Pin the group's mesh-sdk head, whose step log goes quiet after one failed publish

Recovery of photos and link2pay on novox, 2026-10-29: their composition and grant were lost and no tool wrote a done key again.
Quick fix: rewrite the done key unchanged as a new revision. Thorough fix: ADR 0547, the node agent composes its own and the
assigner stops waiting on controller compositions (design 47).

modules/mesh-delivery-assigner/cmd/mesh-delivery-assigner/pass.go

@@ -40,6 +40,9 @@ type passer struct {
 	// noWant is, by node and module, the reason last said why the node gets no want for the module (issue 1945): a reason is
 	// said in the journal when it appears or changes, and its clearing when the node has a want again; one line per change.
 	noWant map[string]string
+	// unreached is, by node and module, the words last said why a wanted module may not be reached there (issue 1960: its
+	// provider is down, which holds no want): said once per words, and once more when it is reached again.
+	unreached map[string]string
 	// nodeFailed is, by node and module, the words of the condition last raised for a failure that is the node's own (ADR 0557
 	// §1, issue 1496): raised once per words, cleared once when it ends.
 	nodeFailed map[string]string
@@ -196,6 +199,7 @@ func (p *passer) wants(ctx context.Context) {
 		gatherNeither(neither, name, out)
 		leftNeither(left, m, wanted[name], out)
 		p.sayNoWant(name, m.Nodes, wanted[name], out)
+		p.sayUnreached(name, m.Nodes, out)
 		p.sayNodeFailed(name, fp, m.Nodes, nodes, out, first)
 		if first {
 			startClears(stale, m, out)
@@ -274,6 +278,26 @@ func (p *passer) sayNoWant(module string, nodes []string, before map[string]deli
 	}
 }
 
+// sayUnreached says in the journal, once per words, that a module is wanted on a node and may not be reached there, since
+// no provider of what it requires runs healthy (rule 5, which holds no want: issue 1960), and once when it is reached again.
+func (p *passer) sayUnreached(module string, nodes []string, out assign.Outcome) {
+	if p.unreached == nil {
+		p.unreached = map[string]string{}
+	}
+	for _, node := range nodes {
+		key := node + "." + module
+		why, last := out.Unreached[node], p.unreached[key]
+		switch {
+		case why != "" && why != last:
+			p.logf("%s on %s is wanted and may not be reached: %s", module, node, why)
+			p.unreached[key] = why
+		case why == "" && last != "":
+			p.logf("%s on %s is reached: its providers run healthy", module, node)
+			delete(p.unreached, key)
+		}
+	}
+}
+
 // sayNodeFailed raises, once per node and words, the condition of a failed health check of a module's newest fingerprint fp
 // that is the node's own, since fp runs healthy elsewhere and is not held (ADR 0557 §1, issue 1496), and says it in the journal;
 // it clears the condition once when the node no longer fails alone, or is no longer one of the module's nodes. The first pass

modules/mesh-delivery-assigner/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-assigner
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-assigner/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff h1:EHuM+ed+/M9woMZsMou6/2xm6hIdb1YCFINprrP54Ys=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028212605-77b48a4f1aff/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-assigner/internal/assign/wants.go

@@ -89,14 +89,15 @@ func Canary(nodes []string, online map[string]bool) string {
 
 // Holds is whether every rule holds for moving node's want for m to m.FP, and if not, the first rule that does not,
 // with why (ADR 0429 §6). Rule 4, at most `step` others ahead, always holds: the mesh keeps no step, and step 0 is no
-// limit (ADR 0528 clause 3).
+// limit (ADR 0528 clause 3). Rule 5, every provider healthy, holds no want (issue 1960): a module whose provider is down
+// is wanted all the same, and said as not reached (Unreached), since a site runs while the proxy in front of it is
+// down and one module never blocks another.
 func Holds(m Module, node string, n Nodes) (bool, int, string) {
 	return holds(m, node, n, true)
 }
 
-// holds is Holds; with ordering false it leaves out the two rules that order a move among nodes and modules, the canary (3)
-// and the providers (5), and keeps those without which there is nothing to want: the build done, not held, the grant and the
-// composition.
+// holds is Holds; with ordering false it leaves out the canary (3), which orders a move among nodes, and keeps those
+// without which there is nothing to want: the build done, not held, the grant and the composition.
 func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 	switch {
 	case !m.Built:
@@ -112,11 +113,6 @@ func holds(m Module, node string, n Nodes, ordering bool) (bool, int, string) {
 		case node != canary && !healthy(n.Haves[canary][m.Name], m.FP):
 			return false, delivery.RuleCanary, fmt.Sprintf("the canary %s does not run %s healthy yet", canary, short(m.FP))
 		}
-		for _, provision := range m.Manifest.Requires {
-			if ok, why := providedHealthy(provision, node, n); !ok {
-				return false, delivery.RuleProviders, why
-			}
-		}
 	}
 	if !m.Granted {
 		return false, delivery.RuleGrant, fmt.Sprintf("the controller has not issued the credential of %s for %s", m.Name, short(m.FP))
@@ -157,6 +153,17 @@ func providedHealthy(provision, node string, n Nodes) (bool, string) {
 	return false, fmt.Sprintf("no provider of %s runs healthy on %s or at its canary", provision, node)
 }
 
+// unreached is why m on node may be wanted and not reached: the first provision it requires that no provider runs
+// healthy on node or at its canary (rule 5, said and never holding a want; issue 1960); empty when all do.
+func unreached(m Module, node string, n Nodes) string {
+	for _, provision := range m.Manifest.Requires {
+		if ok, why := providedHealthy(provision, node, n); !ok {
+			return why
+		}
+	}
+	return ""
+}
+
 // keepsData says whether a module holds data a set-back would lose: an own item of a class that keeps (irreplaceable,
 // valuable or rebuildable; cache and none do not).
 func keepsData(m catalogue.Manifest) bool {
@@ -186,6 +193,9 @@ type Outcome struct {
 	Restore []string
 	// Rules is, by node, the rule holding the node back from m.FP and why.
 	Rules map[string]Holding
+	// Unreached is, by node, why the module may be wanted there and not reached: no provider of a provision it requires runs
+	// healthy (rule 5, issue 1960). It holds no want back; the pass says it.
+	Unreached map[string]string
 	// Neither is, by node, the nodes the module is assigned to that run it (or whose have names it), hold no want for it after this
 	// pass and are not held (a held module is on the held list), with the rule holding the first want back: the node's own composition does not hold a module with a fingerprint of the new form, so such a module is on
 	// neither list and nothing applies it on that node (issue 1945). A module with no fingerprint of the new form goes with the node's
@@ -301,26 +311,33 @@ func Wants(m Module, n Nodes, wants map[string]delivery.Want, lastHealthy map[st
 		}
 		ok, rule, words := Holds(mm, node, n)
 		target := m.FP
-		if have, ran := n.Haves[node][m.Name]; !ok && (!had || before.Removed) && (rule == delivery.RuleCanary || rule == delivery.RuleProviders) && runs(have) {
-			// A node that runs the module and has no want for it has no want the ordering rules could hold it back to: holding its first
-			// want back leaves the module on neither list, since the node's own composition gives up every module with a fingerprint of
-			// the new form (issue 1945: on g14 the bundles of clipmenu, screen-lock and every module requiring x11-display were removed
-			// and never made again, because xorg's health is unknown and screen-lock's canary never ran it healthy). Its first want names
-			// what it runs, never a newer fingerprint, so the canary is never passed over: F when it runs F (by the rules without which
-			// there is nothing to want), or an older fingerprint of the new form whose composition and grant exist. Rules 3 and 5 then
-			// order the move from it as from any want.
-			switch _, composed := m.composition(node, have.FP); {
-			case !ran:
-			case have.FP == m.FP:
-				ok, rule, words = holds(mm, node, n, false)
-			case !strings.HasPrefix(have.FP, delivery.SourcePrefix2):
-				// An old-form build (not src2:) has no composition, so no want can ever name it: its first want names F, and only by every
-				// rule as usual, the canary (3) and the providers (5) included, which here hold it back. Nothing is written and the module
-				// stays on neither list until the canary runs F healthy; then Holds passes and the want names F (issue 1945, a design
-				// limit set by the lead: the canary stays in force and old-form modules leave neither list by themselves).
-			case composed && m.GrantedAt != nil && m.GrantedAt(have.FP):
-				ok, target = true, have.FP
+		if have, ran := n.Haves[node][m.Name]; !ok && (!had || before.Removed) && rule == delivery.RuleCanary {
+			// The canary orders a move, never the first want of a node that does not run the module (issue 1960: de-spiegel,
+			// link2pay and photos on novox were left with no want). A node that runs an older fingerprint of the new form,
+			// composed and granted, gets its first want at what it runs, and rule 3 then orders its move to F as from any want.
+			// A node that runs an old-form build, which no want can name, stays under the canary (issue 1945, a design limit):
+			// its first want names F once the canary runs F healthy. Any other node that runs it (F itself, or an older
+			// fingerprint with no composition or grant) gets F by the rules without which there is nothing to want.
+			older := ran && runs(have) && have.FP != m.FP && strings.HasPrefix(have.FP, delivery.SourcePrefix2)
+			if older {
+				_, composed := m.composition(node, have.FP)
+				older = composed && m.GrantedAt != nil && m.GrantedAt(have.FP)
 			}
+			oldForm := ran && runs(have) && have.FP != m.FP && !strings.HasPrefix(have.FP, delivery.SourcePrefix2)
+			switch {
+			case older:
+				ok, target = true, have.FP
+			case oldForm:
+				// held back by rule 3 as written: on neither list until the canary runs F healthy
+			default:
+				ok, rule, words = holds(mm, node, n, false)
+			}
+		}
+		if why := unreached(m, node, n); why != "" {
+			if out.Unreached == nil {
+				out.Unreached = map[string]string{}
+			}
+			out.Unreached[node] = why
 		}
 		if ok && target == m.FP && len(out.NodeFailed) > 0 && !(had && !before.Removed && before.FP == m.FP) &&
 			n.Haves[node][m.Name].FP != m.FP {

