diff --git a/modules/builder/module.json b/modules/builder/module.json
index 6aaec88..508852e 100644
--- a/modules/builder/module.json
+++ b/modules/builder/module.json
@@ -69,7 +69,8 @@
         "kind": "image",
         "from": "Dockerfile",
         "context": {
-          "repository": "https://git.novox.be/novox/mesh-controller.git",
+          "seat": "git",
+          "repository": "novox/mesh-controller",
           "ref": "main"
         }
       }
diff --git a/modules/de-spiegel/module.json b/modules/de-spiegel/module.json
index 9875cd4..46f0ff7 100644
--- a/modules/de-spiegel/module.json
+++ b/modules/de-spiegel/module.json
@@ -27,7 +27,7 @@
       "port": 35621,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the de-spiegel site and its /contact endpoint over http; the public name de-spiegel.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the de-spiegel site and its /contact endpoint over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -61,7 +61,10 @@
       "ports": [
         "35621"
       ],
-      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (de-spiegel server/index.js); converting is that repository's change"
+      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (de-spiegel server/index.js); converting is that repository's change",
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }
diff --git a/modules/invoicing/module.json b/modules/invoicing/module.json
index bc1ce77..f2eec75 100644
--- a/modules/invoicing/module.json
+++ b/modules/invoicing/module.json
@@ -87,7 +87,10 @@
       },
       "ports": [
         "80"
-      ]
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     },
     {
       "id": "api",
@@ -105,7 +108,10 @@
       "ports": [
         "9000"
       ],
-      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (invoicing-app server/src/config.js); converting is that repository's change"
+      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (invoicing-app server/src/config.js); converting is that repository's change",
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }
diff --git a/modules/keycloak/module.json b/modules/keycloak/module.json
index bfef938..e1da310 100644
--- a/modules/keycloak/module.json
+++ b/modules/keycloak/module.json
@@ -77,6 +77,13 @@
       "type": "network",
       "name": "keycloak"
     },
+    {
+      "id": "hostname-env",
+      "type": "file",
+      "path": "/var/lib/keycloak/hostname.env",
+      "mode": "0600",
+      "content": "KC_HOSTNAME=https://${bound:route:name}\n"
+    },
     {
       "id": "server",
       "type": "container",
@@ -90,12 +97,12 @@
         "KC_DB": "postgres",
         "KC_HTTP_ENABLED": "true",
         "KC_HEALTH_ENABLED": "true",
-        "KC_HOSTNAME": "https://keycloak.novox.be",
         "KC_PROXY_HEADERS": "xforwarded"
       },
       "env-file": [
         "/var/lib/keycloak/admin.env",
-        "/var/lib/keycloak/database.env"
+        "/var/lib/keycloak/database.env",
+        "/var/lib/keycloak/hostname.env"
       ],
       "ports": [
         "8080"
diff --git a/modules/mailu/README.md b/modules/mailu/README.md
new file mode 100644
index 0000000..ba5d344
--- /dev/null
+++ b/modules/mailu/README.md
@@ -0,0 +1,17 @@
+# mailu
+
+Mail — Mailu, with its provisioner (the `smtp` provision) and tools, on the tool runtime.
+
+## Settings
+
+A definition names no mesh (novox/hq ADR 0112, ADR 0155), so the values that are this
+installation's are settings on the assignment, `settings set mailu <file>`:
+
+```json
+{"domain": "…", "sitename": "…", "website": "https://…", "proxy-address": "…"}
+```
+
+`domain` is the mail domain (also the provisioner's, for a consumer's address); `sitename` and
+`website` are shown by the web front; `proxy-address` is what `REAL_IP_FROM` trusts a real-IP
+header from — the address the proxy forwards with. The front's own hostname is the name of its
+`web` route, told to it by the mesh.
