Merge pull request 'The catalogue declares the event it emits on starting' (#129 ) from fix/the-catalogue-declares-the-event-it-emits into main

The catalogue declares the event it emits on starting
Its runtime announces that it has just started and may have missed builds — the event the control plane follows to replay them — and its manifest did not declare it. A module's authority on the bus is derived from what it declares, so the publish was refused and the runtime died on start, in a loop, with the mesh's graph never catching up.
2026-09-28 07:49:06 +00:00 · 2026-09-28 09:49:03 +02:00 · 2026-09-28 07:20:05 +00:00 · 2026-09-28 09:17:38 +02:00 · 2026-09-28 03:08:22 +00:00 · 2026-09-28 05:08:20 +02:00
122 changed files with 1202 additions and 1804 deletions
@@ -1,56 +0,0 @@
-{
-  "module": "amqp-email-forwarder",
-  "version": "1",
-  "slug": "emailfwd",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "amqp"
-  ],
-  "contributes": {},
-  "binds": {
-    "amqp": "/var/lib/amqp-email-forwarder/amqp.json"
-  },
-  "secrets": {
-    "amqp": "/var/lib/amqp-email-forwarder/amqp.secret"
-  },
-  "own-secrets": {
-    "smtp-user": "/var/lib/amqp-email-forwarder/smtp-user.secret",
-    "smtp-password": "/var/lib/amqp-email-forwarder/smtp-password.secret"
-  },
-  "resources": [
-    {
-      "id": "state",
-      "type": "directory",
-      "path": "/var/lib/amqp-email-forwarder",
-      "mode": "0700"
-    },
-    {
-      "id": "app-env",
-      "type": "file",
-      "path": "/var/lib/amqp-email-forwarder/app.env",
-      "mode": "0600",
-      "content": "AMQP_HOST=${bound:amqp:at}\nAMQP_PORT=${bound:amqp:port}\nAMQP_USER=${bound:amqp:as}\nAMQP_VHOST=EMAILDELIVERY_T\nAMQP_EXCHANGE=News.TransactionalEmailing.Command\nAMQP_QUEUE=email-forwarder\nAMQP_URL=amqp://${bound:amqp:as}:${secret:amqp}@${bound:amqp:at}:${bound:amqp:port}/EMAILDELIVERY_T\nSMTP_HOST=mail.novox.be\nSMTP_PORT=587\nSMTP_USER=${secret:smtp-user}\nSMTP_PASSWORD=${secret:smtp-password}\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "amqp-email-forwarder"
-    },
-    {
-      "id": "app",
-      "type": "container",
-      "name": "amqp-email-forwarder",
-      "image": "registry-api.novox.be/novox/amqp-email-forwarder@sha256:f76d34646d9d3b2098c72688a63f6ae656f1888ffcb2f90a9c8dd2a44ad7f8af",
-      "network": "amqp-email-forwarder",
-      "env-file": [
-        "/var/lib/amqp-email-forwarder/app.env"
-      ],
-      "restart-on": [
-        "app-env"
-      ],
-      "secrets-in-environment": "the application's own code reads AMQP_URL, SMTP_USER and SMTP_PASSWORD from the environment (amqp-email-forwarder app.js); converting is that repository's change"
-    }
-  ]
-}
@@ -1,31 +0,0 @@
-# amqp-ping's runtime: the tool runtime, carrying this module's compiled code.
-#
-# **Built from this module's own directory and nothing else.** The sdk and the tool runtime are not
-# copied out of neighbouring checkouts — they are in the base image, which is published like any
-# other artifact. That is what makes this buildable by the mesh from a repository and a path
-# (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/amqp-ping
-COPY . .
-# The compiler is invoked by its real path, not through node_modules/.bin. Those are symlinks to
-# a launcher that requires its library relatively, and the base image resolves them when copying —
-# leaving a launcher whose relative require no longer points at anything.
-RUN node /app/node_modules/typescript/bin/tsc client.ts index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/amqp-ping/dist /app/modules/amqp-ping/dist
-# Declared rather than derived from which files happen to exist: the module knows what it serves.
-ENV MESH_TOOL_MODULES=/app/modules/amqp-ping/dist/index.js
@@ -1,191 +0,0 @@
-// amqp-ping's AMQP client — the demo consumer's own code (novox/hq ADR 0039). It speaks AMQP 0-9-1
-// directly over a raw TCP socket (node:net), the way redis's client speaks RESP: the module carries
-// NO npm dependency beyond @novox/mesh-sdk — no amqplib, no CLI in the image. It does exactly one
-// thing, the round-trip that proves the grant works: connect, authenticate with PLAIN to the vhost
-// the mesh named, declare a queue, publish one message and get it back.
-//
-// This is the consumer half of the `amqp` interface. It connects as the login the mesh derived
-// (`${bound:amqp:as}`) with the password the mesh minted (`${secret:amqp}`) to a vhost of that SAME
-// name — the provider named the vhost after the login, so the consumer must too. Nothing here is
-// hardcoded: user AND vhost are both the bound login, and a wrong vhost is refused by the broker.
-
-import { createConnection, type Socket } from "node:net";
-import { readFileSync } from "node:fs";
-
-const FRAME_END = 0xce;
-const PROTOCOL_HEADER = Buffer.from([0x41, 0x4d, 0x51, 0x50, 0x00, 0x00, 0x09, 0x01]); // "AMQP" 0-9-1
-
-export interface AmqpConn {
-  readonly host: string;
-  readonly port: number;
-  readonly user: string;
-  readonly password: string;
-  readonly vhost: string;
-}
-
-/** Build the connection facts from the environment the mesh's env-file set (see the module manifest). */
-export function connFromEnv(env: NodeJS.ProcessEnv = process.env): AmqpConn {
-  const host = env.MESH_AMQP_HOST ?? "";
-  const port = Number(env.MESH_AMQP_PORT ?? "5672") || 5672;
-  const user = env.MESH_AMQP_USER ?? "";
-  const vhost = env.MESH_AMQP_VHOST ?? user; // the provider names the vhost after the login
-  const password = env.MESH_AMQP_PASSWORD ?? readMaybe(env.MESH_AMQP_PASSWORD_FILE);
-  if (!host || !user || !password) {
-    throw new Error(`amqp-ping: connection is not fully set yet (host=${host} user=${user} password=${password ? "set" : "unset"})`);
-  }
-  return { host, port, user, password, vhost };
-}
-
-// --- wire helpers ---------------------------------------------------------------------------------
-
-function shortstr(s: string): Buffer {
-  const b = Buffer.from(s, "utf8");
-  const o = Buffer.alloc(1 + b.length);
-  o.writeUInt8(b.length, 0);
-  b.copy(o, 1);
-  return o;
-}
-function longstr(s: Buffer | string): Buffer {
-  const b = Buffer.isBuffer(s) ? s : Buffer.from(s, "utf8");
-  const o = Buffer.alloc(4 + b.length);
-  o.writeUInt32BE(b.length, 0);
-  b.copy(o, 4);
-  return o;
-}
-function u16(n: number): Buffer {
-  const o = Buffer.alloc(2);
-  o.writeUInt16BE(n, 0);
-  return o;
-}
-function u32(n: number): Buffer {
-  const o = Buffer.alloc(4);
-  o.writeUInt32BE(n, 0);
-  return o;
-}
-function frame(type: number, channel: number, payload: Buffer): Buffer {
-  const o = Buffer.alloc(7 + payload.length + 1);
-  o.writeUInt8(type, 0);
-  o.writeUInt16BE(channel, 1);
-  o.writeUInt32BE(payload.length, 3);
-  payload.copy(o, 7);
-  o.writeUInt8(FRAME_END, 7 + payload.length);
-  return o;
-}
-function method(channel: number, classId: number, methodId: number, ...parts: Buffer[]): Buffer {
-  return frame(1, channel, Buffer.concat([u16(classId), u16(methodId), ...parts]));
-}
-
-interface MethodWaiter {
-  classId: number;
-  methodId: number;
-  resolve: (args: Buffer) => void;
-  reject: (e: Error) => void;
-}
-
-/**
- * Connect, authenticate to the vhost, declare a queue, publish one message and get it back. Returns
- * the body that came back — the caller checks it equals what went out. Throws on any protocol error,
- * including the broker's `NOT_ALLOWED` refusal of a vhost the login has no permission on (the
- * isolation the provider builds, seen from the consumer's side).
- */
-export function roundTrip(conn: AmqpConn, queue = "amqp-ping", payload?: string): Promise<string> {
-  const body = Buffer.from(payload ?? `ping-${Date.now()}`);
-  return new Promise<string>((resolve, reject) => {
-    const sock: Socket = createConnection({ host: conn.host, port: conn.port });
-    let buf = Buffer.alloc(0);
-    const waiters: MethodWaiter[] = [];
-    let lastBody: Buffer | null = null;
-    let done = false;
-
-    const fail = (e: Error): void => {
-      if (done) return;
-      done = true;
-      sock.destroy();
-      reject(e);
-    };
-    const expect = (classId: number, methodId: number): Promise<Buffer> =>
-      new Promise((res, rej) => waiters.push({ classId, methodId, resolve: res, reject: rej }));
-
-    sock.on("error", (e) => fail(e));
-    sock.on("close", () => fail(new Error("amqp connection closed before the round-trip completed")));
-    sock.on("data", (chunk: Buffer) => {
-      buf = Buffer.concat([buf, chunk]);
-      for (;;) {
-        if (buf.length < 7) return;
-        const type = buf.readUInt8(0);
-        const size = buf.readUInt32BE(3);
-        if (buf.length < 7 + size + 1) return;
-        const framePayload = buf.subarray(7, 7 + size);
-        buf = buf.subarray(7 + size + 1);
-        if (type === 1) {
-          const classId = framePayload.readUInt16BE(0);
-          const methodId = framePayload.readUInt16BE(2);
-          const args = framePayload.subarray(4);
-          const w = waiters.shift();
-          if (!w) continue;
-          if (w.classId === classId && w.methodId === methodId) w.resolve(args);
-          else w.reject(new Error(`expected method ${w.classId}/${w.methodId}, got ${classId}/${methodId}: ${args.toString("utf8")}`));
-        } else if (type === 3) {
-          lastBody = framePayload; // a content body frame
-        }
-        // type 2 (content header) and type 8 (heartbeat) need no handling for this round-trip.
-      }
-    });
-
-    sock.on("connect", () => {
-      void (async () => {
-        try {
-          sock.write(PROTOCOL_HEADER);
-          await expect(10, 10); // Connection.Start
-          const response = Buffer.concat([
-            Buffer.from([0]), Buffer.from(conn.user, "utf8"), Buffer.from([0]), Buffer.from(conn.password, "utf8"),
-          ]);
-          // Connection.Start-Ok: empty client-properties table, PLAIN, the SASL response, locale.
-          sock.write(method(0, 10, 11, u32(0), shortstr("PLAIN"), longstr(response), shortstr("en_US")));
-          const tune = await expect(10, 30); // Connection.Tune
-          const frameMax = tune.readUInt32BE(2) || 131072;
-          sock.write(method(0, 10, 31, u16(tune.readUInt16BE(0)), u32(frameMax), u16(0))); // Tune-Ok, no heartbeat
-          sock.write(method(0, 10, 40, shortstr(conn.vhost), shortstr(""), Buffer.from([0]))); // Connection.Open
-          await expect(10, 41); // Open-Ok — authenticated and into the vhost
-
-          sock.write(method(1, 20, 10, shortstr(""))); // Channel.Open
-          await expect(20, 11);
-          // Queue.Declare: reserved, queue, bits(auto-delete=1), empty arguments table.
-          sock.write(method(1, 50, 10, u16(0), shortstr(queue), Buffer.from([0b00001000]), u32(0)));
-          await expect(50, 11);
-
-          // Basic.Publish to the default exchange, routing-key = queue; then content header + body.
-          sock.write(method(1, 60, 40, u16(0), shortstr(""), shortstr(queue), Buffer.from([0])));
-          const bodySize = Buffer.alloc(8);
-          bodySize.writeBigUInt64BE(BigInt(body.length), 0);
-          sock.write(frame(2, 1, Buffer.concat([u16(60), u16(0), bodySize, u16(0)]))); // content header, no properties
-          sock.write(frame(3, 1, body)); // content body
-
-          await new Promise((r) => setTimeout(r, 200));
-          lastBody = null;
-          sock.write(method(1, 60, 70, u16(0), shortstr(queue), Buffer.from([1]))); // Basic.Get, no-ack
-          await expect(60, 71); // Get-Ok (a Get-Empty would arrive as 60/72 and reject the expect)
-          await new Promise((r) => setTimeout(r, 200));
-          const received = lastBody ? (lastBody as Buffer).toString("utf8") : "";
-
-          sock.write(method(0, 10, 50, u16(200), shortstr("bye"), u16(0), u16(0))); // Connection.Close
-          await expect(10, 51).catch(() => undefined);
-          done = true;
-          sock.end();
-          resolve(received);
-        } catch (e) {
-          fail(e instanceof Error ? e : new Error(String(e)));
-        }
-      })();
-    });
-  });
-}
-
-function readMaybe(path: string | undefined): string {
-  if (!path) return "";
-  try {
-    return readFileSync(path, "utf8").replace(/\n$/, "");
-  } catch {
-    return "";
-  }
-}
@@ -1,53 +0,0 @@
-// amqp-ping — a tiny demo consumer of the mesh `amqp` interface, run as a long-lived container by
-// `mesh-tools run` (it never returns, so the container stays up). It exists to PROVE the grant end to
-// end: the mesh gave it a scoped login and a vhost of that name on the lavinmq provider, and this
-// connects with exactly those and round-trips a message.
-//
-// The connection facts arrive the way every consumer's do — the mesh writes them into an env-file the
-// container reads (novox/hq ADR 0048): MESH_AMQP_HOST/PORT from the binding, MESH_AMQP_USER and
-// MESH_AMQP_VHOST both from `${bound:amqp:as}` (the provider named the vhost after the login, so the
-// consumer uses the login for both — the db-name lesson applied to AMQP), and MESH_AMQP_PASSWORD from
-// `${secret:amqp}`.
-//
-// It retries: on first boot the provider may not have provisioned this consumer yet (the reconcile is
-// asynchronous and cross-container), so a refused or unreachable connection is a "not yet", not a
-// failure — it waits and tries again until the round-trip succeeds, then holds the connection idle
-// and re-pings on a slow cadence so the container is a stable, running proof.
-
-import { connFromEnv, roundTrip } from "./client.js";
-
-async function sleep(ms: number): Promise<void> {
-  await new Promise((r) => setTimeout(r, ms));
-}
-
-async function pingOnce(): Promise<boolean> {
-  try {
-    const conn = connFromEnv();
-    const sent = `ping-${Date.now()}`;
-    const got = await roundTrip(conn, "amqp-ping", sent);
-    if (got === sent) {
-      console.log(`[amqp-ping] round-trip ok as ${conn.user} on vhost ${conn.vhost} (${conn.host}:${conn.port})`);
-      return true;
-    }
-    console.error(`[amqp-ping] round-trip mismatch: sent ${sent}, got ${got}`);
-    return false;
-  } catch (err) {
-    console.error(`[amqp-ping] not ready yet: ${err instanceof Error ? err.message : err}`);
-    return false;
-  }
-}
-
-// Wait for the first successful round-trip — the proof this consumer's grant works — then stay up.
-let first = false;
-for (let i = 0; !first; i++) {
-  first = await pingOnce();
-  if (!first) await sleep(3000);
-}
-console.log("[amqp-ping] connected and round-tripped; holding steady");
-for (;;) {
-  await sleep(30000);
-  await pingOnce();
-}
-// changed by the one-node test at build 66e54af151df
-// changed by the one-node test at build 4fb41636cffd
-// changed by the one-node test at build a69f083bf6a6
@@ -1,89 +0,0 @@
-{
-  "module": "amqp-ping",
-  "slug": "ping",
-  "version": "1",
-  "capabilities": [
-    "container-runtime"
-  ],
-  "requires": [
-    "amqp"
-  ],
-  "contributes": {},
-  "binds": {
-    "amqp": "/var/lib/amqp-ping/amqp.json"
-  },
-  "secrets": {
-    "amqp": "/var/lib/amqp-ping/amqp.secret"
-  },
-  "own-secrets": {
-    "broker": "/var/lib/mesh/amqp-ping/broker"
-  },
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/amqp-ping",
-      "mode": "0700"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "path": "/var/lib/amqp-ping",
-      "mode": "0700"
-    },
-    {
-      "id": "amqp-env",
-      "type": "file",
-      "path": "/var/lib/amqp-ping/amqp.env",
-      "mode": "0600",
-      "content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\n"
-    },
-    {
-      "id": "net",
-      "type": "network",
-      "name": "amqp-ping"
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "amqp-ping",
-      "network": "amqp-ping",
-      "volumes": [
-        "/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro",
-        "/var/lib/amqp-ping/amqp.secret:/run/secrets/amqp:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_AMQP_PASSWORD_FILE": "/run/secrets/amqp"
-      },
-      "env-file": [
-        "/var/lib/amqp-ping/amqp.env"
-      ],
-      "restart-on": [
-        "amqp-env"
-      ],
-      "artifact": "runtime"
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}
@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-amqp-ping",
-  "version": "0.1.0",
-  "description": "amqp-ping — a demo consumer of the mesh amqp interface. Connects with its scoped grant and round-trips one message to prove the broker the mesh gave it (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}
@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts"]
-}
@@ -18,7 +18,7 @@
    "broker": "/var/lib/mesh/anthropic-consumer/broker"
  },
  "emits": [
-    "module.anthropic-consumer.usage.session"
+    "usage.session"
  ],
  "resources": [
    {
@@ -123,7 +123,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
  await new Promise<void>((resolve) => {
    const child = spawn(
      process.execPath,
-      [main, "emit", "module.anthropic-consumer.usage.session", JSON.stringify(body)],
+      [main, "emit", "usage.session", JSON.stringify(body)],
      { stdio: "inherit" },
    );
    child.on("exit", () => resolve());
@@ -18,7 +18,7 @@
    "broker": "/var/lib/mesh/anthropic-manager/broker"
  },
  "emits": [
-    "module.anthropic-manager.usage.read"
+    "usage.read"
  ],
  "resources": [
    {
@@ -143,7 +143,7 @@ async function emitUsage(body: Record<string, unknown>): Promise<void> {
  const main = process.env.MESH_TOOLS_MAIN ?? "/app/dist/main.js";
  const { spawn } = await import("node:child_process");
  await new Promise<void>((resolve) => {
-    const child = spawn(process.execPath, [main, "emit", "module.anthropic-manager.usage.read", JSON.stringify(body)], {
+    const child = spawn(process.execPath, [main, "emit", "usage.read", JSON.stringify(body)], {
      stdio: "inherit",
    });
    child.on("exit", () => resolve());
@@ -3,7 +3,7 @@
  "version": "1",
  "slug": "audit",
  "consumes": [
-    "#"
+    "**"
  ],
  "own-secrets": {
    "broker": "/var/lib/audit-logger/broker"
@@ -15,16 +15,16 @@ test("audit-logger records every event to the trail as one line each", async ()
  const path = join(dir, "audit.log");

