Refuse a placeholder no pass consumes, so a misspelling never reaches a machine as text (issue 231)

internal/catalogue/environment_into.go

@@ -226,6 +226,9 @@ func (m Manifest) contributionPlaceholderProblems() []string {
 	for _, r := range m.Resources {
 		problems = append(problems, placeholderProblems(m, r)...)
 		problems = append(problems, seatPlaceholderProblems(m, r)...)
+		// And whatever is left once every pass's own placeholders are set aside: a misspelt
+		// namespace, or a key its namespace cannot take (novox/hq issue 231).
+		problems = append(problems, unconsumedPlaceholders(m.Module, r, filledByAPass, nil)...)
 	}
 	return problems
 }
@@ -548,7 +551,13 @@ func shellCode(modules []Manifest, shell, slot string) string {
 // is filled before the shell's code is, and each is replaced in a single pass over what the holder
 // wrote, so a contributed piece is never scanned again.
 func contributionsInto(resource map[string]any, m Manifest, modules []Manifest, facts map[string]string, with Rendering, caps map[string]bool, unplaced *[]string) error {
-	if problems := append(placeholderProblems(m, resource), seatPlaceholderProblems(m, resource)...); len(problems) > 0 {
+	// **The sweep stands here, after every other pass and before any contributed text is placed**
+	// (novox/hq issue 231): what is left that the mesh did not fill would reach the machine as text,
+	// and contributed shell code, placed below, is the shell's and is never swept (ADR 0204). The
+	// same function the catalogue check runs, over what the passes left.
+	problems := append(placeholderProblems(m, resource), seatPlaceholderProblems(m, resource)...)
+	problems = append(problems, unconsumedPlaceholders(m.Module, resource, nil, leftForLater)...)
+	if len(problems) > 0 {
 		return fmt.Errorf("%s", problems[0])
 	}
 	content, ok := resource["content"].(string)