modules/mesh-delivery-assigner/internal/assign/wants_test.go

@@ -65,9 +65,6 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		delivery.RuleCanary: func(_ *Module, n *Nodes) {
 			n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
 		},
-		delivery.RuleProviders: func(_ *Module, n *Nodes) {
-			n.Haves["ace"]["store"] = delivery.Have{FP: fpOf('s'), Phase: delivery.PhaseRunning, Health: delivery.HealthWaits}
-		},
 		delivery.RuleGrant: func(m *Module, _ *Nodes) { m.Granted = false },
 		delivery.RuleComposed: func(m *Module, _ *Nodes) {
 			m.Composed = func(string, string) (delivery.ComposedDigest, bool) { return delivery.ComposedDigest{}, false }
@@ -86,6 +83,50 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 			t.Errorf("rule %d broken: g14's want is %+v", rule, w)
 		}
 	}
+	// 1960: rule 5 holds no want, and no module is left without a first want for a provider down or a node offline; the
+	// provider down is said (Unreached). novox on 2026-10-29: route-proxy down held de-spiegel and link2pay, minio not
+	// healthy held photos, and novox offline left a module with no canary.
+	for _, c := range []struct {
+		name, module, provision, provider string
+		have                              *delivery.Have // what novox runs of the module; nil: a new assignment
+		before                            map[string]delivery.Want
+		online                            bool
+		want                              string
+	}{
+		{"de-spiegel, route-proxy down, old form", "de-spiegel", "route", "route-proxy",
+			&delivery.Have{FP: "build-1", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}, nil, true, fNew},
+		{"link2pay, route-proxy down, new assignment", "link2pay", "route", "route-proxy", nil, nil, true, fNew},
+		{"photos, minio not healthy, moving its want", "photos", "s3-bucket", "minio",
+			&delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK},
+			map[string]delivery.Want{"novox": {FP: fOld, Composed: dig(fOld)}}, true, fNew},
+		{"novox offline, no canary, new assignment", "link2pay", "route", "route-proxy", nil, nil, false, fNew},
+		{"novox offline, no canary, moving its want", "photos", "s3-bucket", "minio",
+			&delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK},
+			map[string]delivery.Want{"novox": {FP: fOld, Composed: dig(fOld)}}, false, fOld},
+	} {
+		m := Module{Name: c.module, FP: fNew, Built: true, Granted: true, Composed: composedEverywhere, Nodes: []string{"novox"},
+			Manifest: catalogue.Manifest{Module: c.module, Requires: []string{c.provision}}}
+		n := Nodes{Online: map[string]bool{"novox": c.online}, Haves: map[string]map[string]delivery.Have{"novox": {
+			c.provider: {FP: fpOf('p'), Phase: delivery.PhaseFailed, Health: delivery.HealthFailed}}},
+			Providers: map[string]map[string][]string{c.provision: {c.provider: {"novox"}}}}
+		if c.have != nil {
+			n.Haves["novox"][c.module] = *c.have
+		}
+		out := Wants(m, n, c.before, nil)
+		w, written := out.Wants["novox"]
+		if !written {
+			w = c.before["novox"]
+		}
+		if w.FP != c.want || w.Removed {
+			t.Errorf("%s: novox's want = %+v, want %s", c.name, w, short(c.want))
+		}
+		if _, on := out.Neither["novox"]; on {
+			t.Errorf("%s: on neither list: %+v", c.name, out.Neither)
+		}
+		if c.online && !strings.Contains(out.Unreached["novox"], c.provision) {
+			t.Errorf("%s: the provider down is not said: %q", c.name, out.Unreached["novox"])
+		}
+	}
 