  // The audit-logger's whole behaviour: consume everything, record it.
-  await on("#", async (event) => record(event, path));
+  await on("**", async (event) => record(event, path));

  process.env.MESH_MODULE = "umami";
  process.env.MESH_NODE = "anchor";
-  await emit("module.umami.site.created", { domain: "my-app" });
+  await emit("site.created", { domain: "my-app" });
  await emit("node.anchor.joined", { role: "worker" }); // a node event, not a module one

  const lines = (await readFile(path, "utf8")).trim().split("\n").map((l) => JSON.parse(l));
  assert.equal(lines.length, 2);
-  assert.deepEqual(lines.map((l) => l.type), ["module.umami.site.created", "node.anchor.joined"]);
+  assert.deepEqual(lines.map((l) => l.type), ["umami.site.created", "node.anchor.joined"]);
  assert.equal(lines[0].source, "umami");
  assert.equal(lines[0].node, "anchor");
  assert.equal(lines[0].body.domain, "my-app");
@@ -24,7 +24,7 @@ async function pollHistory(): Promise<void> {
  for (const entry of entries) {
    if (seen.has(entry.id)) continue;
    if (primed) {
-      await emit("module.bazarr.subtitle.downloaded", {
+      await emit("subtitle.downloaded", {
        kind: entry.kind,
        title: entry.title,
        language: entry.language,
@@ -5,7 +5,7 @@
    "container-runtime"
  ],
  "emits": [
-    "module.bazarr.subtitle.downloaded"
+    "subtitle.downloaded"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/bazarr/broker",
@@ -45,12 +45,12 @@ async function pollQueue(bookshelf: BookshelfClient): Promise<void> {
  if (primed) {
    // Entered the queue since last look — Bookshelf grabbed a release.
    for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("module.bookshelf.book.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("book.grabbed", { title: item.title, status: item.status });
    }
    // Left the queue — imported and done, unless it was last seen failing.
    for (const [id, item] of inQueue) {
      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("module.bookshelf.download.completed", { title: item.title });
+        await emit("download.completed", { title: item.title });
      }
    }
  }
@@ -6,8 +6,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.bookshelf.book.grabbed",
-    "module.bookshelf.download.completed"
+    "book.grabbed",
+    "download.completed"
  ],
  "consumes": [],
  "own-secrets": {
@@ -6,23 +6,20 @@
  ],
  "claims": [
    {
-      "name": "the-build-machine",
-      "scope": "node"
+      "name": "mesh-build-machine",
+      "scope": "mesh"
    }
  ],
  "requires": [
    "artifact-store",
-    "package-registry"
+    "npm-package-registry"
  ],
  "binds": {
-    "package-registry": "/var/lib/mesh/builder/package-registry.json"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.json"
  },
  "secrets": {
-    "package-registry": "/var/lib/mesh/builder/package-registry.secret"
+    "npm-package-registry": "/var/lib/mesh/builder/package-registry.secret"
  },
-  "emits": [
-    "module.builder.built"
-  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/builder/broker"
  },
@@ -80,7 +77,7 @@
    "on": [
      {
        "arg": "GO_BASE",
-        "image": "golang@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59"
+        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
      },
      {
        "arg": "ALPINE_BASE",
@@ -22,8 +22,8 @@
    "broker": "/var/lib/mesh/cloudflare-dns/broker"
  },
  "emits": [
-    "module.cloudflare-dns.record.created",
-    "module.cloudflare-dns.record.removed"
+    "record.created",
+    "record.removed"
  ],
  "resources": [
    {
@@ -20,7 +20,7 @@ runProvisioner("public-dns", {
  async create(p: Provision): Promise<void> {
    const fqdn = cloudflare.nameFor(p.as);
    await cloudflare.upsert(fqdn);
-    await announce("module.cloudflare-dns.record.created", {
+    await announce("record.created", {
      name: fqdn,
      target: cloudflare.ingress,
      consumer: p.consumer ?? "",
@@ -30,7 +30,7 @@ runProvisioner("public-dns", {
  async remove(p: { as: string }): Promise<void> {
    const fqdn = cloudflare.nameFor(p.as);
    await cloudflare.remove(fqdn);
-    await announce("module.cloudflare-dns.record.removed", { name: fqdn, consumer: p.as });
+    await announce("record.removed", { name: fqdn, consumer: p.as });
  },
 });

@@ -0,0 +1,43 @@
+# dhcpcd
+
+The uplink seat's module for a machine whose own network is dhcpcd's (novox/hq ADR 0117). It
+asks two things of dhcpcd, and nothing else: leave the resolver file to the mesh, and leave the
+private network's interface alone. It never declares an interface, an address, a route, a
+wireless network or its credentials — the link dhcpcd keeps is the only channel the mesh reaches
+the machine over.
+
+## What it writes
+
+Two lines into `/etc/dhcpcd.conf`, as the mesh's marked region (`into: block`) — dhcpcd reads no
+drop-in directory, so the mesh writes into its one file rather than over it (ADR 0102):
+
+- `nohook resolv.conf` — dhcpcd's resolv.conf hook rewrites `/etc/resolv.conf` on every lease it
+  takes or renews, which would silently replace the resolver `resolv-conf` names.
+- `denyinterfaces mesh0` — dhcpcd never asks for a lease on the private network's interface, and
+  never takes it down. dhcpcd leaves a point-to-point interface alone by default; this says so
+  rather than relying on it.
+
+**At the start of the file** (`at: start`). Both are global options, and dhcpcd reads every line
+after an `interface` or `ssid` line as that interface's own. A configured machine's file ends in
+exactly such a block (the interface, its static address), so appended at the end these two would
+quietly apply to one interface only.
+
+## Why it declares no service
+
+dhcpcd is the machine's, not the mesh's. The mesh never starts, stops or enables it: stopping it
+drops the address the machine is reached at, and a module unassigned by mistake must not be able
+to do that. And there is nothing to reload it with — `dhcpcd.service` reports `CanReload=no`, and
+a restart drops the lease. So the two lines take effect at **dhcpcd's next start**.
+
+On an adopted machine that is normally no gap: the predecessor wrote the same `nohook` line, and
+it is already in force. **On a machine that was not adopted, it is one:** until dhcpcd next
+starts (a reboot, or the operator restarting it in a window of their choosing), a lease renewal
+still rewrites `/etc/resolv.conf`, and `resolv-conf` puts it back at the next push. Assign this
+module before `resolv-conf` on such a machine, and restart dhcpcd once, by hand, when losing the
+link for a moment is acceptable.
+
+## One manager per machine
+
+It claims `the-uplink`: a machine runs one network manager, and assigning a second module that
+claims the seat is refused. Assigning this one to a machine whose network is NetworkManager's
+installs the package and writes the two lines, and starts nothing.
@@ -0,0 +1,30 @@
+{
+  "module": "dhcpcd",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dhcpcd"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/dhcpcd.conf",
+      "mode": "0644",
+      "into": "block",
+      "at": "start",
+      "content": "# The mesh's two lines (module dhcpcd, novox/hq ADR 0117). Global options, so\n# kept above any interface line; read at dhcpcd's next start.\nnohook resolv.conf\ndenyinterfaces mesh0\n"
+    }
+  ]
+}
@@ -33,7 +33,7 @@ async function pollCatalog(): Promise<void> {
    for (const tag of tags) {
      const id = `${repo}:${tag}`;
      if (!seen.has(id)) {
-        if (primed) await emit("module.registry.image.pushed", { repo, tag });
+        if (primed) await emit("image.pushed", { repo, tag });
        seen.add(id);
      }
    }
@@ -17,7 +17,7 @@
    "container-runtime"
  ],
  "emits": [
-    "module.registry.image.pushed"
+    "image.pushed"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/registry/broker"
@@ -20,10 +20,10 @@ async function poll(): Promise<void> {
  const now = new Map((await dnsmasq.answeredNames()).map((a) => [a.name, a.address]));
  if (primed) {
    for (const [name, address] of now) {
-      if (!known.has(name)) await emit("module.dnsmasq.name.added", { name, address });
+      if (!known.has(name)) await emit("name.added", { name, address });
    }
    for (const [name] of known) {
-      if (!now.has(name)) await emit("module.dnsmasq.name.removed", { name });
+      if (!now.has(name)) await emit("name.removed", { name });
    }
  }
  known.clear();
@@ -6,7 +6,7 @@
  ],
  "claims": [
    {
-      "name": "the-intrusion-prevention",
+      "name": "node-intrusion-prevention",
      "scope": "node"
    }
  ],
@@ -33,7 +33,7 @@
      "type": "file",
      "path": "/etc/fail2ban/jail.local",
      "mode": "0644",
-      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\nbanaction = ufw\nbanaction_allports = iptables-allports\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
+      "content": "[INCLUDES]\n\nbefore = paths-arch.conf\n\n[DEFAULT]\n\n# Never act on the machine itself or on a tunnel peer: the mesh's private range is\n# ${machine:mesh-range}, named here rather than written as a value the module cannot\n# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.\nignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range}\n\nbantime  = 10m\nfindtime = 10m\nmaxretry = 5\n\nbanaction = ufw\nbanaction_allports = iptables-allports\n\n[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\n"
    },
    {
      "id": "jail-sshd",
@@ -9,6 +9,8 @@ import { ConfiguredToken, MintedToken, type TokenSource } from "./token.js";
 /** A repository, trimmed to what the mesh cares about. */
 export interface GiteaRepo {
  full_name: string;
+  /** The URL a build clones — what a module records as its source. */
+  clone_url?: string;
  name: string;
  owner: string;
  private: boolean;
@@ -34,6 +36,9 @@ export interface GiteaPull {
  title: string;
  state: string;
  merged: boolean;
+  /** The commit the merge produced — what a build of the base branch is made from. */
+  merge_commit_sha?: string;
+  merged_at?: string;
  user?: string;
  head?: string;
  base?: string;
@@ -116,9 +121,23 @@ export class GiteaClient {

  // ---- Repositories ----

+  /** Every repository this token can see, one page. `/user/repos` is only what the token's own
+   *  user owns — for the mesh's administrator that is nothing, which is how the forge watched an
+   *  empty list and announced no merge (2026-09-28). The search endpoint is the forge's whole view. */
  async listRepos(page = 1, limit = 20): Promise<GiteaRepo[]> {
-    const repos = await this.request<any[]>(`/user/repos?page=${page}&limit=${limit}`);
-    return (repos ?? []).map(GiteaClient.mapRepo);
+    const found = await this.request<{ data?: any[] }>(`/repos/search?page=${page}&limit=${limit}`);
+    return (found?.data ?? []).map(GiteaClient.mapRepo);
+  }
+
+  /** Every repository, all pages. */
+  async listAllRepos(): Promise<GiteaRepo[]> {
+    const all: GiteaRepo[] = [];
+    for (let page = 1; page < 100; page++) {
+      const batch = await this.listRepos(page, 50);
+      all.push(...batch);
+      if (batch.length < 50) break;
+    }
+    return all;
  }

  async createRepo(data: {
@@ -210,6 +229,17 @@ export class GiteaClient {
    return GiteaClient.mapPull(await this.request<any>(`/repos/${owner}/${repo}/pulls/${index}`));
  }

+  /** The files a merged pull request changed, as paths from the repository's root.
+   *
+   *  `limit` is what is asked for, and a merge that changed more says so rather than being read
+   *  page by page: what the mesh does with a partial list is treat the whole repository as changed,
+   *  so more pages would buy nothing. */
+  async listPullFiles(owner: string, repo: string, index: number, limit = 100): Promise<{ paths: string[]; truncated: boolean }> {
+    const files = await this.request<any[]>(`/repos/${owner}/${repo}/pulls/${index}/files?limit=${limit}`);
+    const paths = (files ?? []).map((f) => String(f?.filename ?? "")).filter((p) => p !== "");
+    return { paths, truncated: paths.length >= limit };
+  }
+
  async createPullRequest(
    owner: string,
    repo: string,
@@ -232,6 +262,7 @@ export class GiteaClient {
  private static mapRepo(r: any): GiteaRepo {
    return {
      full_name: r.full_name,
+      clone_url: r.clone_url ?? undefined,
      name: r.name,
      owner: r.owner?.login ?? r.full_name?.split("/")[0] ?? "unknown",
      private: Boolean(r.private),
@@ -259,6 +290,8 @@ export class GiteaClient {
      title: p.title,
      state: p.state,
      merged: Boolean(p.merged),
+      merge_commit_sha: p.merge_commit_sha ?? undefined,
+      merged_at: p.merged_at ?? undefined,
      user: p.user?.login,
      head: p.head?.ref,
      base: p.base?.ref,
@@ -31,11 +31,11 @@ try {
 const seen = new Set<string>();
 let primed = false;
 async function pollRepos(client: GiteaClient): Promise<void> {
-  const repos = await client.listRepos(1, 50);
+  const repos = await client.listAllRepos();
  for (const repo of repos) {
    if (!seen.has(repo.full_name)) {
      if (primed) {
-        await emit("module.gitea.repo.created", {
+        await emit("repo.created", {
          full_name: repo.full_name,
          owner: repo.owner,
          name: repo.name,
@@ -49,6 +49,83 @@ async function pollRepos(client: GiteaClient): Promise<void> {
  primed = true;
 }