diff --git a/modules/mailu/module.json b/modules/mailu/module.json
index b7e7c60..98447f6 100644
--- a/modules/mailu/module.json
+++ b/modules/mailu/module.json
@@ -127,14 +127,14 @@
       "port": 7443,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the web front over its own TLS (admin, webmail, API); the public name mail.novox.be is a route grant reaching it here"
+      "why": "the web front over its own TLS (admin, webmail, API); its public name is a route grant reaching it here"
     },
     {
       "name": "autoconfig",
       "port": 4243,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "automx: mail client autoconfiguration; autoconfig/autodiscover/automx.novox.be are route grants reaching it here"
+      "why": "automx: mail client autoconfiguration; the autoconfig, autodiscover and automx names are route grants reaching it here"
     }
   ],
   "own-secrets": {
@@ -168,7 +168,7 @@
       "type": "file",
       "path": "${dir:state}/mailu.env",
       "mode": "0644",
-      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
+      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=${setting:domain}\nHOSTNAMES=${bound:route:name-web}\nPOSTMASTER=admin\nSITENAME=${setting:sitename}\nWEBSITE=${setting:website}\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=${setting:domain}\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=${bound:route:name-web}\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=${bound:route:name-web}\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=${setting:domain}\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=${setting:proxy-address}\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
     },
     {
       "id": "secret-env",
@@ -490,7 +490,6 @@
         "MESH_MAILU_API_KEY_FILE": "/run/secrets/api-token",
         "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
         "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
-        "MESH_MAILU_DOMAIN": "novox.be",
         "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "restart-on": [
@@ -553,9 +552,7 @@
   ],
   "serves": {
     "smtp": {
-      "port": 587,
-      "domain": "novox.be",
-      "name": "mail.novox.be"
+      "port": 587
     }
   },
   "receives": {
diff --git a/modules/mailu/provisioner/index.ts b/modules/mailu/provisioner/index.ts
index 2b73274..bef72c3 100644
--- a/modules/mailu/provisioner/index.ts
+++ b/modules/mailu/provisioner/index.ts
@@ -13,17 +13,32 @@
 // it to both ends; mailu sets exactly that password every run — so a rotation takes — and seals
 // nothing: the consumer already has its copy through the mesh's own channel.
 
+import { readFileSync } from "node:fs";
 import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
 import { MailuClient } from "../client.js";
 
 const mailu = MailuClient.fromEnv();
 
-// The mail server's own domain. From the environment the manifest composes, because the client's
-// config file carries the admin API's coordinates, not the mail domain.
+// The mail server's own domain: the operator's value, from the settings the mesh merges into this
+// module's config file (`settings set mailu` with {"domain": …}; novox/hq ADR 0112, ADR 0155). A
+// definition names no mesh, so it is never a literal in the manifest — and it used to be, as
+// MESH_MAILU_DOMAIN, which is still read for a mesh that has not re-registered the manifest.
 function domain(): string {
+  const file = process.env.MESH_MAILU_CONFIG_FILE;
+  if (file) {
+    try {
+      const config = JSON.parse(readFileSync(file, "utf8")) as { domain?: unknown };
+      if (typeof config.domain === "string" && config.domain.trim() !== "") return config.domain.trim();
+    } catch {
+      // Unreadable or not JSON: fall through to the environment, and the error below names both.
+    }
+  }
   const named = (process.env.MESH_MAILU_DOMAIN ?? "").trim();
   if (named === "") {
-    throw new Error("MESH_MAILU_DOMAIN is not set, so a consumer's address cannot be composed");
+    throw new Error(
+      "no mail domain is set, so a consumer's address cannot be composed — `settings set mailu <file>` " +
+        'with {"domain": "<the mail domain>"}',
+    );
   }
   return named;
 }
diff --git a/modules/matrix/module.json b/modules/matrix/module.json
index 13964f9..5dd6853 100644
--- a/modules/matrix/module.json
+++ b/modules/matrix/module.json
@@ -55,7 +55,10 @@
