A file may hold a credential where its content says one belongs

The gap that stopped keycloak and gitea from starting. A granted
credential arrives as a file whose entire content is the password, which
is what a program reading a password file wants — and most programs do
not read one. They read KEY=value, or a JSON document with the token at
an attribute inside it. A module in that position could be handed the
bare value or nothing, and both are useless.

The host has been able to do this all along: content with ${secret:name}
in it, sealed values beside it, substitution on the machine, which is
the only place both halves exist. Nothing filled the values in, so the
hole could be written and never closed and the host refused the file.
That refusal was correct and the feature was unreachable.

A module reaches its own secrets and the credentials it was granted —
both things it wrote in its own manifest — and nothing else. Naming
another module's is refused: two modules on one machine are as separate
as two on different machines, and letting one read the other's
credential by guessing a name would end that to save writing a file.

Filling runs after settings, which is the whole reason it sits where it
does. A setting is how a placeholder gets into a JSON document in the
first place — the desktop client that reads its token from an attribute,
not an environment variable. Before the merge that file's content is
"{}" and asks for nothing.

Tested through Declaration rather than through the helper. Three times
in this repository a test asserted on a helper while the code calling it
was wrong, and each time the injected fault stayed silent. Three faults
injected here — the call removed, the call moved before settings, and
the module boundary widened — each caught by the test meant for it.

internal/catalogue/declaration.go

@@ -302,6 +302,13 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 			resources = withMeshNames(resources, with.Names)
 		}
 
+		// What this module may name from inside one of its own files. Gathered once per module
+		// rather than per file, because it is a fact about the module.
+		sealed, err := sealedFor(m, r.Needs, with)
+		if err != nil {
+			return nil, err
+		}
+
 		for _, unsettled := range resources {
 			resource, err := ApplySettings(unsettled, with.Settings[m.Module])
 			if err != nil {
@@ -311,6 +318,13 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 			for k, v := range resource {
 				copied[k] = v
 			}
+			// **After settings, and that is the whole reason it is here.** A module's file
+			// content is where a setting lands, so a placeholder may only exist once the setting
+			// has been put in — filling secrets first would look at content that is not yet what
+			// the machine receives.
+			if err := intoFile(copied, sealed, m.Module); err != nil {
+				return nil, err
+			}
 			copied["id"] = m.Module + "." + fmt.Sprint(resource["id"])
 			// A service saying what it reflects names resources within its own module, so those
 			// are prefixed too or they would point at nothing.