Merge pull request 'The checker fails any repository's change that adds a binary, in any commit (issue 1577)' (#77) from fix/1577-checker-refuses-binaries into main

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026191742-47a66e3c0dc8
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142434-65ee43f07583
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026191742-47a66e3c0dc8 h1:6OaUWIjcpXOtnu70zeqH0VEaF4oGykrxGpFkaFOzCmY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026191742-47a66e3c0dc8/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142434-65ee43f07583 h1:ikD/ggf9/5k23sxJOX1PFcGzb4M3+QeC66AT0MyQ9Zs=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261026142434-65ee43f07583/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/binaries.go

@@ -0,0 +1,42 @@
+package check
+
+import (
+	"fmt"
+	"strings"
+)
+
+// A change that adds or modifies a compiled program fails (issue 1577): it is build output, `go build` in a module's folder
+// writes one beside go.mod, and `git add -A` takes it. The build module's fetch step, which holds the merged clone, reads the
+// first bytes of each changed file and reports the programs (mesh-sdk buildstep.MergeInto); the checker judges the answer.
+
+// NoProgramsReported is the warning of a build module whose fetch answered no programs field: an older module, which cannot
+// tell, so the check does not refuse a program it did not look for.
+const NoProgramsReported = "the build module did not report programs: a compiled program in the change is not refused"
+
+// checkBinariesOf fails a pull request whose change adds or modifies a compiled program, naming each file. It judges the
+// first fetch answer of the pull request, whichever build module gave it; a build module that reports no programs leaves a
+// warning on the check and passes it.
+func (st *state) checkBinariesOf(t *target) verdictPtr {
+	key := fmt.Sprintf("%s#%d", t.pull.Repository, t.pull.Number)
+	if t.fetched.Merge == "" {
+		return nil // no merge was made: nothing was changed to judge
+	}
+	if t.fetched.Programs == nil {
+		st.c.note(fmt.Sprintf("%s: %s (%s)", key, NoProgramsReported, t.module))
+		st.c.warn(key, fmt.Sprintf("a compiled program is not refused: %s reported no programs", t.module))
+		st.j.logf("%s: %s (%s)", key, NoProgramsReported, t.module)
+		return nil
+	}
+	var found []string
+	for _, p := range *t.fetched.Programs {
+		if p.Commit != "" {
+			found = append(found, fmt.Sprintf("%s: a compiled program added in %s and removed later: it stays in history; squash the branch (issue 1577)", p.Path, short12(p.Commit)))
+			continue
+		}
+		found = append(found, p.Path+": a compiled program is build output: remove it and add it to .gitignore (issue 1577)")
+	}
+	if len(found) > 0 {
+		return failed(t.node, fmt.Sprintf("%s: %s", key, strings.Join(found, "; ")))
+	}
+	return nil
+}

modules/mesh-delivery-checker/internal/check/binaries_test.go

@@ -0,0 +1,63 @@
+package check
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func TestAChangeWhoseFetchReportsProgramsFailsNamingEachFile(t *testing.T) { // 1577
+	prog := func(p ...string) *[]ProgramFile {
+		out := []ProgramFile{}
+		for _, f := range p {
+			path, commit, _ := strings.Cut(f, "@") // `path@commit`: added by a commit of the branch and removed later
+			out = append(out, ProgramFile{Path: path, Kind: "ELF", Commit: commit})
+		}
+		return &out
+	}
+	for _, c := range []struct {
+		name     string
+		programs *[]ProgramFile
+		fail     []string // paths named; none passes
+		warned   bool     // the build module reported no programs field
+	}{
+		{"none found", prog(), nil, false},
+		{"one program", prog("modules/m/m"), []string{"modules/m/m"}, false},
+		{"two programs", prog("a/x", "b/y"), []string{"a/x", "b/y"}, false},
+		{"added and removed in the branch", prog("gone/prog@0123456789abcdef0123"), []string{"gone/prog: a compiled program added in 0123456789ab and removed later: it stays in history; squash the branch (issue 1577)"}, false},
+		{"an older build module reports nothing", nil, nil, true},
+	} {
+		b := newBench(t)
+		b.fetch.Merge, b.fetch.Programs = "mmmm", c.programs
+		cs := caseOf(t, pullOf(repoA, 7, head1))
+		v := b.judge(t, cs).Verdict
+		if got := slices.ContainsFunc(cs.Notes(), func(n string) bool { return strings.Contains(n, NoProgramsReported) }); got != c.warned {
+			t.Errorf("%s: warned = %v, want %v (%v)", c.name, got, c.warned, cs.Notes())
+		}
+		line := Line(v, cs, cs.Pulls[0], nil, nil, nil)
+		if got := strings.Contains(line, "a compiled program is not refused: mesh-build-go reported no programs"); got != c.warned {
+			t.Errorf("%s: the status line holds the warning = %v, want %v: %s", c.name, got, c.warned, line)
+		}
+		if len(c.fail) == 0 {
+			if v.State != delivery.VerdictPass {
+				t.Errorf("%s: verdict = %+v", c.name, v)
+			}
+			continue
+		}
+		if v.State != delivery.VerdictFail {
+			t.Errorf("%s: verdict = %+v, want a failure", c.name, v)
+			continue
+		}
+		for _, p := range c.fail {
+			want := p
+			if !strings.Contains(p, " added in ") {
+				want = p + ": a compiled program is build output: remove it and add it to .gitignore (issue 1577)"
+			}
+			if !strings.Contains(v.Failed.Words, want) {
+				t.Errorf("%s: words %q do not name %s", c.name, v.Failed.Words, p)
+			}
+		}
+	}
+}

