A consumer is a module on a machine, not a machine

novox/hq 04-ISSUES/022. A credential was keyed by provision, consumer
node and provider node, so "who is asking" was answered by naming a
host. The node this mesh exists to take over runs eight modules against
one database server.

The symptom had two halves and only one was loud. The provider refused,
naming the modules and explaining they would share one credential, which
reads as a decision rather than a limit. The consumer did not refuse: it
resolved cleanly, wrote one module's credential file and left the others
absent — a service that starts and cannot authenticate, with nothing
saying why. That is 021 again on a different axis.

Three modules wanting one database produced one need, carrying whichever
module mentioned it first, because the resolution walk is a work-list
over names. The fan-out now happens in one place, after the walk. The
record path already did this correctly and said why: a consumer here is
a module on a machine. It is the same rule.

Downstream: the secret's key gains the consuming module, the grant file
is named after both halves, needs are matched by provision and module
rather than provision alone, and the provisioners name the role and the
access key after the module. The refusal in ContributionsTo is gone
because there is nothing left to refuse.

Worth stating plainly: without that refusal, gitea's login would have
opened keycloak's database. From the provisioner's side it created
exactly what it was asked to create.

Existing secrets are discarded rather than backfilled. They cannot say
which module they were for, and a secret is remade and delivered to both
ends on the next push — so this costs one rotation and invents nothing.

Also guards the role name against PostgreSQL's 63-byte truncation, which
is a notice rather than an error and would reintroduce exactly this
collision at a length nobody tests.

Three faults injected — the fan-out removed, needs matched by name
alone, the grant file named after the machine — each caught.

internal/catalogue/resolve.go

@@ -388,6 +388,18 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 		}
 	}
 
+	// One need per module that wants it, rather than one per name (novox/hq 04-ISSUES/022).
+	//
+	// **A consumer is a module on a machine, not a machine.** The walk above is a work-list over
+	// names, so a requirement three modules share is visited once and produced one need, carrying
+	// whichever module happened to mention it first. Everything downstream inherited that: one
+	// credential, named after a node, and the other two consumers given nothing at all — a
+	// service that resolves cleanly and then cannot authenticate, which is the exact shape of
+	// 021.
+	//
+	// The record pass below already gets this right and says so. It is the same rule.
+	needs = perConsumer(needs, order, catalogue)
+
 	// What is answered by a record rather than by a machine.
 	//
 	// A post-pass, deliberately: nothing about it depends on the order requirements were walked
@@ -664,3 +676,38 @@ func providersFirst(order []string, shelf map[string]Manifest) []string {
 	}
 	return out
 }
+
+// perConsumer turns one need per provision into one need per module that wants it.
+//
+// Order follows the resolved modules rather than a map, so the same set always produces the same
+// needs — a declaration whose contents move for no reason makes every push look like a change.
+//
+// A need nothing in the set wants is kept as it is rather than dropped. That should not happen;
+// if it does, the honest outcome is an extra credential nobody reads, not a consumer silently
+// losing the one it depends on.
+func perConsumer(needs []Needed, order []string, catalogue map[string]Manifest) []Needed {
+	out := make([]Needed, 0, len(needs))
+	for _, n := range needs {
+		var wanted bool
+		for _, name := range order {
+			m, known := catalogue[name]
+			if !known {
+				continue
+			}
+			for _, want := range m.Wants() {
+				if want != n.Name {
+					continue
+				}
+				copied := n
+				copied.For = m.Module
+				out = append(out, copied)
+				wanted = true
+				break
+			}
+		}
+		if !wanted {
+			out = append(out, n)
+		}
+	}
+	return out
+}