Judge a definition's resolved paths where the definition is judged, by the node-engine's own rules, so a refusal never freezes a machine (review of #228, issue 496)

internal/catalogue/dir_into.go

@@ -257,10 +257,7 @@ func dirInto(resource map[string]any, dirs map[string]string, module string) err
 		}
 		resource["env-file"] = filled
 	}
-	// **Placed, then judged** (novox/hq issue 496): the path a directory or file resolves to — the default
-	// layout, a place, a stated path, one beneath a ${dir:…} — is judged here, where every plan and the merge
-	// gate compose it, so a module whose directory lands in Docker's data is refused before it reaches a machine.
-	return judgeResolved(resource, module)
+	return nil
 }
 
 // unknownDirRefs is every ${dir:…} in the definition that names no directory the definition

internal/catalogue/engine_guard_test.go

@@ -0,0 +1,71 @@
+package catalogue
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/beside"
+)
+
+// The controller refuses a definition's resolved path by the node-engine's own rules, no more (novox/hq issue
+// 496): the same lists, read here from mesh-host's internal/apply/placement_guard.go — in a merge check the clone
+// beside it at the commit the mesh runs, elsewhere the copy captured in testdata/beside. When the engine's lists
+// move, this fails until the controller's move with them, so the gate never refuses what the engine applies nor
+// passes what it refuses by path alone.
+func TestTheResolvedPathRulesAreTheNodeEnginesOwn(t *testing.T) {
+	file := filepath.Join(beside.Dir(t, "mesh-host"), "internal", "apply", "placement_guard.go")
+	parsed, err := parser.ParseFile(token.NewFileSet(), file, nil, 0)
+	if err != nil {
+		t.Fatalf("the node-engine's guard does not parse: %v", err)
+	}
+	lists := map[string][]string{}
+	consts := map[string]string{}
+	ast.Inspect(parsed, func(n ast.Node) bool {
+		spec, ok := n.(*ast.ValueSpec)
+		if !ok {
+			return true
+		}
+		for i, name := range spec.Names {
+			if i >= len(spec.Values) {
+				continue
+			}
+			switch v := spec.Values[i].(type) {
+			case *ast.CompositeLit:
+				for _, elt := range v.Elts {
+					if lit, ok := elt.(*ast.BasicLit); ok && lit.Kind == token.STRING {
+						s, _ := strconv.Unquote(lit.Value)
+						lists[name.Name] = append(lists[name.Name], s)
+					}
+				}
+			case *ast.BasicLit:
+				if v.Kind == token.STRING {
+					consts[name.Name], _ = strconv.Unquote(v.Value)
+				}
+			}
+		}
+		return true
+	})
+	for name, ours := range map[string][]string{
+		"protectedRoots": protectedRoots, "forbiddenBelow": forbiddenBelow, "engineTrees": engineTrees,
+	} {
+		theirs := lists[name]
+		if len(theirs) == 0 {
+			t.Errorf("the node-engine's guard names no %s any more; read it and say where its rule went", name)
+			continue
+		}
+		a, b := slices.Clone(ours), slices.Clone(theirs)
+		slices.Sort(a)
+		slices.Sort(b)
+		if !slices.Equal(a, b) {
+			t.Errorf("%s differs from the node-engine's:\n controller %v\n node-engine %v", name, a, b)
+		}
+	}
+	if consts["engineModule"] != engineModule {
+		t.Errorf("the node-engine's own module is %q there and %q here", consts["engineModule"], engineModule)
+	}
+}

internal/catalogue/manifest.go

@@ -2138,6 +2138,7 @@ func ParseManifest(raw []byte) (Manifest, error) {
 	problems = append(problems, m.undeclaredMounts()...)
 	problems = append(problems, m.unknownDirRefs()...)
 	problems = append(problems, m.unknownAccessRefs()...)
+	problems = append(problems, m.resolvedPathProblems()...)
 	problems = append(problems, m.jailProblems()...)
 	// What a module adds to the account's environment and to the login shell, and the holder's
 	// placeholders for them (novox/hq ADR 0203, ADR 0204) — here, so the catalogue check refuses

