Merge main: the trunk renamed the seats and made them data

Both branches changed the seat set from the same starting point, so every number
collided and every `mesh-*` name existed twice. The trunk's numbers and names win:
this branch's records became 0129/0130 and its migrations 0037/0038, and the
hardcoded rename map gave way to the trunk's `seat_alias` table — a rename is a
row now (ADR 0122), not a recompile.

Three of my checks were wrong and the merge is what showed it:

A seat with an empty protocol is a marker, not an incomplete declaration. Most
node-scoped seats are markers — which module is this machine's packet filter —
and refusing one refused most of the set, the showcase module included. A
mistyped field name is already refused by the parser, so an empty protocol was
written as one deliberately.

A claim on a seat this manifest does not declare is not the parser's to judge. A
module may hold a seat another module declared; that is the whole reason ADR 0126
has callers name the seat and not its provider. Whether the seat exists is a fact
about the catalogue, so the refusal is at registration, where every declaration
is in view.

And a seat may share a name with the provision it delivers. `git`, the npm
registry and the artifact store still do, because renaming a delivering seat
cascades to every consumer requiring it, with a window where a holder stops
resolving mid-flight. The trunk deferred exactly those three on purpose.

Full suite green against a real NATS and store.

internal/catalogue/seats_test.go

@@ -50,6 +50,26 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
 	}
 }
 
+// novox/hq ADR 0117: a machine's uplink is a seat, held per machine, and delivers nothing.
+//
+// **Nothing, because nothing may be required of it.** A holder only keeps its network manager from
+// contradicting the mesh; a requirement resolving to it would make the manager the mesh's answer
+// for something, and the manager's link is the one thing the mesh must never be able to break.
+func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
+	seat, known := SeatNamed("node-uplink")
+	if !known {
+		t.Fatalf("the uplink is not a seat; the seats are: %s", seatNames())
+	}
+	if seat.Scope != ScopeNode || seat.Delivers != "" || seat.Decision != "novox/hq ADR 0117" {
+		t.Fatalf("the uplink is %+v, not a node seat delivering nothing by ADR 0117", seat)
+	}
+	// And a manager's module can hold it without providing anything.
+	raw := []byte(`{"module":"networkmanager","version":"1","claims":[{"name":"node-uplink","scope":"node"}]}`)
+	if _, err := ParseManifest(raw); err != nil {
+		t.Fatalf("a network manager's module could not hold the uplink: %v", err)
+	}
+}
+
 func claimed(claims string) []byte {
 	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh"}],"claims":` + claims + `}`)
 }
@@ -83,7 +103,7 @@ func TestAClaimOnASeatAnotherModuleDeclaresIsAccepted(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	declarer := Manifest{Module: "someone", Seats: []SeatDeclaration{
+	declarer := Manifest{Module: "someone", DefinesSeats: []SeatDeclaration{
 		{Name: "the-anything", Scope: ScopeNode, Accepts: []string{"work"}},
 	}}
 	if problems := CatalogueProblems(Shelf{claimant.Module: claimant, "someone": declarer}); len(problems) != 0 {
@@ -91,8 +111,35 @@ func TestAClaimOnASeatAnotherModuleDeclaresIsAccepted(t *testing.T) {
 	}
 }
 
