest, by mesh-sdk's one function (delivery.NamedTree), and keeps their objects, so a computation from kept inputs
 // gives the merge's value (novox/hq ADR 0499 clause 2); a message that does not carry the object of each such path gives it
 // none, naming the paths (clause 3). Every other module keeps its directory's tree, whatever objects are given.
-func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, base baseFP) moduleInputs {
-	m, err := catalogue.ParseManifestForInputs([]byte(raw))
+//
+// packages are the mesh packages of other repositories the module's go.sum names (novox/hq ADR 0573 §2): a module with a
+// Go artifact keeps them, and the fingerprint takes the latest published version of each (Recompute).
+func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, packages []string, base baseFP) moduleInputs {
+	m, err := judge.ForInputs([]byte(raw))
 	if err != nil {
 		return moduleInputs{None2: None2Unreadable + err.Error()}
 	}
@@ -133,6 +138,10 @@ func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, b
 			}
 		}
 	}
+	if usesGo(langs) && len(packages) > 0 {
+		kept.Packages = slices.Clone(packages)
+		sort.Strings(kept.Packages)
+	}
 	sort.Strings(kept.Bases)
 	sort.Strings(missing)
 	out := moduleInputs{Kept: &kept, ArtifactPaths: artifactPaths}
@@ -152,6 +161,17 @@ func inputsOfNamed(module, raw, tree string, locks, objects map[string]string, b
 	return out
 }
 
+// usesGo is whether an artifact is built with Go: only a Go build resolves a mesh package by the version the build asks
+// (novox/hq ADR 0573 §2); a Node package moves its dependents as a base (ADR 0498 §5).
+func usesGo(langs map[string]string) bool {
+	for _, l := range langs {
+		if l == "go" {
+			return true
+		}
+	}
+	return false
+}
+
 // languagesOf is the language of each artifact of the manifest that has a toolchain (a bundle or a package of go or
 // typescript), by artifact name: the artifacts a build module's toolchain enters the fingerprint of.
 func languagesOf(m catalogue.Manifest) map[string]string {

modules/mesh-delivery-indexer/internal/index/modules.go

@@ -7,8 +7,9 @@ import (
 	"slices"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-indexer/judge"
 )
 
 // applyMerged writes, for each module whose manifest the merged message carries (each directory of the merge commit that
@@ -85,12 +86,13 @@ func (ix *Indexer) applyManifests(ctx context.Context, f delivery.Forge, drop bo
 		if next.Manifest == "" {
 			next.None2 = "the manifest cannot be read: it cannot be kept as a value"
 		} else {
-			in := inputsOfNamed(name, raw, f.Trees[dir], f.Locks[dir], objects[dir], ix.baseFP(ctx))
+			packages := delivery.OtherPackages(f.Packages[dir], f.Repository) // its own repository's come with its tree
+			in := inputsOfNamed(name, raw, f.Trees[dir], f.Locks[dir], objects[dir], packages, ix.baseFP(ctx))
 			next.Inputs2, next.None2, next.ArtifactPaths = in.Kept, in.None2, in.ArtifactPaths
 			if in.Kept == nil && strings.HasPrefix(in.None2, None2Unreadable) {
 				// The manifest cannot be read by this SDK; the inputs the merge carried are kept all the same, so a later SDK
 				// that reads it judges the module again at start with no merge (issue 1923).
-				next.Inputs2 = unreadInputs(f.Trees[dir], f.Locks[dir], f.Paths[dir])
+				next.Inputs2 = unreadInputs(f.Trees[dir], f.Locks[dir], f.Paths[dir], packages)
 			}
 			if in.Kept == nil && namedErr[dir] != "" {
 				next.None2 = in.None2 + ": the forge could not say them: " + namedErr[dir]
@@ -153,7 +155,7 @@ func (ix *Indexer) namedObjects(ctx context.Context, f delivery.Forge) (map[stri
 	objects := map[string]map[string]string{}
 	need := map[string][]string{}
 	for dir, raw := range f.Manifests {
-		m, err := catalogue.ParseManifestForInputs([]byte(raw))
+		m, err := judge.ForInputs([]byte(raw))
 		if err != nil {
 			continue // inputsOfNamed says why
 		}
@@ -283,7 +285,7 @@ const None2Unreadable = "the manifest cannot be read: "
 // hashes by file name (the artifacts that own them are not known without the manifest) and the objects of the named
 // paths the message carried; nil when the message carried no tree. Judging the manifest again (rejudged) turns them into
 // the inputs of the module (issue 1923).
-func unreadInputs(tree string, locks, paths map[string]string) *delivery.KeptInputs2 {
+func unreadInputs(tree string, locks, paths map[string]string, packages []string) *delivery.KeptInputs2 {
 	if tree == "" {
 		return nil
 	}
@@ -294,5 +296,6 @@ func unreadInputs(tree string, locks, paths map[string]string) *delivery.KeptInp
 	if len(paths) > 0 {
 		in.Paths = maps.Clone(paths)
 	}
+	in.Packages = slices.Clone(packages)
 	return in
 }

modules/mesh-delivery-indexer/internal/index/named_test.go

@@ -63,7 +63,7 @@ func TestAMessageWithoutTheNamedPathsObjectsGivesTheModuleNoneNamingThem(t *test
 }
 
 func TestAModuleNamingNoPathsKeepsItsDirectorysTree(t *testing.T) { // I7, ADR 0499 clause 2: every other module is unchanged
-	in := inputsOfNamed("avahi", catalogueManifest(t, "avahi"), "avahitree", map[string]string{"go.sum": avahiGoSum}, map[string]string{"x": "1111111111111111111111111111111111111111"}, noBases)
+	in := inputsOfNamed("avahi", catalogueManifest(t, "avahi"), "avahitree", map[string]string{"go.sum": avahiGoSum}, map[string]string{"x": "1111111111111111111111111111111111111111"}, nil, noBases)
 	if in.Kept == nil || in.Kept.Tree != "avahitree" || in.Kept.Paths != nil {
 		t.Errorf("inputs = %+v, want the directory's tree and no paths", in.Kept)
 	}
@@ -79,10 +79,10 @@ func TestACandidatesModuleTakesTheNamedPathsObjectsFromThePreview(t *testing.T)
 	named, _ := delivery.NamedTree(digest, sdkObjects)
 	with := delivery.Preview{Modules: map[string]delivery.PreviewModule{".": {Tree: named, Manifest: digest, Paths: sdkObjects}}}
 	without := delivery.Preview{Modules: map[string]delivery.PreviewModule{".": {Tree: "roottree", Manifest: digest}}}
-	if got := ix.candidateModule(context.Background(), "mesh-sdk", ".", without); !strings.Contains(got.None2, "named paths") {
+	if got := ix.candidateModule(context.Background(), "mesh-sdk", ".", without, nil, nil); !strings.Contains(got.None2, "named paths") {
 		t.Errorf("without the objects: %+v, want none naming the named paths", got)
 	}
-	got := ix.candidateModule(context.Background(), "mesh-sdk", ".", with)
+	got := ix.candidateModule(context.Background(), "mesh-sdk", ".", with, nil, nil)
 	if strings.Contains(got.None2, "named paths") || got.Manifest != digest {
 		t.Errorf("with the objects: %+v, want them taken (none only for what else is missing)", got)
 	}

modules/mesh-delivery-indexer/internal/index/order.go

@@ -34,6 +34,16 @@ type mergeWrite struct {
 	late              string // the taken merge this one is older than, or ""
 	asked             string // the taken merge the order was asked against, or "" when none was asked
 	written           []string
+	// fresh are the manifest digests this take-in newly wrote: a new module's, or a changed one's (ADR 0579 §1).
+	fresh map[string]bool
+}
+
+// taken marks a digest this take-in newly wrote.
+func (w *mergeWrite) taken(digest string) {
+	if w.fresh == nil {
+		w.fresh = map[string]bool{}
+	}
+	w.fresh[digest] = true
 }
 
 func newMergeWrite(f delivery.Forge) *mergeWrite {

modules/mesh-delivery-indexer/internal/index/predefined_test.go

@@ -19,9 +19,7 @@ func TestAManifestFallingBackToAPredefinedKeyIsRead(t *testing.T) { // 1751
 			t.Errorf("%s: inputs = %+v, want the manifest read and its inputs kept", module, in)
 		}
 	}
-}
-
-func TestAPredefinedKeyOfAnotherTypeThanItsValueIsStillRefused(t *testing.T) { // 1751: the read judges what it can
+	// A predefined key of another type than its value is still refused: the read judges what it can.
 	raw := strings.Replace(fixture(t, "catalogue-835bf22b-xterm"), `"predefined": "font-size"`, `"predefined": "font-size", "trusted": "yes"`, 1)
 	if in := inputsOf("xterm", raw, "newtree", nil, func(string) (string, string) { return "", "none" }); in.Kept != nil {
 		t.Errorf("inputs = %+v, want a manifest the catalogue refuses still refused", in)

