diff --git a/test/integration/mesh.test.ts b/test/integration/mesh.test.ts
index b98cc78..571e14d 100644
--- a/test/integration/mesh.test.ts
+++ b/test/integration/mesh.test.ts
@@ -198,3 +198,34 @@ test("the consumer is also told where its database is", { skip, timeout: 300_000
   // And the name it resolves to was written by the mesh as well, on this machine.
   assert.match(await must("laptop", `grep anchor.internal /etc/hosts`), /10\.42\.0\.\d+/);
 });
+
+test("when a machine cannot do what it was told, the mesh says which and why", { skip, timeout: 900_000 }, async () => {
+  // Demonstrated with inserted rows first, which proves the query and not the path. This sends a
+  // real machine something it will genuinely fail at, and asks the mesh afterwards.
+  //
+  // A package that does not exist, because that is a failure of the ordinary kind: the host tries,
+  // the package manager says no, and some of the declaration is applied and some is not — which
+  // is the situation `status` exists to distinguish from a machine that refused everything.
+  await must("anchor", `printf %s '{"module":"impossible","version":"1","resources":[` +
+    `{"id":"nothing","type":"package","package":"a-package-that-does-not-exist"}]}' > /tmp/imp.json`);
+  await must("anchor", `docker cp /tmp/imp.json mesh-control:/imp.json`);
+  await mesh("module add /imp.json");
+  await mesh("assign laptop impossible");
+  await mesh("push laptop");
+  await new Promise((r) => setTimeout(r, 10_000));
+
+  const said = await mesh("status");
+  assert.match(said, /not doing what they were told/, said);
+  assert.match(said, /laptop/, said);
+  // The machine's own words about the resource that failed, not a summary written at this end.
+  assert.match(said, /impossible\.nothing/, `the failing resource is not named:\n${said}`);
+
+  // And the distinction survives: this machine FAILED, it did not refuse. Refused means it is
+  // exactly as it was; failed means it is in a state nobody declared, and they are fixed in
+  // different places.
+  assert.match(said, /laptop\s+failed/, said);
+
+  // The other machine is not implicated.
+  assert.doesNotMatch(said.split("not heard from")[0] ?? said, /anchor\s+(failed|refused)/,
+    "a machine that did as it was told is listed as wrong");
+});