internal/catalogue/placement.go

@@ -92,79 +92,103 @@ func systemPath(path string) string {
 	return ""
 }
 
-// Where no directory or file the controller resolves for a module may be, from any route (novox/hq issue 496).
+// Where no directory or file a module's definition resolves to may be (novox/hq issue 496).
 //
-// mesh-catalog #205 gave docker's `state` directory `"place": "."`, which resolves to <root>/docker: /var/lib/docker,
-// every container's filesystem. systemPath judged only the `places` and `accesses` settings, so the default layout
-// and a definition's own paths reached the merge gate unjudged; it composed every machine and passed, and only the
-// node-engine refused the directory, at apply, failing the walk. So every path a directory or file resolves to is
-// judged where the plan is composed, which is also where the gate composes.
+// mesh-catalog #205 gave docker's `state` directory `"place": "."`, which resolves to <root>/docker: with the
+// default root, /var/lib/docker, every container's filesystem. systemPath judged only the `places` and `accesses`
+// settings, so the default layout and a definition's own paths reached the merge gate unjudged; it composed every
+// machine and passed, and only the node-engine refused the directory, at apply, failing the walk.
 //
-// Not by systemPath's whole list: a module writes the machine's configuration in /etc and /usr by design (units,
-// jails, a launcher), keeps run directories in /run, an account's keys in its .ssh, and the mesh places its own files
-// for every module in /var/lib/mesh. Those are the node-engine's to judge with what only the machine knows (owners,
-// links, where the runtimes really keep their data). Refused here is what no module ever writes, whoever owns it:
-// the trees in neverWritten, the node-engine's own trees but by its own module, and a path that is one of the
-// machine's roots or holds one. Each is refused by the node-engine too (its placement guard, issue 339), so nothing
-// that applies today is refused here.
+// **Judged where a definition is judged, never where a machine is composed.** resolvedPathProblems runs in
+// ParseManifest, which every route a definition takes into the mesh passes: `module check`, registration of a
+// build (the builder's and the registry verbs'), and the merge gate's reading of the changed repository. A
+// refusal there stops one definition before it reaches any machine. Composition reads registered manifests
+// without ParseManifest, and judges nothing of this: refusing there would fail the whole machine's declaration and
+// freeze every module on it for one module's path, where the node-engine fails only that resource.
+//
+// **The node-engine's rules, no more** (mesh-host's internal/apply/placement_guard.go, with files judged as
+// directories are after novox/hq issue 495, rule 6). A path is refused when it is one of protectedRoots or holds
+// one, when it is at or below a tree in forbiddenBelow, or at or below one of engineTrees and its module is not
+// the node-engine's. What the engine judges with what only the machine knows stays the engine's: where the
+// runtimes really keep their data, links, the accounts' homes, a directory's owner below /etc. The lists are the
+// engine's own words, and a test (engine_guard_test.go) holds them equal to mesh-host's beside this repository.
+// systemPath stays the stricter rule for a setting: a setting is an operator's word about one machine, and the
+// trees it lists (/etc, /usr, /run, the mesh's own) are where the mesh's own modules write by design.
 var (
-	neverWritten = []string{"/boot", "/root", "/proc", "/sys", "/dev", "/bin", "/sbin", "/lib", "/lib32", "/lib64",
-		"/var/spool", "/var/lib/docker", "/var/lib/containers", "/var/lib/containerd", "/opt"}
+	protectedRoots = []string{"/", "/bin", "/boot", "/dev", "/etc", "/home", "/lib", "/lib32", "/lib64",
+		"/media", "/mnt", "/opt", "/proc", "/root", "/run", "/sbin", "/srv", "/sys", "/tmp", "/usr", "/usr/bin",
+		"/usr/lib", "/usr/lib64", "/usr/local", "/usr/local/bin", "/usr/local/lib", "/usr/local/sbin", "/usr/sbin",
+		"/usr/share", "/var", "/var/cache", "/var/lib", "/var/lib/mesh", "/var/log", "/var/run", "/var/tmp",
+		"/var/spool"}
+	forbiddenBelow = []string{"/proc", "/sys", "/dev", "/boot", "/root", "/var/spool", "/opt", "/var/lib/docker",
+		"/var/lib/containers", "/var/lib/containerd"}
 	engineTrees = []string{"/var/lib/mesh-host", "/usr/lib/nox-mesh-host"}
-	// engineModule is the node-engine's own module, the one that places in engineTrees.
-	engineModule = "mesh-host"
-	// usrRoots are the roots below /usr that hold every program and library: never a module's directory itself.
-	usrRoots = []string{"/usr/bin", "/usr/lib", "/usr/lib64", "/usr/local", "/usr/local/bin", "/usr/local/lib",
-		"/usr/local/sbin", "/usr/sbin", "/usr/share"}
 )
 