modules/mesh-delivery-indexer/internal/index/previews.go

@@ -147,6 +147,14 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 	rev, heads := ix.source.rev, ix.source.heads
 	ix.mu.Unlock()
 	changed, read := false, false
+	// A package one of the candidate's pull requests publishes is built at that pull request's head, every other at its
+	// latest published version (novox/hq ADR 0573 §4): a group's members build against the group's own package.
+	members := map[string]string{}
+	for _, p := range c.Pulls {
+		members[delivery.RepositoryName(p.Repository)] = p.Head.Head
+	}
+	var held map[string]delivery.Module
+	listed := false
 	for i := range c.Pulls {
 		p := &c.Pulls[i]
 		pv, found, stale := ix.previewOf(heads, p.Repository, p.Head.Head)
@@ -154,17 +162,20 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 			continue
 		}
 		read = true
+		if !listed {
+			var err error
+			if held, err = ix.heldModules(ctx); err != nil {
+				ix.logf("the modules cannot be listed, so no touched module's directory or package version is known: %v", err)
+			}
+			listed = true
+		}
 		// A touched module's directory: the one the modules bucket holds of the repository, else the preview's directory
 		// whose manifest is the one the pull request gave the module (a module the pull request adds; ADR 0501 clause 6).
 		dirs := map[string]string{}
-		if held, err := ix.heldModules(ctx); err == nil {
-			for name, m := range held {
-				if delivery.SameRepository(m.Repository, p.Repository) && m.Path != "" {
-					dirs[name] = m.Path
-				}
+		for name, m := range held {
+			if delivery.SameRepository(m.Repository, p.Repository) && m.Path != "" {
+				dirs[name] = m.Path
 			}
-		} else {
-			ix.logf("the modules cannot be listed, so no touched module's directory is known: %v", err)
 		}
 		for _, m := range p.Modules {
 			if _, known := dirs[m]; known || p.Fps[m].Manifest == "" {
@@ -190,7 +201,7 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 					next.None2 = NoneNoDirectory
 					break
 				}
-				next = ix.candidateModule(ctx, m, dir, pv)
+				next = ix.candidateModule(ctx, m, dir, pv, held, members)
 			}
 			if fps == nil {
 				fps = map[string]delivery.CandidateModule{}
@@ -214,9 +225,10 @@ func (ix *Indexer) withPreviews(ctx context.Context, c *delivery.Candidate) bool
 }
 
 // candidateModule is the fingerprint of module m, whose directory is dir, at the preview: the module's inputs from the
-// merge (tree, manifest, locks), its bases' and the builder's fingerprints as the trunk's modules hold them, and the toolchains
-// the build modules agree on, by the rules Recompute applies to a module of the trunk.
-func (ix *Indexer) candidateModule(ctx context.Context, m, dir string, pv delivery.Preview) delivery.CandidateModule {
+// merge (tree, manifest, locks), its bases' and the builder's fingerprints as the trunk's modules hold them, the toolchains
+// the build modules agree on, and the version of each mesh package it uses (candidatePackages), by the rules Recompute
+// applies to a module of the trunk.
+func (ix *Indexer) candidateModule(ctx context.Context, m, dir string, pv delivery.Preview, held map[string]delivery.Module, members map[string]string) delivery.CandidateModule {
 	pm, ok := pv.Modules[dir]
 	if !ok && dir == "" {
 		pm, ok = pv.Modules[delivery.RootPath]
@@ -242,7 +254,7 @@ func (ix *Indexer) candidateModule(ctx context.Context, m, dir string, pv delive
 		out.None2 = NonePreviewNoManifest
 		return out
 	}
-	in := inputsOfNamed(m, kept.JSON, pm.Tree, pm.Locks, pm.Paths, ix.baseFP(ctx))
+	in := inputsOfNamed(m, kept.JSON, pm.Tree, pm.Locks, pm.Paths, delivery.OtherPackages(pm.Packages, pv.Repository), ix.baseFP(ctx))
 	if in.Kept == nil {
 		out.None2 = in.None2
 		return out
@@ -262,14 +274,32 @@ func (ix *Indexer) candidateModule(ctx context.Context, m, dir string, pv delive
 		toolchains[artifact] = t.tc
 	}
 	inputs := *in.Kept // no builder input (ADR 0530 §1)
-	fp, none := delivery.SourceFingerprint2(inputs.With(m, toolchains))
+	versions := candidatePackages(inputs.Packages, held, members)
+	fp, none := delivery.SourceFingerprint2(inputs.WithPackages(m, toolchains, versions))
 	if fp == "" {
 		out.None2 = none
 		return out
 	}
-	out.FP2 = fp
+	out.FP2, out.Packages = fp, versions
 	if len(inputs.Paths) > 0 {
 		out.Paths = inputs.Paths // the builder's fetch for the candidate names them (ADR 0499 clause 4)
 	}
 	return out
 }
+
+// candidatePackages is the version each package of a candidate's module is built against (novox/hq ADR 0573 §2, §4): the
+// head of the candidate's pull request whose repository publishes it (members, by repository), else its latest published
+// version, as the trunk's modules hold it. A package with neither is left out, and the fingerprint is then none.
+func candidatePackages(packages []string, held map[string]delivery.Module, members map[string]string) delivery.PackageVersions {
+	versions, _ := delivery.PackageVersionsOf(packages, held)
+	for _, p := range packages {
+		repository, _, _ := delivery.PackageRepository(p)
+		if head := members[repository]; head != "" {
+			if versions == nil {
+				versions = delivery.PackageVersions{}
+			}
+			versions[p] = head
+		}
+	}
+	return versions
+}

modules/mesh-delivery-indexer/internal/index/previews_test.go

@@ -109,6 +109,24 @@ func TestACandidatesModuleGetsTheFingerprintATrunkModuleOfTheSameTreeHas(t *test
 	if other := fpOf(t, cands); other.FP2 == "" || other.FP2 == trunk.FP2 {
 		t.Errorf("a changed tree: %+v", other)
 	}
+	// Issue 1585 (ADR 0573 §2, §4): a candidate's module is built against the head of the candidate's pull request that
+	// publishes a package it uses, else against the package's latest published version; a preview naming a package of
+	// mesh-sdk that nothing published gives no fingerprint, and one of its own repository's comes with its tree.
+	const sdk, own = "git.novox.be/novox/mesh-sdk/go", "git.novox.be/novox/mesh-catalog/contract"
+	held := map[string]delivery.Module{"mesh-sdk": {Repository: "novox/mesh-sdk", Path: delivery.RootPath, Commit: trunkOld}}
+	if got := candidatePackages([]string{sdk}, held, map[string]string{catalogueRepo: h1}); got[sdk] != trunkOld {
+		t.Errorf("outside a group: %v, want mesh-sdk at its trunk %s", got, trunkOld)
+	}
+	if got := candidatePackages([]string{sdk}, held, map[string]string{catalogueRepo: h1, "novox/mesh-sdk": mergeSha}); got[sdk] != mergeSha {
+		t.Errorf("in a group with mesh-sdk: %v, want its member's head %s", got, mergeSha)
+	}
+	m.Packages = []string{own, sdk}
+	pv.Modules["modules/avahi"] = m
+	pv.Merge = "8888888888888888888888888888888888888888"
+	applyPreview(t, ix, pv)
+	if got := fpOf(t, cands); got.FP2 != "" || got.None2 != delivery.NoPackageVersion+sdk {
+		t.Errorf("a package nothing published: %+v", got)
+	}
 }
 
 func TestAnUnknownToolchainLeavesTheCandidatesModuleNamingIt(t *testing.T) { // 1445/AC2

modules/mesh-delivery-indexer/internal/index/registered.go

@@ -24,6 +24,8 @@ type RepoRead struct {
 	Trees     map[string]string
 	Manifests map[string]string
 	Locks     map[string]map[string]string
+	// Packages are the mesh packages each directory's go.sum names (delivery.MeshPackagesOf, novox/hq ADR 0573 §2).
+	Packages map[string][]string
 }
 
 // IndexRegistered writes the module of a registration as a merge of its repository would, when the modules bucket holds
@@ -129,9 +131,17 @@ func (ix *Indexer) indexAt(ctx context.Context, r Registration, force, reread bo
 	if l := read.Locks[dir]; len(l) > 0 {
 		f.Locks = map[string]map[string]string{dir: l}
 	}
-	if _, err := ix.applyManifests(ctx, f, false); err != nil {
+	if p := read.Packages[dir]; len(p) > 0 {
+		f.Packages = map[string][]string{dir: p}
+	}
+	w, err := ix.applyManifests(ctx, f, false)
+	if err != nil {
 		return t, err
 	}
+	// A module registered or taken in is judged as a merge's are (ADR 0578 §1, ADR 0579 §1).
+	if _, err := ix.JudgeAll(ctx, w.fresh); err != nil {
+		ix.logf("judge: the manifests are not judged after taking in %s: %v", r.Module, err)
+	}
 	if _, _, found, err := ix.Modules.Get(ctx, key); err != nil {
 		return t, fmt.Errorf("modules.%s: %w", key, err)
 	} else if !found {

modules/mesh-delivery-indexer/internal/index/source.go

@@ -37,6 +37,7 @@ func (ix *Indexer) srcOf(repository, merge string) uint64 {
 // when it is written, applyMerged), and a repository none of the indexer's modules is built from writes nothing. The
 // modules of a repository are those the modules bucket holds of it (ADR 0501 clause 6).
 func (ix *Indexer) ApplySource(ctx context.Context, rev uint64, s delivery.Source) error {
+	ix.kickJudge(ctx)
 	ix.mu.Lock()
 	if rev < ix.source.rev {
 		ix.mu.Unlock()

modules/mesh-delivery-indexer/internal/index/toolchains.go

@@ -10,6 +10,8 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"mesh-delivery-indexer/judge"
 )
 