 	// 1126/AC-SW1, AC-SW2, AC-SW3: a want written Self while g14 was placed, kept by a rule after the placement is gone, names
 	// the controller's composition of the fingerprint the rule keeps (on 2026-10-27 g14's systemd-resolved, held, and forticlient,
@@ -108,7 +149,7 @@ func TestEachRuleHoldsTheWantBack(t *testing.T) {
 		{name: "rule 5 at F", before: fNew, set: func(m *Module, n *Nodes) {
 			atF(m, n)
 			n.Haves["ace"]["store"] = delivery.Have{FP: fpOf('s'), Phase: delivery.PhaseRunning, Health: delivery.HealthWaits}
-		}, want: delivery.Want{FP: fNew, Composed: dig(fNew)}, rule: delivery.RuleProviders},
+		}, want: delivery.Want{FP: fNew, Composed: dig(fNew)}},
 		{name: "rule 3 at F", before: fNew, set: func(m *Module, n *Nodes) {
 			atF(m, n)
 			n.Haves["ace"]["mail"] = delivery.Have{FP: fOld, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
@@ -962,10 +1003,12 @@ func x11() (Module, Nodes) {
 func TestANodeRunningAModuleWithNoWantGetsItsFirstWantAtWhatItRuns(t *testing.T) {
 	m, n := x11()
 	out := Wants(m, n, nil, nil)
-	for _, node := range []string{"g14", "shanks"} {
-		if w := out.Wants[node]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule == 0 {
-			t.Errorf("%s's want = %+v, want its first want at the fingerprint it runs, held back from F", node, w)
-		}
+	// 1960: the providers rule holds no want: the canary g14 gets F, its provider's health unknown said
+	if w := out.Wants["g14"]; w.FP != fNew || out.Unreached["g14"] == "" {
+		t.Errorf("g14's want = %+v (unreached %q), want F, the provider said", w, out.Unreached["g14"])
+	}
+	if w := out.Wants["shanks"]; w.FP != fOld || w.Composed != dig(fOld) || w.Newest != fNew || w.Rule != delivery.RuleCanary {
+		t.Errorf("shanks's want = %+v, want its first want at the fingerprint it runs, held back from F by the canary", w)
 	}
 	if len(out.Neither) != 0 {
 		t.Errorf("left on neither list: %+v", out.Neither)
@@ -1003,11 +1046,22 @@ func TestNoFirstWantWithoutTheCompositionAndGrantOfWhatItRuns(t *testing.T) {
 		m, n := x11()
 		change(&m, &n)
 		out := Wants(m, n, nil, nil)
-		if w, ok := out.Wants["shanks"]; ok {
-			t.Errorf("%s: shanks got a want: %+v", what, w)
+		if what == "an old-form build" {
+			// the canary g14 does not run F healthy: no want, on neither list by rule 3 (issue 1945)
+			if w, ok := out.Wants["shanks"]; ok {
+				t.Errorf("%s: shanks got a want: %+v", what, w)
+			}
+			if h, ok := out.Neither["shanks"]; !ok || h.Rule != delivery.RuleCanary {
+				t.Errorf("%s: shanks on neither list = %+v (named %v), want rule 3", what, h, ok)
+			}
+			continue
 		}
-		if h, ok := out.Neither["shanks"]; !ok || h.Rule == 0 {
-			t.Errorf("%s: shanks on neither list = %+v (named %v)", what, h, ok)
+		// 1960: no want can name what it runs, so its first want names F rather than none: never on neither list
+		if w := out.Wants["shanks"]; w.FP != fNew {
+			t.Errorf("%s: shanks's want = %+v, want F", what, w)
+		}
+		if h, ok := out.Neither["shanks"]; ok {
+			t.Errorf("%s: shanks on neither list = %+v", what, h)
 		}
 	}
 	m, n := x11()
@@ -1016,10 +1070,12 @@ func TestNoFirstWantWithoutTheCompositionAndGrantOfWhatItRuns(t *testing.T) {
 	if len(out.Neither) != 0 {
 		t.Errorf("nodes holding a want named on neither list: %+v", out.Neither)
 	}
-	for node, w := range out.Wants {
-		if w.FP != fOld {
-			t.Errorf("%s's want moved from its want past the ordering rules: %+v", node, w)
-		}
+	// the canary g14 moves to F (its provider's health no rule); shanks waits for it
+	if w := out.Wants["shanks"]; w.FP != "" && w.FP != fOld {
+		t.Errorf("shanks's want moved from its want past the canary: %+v", w)
+	}
+	if w := out.Wants["g14"]; w.FP != fNew {
+		t.Errorf("the canary g14's want = %+v, want F", w)
 	}
 }
 
@@ -1030,11 +1086,12 @@ func TestANewAssignmentWaitingIsNotOnNeitherList(t *testing.T) {
 	m, n := x11()
 	delete(n.Haves["shanks"], "screen-lock")
 	out := Wants(m, n, nil, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("a new assignment waiting for the canary got a want: %+v", w)
+	// 1960: the canary orders moves, never a first want: the new assignment is wanted at F
+	if w := out.Wants["shanks"]; w.FP != fNew {
+		t.Errorf("a new assignment while the canary does not run F: %+v, want F", w)
 	}
 	if _, ok := out.Neither["shanks"]; ok {
-		t.Errorf("a new assignment waiting for the canary is named on neither list: %+v", out.Neither)
+		t.Errorf("a new assignment is named on neither list: %+v", out.Neither)
 	}
 	m.Built = false
 	if out := Wants(m, n, nil, nil); len(out.Neither) != 1 || out.Neither["g14"].Rule != delivery.RuleBuildDone {
@@ -1076,7 +1133,7 @@ func TestANewAssignmentWaitingIsNotOnNeitherList(t *testing.T) {
 // 1945/AC21: a node whose have names an old-form build (no fingerprint of the new form, so no composition of it) can never be
 // named in a want at what it runs; its first want names F, under the canary rule as usual and with everything F needs and the
 // providers rule. Given the canary runs F healthy, shanks's first want names F; given it does not yet, shanks gets no want and
-// stays on neither list. The old-form node that is itself the canary gets F once its providers run healthy.
+// stays on neither list; the providers hold no want (issue 1960). The old-form node that is itself the canary gets F once its providers run healthy.
 func TestAnOldFormNodeGetsItsFirstWantAtFOnlyUnderTheCanary(t *testing.T) {
 	oldForm := func(n Nodes, node string) {
 		n.Haves[node]["screen-lock"] = delivery.Have{FP: "build-1792260876956849831", Phase: delivery.PhaseRunning, Health: delivery.HealthUnknown}
@@ -1110,16 +1167,16 @@ func TestAnOldFormNodeGetsItsFirstWantAtFOnlyUnderTheCanary(t *testing.T) {
 	if h, ok := out.Neither["shanks"]; !ok || h.Rule != delivery.RuleCanary {
 		t.Errorf("canary not healthy on F: shanks on neither list = %+v (named %v), want rule 3", h, ok)
 	}
-	// the canary healthy on F but the providers not healthy on shanks: rule 5 still holds it back
+	// 1960: the canary healthy on F but the providers not healthy on shanks: F all the same, the provider down said
 	m, n = x11()
 	oldForm(n, "shanks")
 	n.Haves["g14"]["screen-lock"] = delivery.Have{FP: fNew, Phase: delivery.PhaseRunning, Health: delivery.HealthOK}
 	out = Wants(m, n, nil, nil)
-	if w, ok := out.Wants["shanks"]; ok {
-		t.Errorf("providers not healthy: shanks got a want: %+v", w)
+	if w := out.Wants["shanks"]; w.FP != fNew || out.Unreached["shanks"] == "" {
+		t.Errorf("providers not healthy: shanks's want = %+v (unreached %q), want F, the provider said", w, out.Unreached["shanks"])
 	}
-	if h := out.Neither["shanks"]; h.Rule != delivery.RuleProviders {
-		t.Errorf("providers not healthy: shanks on neither list = %+v, want rule 5", h)
+	if _, on := out.Neither["shanks"]; on {
+		t.Errorf("providers not healthy: shanks on neither list: %+v", out.Neither)
 	}
 	// F not granted: nothing, even with the canary healthy
 	m, n = x11()

modules/mesh-delivery-builder/cmd/mesh-delivery-builder-tools/main.go

@@ -94,6 +94,34 @@ func Tools(r build.StuckReader, askAgain func(key string, value []byte) error, q
 				return map[string]any{"key": key, "revision": r.Revision, "asks": r.Asks, "answer": r.Answer,
 					"next": build.StuckTool + " shows the key and its asks while they wait"}, nil
 			}},
+		{Name: build.AnnounceAgainTool,
+			Description: "Announce a done build again (take in again, compose again): the builder writes the done key of module and fingerprint " +
+				"again, unchanged, as a new revision of the same key (its content, artifacts and manifest stay identical), so the controller's " +
+				"take-in hears it and composes the module and writes its grant again. Use it when a done build was taken in but its composition " +
+				"or grant is gone and every want is refused for it. Answers the new revision. Refuses a key that is not done: " + build.BuildAgainTool +
+				" builds a failed key again, " + build.AskAgainTool + " asks a waiting key's asks again.",
+			Input: map[string]any{"type": "object", "required": []string{"module", "fp", "why"}, "properties": map[string]any{
+				"module": map[string]any{"type": "string", "description": "the module's name"},
+				"fp":     map[string]any{"type": "string", "description": "its new-form fingerprint, src2:<hex>"},
+				"why":    map[string]any{"type": "string", "description": "why it is announced again, in plain words"}}},
+			Run: func(args map[string]any) (any, error) {
+				key, value, err := build.NewAnnounceAgain(str(args, "module"), str(args, "fp"), str(args, "why"), stdio.CallerOf(args), now())
+				if err != nil {
+					return nil, err
+				}
+				raw, err := buildAgain(key, value)
+				if err != nil {
+					return nil, err
+				}
+				r, err := build.DecodeReAsk(raw)
+				if err != nil {
+					return nil, err
+				}
+				if r.Refused || r.Revision == 0 {
+					return nil, errors.New(r.Answer)
+				}
+				return map[string]any{"key": key, "revision": r.Revision, "answer": r.Answer}, nil
+			}},
 		{Name: build.SeatQueueTool,
 			Description: "What waits on a build seat's stream (SEAT_NODE_BUILD_<LANGUAGE>), as the builder reads it: the stream's message count and " +
 				"sequences, and per kind (delivery, check, recheck) its messages oldest first, at most limit each, with sequence, ask id, when asked " +

modules/mesh-delivery-builder/cmd/mesh-delivery-builder/reasks.go

@@ -19,6 +19,7 @@ import (
 type askAgainer interface {
 	AskAgain(key, why string) []string
 	BuildAgain(ctx context.Context, module, fp, why, by string, bound time.Duration) build.BuildAgainResult
+	AnnounceAgain(ctx context.Context, module, fp, why, by string) build.BuildAgainResult
 }
 
