Bring F3 up to its release branch, with both sides' store tests (part 6 of 14)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/catalogue/build.go

@@ -35,6 +35,10 @@ type Built struct {
 	// Launchers are, for a bundle in an interpreted language, the executable the build wrote beside
 	// each entrypoint, by entrypoint (novox/hq ADR 0193): what the node's runtime starts to serve it.
 	Launchers map[string]string
+	// Texts are, for the archive a module packs its templates into (TemplatesArtifact), each file's text as the
+	// build read it back from the packed archive, by its path inside it (novox/hq ADR 0349 §2). Never carried on
+	// the wire or kept: Resolve reads them into the files' content, which is what the mesh holds.
+	Texts map[string]string `json:"-"`
 }
 
 // Resolve fills a manifest's resources in from what was built.
@@ -71,6 +75,26 @@ func (m Manifest) Resolve(built []Built) (Manifest, error) {
 			m.Module, strings.Join(missing, " and "), oneOrOther(len(missing)))
 	}
 
+	// **Each template's text, as the build read it back from its templates archive** (novox/hq ADR 0349 §2): into
+	// the file's content, so what the mesh holds and composes is what the same text inline would be.
+	if m.Templated() {
+		name := TemplatesArtifact(m)
+		texts := by[name].Texts
+		if name == "" || texts == nil {
+			return Manifest{}, fmt.Errorf("%s names templates, and the build carried no text read back from the "+
+				"archive it packs %s/ into (%q): the builder that built it does not read templates",
+				m.Module, TemplatesDir, name)
+		}
+		filled, err := fillTemplates(m.Module, m.Resources, func(template string) (string, bool) {
+			t, ok := texts[strings.TrimPrefix(template, TemplatesDir+"/")]
+			return t, ok
+		}, fmt.Sprintf("the archive %q", name))
+		if err != nil {
+			return Manifest{}, err
+		}
+		m.Resources = filled
+	}
+
 	out := m
 	out.Build = nil
 	out.Resources = nil

internal/catalogue/co_located_test.go

@@ -51,6 +51,15 @@ func stepCA() Manifest {
 	}
 }
 
+// stepCAWithItsRoot is the authority whose root the operator supplies: the served key asks for it as
+// `${setting:root}` (ADR 0155), the only way a setting reaches what a provider serves since a layer
+// stopped replacing a served key (novox/hq issue 696; before it, the empty `root` was replaced whole).
+func stepCAWithItsRoot() Manifest {
+	m := stepCA()
+	m.Serves["acme-ca"]["root"] = "${setting:root}"
+	return m
+}
+
 // routeProxy issues from that authority, so it must be told the root to verify it with.
 func routeProxy() Manifest {
 	return Manifest{
@@ -78,7 +87,7 @@ func routeProxy() Manifest {
 // The consequence is silent and total: route-proxy wrote an empty CA bundle, fell back to the
 // system trust store, could not verify the internal authority, and no certificate was ever issued.
 func TestACoLocatedProvidersServedValuesReachItsConsumer(t *testing.T) {
-	r, err := Resolve(shelf(stepCA(), routeProxy()),
+	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
 		[]string{"step-ca", "route-proxy"}, reachable(), World{})
 	if err != nil {
 		t.Fatal(err)
@@ -106,7 +115,7 @@ func TestACoLocatedProvidersServedValuesReachItsConsumer(t *testing.T) {
 // And the binding file says the same thing, for a consumer that reads the binding rather than a
 // substituted placeholder. The two are one fact and must not be able to disagree.
 func TestACoLocatedConsumersBindingCarriesTheSettledValues(t *testing.T) {
-	r, err := Resolve(shelf(stepCA(), routeProxy()),
+	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
 		[]string{"step-ca", "route-proxy"}, reachable(), World{})
 	if err != nil {
 		t.Fatal(err)
@@ -152,7 +161,7 @@ func TestACoLocatedProviderIsSettledWhicheverWayItWasPulledIn(t *testing.T) {
 		{"step-ca", "route-proxy"},
 		{"route-proxy", "step-ca"},
 	} {
-		r, err := Resolve(shelf(stepCA(), routeProxy()), assigned, reachable(), World{})
+		r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()), assigned, reachable(), World{})
 		if err != nil {
 			t.Fatal(err)
 		}