 // The new-form fingerprint of a module is written, and written again with no merge, when what it is of changes
@@ -200,6 +202,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 	type result struct {
 		fp, none string
 		tcs      map[string]delivery.ToolchainUsed // by language, when there is a fingerprint
+		pkgs     delivery.PackageVersions          // the package versions, when there is a fingerprint
 	}
 	done := map[string]result{}
 	visiting := map[string]bool{}
@@ -251,6 +254,12 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			}
 			toolchains[artifact] = t.tc
 		}
+		// The latest published version of each mesh package the module uses: the trunk merge of the module that holds it,
+		// as this recompute holds it, so a package's merge moves every dependent in the same recompute (ADR 0573 §2).
+		versions, unpublished := delivery.PackageVersionsOf(kept.Packages, held)
+		if len(unpublished) > 0 {
+			ix.logf("%s: no module the indexer holds publishes %s, so its fingerprint takes no version of it", module, strings.Join(unpublished, ", "))
+		}
 		var r result
 		switch {
 		case k.contexts:
@@ -259,13 +268,13 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			r.none = strings.Join(missing, "; ")
 		case noToolchain != "":
 			r.none = noToolchain
-			if fp, ok := stillComputed(module, kept, k, toolchains); ok {
-				r = result{fp: fp, tcs: k.held.Toolchains}
+			if fp, ok := stillComputed(module, kept, k, toolchains, versions); ok {
+				r = result{fp: fp, tcs: k.held.Toolchains, pkgs: versions}
 			}
 		default:
-			r.fp, r.none = delivery.SourceFingerprint2(kept.With(module, toolchains))
+			r.fp, r.none = delivery.SourceFingerprint2(kept.WithPackages(module, toolchains, versions))
 			if r.fp != "" {
-				r.tcs = toolchainsUsed(toolchains)
+				r.tcs, r.pkgs = toolchainsUsed(toolchains), versions
 			}
 		}
 		done[module] = r
@@ -278,7 +287,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 		r := of(key, nil)
 		if _, merged := overlay[key]; merged {
 			final := overlay[key]
-			final.FP2, final.None2, final.Inputs2, final.Toolchains = r.fp, r.none, k.cur.Inputs2, r.tcs
+			final.FP2, final.None2, final.Inputs2, final.Toolchains, final.Packages = r.fp, r.none, k.cur.Inputs2, r.tcs, r.pkgs
 			// What the bases gave is kept as it was while the value it gave does not change, so a merge
 			// that moves nothing for the module writes nothing (as Recompute does).
 			if value, _, found, err := ix.Modules.Get(ctx, key); err == nil && found {
@@ -291,7 +300,7 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			finals[key] = final
 			continue
 		}
-		if !stale[key] && k.cur.FP2 == r.fp && k.cur.None2 == r.none && reflect.DeepEqual(k.cur.Toolchains, r.tcs) {
+		if !stale[key] && k.cur.FP2 == r.fp && k.cur.None2 == r.none && reflect.DeepEqual(k.cur.Toolchains, r.tcs) && reflect.DeepEqual(k.cur.Packages, r.pkgs) {
 			continue
 		}
 		digest, inputs, paths := k.cur.Manifest, k.cur.Inputs2, k.cur.ArtifactPaths
@@ -304,10 +313,10 @@ func (ix *Indexer) recomputeModules(ctx context.Context, overlay map[string]deli
 			if err != nil || cur.Manifest != digest || cur.Inputs2 == nil {
 				return nil, false, nil // a merge changed it meanwhile; its own recompute follows
 			}
-			if cur.FP2 == r.fp && cur.None2 == r.none && reflect.DeepEqual(cur.Toolchains, r.tcs) {
+			if cur.FP2 == r.fp && cur.None2 == r.none && reflect.DeepEqual(cur.Toolchains, r.tcs) && reflect.DeepEqual(cur.Packages, r.pkgs) {
 				return nil, false, nil
 			}
-			cur.FP2, cur.None2, cur.Toolchains = r.fp, r.none, r.tcs
+			cur.FP2, cur.None2, cur.Toolchains, cur.Packages = r.fp, r.none, r.tcs, r.pkgs
 			cur.Inputs2, cur.ArtifactPaths = inputs, paths
 			data, err := delivery.EncodeModule(cur)
 			wrote = err == nil
@@ -342,10 +351,19 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 		wrote := false
 		err := write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
 			wrote = false
-			if found {
-				if cur, err := delivery.DecodeModule(value); err == nil && sameButWhere(cur, next) {
-					return nil, false, nil
-				}
+			next := next
+			cur, err := delivery.DecodeModule(value)
+			held := found && err == nil
+			if held && cur.Manifest == next.Manifest {
+				// The judge's verdict stands while the digest does (ADR 0578 §3, ADR 0579 §1): a recompute never writes a
+				// refused or outgrown module as accepted; only the judge changes it.
+				next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
+			}
+			if held && sameButWhere(cur, next) {
+				return nil, false, nil
+			}
+			if next.Manifest != "" && (!held || cur.Manifest != next.Manifest) {
+				w.taken(next.Manifest) // a new module, or a changed manifest: fresh, judged in full (ADR 0579 §1)
 			}
 			data, err := delivery.EncodeModule(next)
 			wrote = err == nil
@@ -361,10 +379,12 @@ func (ix *Indexer) writeOverlay(ctx context.Context, overlay, finals map[string]
 	return nil
 }
 
-// sameButWhere says the held value cur is next but for where it was computed (Commit and Src): the module is unchanged.
+// sameButWhere says the held value cur is next but for where it was computed (Commit and Src) and the judge's verdict,
+// which only the judge writes: the module is unchanged.
 func sameButWhere(cur, next delivery.Module) bool {
 	next = withV(next)
 	next.Commit, next.Src = cur.Commit, cur.Src
+	next.Verdict, next.Problems, next.Warnings = cur.Verdict, cur.Problems, cur.Warnings
 	return reflect.DeepEqual(cur, next)
 }
 
@@ -385,7 +405,7 @@ func (ix *Indexer) manifestRaw(ctx context.Context, digest string) (string, cata
 	if err != nil {
 		return "", catalogue.Manifest{}, err
 	}
-	m, err := catalogue.ParseManifestForInputs([]byte(kept.JSON))
+	m, err := judge.ForInputs([]byte(kept.JSON))
 	return kept.JSON, m, err
 }
 
@@ -397,7 +417,7 @@ func (ix *Indexer) rejudged(ctx context.Context, m catalogue.Manifest, cur deliv
 	if cur.FP2 != "" || cur.Inputs2 == nil || !strings.HasPrefix(cur.None2, None2Unreadable) {
 		return cur, false
 	}
-	in := inputsOfNamed(m.Module, raw, cur.Inputs2.Tree, cur.Inputs2.Locks, cur.Inputs2.Paths, ix.baseFP(ctx))
+	in := inputsOfNamed(m.Module, raw, cur.Inputs2.Tree, cur.Inputs2.Locks, cur.Inputs2.Paths, cur.Inputs2.Packages, ix.baseFP(ctx))
 	if in.Kept == nil {
 		return cur, false
 	}
@@ -424,7 +444,7 @@ func hasContext(m catalogue.Manifest) bool {
 // computed and built). Only computing a new fingerprint needs the agreement: the held one is kept when its kept inputs,
 // with the toolchains it was computed with in place of the languages agreed on none, give it again. Any other input that
 // moved (a merge, a base, an agreed toolchain) gives another fingerprint, and the module has none until they agree.
-func stillComputed(module string, kept delivery.KeptInputs2, k *known, agreed map[string]delivery.Toolchain2) (string, bool) {
+func stillComputed(module string, kept delivery.KeptInputs2, k *known, agreed map[string]delivery.Toolchain2, versions delivery.PackageVersions) (string, bool) {
 	if k.held.FP2 == "" {
 		return "", false
 	}
@@ -440,7 +460,7 @@ func stillComputed(module string, kept delivery.KeptInputs2, k *known, agreed ma
 		}
 		toolchains[artifact] = delivery.Toolchain2{Language: language, Version: used.Version, Recipe: used.Recipe}
 	}
-	fp, none := delivery.SourceFingerprint2(kept.With(module, toolchains))
+	fp, none := delivery.SourceFingerprint2(kept.WithPackages(module, toolchains, versions))
 	return fp, none == "" && fp == k.held.FP2
 }
 

