diff --git a/modules/docker/README.md b/modules/docker/README.md
index 2f85be97b..6b893c395 100644
--- a/modules/docker/README.md
+++ b/modules/docker/README.md
@@ -36,10 +36,10 @@ either. Under ADR 0196 a container copies its machine's resolvers, so no module
 controller's private network wrote `insecure-registries`; under ADR 0222 the controller writes
 nothing into this file, and this module states the registry itself (the order below).
 
-- `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}`,
+- `daemon`: `{"live-restore": true, "insecure-registries": ["${seat:container-image-registry:reach}"]}`,
   merged into the file beside the keys others write.
-- `${seat:mesh-artifact-store:reach}` is where this machine reaches the mesh's artifact store
-  (host:port), filled in by the controller: no binding, no credential, the same address the mesh
+- `${seat:container-image-registry:reach}` is where this machine reaches the mesh's artifact store
+  (host:port), the image seat holder's listen open to the mesh (ADR 0632 §1), filled in by the node-engine: no binding, no credential, the same address the mesh
   composes into every image it built. Trusting it in the clear is ADR 0082's decision: every path to
   it is inside the private network's encryption. While no machine on the network holds the store the
   answer is empty, and the controller drops the empty member, so the list gets nothing.
diff --git a/modules/docker/cmd/docker-tools/logrotation_test.go b/modules/docker/cmd/docker-tools/logrotation_test.go
index 381df1e2e..fbdef2b97 100644
--- a/modules/docker/cmd/docker-tools/logrotation_test.go
+++ b/modules/docker/cmd/docker-tools/logrotation_test.go
@@ -68,7 +68,12 @@ func filled(t *testing.T, m manifestForLogs, content string) string {
 	if len(missing) > 0 {
 		t.Fatalf("the content asks for %v, which the manifest gives no preference default", missing)
 	}
-	return strings.ReplaceAll(out, "${seat:mesh-artifact-store:reach}", "registry.example:5100")
+	// The store's address is the image seat holder's listen (novox/hq ADR 0632 §1), never the retired provision's.
+	const reach = "${seat:container-image-registry:reach}"
+	if strings.Contains(content, "insecure-registries") && !strings.Contains(content, reach) {
+		t.Fatalf("the runtime trusts no %s: %s", reach, content)
+	}
+	return strings.ReplaceAll(out, reach, "registry.example:5100")
 }
 
 func TestTheDefaultLogRotationIsTheOneTheHandSetMachineHas(t *testing.T) {
diff --git a/modules/docker/files/daemon.json b/modules/docker/files/daemon.json
index 83750f4bd..c8fb9c7ee 100644
--- a/modules/docker/files/daemon.json
+++ b/modules/docker/files/daemon.json
@@ -1 +1 @@
-{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}
+{"live-restore": true, "insecure-registries": ["${seat:container-image-registry:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}