diff --git a/.build.yml b/.build.yml
index f05ab8f1fad69c152dfcf138c5d8e24194a7ffde..2d62dbd1b648cdf9b991761e731003cbc36b2bfd 100644
--- a/.build.yml
+++ b/.build.yml
@@ -122,6 +122,21 @@       # or go.sum — but an untracked or modified file here is a "+dirty" stamp
       # in the packaged binary, so say so out loud rather than trusting the
       # flag. docs/ci.md#cache_restore.
       git status --porcelain
+  - test: |
+      cd "$REPO"
+      # gofmt -l exits 0 whether or not it printed anything, so the only way to
+      # fail on its output is to look at the output; tee keeps the filenames in
+      # the log, where they are the whole diagnosis. See docs/ci.md#test.
+      gofmt -l . | tee /tmp/fmt
+      test ! -s /tmp/fmt || { echo "gofmt would change the files above" >&2; exit 1; }
+      go vet ./...
+      # `make test` and not a bare `go test ./...`: the test command lives in
+      # one place. There is no DSN guard and no service to reach — every suite
+      # here is hermetic (gitx builds a bare repo with the local git, web is
+      # httptest + ecoretest) — so nothing can skip, and a failure is a non-zero
+      # exit that fails this task. That is what the APKBUILD's `!check` now
+      # rests on. docs/ci.md#test.
+      make test
   - build: |
       cd "$REPO"
       # -d: makedepends come from `packages:` above, so skip abuild's own
diff --git a/APKBUILD b/APKBUILD
index aba8c3878993a84d3c1be0be785408577c8c76c4..a7023bab6cfeadcc8f9be80619807945a8f839ca 100644
--- a/APKBUILD
+++ b/APKBUILD
@@ -28,7 +28,14 @@ pkgdesc="Stateless diff/compare viewer for a sourcehut instance"
 url="https://sourcecraft.dev/bigbes/sr-ht-compare"
 arch="x86_64"
 license="MIT"
-# !check      — the Go tests need a live git.sr.ht API, not available in the VM
+# !check      — the suites are run by the `test` task of .build.yml, which runs
+#               BEFORE this package is built. They do NOT need a live git.sr.ht
+#               API — that claim was here for a year and was never true: every
+#               suite in this tree is hermetic (gitx/fixture_test.go builds a
+#               bare repo with the local git, web/web_test.go is httptest plus
+#               ecoretest). This option is therefore a promise that they ran
+#               elsewhere, not a statement that they are unrunnable, and it is
+#               only as good as that task staying fatal.
 # !tracedeps  — CGO_ENABLED=0, so there are no shared-object deps to trace
 options="!check !tracedeps"
 
diff --git a/docs/ci.md b/docs/ci.md
index 35f5dff40489d2ef6cce49592e630f28697dcf98..4c0753e69af0cb96e1fbbcbfa750654a046388fc 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -8,7 +8,7 @@ manifest carries pointers.
 
 The pipeline is one linear job on `alpine/edge`: install the cache helper,
 assemble the shared SCSS, make a throwaway signing key, decide the version,
-restore the Go caches, package with `abuild`, publish the apk to
+restore the Go caches, test, package with `abuild`, publish the apk to
 `repo.bigb.es/alpine/v3.22/bigbes`, save the caches.
 
 It is triggered by a push to the **sourcehut** side. A push to sourcecraft
@@ -187,11 +187,16 @@
 `go vet ./...` next, then `make test` — the Makefile, not a bare `go test ./...`,
 so that the test command lives in one place.
 
-No Postgres and no network. Every suite in this tree is hermetic:
+No Postgres, no network and **no guard**. Every suite in this tree is hermetic:
 `gitx/fixture_test.go` builds a bare repository with the local `git` binary, and
-`web/web_test.go` is `httptest` plus `ecoretest`. The APKBUILD's `!check` is
-about not running these a second time inside `abuild`, not about them needing
-something the VM lacks.
+`web/web_test.go` is `httptest` plus `ecoretest`. Nothing here is gated on an
+environment variable, so nothing can skip itself into a green build, and the
+only thing this task owes is a non-zero exit when `make test` fails.
+
+That last point is load-bearing for the APKBUILD. `options="!check"` used to say
+the tests could not run in the VM — a claim that was never true — and now says
+they ran *before* `abuild` did. Which is a promise about **this** task: soften it
+and `!check` becomes a package built with nothing tested.
 
 ## build
 
@@ -322,8 +327,6 @@ parallel — the copying would start beside the build it is supposed to follow.
 
 ## What is not here
 
-- **No test task in the same commit as the version fix.** They are two commits
-  on purpose: a red suite must not be able to hold up the packaging change.
 - **No coverage upload.** The sibling services POST their profile to cover.sr.ht
   at the end of the pipeline. Adding it here needs a token secret and a
   repository on cover.