modules/mesh-delivery-indexer/internal/index/toolchains_test.go

@@ -294,6 +294,41 @@ func TestAModuleKeepsTheToolchainsItsFingerprintWasComputedWith(t *testing.T) {
 	if n.FP2 == m.FP2 || n.Toolchains["go"].Version != "go1.27.2" {
 		t.Errorf("after the upgrade: fp2 %q (was %q) toolchains %+v, want the new version with the new fingerprint", n.FP2, m.FP2, n.Toolchains)
 	}
+	// Issue 1585 (ADR 0573 §2): a module whose go.sum names mesh-sdk takes mesh-sdk's latest published version into its
+	// fingerprint and keeps it beside its toolchains; a mesh-sdk trunk merge moves it with no merge of its own, and a module
+	// using no package is not moved. With no published version held, it has none, naming the package.
+	const sdk = "git.novox.be/novox/mesh-sdk/go"
+	_, _, uses := newFormIndexerUnmerged(t, builderModules(t)...)
+	uses.Packages = map[string][]string{"modules/avahi": {sdk}}
+	if err := ix.Apply(context.Background(), uses); err != nil {
+		t.Fatal(err)
+	}
+	if u, _ := moduleOf(t, mods, "avahi"); u.FP2 != "" || u.None2 != delivery.NoPackageVersion+sdk {
+		t.Errorf("no published mesh-sdk: fp2 %q none2 %q", u.FP2, u.None2)
+	}
+	tools, _ := moduleOf(t, mods, "mesh-tools")
+	sdkMerge := func(commit, tree string) delivery.Module {
+		t.Helper()
+		f := delivery.Forge{V: delivery.Version, Kind: delivery.ForgeMerged, Repository: "novox/mesh-sdk", Branch: "feat/x", Number: 3, Head: h1,
+			Merge: commit, Root: tree, Trees: map[string]string{"": tree}, Manifests: map[string]string{"": `{"module":"mesh-sdk","version":"1"}`}}
+		if err := ix.Apply(context.Background(), f); err != nil {
+			t.Fatal(err)
+		}
+		a, _ := moduleOf(t, mods, "avahi")
+		if a.FP2 == "" || !reflect.DeepEqual(a.Packages, delivery.PackageVersions{sdk: commit}) {
+			t.Fatalf("after mesh-sdk's merge %.8s: fp2 %q none2 %q packages %v", commit, a.FP2, a.None2, a.Packages)
+		}
+		if o, _ := moduleOf(t, mods, "mesh-tools"); o.FP2 != tools.FP2 || o.Packages != nil {
+			t.Errorf("mesh-tools uses no package and moved: fp2 %q (was %q) packages %v", o.FP2, tools.FP2, o.Packages)
+		}
+		return a
+	}
+	first := sdkMerge(strings.Repeat("1", 40), "tree-sdk-1")
+	second := sdkMerge(strings.Repeat("2", 40), "tree-sdk-2")
+	if second.FP2 == first.FP2 {
+		t.Errorf("a mesh-sdk trunk merge kept avahi's fingerprint %q", first.FP2)
+	}
+	n = second
 	// Nodes that disagree keep the fingerprint already computed, with its toolchains (issue 1940, 2026-10-25 20:56: a
 	// stale report blanked every module and the controller's take-in refused modules already built); only a new
 	// fingerprint needs the agreement: a merge that moves the module's tree gives it none, naming the disagreement.

modules/mesh-delivery-indexer/internal/index/verdicts.go

@@ -0,0 +1,228 @@
+package index
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/process"
+
+	"mesh-delivery-indexer/judge"
+)
+
+// The indexer judges every manifest it holds, once, with its own judge (novox/hq ADR 0578 §1): it writes each verdict in
+// its state verdicts (delivery.VerdictsBucket), one key per manifest digest, only when the verdict differs from the one
+// held; a module's value in the modules state carries a refusal (Verdict, Problems), so a reader of modules takes it
+// without a second read; a new refusal is said as the event manifest-refused. It judges at its start, so a judge that
+// changed (a new indexer) judges every manifest again, and after every merge it takes in, since a rule between manifests
+// can turn on any of them. Nothing polls.
+
+// VerdictsBucket is the indexer's state of verdicts.
+var VerdictsBucket = delivery.VerdictsBucket
+
+// Judged is what one pass of the judge did: the manifests judged, the verdicts written, and the modules refused.
+type Judged struct {
+	Judged, Written int
+	Refused         map[string][]string
+	// Outgrown are the modules accepted before whose problems are now warnings (ADR 0579 §1).
+	Outgrown []string
+}
+
+// JudgeAll judges every manifest the modules state names, as one catalogue with the predefined list the indexer keeps,
+// and writes what differs. A manifest the manifests state does not hold is left unjudged and said; a write that fails is
+// said and the pass goes on, so one key never costs the others their verdict.
+//
+// **A stricter judge never refuses what it accepted before** (novox/hq ADR 0579 §1): a manifest whose verdict under its
+// digest is accepted, or which the indexer held before any verdict (taken as accepted, ADR 0578 §3) and is not in fresh,
+// stays accepted, the new problems written as the verdict's Warnings and carried in its module's value, which the
+// watchman raises as manifest-outgrown. A manifest in fresh (the digests a merge just took in) with no verdict yet, and
+// one already refused, is judged in full.
+func (ix *Indexer) JudgeAll(ctx context.Context, fresh map[string]bool) (Judged, error) {
+	var out Judged
+	if ix.Verdicts == nil || ix.Modules == nil || ix.Manifests == nil {
+		return out, nil
+	}
+	held, err := ix.heldModules(ctx)
+	if err != nil {
+		return out, err
+	}
+	raws := map[string][]byte{}
+	digests := map[string]string{}
+	for _, name := range slices.Sorted(maps.Keys(held)) {
+		digest := held[name].Manifest
+		if digest == "" {
+			continue
+		}
+		value, _, found, err := ix.Manifests.Get(ctx, digest)
+		if err != nil {
+			return out, fmt.Errorf("reading manifests.%s of %s: %w", digest, name, err)
+		}
+		if !found {
+			ix.logf("judge: the manifest of %s (digest %s) is not in the manifests state, so it is not judged", name, digest)
+			continue
+		}
+		kept, err := delivery.DecodeManifest(value)
+		if err != nil {
+			ix.logf("judge: manifests.%s of %s cannot be read, so it is not judged: %v", digest, name, err)
+			continue
+		}
+		raws[name] = []byte(kept.JSON)
+		digests[name] = digest
+	}
+	refused, unnamed := judge.Shelf(raws, ix.predefinedList(ctx), 0)
+	for _, p := range unnamed {
+		ix.logf("judge: a problem between the manifests that no one module's removal ends, so it refuses none: %s", p)
+	}
+	out.Refused = refused
+	id := ix.JudgeID
+	if id == "" {
+		id = judge.Identity()
+	}
+	for _, name := range slices.Sorted(maps.Keys(digests)) {
+		out.Judged++
+		v := delivery.ManifestVerdict{Module: name, State: delivery.VerdictAccepted, Judge: id, At: ix.now()}
+		if problems := refused[name]; len(problems) > 0 {
+			if ix.acceptedBefore(ctx, digests[name], fresh) {
+				v.Warnings = problems
+				out.Outgrown = append(out.Outgrown, name)
+			} else {
+				v.State, v.Problems = delivery.VerdictRefused, problems
+			}
+		}
+		wrote, err := ix.writeVerdict(ctx, digests[name], v)
+		if errors.Is(err, process.ErrNotYet) {
+			return out, fmt.Errorf("the state %s is not on the bus yet: %w", VerdictsBucket, err)
+		}
+		if err != nil {
+			ix.logf("judge: the verdict on %s (digest %s) is not written: %v", name, digests[name], err)
+			continue
+		}
+		if wrote {
+			out.Written++
+			if v.Refused() {
+				ix.logf("judge: %s", v.Why())
+				if ix.SayRefused != nil {
+					ix.SayRefused(ctx, delivery.RefusedOf(digests[name], v))
+				}
+			}
+		}
+		if err := ix.carryVerdict(ctx, name, digests[name], v); err != nil {
+			ix.logf("judge: modules.%s does not carry its verdict: %v", name, err)
+		}
+	}
+	return out, nil
+}
+
+// JudgeAtStart is JudgeAll of every manifest held, none fresh, as the indexer starts (a judge that changed judges every
+// one again); one that fails is judged again at the next message or source revision heard (kickJudge).
+func (ix *Indexer) JudgeAtStart(ctx context.Context) (Judged, error) {
+	j, err := ix.JudgeAll(ctx, nil)
+	ix.judgePending.Store(err != nil)
+	return j, err
+}
+
+// kickJudge judges again a start pass that failed, when the indexer hears something: never on a timer.
+func (ix *Indexer) kickJudge(ctx context.Context) {
+	if !ix.judgePending.Load() {
+		return
+	}
+	if j, err := ix.JudgeAtStart(ctx); err != nil {
+		ix.logf("judge: the manifests are still not judged: %v", err)
+	} else {
+		ix.logf("judge: judged %d manifests again after a failed start: %d verdicts written", j.Judged, j.Written)
+	}
+}
+
+// acceptedBefore says whether the manifest of digest was accepted before this judgement: its verdict says accepted, or
+// it has none and is not fresh (held before any verdict, so taken in under the judges that ran until then).
+func (ix *Indexer) acceptedBefore(ctx context.Context, digest string, fresh map[string]bool) bool {
+	value, _, found, err := ix.Verdicts.Get(ctx, digest)
+	if err != nil {
+		return false // unread: judged in full, said by the write that follows
+	}
+	if !found {
+		return !fresh[digest]
+	}
+	prev, err := delivery.DecodeManifestVerdict(value)
+	return err == nil && !prev.Refused()
+}
+
+// writeVerdict writes v under the digest's key unless the verdict held there says the same (ManifestVerdict.Same); wrote
+// says it was written.
+func (ix *Indexer) writeVerdict(ctx context.Context, digest string, v delivery.ManifestVerdict) (wrote bool, err error) {
+	key, err := delivery.VerdictsKey(digest)
+	if err != nil {
+		return false, err
+	}
+	err = write(ctx, ix.Verdicts, key, func(value []byte, found bool) ([]byte, bool, error) {
+		wrote = false
+		if found {
+			if cur, err := delivery.DecodeManifestVerdict(value); err == nil && cur.Same(v) {
+				return nil, false, nil
+			}
+		}
+		wrote = true
+		next, err := delivery.EncodeManifestVerdict(v)
+		return next, false, err
+	})
+	return wrote, err
+}
+
+// carryVerdict puts a refusal into the module's value, and takes one out once the manifest is accepted, while the value
+// still names the digest judged; an accepted module's value carries nothing, so judging writes no value of a module the
+// judge accepts (a reader takes a value without a verdict as accepted, delivery.TakeManifestVerdict).
+func (ix *Indexer) carryVerdict(ctx context.Context, name, digest string, v delivery.ManifestVerdict) error {
+	key, err := delivery.ModulesKey(name)
+	if err != nil {
+		return err
+	}
+	return write(ctx, ix.Modules, key, func(value []byte, found bool) ([]byte, bool, error) {
+		if !found {
+			return nil, false, nil
+		}
+		cur, err := delivery.DecodeModule(value)
+		if err != nil || cur.Manifest != digest {
+			return nil, false, nil // gone, unreadable, or moved to another manifest since: the next pass judges it
+		}
+		state := ""
+		if v.Refused() {
+			state = delivery.VerdictRefused
+		}
+		if cur.Verdict == state && slices.Equal(cur.Problems, v.Problems) && slices.Equal(cur.Warnings, v.Warnings) {
+			return nil, false, nil
+		}
+		cur.Verdict, cur.Problems, cur.Warnings = state, v.Problems, v.Warnings
+		if state == "" {
+			cur.Problems = nil
+		}
+		next, err := delivery.EncodeModule(cur)
+		return next, false, err
+	})
+}
+
+// predefinedList is the catalogue's predefined list the indexer keeps (writePredefined), or nil when it keeps none or
+// it cannot be read: the judge then takes each fallback as its value declares it.
+func (ix *Indexer) predefinedList(ctx context.Context) catalogue.PredefinedList {
+	if ix.Predefined == nil {
+		return nil
+	}
+	value, _, found, err := ix.Predefined.Get(ctx, delivery.PredefinedListKey)
+	if err != nil || !found {
+		return nil
+	}
+	var kept delivery.PredefinedKept
+	if json.Unmarshal(value, &kept) != nil {
+		return nil
+	}
+	list, err := catalogue.ParsePredefined(kept.List)
+	if err != nil {
+		ix.logf("judge: the predefined list kept cannot be read, so fallbacks are judged as their values declare them: %v", err)
+		return nil
+	}
+	return list
+}

