diff --git a/one-node-mesh-report.json b/one-node-mesh-report.json
index 1fbb267..f8756e9 100644
--- a/one-node-mesh-report.json
+++ b/one-node-mesh-report.json
@@ -7,7 +7,7 @@
       "code": "R1",
       "title": "a bare machine becomes a mesh of one, raised by the installer",
       "status": "pass",
-      "seconds": 141,
+      "seconds": 122,
       "why": ""
     },
     {
@@ -56,35 +56,35 @@
       "code": "P1",
       "title": "the mesh builds the shared base from source",
       "status": "pass",
-      "seconds": 77,
+      "seconds": 85,
       "why": ""
     },
     {
       "code": "P2",
       "title": "the mesh builds and runs a store of its own",
       "status": "pass",
-      "seconds": 49,
+      "seconds": 38,
       "why": ""
     },
     {
       "code": "P3",
       "title": "the mesh builds and runs its own catalogue",
       "status": "pass",
-      "seconds": 26,
+      "seconds": 31,
       "why": ""
     },
     {
       "code": "P4",
       "title": "the mesh rebuilds its own control plane from source",
       "status": "pass",
-      "seconds": 33,
+      "seconds": 32,
       "why": ""
     },
     {
       "code": "N1",
       "title": "the mesh puts itself on a private network, and its machine has a name",
       "status": "pass",
-      "seconds": 12,
+      "seconds": 6,
       "why": ""
     },
     {
@@ -98,14 +98,14 @@
       "code": "U1",
       "title": "the mesh builds a module standing on that base",
       "status": "pass",
-      "seconds": 14,
+      "seconds": 13,
       "why": ""
     },
     {
       "code": "U2",
       "title": "the mesh runs a broker for that module to talk to",
       "status": "pass",
-      "seconds": 20,
+      "seconds": 24,
       "why": ""
     },
     {
@@ -140,22 +140,22 @@
       "code": "V4",
       "title": "every resource the mesh declared is true on the machine",
       "status": "pass",
-      "seconds": 12,
+      "seconds": 11,
       "why": ""
     },
     {
       "code": "E1",
       "title": "a change to a module's source reaches the machine on its own",
       "status": "pass",
-      "seconds": 14,
+      "seconds": 13,
       "why": ""
     },
     {
       "code": "E2",
       "title": "the mesh comes back after the machine reboots",
       "status": "fail",
-      "seconds": 30,
-      "why": "every container came back and no host agent did, so the machine is running the right things and can no longer be told anything:\namqp-ping\tUp 3 seconds\nmesh-lavinmq\tUp 3 seconds\nlavinmq\tUp 3 seconds (health: starting)\nmesh-control\tUp 3 seconds\nmesh-catalog\tUp 3 seconds\nmesh-postgres\tUp 3 seconds\npostgres\tUp 3 seconds\nmesh-builder\tUp 3 seconds\nmesh-registry\tUp 3 seconds\nmesh-broker\tUp 4 seconds (health: starting)\nmesh-store\tUp 4 seconds\n"
+      "seconds": 31,
+      "why": "every container came back and no host agent did, so the machine is running the right things and can no longer be told anything:\namqp-ping\tUp 3 seconds\nmesh-lavinmq\tUp 3 seconds\nlavinmq\tUp 4 seconds (health: starting)\nmesh-control\tUp 3 seconds\nmesh-catalog\tUp 1 second\nmesh-postgres\tUp 4 seconds\npostgres\tUp 3 seconds\nmesh-builder\tUp 2 seconds\nmesh-registry\tUp 3 seconds\nmesh-broker\tUp 3 seconds (health: starting)\nmesh-store\tUp 3 seconds\n"
     }
   ]
 }
\ No newline at end of file
diff --git a/test/integration/fresh-mesh.test.ts b/test/integration/fresh-mesh.test.ts
index 4f30d54..6e940f9 100644
--- a/test/integration/fresh-mesh.test.ts
+++ b/test/integration/fresh-mesh.test.ts
@@ -329,6 +329,9 @@ before(async () => {
         registry: REGISTRY,
         source,
         sourceRef,
+        toolsSource: forgeUrl(BASE.repo),
+        catalogSource: forgeUrl(MODULE.repo),
+        catalogRef: refFor(MODULE.repo),
         log: (m) => console.log(m),
       });
     } catch (err) {
diff --git a/test/integration/genesis-single.test.ts b/test/integration/genesis-single.test.ts
index 7d02ff1..42dc73a 100644
--- a/test/integration/genesis-single.test.ts
+++ b/test/integration/genesis-single.test.ts
@@ -81,6 +81,9 @@ before(async () => {
       bundleTemplate: substrateBundle(bundle, []),
       source,
       sourceRef,
+      // Phase two builds from the same forge; the repositories sit beside the control plane's.
+      toolsSource: source.replace(/[^/]+\.git$/, "mesh-tools.git"),
+      catalogSource: source.replace(/[^/]+\.git$/, "mesh-catalog.git"),
       log: (m) => console.log(m),
     });
   } catch (err) {
diff --git a/test/integration/genesis.ts b/test/integration/genesis.ts
index 0f80175..0f25fba 100644
--- a/test/integration/genesis.ts
+++ b/test/integration/genesis.ts
@@ -53,6 +53,18 @@ export interface GenesisOptions {
    */
   source: string;
   sourceRef: string;
+  /**
+   * Phase two: where the shared base and the catalogue's modules are built from.
+   *
+   * The installer no longer stops at a mesh that runs — it builds the base, a store, the
+   * catalogue, chooses the network and the filter, and asks a human where one must choose. This
+   * bed has no human, so every choice arrives as a flag, and a required choice with no flag is
+   * the installer refusing — which is the behaviour, not a lab problem.
+   */
+  toolsSource: string;
+  catalogSource: string;
+  /** What of the catalogue to build. A branch under test is the usual reason this is not main. */
+  catalogRef?: string;
   log?: (m: string) => void;
 }
 
@@ -118,6 +130,14 @@ export async function genesis(o: GenesisOptions): Promise<GenesisResult> {
     `--catalog ${catalogueOnMachine}`,
     `--node ${node}`,
     `--registry ${registry}`,
+    `--tools-source ${o.toolsSource}`,
+    `--catalog-source ${o.catalogSource}`,
+    `--catalog-ref ${o.catalogRef ?? "main"}`,
+    // The choices, answered the unattended way. Both have one option today, so these are
+    // redundant on purpose: the day a second filter exists, this bed keeps working instead of
+    // refusing, and choosing becomes a thing it visibly does.
+    `--private-network wireguard`,
+    `--packet-filter nftables`,
     `--host ${HOST_PATH}`,
     // The lab has no unit to supervise the host with, and the installer refuses to invent one — a
     // unit file is a packaging decision. A host started this way does not survive a reboot.
diff --git a/test/integration/one-node-mesh.test.ts b/test/integration/one-node-mesh.test.ts
index bfa6130..c19beb0 100644
--- a/test/integration/one-node-mesh.test.ts
+++ b/test/integration/one-node-mesh.test.ts
@@ -467,6 +467,9 @@ before(async () => {
         registry: REGISTRY,
         source,
         sourceRef,
+        toolsSource: forgeUrl(BASE.repo),
+        catalogSource: forgeUrl(MODULE.repo),
+        catalogRef: refFor(MODULE.repo),
         log: (m) => console.log(m),
       });
     } catch (err) {