-// resolvedSystemPath says why a path resolved for one of module's directories or files is the machine's own, or "".
-func resolvedSystemPath(path, module string) string {
-	if !strings.HasPrefix(path, "/") {
+// engineModule is the node-engine's own module, the one that places in engineTrees.
+const engineModule = "mesh-host"
+
+// enginePath says why the node-engine refuses a directory or file at path for module, or "".
+func enginePath(path, module string) string {
+	path = filepath.Clean(path)
+	if !filepath.IsAbs(path) {
 		return ""
 	}
-	path = filepath.Clean(path)
-	in := func(tree string) bool { return path == tree || strings.HasPrefix(path, tree+"/") }
-	for _, tree := range neverWritten {
-		if in(tree) {
-			return path + " is in " + tree + ", which no module writes in"
+	atOrBelow := func(tree string) bool { return path == tree || strings.HasPrefix(path, tree+"/") }
+	for _, root := range protectedRoots {
+		if path == root || path == "/" || strings.HasPrefix(root, path+"/") {
+			return root + " is one of the machine's own directories, and owning it is owning everything in it"
+		}
+	}
+	for _, tree := range forbiddenBelow {
+		if atOrBelow(tree) {
+			return "nothing is placed in " + tree
 		}
 	}
 	if module != engineModule {
 		for _, tree := range engineTrees {
-			if in(tree) {
-				return path + " is in " + tree + ", the node-engine's own, which only its module places in"
+			if atOrBelow(tree) {
+				return tree + " is the node-engine's own, placed in by its own module alone"
 			}
 		}
 	}
-	for _, roots := range [][]string{systemRoots, systemTrees, usrRoots} {
-		for _, root := range roots {
-			if path == root {
-				return path + " is one of the machine's roots, the parent of everything in it"
-			}
-		}
-	}
-	for _, tree := range append(append([]string(nil), systemTrees...), neverWritten...) {
-		if strings.HasPrefix(tree, path+"/") {
-			return path + " holds " + tree + ", the machine's own or the mesh's state"
-		}
-	}
 	return ""
 }
 