+// **A merge is announced whoever made it.** The merge tool below emits at the instant it acts; a
+// merge made in the forge's own pages or over its API would emit nothing, and the mesh would go on
+// believing every module current with its source (novox/hq 04-ISSUES/131). So merged pull requests
+// are watched the way repositories are: what the forge holds, asked for on a tick, announced once.
+// What has been announced is kept beside the module's state, so a restart does not announce the
+// whole history again — and the first tick on a machine with no record announces nothing, because
+// everything it sees then predates the watching.
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const mergedRecord = process.env.MESH_GITEA_STATE_DIR ? join(process.env.MESH_GITEA_STATE_DIR, "merged-announced.json") : null;
+const announced = new Set<string>();
+let primedMerges = false;
+// since is the moment the watching began: a merge made before it is history, whatever page of the
+// forge's listing it surfaces on. Without it, an old merge past the first page — pushed into view
+// as newer pull requests were updated — was announced as if it had just happened, and the mesh
+// rebuilt everything built from that repository, once per old merge (2026-09-28).
+let since = "";
+if (mergedRecord && existsSync(mergedRecord)) {
+  try {
+    const kept = JSON.parse(readFileSync(mergedRecord, "utf8")) as string[] | { announced: string[]; since: string };
+    const list = Array.isArray(kept) ? kept : kept.announced;
+    for (const sha of list) announced.add(sha);
+    since = Array.isArray(kept) ? new Date().toISOString() : kept.since;
+    primedMerges = true;
+  } catch {
+    // An unreadable record is treated as no record: prime again rather than re-announce history.
+  }
+}
+function keepAnnounced(): void {
+  if (!mergedRecord) return;
+  mkdirSync(join(mergedRecord, ".."), { recursive: true });
+  const tmp = mergedRecord + ".tmp";
+  writeFileSync(tmp, JSON.stringify({ announced: [...announced].slice(-2000), since }));
+  renameSync(tmp, mergedRecord);
+}
+async function pollMerged(client: GiteaClient): Promise<void> {
+  const repos = await client.listAllRepos();
+  let changed = false;
+  for (const repo of repos) {
+    const pulls = await client.listPullRequests(repo.owner, repo.name, { state: "closed", sort: "recentupdate", limit: "20" });
+    for (const pull of pulls) {
+      if (!pull.merged || !pull.merge_commit_sha || announced.has(pull.merge_commit_sha)) continue;
+      // Announced only if merged since the watching began; recorded either way, so it is looked
+      // at once.
+      const fresh = !!pull.merged_at && !!since && pull.merged_at > since;
+      if (primedMerges && fresh) {
+        // What it changed, asked for only now: a module is rebuilt because a file inside its own
+        // directory moved, and without this every module built from a repository is rebuilt for a
+        // change to any of them (novox/hq 04-ISSUES/131).
+        const changed = await client.listPullFiles(repo.owner, repo.name, pull.number);
+        await emit("pull.merged", {
+          owner: repo.owner,
+          repo: repo.name,
+          number: pull.number,
+          title: pull.title,
+          head: pull.head,
+          base: pull.base,
+          merge_commit_sha: pull.merge_commit_sha,
+          merged_at: pull.merged_at,
+          clone_url: repo.clone_url,
+          html_url: pull.html_url,
+          paths: changed.paths,
+          paths_truncated: changed.truncated,
+        });
+        // Said, because a trigger that fires silently is indistinguishable from one that did not
+        // fire (novox/hq 04-ISSUES/131) — this line is how an operator knows the mesh was told.
+        console.log(`[gitea] announced merge ${repo.full_name}#${pull.number} (${pull.merge_commit_sha.slice(0, 8)}) into ${pull.base}`);
+      }
+      announced.add(pull.merge_commit_sha);
+      changed = true;
+    }
+  }
+  if (!primedMerges) since = new Date().toISOString();
+  if (!primedMerges || changed) keepAnnounced();
+  primedMerges = true;
+}
+
 if (gitea) {
  const client = gitea;
  // A poll that fails says so once, not once a minute: the same reason repeating (the forge not up
@@ -70,5 +147,6 @@ if (gitea) {
    run();
  };
  tick(() => pollRepos(client), 60_000);
-  console.log("[gitea] watching for new repositories");
+  tick(() => pollMerged(client), 30_000);
+  console.log("[gitea] watching for new repositories and merged pull requests");
 }
@@ -24,23 +24,23 @@
    }
  },
  "binds": {
-    "postgres-database": "/var/lib/gitea/database.json",
-    "route": "/var/lib/gitea/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
  },
  "secrets": {
-    "postgres-database": "/var/lib/gitea/database.secret",
+    "postgres-database": "${dir:state}/database.secret",
    "secret": {
-      "internal-token": "/var/lib/gitea/internal-token.secret",
-      "admin": "/var/lib/gitea/admin.secret"
+      "internal-token": "${dir:state}/internal-token.secret",
+      "admin": "${dir:state}/admin.secret"
    }
  },
  "capabilities": [
    "container-runtime"
  ],
  "emits": [
-    "module.gitea.repo.created",
-    "module.gitea.issue.opened",
-    "module.gitea.pull.merged"
+    "repo.created",
+    "issue.opened",
+    "pull.merged"
  ],
  "listens": [
    {
@@ -53,22 +53,36 @@
      "port": 22,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "git over ssh, gitea's own unmodified sshd. Published on the machine's own side at 222, the mesh's fixed public convention — not 22, which the machine's own daemon holds and a module does not take"
+      "why": "git over ssh, gitea's own unmodified sshd. Published on the machine's own side at 222, the mesh's fixed public convention \u2014 not 22, which the machine's own daemon holds and a module does not take"
    }
  ],
  "serves": {
-    "package-registry": {
+    "npm-package-registry": {
      "scheme": "http",
      "port": 3000,
      "npm-path": "/api/packages/novox/npm/"
+    },
+    "git": {
+      "scheme": "http",
+      "port": 3000
    }
  },
  "receives": {
-    "package-registry": "/var/lib/gitea/grants/mesh.json"
+    "npm-package-registry": "${dir:grants}/npm.json"
  },
  "grants": {
-    "package-registry": "/var/lib/gitea/grants"
+    "npm-package-registry": "${dir:grants}"
  },
+  "claims": [
+    {
+      "name": "npm-package-registry",
+      "scope": "mesh"
+    },
+    {
+      "name": "git",
+      "scope": "mesh"
+    }
+  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/gitea/broker"
  },
@@ -88,26 +102,24 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/gitea",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
-      "path": "/var/lib/gitea/grants",
      "mode": "0700"
    },
    {
      "id": "server-env",
      "type": "file",
-      "path": "/var/lib/gitea/server.env",
+      "path": "${dir:state}/server.env",
      "mode": "0600",
      "content": "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\nGITEA__database__DB_TYPE=postgres\nGITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nGITEA__database__NAME=${bound:postgres-database:as}\nGITEA__database__USER=${bound:postgres-database:as}\nGITEA__database__PASSWD=${secret:postgres-database}\n"
    },
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/gitea/gitea",
      "mode": "0700",
      "owner": "1000:1000"
    },
@@ -122,14 +134,14 @@
        "USER_GID": "1000"
      },
      "env-file": [
-        "/var/lib/gitea/server.env"
+        "${dir:state}/server.env"
      ],
      "ports": [
        "3000",
        "222:22"
      ],
      "volumes": [
-        "/services/gitea/gitea:/data"
+        "${dir:data}:/data"
      ],
      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
    },
@@ -145,11 +157,11 @@
        "MESH_GITEA_ADMIN_USER": "mesh-admin"
      },
      "env-file": [
-        "/var/lib/gitea/server.env"
+        "${dir:state}/server.env"
      ],
      "volumes": [
-        "/services/gitea/gitea:/data",
-        "/var/lib/gitea/admin.secret:/run/secrets/admin:ro"
+        "${dir:data}:/data",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro"
      ],
      "args": [
        "/bin/sh",
@@ -174,8 +186,8 @@
      "volumes": [
        "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
-        "/var/lib/gitea/grants:/var/lib/gitea/grants:ro",
-        "/var/lib/gitea/admin.secret:/run/secrets/admin:ro",
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
        "/var/lib/mesh/gitea/state:/run/state"
      ],
      "env": {
@@ -185,7 +197,7 @@
        "MESH_GITEA_ADMIN_USER": "mesh-admin",
        "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
        "MESH_GITEA_STATE_DIR": "/run/state",
-        "MESH_RECEIVES": "/var/lib/gitea/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/npm.json"
      },
      "artifact": "runtime",
      "restart-on": [
@@ -195,7 +207,11 @@
  ],
  "provides": [
    {
-      "name": "package-registry",
+      "name": "npm-package-registry",
+      "scope": "mesh"
+    },
+    {
+      "name": "git",
      "scope": "mesh"
    }
  ],
@@ -1,9 +1,15 @@
-// gitea's provisioner — the adapter that makes gitea a provider of the mesh `package-registry`
-// interface. The reconcile loop, the contributions file, and reading the mesh's minted password are
-// the sdk harness's; this writes only the per-service half: how gitea creates and removes a
-// consumer's npm credential (novox/hq ADR 0048/0076).
+// gitea's provisioner — the adapter that makes gitea a provider of the mesh
+// `npm-package-registry` interface. The reconcile loop, the contributions file, and reading the
+// mesh's minted password are the sdk harness's; this writes only the per-service half: how gitea
+// creates and removes a consumer's npm credential (novox/hq ADR 0048/0076).
 //
-// The `package-registry` interface: a consumer authenticates to the npm registry at
+// **A package registry seat is one per ecosystem (novox/hq ADR 0109).** gitea holds the npm seat
+// (ADR 0110). Adding cargo or PyPI is adding a provision — another `provides` entry, another
+// `receives` path and another registration below — not widening this one. `git`, which gitea also
+// provides, mints nothing and so registers nothing here: the mesh's own repositories are public,
+// and a clone credential is not yet decided (ADR 0111).
+//
+// The `npm-package-registry` interface: a consumer authenticates to the npm registry at
 // `/api/packages/novox/npm/` with basic auth, as `as` with the password the mesh minted, and can
 // read and write packages under the `@novox` scope. The registry's npm owner is the gitea org
 // `novox`; a consumer is a gitea *user* placed on that org's package team.
@@ -26,7 +32,11 @@ const PACKAGE_TEAM = "packages";

 const gitea = GiteaAdmin.fromEnv();

-runProvisioner("package-registry", {
+// Where this registration's contributions land comes from $MESH_RECEIVES, never a path written
+// here: the mesh writes the file where the manifest's `receives` says, and a second copy of that
+// path in code would drift from it. One variable carries one path, so a second registration in this
+// module needs the mesh to say where each provision's file is — not yet possible, and not faked.
+runProvisioner("npm-package-registry", {
  async create(p: Provision): Promise<void> {
    // The org and its package team are the same for every consumer; ensuring them per-create is
    // idempotent and needs no separate bootstrap step.
@@ -124,7 +124,7 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
          labels: labelIds,
        });
        // The mesh just opened an issue — announce it the moment it exists.
-        await emit("module.gitea.issue.opened", {
+        await emit("issue.opened", {
          owner,
          repo,
          number: issue.number,
@@ -231,15 +231,24 @@ export function getGiteaTools(gitea: GiteaClient): ToolDefinition[] {
        // Read the PR first, so the merged event carries a title and branches, not just a number.
        const pull = await gitea.getPullRequest(owner, repo, number);
        await gitea.mergePullRequest(owner, repo, number, method, deleteBranch);
-        await emit("module.gitea.pull.merged", {
+        // Read it again: the merge commit only exists now, and it is what a build is made from.
+        const merged = await gitea.getPullRequest(owner, repo, number);
+        // And what it changed, so the mesh rebuilds the modules whose own files moved rather than
+        // every module built from the repository (novox/hq 04-ISSUES/131).
+        const changed = await gitea.listPullFiles(owner, repo, number);
+        await emit("pull.merged", {
          owner,
          repo,
          number,
          title: pull.title,
          head: pull.head,
          base: pull.base,
+          merge_commit_sha: merged.merge_commit_sha,
+          merged_at: merged.merged_at,
          method,
          html_url: pull.html_url,
+          paths: changed.paths,
+          paths_truncated: changed.truncated,
        });
        return { merged: true, number, method, deleted_branch: deleteBranch };
      },
@@ -40,7 +40,7 @@ async function pollAlerts(client: GrafanaClient): Promise<void> {
    for (const key of now) {
      if (!firing.has(key)) {
        const a = byKey.get(key)!;
-        await emit("module.grafana.alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
+        await emit("alert.firing", { name: a.name, labels: a.labels, activeAt: a.activeAt });
      }
    }
  }
@@ -2,7 +2,7 @@
  "module": "grafana",
  "version": "1",
  "emits": [
-    "module.grafana.alert.firing"
+    "alert.firing"
  ],
  "own-secrets": {
    "admin": "/var/lib/grafana-module/admin.secret",
@@ -44,7 +44,7 @@ async function pollStates(): Promise<void> {
  for (const s of states) {
    const prev = lastState.get(s.entity_id);
    if (primed && prev !== undefined && prev !== s.state) {
-      await emit("module.home-assistant.state.changed", {
+      await emit("state.changed", {
        entity: s.entity_id,
        name: nameOf(s),
        from: prev,
@@ -6,7 +6,7 @@
    "container-runtime"
  ],
  "emits": [
-    "module.home-assistant.state.changed"
+    "state.changed"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/home-assistant/broker",
@@ -23,7 +23,7 @@ async function pollMounts(): Promise<void> {
  if (primed) {
    for (const [mount, m] of now) {
      if (!live.has(mount)) {
-        await emit("module.icecast.stream.started", {
+        await emit("stream.started", {
          mount,
          name: m.name,
          description: m.description,
@@ -33,7 +33,7 @@ async function pollMounts(): Promise<void> {
    }
    for (const [mount, m] of live) {
      if (!now.has(mount)) {
-        await emit("module.icecast.stream.stopped", { mount, name: m.name });
+        await emit("stream.stopped", { mount, name: m.name });
      }
    }
  }
@@ -5,8 +5,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.icecast.stream.started",
-    "module.icecast.stream.stopped"
+    "stream.started",
+    "stream.stopped"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/icecast/broker"
@@ -14,12 +14,15 @@
    "mongodb-database": {
      "name": "invoicing"
    },
-    "s3-bucket": {
-      "bucket": "invoicing"
-    },
    "route": {
-      "label": "invoicing",
-      "port": 80
+      "site": {
+        "label": "invoicing",
+        "port": 80
+      },
+      "api": {
+        "label": "invoicing-api",
+        "port": 9000
+      }
    }
  },
  "binds": {
@@ -63,7 +66,7 @@
      "type": "file",
      "path": "/var/lib/invoicing/api.env",
      "mode": "0600",
-      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/invoicing?authSource=admin\nMINIO_BUCKET=invoicing\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_BUCKET=mesh-novox-invoice\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\n"
    },
    {
      "id": "net",
@@ -28,17 +28,17 @@ async function announce(type: string, body: Record<string, unknown>): Promise<vo

 export const events = {
  userCreated: (realm: string, username: string, email?: string) =>
-    announce("module.keycloak.user.created", { realm, username, ...(email ? { email } : {}) }),
+    announce("user.created", { realm, username, ...(email ? { email } : {}) }),
  userDeleted: (realm: string, userId: string) =>
-    announce("module.keycloak.user.deleted", { realm, userId }),
+    announce("user.deleted", { realm, userId }),
  passwordReset: (realm: string, userId: string) =>
-    announce("module.keycloak.password.reset", { realm, userId }),
+    announce("password.reset", { realm, userId }),
  clientCreated: (realm: string, clientId: string, name?: string) =>
-    announce("module.keycloak.client.created", { realm, clientId, ...(name ? { name } : {}) }),
+    announce("client.created", { realm, clientId, ...(name ? { name } : {}) }),
  groupCreated: (realm: string, name: string) =>
-    announce("module.keycloak.group.created", { realm, name }),
+    announce("group.created", { realm, name }),
  roleCreated: (realm: string, name: string) =>
-    announce("module.keycloak.role.created", { realm, name }),
+    announce("role.created", { realm, name }),
 };