       "type": "file",
       "path": "${dir:state}/conduit.toml",
       "mode": "0644",
-      "content": "# Written by the mesh (modules/matrix). Conduit reads this file (CONDUIT_CONFIG); nothing comes\n# from the environment. server_name is the homeserver's permanent identity: every user id, room id\n# and signature in the database carries it, so it is the name this module is served under\n# (${bound:route:name-homeserver}) and never changes once a database exists.\n[global]\nserver_name = \"${bound:route:name-homeserver}\"\ndatabase_backend = \"rocksdb\"\ndatabase_path = \"/var/lib/matrix-conduit/\"\naddress = \"0.0.0.0\"\nport = 6167\nmax_request_size = 20000000\nallow_registration = false\nallow_federation = true\nallow_check_for_updates = true\ntrusted_servers = [\"matrix.org\"]\n"
+      "content": "# Written by the mesh (modules/matrix). Conduit reads this file (CONDUIT_CONFIG); nothing comes\n# from the environment. server_name is the homeserver's permanent identity: every user id, room id\n# and signature in the database carries it, so it is the name this module is served under\n# (${bound:route:name-homeserver}) and never changes once a database exists.\n[global]\nserver_name = \"${bound:route:name-homeserver}\"\ndatabase_backend = \"rocksdb\"\ndatabase_path = \"/var/lib/matrix-conduit/\"\naddress = \"0.0.0.0\"\nport = 6167\nmax_request_size = 20000000\nallow_registration = false\nallow_federation = true\nallow_check_for_updates = true\ntrusted_servers = [\"matrix.org\"]\n",
+      "names-on-purpose": {
+        "matrix.org": "the federation's public key server, trusted by default; the world's, not this mesh's"
+      }
     },
     {
       "id": "element-conf",
@@ -63,7 +66,19 @@
       "path": "${dir:state}/element.json",
       "mode": "0644",
       "merge": "json",
-      "content": "{\n  \"default_server_name\": \"${bound:route:name-homeserver}\",\n  \"default_server_config\": {\n    \"m.homeserver\": {\n      \"base_url\": \"https://${bound:route:name-homeserver}\"\n    },\n    \"m.identity_server\": {\n      \"base_url\": \"https://vector.im\"\n    }\n  },\n  \"brand\": \"Element\",\n  \"integrations_ui_url\": \"https://scalar.vector.im/\",\n  \"integrations_rest_url\": \"https://scalar.vector.im/api\",\n  \"integrations_widgets_urls\": [\n    \"https://scalar.vector.im/_matrix/integrations/v1\",\n    \"https://scalar.vector.im/api\",\n    \"https://scalar-staging.vector.im/_matrix/integrations/v1\",\n    \"https://scalar-staging.vector.im/api\",\n    \"https://scalar-staging.riot.im/scalar/api\"\n  ],\n  \"bug_report_endpoint_url\": \"https://element.io/bugreports/submit\",\n  \"uisi_autorageshake_app\": \"element-auto-uisi\",\n  \"show_labs_settings\": true,\n  \"room_directory\": {\n    \"servers\": [\n      \"${bound:route:name-homeserver}\",\n      \"matrix.org\",\n      \"gitter.im\",\n      \"libera.chat\"\n    ]\n  },\n  \"enable_presence_by_hs_url\": {\n    \"https://matrix.org\": false,\n    \"https://matrix-client.matrix.org\": false\n  },\n  \"terms_and_conditions_links\": [\n    {\n      \"url\": \"https://element.io/privacy\",\n      \"text\": \"Privacy Policy\"\n    },\n    {\n      \"url\": \"https://element.io/cookie-policy\",\n      \"text\": \"Cookie Policy\"\n    }\n  ],\n  \"features\": {\n    \"feature_video_rooms\": true,\n    \"feature_rust_crypto\": true\n  },\n  \"element_call\": {\n    \"url\": \"https://call.element.dev\"\n  }\n}\n"
+      "content": "{\n  \"default_server_name\": \"${bound:route:name-homeserver}\",\n  \"default_server_config\": {\n    \"m.homeserver\": {\n      \"base_url\": \"https://${bound:route:name-homeserver}\"\n    },\n    \"m.identity_server\": {\n      \"base_url\": \"https://vector.im\"\n    }\n  },\n  \"brand\": \"Element\",\n  \"integrations_ui_url\": \"https://scalar.vector.im/\",\n  \"integrations_rest_url\": \"https://scalar.vector.im/api\",\n  \"integrations_widgets_urls\": [\n    \"https://scalar.vector.im/_matrix/integrations/v1\",\n    \"https://scalar.vector.im/api\",\n    \"https://scalar-staging.vector.im/_matrix/integrations/v1\",\n    \"https://scalar-staging.vector.im/api\",\n    \"https://scalar-staging.riot.im/scalar/api\"\n  ],\n  \"bug_report_endpoint_url\": \"https://element.io/bugreports/submit\",\n  \"uisi_autorageshake_app\": \"element-auto-uisi\",\n  \"show_labs_settings\": true,\n  \"room_directory\": {\n    \"servers\": [\n      \"${bound:route:name-homeserver}\",\n      \"matrix.org\",\n      \"gitter.im\",\n      \"libera.chat\"\n    ]\n  },\n  \"enable_presence_by_hs_url\": {\n    \"https://matrix.org\": false,\n    \"https://matrix-client.matrix.org\": false\n  },\n  \"terms_and_conditions_links\": [\n    {\n      \"url\": \"https://element.io/privacy\",\n      \"text\": \"Privacy Policy\"\n    },\n    {\n      \"url\": \"https://element.io/cookie-policy\",\n      \"text\": \"Cookie Policy\"\n    }\n  ],\n  \"features\": {\n    \"feature_video_rooms\": true,\n    \"feature_rust_crypto\": true\n  },\n  \"element_call\": {\n    \"url\": \"https://call.element.dev\"\n  }\n}\n",
+      "names-on-purpose": {
+        "matrix.org": "the public room directory and the federation's largest homeserver; the world's",
+        "matrix-client.matrix.org": "the same homeserver's client endpoint; the world's",
+        "vector.im": "Element's public identity server; the world's",
+        "scalar.vector.im": "Element's public integration manager; the world's",
+        "scalar-staging.vector.im": "Element's staging integration manager, named by the upstream default config; the world's",
+        "scalar-staging.riot.im": "the same, under its former name; the world's",
+        "element.io": "Element's bug reports, privacy and cookie pages; the world's",
+        "gitter.im": "a public room directory; the world's",
+        "libera.chat": "a public room directory; the world's",
+        "call.element.dev": "Element Call's public instance; the world's"
+      }
     },
     {
       "id": "net",
diff --git a/modules/minio/module.json b/modules/minio/module.json
index a251ddb..6a854bf 100644
--- a/modules/minio/module.json
+++ b/modules/minio/module.json
@@ -86,7 +86,7 @@
       "type": "file",
       "path": "/var/lib/minio/root.env",
       "mode": "0600",
-      "content": "MINIO_ROOT_USER=meshroot\n"
+      "content": "MINIO_ROOT_USER=meshroot\nMINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}\n"
     },
     {
       "id": "data",
@@ -124,7 +124,6 @@
       ],
       "env": {
         "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
-        "MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be",
         "MINIO_REGION": "eu-west"
       }
     },
diff --git a/modules/n8n/module.json b/modules/n8n/module.json
index a1810e8..f3db82c 100644
--- a/modules/n8n/module.json
+++ b/modules/n8n/module.json
@@ -33,7 +33,7 @@
       "port": 5682,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the n8n editor and webhook endpoints over http; the public name n8n.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the n8n editor and webhook endpoints over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -55,7 +55,7 @@
       "type": "file",
       "path": "/var/lib/n8n/server.env",
       "mode": "0600",
-      "content": "N8N_HOST=n8n.novox.be\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://n8n.novox.be/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
+      "content": "N8N_HOST=${bound:route:name}\nN8N_PORT=5678\nN8N_PROTOCOL=https\nWEBHOOK_URL=https://${bound:route:name}/\nN8N_BASIC_AUTH_ACTIVE=true\nN8N_BASIC_AUTH_USER=admin\nN8N_BASIC_AUTH_PASSWORD=${secret:basic-auth}\nNODE_FUNCTION_ALLOW_BUILTIN=*\nNODE_FUNCTION_ALLOW_EXTERNAL=*\nDB_TYPE=postgresdb\nDB_POSTGRESDB_HOST=${bound:postgres-database:at}\nDB_POSTGRESDB_PORT=${bound:postgres-database:port}\nDB_POSTGRESDB_DATABASE=${bound:postgres-database:as}\nDB_POSTGRESDB_USER=${bound:postgres-database:as}\nDB_POSTGRESDB_PASSWORD=${secret:postgres-database}\n"
     },
     {
       "id": "net",
diff --git a/modules/only-office/module.json b/modules/only-office/module.json
index 9285015..8763ac6 100644
--- a/modules/only-office/module.json
+++ b/modules/only-office/module.json
@@ -26,7 +26,7 @@
       "port": 9070,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the document server over http; the public name office.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the document server over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
diff --git a/modules/photos-eef/module.json b/modules/photos-eef/module.json
index b090d4c..96dd317 100644
--- a/modules/photos-eef/module.json
+++ b/modules/photos-eef/module.json
@@ -23,7 +23,7 @@