-// judgeResolved refuses a directory or file whose resolved path resolvedSystemPath refuses (novox/hq issue 496).
-func judgeResolved(resource map[string]any, module string) error {
-	kind := fmt.Sprint(resource["type"])
-	if kind != "directory" && kind != "file" {
-		return nil
+// resolvedPathProblems is every directory and file of the definition whose path, resolved as a node with the
+// default root resolves it, the node-engine would refuse (novox/hq issue 496). A path still holding a placeholder
+// only a machine fills (a setting, an access the definition gives no default) is the engine's to judge.
+func (m Manifest) resolvedPathProblems() []string {
+	dirs := dirsFor(m, Rendering{})
+	accesses := map[string]string{}
+	for _, a := range m.Accesses {
+		if a.ID != "" && a.Path != "" {
+			accesses[a.ID] = a.Path
+		}
 	}
-	path, _ := resource["path"].(string)
-	if why := resolvedSystemPath(path, module); why != "" {
-		return fmt.Errorf("%s's %s %q resolves to %s: %s. The node-engine refuses it at apply, so it is refused "+
-			"where the plan is composed, and the merge gate with it (novox/hq issue 496)",
-			module, kind, fmt.Sprint(resource["id"]), filepath.Clean(path), why)
+	var problems []string
+	for _, r := range m.Resources {
+		kind := fmt.Sprint(r["type"])
+		if kind != "directory" && kind != "file" {
+			continue
+		}
+		id := fmt.Sprint(r["id"])
+		path, _ := r["path"].(string)
+		if kind == "directory" && path == "" {
+			path = dirs[id]
+		}
+		path, _ = dirFill(path, dirs, m.Module)
+		path, _ = accessFill(path, accesses, m.Module)
+		if path == "" || strings.Contains(path, "${") {
+			continue
+		}
+		if why := enginePath(path, m.Module); why != "" {
+			problems = append(problems, fmt.Sprintf("%s's %s %q resolves to %s, which the node-engine refuses: %s. "+
+				"A module's directories and files are judged when its definition is, so the merge gate refuses it "+
+				"before any machine does (novox/hq issue 496)", m.Module, kind, id, filepath.Clean(path), why))
+		}
 	}
-	return nil
+	return problems
 }
 
 // accessRef is how a module names one of its accesses: ${access:<id>}.
@@ -359,10 +383,6 @@ func accessInto(resource map[string]any, accesses map[string]string, module stri
 		if resource["path"], err = fill(path); err != nil {
 			return err
 		}
-		// Judged again once the access is in it: dirInto judged it while it still named one (novox/hq issue 496).
-		if err := judgeResolved(resource, module); err != nil {
-			return err
-		}
 	}
 	if content, ok := resource["content"].(string); ok {
 		if resource["content"], err = fill(content); err != nil {

internal/catalogue/resolved_path_test.go

@@ -1,39 +1,22 @@
 package catalogue
 
-// Every path the controller resolves for a module's directories and files is judged where the plan is
-// composed (novox/hq issue 496). mesh-catalog #205 gave docker's `state` directory `"place": "."`, which
-// resolves to <root>/docker — /var/lib/docker, every container's filesystem. The merge gate composed every
-// machine and passed it; only the node-engine refused it, at apply, and failed the walk. The gate composes
-// through Declaration, so a refusal here is a refusal at the gate, for every module.
+// A definition's directories and files are judged at their resolved paths when the definition is (novox/hq issue
+// 496). mesh-catalog #205 gave docker's `state` directory `"place": "."`, which resolves to <root>/docker —
+// /var/lib/docker, every container's filesystem. The merge gate composed every machine and passed it; only the
+// node-engine refused it, at apply, and failed the walk. ParseManifest is what `module check`, registration and the
+// merge gate's reading of a changed repository all run, so a refusal here is a refusal at each of them.
 
 import (
 	"strings"
 	"testing"
 )
 