modules/mesh-delivery-checker/internal/check/case.go

@@ -43,7 +43,9 @@ type Case struct {
 	Try *TryOptions
 
 	notesMu sync.Mutex
-	notes   []string
+	// warnings are, by pull request, what part of its check did not run (Case.warn).
+	warnings map[string]string
+	notes    []string
 	// asks are the ids of the asks the check put on the build seats' streams, in order: a try names them (Try.Asks).
 	asks []string
 	// Progress says what the check is doing, so a check that ran past its bound names the step it was stuck at.
@@ -186,6 +188,23 @@ func (c *Case) note(s string) {
 	}
 }
 
+// warn says of a pull request (pullKey) that a part of its check did not run, in words for its status line (issue 1577).
+func (c *Case) warn(key, words string) {
+	c.notesMu.Lock()
+	defer c.notesMu.Unlock()
+	if c.warnings == nil {
+		c.warnings = map[string]string{}
+	}
+	c.warnings[key] = words
+}
+
+// Warning is what warn said of a pull request, or "".
+func (c *Case) Warning(key string) string {
+	c.notesMu.Lock()
+	defer c.notesMu.Unlock()
+	return c.warnings[key]
+}
+
 // Notes are the words noted on the case, in the order they were noted.
 func (c *Case) Notes() []string {
 	c.notesMu.Lock()

modules/mesh-delivery-checker/internal/check/failure_words_test.go

@@ -42,7 +42,7 @@ func TestTheStatusLineNamesTheFailureNotTheFirstLoggedLine(t *testing.T) { // 19
 	f := fatalAfterLog()
 	f.Cause = ""
 	v = levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
-	if !strings.HasPrefix(afterHid(v.Failed.Words), "agreement_catalogue_test.go:130") {
+	if !strings.HasPrefix(v.Failed.Words, "agreement_catalogue_test.go:130") {
 		t.Errorf("words = %q", v.Failed.Words)
 	}
 }
@@ -56,45 +56,18 @@ func TestWordsLongerThanTheBoundKeepTheirLastLines(t *testing.T) { // 1901/AC1
 	_ = delivery.VerdictFail
 }
 