modules/mesh-delivery-indexer/internal/index/verdicts_test.go

@@ -0,0 +1,126 @@
+package index
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// The indexer judges every manifest it holds and writes each verdict only when it differs; a module's value carries a
+// refusal, which is said once as manifest-refused; a new judge writes again only what it judges otherwise; a manifest
+// mended clears the module's refusal (novox/hq ADR 0578 §1).
+func TestTheIndexerJudgesEveryManifestOnce(t *testing.T) {
+	ctx := context.Background()
+	ix := &Indexer{Modules: newMem(), Manifests: newMem(), Verdicts: newMem(), JudgeID: "judge-1",
+		Now: func() time.Time { return time.Date(2026, 11, 1, 3, 0, 0, 0, time.UTC) }}
+	var said []delivery.ManifestRefused
+	ix.SayRefused = func(_ context.Context, r delivery.ManifestRefused) { said = append(said, r) }
+	hold := func(module, raw string) string {
+		digest, err := ix.keepManifest(ctx, module, raw)
+		if err != nil {
+			t.Fatal(err)
+		}
+		value, err := delivery.EncodeModule(delivery.Module{FP2: "src2:" + strings.Repeat("a", 64), Manifest: digest,
+			Repository: "novox/mesh-catalog", Commit: "c"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		ix.Modules.(*memStore).put(module, value)
+		return digest
+	}
+	good := hold("good", `{"module":"good","version":"1"}`)
+	bad := hold("bad", `{"module":"bad","version":"1","requires":["amqp"]}`)
+	// Both taken in by a merge: judged in full.
+	j, err := ix.JudgeAll(ctx, map[string]bool{good: true, bad: true})
+	if err != nil || j.Judged != 2 || j.Written != 2 || len(j.Refused) != 1 {
+		t.Fatalf("the first pass: %+v %v", j, err)
+	}
+	verdict := func(digest string) delivery.ManifestVerdict {
+		value, _, found, _ := ix.Verdicts.Get(ctx, digest)
+		v, err := delivery.DecodeManifestVerdict(value)
+		if !found || err != nil {
+			t.Fatalf("no verdict under %s: %v", digest, err)
+		}
+		return v
+	}
+	if v := verdict(good); v.Refused() || v.Judge != "judge-1" {
+		t.Fatalf("good: %+v", v)
+	}
+	if v := verdict(bad); !v.Refused() || !strings.Contains(v.Problems[0], `requires "amqp"`) {
+		t.Fatalf("bad: %+v", v)
+	}
+	module := func(name string) delivery.Module {
+		value, _, _, _ := ix.Modules.Get(ctx, name)
+		m, err := delivery.DecodeModule(value)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return m
+	}
+	if m := module("bad"); m.Verdict != delivery.VerdictRefused || len(m.Problems) != 1 {
+		t.Fatalf("modules.bad carries %+v", m)
+	}
+	if m := module("good"); m.Verdict != "" {
+		t.Fatalf("modules.good carries %q", m.Verdict)
+	}
+	if len(said) != 1 || said[0].Module != "bad" || said[0].Digest != bad || said[0].Judge != "judge-1" {
+		t.Fatalf("said %+v", said)
+	}
+	// A new judge that judges alike writes nothing and says nothing again.
+	ix.JudgeID = "judge-2"
+	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Written != 0 || len(said) != 1 {
+		t.Fatalf("a judge that judges alike: %+v %v, said %d", j, err, len(said))
+	}
+	// The manifest mended: its new digest is accepted and the module's refusal goes.
+	mended := hold("bad", `{"module":"bad","version":"2"}`)
+	if j, err := ix.JudgeAll(ctx, map[string]bool{mended: true}); err != nil || j.Written != 1 || len(j.Refused) != 0 {
+		t.Fatalf("mended: %+v %v", j, err)
+	}
+	if m := module("bad"); m.Verdict != "" || m.Problems != nil {
+		t.Fatalf("modules.bad still carries %+v", m)
+	}
+	// ADR 0579 §1: a manifest held before any verdict (taken in under the judges until then), which this judge finds a
+	// problem in, stays accepted with the problem as a warning, carried in its value and said nowhere as a refusal; the
+	// same problem in a manifest a merge takes in now, or in one whose digest changed, is refused in full.
+	old := hold("old", `{"module":"old","version":"1","requires":["amqp"]}`)
+	if j, err := ix.JudgeAll(ctx, nil); err != nil || len(j.Outgrown) != 1 || j.Outgrown[0] != "old" {
+		t.Fatalf("an outgrown manifest: %+v %v", j, err)
+	}
+	if v := verdict(old); v.Refused() || len(v.Warnings) != 1 || !strings.Contains(v.Warnings[0], `requires "amqp"`) {
+		t.Fatalf("old: %+v", v)
+	}
+	if m := module("old"); m.Verdict != "" || len(m.Warnings) != 1 || len(said) != 1 {
+		t.Fatalf("modules.old carries %+v, said %d", m, len(said))
+	}
+	changed := hold("old", `{"module":"old","version":"2","requires":["amqp"]}`)
+	fresh := hold("new", `{"module":"new","version":"1","requires":["amqp"]}`)
+	if j, err := ix.JudgeAll(ctx, map[string]bool{changed: true, fresh: true}); err != nil || len(j.Outgrown) != 0 {
+		t.Fatalf("a changed and a new manifest: %+v %v", j, err)
+	}
+	if !verdict(changed).Refused() || !verdict(fresh).Refused() || module("old").Verdict != delivery.VerdictRefused || len(module("old").Warnings) != 0 {
+		t.Fatalf("the changed and the new manifest are not refused: %+v %+v", verdict(changed), verdict(fresh))
+	}
+	// A merge's write of a module whose digest it leaves as it is carries the verdict over, and nothing is fresh; a changed
+	// digest is fresh, judged in full (review R1, R2).
+	w := &mergeWrite{}
+	same := delivery.Module{FP2: "src2:" + strings.Repeat("c", 64), Manifest: changed, Repository: "novox/mesh-catalog", Commit: "c2"}
+	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil {
+		t.Fatal(err)
+	}
+	if m := module("old"); m.Verdict != delivery.VerdictRefused || len(m.Problems) == 0 || len(w.fresh) != 0 {
+		t.Fatalf("a merge rewrote a refused module as %+v, fresh %v", m, w.fresh)
+	}
+	other := strings.Repeat("d", 64)
+	same.Manifest = other
+	if err := ix.writeOverlay(ctx, map[string]delivery.Module{"old": same}, nil, w); err != nil || !w.fresh[other] {
+		t.Fatalf("a changed digest is not fresh: %v %v", w.fresh, err)
+	}
+	// Without the verdicts state the indexer judges nothing.
+	ix.Verdicts = nil
+	if j, err := ix.JudgeAll(ctx, nil); err != nil || j.Judged != 0 {
+		t.Fatalf("without the state: %+v %v", j, err)
+	}
+}