-func composedOn(m Manifest, with Rendering) ([]map[string]any, error) {
-	return Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(with)
-}
-
-func pathOf(t *testing.T, resources []map[string]any, id string) string {
-	t.Helper()
-	for _, r := range resources {
-		if r["id"] == id {
-			return r["path"].(string)
-		}
-	}
-	t.Fatalf("no resource %s in %v", id, resources)
-	return ""
-}
-
-func TestADirectoryPlacedInDockersDataIsRefusedAtComposition(t *testing.T) {
+func TestADirectoryPlacedInDockersDataIsRefusedWhereTheDefinitionIsJudged(t *testing.T) {
 	// The #205 shape, as it was merged.
-	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
-		{"id": "state", "type": "directory", "place": "."},
-	}}
-	_, err := composedOn(m, Rendering{})
+	_, err := ParseManifest([]byte(`{"module": "docker", "version": "1",
+		"resources": [{"id": "state", "type": "directory", "place": "."}]}`))
 	if err == nil {
-		t.Fatal("a directory resolving to /var/lib/docker composed; the node-engine refuses it at apply")
+		t.Fatal("a directory resolving to /var/lib/docker was accepted; the node-engine refuses it at apply")
 	}
 	for _, said := range []string{"docker", `"state"`, "/var/lib/docker", "issue 496"} {
 		if !strings.Contains(err.Error(), said) {
@@ -42,68 +25,103 @@ func TestADirectoryPlacedInDockersDataIsRefusedAtComposition(t *testing.T) {
 	}
 }
 
-func TestTheMeshsPlaceForDockerComposes(t *testing.T) {
+func TestTheMeshsPlaceForDockerIsAccepted(t *testing.T) {
 	// The fix #205 needed: the mesh's own directory for the module, <root>/mesh/docker.
-	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
+	m, err := ParseManifest([]byte(`{"module": "docker", "version": "1", "resources": [
 		{"id": "state", "type": "directory", "place": "mesh"},
-		{"id": "marker", "type": "file", "path": "${dir:state}/applied", "content": "x"},
-	}}
-	resources, err := composedOn(m, Rendering{})
+		{"id": "marker", "type": "file", "path": "${dir:state}/applied", "content": "x"}]}`))
 	if err != nil {
-		t.Fatalf("place %q is the mesh's tree, which the mesh writes for every module: %v", "mesh", err)
+		t.Fatalf("place %q is in the mesh's tree, where the mesh writes for every module: %v", "mesh", err)
 	}
-	if got := pathOf(t, resources, "docker.state"); got != "/var/lib/mesh/docker" {
-		t.Fatalf("got %q", got)
+	if got := dirsFor(m, Rendering{}); got["state"] != "/var/lib/mesh/docker" {
+		t.Fatalf("got %v", got)
 	}
 }
 
-func TestEveryResolvedPathIsJudged(t *testing.T) {
-	refused := map[string]Manifest{
-		"a default directory under a data root inside containerd's data": {Module: "images", Version: "1",
-			Resources: []map[string]any{{"id": "cache", "type": "directory"}}},
-		"a stated directory in docker's data": {Module: "sidecar", Version: "1",
-			Resources: []map[string]any{{"id": "volumes", "type": "directory", "path": "/var/lib/docker/volumes/x"}}},
