Name system seats by scope; let a module define its own (ADR 0121)

System seats are mesh-* (one, mesh-wide) or node-* (one per node). Renamed:
the-build-machine -> mesh-build-machine (+scope mesh), the-catalogue ->
mesh-catalog, the-dns-port -> node-dns-resolver, the-intrusion-prevention ->
node-intrusion-prevention, the-packet-filter -> node-packet-filter,
the-resolver-configuration -> node-resolver-config, the-uplink -> node-uplink.
Removed the-showcase from the set — it becomes the first module-defined seat.

A manifest may declare its own seats (DefinesSeats); a claim is a system seat,
a reserved mesh-*/node-* name the mesh does not define (refused), or a
module-defined seat valid only when the manifest declares it.

Deferred: the delivering registry seats (git, npm-package-registry,
the-artifact-store) and the-private-network (a scope + server/client model
change), per ADR 0121.

internal/catalogue/seats_test.go

@@ -44,8 +44,8 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 			delivered[s.Delivers] = s.Name
 		}
 	}
-	if len(Seats()) != 15 {
-		t.Errorf("the mesh defines %d seats rather than 15; the set is closed, so a change here is "+
+	if len(Seats()) != 14 {
+		t.Errorf("the mesh defines %d seats rather than 14; the set is closed, so a change here is "+
 			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
 	}
 }
@@ -56,7 +56,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 // contradicting the mesh; a requirement resolving to it would make the manager the mesh's answer
 // for something, and the manager's link is the one thing the mesh must never be able to break.
 func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
-	seat, known := SeatNamed("the-uplink")
+	seat, known := SeatNamed("node-uplink")
 	if !known {
 		t.Fatalf("the uplink is not a seat; the seats are: %s", seatNames())
 	}
@@ -64,7 +64,7 @@ func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
 		t.Fatalf("the uplink is %+v, not a node seat delivering nothing by ADR 0117", seat)
 	}
 	// And a manager's module can hold it without providing anything.
-	raw := []byte(`{"module":"networkmanager","version":"1","claims":[{"name":"the-uplink","scope":"node"}]}`)
+	raw := []byte(`{"module":"networkmanager","version":"1","claims":[{"name":"node-uplink","scope":"node"}]}`)
 	if _, err := ParseManifest(raw); err != nil {
 		t.Fatalf("a network manager's module could not hold the uplink: %v", err)
 	}
@@ -83,11 +83,31 @@ func TestAClaimOnASeatTheMeshDoesNotDefineIsRefused(t *testing.T) {
 		t.Fatalf("the refusal does not say the seat is unknown: %v", err)
 	}
 	// And it says what the seats are, because "no" without the list sends somebody reading code.
-	if !strings.Contains(err.Error(), "the-packet-filter") {
+	if !strings.Contains(err.Error(), "node-packet-filter") {
 		t.Fatalf("the refusal does not list the seats: %v", err)
 	}
 }
 
+// A module may define its own seat and claim it — the mesh enforces exclusivity without knowing
+// what it means (novox/hq ADR 0121). But it may not define one in the mesh's own namespace.
+func TestAModuleDefinesAndClaimsItsOwnSeat(t *testing.T) {
+	ok := []byte(`{"module":"showcase","version":"1","seats":[{"name":"the-showcase","scope":"node"}],` +
+		`"claims":[{"name":"the-showcase","scope":"node"}]}`)
+	if _, err := ParseManifest(ok); err != nil {
+		t.Fatalf("a module could not define and claim its own seat: %v", err)
+	}
+	// Claiming a name it neither the mesh nor the module defines is still refused.
+	if _, err := ParseManifest(claimed(`[{"name":"the-anything","scope":"node"}]`)); err == nil {
+		t.Fatal("a module claimed a seat nobody defines")
+	}
+	// A module may not carve its seat out of the mesh's own namespace.
+	bad := []byte(`{"module":"x","version":"1","seats":[{"name":"node-mine","scope":"node"}],` +
+		`"claims":[{"name":"node-mine","scope":"node"}]}`)
+	if _, err := ParseManifest(bad); err == nil || !strings.Contains(err.Error(), "own namespace") {
+		t.Fatalf("a module defined a seat in the mesh's namespace and was not refused: %v", err)
+	}
+}
+
 func TestASeatClaimedAtAnotherScopeIsRefused(t *testing.T) {
 	_, err := ParseManifest(claimed(`[{"name":"npm-package-registry","scope":"node"}]`))
 	if err == nil {