modules/mesh-delivery-indexer/judge/judge.go

@@ -0,0 +1,279 @@
+// Package judge is the mesh's one judge of module manifests (novox/hq ADR 0578 §1, §2): strict decoding, the seat and
+// namespace rules, the bus and stream limits, and the rules between the manifests of one catalogue. Only the indexer,
+// which judges every manifest it takes in and writes the verdicts (delivery.VerdictsBucket), and the checker, which
+// judges every manifest a change touches by running this judge built at the trunk or a group's head (cmd/mesh-judge,
+// as the composer is run), use it. Every other part decodes a manifest leniently (catalogue.Decode) and takes the
+// verdict; it never judges (ADR 0578 §3).
+//
+// Its rules are still mesh-sdk's catalogue functions it calls; they leave mesh-sdk for this package in the group's last
+// mesh-sdk commit, once no reader imports them (ADR 0578 §7, issue 1585 S19). Callers depend only on what this package
+// answers, so that move changes nothing for them.
+package judge
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	json "encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"os"
+	filepath "path/filepath"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+)
+
+// Manifest judges one manifest alone: decoded strictly, and every rule a manifest is held to by itself. The list of
+// predefined keys is the one a config value falling back to a key is judged against (ADR 0348 §7); nil judges each
+// fallback as its value declares it, where no list is at hand. Problems is empty when the manifest is accepted, and
+// then m is the manifest as the judge read it.
+func Manifest(raw []byte, predefined catalogue.PredefinedList) (m catalogue.Manifest, problems []string) {
+	var err error
+	if predefined != nil {
+		m, err = ParseManifestWith(raw, predefined)
+	} else {
+		m, err = ParseManifestForInputs(raw)
+	}
+	if err != nil {
+		return catalogue.Manifest{}, problemsOf(err)
+	}
+	return m, nil
+}
+
+// ForInputs is Manifest worded as the strict parser words a refusal: the indexer's read of a manifest for the inputs of its
+// fingerprint, which keeps a refused manifest's reason in its value (None2) as it always has.
+func ForInputs(raw []byte) (catalogue.Manifest, error) {
+	return ParseManifestForInputs(raw)
+}
+
+// listedRefusal is how the strict parser words a refusal of several problems, one per line after its header.
+const listedRefusal = "this manifest cannot be used:\n  - "
+
+// problemsOf splits the strict parser's refusal into its problems, one each.
+func problemsOf(err error) []string {
+	text := err.Error()
+	if rest, ok := strings.CutPrefix(text, listedRefusal); ok {
+		return strings.Split(rest, "\n  - ")
+	}
+	return []string{text}
+}
+
+// Shelf judges every manifest of one catalogue, by the name it is given under (a module's name): each alone (Manifest),
+// then the rules between the manifests accepted alone (Between). A problem between manifests is a problem of each module
+// whose removal from the catalogue ends it (a rule two modules break together refuses both); one no removal ends is in
+// unnamed, for the caller to say. A module not in the answer is accepted.
+func Shelf(raws map[string][]byte, predefined catalogue.PredefinedList, longestMachine int) (refused map[string][]string, unnamed []string) {
+	refused = map[string][]string{}
+	shelf := catalogue.Shelf{}
+	for name, raw := range raws {
+		m, problems := Manifest(raw, predefined)
+		if len(problems) > 0 {
+			refused[name] = problems
+			continue
+		}
+		if m.Module != name {
+			refused[name] = []string{fmt.Sprintf("the manifest is of module %q, not %q", m.Module, name)}
+			continue
+		}
+		shelf[name] = m
+	}
+	between := Between(shelf, longestMachine)
+	without := map[string]map[string]bool{} // by module: the problems between the rest, once asked
+	ends := func(module, problem string) bool {
+		if without[module] == nil {
+			rest := maps.Clone(shelf)
+			delete(rest, module)
+			without[module] = map[string]bool{}
+			for _, p := range Between(rest, longestMachine) {
+				without[module][p] = true
+			}
+		}
+		return !without[module][problem]
+	}
+	for _, p := range between {
+		// The modules it names are asked first; only when none of them ends it is every module asked.
+		var of []string
+		for _, name := range Named(p, shelf) {
+			if ends(name, p) {
+				of = append(of, name)
+			}
+		}
+		if len(of) == 0 {
+			for _, name := range slices.Sorted(maps.Keys(shelf)) {
+				if ends(name, p) {
+					of = append(of, name)
+				}
+			}
+		}
+		if len(of) == 0 {
+			unnamed = append(unnamed, p)
+			continue
+		}
+		for _, name := range of {
+			refused[name] = append(refused[name], p)
+		}
+	}
+	for name := range refused {
+		sort.Strings(refused[name])
+	}
+	return refused, unnamed
+}
+
+// Between is every problem between the manifests of shelf, sorted: catalogue.CatalogueProblems, IdentityProblems over
+// the longest machine name (catalogue.DefaultLongestMachine when not above 0) and DataProblems.
+func Between(shelf catalogue.Shelf, longestMachine int) []string {
+	if longestMachine <= 0 {
+		longestMachine = catalogue.DefaultLongestMachine
+	}
+	between := CatalogueProblems(shelf)
+	between = append(between, IdentityProblems(shelf, longestMachine)...)
+	between = append(between, DataProblems(shelf)...)
+	sort.Strings(between)
+	return slices.Compact(between)
+}
+
+// nameChar is a character a module's name may hold; a name is named in a text only where none borders it.
+var nameChar = regexp.MustCompile(`[a-z0-9.-]`)
+
+// Named is every module of shelf a problem names, as a word of its own (not part of a longer name), sorted: the modules
+// Shelf asks first whether their removal ends the problem. A module named only as a word ("mounts" in "f1-circuits
+// mounts its directory") is not blamed for it, since its removal ends nothing.
+func Named(problem string, shelf catalogue.Shelf) []string {
+	var out []string
+	for name := range shelf {
+		for at := 0; ; {
+			i := strings.Index(problem[at:], name)
+			if i < 0 {
+				break
+			}
+			i += at
+			end := i + len(name)
+			before := i == 0 || !nameChar.MatchString(problem[i-1:i])
+			after := end == len(problem) || !nameChar.MatchString(problem[end:end+1]) ||
+				// A sentence's full stop after a name ends it.
+				(problem[end] == '.' && (end+1 == len(problem) || problem[end+1] == ' '))
+			if before && after {
+				out = append(out, name)
+				break
+			}
+			at = i + 1
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// Unnamed names, in a request's case verdict, the problems between manifests that no one module's removal ends.
+const Unnamed = "(between manifests)"
+
+// Request judges every case of a composer request (mesh-sdk composer.Request), what cmd/mesh-judge answers the checker:
+// each case's manifests as one catalogue (Shelf), every manifest accepted or refused with its problems, one per line; the
+// problems no module's removal ends under Between. The verdict's SDK names this judge (Identity). A manifest left as a
+// digest, or a case named twice, is a request it cannot run.
+func Request(r composer.Request) (composer.Verdict, error) {
+	v := composer.Verdict{V: composer.Version, SDK: Identity()}
+	seen := map[string]bool{}
+	for _, c := range r.Cases {
+		if seen[c.Name] {
+			return composer.Verdict{}, fmt.Errorf("the case %q is named twice", c.Name)
+		}
+		seen[c.Name] = true
+		raws := map[string][]byte{}
+		for name, m := range c.Manifests {
+			if len(m.Raw) == 0 {
+				return composer.Verdict{}, fmt.Errorf("%w: %s (digest %s)", composer.ErrUnfilled, name, m.Digest)
+			}
+			raws[name] = m.Raw
+		}
+		refused, unnamed := Shelf(raws, r.Predefined, 0)
+		cv := composer.CaseVerdict{Name: c.Name, Manifests: map[string]composer.ManifestRead{}}
+		for name := range raws {
+			if problems := refused[name]; len(problems) > 0 {
+				cv.Manifests[name] = composer.ManifestRead{Refused: strings.Join(problems, "\n")}
+				continue
+			}
+			cv.Manifests[name] = composer.ManifestRead{Accepted: true}
+		}
+		if len(unnamed) > 0 {
+			cv.Manifests[Unnamed] = composer.ManifestRead{Refused: strings.Join(unnamed, "\n")}
+		}
+		v.Cases = append(v.Cases, cv)
+	}
+	return v, nil
+}
+
+var (
+	identityOnce sync.Once
+	identity     string
+)
+
+// Identity names this judge: the sha256 of the running program, "exe:" and 16 hex digits, so a verdict says which judge
+// made it and the indexer knows its judge changed when the program it runs does. "unknown" when the program cannot be
+// read.
+func Identity() string {
+	identityOnce.Do(func() {
+		identity = "unknown"
+		path, err := os.Executable()
+		if err != nil {
+			return
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return
+		}
+		defer f.Close()
+		h := sha256.New()
+		if _, err := io.Copy(h, f); err != nil {
+			return
+		}
+		identity = "exe:" + hex.EncodeToString(h.Sum(nil)[:8])
+	})
+	return identity
+}
+
+// WithTemplatesFrom is catalogue.WithTemplatesFrom judged: m with each template's text read from dir, then judged again
+// as filled, against the list of predefined keys m was read with (a template's text can ask for what the manifest
+// does not declare). The catalogue's reader only fills it (novox/hq ADR 0578 §3); judging the result is this judge's.
+func WithTemplatesFrom(m catalogue.Manifest, dir string) (catalogue.Manifest, error) {
+	filled, err := catalogue.WithTemplatesFrom(m, dir)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	// Judged as it composes without its build's templates archive, as the catalogue judged it before (template.go).
+	filled.Moved = false
+	raw, err := json.Marshal(filled)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	again, err := parseManifest(raw, m.Predefined())
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	again.Moved = m.Moved
+	return again, nil
+}
+
+// ReadTreeManifest is the manifest in a module's directory of a repository tree judged as the merge gate judges it:
+// strictly, against the list of predefined keys at the tree's root, then with each template's text read from its
+// directory and judged again (WithTemplatesFrom).
+func ReadTreeManifest(root, dir string) (catalogue.Manifest, error) {
+	list, err := catalogue.ReadPredefined(root)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	raw, err := os.ReadFile(filepath.Join(dir, "module.json"))
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	m, err := ParseManifestWith(raw, list)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	return WithTemplatesFrom(m, dir)
+}