 console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");
@@ -25,12 +25,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.keycloak.user.created",
-    "module.keycloak.user.deleted",
-    "module.keycloak.password.reset",
-    "module.keycloak.client.created",
-    "module.keycloak.group.created",
-    "module.keycloak.role.created"
+    "user.created",
+    "user.deleted",
+    "password.reset",
+    "client.created",
+    "group.created",
+    "role.created"
  ],
  "listens": [
    {
@@ -88,7 +88,9 @@
      "env": {
        "KC_DB": "postgres",
        "KC_HTTP_ENABLED": "true",
-        "KC_HEALTH_ENABLED": "true"
+        "KC_HEALTH_ENABLED": "true",
+        "KC_HOSTNAME": "https://keycloak.novox.be",
+        "KC_PROXY_HEADERS": "xforwarded"
      },
      "env-file": [
        "/var/lib/keycloak/admin.env",
@@ -118,7 +120,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_KEYCLOAK_URL": "http://127.0.0.1:8080",
+        "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
        "MESH_KEYCLOAK_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -1,42 +0,0 @@
-# lavinmq's runtime: the tool runtime, carrying this module's compiled bootstrap, provisioner,
-# tools and event consumer.
-#
-# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
-# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
-# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
-# the siblings.
-#
-# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
-# They are different images on purpose — the first carries a compiler and the second must not, or
-# every running container would carry one it never invokes. The mesh answers both with the copies it
-# holds, because a fingerprint written here would name one particular copy and no other mesh has it
-# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
-# nobody told stops here and says which module to build first.
-ARG BUILD_BASE
-ARG RUNTIME_BASE
-
-FROM ${BUILD_BASE} AS build
-# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
-# node_modules — the module is compiled against exactly the sdk it will run against.
-WORKDIR /app/modules/lavinmq
-COPY . .
-# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
-# symlinks to a launcher that requires its library relatively — resolved away when the base image
-# was assembled.
-#
-# Four entrypoints and a client, because this module is four things: a run-once bootstrap that
-# writes the broker's configuration before it first starts, a provisioner that grants consumers
-# their own vhost and user, a set of tools, and an event consumer.
-RUN node /app/node_modules/typescript/bin/tsc \
-      client.ts index.ts bootstrap/index.ts provisioner/index.ts tools/index.ts \
-      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
-
-FROM ${RUNTIME_BASE}
-COPY --from=build /app/modules/lavinmq/dist /app/modules/lavinmq/dist
-# What the runtime loads from this module in serve mode: its event consumer, its tools, and its
-# provisioner — all three in one process, so the provisioner's reconcile loop runs with the broker
-# connected (novox/hq issues 060/061; the provisioner used to be run as a separate container `args`
-# command, which meant it served no tools and, once, ran nowhere at all). The run-once bootstrap is
-# NOT listed here — it is named in its own container's `args`, because it runs to completion before
-# the broker starts rather than serving. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/lavinmq/dist/index.js,/app/modules/lavinmq/dist/tools/index.js,/app/modules/lavinmq/dist/provisioner/index.js
@@ -1,45 +0,0 @@
-// lavinmq's run-once bootstrap — lavinmq's own code (novox/hq ADR 0039), run once before the broker
-// first starts (ADR 0052). lavinmq's default admin is set at first boot from a config file's
-// `default_password_hash`, and that value is a HASH of the mesh-minted admin password, not the
-// password itself — a form the mesh's plain-secret delivery cannot produce and no `${secret:...}`
-// placeholder can compute. So this step computes it: it reads the admin password the mesh minted and
-// the host unsealed, hashes it the way lavinmq expects (see client.rabbitHash), and writes the config
-// file the broker container reads with `--config`. The host runs it to completion and only then
-// starts the broker the manifest places after it — so the broker's first boot finds a config with an
-// admin it can authenticate, and the provisioner (which reaches the management API as that admin)
-// can do its work.
-//
-// It runs in the module's own runtime image, under the module's own account, as `mesh-tools run`
-// imports it — no broker connection, because writing a config file is an offline operation and there
-// is no broker to reach yet.
-//
-// lavinmq consults `default_user`/`default_password_hash` only on a first boot with an empty data
-// dir; a later boot uses the persisted user database and ignores them. So this seeds the admin once,
-// and a rotation of the admin secret does not re-key an already-initialised broker — the same
-// first-boot-only shape the RabbitMQ-compatible default user has always had.
-
-import { writeFileSync } from "node:fs";
-import { readFileSync } from "node:fs";
-import { rabbitHash } from "../client.js";
-
-const adminUser = process.env.MESH_PROVISION_ADMIN_USER ?? process.env.MESH_LAVINMQ_ADMIN_USER ?? "mesh-admin";
-const passwordFile = process.env.MESH_PROVISION_PASSWORD_FILE ?? process.env.MESH_LAVINMQ_ADMIN_PASSWORD_FILE ?? "/run/secrets/default";
-const configOut = process.env.MESH_LAVINMQ_CONFIG_OUT ?? "/var/lib/lavinmq-module/lavinmq.ini";
-const dataDir = process.env.MESH_LAVINMQ_DATA_DIR ?? "/var/lib/lavinmq";
-
-const password = readFileSync(passwordFile, "utf8").replace(/\n$/, "");
-if (!password) {
-  throw new Error(`[lavinmq:bootstrap] admin password file ${passwordFile} is empty — cannot seed the admin`);
-}
-
-// The broker reads only what it needs to authenticate its admin on first boot; bind/ports come from
-// the container's entrypoint (`-b 0.0.0.0`), so this file names the admin and nothing else about the
-// network.
-const ini =
-  "[main]\n" +
-  `data_dir = ${dataDir}\n` +
-  `default_user = ${adminUser}\n` +
-  `default_password_hash = ${rabbitHash(password)}\n`;
-
-writeFileSync(configOut, ini, { mode: 0o600 });
-console.log(`[lavinmq:bootstrap] wrote ${configOut} with admin '${adminUser}' (password hashed for lavinmq)`);
@@ -1,183 +0,0 @@
-// lavinmq's admin client — lavinmq's own code, living in the module (novox/hq ADR 0039). Both this
-// module's tools and its provisioner import it, and nothing outside lavinmq does.
-//
-// It drives lavinmq through its HTTP management API (the RabbitMQ-compatible surface lavinmq serves
-// on 15672), not a hand-rolled AMQP admin stack: the module may take NO npm dependency beyond
-// @novox/mesh-sdk, and the management API is exactly the admin surface — create/remove a vhost, a
-// user, and its permissions — reached with `fetch` (global on node 22) and HTTP Basic auth. One
-// boundary, `api()`, and every method is built on it. This is the module's one impure seam, the way
-// postgres's is `psql` and redis's is a RESP socket.
-//
-// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
-// derives the login and hands it to both ends so they agree, and mints the password and delivers a
-// copy to each. lavinmq creates exactly that user with exactly that password on a vhost of the same
-// name — a name or password the provisioner invented is one the consumer could never present.
-
-import { createHash, randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
-
-export interface LavinmqConn {
-  /** Base URL of the management API, e.g. http://lavinmq:15672 (no trailing /api). */
-  readonly base: string;
-  readonly adminUser: string;
-  readonly adminPassword: string;
-}
-
-export class LavinmqClient {
-  constructor(private readonly conn: LavinmqConn) {}
-
-  /**
-   * Build from the module's resolved environment. Reads MESH_LAVINMQ_* first (the documented
-   * names), falling back to the MESH_PROVISION_* keys the manifest already sets on the provisioner
-   * container so the module runs unchanged there. Throws if it cannot find a management endpoint and
-   * an admin password — the right failure, because without them nothing it does can work.
-   */
-  static fromEnv(env: NodeJS.ProcessEnv = process.env): LavinmqClient {
-    const base = (env.MESH_LAVINMQ_MANAGEMENT ?? env.MESH_PROVISION_LAVINMQ ?? "").replace(/\/+$/, "");
-    const adminUser = env.MESH_LAVINMQ_ADMIN_USER ?? env.MESH_PROVISION_ADMIN_USER ?? "mesh-admin";
-    const adminPassword = env.MESH_LAVINMQ_ADMIN_PASSWORD ?? readSecretFile(env.MESH_PROVISION_PASSWORD_FILE);
-    if (!base || !adminPassword) {
-      throw new Error("lavinmq management endpoint or admin password is not set — lavinmq's own code cannot reach the server");
-    }
-    return new LavinmqClient({ base, adminUser, adminPassword });
-  }
-
-  /** One request against the management API. A non-2xx reply rejects, carrying the body for the log. */
-  async api(method: string, path: string, body?: unknown): Promise<unknown> {
-    const headers: Record<string, string> = {
-      Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
-    };
-    if (body !== undefined) headers["Content-Type"] = "application/json";
-    const resp = await fetch(`${this.conn.base}/api${path}`, {
-      method,
-      headers,
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
-    if (!resp.ok) {
-      throw new Error(`lavinmq management API ${method} ${path} -> ${resp.status}: ${await resp.text()}`);
-    }
-    const text = await resp.text();
-    return text ? JSON.parse(text) : null;
-  }
-
-  /** True once the management API answers — the server has finished starting. */
-  async ready(): Promise<boolean> {
-    try {
-      await this.api("GET", "/overview");
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  /** Block until the management API answers, or throw once the budget is spent. */
-  async waitReady(retries = 30, delayMs = 1000): Promise<void> {
-    for (let i = 0; i < retries; i++) {
-      if (await this.ready()) return;
-      await new Promise((r) => setTimeout(r, delayMs));
-    }
-    throw new Error("lavinmq management API did not become ready");
-  }
-
-  /**
-   * Create (or reset to a known state) one consumer's broker: a vhost and a user both named for the
-   * consumer's login, with the login owning full permissions on exactly that vhost. Idempotent — a
-   * PUT of a vhost or user that exists is a no-op or a password reset, so a reconcile can call it
-   * again without harm. The consumer connects as `<login>` to vhost `<login>` and can reach nothing
-   * else (novox/hq ADR 0048).
-   */
-  async createConsumer(login: string, password: string): Promise<void> {
-    const v = encodeURIComponent(login);
-    const u = encodeURIComponent(login);
-    await this.api("PUT", `/vhosts/${v}`);
-    await this.api("PUT", `/users/${u}`, { password, tags: "" });
-    await this.api("PUT", `/permissions/${v}/${u}`, { configure: ".*", write: ".*", read: ".*" });
-  }
-
-  /**
-   * Whether a consumer's user exists with exactly this password and full permissions on its own
-   * vhost. Read-only: the stored hash is salted SHA-256, the scheme `rabbitHash` writes, so the
-   * password is checked by hashing it with the stored salt rather than by logging in. `false` when
-   * the user or its permission is gone or the password differs; an unreachable API rejects
-   * (novox/hq issue 120).
-   */
-  async holdsConsumer(login: string, password: string): Promise<boolean> {
-    const v = encodeURIComponent(login);
-    const u = encodeURIComponent(login);
-    const user = await this.getOrNull<{ password_hash?: string; hashing_algorithm?: string }>(`/users/${u}`);
-    if (!user?.password_hash) return false;
-    if (user.hashing_algorithm && !/sha256/i.test(user.hashing_algorithm)) {
-      throw new Error(`lavinmq user ${login} is hashed with ${user.hashing_algorithm}, which this check cannot verify`);
-    }
-    const stored = Buffer.from(user.password_hash, "base64");
-    if (stored.length < 5 || rabbitHash(password, stored.subarray(0, 4)) !== user.password_hash) return false;
-    const perm = await this.getOrNull<{ configure?: string; write?: string; read?: string }>(`/permissions/${v}/${u}`);
-    return perm?.configure === ".*" && perm?.write === ".*" && perm?.read === ".*";
-  }
-
-  /** A GET that answers null for a 404 and rejects on anything else that is not 2xx. */
-  private async getOrNull<T>(path: string): Promise<T | null> {
-    const resp = await fetch(`${this.conn.base}/api${path}`, {
-      headers: {
-        Authorization: "Basic " + Buffer.from(`${this.conn.adminUser}:${this.conn.adminPassword}`).toString("base64"),
-      },
-    });
-    if (resp.status === 404) return null;
-    if (!resp.ok) throw new Error(`lavinmq management API GET ${path} -> ${resp.status}: ${await resp.text()}`);
-    return (await resp.json()) as T;
-  }
-
-  /** Remove a consumer's vhost and user, idempotently. A DELETE of what is already gone is tolerated. */
-  async removeConsumer(login: string): Promise<void> {
-    const v = encodeURIComponent(login);
-    const u = encodeURIComponent(login);
-    try {
-      await this.api("DELETE", `/vhosts/${v}`);
-    } catch (err) {
-      console.error(`[lavinmq] delete vhost ${login} failed (continuing): ${err}`);
-    }
-    try {
-      await this.api("DELETE", `/users/${u}`);
-    } catch (err) {
-      console.error(`[lavinmq] delete user ${login} failed (continuing): ${err}`);
-    }
-  }
-
-  /** The vhosts, for the amqp_list_vhosts tool. */
-  async listVhosts(): Promise<{ name: string; messages: number }[]> {
-    const vhosts = (await this.api("GET", "/vhosts")) as { name: string; messages?: number }[];
-    return vhosts.map((v) => ({ name: v.name, messages: v.messages ?? 0 }));
-  }
-
-  /** The queues on one vhost (default the root vhost), for the amqp_list_queues tool. */
-  async listQueues(vhost = "/"): Promise<{ name: string; messages: number; consumers: number }[]> {
-    const queues = (await this.api("GET", `/queues/${encodeURIComponent(vhost)}`)) as
-      { name: string; messages?: number; consumers?: number }[];
-    return queues.map((q) => ({ name: q.name, messages: q.messages ?? 0, consumers: q.consumers ?? 0 }));
-  }
-}
-
-/**
- * The RabbitMQ-compatible SHA-256 password hash lavinmq's `default_password_hash` expects:
- * base64( salt[4] || sha256( salt || utf8(password) ) ). The salt is any four bytes — random here,
- * because a fixed salt buys nothing and a fresh one is free. Verified against `lavinmqctl
- * hash_password`: a hash produced here is accepted by the server unchanged.
- */
-export function rabbitHash(password: string, salt: Buffer = randomBytes(4)): string {
-  const digest = createHash("sha256").update(Buffer.concat([salt, Buffer.from(password, "utf8")])).digest();
-  return Buffer.concat([salt, digest]).toString("base64");
-}
-
-/** Generate a URL-safe password. */
-export function generatePassword(): string {
-  return randomBytes(24).toString("base64url");
-}
-
-function readSecretFile(path: string | undefined): string | undefined {
-  if (!path) return undefined;
-  try {
-    return readFileSync(path, "utf8").trim();
-  } catch {
-    return undefined;
-  }
-}
@@ -1,25 +0,0 @@
-// lavinmq's events entrypoint, loaded by the per-node tool host (the provisioner container runs
-// ./provisioner separately). The broker lifecycle events are EMITTED from the provisioner, where the
-// lifecycle actually happens (novox/hq ADR 0041/0042):
-//   module.lavinmq.amqp.provisioned    — a consumer's vhost + user was created
-//   module.lavinmq.amqp.deprovisioned  — that vhost + user was removed
-// Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
-// broker and who lost one — observability the provider itself is best placed to log.
-
-import { on } from "@novox/mesh-sdk/events";
-
-interface AmqpEvent {
-  consumer?: string;
-  user: string;
-  vhost?: string;
-}
-
-await on<AmqpEvent>("module.lavinmq.amqp.provisioned", async (e) => {
-  console.log(`[lavinmq] broker provisioned for ${e.body.consumer ?? "?"} (user ${e.body.user}, vhost ${e.body.vhost})`);
-});
-
-await on<AmqpEvent>("module.lavinmq.amqp.deprovisioned", async (e) => {
-  console.log(`[lavinmq] broker deprovisioned (user ${e.body.user})`);
-});
-
-console.log("[lavinmq] auditing broker lifecycle events");
@@ -1,151 +0,0 @@
-{
-  "module": "lavinmq",
-  "version": "1",
-  "provides": [
-    {
-      "name": "amqp",
-      "scope": "mesh"
-    }
-  ],
-  "claims": [
-    {
-      "name": "mesh-broker",
-      "scope": "mesh"
-    }
-  ],
-  "capabilities": [
-    "container-runtime"
-  ],
-  "emits": [
-    "module.lavinmq.amqp.provisioned",
-    "module.lavinmq.amqp.deprovisioned"
-  ],
-  "consumes": [
-    "module.lavinmq.amqp.provisioned",
-    "module.lavinmq.amqp.deprovisioned"
-  ],
-  "serves": {
-    "amqp": {
-      "port": 5672
-    }
-  },
-  "receives": {
-    "amqp": "/var/lib/lavinmq-module/grants/mesh.json"
-  },
-  "grants": {
-    "amqp": "/var/lib/lavinmq-module/grants"
-  },
-  "own-secrets": {
-    "admin": "/var/lib/lavinmq-module/admin.secret",
-    "broker": "/var/lib/mesh/lavinmq/broker"
-  },
-  "listens": [
-    {
-      "port": 5671,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "the mesh bus \u2014 amqps, every module's events and the control plane, reached over the overlay"
-    },
-    {
-      "port": 5672,
-      "protocol": "tcp",
-      "from": "mesh",
-      "why": "modules on any machine that were granted a queue"
-    }
-  ],
-  "guards": [
-    15672
-  ],
-  "resources": [
-    {
-      "id": "mesh-state",
-      "type": "directory",
-      "path": "/var/lib/mesh/lavinmq",
-      "mode": "0700"
-    },
-    {
-      "id": "state",
-      "type": "directory",
-      "path": "/var/lib/lavinmq-module",
-      "mode": "0700"
-    },
-    {
-      "id": "grants-dir",
-      "type": "directory",
-      "path": "/var/lib/lavinmq-module/grants",
-      "mode": "0700"
-    },
-    {
-      "id": "broker-data",
-      "type": "directory",
-      "path": "/var/lib/mesh-broker",
-      "mode": "0700"
-    },
-    {
-      "id": "broker-tls",
-      "type": "directory",
-      "path": "/var/lib/mesh-broker-tls",
-      "mode": "0700"
-    },
-    {
-      "id": "server",
-      "type": "container",
-      "name": "mesh-broker",
-      "image": "cloudamqp/lavinmq@sha256:3eb54c12916d700a978c2ea86e6362cd4974b0e3189508718006d4e6d341246b",
-      "ports": [
-        "5671:5671",
-        "5672:5672",
-        "127.0.0.1:15672:15672"
-      ],
-      "volumes": [
-        "/var/lib/mesh-broker:/var/lib/lavinmq",
-        "/var/lib/mesh-broker-tls:/tls:ro"
-      ],
-      "args": [
-        "--amqps-port=5671",
-        "--cert=/tls/tls.crt",
-        "--key=/tls/tls.key"
-      ]
-    },
-    {
-      "id": "runtime",
-      "type": "container",
-      "name": "mesh-lavinmq",
-      "artifact": "runtime",
-      "network": "host",
-      "volumes": [
-        "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
-        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro",
-        "/var/lib/lavinmq-module/admin.secret:/run/secrets/admin:ro"
-      ],
-      "env": {
-        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/lavinmq-module/grants/mesh.json",
-        "MESH_PROVISION_LAVINMQ": "http://127.0.0.1:15672",
-        "MESH_PROVISION_ADMIN_USER": "guest",
-        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
-      }
-    }
-  ],
-  "build": {
-    "on": [
-      {
-        "arg": "BUILD_BASE",
-        "module": "mesh-tools",
-        "artifact": "build"
-      },
-      {
-        "arg": "RUNTIME_BASE",
-        "module": "mesh-tools",
-        "artifact": "runtime"
-      }
-    ],
-    "artifacts": [
-      {
-        "name": "runtime",
-        "kind": "image",
-        "from": "Dockerfile"
-      }
-    ]
-  }
-}
@@ -1,14 +0,0 @@
-{
-  "name": "@novox/module-lavinmq",
-  "version": "0.1.0",
-  "description": "lavinmq — provides the mesh amqp interface (a per-consumer AMQP message broker). Its management client, provisioner, run-once bootstrap, tools and events live here (novox/hq ADR 0039).",
-  "type": "module",
-  "private": true,
-  "dependencies": {
-    "@novox/mesh-sdk": "^0.1.1"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}
@@ -1,56 +0,0 @@
-// lavinmq's provisioner — the adapter that makes lavinmq a provider of the mesh `amqp` interface.
-// The reconcile loop, the contributions file, and reading the mesh's minted password are the sdk
-// harness's; this writes only the per-service half: how lavinmq creates and removes a consumer's own
-// broker (novox/hq ADR 0039/0040/0048).
-//
-// The `amqp` interface: a consumer connects as `as` with the password the mesh minted, to a vhost
-// named for that same login — its own message broker, isolated from every other consumer's by the
-// vhost boundary. It is a broker of its own, not a shared account on the mesh's control-plane broker.
-//
-// **The login and password are the mesh's, not the provisioner's (novox/hq ADR 0048).** The mesh
-// derives the login and hands it to both ends so they agree, and mints the password and delivers a
-// copy to each. lavinmq creates exactly that user with exactly that password — a name or password the
-// provisioner invented is one the consumer could never present.
-//
-// Vhost-per-login is the isolation model, the exact analog of postgres's database-per-login: the
-// consumer owns one vhost, named for its login, and a user with full rights on that vhost and no
-// rights anywhere else. lavinmq enforces it — a user with no permission on `/` is refused the moment
-// it opens that vhost (`NOT_ALLOWED`), so a login is a broker the consumer alone can reach.
-
-import { runProvisioner, type Provision } from "@novox/mesh-sdk/provisioner";
-import { emit } from "@novox/mesh-sdk/events";
-import { LavinmqClient } from "../client.js";
-
-const lavinmq = LavinmqClient.fromEnv();
-
-/** Emit a lifecycle event without letting a broker hiccup fail the provisioning itself. */
-async function announce(type: string, body: Record<string, string>): Promise<void> {
-  try {
-    await emit(type, body);
-  } catch (err) {
-    console.error(`[provisioner:amqp] emit ${type} failed: ${err}`);
-  }
-}
-
-runProvisioner("amqp", {
-  async create(p: Provision): Promise<void> {
-    // The vhost and the user share the consumer's login, so one cannot reach another's broker.
-    await lavinmq.waitReady();
-    await lavinmq.createConsumer(p.as, p.password);
-    await announce("module.lavinmq.amqp.provisioned", {
-      consumer: p.consumer ?? "",
-      user: p.as,
-      vhost: p.as,
-    });
-  },
-
-  async remove(p: { as: string }): Promise<void> {
-    await lavinmq.removeConsumer(p.as);
-    await announce("module.lavinmq.amqp.deprovisioned", { user: p.as, vhost: p.as });
-  },
-  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
-  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
-  async holds(p: Provision): Promise<boolean> {
-    return lavinmq.holdsConsumer(p.as, p.password);
-  },
-});
@@ -1,32 +0,0 @@
-// lavinmq's tools — lavinmq's own code (novox/hq ADR 0039), importing lavinmq's own management
-// client. They return structured data; the mesh serves them through the sdk's tool harness.
-
-import { registerModuleTools, type ToolDefinition } from "@novox/mesh-sdk/tools";
-import { LavinmqClient } from "../client.js";
-
-export function getLavinmqTools(lavinmq: LavinmqClient): ToolDefinition[] {
-  return [
-    {
-      name: "amqp_list_vhosts",
-      description: "List the lavinmq virtual hosts — one per consumer that was granted a broker.",
-      input: {},
-      run: async () => ({ vhosts: await lavinmq.listVhosts() }),
-    },
-    {
-      name: "amqp_list_queues",
-      description: "List the queues on a vhost with message and consumer counts. Omit vhost for the root '/'.",
-      input: { vhost: { type: "string", description: "the vhost to list, e.g. a consumer's login; defaults to '/'" } },
-      run: async (args) => ({ queues: await lavinmq.listQueues(args.vhost ? String(args.vhost) : undefined) }),
-    },
-  ];
-}
-
-// The tools exist only when the server can be reached from the environment; without it, lavinmq
-// contributes none rather than failing the whole tool runtime.
-registerModuleTools("lavinmq", (env) => {
-  try {
-    return getLavinmqTools(LavinmqClient.fromEnv(env));
-  } catch {
-    return [];
-  }
-});
@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "noEmit": true
-  },
-  "include": ["client.ts", "index.ts", "provisioner/index.ts", "tools/index.ts", "bootstrap/index.ts"]
-}
@@ -40,12 +40,12 @@ async function pollQueue(lidarr: LidarrClient): Promise<void> {
  if (primed) {
    // Entered the queue since last look — Lidarr grabbed a release.
    for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("module.lidarr.album.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("album.grabbed", { title: item.title, status: item.status });
    }
    // Left the queue — imported and done, unless it was last seen failing.
    for (const [id, item] of inQueue) {
      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("module.lidarr.download.completed", { title: item.title });
+        await emit("download.completed", { title: item.title });
      }
    }
  }
@@ -5,8 +5,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.lidarr.album.grabbed",
-    "module.lidarr.download.completed"
+    "album.grabbed",
+    "download.completed"
  ],
  "consumes": [],
  "own-secrets": {
@@ -36,8 +36,8 @@ function watcher(created: string, deleted: string): (keys: string[]) => Promise<
  };
 }

