diff --git a/test/integration/mesh.test.ts b/test/integration/mesh.test.ts
index b755f80..bf3d477 100644
--- a/test/integration/mesh.test.ts
+++ b/test/integration/mesh.test.ts
@@ -1972,15 +1972,17 @@ test("the forge runs, on a database the mesh gave it", { skip, timeout: 900_000
     (await on("anchor",
       `docker exec postgres psql -U postgres -qAt -c ${quote(q)}`, 60_000)).out.trim();
 
+  // Both halves in one poll. The provisioner makes the role and then the database, and a test
+  // that waited for the first and checked the second once was racing the gap between two
+  // statements — it lost, once, eighteen seconds into a run.
   let made = "";
   for (let i = 0; i < 40 && made !== "t"; i++) {
-    made = await psql("select true from pg_roles where rolname = 'mesh_anchor_gitea'");
+    made = await psql("select true from pg_roles where rolname = 'mesh_anchor_gitea'" +
+      " and exists (select from pg_database where datname = 'gitea')");
     if (made !== "t") await new Promise((r) => setTimeout(r, 3000));
   }
   assert.equal(made, "t",
     `no login was created for the forge:\n${(await on("anchor", "docker logs mesh-provision-postgres 2>&1 | tail -20")).out}`);
-  assert.equal(await psql("select true from pg_database where datname = 'gitea'"), "t",
-    "the login exists and the database it owns does not");
 
   // And the forge itself, answering. Not that its container exists — that it serves.
   //
@@ -2073,7 +2075,9 @@ test("a consumer's cache grant means exactly its own keys", { skip, timeout: 600
   }
   assert.ok(granted, `no user was created for the consumer:
 ` +
-    `${(await on("anchor", "docker logs mesh-provision-redis 2>&1 | tail -20")).out}`);
+    `containers:\n${(await on("anchor", "docker ps -a --format '{{.Names}} {{.Status}}' | head -20")).out}\n` +
+    `the store:\n${(await on("anchor", "docker logs redis 2>&1 | tail -15")).out}\n` +
+    `the provisioner:\n${(await on("anchor", "docker logs mesh-provision-redis 2>&1 | tail -15")).out}`);
 
   const asConsumer = (command: string) =>
     on("anchor", `docker exec redis redis-cli --no-auth-warning ` +