Run the proof of the operator's answers in the Go toolchain on every pull request, and say NOT RUN loudly where it cannot

The review of 2026-10-09: the build seat runs the lab's merge-check.sh in the TypeScript toolchain, which
holds no Go, so the proof never ran there. It is now a declared part of its own (mesh-check-also), run
against the controller, runtime and catalogue cloned beside the lab; a missing clone or a controller
without the proof's fixture is said NOT RUN in capitals instead of failing every lab change.

asks/harness_test.go

@@ -84,6 +84,20 @@ func clonesFor(t *testing.T) clones {
 				"MESH_LAB_CATALOGUE)", want)
 		}
 	}
+	// The controller beside is, on the build seat, the one the mesh runs: until it carries the proof's fixture
+	// (mesh-controller's TestTheAsksLabBus), the proof cannot compose its bus, and says so rather than fail
+	// every pull request of the lab for a merge not yet made.
+	fixtures, _ := filepath.Glob(filepath.Join(c.controller, "internal", "inventory", "*_test.go"))
+	has := false
+	for _, f := range fixtures {
+		if body, err := os.ReadFile(f); err == nil && strings.Contains(string(body), "func TestTheAsksLabBus(") {
+			has = true
+		}
+	}
+	if !has {
+		t.Skipf("NOT RUN: the controller at %s has no TestTheAsksLabBus, the fixture that composes the proof's bus "+
+			"(mesh-controller #157): the proof runs once the controller it is given carries it", c.controller)
+	}
 	return c
 }
 

asks/merge-check.sh

@@ -1,7 +1,17 @@
 #!/bin/sh
-# The proof of the operator's answers (novox/hq ADR 0259): formatted, vetted, and run where the clones it
-# builds are beside it (MESH_LAB_REPOS, or MESH_LAB_CONTROLLER, MESH_LAB_TOOLS and MESH_LAB_CATALOGUE);
-# elsewhere it says NOT RUN and why. It takes about four minutes when it runs.
+# mesh-check-toolchain: go
+#
+# The proof of the operator's answers (novox/hq ADR 0259), the Go part of the lab's own check: run by the
+# build seat in the mesh's Go toolchain, its own container, because the lab's merge-check.sh declares it
+# (`# mesh-check-also: go asks/merge-check.sh`) — and by hand: `sh asks/merge-check.sh`.
+#
+# Formatted, vetted, and run against the clones beside the lab: on the build seat those are the controller,
+# the runtime and the catalogue **the mesh runs**, so every pull request of the lab proves the answers the
+# operator would get today. By hand, MESH_LAB_REPOS, or MESH_LAB_CONTROLLER, MESH_LAB_TOOLS and
+# MESH_LAB_CATALOGUE, point it at branches under review. It takes about four minutes when it runs.
+#
+# **Said, never passed silently**: where a clone is missing, or the controller predates the proof's fixture,
+# it says NOT RUN and why, in capitals, and passes; a proof that runs and fails, fails the check.
 set -eu
 cd "$(dirname "$0")"
 export GOPRIVATE=git.novox.be
@@ -17,7 +27,11 @@ go vet ./...
 out=$(mktemp)
 status=0
 go test -count=1 -timeout 25m -v -run '^TestTheOperatorsAnswerEndToEnd$' . >"$out" 2>&1 || status=$?
-grep -E '^(--- |    --- |ok|FAIL|PASS)|NOT RUN' "$out" || true
+grep -E '^(--- |    --- |ok|FAIL|PASS)' "$out" || true
+if grep -q 'NOT RUN' "$out"; then
+	echo "NOT RUN: THE PROOF OF THE OPERATOR'S ANSWERS DID NOT RUN HERE:"
+	grep -o 'NOT RUN: .*' "$out" | head -3
+fi
 [ "$status" -eq 0 ] || tail -60 "$out"
 rm -f "$out"
 exit "$status"

merge-check.sh

@@ -1,6 +1,7 @@
 #!/bin/sh
 # mesh-check-toolchain: typescript
 # mesh-check-also: go replays/merge-check.sh
+# mesh-check-also: go asks/merge-check.sh
 #
 # The lab's own check (novox/hq ADR 0237 as amended): the second layer of a pull request's merge check,
 # `mesh/repo-check`, run by the build seat — and by hand.
@@ -11,8 +12,10 @@
 #
 #   - this script, in the TypeScript toolchain: installed from the lock file, type-checked, sources and
 #     tests, and the unit suite;
-#   - replays/merge-check.sh, in the Go toolchain, declared on the line above: the replays register and its
-#     prover formatted, vetted and compiled, and the register's own tests.
+#   - replays/merge-check.sh, in the Go toolchain, declared above: the replays register and its prover
+#     formatted, vetted and compiled, and the register's own tests;
+#   - asks/merge-check.sh, in the Go toolchain, declared above: the proof of the operator's answers, run
+#     against the controller, runtime and catalogue cloned beside the lab (novox/hq ADR 0259).
 #
 # **Said, never passed silently**: the integration suite raises a lab on a workstation, and the replays
 # raise containers through the container runtime — neither is given to code nobody has approved. The
@@ -29,6 +32,6 @@ if command -v go >/dev/null 2>&1; then
 	sh replays/merge-check.sh
 	sh asks/merge-check.sh
 else
-	echo "replays/ (Go) is checked by replays/merge-check.sh, which the build seat runs in the Go toolchain"
+	echo "replays/ and asks/ (Go) are checked by their merge-check.sh, which the build seat runs in the Go toolchain"
 fi
 echo "NOT RUN HERE: the integration suite and the replays — they need a lab and the container runtime"