-// An older build module sends no "cause": its answer is still accepted and the verdict's words are its output, as before
-// (1901/AC3). A failure that hides its cause (none, or a passing line) is said loudly first in the words and in the status
-// line, naming the build module and the version it says it is, and the level still fails; a failure that keeps the
-// contract is worded as before (1901/AC8).
-func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) { // 1901/AC3, AC8
+// An older build module sends no "cause": its answer is still accepted and the verdict's words are its output, as before.
+func TestAnOlderBuildModulesFailureIsAcceptedWithItsWholeOutput(t *testing.T) { // 1901/AC3
 	old := `{"package":"p","test":"TestX","output":"x_test.go:1: logged\nx_test.go:2: the old kept lines"}`
 	var f Failure
 	if err := json.Unmarshal([]byte(old), &f); err != nil || f.Cause != "" {
 		t.Fatalf("1901/AC3: err = %v, cause = %q", err, f.Cause)
 	}
 	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{f}})
-	if afterHid(v.Failed.Words) != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
+	if v.Failed.Words != "x_test.go:1: logged\nx_test.go:2: the old kept lines" {
 		t.Errorf("1901/AC3: words = %q", v.Failed.Words)
 	}
-	if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.Contains(got, "\n") {
-		t.Errorf("1901/AC3, AC8: status = %q", got)
-	}
-
-	by := "mesh-build-node with mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78"
-	for _, c := range []struct {
-		name, module, by, cause, output, loud string
-	}{
-		{"no cause", "mesh-build-node", by, "", "test/b.test.ts: something", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): it sent no cause"},
-		{"a passing line as its cause", "mesh-build-node", by, "\u2714 the same merge has the same id (8.006913ms)", "", "the build module hid the failure (mesh-build-node at mesh-sdk v0.1.14-0.20261026184535-e40dd0f56a78): its cause is a passing line"},
-		{"from before the contract", "mesh-build-node", "", "", "\u2714 the same merge has the same id (8.006913ms)", "the build module hid the failure (mesh-build-node at a version before the failure contract): it sent no cause"},
-		{"a real cause", "mesh-build-node", by, "one plus one is not three", "not ok 3 - fails", ""},
-	} {
-		t.Run(c.name, func(t *testing.T) {
-			v := levelFailure(&target{module: c.module}, "unit", Tested{By: c.by, Failed: []Failure{{Package: "modules/gitea", Test: "fails", Cause: c.cause, Output: c.output}}})
-			if v.State != delivery.VerdictFail {
-				t.Errorf("1901/AC8: the verdict is %q, want it failed", v.State)
-			}
-			line := firstFailed(*v)
-			switch {
-			case c.loud == "" && strings.Contains(v.Failed.Words, "hid the failure"):
-				t.Errorf("1901/AC8: a failure that keeps the contract is said hidden: %q", v.Failed.Words)
-			case c.loud != "" && (!strings.HasPrefix(v.Failed.Words, c.loud) || !strings.Contains(line, c.loud) || !strings.Contains(v.Failures[0].Words, "hid the failure")):
-				t.Errorf("1901/AC8: words %q, status %q, want both to start with %q", v.Failed.Words, line, c.loud)
-			}
-		})
+	if got := firstFailed(*v); !strings.Contains(got, "logged") || strings.Contains(got, "\n") {
+		t.Errorf("1901/AC3: status = %q", got)
 	}
 }

modules/mesh-delivery-checker/internal/check/judge.go

@@ -489,6 +489,9 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		if v := st.checkPinsOf(ctx, t); v != nil {
 			return v
 		}
+		if v := st.checkBinariesOf(t); v != nil {
+			return v
+		}
 	}
 	ran := 0.0
 	for _, la := range answer.Levels {
@@ -654,12 +657,6 @@ const MaxWords = 4096
 // no cause told apart (an older build module) the cause is the output's first "panic:", "fatal error:" or "signal:"
 // line, read before the output is cut, or the words say the tests passed and the program failed after them.
 func failureWords(f Failure) string {
-	return failureWordsAfter(f, "")
-}
-
-// failureWordsAfter is failureWords with the line loud put first, within the same MaxWords: what the checker itself says of
-// the failure (that the build module hid it), which the status line then names.
-func failureWordsAfter(f Failure, loud string) string {
 	out, passed := dropSummary(strings.TrimSpace(f.Output))
 	cause := strings.TrimSpace(f.Cause)
 	if cause == "" {
@@ -675,14 +672,11 @@ func failureWordsAfter(f Failure, loud string) string {
 	if len(cause) > MaxCause {
 		cause = strings.ToValidUTF8(cause[:MaxCause], "") + "..."
 	}
-	// The words keep MaxWords exactly: the loud line, the cause and their newlines, the marker and the kept lines.
+	// The words keep MaxWords exactly: the cause and its newline, the marker and the kept lines (review round 1).
 	budget := MaxWords
 	if cause != "" {
 		budget -= len(cause) + 1
 	}
-	if loud != "" {
-		budget -= len(loud) + 1
-	}
 	if len(out) > budget {
 		const marker = "... "
 		tail := out[len(out)-(budget-len(marker)):]
@@ -695,31 +689,9 @@ func failureWordsAfter(f Failure, loud string) string {
 	if cause != "" && !strings.HasPrefix(firstLine(out), cause) {
 		out = strings.TrimRight(cause+"\n"+out, "\n")
 	}
-	if loud != "" {
-		out = strings.TrimRight(loud+"\n"+out, "\n")
-	}
 	return out
 }
 