-const watchUsers = watcher("module.mailu.user.created", "module.mailu.user.deleted");
-const watchAliases = watcher("module.mailu.alias.created", "module.mailu.alias.deleted");
+const watchUsers = watcher("user.created", "user.deleted");
+const watchAliases = watcher("alias.created", "alias.deleted");

 async function pollUsers(): Promise<void> {
  await watchUsers((await mailu.listUsers()).map((u) => u.email));
@@ -41,22 +41,22 @@
    }
  },
  "binds": {
-    "postgres-database": "/var/lib/mailu/database.json",
-    "route": "/var/lib/mailu/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
  },
  "secrets": {
-    "postgres-database": "/var/lib/mailu/database.secret",
+    "postgres-database": "${dir:state}/database.secret",
    "secret": {
-      "secret-key": "/var/lib/mailu/secret-key.secret",
-      "admin": "/var/lib/mailu/admin.secret",
-      "api-token": "/var/lib/mailu/api-token.secret"
+      "secret-key": "${dir:state}/secret-key.secret",
+      "admin": "${dir:state}/admin.secret",
+      "api-token": "${dir:state}/api-token.secret"
    }
  },
  "emits": [
-    "module.mailu.user.created",
-    "module.mailu.user.deleted",
-    "module.mailu.alias.created",
-    "module.mailu.alias.deleted"
+    "user.created",
+    "user.deleted",
+    "alias.created",
+    "alias.deleted"
  ],
  "listens": [
    {
@@ -140,143 +140,125 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/mailu",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
-      "path": "/var/lib/mailu/grants",
      "mode": "0700"
    },
    {
      "id": "data-automx",
      "type": "directory",
-      "path": "/services/mailu/data/automx",
      "mode": "0700"
    },
    {
      "id": "config-env",
      "type": "file",
-      "path": "/var/lib/mailu/mailu.env",
+      "path": "${dir:state}/mailu.env",
      "mode": "0644",
-      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=cert\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nWEBMAIL_ADDRESS=webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
+      "content": "ADMIN_ADDRESS=mailu-admin\nANTISPAM_ADDRESS=mailu-antispam\nANTIVIRUS_ADDRESS=mailu-antivirus\nIMAP_ADDRESS=mailu-imap\nSMTP_ADDRESS=mailu-smtp\nFRONT_ADDRESS=mailu-front\nWEBMAIL_ADDRESS=mailu-webmail\nWEBDAV_ADDRESS=mailu-webdav\nREDIS_ADDRESS=mailu-redis\nPORTS=25,80,443,465,993,995,4190,110,143,587\nDOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=letsencrypt\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=142.132.152.141\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\nWELCOME_SUBJECT=Welcome to your new email account\nWELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!\n"
    },
    {
      "id": "secret-env",
      "type": "file",
-      "path": "/var/lib/mailu/secret.env",
+      "path": "${dir:state}/secret.env",
      "mode": "0600",
      "content": "SECRET_KEY=${secret:secret-key}\n"
    },
    {
      "id": "database-env",
      "type": "file",
-      "path": "/var/lib/mailu/database.env",
+      "path": "${dir:state}/database.env",
      "mode": "0600",
      "content": "DB_FLAVOR=postgresql\nDB_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nDB_USER=${bound:postgres-database:as}\nDB_NAME=${bound:postgres-database:as}\nDB_PW=${secret:postgres-database}\n"
    },
    {
      "id": "admin-env",
      "type": "file",
-      "path": "/var/lib/mailu/admin.env",
+      "path": "${dir:state}/admin.env",
      "mode": "0600",
      "content": "INITIAL_ADMIN_PW=${secret:admin}\nAPI_TOKEN=${secret:api-token}\n"
    },
    {
      "id": "data-certs",
      "type": "directory",
-      "path": "/services/mailu/data/certs",
      "mode": "0700"
    },
    {
      "id": "data-data",
      "type": "directory",
-      "path": "/services/mailu/data/data",
      "mode": "0700"
    },
    {
      "id": "data-dkim",
      "type": "directory",
-      "path": "/services/mailu/data/dkim",
      "mode": "0700"
    },
    {
      "id": "data-mail",
      "type": "directory",
-      "path": "/services/mailu/data/mail",
      "mode": "0700"
    },
    {
      "id": "data-mailqueue",
      "type": "directory",
-      "path": "/services/mailu/data/mailqueue",
      "mode": "0755"
    },
    {
      "id": "data-filter",
      "type": "directory",
-      "path": "/services/mailu/data/filter",
      "mode": "0700"
    },
    {
      "id": "data-clamav",
      "type": "directory",
-      "path": "/services/mailu/data/clamav",
      "mode": "0700"
    },
    {
      "id": "data-redis",
      "type": "directory",
-      "path": "/services/mailu/data/redis",
      "mode": "0700"
    },
    {
      "id": "data-webmail",
      "type": "directory",
-      "path": "/services/mailu/data/webmail",
      "mode": "0700"
    },
    {
      "id": "data-dav",
      "type": "directory",
-      "path": "/services/mailu/data/dav",
      "mode": "0700"
    },
    {
      "id": "data-fetchmail",
      "type": "directory",
-      "path": "/services/mailu/data/data/fetchmail",
      "mode": "0700"
    },
    {
      "id": "data-overrides-nginx",
      "type": "directory",
-      "path": "/services/mailu/data/overrides/nginx",
      "mode": "0700"
    },
    {
      "id": "data-overrides-dovecot",
      "type": "directory",
-      "path": "/services/mailu/data/overrides/dovecot",
      "mode": "0700"
    },
    {
      "id": "data-overrides-postfix",
      "type": "directory",
-      "path": "/services/mailu/data/overrides/postfix",
      "mode": "0700"
    },
    {
      "id": "data-overrides-rspamd",
      "type": "directory",
-      "path": "/services/mailu/data/overrides/rspamd",
      "mode": "0700"
    },
    {
      "id": "data-overrides-roundcube",
      "type": "directory",
-      "path": "/services/mailu/data/overrides/roundcube",
      "mode": "0700"
    },
    {
@@ -291,8 +273,8 @@
      "image": "ghcr.io/mailu/unbound@sha256:3a0fdfb364a63f4f9259526e013c1ef40f5f14de3621ce1560804b3a5909584a",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env",
-        "/var/lib/mailu/secret.env"
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
      ],
      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
      "ip": "192.168.203.254"
@@ -304,7 +286,7 @@
      "image": "redis@sha256:4bed291aa5efb9f0d77b76ff7d4ab71eee410962965d052552db1fb80576431d",
      "network": "mailu",
      "volumes": [
-        "/services/mailu/data/redis:/data"
+        "${dir:data-redis}:/data"
      ]
    },
    {
@@ -314,14 +296,14 @@
      "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env",
-        "/var/lib/mailu/secret.env",
-        "/var/lib/mailu/database.env",
-        "/var/lib/mailu/admin.env"
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env",
+        "${dir:state}/database.env",
+        "${dir:state}/admin.env"
      ],
      "volumes": [
-        "/services/mailu/data/data:/data",
-        "/services/mailu/data/dkim:/dkim"
+        "${dir:data-data}:/data",
+        "${dir:data-dkim}:/dkim"
      ],
      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
      "dns": [
@@ -335,11 +317,11 @@
      "image": "ghcr.io/mailu/dovecot@sha256:7f0ed5db996fbdc00adc5c5e38a08492e04f7eb4a9fbd66a03aa9a28ddf23993",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env"
+        "${dir:state}/mailu.env"
      ],
      "volumes": [
-        "/services/mailu/data/mail:/mail",
-        "/services/mailu/data/overrides/dovecot:/overrides:ro"
+        "${dir:data-mail}:/mail",
+        "${dir:data-overrides-dovecot}:/overrides:ro"
      ],
      "dns": [
        "192.168.203.254"
@@ -352,11 +334,11 @@
      "image": "ghcr.io/mailu/postfix@sha256:e2e49f39e53b80eac9e7a2f18d9df11edeb4914fd62dbba89b3155e8e034f62e",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env"
+        "${dir:state}/mailu.env"
      ],
      "volumes": [
-        "/services/mailu/data/mailqueue:/queue",
-        "/services/mailu/data/overrides/postfix:/overrides:ro"
+        "${dir:data-mailqueue}:/queue",
+        "${dir:data-overrides-postfix}:/overrides:ro"
      ],
      "dns": [
        "192.168.203.254"
@@ -369,11 +351,11 @@
      "image": "ghcr.io/mailu/rspamd@sha256:ff3666d8a61f17d309c5c6f6bcf4d40470b82299ca706ac650301175bb1a079d",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env"
+        "${dir:state}/mailu.env"
      ],
      "volumes": [
-        "/services/mailu/data/filter:/var/lib/rspamd",
-        "/services/mailu/data/overrides/rspamd:/etc/rspamd/override.d:ro"
+        "${dir:data-filter}:/var/lib/rspamd",
+        "${dir:data-overrides-rspamd}:/etc/rspamd/override.d:ro"
      ],
      "dns": [
        "192.168.203.254"
@@ -386,7 +368,7 @@
      "image": "clamav/clamav-debian@sha256:b12ef8fefddbba7d88de59bea8a32622f365339154adf02d38fd089112e6745a",
      "network": "mailu",
      "volumes": [
-        "/services/mailu/data/clamav:/var/lib/clamav"
+        "${dir:data-clamav}:/var/lib/clamav"
      ],
      "dns": [
        "192.168.203.254"
@@ -399,12 +381,12 @@
      "image": "ghcr.io/mailu/webmail@sha256:bdbee44cdb05a4658f0e3b62cc448de55ca8f8aea172279fda594826144c04f6",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env",
-        "/var/lib/mailu/secret.env"
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
      ],
      "volumes": [
-        "/services/mailu/data/webmail:/data",
-        "/services/mailu/data/overrides/roundcube:/overrides:ro"
+        "${dir:data-webmail}:/data",
+        "${dir:data-overrides-roundcube}:/overrides:ro"
      ],
      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
      "dns": [
@@ -418,11 +400,11 @@
      "image": "ghcr.io/mailu/radicale@sha256:690ed6edf189dfef100a5a8b37c195ebf5d9241ac5f23f2f44b8b7b75726e3de",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env",
-        "/var/lib/mailu/secret.env"
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
      ],
      "volumes": [
-        "/services/mailu/data/dav:/data"
+        "${dir:data-dav}:/data"
      ],
      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
      "dns": [
@@ -436,11 +418,11 @@
      "image": "ghcr.io/mailu/fetchmail@sha256:f881c8412d3bbe73d638469b48321558d6403a9d45bfa043c1e52c752103d42d",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env",
-        "/var/lib/mailu/secret.env"
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
      ],
      "volumes": [
-        "/services/mailu/data/data/fetchmail:/data"
+        "${dir:data-fetchmail}:/data"
      ],
      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
      "dns": [
@@ -454,7 +436,7 @@
      "image": "ghcr.io/mailu/nginx@sha256:36f98897cd1bc9d27628bbb4e04bdf60147af2ec7507d6da77f002c4f256896d",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env"
+        "${dir:state}/mailu.env"
      ],
      "ports": [
        "25",
@@ -468,8 +450,8 @@
        "7443:443"
      ],
      "volumes": [
-        "/services/mailu/data/certs:/certs",
-        "/services/mailu/data/overrides/nginx:/overrides:ro"
+        "${dir:data-certs}:/certs",
+        "${dir:data-overrides-nginx}:/overrides:ro"
      ],
      "dns": [
        "192.168.203.254"
@@ -490,8 +472,8 @@
      "network": "mailu",
      "volumes": [
        "/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
-        "/var/lib/mailu/api-token.secret:/run/secrets/api-token:ro",
-        "/var/lib/mailu/grants:/var/lib/mailu/grants:ro",
+        "${dir:state}/api-token.secret:/run/secrets/api-token:ro",
+        "${dir:grants}:${dir:grants}:ro",
        "/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
        "/var/run/docker.sock:/var/run/docker.sock"
      ],
@@ -502,7 +484,7 @@
        "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
        "MESH_MAILU_CONFIG_FILE": "/run/config/config.json",
        "MESH_MAILU_DOMAIN": "novox.be",
-        "MESH_RECEIVES": "/var/lib/mailu/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
      },
      "restart-on": [
        "runtime-config"
@@ -516,13 +498,13 @@
      "artifact": "automx",
      "network": "mailu",
      "env-file": [
-        "/var/lib/mailu/mailu.env"
+        "${dir:state}/mailu.env"
      ],
      "ports": [
        "4243"
      ],
      "volumes": [
-        "/services/mailu/data/automx:/data"
+        "${dir:data-automx}:/data"
      ]
    }
  ],
@@ -565,13 +547,14 @@
  "serves": {
    "smtp": {
      "port": 587,
-      "domain": "novox.be"
+      "domain": "novox.be",
+      "name": "mail.novox.be"
    }
  },
  "receives": {
-    "smtp": "/var/lib/mailu/grants/mesh.json"
+    "smtp": "${dir:grants}/mesh.json"
  },
  "grants": {
-    "smtp": "/var/lib/mailu/grants"
+    "smtp": "${dir:grants}"
  }
 }
@@ -1,6 +1,6 @@
 // mesh-catalog's entrypoint — the module graph's consumer (novox/hq ADR 0070, ADR 0072).
 //
-// The builder announces what it built; this places it in the graph and announces what that means.
+// The build-machine role announces what it built; this places it in the graph and announces what that means.
 // The control plane hooks the *meaning* — a module was upgraded — rather than the build output, so
 // it never has to interpret an artifact or ask this module anything.
 //
@@ -47,7 +47,7 @@ interface Built {
  replay?: boolean;
 }