 // buildAgainBound is how long the builder waits for the claim and the asks of a key built again by hand; the tool waits
@@ -45,6 +46,10 @@ func reAsked(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jetstre
 		go builtAgain(ctx, b, kv, e, r, logf)
 		return
 	}
+	if r.Mode == build.ModeAnnounce {
+		announcedAgain(ctx, b, kv, e, r, logf)
+		return
+	}
 	asked := b.AskAgain(e.Key(), r.Why)
 	if len(asked) == 0 {
 		r.Answer = "no ask of this key waits in this builder now (it is not building, or its build has not reached its ask yet): nothing was asked; builder_stuck shows where it stands"
@@ -114,3 +119,22 @@ func builtAgain(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jets
 		logf("%s.%s: the answer could not be written: %v", build.ReAsksState, e.Key(), err)
 	}
 }
+
+// announcedAgain answers a reasks value of mode announce (the tool builder_announce_again): the done key is written again
+// unchanged, and the value is written back with the new revision, or why nothing was done.
+func announcedAgain(ctx context.Context, b askAgainer, kv jetstream.KeyValue, e jetstream.KeyValueEntry, r build.ReAsk, logf func(string, ...any)) {
+	res := b.AnnounceAgain(ctx, r.Module, r.FP, r.Why, r.By)
+	if res.Refused != "" {
+		r.Answer, r.Refused = res.Refused, true
+	} else {
+		r.Revision, r.Answer = res.Revision, fmt.Sprintf("announced again: the done key is written again, unchanged, as revision %d", res.Revision)
+	}
+	r.Answered = time.Now().UTC()
+	data, err := json.Marshal(r)
+	if err != nil {
+		return
+	}
+	if _, err := kv.Update(ctx, e.Key(), data, e.Revision()); err != nil && !errors.Is(err, jetstream.ErrKeyExists) && !errors.Is(err, jetstream.ErrKeyRevisionMismatch) {
+		logf("%s.%s: the answer could not be written: %v", build.ReAsksState, e.Key(), err)
+	}
+}

modules/mesh-delivery-builder/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-builder
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-builder/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef h1:ggwHXCvAOhBCKAY+ErehKEhu/IQTS4poJBRDokGYnDc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-builder/internal/build/announce.go

@@ -0,0 +1,53 @@
+package build
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// **A done build is announced again by hand** (recovery of photos and link2pay on novox, 2026-10-29). The controller takes a
+// build in when a write of the build key reaches its take-in consumer, and composes then; a done key is never written again
+// by the builder, so a composition or a grant lost afterwards could not be made again by any tool. AnnounceAgain writes the
+// done key again with its own bytes, as a new revision of the same key: its content, state, artifacts and manifest stay
+// identical, and only the write is new. Who asked and why is in the builder's log and in the reasks answer.
+
+// AnnounceAgain rewrites the done key of module at fp unchanged, as a new revision, and answers the revision. A key that is
+// not done is refused with why: failed (builder_build_again builds it) or waiting (builder_ask_again).
+func (b *Builder) AnnounceAgain(ctx context.Context, module, fp, why, by string) BuildAgainResult {
+	b.init()
+	key, err := delivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		return BuildAgainResult{Refused: err.Error()}
+	}
+	value, rev, found, err := b.Claimer.Store.Get(ctx, key)
+	if err != nil {
+		return BuildAgainResult{Refused: fmt.Sprintf("%s cannot be read: %v", key, err)}
+	}
+	if !found {
+		return BuildAgainResult{Refused: fmt.Sprintf("%s has no build key: nothing to announce", key)}
+	}
+	cur, err := delivery.DecodeBuilderBuild(value)
+	if err != nil {
+		return BuildAgainResult{Refused: fmt.Sprintf("%s holds what is not a build: %v", key, err)}
+	}
+	switch cur.State {
+	case delivery.BuildDone:
+	case delivery.BuildFailed:
+		return BuildAgainResult{Refused: fmt.Sprintf("%s is failed, not done: %s builds it again", key, BuildAgainTool)}
+	default:
+		return BuildAgainResult{Refused: fmt.Sprintf("%s is %q, not done: %s asks its waiting asks again", key, cur.State, AskAgainTool)}
+	}
+	// Compare-and-set at the revision read: a build written meanwhile is not overwritten.
+	nrev, err := b.Claimer.Store.Update(ctx, key, value, rev)
+	if err != nil {
+		if errors.Is(err, ErrConflict) {
+			return BuildAgainResult{Refused: fmt.Sprintf("%s changed while it was announced: read it again", key)}
+		}
+		return BuildAgainResult{Refused: fmt.Sprintf("%s could not be written: %v", key, err)}
+	}
+	b.logf("%s: done, announced again by %s (revision %d): %s", key, by, nrev, why)
+	return BuildAgainResult{Revision: nrev}
+}

modules/mesh-delivery-builder/internal/build/announce_test.go

@@ -0,0 +1,49 @@
+package build
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func TestAnnounceAgainRewritesOnlyADoneKeyUnchanged(t *testing.T) { // recovery of photos and link2pay, 2026-10-29
+	for _, c := range []struct {
+		name   string
+		key    *delivery.BuilderBuild
+		fp     string
+		refuse string
+	}{
+		{name: "a done key is written again, unchanged, as a new revision", key: &delivery.BuilderBuild{State: delivery.BuildDone, Step: "built"}},
+		{name: "a failed key is refused, builder_build_again is for it", refuse: "builder_build_again", key: &delivery.BuilderBuild{State: delivery.BuildFailed, Error: "x"}},
+		{name: "a building key is refused, builder_ask_again is for it", refuse: "builder_ask_again", key: &delivery.BuilderBuild{State: delivery.BuildBuilding, By: "novox.builder", Step: "asked"}},
+		{name: "a key with no build is refused", refuse: "has no build key"},
+		{name: "a fingerprint that is not one is refused", refuse: "fingerprint", fp: "nope"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			r := newRig(t, goBundle)
+			var rev uint64
+			if c.key != nil {
+				c.key.Manifest = manifestD
+				rev = putBuild(t, r.st, r.key, *c.key)
+			}
+			before := bytes.Clone(r.st.vals[r.key])
+			fp := fp1
+			if c.fp != "" {
+				fp = c.fp
+			}
+			res := r.b.AnnounceAgain(context.Background(), "m", fp, "grant lost", "shanks.lead")
+			if c.refuse != "" {
+				if !strings.Contains(res.Refused, c.refuse) || res.Revision != 0 || r.st.revs[r.key] != rev || !bytes.Equal(r.st.vals[r.key], before) {
+					t.Fatalf("answer %+v, key at revision %d (was %d); want refused with %q and nothing written", res, r.st.revs[r.key], rev, c.refuse)
+				}
+				return
+			}
+			if res.Refused != "" || res.Revision <= rev || r.st.revs[r.key] != res.Revision || !bytes.Equal(r.st.vals[r.key], before) {
+				t.Fatalf("answer %+v, key at revision %d (was %d); want a new revision and the same bytes", res, r.st.revs[r.key], rev)
+			}
+		})
+	}
+}

