Model access is a provision answered by a record, not a machine

novox/hq ADR 0024, gaps 1 and 2. The user's stated requirement, and the first
thing here that no machine can answer: a hosted model is on nobody's node and
is reached over the public internet, so the rule that refuses two ends sharing
no private network must not apply to it.

A licence is a named thing and the name is the operator's — *the personal
account*, *the organisation's* — because the whole point is saying which one a
given consumer uses, and an anonymous credential hanging off a provider cannot
be said. Many to many, so deliberately not a claim: two machines sharing an
account is ordinary rather than a collision.

Gap 2 is the missing verb, *accept*: take a value somebody supplied, seal it to
each holder, discard the plaintext. With the consequence stated rather than
hidden — a holder recorded after the key was supplied has no key and the mesh
cannot make one, so it is refused by name with the remedy, not silently handed
an empty file.

Refusal is felt, as the record warns: a mesh holding three ways to reach a
model refuses every consumer that has not chosen. So the refusal names the
candidates and the exact command. Being right is not the same as being usable.

Gaps 3 and 4 — a consumer that is not a machine, and switching as a reaction
rather than a declaration — remain gaps. Half-building them would put a
conditional in the declaration language, which is what ADR 0024 says plainly to
avoid.

Its own context, with its own store and its own credential: a licence is a
different aggregate from anything inventory owns, and it refers to nodes by
name because that is what crossing a context boundary may carry.

internal/catalogue/declaration.go

@@ -157,6 +157,17 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 					found = &r.Needs[i]
 				}
 			}
+			if found != nil && found.ByRecord && found.Sealed == "" {
+				// Answered by a record whose key has not been supplied since this consumer was
+				// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
+				// key was accepted and cannot seal another, so a machine that resolved cleanly
+				// would receive no file at all and fail at whatever tried to read it — which is
+				// the outcome ADR 0024 exists to avoid, arrived at politely.
+				return nil, fmt.Errorf(
+					"%s on this machine uses the licence %q and no key has been sealed to it. "+
+						"The mesh cannot make one; supply it again with `licence key %s`",
+					m.Module, found.From, found.From)
+			}
 			if found == nil || found.Sealed == "" {
 				// Answered on this machine, or answered by a node the mesh could not seal to.
 				// Nothing to write either way, and writing an empty credential file would be
@@ -408,11 +419,17 @@ func sortedKeys[V any](m map[string]V) []string {
 // says so rather than leaving a reader to wonder whether one was meant to be there — a missing
 // field looks like a bug, and a stated absence looks like a boundary.
 func boundFile(n Needed, path string) (map[string]any, error) {
+	// A record has no machine and no address. Saying so is the difference between a reader
+	// concluding "somewhere with no address" and concluding the mesh failed to fill something in.
+	where := any(n.At)
+	if n.ByRecord {
+		where = "a record in this mesh, not a machine"
+	}
 	body, err := json.MarshalIndent(map[string]any{
 		"binding":   1,
 		"provision": n.Name,
 		"from":      n.From,
-		"at":        n.At,
+		"at":        where,
 		"serves":    n.Serves,
 		"generated": "by the mesh — do not edit; replaced whenever this changes. " +
 			"It carries no credential: the mesh has no way to issue one yet",