-		"a file beneath a placed directory that climbs out of it": {Module: "docker", Version: "1",
-			Resources: []map[string]any{{"id": "state", "type": "directory", "place": "mesh"},
-				{"id": "f", "type": "file", "path": "${dir:state}/../../containers/x", "content": "x"}}},
-		"a file in /boot": {Module: "grub", Version: "1",
-			Resources: []map[string]any{{"id": "cfg", "type": "file", "path": "/boot/grub/custom.cfg", "content": "x"}}},
-		"a directory that is the data root itself": {Module: "lib", Version: "1",
-			Resources: []map[string]any{{"id": "all", "type": "directory", "place": "."}}},
-		"a directory in the node-engine's own tree, by another module": {Module: "intruder", Version: "1",
-			Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/var/lib/mesh-host/x"}}},
+// The node-engine's rules, for directories and — as the engine judges them since novox/hq issue 495 — files.
+func TestADefinitionIsRefusedWhereTheNodeEngineRefusesItsPaths(t *testing.T) {
+	refused := map[string]string{
+		"a stated directory in docker's data": `{"module": "sidecar", "version": "1", "resources": [
+			{"id": "volumes", "type": "directory", "path": "/var/lib/docker/volumes/x"}]}`,
+		"a file in containerd's data": `{"module": "images", "version": "1", "resources": [
+			{"id": "f", "type": "file", "path": "/var/lib/containerd/x", "content": "x"}]}`,
+		"a file beneath a placed directory that climbs out of it": `{"module": "docker", "version": "1", "resources": [
+			{"id": "state", "type": "directory", "place": "mesh"},
+			{"id": "f", "type": "file", "path": "${dir:state}/../../containers/x", "content": "x"}]}`,
+		"a file in /boot": `{"module": "grub", "version": "1", "resources": [
+			{"id": "cfg", "type": "file", "path": "/boot/grub/custom.cfg", "content": "x"}]}`,
+		"a directory that is the mesh's whole tree": `{"module": "mesh", "version": "1", "resources": [
+			{"id": "all", "type": "directory", "place": "."}]}`,
+		"a directory that holds /etc": `{"module": "x", "version": "1", "resources": [
+			{"id": "d", "type": "directory", "path": "/"}]}`,
+		"a directory in the node-engine's own tree, by another module": `{"module": "intruder", "version": "1",
+			"resources": [{"id": "d", "type": "directory", "path": "/var/lib/mesh-host/x"}]}`,
 	}
-	roots := map[string]Rendering{
-		"a default directory under a data root inside containerd's data": {DataRoot: "/var/lib/containerd"},
-		"a directory that is the data root itself":                       {DataRoot: "/var"},
-	}
-	for name, m := range refused {
-		if _, err := composedOn(m, roots[name]); err == nil || !strings.Contains(err.Error(), "issue 496") {
-			t.Errorf("%s: composed or refused for another reason: %v", name, err)
+	for name, raw := range refused {
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "issue 496") {
+			t.Errorf("%s: accepted, or refused for another reason: %v", name, err)
 		}
 	}
 