modules/mesh-delivery-builder/internal/build/stuck.go

@@ -24,6 +24,9 @@ const (
 	AskAgainTool = "builder_ask_again"
 	// BuildAgainTool builds a failed key again by hand (issue 1126 note 72): it writes a reasks value of Mode ModeBuild.
 	BuildAgainTool = "builder_build_again"
+	// AnnounceAgainTool writes a done key again unchanged, so the controller takes it in and composes again: a reasks value
+	// of Mode ModeAnnounce.
+	AnnounceAgainTool = "builder_announce_again"
 	// ReAsksState is the builder's state of asks to ask again: the bucket mesh-delivery-builder_reasks, keyed as the build key.
 	ReAsksState  = "reasks"
 	ReAsksBucket = delivery.BuilderModule + "_" + ReAsksState
@@ -56,6 +59,9 @@ type ReAsk struct {
 // ModeBuild is the Mode of a reasks value that asks the key to be built again, not its waiting asks to be asked again.
 const ModeBuild = "build"
 
+// ModeAnnounce is the Mode of a reasks value that asks a done key to be announced again.
+const ModeAnnounce = "announce"
+
 // DecodeReAsk reads a reasks value.
 func DecodeReAsk(data []byte) (ReAsk, error) {
 	var r ReAsk
@@ -94,6 +100,19 @@ func NewBuildAgain(module, fp, why, by string, at time.Time) (string, []byte, er
 	return key, data, err
 }
 
+// NewAnnounceAgain is the value builder_announce_again writes for a module's fingerprint: its key and the value.
+func NewAnnounceAgain(module, fp, why, by string, at time.Time) (string, []byte, error) {
+	key, err := delivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		return "", nil, err
+	}
+	if strings.TrimSpace(why) == "" {
+		return "", nil, errors.New("say why the done build is announced again (why)")
+	}
+	data, err := json.Marshal(ReAsk{V: 1, Why: strings.TrimSpace(why), By: by, At: at.UTC(), Mode: ModeAnnounce, Module: module, FP: fp})
+	return key, data, err
+}
+
 // StateRead is a state the tools read: its keys, and a key's value with when it was written (zero when not known).
 type StateRead struct {
 	Keys func() ([]string, error)

modules/mesh-delivery-builder/manifest_test.go

@@ -116,7 +116,7 @@ func TestManifestDeclarations(t *testing.T) { // 1607/AC1
 		t.Errorf("secrets-owner = %q", m.SecretsOwner)
 	}
 	// 1945: the builder's tools (builder_seat_queue: note 62), served by its tools bundle, and the event it says when it asks an ask again.
-	if want := []string{"builder_ask_again", "builder_build_again", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"builder_announce_again", "builder_ask_again", "builder_build_again", "builder_seat_queue", "builder_stuck"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	if want := []string{"build.asked-again"}; !reflect.DeepEqual(m.Emits, want) {

modules/mesh-delivery-builder/module.json

@@ -3,6 +3,7 @@
   "version": "1",
   "slug": "builder",
   "tools": [
+    "builder_announce_again",
     "builder_ask_again",
     "builder_build_again",
     "builder_seat_queue",

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main.go

@@ -193,6 +193,24 @@ func Tools(r check.Reader) []stdio.Tool {
 				n, _ := args["number"].(float64)
 				return r.Pull(repository, int(n))
 			}},
+		{Name: check.FailureReadTool,
+			Description: "The full output of a pull request's failed test, which the verdict and its mesh/check status cut to their last lines " +
+				"(\"... (N earlier lines)\"): the test, the words the verdict keeps, the build step that holds the rest (its id, build module, " +
+				"machine, the check it ran for, and the call that reads it) and the first page of its build log. Read on with from = the " +
+				"output's next. Answers from the pull request's last failed verdict also once no candidate holds it. Read-only.",
+			Input: map[string]any{"type": "object", "required": []string{"repository", "number"}, "properties": map[string]any{
+				"repository": map[string]any{"type": "string", "description": "<owner>/<name>"},
+				"number":     map[string]any{"type": "integer", "description": "the pull request's number"},
+				"from":       map[string]any{"type": "integer", "description": "the log's stream sequence to read on from: the output's next; 0 is the start"}}},
+			Run: func(args map[string]any) (any, error) {
+				repository, _ := args["repository"].(string)
+				n, _ := args["number"].(float64)
+				from, _ := args["from"].(float64)
+				if from < 0 {
+					return nil, fmt.Errorf("from is a stream sequence, 0 or more")
+				}
+				return r.Failure(repository, int(n), uint64(from))
+			}},
 		{Name: check.KeptReadTool,
 			Description: "The kept verdicts of passing packages, each as stored under kept.<level>.<digest>: the package, its tests, the time they took, the toolchain " +
 				"and when it was kept. With a level, that level's; with a level and a digest, that one. Read-only.",
@@ -269,7 +287,8 @@ func main() {
 		HaveState:    read(stdio.State("node-engine.have")), StepBound: stepBound(),
 		TurnState: read(stdio.State("mesh-delivery-gate.turns")), HearingState: read(stdio.State(buildrun.HearingState)),
 		AskState: read(stdio.State(check.AsksState))}
-	r.Runs = runsOf{read(stdio.State("mesh-delivery-indexer.modules"))} // the node-engine at the commit the mesh runs, as the checker reads it
+	r.Logs = func(tool string, args map[string]any) (json.RawMessage, error) { return stdio.Ask(tool, args) } // the module's invokes
+	r.Runs = runsOf{read(stdio.State("mesh-delivery-indexer.modules"))}                                       // the node-engine at the commit the mesh runs, as the checker reads it
 	tries := stdio.State(check.TriesState)
 	source := stdio.State("mesh-delivery-gate.source")
 	trunks := func() (map[string]string, error) {

modules/mesh-delivery-checker/cmd/mesh-delivery-checker-tools/main_test.go

@@ -11,7 +11,7 @@ import (
 	"mesh-delivery-checker/internal/check"
 )
 
-func TestTheToolsServedAreTheFiveReadTools(t *testing.T) {
+func TestTheToolsServedAreTheSixReadTools(t *testing.T) {
 	var names []string
 	for _, tl := range Tools(check.Reader{}) {
 		names = append(names, tl.Name)
@@ -19,7 +19,7 @@ func TestTheToolsServedAreTheFiveReadTools(t *testing.T) {
 			t.Errorf("%s has no description or no run", tl.Name)
 		}
 	}
-	want := []string{check.VerdictsReadTool, check.PullReadTool, check.KeptReadTool, check.PreviewsReadTool, check.StatusReadTool}
+	want := []string{check.VerdictsReadTool, check.PullReadTool, check.FailureReadTool, check.KeptReadTool, check.PreviewsReadTool, check.StatusReadTool}
 	if !slices.Equal(names, want) {
 		t.Errorf("tools = %v, want %v", names, want)
 	}

modules/mesh-delivery-checker/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-checker
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-checker/go.sum

@@ -1,5 +1,9 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef h1:ggwHXCvAOhBCKAY+ErehKEhu/IQTS4poJBRDokGYnDc=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028193502-f91340fe82ef/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc h1:Wdjl2gomooHswJ5qpkwZPq/ureZgXVw6FMCsgzPJhPo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde h1:eKXSllHCS31GgMazfvZ7BeiLoXIUibnUmzxWVkj+Vcw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-delivery-checker/internal/check/examiner_test.go

