A3c kind: the fixture state refuses every key the bus refuses

The approval unit table's in-memory state held `<node>.act.sha256:<hex>`, a key the live bus
refuses, so the table passed while every marked call failed on the bus. meshtest.State now
refuses a key outside letters, digits and -/_= in dot-separated names, as the bus does, checked
with mesh-sdk's keys.CheckName per name; a row of the refusals table holds it.

Builds: design 46 7-approval-mark §13, §22; lead answer A-209

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

node-tools/internal/approval/approval_test.go

@@ -390,6 +390,18 @@ func TestTheRefusalsAndAnswers(t *testing.T) {
 				t.Fatalf("marked: %v, runs %d", err, w.runs)
 			}
 		}},
+		{"§13: the fixture state refuses a key the bus refuses, so every key the gate writes here is one the bus holds (A-209)", func(t *testing.T, w *world) {
+			if _, err := w.state.Put("n1.act.sha256:00", "x"); err == nil {
+				t.Fatal("the fixture state held a key with a colon, which the bus refuses")
+			}
+			if _, err := w.state.Create("n1..ask", "x"); err == nil {
+				t.Fatal("the fixture state held a key with an empty name")
+			}
+			_, _ = w.do(call("wipe", `{"dir":"scratch"}`))
+			if len(w.asked) != 1 || len(w.state.Vals) == 0 {
+				t.Fatalf("the gate kept nothing through the fixture state: asked %d, keys %d", len(w.asked), len(w.state.Vals))
+			}
+		}},
 		{"§13: an ask over 256 KiB is refused naming the cause", func(t *testing.T, w *world) {
 			c := call("wipe", `{}`)
 			c.Description = strings.Repeat("w", 300*1024)