-	// What the mesh's own modules place today, on every machine (read from each machine's live plan): the
-	// machine's configuration, the mesh's tree, the node-engine's own, run directories and an account's keys.
-	passes := map[string]Manifest{
-		"a unit in /etc": {Module: "power", Version: "1",
-			Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/etc/systemd/system/x.service.d"},
-				{"id": "u", "type": "file", "path": "/etc/systemd/system/x.service.d/a.conf", "content": "x"}}},
-		"a run directory": {Module: "fail2ban", Version: "1",
-			Resources: []map[string]any{{"id": "run-dir", "type": "directory", "path": "/var/run/fail2ban"}}},
-		"a program in /usr/local": {Module: "claude-code", Version: "1",
-			Resources: []map[string]any{{"id": "start", "type": "file", "path": "/usr/local/bin/claude-agent", "content": "x"}}},
-		"the node-engine's launcher, by the node-engine": {Module: "mesh-host", Version: "1",
-			Resources: []map[string]any{{"id": "launcher", "type": "file", "path": "/usr/lib/nox-mesh-host/launch", "content": "x"}}},
-		"an account's .ssh": {Module: "ssh-client", Version: "1",
-			Resources: []map[string]any{{"id": "ssh-dir", "type": "directory", "path": "/home/someone/.ssh"},
-				{"id": "config", "type": "file", "path": "/home/someone/.ssh/config", "content": "x"}}},
-		"a module's own root": {Module: "mailu", Version: "1",
-			Resources: []map[string]any{{"id": "state", "type": "directory", "place": "."}}},
+	// What the engine applies, the mesh's own modules' paths among them (read from every machine's live plan):
+	// the machine's configuration, run directories, programs below /usr/local, the node-engine's own trees by its
+	// own module, an account's keys, a module's own root, and — not on the engine's lists, so not refused here —
+	// below /lib and at /storage, /data, /services and /var/lock.
+	accepted := map[string]string{
+		"a unit in /etc": `{"module": "power", "version": "1", "resources": [
+			{"id": "d", "type": "directory", "path": "/etc/systemd/system/x.service.d"},
+			{"id": "u", "type": "file", "path": "/etc/systemd/system/x.service.d/a.conf", "content": "x"}]}`,
+		"a run directory": `{"module": "fail2ban", "version": "1", "resources": [
+			{"id": "run-dir", "type": "directory", "path": "/var/run/fail2ban"}]}`,
+		"a program in /usr/local/bin": `{"module": "claude-code", "version": "1", "resources": [
+			{"id": "start", "type": "file", "path": "/usr/local/bin/claude-agent", "content": "x"}]}`,
+		"the node-engine's launcher and state, by the node-engine": `{"module": "mesh-host", "version": "1", "resources": [
+			{"id": "launcher", "type": "file", "path": "/usr/lib/nox-mesh-host/launch", "content": "x"},
+			{"id": "state", "type": "directory", "path": "/var/lib/mesh-host"}]}`,
+		"an account's .ssh": `{"module": "ssh-client", "version": "1", "resources": [
+			{"id": "ssh-dir", "type": "directory", "path": "/home/someone/.ssh"},
+			{"id": "config", "type": "file", "path": "/home/someone/.ssh/config", "content": "x"}]}`,
+		"a module's own root": `{"module": "mailu", "version": "1", "resources": [
+			{"id": "state", "type": "directory", "place": "."}]}`,
+		"a file below /lib": `{"module": "udev", "version": "1", "resources": [
+			{"id": "rule", "type": "file", "path": "/lib/udev/rules.d/99-x.rules", "content": "x"}]}`,
+		"directories at /storage, /data, /services and /var/lock": `{"module": "roots", "version": "1", "resources": [
+			{"id": "a", "type": "directory", "path": "/storage"}, {"id": "b", "type": "directory", "path": "/data"},
+			{"id": "c", "type": "directory", "path": "/services"}, {"id": "d", "type": "directory", "path": "/var/lock"}]}`,
 	}
-	for name, m := range passes {
-		if _, err := composedOn(m, Rendering{}); err != nil {
+	for name, raw := range accepted {
+		if _, err := ParseManifest([]byte(raw)); err != nil {
 			t.Errorf("%s: refused: %v", name, err)
 		}
 	}
 }
+
+func TestAPathThroughAnAccessIsJudgedWithTheAccessFilledIn(t *testing.T) {
+	// A file's path may name an access; the access's default path is the definition's, so it is judged with it.
+	_, err := ParseManifest([]byte(`{"module": "backup", "version": "1",
+		"accesses": [{"id": "images", "path": "/var/lib/docker/volumes"}],
+		"resources": [{"id": "marker", "type": "file", "path": "${access:images}/marker", "content": "x"}]}`))
+	if err == nil || !strings.Contains(err.Error(), "/var/lib/docker/volumes/marker") ||
+		!strings.Contains(err.Error(), "issue 496") {
+		t.Fatalf("a file reaching Docker's data through an access's default path was accepted: %v", err)
+	}
+	// An access the definition gives no path is placed by a setting, which Places and AccessPlaces judge, and on
+	// the machine by the node-engine: nothing here to resolve it against, so nothing is refused for it.
+	if _, err := ParseManifest([]byte(`{"module": "backup", "version": "1",
+		"accesses": [{"id": "images"}],
+		"resources": [{"id": "marker", "type": "file", "path": "${access:images}/marker", "content": "x"}]}`)); err != nil {
+		t.Fatalf("an access placed only by a setting cannot be judged at the definition: %v", err)
+	}
+}
+
+func TestComposingAMachineIsNeverStoppedByOneModulesPath(t *testing.T) {
+	// A module registered from outside the catalogue never passes the gate. Refusing its path while a machine's
+	// declaration is composed would fail the whole declaration and freeze every module on that machine; the
+	// node-engine fails only the one resource. So composition leaves it to the engine.
+	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
+		{"id": "state", "type": "directory", "place": "."},
+	}}
+	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{m}}).Declaration(Rendering{}); err != nil {
+		t.Fatalf("the machine's declaration failed for one module's path: %v", err)
+	}
+}