@@ -432,6 +432,8 @@ func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.
 	b.fetch.Changed = []string{"modules/m/internal/b/b_test.go"}
 	b.digest[delivery.LevelUnit] = Digested{Level: "unit", Packages: map[string]string{"m/internal/a": digA, "m/internal/b": digB}}
 	failing := captured[Tested](t, "go-test-failing")
+	// The step said the failure's whole output on its log (the operator, 2026-10-30): the verdict names where.
+	failing.Failed[0].Step, failing.Failed[0].Module, failing.Failed[0].Machine, failing.Failed[0].Run = "s1", "mesh-build-go", "ace", "r1"
 	b.test = func(c stepCall) (any, error) {
 		if got := packagesOf(c); len(got) == 1 && got[0] == "m/internal/b" {
 			return failing, nil
@@ -439,7 +441,8 @@ func TestTheChangesOwnFailingTestRunsFirstThenTheRestAndNoLaterLevel(t *testing.
 		return captured[Tested](t, "go-test-slow"), nil
 	}
 	out := b.judge(t, caseOf(t, pullOf(repoA, 7, head1)))
-	if out.Verdict.State != delivery.VerdictFail || !strings.Contains(out.Verdict.Failed.Test, "TestThreeIsFour") {
+	if f := out.Verdict.Failed; out.Verdict.State != delivery.VerdictFail || !strings.Contains(f.Test, "TestThreeIsFour") ||
+		f.Step != "s1" || f.Module != "mesh-build-go" || f.Machine != "ace" || f.Run != "r1" || f.Pull != repoA+"#7" || out.Verdict.Failures[0].Step != "s1" {
 		t.Fatalf("verdict = %+v", out.Verdict)
 	}
 	tests := b.steps.tool("test")

modules/mesh-delivery-checker/internal/check/failure.go

@@ -0,0 +1,132 @@
+package check
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// A pull request's failed test, its whole output read from the build step that said it (the operator, 2026-10-30: the
+// verdict cuts a failure to its last lines, and its cause was guessed). The verdict names the step, its build module and
+// machine and the check it ran for (delivery.FailedFirst); the build module's log tool reads the step's log from its own
+// stream (mesh-sdk buildstep.LogTool). The verdict is found through the pull request's candidate, or, once no candidate
+// holds it, as the newest verdict that names the pull request's failure.
+
+// FailureStep is where a failure's whole output is: the step id, its build module and machine, the run it ran for, and the
+// call that reads it.
+type FailureStep struct {
+	ID      string `json:"id"`
+	Module  string `json:"module"`
+	Machine string `json:"machine,omitempty"`
+	Run     string `json:"run"`
+	Read    string `json:"read"`
+}
+
+// FailureRead is a pull request's failed test: the verdict that names it, the test and the words the verdict keeps, the
+// step that holds the rest, and the first page of its log (Output, the log tool's answer), or why there is none.
+type FailureRead struct {
+	Pull    string          `json:"pull"`
+	Verdict string          `json:"verdict"`
+	Test    string          `json:"test,omitempty"`
+	Words   string          `json:"words,omitempty"`
+	Step    *FailureStep    `json:"step,omitempty"`
+	Output  json.RawMessage `json:"output,omitempty"`
+	Note    string          `json:"note,omitempty"`
+}
+
+// logToolOf is a build module's log tool: mesh-build-go's build_go_log.
+func logToolOf(module string) string {
+	lang := strings.TrimPrefix(module, "mesh-build-")
+	return module + ".build_" + lang + "_log"
+}
+
+// failureOf is the failure a verdict names of the pull request pull: the first that names it, or, in a verdict that names
+// no pull request (written before), the first failure.
+func failureOf(v delivery.Verdict, pull string) (delivery.FailedFirst, bool) {
+	for _, f := range append([]delivery.FailedFirst{v.Failed}, v.Failures...) {
+		if f.Pull == pull && f.Test != "" {
+			return f, true
+		}
+	}
+	if v.Failed.Pull == "" && v.Failed.Test != "" {
+		return v.Failed, true
+	}
+	return delivery.FailedFirst{}, false
+}
+
+// Failure answers a pull request's failed test, with the page of its log from the stream sequence from on (0 the start).
+func (r Reader) Failure(repository string, number int, from uint64) (FailureRead, error) {
+	pull := fmt.Sprintf("%s#%d", repository, number)
+	out := FailureRead{Pull: pull}
+	var v delivery.Verdict
+	found := false
+	if read, err := r.Pull(repository, number); err == nil && len(read.Verdict) > 0 {
+		if v, err = delivery.DecodeVerdict(read.Verdict); err != nil {
+			return out, fmt.Errorf("%s holds what is not a verdict: %w", read.Key, err)
+		}
+		out.Verdict, found = read.Key, true
+	} else if err != nil && !strings.HasPrefix(err.Error(), "no candidate") {
+		return out, err
+	}
+	if _, ok := failureOf(v, pull); !found || v.State != delivery.VerdictFail || !ok {
+		// No candidate holds it, or its candidate's verdict did not fail of it: the newest verdict that names its failure.
+		key, last, err := r.lastFailure(pull)
+		if err != nil {
+			return out, err
+		}
+		if key == "" {
+			if found {
+				out.Note = "its verdict names no failed test of it, and no other verdict does"
+				return out, nil
+			}
+			return out, fmt.Errorf("no candidate holds %s, and no verdict names a failed test of it", pull)
+		}
+		out.Verdict, v = key, last
+	}
+	f, _ := failureOf(v, pull)
+	out.Test, out.Words = f.Test, f.Words
+	if f.Step == "" {
+		out.Note = "the verdict names no build step that kept the whole output (a build module or a checker from before it)"
+		return out, nil
+	}
+	out.Step = &FailureStep{ID: f.Step, Module: f.Module, Machine: f.Machine, Run: f.Run,
+		Read: fmt.Sprintf("%s {run: %s, step: %s}", logToolOf(f.Module), f.Run, f.Step)}
+	if r.Logs == nil {
+		out.Note = "the build module's log cannot be asked here"
+		return out, nil
+	}
+	page, err := r.Logs(logToolOf(f.Module), map[string]any{"run": f.Run, "step": f.Step, "from": from})
+	if err != nil {
+		out.Note = "its log could not be read: " + err.Error()
+		return out, nil
+	}
+	out.Output = page
+	return out, nil
+}
+
+// lastFailure is the newest verdict that names a failed test of pull, by its step id (an id begins with its time), and
+// its key; "" when none does among the first MaxReads.
+func (r Reader) lastFailure(pull string) (string, delivery.Verdict, error) {
+	rows, _, err := r.Verdicts("")
+	if err != nil {
+		return "", delivery.Verdict{}, err
+	}
+	var key, newest string
+	var last delivery.Verdict
+	for _, row := range rows {
+		v, err := delivery.DecodeVerdict(row.Verdict)
+		if err != nil || v.State != delivery.VerdictFail {
+			continue
+		}
+		f, ok := failureOf(v, pull)
+		if !ok || f.Pull != pull {
+			continue
+		}
+		if key == "" || len(f.Step) > len(newest) || (len(f.Step) == len(newest) && f.Step > newest) {
+			key, newest, last = row.Key, f.Step, v
+		}
+	}
+	return key, last, nil
+}

modules/mesh-delivery-checker/internal/check/judge.go

@@ -318,6 +318,15 @@ func (st *state) outcome(v delivery.Verdict) Outcome {
 	return out
 }
 