+// A module may define its own seat and claim it — the mesh enforces exclusivity without knowing
+// what it means (novox/hq ADR 0121). But it may not define one in the mesh's own namespace.
+func TestAModuleDefinesAndClaimsItsOwnSeat(t *testing.T) {
+	ok := []byte(`{"module":"showcase","version":"1","seats":[{"name":"the-showcase","scope":"node"}],` +
+		`"claims":[{"name":"the-showcase","scope":"node"}]}`)
+	if _, err := ParseManifest(ok); err != nil {
+		t.Fatalf("a module could not define and claim its own seat: %v", err)
+	}
+	// Claiming a name nobody defines is still refused — but **at registration, not here**: with
+	// seats declared by modules, a claim on a seat *another* module declares is good, and the
+	// parser cannot tell that from an invented name. See
+	// TestAClaimOnASeatNobodyDeclaresIsRefusedAtRegistration.
+	claimant, err := ParseManifest(claimed(`[{"name":"the-anything","scope":"node"}]`))
+	if err != nil {
+		t.Fatalf("the parser judged a claim it cannot judge alone: %v", err)
+	}
+	if len(CatalogueProblems(Shelf{claimant.Module: claimant})) == 0 {
+		t.Fatal("a module claimed a seat nobody defines")
+	}
+	// A module may not carve its seat out of the mesh's own namespace.
+	bad := []byte(`{"module":"x","version":"1","seats":[{"name":"node-mine","scope":"node"}],` +
+		`"claims":[{"name":"node-mine","scope":"node"}]}`)
+	if _, err := ParseManifest(bad); err == nil || !strings.Contains(err.Error(), "own namespace") {
+		t.Fatalf("a module defined a seat in the mesh's namespace and was not refused: %v", err)
+	}
+}
+
 func TestASeatClaimedAtAnotherScopeIsRefused(t *testing.T) {
-	_, err := ParseManifest(claimed(`[{"name":"mesh-npm-package-registry","scope":"node"}]`))
+	_, err := ParseManifest(claimed(`[{"name":"npm-package-registry","scope":"node"}]`))
 	if err == nil {
 		t.Fatal("a mesh seat was held per node")
 	}
@@ -104,7 +151,7 @@ func TestASeatClaimedAtAnotherScopeIsRefused(t *testing.T) {
 func TestADeliveringSeatIsOnlyHeldByAModuleThatProvides(t *testing.T) {
 	// Holding it makes the module the mesh's answer for the provision. A module that cannot answer
 	// would be the answer anyway, and every consumer would be sent to it.
-	raw := []byte(`{"module":"thing","version":"1","claims":[{"name":"mesh-git","scope":"mesh"}]}`)
+	raw := []byte(`{"module":"thing","version":"1","claims":[{"name":"git","scope":"mesh"}]}`)
 	_, err := ParseManifest(raw)
 	if err == nil {
 		t.Fatal("a module holding the git seat need not provide git")
@@ -163,7 +210,7 @@ func TestEveryManifestInUseClaimsASeatTheMeshDefines(t *testing.T) {
 func registryShelf() map[string]Manifest {
 	return shelf(
 		Manifest{Module: "gitea", Version: "1", Provides: FromAnywhere("npm-package-registry"),
-			Claims: []Claim{{Name: "mesh-npm-package-registry", Scope: ScopeMesh}}},
+			Claims: []Claim{{Name: "npm-package-registry", Scope: ScopeMesh}}},
 		Manifest{Module: "verdaccio", Version: "1", Provides: FromAnywhere("npm-package-registry")},
 		Manifest{Module: "builder", Version: "1", Requires: []string{"npm-package-registry"}},
 	)
@@ -177,7 +224,7 @@ func twoRegistries() map[string][]Provider {
 }
 
 func giteaHoldsTheSeat() []Held {
-	return []Held{{Claim: "mesh-npm-package-registry", Scope: ScopeMesh, Node: "anchor", Module: "gitea"}}
+	return []Held{{Claim: "npm-package-registry", Scope: ScopeMesh, Node: "anchor", Module: "gitea"}}
 }
 
 func TestTheSeatsHolderAnswersWhenSeveralProvide(t *testing.T) {
@@ -229,3 +276,43 @@ func TestTheHolderIsTheModuleNotTheMachine(t *testing.T) {
 		t.Fatalf("the holder was not told apart from a neighbour: %+v", holder)
 	}
 }
+
+// The working set is loaded from the store, and an empty load never erases it (novox/hq ADR 0122).
+func TestUseSeatsReplacesTheSetButNeverEmptiesIt(t *testing.T) {
+	before := Seats()
+	defer UseSeats(DefaultSeats()) // restore for other tests, whatever this leaves it as
+
+	// An empty load (store not seeded, or unreadable) leaves the compiled defaults in force.
+	UseSeats(nil)
+	if len(Seats()) != len(before) {
+		t.Fatalf("an empty load changed the set from %d to %d seats", len(before), len(Seats()))
+	}
+	// A non-empty load replaces it — this is how a rename in the store reaches the lookups.
+	UseSeats([]Seat{{Name: "node-firewall", Scope: ScopeNode, Decision: "novox/hq ADR 0122"}})
+	if _, known := SeatNamed("node-firewall"); !known {
+		t.Fatal("the loaded set did not replace the working set")
+	}
+	if len(Seats()) != 1 {
+		t.Fatalf("the working set is %d seats, not the one that was loaded", len(Seats()))
+	}
+}
+
+// A former name resolves to the seat it was renamed from (novox/hq ADR 0122), so a manifest's claim
+// and a held record naming the old name break nothing after a rename.
+func TestAFormerNameResolvesAfterARename(t *testing.T) {
+	defer func() { UseSeats(DefaultSeats()); UseAliases(nil) }()
+	UseSeats([]Seat{{Name: "git", Scope: ScopeMesh, Delivers: "git", Decision: "novox/hq ADR 0121"}})
+	UseAliases(map[string]string{"git": "git"})
+
+	// The old name resolves to the renamed seat.
+	if s, ok := SeatNamed("git"); !ok || s.Name != "git" {
+		t.Fatalf("the former name did not resolve to the renamed seat: %+v ok=%v", s, ok)
+	}
+	// And a holder recorded under the old name is still found for the provision the seat delivers.
+	providers := []Provider{{Node: "anchor", At: "anchor.internal", Module: "gitea"}}
+	held := []Held{{Claim: "git", Scope: ScopeMesh, Node: "anchor", Module: "gitea"}}
+	holder, found := HolderAmong("git", providers, held)
+	if !found || holder.Module != "gitea" {
+		t.Fatalf("the holder recorded under the former name was not matched: %+v found=%v", holder, found)
+	}
+}