Merge pull request 'Make no value for an own secret issued outside the mesh that nobody gave (issue 401)' (#262) from fix/401-an-outside-secret-not-given-is-not-made into main

internal/catalogue/declaration.go

@@ -645,6 +645,11 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				sealed = ForeseenSealed
 				*foreseen = append(*foreseen, m.Module+"/"+name)
 			}
+			if sealed == "" && m.OwnSecrets[name].IssuedBy == IssuedOutside {
+				// **Not given, and the mesh never makes it** (novox/hq issue 401, ADR 0228): no file, as for a
+				// family's member (ADR 0283), so the module reads its absence as not given.
+				continue
+			}
 			if sealed == "" {
 				// Declared and not made. Refused rather than skipped: a module whose own
 				// credential is silently absent starts, fails to authenticate, and the reason is
@@ -1002,7 +1007,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// content is where a setting lands, so a placeholder may only exist once the setting
 			// has been put in — filling secrets first would look at content that is not yet what
 			// the machine receives.
-			if err := intoFile(copied, sealed, m.Module); err != nil {
+			if err := intoFile(copied, sealed, outsideNotGiven(m, with.Needed[m.Module]), m.Module); err != nil {
 				return nil, err
 			}
 			// **Substituted here, not on the machine.** A bound value is not secret — the mesh
@@ -2431,6 +2436,9 @@ func secretsReadBy(resource map[string]any, m Manifest, given map[string]string)
 	}
 	paths := map[string]string{}
 	for name, own := range m.OwnSecrets.Plain() {
+		if own.IssuedBy == IssuedOutside && given[name] == "" {
+			continue // not given, so not placed: nothing to restart on (novox/hq issue 401)
+		}
 		paths[name] = own.Path
 	}
 	for name, sealed := range given {