-// hidWords is the checker's loud line for a failure the build module sent hiding its cause (issue 1901, its thorough
-// fix): with no cause, or a passing line as its cause, under the failure contract (buildstep.Hidden). It names the build
-// module and the version it says it is (Tested.By, "<module> with mesh-sdk <version>"); one from before the contract
-// says nothing of itself. "" when the failure keeps the contract. The check fails either way: only its words change.
-func hidWords(module, by string, f Failure) string {
-	why := buildstep.Hidden(f)
-	if why == "" {
-		return ""
-	}
-	version := "a version before the failure contract"
-	if module == "" {
-		module = "an unnamed build module"
-	}
-	if m, v, ok := strings.Cut(by, " with "); ok && m != "" {
-		module, version = m, v
-	}
-	return fmt.Sprintf("the build module hid the failure (%s at %s): %s", module, version, why)
-}
-
 // MaxCause is the most a cause in a failure's words holds: one long line (the 1901 review: a cause of a kilobyte could
 // push the words past MaxWords).
 const MaxCause = 1024
@@ -806,7 +778,7 @@ func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict
 			if t.module == buildrun.NodeBuildModule && f.Package == "" {
 				name = res.Module
 			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f))})
+			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWords(f)})
 		}
 	}
 	if len(all) == 0 { // no result: a level said failed with nothing to name

modules/mesh-delivery-checker/internal/check/line.go

@@ -87,18 +87,20 @@ type pieces struct {
 	judged string
 	// carried says, of a carried verdict, the commits it was carried from (ADR 0548 §8); never dropped.
 	carried string
+	// warning says that a part of the check did not run, for instance that an older build module could not refuse a compiled program; never dropped.
+	warning string
 }
 
 // pullKey names a pull request of a case: `<owner/repo>#<number>`.
 func pullKey(p Pull) string { return fmt.Sprintf("%s#%d", p.Repository, p.Number) }
 
 func (p pieces) join(drop int) string {
-	parts := []string{p.head, p.commits, p.carried, p.counts, p.judged}
+	parts := []string{p.head, p.commits, p.carried, p.warning, p.counts, p.judged}
 	switch {
 	case drop < 3 && p.times != "":
 		parts = append(parts, p.times)
 	case drop == 3 && p.shortTimes != "":
-		parts = []string{p.head, p.commits, p.carried, p.shortCounts, p.judged, p.shortTimes}
+		parts = []string{p.head, p.commits, p.carried, p.warning, p.shortCounts, p.judged, p.shortTimes}
 	}
 	if p.over != "" {
 		parts = append(parts, p.over)
@@ -210,6 +212,9 @@ func carriedWords(from map[string]string, v delivery.Verdict, cs *Case, p Pull)
 func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) pieces {
 	var pc pieces
 	pc.judged = judged[pullKey(p)]
+	if cs != nil {
+		pc.warning = cs.Warning(pullKey(p))
+	}
 	commits := short12(p.Head) + " on " + short12(p.Trunk)
 	switch v.State {
 	case delivery.VerdictRunning:

modules/mesh-delivery-checker/internal/check/package_cause_test.go

@@ -38,11 +38,11 @@ func TestAPackageFailureIsNeverWordedPass(t *testing.T) { // 1901/AC5
 					t.Errorf("1901/AC5: the words keep %q: %q", l, v.Failed.Words)
 				}
 			}
-			if !strings.HasPrefix(afterHid(v.Failed.Words), c.want) {
-				t.Errorf("1901/AC5: words after the loud line start %q, want %q", firstLine(afterHid(v.Failed.Words)), c.want)
+			if !strings.HasPrefix(v.Failed.Words, c.want) {
+				t.Errorf("1901/AC5: words start %q, want %q", firstLine(v.Failed.Words), c.want)
 			}
-			if got := firstFailed(*v); !strings.Contains(got, "the build module hid the failure") || strings.HasSuffix(got, ": PASS") {
-				t.Errorf("1901/AC5, AC8: status = %q", got)
+			if got := firstFailed(*v); !strings.Contains(got, c.want) || strings.HasSuffix(got, ": PASS") {
+				t.Errorf("1901/AC5: status = %q", got)
 			}
 		})
 	}
@@ -63,7 +63,7 @@ func TestALongCauseIsCutToALinesBound(t *testing.T) { // 1901/AC5
 func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901/AC5
 	for _, out := range []string{"FAIL\texample.com/timeout\t2.017s", "FAIL\texample.com/exiting\t0.006s", "FAIL\texample.com/killed\t0.006s"} {
 		v := levelFailure(&target{}, "integration", Tested{Failed: []Failure{{Package: "example.com/x", Output: out}}})
-		if !strings.HasPrefix(afterHid(v.Failed.Words), "the package failed with no test to name and no panic, signal or build error in its output") {
+		if !strings.HasPrefix(v.Failed.Words, "the package failed with no test to name and no panic, signal or build error in its output") {
 			t.Errorf("1901/AC5: %q is worded %q", out, v.Failed.Words)
 		}
 	}
@@ -74,7 +74,7 @@ func TestAPackageStoppedWithOnlyItsFailLineIsStillWorded(t *testing.T) { // 1901
 func TestOnlyGosExactFormsAreSummaryOrCause(t *testing.T) { // 1901/AC5
 	out := "    x_test.go:3: ok so far\nok then: the seat is free\n        panic: child retried and recovered\npanic: the real one\nFAIL\tp\t1.0s"
 	v := levelFailure(&target{}, "unit", Tested{Failed: []Failure{{Package: "p", Output: out}}})
-	if !strings.HasPrefix(afterHid(v.Failed.Words), "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
+	if !strings.HasPrefix(v.Failed.Words, "panic: the real one") || !strings.Contains(v.Failed.Words, "ok then: the seat is free") {
 		t.Errorf("1901/AC5: words = %q", v.Failed.Words)
 	}
 }
@@ -90,13 +90,3 @@ func TestTheWordsKeepTheirBoundExactly(t *testing.T) { // 1901/AC5
 		}
 	}
 }
-
-// afterHid is a verdict's words after the checker's loud line, which a failure with no cause from an older build module
-// now starts with (1901/AC8).
-func afterHid(w string) string {
-	if strings.HasPrefix(w, "the build module hid the failure") {
-		_, rest, _ := strings.Cut(w, "\n")
-		return rest
-	}
-	return w
-}

modules/mesh-delivery-checker/internal/check/results.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"strings"
 
-	"git.novox.be/novox/mesh-sdk/go/buildstep"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 )
 
@@ -45,6 +44,17 @@ type Fetched struct {
 	Conflicts []string             `json:"conflicts,omitempty"`
 	Changed   []string             `json:"changed,omitempty"`
 	Trees     map[string]MergeTree `json:"trees,omitempty"`
+	// Programs are the changed files whose first bytes are an executable binary, read by the build module in its workspace
+	// (issue 1577); nil for a build module that does not report it, a pointer to an empty list for one that found none.
+	Programs *[]ProgramFile `json:"programs,omitempty"`
+}
+
+// ProgramFile is a changed file that is a compiled program, and its format (ELF, Mach-O or PE).
+type ProgramFile struct {
+	Path string `json:"path"`
+	Kind string `json:"kind"`
+	// Commit is set for a program a commit of the branch added and a later one removed: it stays in history once merged.
+	Commit string `json:"commit,omitempty"`
 }
 
 // GoPackage is one package of a Go test result.
@@ -59,9 +69,14 @@ type GoPackage struct {
 	Skipped int `json:"skipped,omitempty"`
 }
 
-// Failure is a test that failed, or a package that failed with no test to name: the build modules' failure contract
-// (buildstep.Failure, issue 1901), its cause never empty and never a passing line from a build module that keeps it.
-type Failure = buildstep.Failure
+// Failure is a test that failed, or a package that failed with no test to name.
+type Failure struct {
+	Package string `json:"package"`
+	Test    string `json:"test,omitempty"`
+	Output  string `json:"output,omitempty"`
+	// Cause is the first line of what the test reported as its error, when the build module told it apart (issue 1901).
+	Cause string `json:"cause,omitempty"`
+}
 