modules/mesh-delivery-indexer/judge/judge_test.go

@@ -0,0 +1,93 @@
+package judge
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// The judge (novox/hq ADR 0578 §1): a manifest alone is accepted, or refused with each problem; an unknown field is
+// refused (strict decoding); a rule between manifests refuses every module it names, and a word inside a longer name
+// is no naming.
+func TestTheJudge(t *testing.T) {
+	for _, row := range []struct {
+		name string
+		raws map[string]string
+		want map[string]string // module: a word of its first problem; absent: accepted
+	}{
+		{name: "a valid manifest", raws: map[string]string{"a": `{"module":"a","version":"1"}`}},
+		{name: "a refused manifest", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"amqp"}]}`},
+			want: map[string]string{"a": `provides "amqp", which is not a provision`}},
+		{name: "a provision named as a credential's", raws: map[string]string{"a": `{"module":"a","version":"1","provides":[{"name":"secret-db","scope":"mesh"}]}`},
+			want: map[string]string{"a": `secret-`}},
+		{name: "an unknown field", raws: map[string]string{"a": `{"module":"a","version":"1","a-field-from-later":1}`},
+			want: map[string]string{"a": `"a-field-from-later"`}},
+		{name: "a manifest under another name", raws: map[string]string{"b": `{"module":"a","version":"1"}`},
+			want: map[string]string{"b": `of module "a", not "b"`}},
+		{name: "a seat declared twice",
+			raws: map[string]string{
+				"one": `{"module":"one","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
+				"two": `{"module":"two","version":"1","seats":[{"name":"thing","scope":"mesh"}]}`,
+				"ok":  `{"module":"ok","version":"1"}`},
+			want: map[string]string{"one": "already declares", "two": "already declares"}},
+	} {
+		raws := map[string][]byte{}
+		for k, v := range row.raws {
+			raws[k] = []byte(v)
+		}
+		refused, unnamed := Shelf(raws, nil, 0)
+		if len(unnamed) > 0 {
+			t.Errorf("%s: unnamed %v", row.name, unnamed)
+		}
+		if len(refused) != len(row.want) {
+			t.Errorf("%s: refused %v, want %v", row.name, refused, row.want)
+			continue
+		}
+		for m, word := range row.want {
+			if len(refused[m]) == 0 || !strings.Contains(strings.Join(refused[m], "\n"), word) {
+				t.Errorf("%s: %s refused with %v, want %q", row.name, m, refused[m], word)
+			}
+		}
+	}
+	// The private network's manifest, which the mesh provides itself, is accepted (moved from mesh-sdk overlay's test).
+	if raw, err := json.Marshal(overlay.Manifest()); err != nil {
+		t.Fatal(err)
+	} else if _, problems := Manifest(raw, nil); len(problems) > 0 {
+		t.Errorf("the provided private network is refused: %v", problems)
+	}
+	shelf := catalogue.Shelf{"nats": {}, "mesh-nats": {}, "a.b": {}}
+	for problem, want := range map[string][]string{
+		"nats removes a stream":                   {"nats"},
+		"mesh-nats reads nats.":                   {"mesh-nats", "nats"},
+		"the state nats.modules and mesh-natsy":   nil,
+		"a.b and a.bc":                            {"a.b"},
+		`"nats" is quoted, (mesh-nats) bracketed`: {"mesh-nats", "nats"},
+	} {
+		if got := Named(problem, shelf); !reflect.DeepEqual(got, want) {
+			t.Errorf("Named(%q) = %v, want %v", problem, got, want)
+		}
+	}
+	if id := Identity(); !strings.HasPrefix(id, "exe:") || id != Identity() {
+		t.Errorf("identity %q", id)
+	}
+	// What cmd/mesh-judge answers the checker (ADR 0578 §2): a composer request in, a verdict out, each manifest accepted
+	// or refused; a manifest left as a digest is a request it cannot run.
+	r := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: "change", Manifests: map[string]composer.Manifest{
+		"a": {Raw: json.RawMessage(`{"module":"a","version":"1"}`)},
+		"b": {Raw: json.RawMessage(`{"module":"b","version":"1","requires":["amqp"]}`)},
+	}}}}
+	v, err := Request(r)
+	if err != nil || v.V != composer.Version || len(v.Cases) != 1 || v.SDK != Identity() || !v.Cases[0].Manifests["a"].Accepted ||
+		v.Cases[0].Manifests["b"].Accepted || !strings.Contains(v.Cases[0].Manifests["b"].Refused, `requires "amqp"`) {
+		t.Fatalf("request: %+v %v", v, err)
+	}
+	r.Cases[0].Manifests["c"] = composer.Manifest{Digest: strings.Repeat("a", 64)}
+	if _, err := Request(r); err == nil {
+		t.Fatal("a manifest left as a digest was judged")
+	}
+}

modules/mesh-delivery-indexer/judge/reads-outside

@@ -0,0 +1 @@
+These tests read files outside this directory: the catalogue and the node-engine captured in the module's testdata/beside (internal/beside).