+// runOf is the run a case's asks name (delivery.StepAsk.Run), under which their steps say their logs: the check's heads
+// hash, or delivery.NoRun when it is no token.
+func runOf(c *Case) string {
+	if c == nil || c.HeadsHash == "" || strings.ContainsAny(c.HeadsHash, ".*> ") {
+		return delivery.NoRun
+	}
+	return c.HeadsHash
+}
+
 // fail is a verdict of failure at a machine.
 func fail(machine, words string) *delivery.Verdict {
 	v := failure(machine, words)
@@ -430,7 +439,7 @@ func (st *state) askNeeding(ctx context.Context, t *target, merged *[]Fetched, l
 		kind = delivery.AskRecheck // a re-judge after a trunk move goes after every new head's check (ADR 0536 §4)
 	}
 	a := delivery.StepAsk{ID: buildstep.NewID(), Kind: kind, Language: askLanguage[t.module], Asker: delivery.CheckerModule,
-		At: st.j.now().UTC(), Check: job, Needs: needs}
+		At: st.j.now().UTC(), Check: job, Needs: needs, Run: runOf(st.c)}
 	var step delivery.Step
 	var firstDecline time.Time
 	for {
@@ -831,7 +840,12 @@ func levelFailure(t *target, level string, results ...Tested) *delivery.Verdict
 			if t.module == buildrun.NodeBuildModule && f.Package == "" {
 				name = res.Module
 			}
-			all = append(all, delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f))})
+			ff := delivery.FailedFirst{Test: level + ": " + name, Words: failureWordsAfter(f, hidWords(t.module, res.By, f)),
+				Pull: fmt.Sprintf("%s#%d", t.pull.Repository, t.pull.Number)}
+			if f.Step != "" { // its build step said its whole output on the module's log: where (checker_failure reads it)
+				ff.Step, ff.Module, ff.Machine, ff.Run = f.Step, f.Module, f.Machine, f.Run
+			}
+			all = append(all, ff)
 		}
 	}
 	if len(all) == 0 { // no result: a level said failed with nothing to name
@@ -848,7 +862,8 @@ func failureLines(all []delivery.FailedFirst) []delivery.FailedFirst {
 	n := min(len(all), delivery.MaxFailures)
 	out := make([]delivery.FailedFirst, 0, n+1)
 	for _, f := range all[:n] {
-		out = append(out, delivery.FailedFirst{Test: f.Test, Machine: f.Machine, Words: clipLine(firstLine(f.Words), MaxFailureLine)})
+		f.Words = clipLine(firstLine(f.Words), MaxFailureLine)
+		out = append(out, f)
 	}
 	if more := len(all) - n; more > 0 {
 		out = append(out, delivery.FailedFirst{Test: fmt.Sprintf("and %d more", more)})

modules/mesh-delivery-checker/internal/check/line.go

@@ -312,7 +312,7 @@ func parts(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []s
 
 // Report is the full line of a pull request's status, with no limit: what the read tools and the full report say.
 func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) string {
-	return parts(v, cs, p, builds, slowest, judged).join(0)
+	return joinSet(parts(v, cs, p, builds, slowest, judged).join(0), fullOutputWords(v, p))
 }
 
 // Line is the words of a status for one pull request of a case (ADR 0447 clause 3, ADR 0484 clause 7): the verdict first (a
@@ -324,26 +324,52 @@ func Report(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []
 // The program that judged is never dropped: a line naming it gives the counts in their compact form, then drops them and
 // what follows, and is cut in its first part rather than lose it.
 func Line(v delivery.Verdict, cs *Case, p Pull, builds []BuildNote, slowest []string, judged map[string]string) string {
-	pc := parts(v, cs, p, builds, slowest, judged)
+	full := fullOutputWords(v, p)
+	if full == "" {
+		return lineWithin(parts(v, cs, p, builds, slowest, judged), MaxLine)
+	}
+	return lineWithin(parts(v, cs, p, builds, slowest, judged), MaxLine-utf8.RuneCountInString(full)-3) + " | " + full
+}
+
+// FullOutputTool is the read tool that answers a failed test's whole output (the checker's tools).
+const FullOutputTool = "checker_failure"
+
+// fullOutputWords end the line of a pull request whose failed test's whole output a build step said on its log: where to
+// read it, "full output: checker_failure <repo>#<n>"; "" when none was said (no test failed, or an older build module).
+func fullOutputWords(v delivery.Verdict, p Pull) string {
+	if v.State != delivery.VerdictFail {
+		return ""
+	}
+	pull := fmt.Sprintf("%s#%d", p.Repository, p.Number)
+	for _, f := range append([]delivery.FailedFirst{v.Failed}, v.Failures...) {
+		if f.Step != "" && (f.Pull == "" || f.Pull == pull) {
+			return "full output: " + FullOutputTool + " " + pull
+		}
+	}
+	return ""
+}
+
+// lineWithin is the line of the pieces in at most most characters (Line).
+func lineWithin(pc pieces, most int) string {
 	for drop := 0; drop <= 4; drop++ {
-		if s := pc.join(drop); utf8.RuneCountInString(s) <= MaxLine {
+		if s := pc.join(drop); utf8.RuneCountInString(s) <= most {
 			return s
 		}
 	}
 	if pc.judged != "" {
 		for _, counts := range []string{pc.shortCounts, ""} {
-			if s := joinSet(pc.head, pc.commits, counts, pc.judged); utf8.RuneCountInString(s) <= MaxLine {
+			if s := joinSet(pc.head, pc.commits, counts, pc.judged); utf8.RuneCountInString(s) <= most {
 				return s
 			}
 		}
 		rest := " | " + joinSet(pc.commits, pc.judged)
-		room := MaxLine - utf8.RuneCountInString(rest) - 1
+		room := most - utf8.RuneCountInString(rest) - 1
 		if head := []rune(pc.head); room > 0 && len(head) > room {
 			return string(head[:room]) + "…" + rest
 		}
 	}
 	runes := []rune(pc.join(4))
-	return string(runes[:MaxLine-1]) + "…"
+	return string(runes[:most-1]) + "…"
 }
 
 // joinSet joins the parts that are not empty.

modules/mesh-delivery-checker/internal/check/line_test.go

@@ -50,11 +50,18 @@ func TestAFailureNamesTheTestTheConflictOrTheRefusedStepFirst(t *testing.T) { //
 		"test":     {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4"}}, "failed: unit: m/a.TestX: want 4"},
 		"conflict": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "shanks", Words: "novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"}}, "failed: shanks: novox/mesh-delivery#7 does not merge into the trunk: files in conflict: go.mod"},
 		"refused":  {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Machine: "mesh-build-go", Words: "no go build node qualifies: builders disagree"}}, "failed: mesh-build-go: no go build node qualifies"},
+		// The operator, 2026-10-30: a test whose step said its whole output ends the line saying where to read it.
+		"whole output": {delivery.Verdict{State: delivery.VerdictFail, Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4\n... " + strings.Repeat("a long line ", 40),
+			Step: "s1", Module: "mesh-build-go", Run: "r1", Pull: "novox/mesh-delivery#7"}}, "failed: unit: m/a.TestX: want 4"},
 	} {
 		line := Line(c.v, cs, p, nil, nil, nil)
 		if !strings.HasPrefix(line, c.want) || !strings.Contains(line, "111111111111 on aaaaaaaaaaaa") {
 			t.Errorf("%s: line = %q, want it to open with %q and name the commits", name, line, c.want)
 		}
+		full := strings.HasSuffix(line, " | full output: checker_failure novox/mesh-delivery#7")
+		if full != (c.v.Failed.Step != "") || utf8.RuneCountInString(line) > MaxLine {
+			t.Errorf("%s: line = %q: the full output named %v, want %v, within %d characters", name, line, full, !full, MaxLine)
+		}
 	}
 }
 

modules/mesh-delivery-checker/internal/check/read.go

@@ -18,7 +18,9 @@ import (
 const (
 	VerdictsReadTool = "checker_verdicts"
 	PullReadTool     = "checker_pull"
-	KeptReadTool     = "checker_kept"
+	// FailureReadTool is FullOutputTool: a pull request's failed test with its whole output (Failure).
+	FailureReadTool = FullOutputTool
+	KeptReadTool    = "checker_kept"
 	// PreviewsReadTool reads the previews state (issue 1680); StatusReadTool reads what the checker runs (issue 1685: nothing holds it since R4g).
 	PreviewsReadTool = "checker_previews"
 	StatusReadTool   = "checker_status"
@@ -49,7 +51,10 @@ type Reader struct {
 	HearingState StateRead
 	// AskState is the checker's state asks: the asks each running check put (AsksState), which checker_ask_again reads.
 	AskState StateRead
-	Now      func() time.Time
+	// Logs asks a build module's log tool (`<module>.build_<lang>_log`) as the checker (stdio.Ask): a failed test's whole
+	// output (Failure); nil asks none.
+	Logs func(tool string, args map[string]any) (json.RawMessage, error)
+	Now  func() time.Time
 }
 
