A-9 tests: a bundle not serving its marked tool is refused at the load; a withheld marked call is said so

The runtime's load test gains rows (run with the Python fixture, before the bundles' skip): a bundle whose
marks name a tool it does not register serves no tool of its module, and one that registers it serves.
mesh_call's failure words move into Surface.callFailed, whose rows hold that only a marked tool reaching no
responder names withheld and mesh-grants.grants_user_list.

Builds: design 46 7-approval-mark §4, §6, §22

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

node-tools/internal/runtime/runtime_test.go

@@ -4,10 +4,12 @@ import (
 	"encoding/json"
 	"errors"
 	"os"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/novox/mesh-tools/node-tools/internal/approval"
 	"github.com/novox/mesh-tools/node-tools/internal/bus"
 	"github.com/novox/mesh-tools/node-tools/internal/launch"
 	mt "github.com/novox/mesh-tools/node-tools/internal/meshtest"
@@ -192,10 +194,49 @@ func TestEachBundleIsGivenItsOwnEnvironment(t *testing.T) {
 	}
 }
 
-// An entrypoint that is not executable is refused by name, and the others serve (ADR 0193).
+// unservingGate is an approval gate whose marks of each module name the tools given, so a bundle not registering them is
+// refused at the load (design 46 7-approval-mark §4).
+type unservingGate map[string][]string
+
+func (g unservingGate) Unserved(module, _ string, registered []string) []string {
+	var missing []string
+	for _, tool := range g[module] {
+		if !slices.Contains(registered, tool) {
+			missing = append(missing, tool)
+		}
+	}
+	return missing
+}
+func (unservingGate) Run(_ approval.Call, run func() (any, error)) (any, error) { return run() }
+
+// An entrypoint that is not executable is refused by name, and the others serve (ADR 0193). A bundle whose marks name a
+// tool it does not register is refused at the load, serving no tool of its module, and one that registers it serves
+// (design 46 7-approval-mark §4).
 func TestAnEntrypointThatIsNotExecutableIsRefused(t *testing.T) {
-	mt.NeedBundles(t)
 	mesh := mt.New(t)
+	{
+		mesh.Issue(t, mt.MembershipOf("marked", "anchor", true, nil))
+		mesh.Issue(t, mt.MembershipOf("served", "anchor", true, nil))
+		nodeTools := connect(t, "node-tools", "anchor")
+		asker := connect(t, "console", "workstation")
+		logs := &mt.Logs{}
+		stop, err := Run(nodeTools, []Served{{"marked", []string{mt.Fixture("caller-echo.py")}}, {"served", []string{mt.Fixture("caller-echo.py")}}},
+			nil, logs.Logf, WithGate(unservingGate{"marked": {"wipe"}, "served": {"who"}}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !logs.Has("marked's bundle", "failed to load: its marks name wipe, which it does not register (design 46 7-approval-mark §4)") {
+			t.Errorf("a bundle not serving its marked tool was not refused at the load:\n%s", logs.All())
+		}
+		if _, err := call(t, asker, "served.who@anchor", map[string]any{}); err != nil {
+			t.Errorf("a bundle serving its marked tool: %v", err)
+		}
+		if _, err := asker.Ask("marked.who@anchor", map[string]any{}, ""); !errors.Is(err, bus.ErrNoResponders) {
+			t.Errorf("a refused bundle's tool answered: %v", err)
+		}
+		stop()
+	}
+	mt.NeedBundles(t)
 	mesh.Issue(t, mt.MembershipOf("alpha", "anchor", false, nil))
 	mesh.Issue(t, mt.MembershipOf("plain", "anchor", false, nil))
 	nodeTools := connect(t, "node-tools", "anchor")