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-claude-code.module.json

@@ -0,0 +1,249 @@
+{
+  "module": "claude-code",
+  "version": "1",
+  "moved": true,
+  "slug": "agent",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
+  ],
+  "binds": {
+    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
+  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "servers",
+    "holdings",
+    "config",
+    "proposals",
+    "questions",
+    "memory",
+    "waits"
+  ],
+  "reads": [
+    "claude-licence-manager.bindings"
+  ],
+  "tools": [
+    "claude_code_status",
+    "claude_code_render",
+    "claude_code_guard",
+    "claude_code_pull",
+    "claude_code_grant",
+    "claude_code_add_api_key",
+    "claude_code_registrations",
+    "claude_code_memory",
+    "claude_code_mcp_list",
+    "claude_code_mcp_register",
+    "claude_code_mcp_unregister",
+    "claude_code_skill_list",
+    "claude_code_skill_register",
+    "claude_code_skill_unregister",
+    "claude_code_agent_list",
+    "claude_code_agent_register",
+    "claude_code_agent_unregister",
+    "claude_code_command_list",
+    "claude_code_command_register",
+    "claude_code_command_unregister",
+    "claude_code_hook_list",
+    "claude_code_hook_register",
+    "claude_code_hook_unregister",
+    "claude_code_output_style_list",
+    "claude_code_output_style_register",
+    "claude_code_output_style_unregister",
+    "claude_code_instructions_list",
+    "claude_code_instructions_register",
+    "claude_code_instructions_unregister",
+    "claude_code_instructions_propose",
+    "claude_code_proposals",
+    "claude_code_ask",
+    "claude_code_answer",
+    "claude_code_wait",
+    "claude_code_settings_get",
+    "claude_code_settings_set",
+    "claude_code_settings_clear",
+    "claude_code_permission_add",
+    "claude_code_permission_remove",
+    "claude_code_config_list",
+    "claude_code_config_show",
+    "claude_code_config_status",
+    "claude_code_config_import",
+    "claude_code_home_show",
+    "claude_code_home_remove",
+    "claude_code_home_removed",
+    "claude_code_home_restore",
+    "claude_code_judge",
+    "claude_code_judged"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "agent-home",
+        "path": "${dir:agent-home}",
+        "class": "valuable",
+        "why": "the operator's agent's own files: its memory, history and projects"
+      }
+    ]
+  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "claude-code"
+    },
+    {
+      "id": "managed",
+      "type": "directory",
+      "path": "/etc/claude-code",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/claude-agent",
+      "mode": "0755",
+      "template": "files/claude-agent"
+    },
+    {
+      "id": "agent-account-name",
+      "type": "file",
+      "path": "/etc/claude-code/agent-account",
+      "mode": "0644",
+      "template": "files/agent-account"
+    },
+    {
+      "id": "agent-account",
+      "type": "user",
+      "name": "${machine:agent-account}",
+      "home": "${machine:agent-home}",
+      "root": "${machine:agent-root}"
+    },
+    {
+      "id": "agent-home",
+      "type": "directory",
+      "path": "${machine:agent-home}/.claude",
+      "mode": "0700",
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "facts",
+      "type": "file",
+      "path": "${dir:state}/facts.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "template": "files/facts.json"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-code",
+        "binary": "claude-code",
+        "loads": [
+          "claude-code"
+        ],
+        "env": {
+          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
+          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
+          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-dunst.module.json

@@ -0,0 +1,123 @@
+{
+  "module": "dunst",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-notifier",
+      "scope": "node",
+      "serves": [
+        "send",
+        "history"
+      ]
+    }
+  ],
+  "tools": [
+    "dunst_pause",
+    "dunst_resume",
+    "dunst_close_all",
+    "dunst_rules",
+    "dunst_count",
+    "dunst_reload"
+  ],
+    "config": {
+      "font-size": {
+        "type": "number",
+        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+        "minimum": 6,
+        "maximum": 72,
+        "predefined": "font-size",
+        "default": 10
+      },
+      "width": {
+        "type": "number",
+        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
+        "minimum": 50,
+        "maximum": 4000,
+        "default": 250
+      }
+    },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dunst"
+    },
+    {
+      "id": "client",
+      "type": "package",
+      "package": "libnotify"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "dropins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["50-slack.conf"]
+    },
+    {
+      "id": "configuration",
+      "trusted": false,
+      "type": "file",
+      "path": "${machine:account-home}/.config/dunst/dunstrc",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/dunstrc"
+    },
+    {
+      "id": "notifier",
+      "type": "service",
+      "unit": "dunst.service",
+      "scope": "user",
+      "user": "${machine:account}",
+      "reload-on": [
+        "configuration"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dunst-tools",
+        "binary": "dunst-tools",
+        "loads": [
+          "dunst-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "emits": [
+    "action-chosen",
+    "started",
+    "paused"
+  ],
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-dunst.conf"
+    }
+  ]
+}

modules/mesh-delivery-indexer/judge/testdata/catalogue-835bf22b-xterm.module.json

@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}

modules/mesh-delivery-indexer/manifest_test.go

@@ -81,12 +81,13 @@ func TestManifestDeclarations(t *testing.T) { // 1238/AC1, 1444 (reads the build
 	if m.Module != "mesh-delivery-indexer" {
 		t.Errorf("module = %q", m.Module)
 	}
-	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state and says no event.
-	if len(m.Emits) != 0 {
-		t.Errorf("emits = %v, want none", m.Emits)
+	// 1126: placement is the seat mesh-placement's (ADR 0567): the indexer holds no placement state. ADR 0578 §1: it says
+	// a refused manifest as manifest-refused, its one event.
+	if !reflect.DeepEqual(m.Emits, []string{"manifest-refused"}) {
+		t.Errorf("emits = %v, want manifest-refused alone", m.Emits)
 	}
 	// 1126 note 76: heard keeps the last 64 FORGE messages the indexer handled, for indexer_heard.
-	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}}; !reflect.DeepEqual(m.State, want) {
+	if want := []state{{Name: "candidates", History: 10}, {Name: "heard", History: 64}, {Name: "manifests", History: 1}, {Name: "modules", History: 20}, {Name: "predefined", History: 5}, {Name: "config-candidates", History: 5}, {Name: "taken", History: 1}, {Name: "takeins", History: 1}, {Name: "verdicts", History: 5}}; !reflect.DeepEqual(m.State, want) {
 		t.Errorf("state = %+v, want %+v", m.State, want)
 	}
 	if want := []string{"mesh-build-go.toolchains", "mesh-build-node.toolchains", "mesh-delivery-assigner.placement", "mesh-delivery-builder.build-log", "mesh-delivery-checker.previews", "mesh-delivery-gate.source"}; !reflect.DeepEqual(sorted(m.Reads), want) {

modules/mesh-delivery-indexer/module.json

@@ -19,7 +19,11 @@
     { "name": "predefined", "history": 5 },
     { "name": "config-candidates", "history": 5 },
     { "name": "taken", "history": 1 },
-    { "name": "takeins", "history": 1 }
+    { "name": "takeins", "history": 1 },
+    { "name": "verdicts", "history": 5 }
+  ],
+  "emits": [
+    "manifest-refused"
   ],
   "reads": [
     "mesh-build-go.toolchains",

modules/mesh-delivery-indexer/testdata/beside/CAPTURED

@@ -0,0 +1,29 @@
+What a test reads of another repository when no merge check has cloned it beside this one (internal/beside,
+novox/hq issue 432). Copied from the repositories at the commits below, never written by hand. Each
+module.json is kept as module.json.captured: a module.json in this repository is a module of it to the
+forge and the planner, and a merge would build and register it.
+
+The copy carries the catalogue's private details: domains, first names in module names, a node name and
+private addresses. That is acceptable while mesh-sdk is private; if it ever goes public, this copy is
+a second place to clean besides the catalogue itself.
+
+Only what go/catalogue's tests read is captured (R4b, issue 1379), copied here from mesh-sdk with the judge's tests
+(issue 1585). mesh-host refreshed 2026-11-01 from its main, the catalogue 2026-10-21 from its main; before that it
+was mesh-controller's copy, which still held two modules that had left the catalogue.
+
+mesh-catalog  b5dbfbb784507e211372a7c9640d91f7d6dadd84  modules/*/module.json, modules/*/files/**, modules/*/templates/**, predefined.json
+mesh-host     233bb23bbcb1a829ce2a6164a31a5c5cc4f3d950  internal/apply/placement_guard.go
+
+To move them, from mesh-delivery's modules/mesh-delivery-indexer directory, with the two repositories checked out
+beside mesh-delivery:
+
+  rm -rf testdata/beside/mesh-catalog testdata/beside/mesh-host
+  mkdir -p testdata/beside/mesh-catalog testdata/beside/mesh-host/internal/apply
+  git -C ../../../mesh-catalog archive <commit> -- predefined.json ':(glob)modules/*/module.json' \
+    ':(glob)modules/*/files/**' ':(glob)modules/*/templates/**' | tar -x -C testdata/beside/mesh-catalog
+  find testdata/beside -name module.json -exec mv {} {}.captured \;
+  git -C ../../../mesh-host show <commit>:internal/apply/placement_guard.go \
+    > testdata/beside/mesh-host/internal/apply/placement_guard.go.captured
+
+and write the commits here. The placement guard is kept as .captured so no Go tool reads it as this
+repository's code.

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/cursor-index.theme

@@ -0,0 +1,5 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that
+# read neither XCURSOR_THEME nor the X resources.
+[Icon Theme]
+Name=Default
+Inherits=Adwaita

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk-theme

@@ -0,0 +1 @@
+Adwaita:dark

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk2-rc-files

@@ -0,0 +1 @@
+/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-qpa-platformtheme

@@ -0,0 +1 @@
+qt6ct

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-select

@@ -0,0 +1 @@
+6

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-style-override

@@ -0,0 +1 @@
+Fusion

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-size

@@ -0,0 +1 @@
+24

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-theme

@@ -0,0 +1 @@
+Adwaita

modules/mesh-delivery-indexer/testdata/beside/mesh-catalog/modules/adwaita/files/gtk-settings.ini

@@ -0,0 +1,9 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at
+# every push; adwaita_appearance switches dark and light for the running session.
+[Settings]
+gtk-theme-name=Adwaita
+gtk-icon-theme-name=Adwaita
+gtk-cursor-theme-name=Adwaita
+gtk-cursor-theme-size=24
+gtk-font-name=Inter 11
+gtk-application-prefer-dark-theme=1