 // TestTime is one test and the seconds it took.
 type TestTime struct {
@@ -94,9 +109,6 @@ type Tested struct {
 	// JudgedBy is the program that ran the step (ADR 0535 §5): "installed", or "candidate <merge commit>" under runner
 	// workspace; absent from a build module that does not take the runner.
 	JudgedBy string `json:"judged_by,omitempty"`
-	// By is the build module that answered and the SDK it was built with (buildstep.By); absent from a build module from
-	// before the failure contract.
-	By string `json:"by,omitempty"`
 }
 
 // Digested is the answer of the Go build module's digest step: one digest per package that has tests at the level, by import

modules/mesh-delivery-checker/internal/check/testdata/captured/README

@@ -10,7 +10,7 @@ TestFetchWithABaseMergesAndAnswersThePreview and TestFetchWithAConflictEndsPasse
 into a throwaway test that wrote them out, at mesh-catalog feat/r4c5-checker d5804927 (the git commands are the test's fake,
 so the shas are its constants; the shape and the field names are the module's own marshalling). node-fetch-clean.json is the
 FetchResult json.Marshal of mesh-build-node's fetch (fetch.go, preview.go) in its test TestFetchWithABaseMergesAndAnswersThePreview
-(cmd/mesh-build-node/preview_test.go) at the same commit. Captured on 2026-10-21 for issue 1679.
+(cmd/mesh-build-node/preview_test.go) at the same commit. Captured on 2026-10-21 for issue 1679. Both clean fetches carry `"programs":[]`, which a merging fetch of the build modules answers since issue 1577 (mesh-sdk buildstep.MergeInto's Programs), added by hand to the captured bytes: a fixture without it is an older build module's, and its line warns that no compiled program is refused.
 
 forge-get-file-go-mod.json is the answer of the forge's gitea_get_file (mesh-catalog modules/gitea, tools/index.ts) for modules/mesh-delivery-builder/go.mod of
 novox/mesh-delivery at main, and forge-compare-trunk.json the answer of gitea_compare for novox/mesh-sdk base main, head cb54756c3865 (a commit on the

modules/mesh-delivery-checker/internal/check/testdata/captured/go-fetch-clean.json

@@ -1 +1 @@
-{"workspace":"mvii1iwu5414e4","commit":"0123456789abcdef0123456789abcdef01234567","modules":["."],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"fedcba9876543210fedcba9876543210fedcba98","changed":["a.go","modules/m/main.go"],"trees":{"modules/m":{"tree":"1111111111111111111111111111111111111111","manifest":"ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356","locks":{"go.sum":"c5fc83c01e92404452b986527d239140ccf9a48b88e0c268fbf38c2e1429e9c9"}}}}
+{"workspace":"mvii1iwu5414e4","commit":"0123456789abcdef0123456789abcdef01234567","modules":["."],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"fedcba9876543210fedcba9876543210fedcba98","changed":["a.go","modules/m/main.go"],"programs":[],"trees":{"modules/m":{"tree":"1111111111111111111111111111111111111111","manifest":"ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356","locks":{"go.sum":"c5fc83c01e92404452b986527d239140ccf9a48b88e0c268fbf38c2e1429e9c9"}}}}

modules/mesh-delivery-checker/internal/check/testdata/captured/node-fetch-clean.json

@@ -1 +1 @@
-{"workspace":"mvii1sxt979f67","commit":"0123456789abcdef0123456789abcdef01234567","modules":["modules/m"],"installed":[],"refused":[],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"0123456789abcdef0123456789abcdef01234567","changed":["modules/m/package.json"],"trees":{"modules/m":{"tree":"0123456789abcdef0123456789abcdef01234567","manifest":"0581b699d9d05517e69b21f5cedbeb2eee8aba2b205280b561be731594d7feef"}}}
+{"workspace":"mvii1sxt979f67","commit":"0123456789abcdef0123456789abcdef01234567","modules":["modules/m"],"installed":[],"refused":[],"base":"abcdef0123456789abcdef0123456789abcdef01","merge":"0123456789abcdef0123456789abcdef01234567","changed":["modules/m/package.json"],"programs":[],"trees":{"modules/m":{"tree":"0123456789abcdef0123456789abcdef01234567","manifest":"0581b699d9d05517e69b21f5cedbeb2eee8aba2b205280b561be731594d7feef"}}}