-await on("module.builder.built", async (event) => {
+await on("mesh-build-machine.built", async (event) => {
  const body = event.body as Built;
  if (!body.module || !body.commit) {
    // Said rather than dropped: a build that announced itself without saying what it built is a
@@ -69,7 +69,7 @@ await on("module.builder.built", async (event) => {
  // it was missing, and the mesh is told nothing happened, because nothing did.
  if (body.replay) return;

-  await emit("module.mesh-catalog.registered", {
+  await emit("registered", {
    module: body.module, commit: body.commit, upgraded,
  });

@@ -77,13 +77,13 @@ await on("module.builder.built", async (event) => {
  // through modules that did not change, forever (ADR 0072).
  if (!upgraded) return;

-  await emit("module.mesh-catalog.upgraded", {
+  await emit("upgraded", {
    module: body.module, commit: body.commit, previous,
  });

  // What can be built now — stale, and waiting on nothing that is itself stale.
  for (const next of await graph.buildable()) {
-    await emit("module.mesh-catalog.rebuild-needed", {
+    await emit("rebuild-needed", {
      module: next.module,
      builtAt: next.commit,
      because: next.because,
@@ -101,4 +101,4 @@ await on("module.builder.built", async (event) => {
 // Asked on every start, not only the first. A catalogue cannot tell whether it has a gap, and the
 // answer is idempotent: registering a build already held changes nothing and announces nothing.
 // Asked AFTER subscribing, so a build arriving during the replay is not lost between the two.
-await emit("module.mesh-catalog.catching-up", {});
+await emit("catching-up", {});
@@ -7,7 +7,7 @@
  ],
  "claims": [
    {
-      "name": "the-catalogue",
+      "name": "mesh-catalog",
      "scope": "mesh"
    }
  ],
@@ -29,12 +29,13 @@
    "broker": "/var/lib/mesh/mesh-catalog/broker"
  },
  "consumes": [
-    "module.builder.built"
+    "mesh-build-machine.built"
  ],
  "emits": [
-    "module.mesh-catalog.registered",
-    "module.mesh-catalog.upgraded",
-    "module.mesh-catalog.rebuild-needed"
+    "registered",
+    "upgraded",
+    "rebuild-needed",
+    "catching-up"
  ],
  "resources": [
    {
@@ -16,15 +16,15 @@ interface SecretEvent {
  rotations?: number;
 }

-await on<SecretEvent>("module.mesh-vault.secret.provisioned", async (e) => {
+await on<SecretEvent>("secret.provisioned", async (e) => {
  console.log(`[mesh-vault] secret provisioned for ${e.body.as} on ${e.body.consumer} (${e.body.fingerprint})`);
 });

-await on<SecretEvent>("module.mesh-vault.secret.rotated", async (e) => {
+await on<SecretEvent>("secret.rotated", async (e) => {
  console.log(`[mesh-vault] secret rotated for ${e.body.as} — rotation ${e.body.rotations} (${e.body.fingerprint})`);
 });

-await on<SecretEvent>("module.mesh-vault.secret.deprovisioned", async (e) => {
+await on<SecretEvent>("secret.deprovisioned", async (e) => {
  console.log(`[mesh-vault] secret withdrawn from ${e.body.as}`);
 });

@@ -11,14 +11,14 @@
    "container-runtime"
  ],
  "emits": [
-    "module.mesh-vault.secret.provisioned",
-    "module.mesh-vault.secret.rotated",
-    "module.mesh-vault.secret.deprovisioned"
+    "secret.provisioned",
+    "secret.rotated",
+    "secret.deprovisioned"
  ],
  "consumes": [
-    "module.mesh-vault.secret.provisioned",
-    "module.mesh-vault.secret.rotated",
-    "module.mesh-vault.secret.deprovisioned"
+    "mesh-vault.secret.provisioned",
+    "mesh-vault.secret.rotated",
+    "mesh-vault.secret.deprovisioned"
  ],
  "receives": {
    "secret": "/var/lib/mesh-vault/grants/mesh.json"
@@ -43,6 +43,6 @@ runProvisioner("secret", {
  async remove(p: { as: string }): Promise<void> {
    if (!ledger.withdraw(p.as)) return;
    console.log(`[mesh-vault] withdrawn: ${p.as}`);
-    await announce("module.mesh-vault.secret.deprovisioned", { as: p.as });
+    await announce("secret.deprovisioned", { as: p.as });
  },
 });
@@ -26,8 +26,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.minio.bucket.created",
-    "module.minio.bucket.removed"
+    "bucket.created",
+    "bucket.removed"
  ],
  "listens": [
    {
@@ -95,14 +95,14 @@
    {
      "id": "net",
      "type": "network",
-      "name": "minio"
+      "name": "minio-net"
    },
    {
      "id": "server",
      "type": "container",
      "name": "minio",
      "image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
-      "network": "minio",
+      "network": "minio-net",
      "args": [
        "server",
        "/data",
@@ -122,6 +122,7 @@
      ],
      "env": {
        "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
+        "MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be",
        "MINIO_REGION": "eu-west"
      }
    },
@@ -129,7 +130,7 @@
      "id": "runtime",
      "type": "container",
      "name": "mesh-minio",
-      "network": "minio",
+      "network": "minio-net",
      "volumes": [
        "/var/lib/mesh/minio/broker:/run/secrets/broker:ro",
        "/var/lib/minio/grants:/var/lib/minio/grants:ro",
@@ -30,7 +30,7 @@ runProvisioner("s3-bucket", {
    try { await minio.removeAccessKey(accessKeyId); } catch { /* none yet — first provision */ }
    await minio.createAccessKey(bucket, accessKeyId, p.password);

-    await announce("module.minio.bucket.created", {
+    await announce("bucket.created", {
      bucket,
      consumer: p.consumer ?? "",
      accessKey: accessKeyId,
@@ -51,7 +51,7 @@ runProvisioner("s3-bucket", {
      console.error(`[minio] bucket ${bucket} not removed (likely non-empty), access revoked: ${err}`);
    }

-    await announce("module.minio.bucket.removed", { bucket, accessKey: p.as });
+    await announce("bucket.removed", { bucket, accessKey: p.as });
  },

  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
@@ -22,7 +22,7 @@ const store = UsageStore.fromEnv();
 // to reach the provider over the overlay would block the very apply that brings the overlay up.
 await store.migrate();

-await on("module.*.usage.*", async (event) => {
+await on("*.usage.*", async (event) => {
  const body = event.body as { rows?: UsageRow[]; raw?: unknown };
  for (const row of body.rows ?? []) {
    try {
@@ -20,7 +20,7 @@
    "postgres-database": "/var/lib/model-usage/database.secret"
  },
  "consumes": [
-    "module.*.usage.*"
+    "*.usage.*"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/model-usage/broker"
@@ -14,11 +14,11 @@ interface DatabaseEvent {
  user?: string;
 }

-await on<DatabaseEvent>("module.mongodb.database.provisioned", async (e) => {
+await on<DatabaseEvent>("database.provisioned", async (e) => {
  console.log(`[mongodb] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

-await on<DatabaseEvent>("module.mongodb.database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("database.deprovisioned", async (e) => {
  console.log(`[mongodb] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

@@ -11,12 +11,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.mongodb.database.provisioned",
-    "module.mongodb.database.deprovisioned"
+    "database.provisioned",
+    "database.deprovisioned"
  ],
  "consumes": [
-    "module.mongodb.database.provisioned",
-    "module.mongodb.database.deprovisioned"
+    "mongodb.database.provisioned",
+    "mongodb.database.deprovisioned"
  ],
  "listens": [
    {
@@ -32,13 +32,13 @@
    }
  },
  "receives": {
-    "mongodb-database": "/var/lib/mongodb/grants/mesh.json"
+    "mongodb-database": "${dir:grants}/mesh.json"
  },
  "grants": {
-    "mongodb-database": "/var/lib/mongodb/grants"
+    "mongodb-database": "${dir:grants}"
  },
  "own-secrets": {
-    "root": "/var/lib/mongodb/root.secret",
+    "root": "${dir:state}/root.secret",
    "broker": "/var/lib/mesh/mongodb/broker"
  },
  "secrets-owner": "999:999",
@@ -52,19 +52,17 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/mongodb",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
-      "path": "/var/lib/mongodb/grants",
      "mode": "0700"
    },
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/mongodb/db-data",
      "mode": "0700"
    },
    {
@@ -86,8 +84,8 @@
        "27017"
      ],
      "volumes": [
-        "/services/mongodb/db-data:/data/db",
-        "/var/lib/mongodb/root.secret:/run/secrets/root:ro"
+        "${dir:data}:/data/db",
+        "${dir:state}/root.secret:/run/secrets/root:ro"
      ]
    },
    {
@@ -97,14 +95,14 @@
      "network": "mongodb",
      "volumes": [
        "/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro",
-        "/var/lib/mongodb/grants:/var/lib/mongodb/grants:ro",
-        "/var/lib/mongodb/root.secret:/run/secrets/root:ro"
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:state}/root.secret:/run/secrets/root:ro"
      ],
      "env": {
        "MESH_PROVISION_MONGODB": "mongodb://root@mongodb-server:27017/admin?authSource=admin",
        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/root",
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/mongodb/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
      },
      "artifact": "runtime"
    }
@@ -34,7 +34,7 @@ runProvisioner("mongodb-database", {
    // Database and owning user share the consumer's login, so the consumer owns exactly its own.
    const database = p.as;
    await mongo.createDatabaseAndUser(database, p.as, p.password);
-    await announce("module.mongodb.database.provisioned", {
+    await announce("database.provisioned", {
      consumer: p.consumer ?? "",
      database,
      user: p.as,
@@ -43,7 +43,7 @@ runProvisioner("mongodb-database", {

  async remove(p: { as: string }): Promise<void> {
    await mongo.dropDatabaseAndUser(p.as, p.as);
-    await announce("module.mongodb.database.deprovisioned", { database: p.as });
+    await announce("database.deprovisioned", { database: p.as });
  },
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
@@ -14,11 +14,11 @@ interface TopicEvent {
  topicPrefix?: string;
 }

-await on<TopicEvent>("module.mosquitto.topic.provisioned", async (e) => {
+await on<TopicEvent>("topic.provisioned", async (e) => {
  console.log(`[mosquitto] topic provisioned for ${e.body.consumer} (client ${e.body.username})`);
 });

-await on<TopicEvent>("module.mosquitto.topic.deprovisioned", async (e) => {
+await on<TopicEvent>("topic.deprovisioned", async (e) => {
  console.log(`[mosquitto] topic deprovisioned for ${e.body.consumer} (client ${e.body.username})`);
 });

@@ -12,12 +12,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.mosquitto.topic.provisioned",
-    "module.mosquitto.topic.deprovisioned"
+    "topic.provisioned",
+    "topic.deprovisioned"
  ],
  "consumes": [
-    "module.mosquitto.topic.provisioned",
-    "module.mosquitto.topic.deprovisioned"
+    "mosquitto.topic.provisioned",
+    "mosquitto.topic.deprovisioned"
  ],
  "serves": {
    "mqtt-topic": {}
@@ -32,7 +32,7 @@ runProvisioner("mqtt-topic", {
    // The topic subtree is scoped to the consumer's own login, so one cannot read another's topics.
    const topicPrefix = p.as;
    await mosquitto.createScopedClient(p.as, p.password, topicPrefix);
-    await announce("module.mosquitto.topic.provisioned", {
+    await announce("topic.provisioned", {
      consumer: p.consumer ?? "",
      username: p.as,
      topicPrefix,
@@ -41,7 +41,7 @@ runProvisioner("mqtt-topic", {

  async remove(p: { as: string }): Promise<void> {
    await mosquitto.deleteScopedClient(p.as);
-    await announce("module.mosquitto.topic.deprovisioned", { username: p.as });
+    await announce("topic.deprovisioned", { username: p.as });
  },
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
@@ -14,11 +14,11 @@ interface DatabaseEvent {
  user?: string;
 }

-await on<DatabaseEvent>("module.mssql.database.provisioned", async (e) => {
+await on<DatabaseEvent>("database.provisioned", async (e) => {
  console.log(`[mssql] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

-await on<DatabaseEvent>("module.mssql.database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("database.deprovisioned", async (e) => {
  console.log(`[mssql] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

