A run rebuilds what it tests, and leaves a receipt saying what it covered

The danger is not that the suite breaks. It is that nobody notices it
stopped running (novox/hq 04-ISSUES/005). The harness this replaces had
not built for two and a half months and nothing said so — and this suite
needs a hypervisor, so it inherits exactly that: it runs when somebody
remembers, and remembering is not a mechanism.

So running, recording, and rebuilding are one act:

- the host binary, control-plane image and builder are rebuilt from
  source first. The last two both parse manifests; building one and not
  the other left a binary eleven hours old refusing a field the mesh had
  just renamed, found by a full run.
- a receipt lands in XDG state — outside git, because the question is
  whether *this machine* has run it, and a receipt in git would be a
  claim about everybody's machine made by whoever committed last.
- `last-run` judges it and exits non-zero when it no longer counts.

Three faults found by running the thing rather than reading it, each now
held by a test confirmed to fail without it:

- counted() passed every test while parsing nothing. The runner colours
  its summary even into a pipe; the fixtures were clean text that had
  been imagined rather than captured. A fixture that agrees with the
  mistake proves the mistake.
- a receipt for `suite test/lastrun.test.ts` was indistinguishable from
  one for the real thing — 005's own symptom, rebuilt inside its remedy.
  The receipt now records what ran.
- a tree with uncommitted work reported the bare commit, claiming
  coverage of code nobody can check out. Nothing else could tell: the
  hash is identical either way.

Proven on real machines: 22/22, against all three repositories.

test/rebuild.test.ts

@@ -0,0 +1,47 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { planned } from "../src/rebuild.ts";
+import { repositories } from "../src/repos.ts";
+
+// The control plane's image and the builder are one step, not two.
+//
+// Both parse manifests. On 2026-08-30 a rename was built into the image and not the binary, and
+// the run that found out was a full lab raise. novox/hq 04-ISSUES/005.
+test("the control plane's image and builder are always built together", () => {
+  const builds = planned({
+    MESH_LAB_MODULES: "/repo/control/examples/modules",
+    MESH_LAB_BUILDER: "/repo/control/build/mesh-builder",
+  });
+  const what = builds.map((b) => b.what);
+  assert.ok(what.includes("control plane image"), "the image was not built");
+  assert.ok(what.includes("builder"), "the builder was not built");
+  for (const build of builds) assert.equal(build.in, "/repo/control");
+});
+
+// A repository this run was not pointed at is not built, and not claimed.
+test("only what this run was pointed at is built", () => {
+  assert.deepEqual(planned({}), []);
+  const hostOnly = planned({ MESH_LAB_HOST_BINARY: "/repo/host/mesh-host" });
+  assert.deepEqual(hostOnly.map((b) => b.what), ["host"]);
+  assert.equal(hostOnly[0]!.in, "/repo/host");
+});
+
+// What the receipt claims and what the run built come from one derivation.
+//
+// They are separate concerns that must agree: a receipt naming a repository the run did not build
+// is false coverage arriving by nobody's decision — just two derivations drifting apart.
+// novox/hq 04-ISSUES/005.
+test("every repository the receipt claims was built by the run", () => {
+  const env = {
+    MESH_LAB_HOST_BINARY: "/repo/host/mesh-host",
+    MESH_LAB_MODULES: "/repo/control/examples/modules",
+    MESH_LAB_BUILDER: "/repo/control/build/mesh-builder",
+  };
+  const built = new Set(planned(env).map((b) => b.in));
+  for (const [name, directory] of Object.entries(repositories(env))) {
+    // mesh-lab is the exception, and it is not an omission: it is TypeScript run from source, so
+    // the code under test *is* the code running. There is nothing to build and nothing to go stale.
+    if (name === "mesh-lab") continue;
+    assert.ok(built.has(directory), `${name} (${directory}) is claimed but never built`);
+  }
+});