The uplink's managers are modules (hq ADR 0117)

networkmanager, systemd-networkd and dhcpcd each claim the-uplink and
declare only what keeps the machine's own network manager from
contradicting the mesh: the resolver file left to resolv-conf, mesh0
left alone. Never a link, profile or credential — the link is the
mesh's only channel to the machine, so NetworkManager and networkd are
reloaded on a change, never restarted, and dhcpcd (no reload; a restart
drops the address) takes its block at its next start.

modules/dhcpcd/module.json

@@ -0,0 +1,36 @@
+{
+  "module": "dhcpcd",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "the-uplink",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dhcpcd"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/dhcpcd.conf",
+      "mode": "0644",
+      "into": "block",
+      "content": "# Managed by the mesh (module dhcpcd). Only the lines between these markers are\n# the mesh's; the rest of this file is the operator's and is kept as it is.\n# dhcpcd reads no drop-in directory, so the mesh writes into its one file\n# rather than over it (novox/hq ADR 0102).\n#\n# This machine's uplink is dhcpcd's, and these two lines are the whole of what\n# the mesh asks of it (novox/hq ADR 0117). The mesh never declares an\n# interface, an address, a route, a wireless network or its credentials \u2014\n# the link dhcpcd keeps is the only channel the mesh reaches this machine over.\n#\n# nohook resolv.conf: the resolver file is the mesh's (resolv-conf). dhcpcd's\n# resolv.conf hook rewrites /etc/resolv.conf on every lease it takes or renews,\n# which would silently replace the mesh's resolver at the next renewal.\n#\n# denyinterfaces mesh0: the private network's interface is the mesh's. dhcpcd\n# never asks for a lease on it, and never takes it down.\n#\n# Both are global options. dhcpcd reads every line after an interface or ssid\n# line as that interface's own, so this block belongs above any such line; a\n# stock dhcpcd.conf has none. Both are as documented in dhcpcd.conf(5), which\n# was not installed on the machine this was written on.\n#\n# Applied at dhcpcd's next start, not now. dhcpcd.service cannot be reloaded\n# (CanReload=no, measured), and restarting it drops the address this machine is\n# reached at \u2014 its channel to the mesh. So nothing here restarts or reloads\n# it. On an adopted machine the predecessor's identical nohook line is normally\n# already in force, so nothing is waiting on that start.\nnohook resolv.conf\ndenyinterfaces mesh0\n"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "dhcpcd.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ]
+}