@@ -11,12 +11,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.mssql.database.provisioned",
-    "module.mssql.database.deprovisioned"
+    "database.provisioned",
+    "database.deprovisioned"
  ],
  "consumes": [
-    "module.mssql.database.provisioned",
-    "module.mssql.database.deprovisioned"
+    "mssql.database.provisioned",
+    "mssql.database.deprovisioned"
  ],
  "listens": [
    {
@@ -68,7 +68,6 @@
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/mssql/data",
      "mode": "0700",
      "owner": "10001:0"
    },
@@ -90,7 +89,7 @@
        "1433"
      ],
      "volumes": [
-        "/services/mssql/data:/var/opt/mssql"
+        "${dir:data}:/var/opt/mssql"
      ],
      "secrets-in-environment": "the image documents only MSSQL_SA_PASSWORD, no _FILE and no configuration field; not convertible without a wrapper entrypoint"
    },
@@ -33,7 +33,7 @@ runProvisioner("mssql-database", {
    // Database, login and user share the consumer's name, so the consumer owns exactly its own.
    const database = p.as;
    await mssql.createDatabaseAndLogin(database, p.as, p.password);
-    await announce("module.mssql.database.provisioned", {
+    await announce("database.provisioned", {
      consumer: p.consumer ?? "",
      database,
      user: p.as,
@@ -42,7 +42,7 @@ runProvisioner("mssql-database", {

  async remove(p: { as: string }): Promise<void> {
    await mssql.dropDatabaseAndLogin(p.as, p.as);
-    await announce("module.mssql.database.deprovisioned", { database: p.as });
+    await announce("database.deprovisioned", { database: p.as });
  },
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
@@ -0,0 +1,21 @@
+# nats's server image: the upstream server, plus an entrypoint that reloads it in place when the
+# mesh rewrites its configuration. See entrypoint.sh for why that belongs here and not in the host.
+#
+# **Pinned to the multi-architecture index digest, not a platform's.** `docker manifest inspect`
+# reports a platform manifest per architecture and the index that lists them; pinning a platform's
+# digest builds on this workstation and fails on any node of another architecture, with an error
+# that names a manifest rather than the mistake. This is the index — `docker pull` reports the same
+# one, and `RepoDigests` confirms it.
+#
+# Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
+# the module's code is the server, which upstream already built. There is no BUILD_BASE here on
+# purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and
+# arrives as NATS_BASE, like every other base the mesh copies into its own store before a build
+# (novox/hq ADR 0097); the digest above is the index one for the reason given.
+ARG NATS_BASE
+FROM ${NATS_BASE}
+
+COPY entrypoint.sh /usr/local/bin/mesh-nats-entrypoint
+RUN chmod 0755 /usr/local/bin/mesh-nats-entrypoint
+
+ENTRYPOINT ["/usr/local/bin/mesh-nats-entrypoint"]
@@ -0,0 +1,69 @@
+#!/bin/sh
+# nats's entrypoint: run the server, and reload it in place when the mesh rewrites its
+# configuration.
+#
+# **Why this exists inside the module** (novox/hq design 25 §5). The controller composes every
+# account and permission into one file, and that file changes whenever a module is added,
+# reassigned, or a person's access is granted or revoked — which is often, and on the one server
+# everything else depends on. The host has no way to say "reload this container": a
+# container resource has `restart-on` and nothing else, and a container's `restart-on` means
+# *recreate* — every connection dropped and every in-flight JetStream ack lost, mid-flight, for a
+# permission change. `reload-on` is real but it is a *service* field, not a container's.
+#
+# nats-server already reloads its own configuration on SIGHUP — accounts, permissions, everything
+# the mesh composes — without dropping a connection. That is the server's own documented
+# capability, not something built for the mesh. So the configuration is mounted as a directory
+# (a directory's contents are not digest-tracked the way a directly-mounted file's are, novox/hq
+# issue 103), and this watches the one file inside it and signals the server itself. The host's
+# only job is what it already does for any directory: keep the file's content current. Nothing
+# here is declared `restart-on` or `reload-on`.
+set -eu
+
+# **Two files, and only one of them is the mesh's** (novox/hq design 25 §4, task 1.7). CONF is this
+# module's own — ports, TLS, JetStream — declared in its manifest, because those are properties of
+# the container this module raises. USERS is every account and permission, composed by the
+# controller, and CONF includes it. So what is watched here is the mesh's half: the module's own
+# does not change without a new declaration, and that recreates the container anyway.
+CONF="${MESH_NATS_CONF:-/etc/nats/nats.conf}"
+USERS="${MESH_NATS_USERS:-/etc/nats/accounts.conf}"
+POLL="${MESH_NATS_CONF_POLL_SECONDS:-5}"
+
+# Both are written as part of the same declaration that creates this container, but none of the
+# three are ordered against each other. Waiting is correct and starting without them is not:
+# nats-server given a configuration whose include is missing refuses to start, and one given no
+# configuration at all comes up with its compiled-in defaults — no TLS, no accounts, every subject
+# open to anyone who can reach the port. A bus that is briefly open to everything is not a bus that
+# is briefly wrong; it is an open bus.
+for needed in "$CONF" "$USERS"; do
+  while [ ! -s "$needed" ]; do
+    echo "[nats] waiting for the mesh to write $needed"
+    sleep 1
+  done
+done
+
+digest() { sha256sum "$USERS" 2>/dev/null | cut -d' ' -f1; }
+
+nats-server --config "$CONF" "$@" &
+server=$!
+
+# Forward a stop to the server and let it drain, rather than dying and leaving it orphaned as
+# PID 1's child.
+stop() { kill -TERM "$server" 2>/dev/null || true; }
+trap stop TERM INT
+
+last=$(digest)
+while kill -0 "$server" 2>/dev/null; do
+  sleep "$POLL"
+  now=$(digest)
+  # An empty digest means the file is mid-write or briefly gone. Reloading on that would hand the
+  # server a truncated configuration; the next tick sees the finished one.
+  [ -n "$now" ] || continue
+  if [ "$now" != "$last" ]; then
+    last=$now
+    echo "[nats] the mesh's user list changed; reloading in place"
+    kill -HUP "$server" || true
+  fi
+done
+
+# `wait` on an already-exited child still yields its status, which becomes this container's.
+wait "$server"
@@ -0,0 +1,90 @@
+{
+  "module": "nats",
+  "version": "1",
+  "provides": [
+    {
+      "name": "mesh-bus",
+      "scope": "mesh"
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-broker",
+      "scope": "mesh"
+    }
+  ],
+  "bus-users": "/var/lib/nats-module/conf/accounts.conf",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [],
+  "consumes": [],
+  "listens": [
+    {
+      "port": 4222,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mesh bus \u2014 every link the mesh has, over TLS, reached across the overlay"
+    }
+  ],
+  "guards": [
+    8222
+  ],
+  "resources": [
+    {
+      "id": "jetstream-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-broker-nats",
+      "mode": "0700"
+    },
+    {
+      "id": "conf-dir",
+      "type": "directory",
+      "path": "/var/lib/nats-module/conf",
+      "mode": "0700"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "/var/lib/nats-module/conf/nats.conf",
+      "content": "# The nats module's own server settings. Declared by the module, because a port, a TLS path\n# and a store directory are properties of the container this module raises: they live in its\n# image and its mounts and change when it does.\n#\n# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the\n# whole file would have to be kept in step with a Dockerfile it never sees.\n\nport: 4222\nhttp: 127.0.0.1:8222\n\n# The mesh's own broker certificate \u2014 the one every machine already pins by fingerprint and the\n# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no\n# machine's pin changes when it moves, and no second certificate exists to be wrong about.\ntls {\n  cert_file: \"/tls/tls.crt\"\n  key_file: \"/tls/tls.key\"\n}\n\n# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That\n# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a\n# host pins this server's exact certificate and authenticates with the password the mesh minted\n# (novox/hq ADR 0004, design 25 \u00a74), and so does a module's runtime. With it on, every connection\n# in the mesh is refused at the TLS handshake, before any password is looked at \u2014 and the error is\n# \"client didn't provide a certificate\", which reads as a client fault.\n#\n# TLS is still required: a tls block is what makes it required, and verify only decides whether\n# client certificates are checked. What is given up is a second factor the mesh has no machinery\n# to issue or rotate \u2014 a certificate per module per node \u2014 and what is kept is stronger than a\n# name check in both directions: an exact pin outward, a per-user password inward.\n\njetstream {\n  store_dir: \"/data\"\n}\n\n# Every user of the mesh, composed by the controller and rewritten whenever a module is\n# assigned, a node enrols or a person's access changes.\n#\n# **Relative, and in this same directory, because it has to be.** An absolute include path is\n# resolved relative to the including file's directory, not from the root: nats-server given\n# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for\n# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.\ninclude accounts.conf\n",
+      "mode": "0644"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-broker-nats",
+      "ports": [
+        "4222:4222",
+        "127.0.0.1:8222:8222"
+      ],
+      "volumes": [
+        "/var/lib/mesh-broker-nats:/data",
+        "/var/lib/nats-module/conf:/etc/nats:ro",
+        "/var/lib/mesh-broker-tls:/tls:ro"
+      ],
+      "artifact": "server"
+    }
+  ],
+  "accesses": [
+    {
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "NATS_BASE",
+        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "module": "networkmanager",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "networkmanager"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/NetworkManager/conf.d/50-mesh.conf",
+      "mode": "0644",
+      "content": "# Managed by the mesh (module networkmanager). Replaced on every push; edit the\n# catalogue instead.\n#\n# This machine's uplink is NetworkManager's, and this file is the whole of what\n# the mesh asks of it (novox/hq ADR 0117): leave the resolver file to the mesh,\n# and leave the private network's interface alone. Nothing more. The mesh never\n# declares a connection profile, an address, a route, a wireless network or its\n# credentials \u2014 those are joined at the machine, by the person using it, and\n# the link they make is the only channel the mesh reaches this machine over. A\n# push that got a link wrong could not be undone by the next one.\n#\n# A drop-in of the mesh's own, beside NetworkManager.conf and whatever else the\n# operator keeps in this directory. NetworkManager reads the files here sorted by\n# name and a later one wins a key it sets again \u2014 so a file of the operator's\n# that sorts after this one (any name starting with a letter does) and sets dns=\n# or unmanaged-devices= overrides it. That is the operator's to decide, and the\n# reason this file sets nothing but the two keys it must.\n#\n# NetworkManager itself is the machine's: the mesh never starts, stops, enables\n# or disables it (its service is declared with no state), because stopping it\n# takes every link down, this machine's channel to the mesh included \u2014 and a\n# module unassigned by mistake must not be able to do that. When this file\n# changes, a running NetworkManager is reloaded (its D-Bus Reload call, which\n# re-reads its configuration \u2014 NetworkManager(8)), never restarted.\n\n[main]\n# The resolver file is the mesh's: resolv-conf writes /etc/resolv.conf and names\n# the mesh's resolver. Without this line NetworkManager rewrites that file on\n# every connectivity change \u2014 every network joined, every lease renewed \u2014\n# and the mesh's resolver is silently replaced while every surface of the mesh\n# still reads green. none: \"NetworkManager will not modify resolv.conf. This\n# implies rc-manager unmanaged\" (NetworkManager.conf(5), 1.58). On an adopted\n# machine the predecessor wrote the same line in a file of its own; both say one\n# thing, and the predecessor's is retired by hand after the take.\ndns=none\n\n[keyfile]\n# mesh0 is the private network's interface: the mesh brings it up and the mesh\n# alone configures it. A manager that considers every interface its own could\n# try to configure it, or tear it down on a profile change.\n#\n# unmanaged-devices rather than a [device-mesh0] section with managed=0, because\n# NetworkManager.conf(5) says a device unmanaged by this key \"is strictly\n# unmanaged and cannot be overruled by using the API like nmcli device set\n# $IFNAME managed yes\", while device*.managed \"can be overruled at runtime via\n# D-Bus\". The same page adds that device*.managed \"may be a better choice\" for\n# exactly those reasons \u2014 for an interface the operator might want to hand back\n# at runtime. For the mesh's own interface, strict is the point.\n#\n# += rather than =: the same page documents appending to a list-valued key set\n# earlier (\"plugins+=another-plugin\") as an extension of its key file format,\n# and unmanaged-devices is a device list. = would replace whatever devices the\n# operator already keeps NetworkManager away from; += adds this one to them\n# (novox/hq ADR 0102: a list is added to, never replaced). A file of the\n# operator's read after this one that sets the key with = replaces it again;\n# that is the operator's to decide.\nunmanaged-devices+=interface-name:mesh0\n"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "NetworkManager.service",
+      "reload-on": [
+        "config"
+      ]
+    }
+  ]
+}
@@ -26,7 +26,7 @@ async function pollUsers(client: NextcloudClient): Promise<void> {
  const users = client.listUsers();
  for (const u of users) {
    if (knownUsers.has(u.uid)) continue;
-    if (usersPrimed) await emit("module.nextcloud.user.created", { uid: u.uid, displayName: u.displayName });
+    if (usersPrimed) await emit("user.created", { uid: u.uid, displayName: u.displayName });
    knownUsers.add(u.uid);
  }
  usersPrimed = true;
@@ -38,7 +38,7 @@ async function pollShares(client: NextcloudClient): Promise<void> {
  const shares = await client.listShares();
  for (const s of shares) {
    if (knownShares.has(s.id)) continue;
-    if (sharesPrimed) await emit("module.nextcloud.share.created", { id: s.id, path: s.path, shareType: s.shareType, shareWith: s.shareWith, owner: s.owner });
+    if (sharesPrimed) await emit("share.created", { id: s.id, path: s.path, shareType: s.shareType, shareWith: s.shareWith, owner: s.owner });
    knownShares.add(s.id);
  }
  sharesPrimed = true;
@@ -11,29 +11,26 @@
    "postgres-database": {
      "name": "nextcloud"
    },
-    "s3-bucket": {
-      "bucket": "nextcloud"
-    },
    "route": {
      "label": "drive",
      "port": 80
    }
  },
  "binds": {
-    "postgres-database": "/var/lib/nextcloud-module/database.json",
-    "s3-bucket": "/var/lib/nextcloud-module/store.json",
-    "route": "/var/lib/nextcloud-module/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store.json",
+    "route": "${dir:state}/route.json"
  },
  "secrets": {
-    "postgres-database": "/var/lib/nextcloud-module/database.secret",
-    "s3-bucket": "/var/lib/nextcloud-module/store.secret"
+    "postgres-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
  },
  "emits": [
-    "module.nextcloud.user.created",
-    "module.nextcloud.share.created"
+    "user.created",
+    "share.created"
  ],
  "own-secrets": {
-    "admin": "/var/lib/nextcloud-module/admin.secret",
+    "admin": "${dir:state}/admin.secret",
    "broker": "/var/lib/mesh/nextcloud/broker"
  },
  "capabilities": [
@@ -57,20 +54,19 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/nextcloud-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "server-env",
      "type": "file",
-      "path": "/var/lib/nextcloud-module/server.env",
+      "path": "${dir:state}/server.env",
      "mode": "0600",
-      "content": "POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nPOSTGRES_DB=${bound:postgres-database:as}\nPOSTGRES_USER=${bound:postgres-database:as}\nPOSTGRES_PASSWORD=${secret:postgres-database}\nNEXTCLOUD_ADMIN_USER=mesh-admin\nNEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\nOBJECTSTORE_S3_HOST=${bound:s3-bucket:at}\nOBJECTSTORE_S3_PORT=${bound:s3-bucket:port}\nOBJECTSTORE_S3_BUCKET=nextcloud\nOBJECTSTORE_S3_KEY=${bound:s3-bucket:as}\nOBJECTSTORE_S3_SECRET=${secret:s3-bucket}\nOBJECTSTORE_S3_SSL=false\nOBJECTSTORE_S3_USEPATH_STYLE=true\nOBJECTSTORE_S3_REGION=${bound:s3-bucket:region}\n"
+      "content": "POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nPOSTGRES_DB=${bound:postgres-database:as}\nPOSTGRES_USER=${bound:postgres-database:as}\nPOSTGRES_PASSWORD=${secret:postgres-database}\nNEXTCLOUD_ADMIN_USER=mesh-admin\nNEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\nOBJECTSTORE_S3_HOST=${bound:s3-bucket:at}\nOBJECTSTORE_S3_PORT=${bound:s3-bucket:port}\nOBJECTSTORE_S3_BUCKET=mesh-novox-ncloud\nOBJECTSTORE_S3_KEY=${bound:s3-bucket:as}\nOBJECTSTORE_S3_SECRET=${secret:s3-bucket}\nOBJECTSTORE_S3_SSL=false\nOBJECTSTORE_S3_USEPATH_STYLE=true\nOBJECTSTORE_S3_REGION=${bound:s3-bucket:region}\n"
    },
    {
      "id": "html",
      "type": "directory",
-      "path": "/services/nextcloud/html",
      "mode": "0750",
      "owner": "33:33"
    },
@@ -80,13 +76,13 @@
      "name": "nextcloud",
      "image": "nextcloud@sha256:fb966733647ea03f0446b0c22eac9733c8eb616d37b960caca9d4c3010e14a08",
      "env-file": [
-        "/var/lib/nextcloud-module/server.env"
+        "${dir:state}/server.env"
      ],
      "ports": [
        "80"
      ],
      "volumes": [
-        "/services/nextcloud/html:/var/www/html"
+        "${dir:html}:/var/www/html"
      ],
      "secrets-in-environment": "the image honours POSTGRES_PASSWORD_FILE and NEXTCLOUD_ADMIN_PASSWORD_FILE (entrypoint file_env); OBJECTSTORE_S3_SECRET has none and needs a generated config fragment; convertible, awaiting a bed"
    },
@@ -106,7 +102,7 @@
      "volumes": [
        "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
        "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
-        "/var/lib/nextcloud-module/admin.secret:/run/secrets/admin:ro",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
        "/var/run/docker.sock:/var/run/docker.sock"
      ],
      "env": {
@@ -6,7 +6,7 @@
  ],
  "claims": [
    {
-      "name": "the-packet-filter",
+      "name": "node-packet-filter",
      "scope": "node"
    }
  ],
@@ -30,7 +30,7 @@
      "id": "stock-unit-stop",
      "type": "file",
      "path": "/etc/systemd/system/nftables.service.d/mesh.conf",
-      "content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
+      "content": "# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset\n# (novox/hq ADR 0100) \u2014 a flush would take the container runtime's rules and any firewall with it.\n[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n",
      "mode": "0644"
    },
    {
@@ -2,7 +2,7 @@
  "module": "nodered",
  "version": "1",
  "emits": [
-    "module.nodered.flows.deployed"
+    "flows.deployed"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/nodered/broker"
@@ -43,7 +43,7 @@ export function getNodeRedTools(nodered: NodeRedClient): ToolDefinition[] {
        const result = await nodered.deployFlows(flows, type);
        // Best-effort announcement — a deploy must not fail because the broker is unbound here.
        try {
-          await emit("module.nodered.flows.deployed", { rev: result.rev, nodeCount: result.nodeCount, type });
+          await emit("flows.deployed", { rev: result.rev, nodeCount: result.nodeCount, type });
        } catch (err) {
          console.error(`[nodered] deployed but could not emit: ${err}`);
        }
@@ -27,7 +27,7 @@ async function pollQueue(): Promise<void> {
  if (queuePrimed) {
    for (const item of items) {
      if (!inQueue.has(item.id)) {
-        await emit("module.nzbget.download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+        await emit("download.added", { name: item.name, category: item.category, sizeMB: item.sizeMB });
      }
    }
  }
@@ -45,7 +45,7 @@ async function pollHistory(): Promise<void> {
      // A newly-appeared history entry is a completion only if it actually succeeded; a failure or
      // a manual delete lands in history too, and neither is a "download.completed".
      if (historyPrimed && item.success) {
-        await emit("module.nzbget.download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
+        await emit("download.completed", { name: item.name, category: item.category, sizeMB: item.sizeMB });
      }
      seenHistory.add(item.id);
    }
@@ -5,8 +5,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.nzbget.download.added",
-    "module.nzbget.download.completed"
+    "download.added",
+    "download.completed"
  ],
  "consumes": [],
  "own-secrets": {
@@ -31,7 +31,7 @@ async function pollRequests(): Promise<void> {
    const key = keyOf(r);
    const known = approvedState.has(key);
    if (primed && !known) {
-      await emit("module.ombi.request.created", {
+      await emit("request.created", {
        kind: r.kind,
        id: r.id,
        title: r.title,
@@ -41,7 +41,7 @@ async function pollRequests(): Promise<void> {
    }
    // Approval: the flag went from false to true for a request we already knew about.
    if (primed && known && r.approved && approvedState.get(key) === false) {
-      await emit("module.ombi.request.approved", { kind: r.kind, id: r.id, title: r.title, tmdbId: r.tmdbId });
+      await emit("request.approved", { kind: r.kind, id: r.id, title: r.title, tmdbId: r.tmdbId });
    }
    approvedState.set(key, r.approved);
  }
@@ -5,8 +5,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.ombi.request.created",
-    "module.ombi.request.approved"
+    "request.created",
+    "request.approved"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/ombi/broker",
@@ -15,10 +15,10 @@
    }
  },
  "binds": {
-    "route": "/var/lib/only-office/route.json"
+    "route": "${dir:state}/route.json"
  },
  "own-secrets": {
-    "jwt": "/var/lib/only-office/jwt.secret"
+    "jwt": "${dir:state}/jwt.secret"
  },
  "listens": [
    {
@@ -32,56 +32,49 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/only-office",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
      "id": "server-env",
      "type": "file",
-      "path": "/var/lib/only-office/server.env",
+      "path": "${dir:state}/server.env",
      "mode": "0600",
      "content": "JWT_ENABLED=true\nJWT_SECRET=${secret:jwt}\nJWT_HEADER=Authorization\nJWT_IN_BODY=true\nALLOW_PRIVATE_IP_ADDRESS=true\n"
    },
    {
      "id": "logs",
      "type": "directory",
-      "path": "/services/only-office/logs",
      "mode": "0700"
    },
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/only-office/data",
      "mode": "0700"
    },
    {
      "id": "lib",
      "type": "directory",
-      "path": "/services/only-office/lib",
      "mode": "0700"
    },
    {
      "id": "db",
      "type": "directory",
-      "path": "/services/only-office/db",
      "mode": "0700"
    },
    {
      "id": "rabbitmq",
      "type": "directory",
-      "path": "/services/only-office/rabbitmq",
      "mode": "0700"
    },
    {
      "id": "redis",
      "type": "directory",
-      "path": "/services/only-office/redis",
      "mode": "0700"
    },
    {
      "id": "fonts",
      "type": "directory",
-      "path": "/services/only-office/fonts",
      "mode": "0700"
    },
    {
@@ -96,19 +89,19 @@
      "image": "onlyoffice/documentserver@sha256:3ab6ebc7c605e5a32b7ae3ff19daed4925090245acc8100ce2230bd766c88212",
      "network": "only-office",
      "env-file": [
-        "/var/lib/only-office/server.env"
+        "${dir:state}/server.env"
      ],
      "ports": [
-        "80"
+        "9070:80"
      ],
      "volumes": [
-        "/services/only-office/logs:/var/log/onlyoffice",
-        "/services/only-office/data:/var/www/onlyoffice/Data",
-        "/services/only-office/lib:/var/lib/onlyoffice",
-        "/services/only-office/db:/var/lib/postgresql",
-        "/services/only-office/rabbitmq:/var/lib/rabbitmq",
-        "/services/only-office/redis:/var/lib/redis",
-        "/services/only-office/fonts:/usr/share/fonts/truetype/custom"
+        "${dir:logs}:/var/log/onlyoffice",
+        "${dir:data}:/var/www/onlyoffice/Data",
+        "${dir:lib}:/var/lib/onlyoffice",
+        "${dir:db}:/var/lib/postgresql",
+        "${dir:rabbitmq}:/var/lib/rabbitmq",
+        "${dir:redis}:/var/lib/redis",
+        "${dir:fonts}:/usr/share/fonts/truetype/custom"
      ],
      "secrets-in-environment": "run-document-server.sh regenerates JWT_SECRET from the environment on every start and overwrites local.json; not convertible"
    }
@@ -20,7 +20,7 @@ async function pollRecent(): Promise<void> {
  for (const asset of items) {
    if (!seen.has(asset.id)) {
      if (primed) {
-        await emit("module.photos.item.added", {
+        await emit("item.added", {
          id: asset.id,
          fileName: asset.fileName,
          kind: asset.type,
@@ -4,15 +4,15 @@
  "capabilities": [
    "container-runtime"
  ],
+  "emits": [
+    "item.added"
+  ],
  "requires": [
    "s3-bucket",
    "mongodb-database",
    "route"
  ],
  "contributes": {
-    "s3-bucket": {
-      "bucket": "photos"
-    },
    "mongodb-database": {
      "name": "photos"
    },
@@ -56,7 +56,7 @@
      "type": "file",
      "path": "/var/lib/photos/server.env",
      "mode": "0600",
-      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
+      "content": "NODE_ENV=production\nPORT=9000\nMONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=admin\nMONGO_DB=${bound:mongodb-database:as}\nMINIO_ENDPOINT=${bound:s3-bucket:at}\nMINIO_PORT=${bound:s3-bucket:port}\nMINIO_BUCKET=mesh-novox-photos\nMINIO_ACCESSKEY=${bound:s3-bucket:as}\nMINIO_SECRET=${secret:s3-bucket}\nMINIO_USE_SSL=false\n"
    },
    {
      "id": "net",
@@ -24,10 +24,10 @@ async function pollSessions(): Promise<void> {
  const now = new Map(sessions.map((s) => [s.key, s]));
  if (playbackPrimed) {
    for (const [key, s] of now) {
-      if (!active.has(key)) await emit("module.plex.playback.started", { title: s.title, user: s.user, player: s.player, kind: s.type });
+      if (!active.has(key)) await emit("playback.started", { title: s.title, user: s.user, player: s.player, kind: s.type });
    }
    for (const [key, s] of active) {
-      if (!now.has(key)) await emit("module.plex.playback.stopped", { title: s.title, user: s.user, player: s.player });
+      if (!now.has(key)) await emit("playback.stopped", { title: s.title, user: s.user, player: s.player });
    }
  }
  active.clear();
@@ -44,7 +44,7 @@ async function pollRecent(): Promise<void> {
  for (const item of items) {
    const id = `${item.title}@${item.addedAt ?? ""}`;
    if (!seen.has(id)) {
-      if (itemsPrimed) await emit("module.plex.item.added", item);
+      if (itemsPrimed) await emit("item.added", item);
      seen.add(id);
    }
  }
@@ -53,7 +53,7 @@ async function pollRecent(): Promise<void> {