       "port": 4012,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the eef photos client site over http; the public name eef.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the eef photos client site over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -46,7 +46,10 @@
       "network": "photos-eef",
       "ports": [
         "80"
-      ]
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }
diff --git a/modules/photos-filip/module.json b/modules/photos-filip/module.json
index 9e9130f..9e0c286 100644
--- a/modules/photos-filip/module.json
+++ b/modules/photos-filip/module.json
@@ -23,7 +23,7 @@
       "port": 4013,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the filip photos client site over http; the public name filip.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the filip photos client site over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -46,7 +46,10 @@
       "network": "photos-filip",
       "ports": [
         "80"
-      ]
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }
diff --git a/modules/photos/module.json b/modules/photos/module.json
index df458a4..fbfa007 100644
--- a/modules/photos/module.json
+++ b/modules/photos/module.json
@@ -43,7 +43,7 @@
       "port": 4001,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the admin client site over http; the public name photos.novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the admin client site over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
@@ -77,7 +77,10 @@
       "ports": [
         "9000"
       ],
-      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (photos server/src/config.js); converting is that repository's change"
+      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (photos server/src/config.js); converting is that repository's change",
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     },
     {
       "id": "admin-client",
@@ -87,7 +90,10 @@
       "network": "photos",
       "ports": [
         "80"
-      ]
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }
diff --git a/modules/portainer/module.json b/modules/portainer/module.json
index 26844b6..00a1326 100644
--- a/modules/portainer/module.json
+++ b/modules/portainer/module.json
@@ -11,7 +11,7 @@
       "port": 9090,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
+      "why": "the dashboard over http; its public name is a route grant and the proxy reaches it here — the machine side of 9090:9000, the predecessor's number"
     },
     {
       "name": "web-tls",
diff --git a/modules/route-proxy/module.json b/modules/route-proxy/module.json
index e861991..0285b38 100644
--- a/modules/route-proxy/module.json
+++ b/modules/route-proxy/module.json
@@ -162,7 +162,8 @@
         "kind": "image",
         "from": "Dockerfile",
         "context": {
-          "repository": "https://git.novox.be/novox/mesh-controller.git",
+          "seat": "git",
+          "repository": "novox/mesh-controller",
           "ref": "main"
         }
       },
diff --git a/modules/novox.be/module.json b/modules/website/module.json
similarity index 56%
rename from modules/novox.be/module.json
rename to modules/website/module.json
index d502281..785885f 100644
--- a/modules/novox.be/module.json
+++ b/modules/website/module.json
@@ -1,5 +1,5 @@
 {
-  "module": "novox.be",
+  "module": "website",
   "version": "1",
   "capabilities": [
     "container-runtime"
@@ -14,7 +14,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/novox.be/route.json"
+    "route": "${dir:state}/route.json"
   },
   "listens": [
     {
@@ -22,30 +22,33 @@
       "port": 4000,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the public website over http; the public name novox.be is a route grant, and route-proxy reaches it on this published port"
+      "why": "the public website over http; its public name is a route grant, and route-proxy reaches it on this published port"
     }
   ],
   "resources": [
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/novox.be",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "net",
       "type": "network",
-      "name": "novox-be"
+      "name": "website"
     },
     {
       "id": "server",
       "type": "container",
-      "name": "novox-be",
+      "name": "website",
       "image": "registry-api.novox.be/novox/www@sha256:aa7ed20a293e1d7444c5c5d59b6d8bdb382bad159559a22e006810e379cae69c",
       "network": "novox-be",
       "ports": [
         "8080"
-      ]
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
     }
   ]
 }