# Diagnosis — 2026-09-21

1. The renames the report asked for were sized: each bed uses its borrowed name twenty to sixty
   times, most of them container names and paths that could stay; the name itself appears in the
   manifest, in the `assign` and `module issue` commands, and in the broker account the bed
   asserts on, `<node>-<module>`.
2. Then the account was read. The mesh scopes a module's broker account to `serve.<module>.*`
   from the manifest's name, and the tool runtime binds its queues under the module name baked
   into its image. A fixture named `redis-fixture` running the real redis runtime would be
   refused the queues it serves on. The name is not a label. **A fixture that runs a module's
   runtime carries the module's name**, and therefore reads the catalogue
   ([ADR 0093](../../02-DECISIONS/0093-a-fixture-that-runs-a-modules-runtime-carries-its-name.md)).
3. Of the twelve, the two whose only cut was the vault's secret — the grant bed and the
   backend-network bed, both redis — read the catalogue's redis now and install the vault beside
   it, as the vault bed does. The rest are declared with this reason: four sidecar beds need the
   module's server raised (and, for grafana and sonarr, the route module); the minio and postgres
   grant beds raise a second store beside the foundation's; the route-forwarding bed needs the
   certificate authority; the largest mesh test carries a declaration-only postgres, a builder
   that builds itself and an umami of another shape.

**Located in:** mesh-lab, the ten declared beds, one conversion each with a lab run. Not renamed,
by decision; converted two at a time as the modules they need are raised beside them.

*2026-09-21, later.* Ten conversions were the wrong shape. Six of the ten beds duplicated coverage
that exists elsewhere since the catalogue beds and the whole-mesh beds read the catalogue: the four
sidecar beds proved a sidecar alone, which the module beds prove whole; the minio and postgres
grant beds proved a grant with a second store beside the foundation's, which the grant bed and
the vault bed prove against the catalogue. Retired, with their scenarios. Two remain declared:
route-forwarding, which needs the certificate authority beside the proxy, and the large mesh test.

*Route-forwarding's conversion is blocked:* the catalogue's authority cannot be raised as written
([issue 076](../076-a-served-fact-made-at-first-start-cannot-be-served/00-report.md)).

*Later the same day.* Route-forwarding converted, with the authority beside the proxy
(ADR 0098). One bed remains declared: the large mesh test, with its three fixtures.

*2026-09-21, late.* The last three `WEARING` declarations are gone. The large mesh test's fixtures
are `a-store` (a provider with no resources) and `adopted-analytics`, its builder fixture retired below; the
runtime-restart bed's fixture is `a-runtime`. The credential-mechanism bed could not be renamed:
its runtime image is the catalogue's, and a runtime names its queues by the module compiled into
it, so the mesh's account for a module of another name is refused at the broker. It was retired —
the grant end-to-end bed proves the same login against the catalogue's redis, with the mesh writing
the contributions the retired bed wrote by hand — and its one assertion nothing else made (the
provider needs no seal key) moved there. Running the large test's renamed tests found two things
its long idleness had hidden: the consumer fixture's login exceeded a backend's twenty characters
(ADR 0049; it has a slug now), and the builder-as-module test declared the builder's image as an
upstream artifact by bare image ID, which a registry copy cannot fetch since ADR 0096 — retired,
since genesis installs the catalogue's builder and proves the same. The large test as a whole has
not been run end to end; its renamed tests and the tests around them have.