 // A downloader finished somewhere on the mesh: rescan, so what it fetched becomes a visible item
 // rather than a file Plex has not noticed. Idempotent — a rescan too many costs a little disk I/O.
-await on("module.*.download.completed", async () => {
+await on("*.download.completed", async () => {
  await plex.refreshAll();
 });

@@ -5,12 +5,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.plex.playback.started",
-    "module.plex.playback.stopped",
-    "module.plex.item.added"
+    "playback.started",
+    "playback.stopped",
+    "item.added"
  ],
  "consumes": [
-    "module.*.download.completed"
+    "*.download.completed"
  ],
  "own-secrets": {
    "broker": "/var/lib/mesh/plex/broker",
@@ -6,11 +6,17 @@
    "container-runtime"
  ],
  "listens": [
+    {
+      "port": 9090,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
+    },
    {
      "port": 9443,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the container dashboard, over its own tls"
+      "why": "the same dashboard over its own tls; the runtime sidecar talks to it here"
    }
  ],
  "resources": [
@@ -23,19 +29,19 @@
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/portainer/data",
      "mode": "0700"
    },
    {
      "id": "server",
      "type": "container",
      "name": "portainer",
-      "image": "portainer/portainer-ce@sha256:511f3f06c96fe3b993ebeaafde311c1959cae73a7ef825dba6397d51b450dffa",
+      "image": "portainer/portainer-ce@sha256:4d616db18cfeb5dd41a69c0958bc825c84483ea9cde1106eb82a5d26f3bd8b0e",
      "ports": [
-        "9443"
+        "9090:9000",
+        "9443:9443"
      ],
      "volumes": [
-        "/services/portainer/data:/data",
+        "${dir:data}:/data",
        "/var/run/docker.sock:/var/run/docker.sock"
      ]
    },
@@ -90,5 +96,17 @@
        "from": "Dockerfile"
      }
    ]
+  },
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "portainer",
+      "port": 9090
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/portainer/route.json"
  }
 }
@@ -14,11 +14,11 @@ interface DatabaseEvent {
  user?: string;
 }

-await on<DatabaseEvent>("module.postgres.database.provisioned", async (e) => {
+await on<DatabaseEvent>("database.provisioned", async (e) => {
  console.log(`[postgres] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

-await on<DatabaseEvent>("module.postgres.database.deprovisioned", async (e) => {
+await on<DatabaseEvent>("database.deprovisioned", async (e) => {
  console.log(`[postgres] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
 });

@@ -17,12 +17,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.postgres.database.provisioned",
-    "module.postgres.database.deprovisioned"
+    "database.provisioned",
+    "database.deprovisioned"
  ],
  "consumes": [
-    "module.postgres.database.provisioned",
-    "module.postgres.database.deprovisioned"
+    "postgres.database.provisioned",
+    "postgres.database.deprovisioned"
  ],
  "listens": [
    {
@@ -73,7 +73,8 @@
      "id": "store-data",
      "type": "directory",
      "path": "/var/lib/mesh-store",
-      "mode": "0700"
+      "mode": "0700",
+      "owner": "999:70"
    },
    {
      "id": "server",
@@ -34,7 +34,7 @@ runProvisioner("postgres-database", {
    // Database and owning role share the consumer's login, so the consumer owns exactly its own.
    const database = p.as;
    await postgres.createDatabaseAndRole(database, p.as, p.password);
-    await announce("module.postgres.database.provisioned", {
+    await announce("database.provisioned", {
      consumer: p.consumer ?? "",
      database,
      user: p.as,
@@ -43,7 +43,7 @@ runProvisioner("postgres-database", {

  async remove(p: { as: string }): Promise<void> {
    await postgres.dropDatabaseAndRole(p.as, p.as);
-    await announce("module.postgres.database.deprovisioned", { database: p.as });
+    await announce("database.deprovisioned", { database: p.as });
  },
  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
@@ -30,9 +30,9 @@ async function pollTorrents(): Promise<void> {
    for (const [hash, t] of now) {
      const before = progressByHash.get(hash);
      if (before === undefined) {
-        await emit("module.qbittorrent.download.added", { name: t.name, category: t.category, sizeBytes: t.sizeBytes });
+        await emit("download.added", { name: t.name, category: t.category, sizeBytes: t.sizeBytes });
      } else if (before < 1 && t.progress >= 1) {
-        await emit("module.qbittorrent.download.completed", { name: t.name, category: t.category, sizeBytes: t.sizeBytes });
+        await emit("download.completed", { name: t.name, category: t.category, sizeBytes: t.sizeBytes });
      }
    }
  }
@@ -6,8 +6,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.qbittorrent.download.added",
-    "module.qbittorrent.download.completed"
+    "download.added",
+    "download.completed"
  ],
  "consumes": [],
  "own-secrets": {
@@ -40,12 +40,12 @@ async function pollQueue(radarr: RadarrClient): Promise<void> {
  if (primed) {
    // Entered the queue since last look — Radarr grabbed a release.
    for (const [id, item] of now) {
-      if (!inQueue.has(id)) await emit("module.radarr.movie.grabbed", { title: item.title, status: item.status });
+      if (!inQueue.has(id)) await emit("movie.grabbed", { title: item.title, status: item.status });
    }
    // Left the queue — imported and done, unless it was last seen failing.
    for (const [id, item] of inQueue) {
      if (!now.has(id) && !FAILED_STATUSES.has(item.status)) {
-        await emit("module.radarr.download.completed", { title: item.title });
+        await emit("download.completed", { title: item.title });
      }
    }
  }
@@ -5,8 +5,8 @@
    "container-runtime"
  ],
  "emits": [
-    "module.radarr.movie.grabbed",
-    "module.radarr.download.completed"
+    "movie.grabbed",
+    "download.completed"
  ],
  "consumes": [],
  "own-secrets": {
@@ -14,11 +14,11 @@ interface CacheEvent {
  keyspacePrefix?: string;
 }

-await on<CacheEvent>("module.redis.cache.provisioned", async (e) => {
+await on<CacheEvent>("cache.provisioned", async (e) => {
  console.log(`[redis] cache provisioned for ${e.body.consumer} (user ${e.body.username})`);
 });

-await on<CacheEvent>("module.redis.cache.deprovisioned", async (e) => {
+await on<CacheEvent>("cache.deprovisioned", async (e) => {
  console.log(`[redis] cache deprovisioned for ${e.body.consumer} (user ${e.body.username})`);
 });

@@ -14,12 +14,12 @@
    "container-runtime"
  ],
  "emits": [
-    "module.redis.cache.provisioned",
-    "module.redis.cache.deprovisioned"
+    "cache.provisioned",
+    "cache.deprovisioned"
  ],
  "consumes": [
-    "module.redis.cache.provisioned",
-    "module.redis.cache.deprovisioned"
+    "redis.cache.provisioned",
+    "redis.cache.deprovisioned"
  ],
  "serves": {
    "redis-cache": {
--- a/Show More
+++ b/Show More