 // VerdictRead is a verdict as stored with the full report of the status of each pull request it judged (Report), when the

modules/mesh-delivery-checker/internal/check/read_test.go

@@ -67,6 +67,41 @@ func TestTheVerdictToolsAnswerTheStoredVerdictWithTheFullReportOfEachPullRequest
 	if only, _, _ := rd.Verdicts("feat/other"); len(only) != 0 {
 		t.Errorf("another group's verdicts = %+v", only)
 	}
+
+	// checker_failure (the operator, 2026-10-30): a passing pull request has no failure to read; one no candidate holds any
+	// more is answered from its newest failed verdict, with the step that holds its whole output and that log's first page.
+	if got, err := rd.Failure(repoA, 7, 0); err != nil || got.Step != nil || !strings.Contains(got.Note, "names no failed test") {
+		t.Errorf("a passing pull request's failure: %+v, %v", got, err)
+	}
+	if _, err := rd.Failure("novox/none", 1, 0); err == nil || !strings.Contains(err.Error(), "no verdict names a failed test") {
+		t.Errorf("a pull request no candidate and no verdict holds: %v", err)
+	}
+	verdicts := fakeState{}
+	keys, _ := rd.VerdictState.Keys()
+	for _, k := range keys {
+		verdicts[k], _ = rd.VerdictState.Get(k)
+	}
+	for i, step := range []string{"mh0aaaaa000001", "mh0aaaab000002"} {
+		v := delivery.Verdict{V: 1, Group: "fix/y", Heads: fmt.Sprintf("%012d", i), State: delivery.VerdictFail,
+			Failed: delivery.FailedFirst{Test: "unit: m/a.TestX", Words: "want 4", Step: step, Module: "mesh-build-go", Machine: "ace", Run: "r1", Pull: "novox/y#9"}}
+		raw, err := delivery.EncodeVerdict(v)
+		if err != nil {
+			t.Fatal(err)
+		}
+		key, _ := delivery.CheckerVerdictKey(v.Group, v.Heads)
+		verdicts[key] = raw
+	}
+	rd.VerdictState = verdicts.read()
+	var asked string
+	rd.Logs = func(tool string, args map[string]any) (json.RawMessage, error) {
+		asked = fmt.Sprintf("%s %v %v %v", tool, args["run"], args["step"], args["from"])
+		return json.RawMessage(`{"lines":["=== m/a TestX","want 4"],"next":0}`), nil
+	}
+	got, err := rd.Failure("novox/y", 9, 0)
+	if err != nil || got.Step == nil || got.Step.ID != "mh0aaaab000002" || got.Step.Read != "mesh-build-go.build_go_log {run: r1, step: mh0aaaab000002}" ||
+		asked != "mesh-build-go.build_go_log r1 mh0aaaab000002 0" || !strings.Contains(string(got.Output), "want 4") {
+		t.Errorf("the failure of novox/y#9: %+v (%s), asked %q, %v", got, got.Output, asked, err)
+	}
 }
 
 // 1887/A10: an hq pull request is answered as any other, its report its verdict's (ADR 0527 §2), never a note that a script

modules/mesh-delivery-checker/manifest_test.go

@@ -101,10 +101,12 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 		"mesh-delivery-indexer.manifests", "mesh-delivery-indexer.modules", "mesh-delivery-watchman.presence", "node-engine.have"}; !reflect.DeepEqual(sorted(m.Reads), want) {
 		t.Errorf("reads = %v, want %v", m.Reads, want)
 	}
-	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), calls no
-	// build module's tool and holds no capacity: it puts check asks on the Go and Node build seats (ADR 0525 §1, §4).
-	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "gitea.gitea_list_branches"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
-		t.Errorf("invokes = %v, want only the forge's reads for a mesh-sdk pin (ADR 0484 clause 9)", m.Invokes)
+	// 1887/A5b: the checker reads nothing of the controller's plans-building (ADR 0483 superseded by ADR 0525 §7), runs no
+	// build module's step tool and holds no capacity: it puts check asks on the Go and Node build seats (ADR 0525 §1, §4).
+	// Its checker_failure reads a failed step's whole output with the build modules' log tools (the operator, 2026-10-30).
+	if want := []string{"gitea.gitea_commits", "gitea.gitea_compare", "gitea.gitea_get_file", "gitea.gitea_list_branches",
+		"mesh-build-go.build_go_log", "mesh-build-node.build_node_log"}; !reflect.DeepEqual(sorted(m.Invokes), want) {
+		t.Errorf("invokes = %v, want the forge's reads for a mesh-sdk pin (ADR 0484 clause 9) and the build logs' reads", m.Invokes)
 	}
 	if want := []string{"node-build-go", "node-build-node"}; !reflect.DeepEqual(sorted(m.Uses), want) {
 		t.Errorf("uses = %v, want the Go and Node build seats", m.Uses)
@@ -126,7 +128,7 @@ func TestManifestDeclarations(t *testing.T) { // 1678/AC1
 	// The read tools (issue 1686) are served by the tools bundle, not by the checker's process.
 	// The try's tools (ADR 0501 §5; the end by hand, issue 734) beside them: mesh-controller's try calls them. A lost check
 	// is asked again by hand (checker_ask_again).
-	if want := []string{"checker_ask_again", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
+	if want := []string{"checker_ask_again", "checker_failure", "checker_kept", "checker_previews", "checker_pull", "checker_status", "checker_try", "checker_try_end", "checker_try_read", "checker_verdicts"}; !reflect.DeepEqual(sorted(m.Tools), want) {
 		t.Errorf("tools = %v, want %v", m.Tools, want)
 	}
 	for _, k := range []string{"logs", "emits", "claims", "provides", "requires", "defines-seats", "seat", "seats", "bus", "config"} {

modules/mesh-delivery-checker/module.json

@@ -40,6 +40,7 @@
   ],
   "tools": [
     "checker_ask_again",
+    "checker_failure",
     "checker_kept",
     "checker_previews",
     "checker_pull",
@@ -53,7 +54,9 @@
     "gitea.gitea_commits",
     "gitea.gitea_compare",
     "gitea.gitea_get_file",
-    "gitea.gitea_list_branches"
+    "gitea.gitea_list_branches",
+    "mesh-build-go.build_go_log",
+    "mesh-build-node.build_node_log"
   ],
 
   "own-secrets": {

modules/mesh-delivery-indexer/go.mod

@@ -3,7 +3,7 @@ module mesh-delivery-indexer
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 )

modules/mesh-delivery-indexer/go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388 h1:ycu/sNieTdLpD3bzhZOCXdzcoqXUOxPRmqWV019REpo=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028174713-38dbe1d3a388/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=

modules/mesh-grants/go.mod

@@ -3,7 +3,7 @@ module mesh-grants
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028191251-5228a5782d5c
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde
 	github.com/nats-io/nats.go v1.54.0
 )
 

modules/mesh-grants/go.sum

@@ -1,5 +1,9 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028191251-5228a5782d5c h1:ngcItoLuh2uP24toZvkCXGA/3+TBrLTwTbE28XpYDWY=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261028191251-5228a5782d5c/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771 h1:Tt16HJk8JZRce1i3JzzDSNdCWOrv7dw8FQ/bckNQ5Ig=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261029233535-78c9ec881771/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc h1:Wdjl2gomooHswJ5qpkwZPq/ureZgXVw6FMCsgzPJhPo=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030095816-530d8d3007dc/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde h1:eKXSllHCS31GgMazfvZ7BeiLoXIUibnUmzxWVkj+Vcw=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030100935-c2ec8b6b2fde/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=