A take acts on the preview it showed; a setting is judged where it is stored; a kept network and a minted secret are said (hq ADR 0163)

take ends its preview with a digest and --yes names it, as the flip does; a
changed preview or an account older than the flip allows is refused. A module
the machine holds nothing for has nothing to compare, and --yes suffices. A
published port's reach is said as the machine reported it. Every secret the
module holds on the machine is listed with where it came from, and one the
mesh minted for a service whose data was found refuses unless --mint names it.

One judgement of a module's settings against its definition, in the catalogue:
settings set refuses what cannot compose or reaches nothing, naming node,
module, layer and key; Compose leaves out a module whose definition moved
under a stored setting, the envelope says so (left_out), plan and push say it
by name, and the machine is told everything else. A stray setting no longer
refuses the whole machine where it is read (issue 096).

The per-machine setting networks keeps a found network for a taken container,
on an adopted machine only; the container's declaration carries it and the
preview names it (rule 4).

internal/catalogue/declaration.go

@@ -244,12 +244,31 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 type Composed struct {
 	Resources []map[string]any
 	Owner     map[string]string
+	// LeftOut is every module of this machine's set that was left out of its declaration, and
+	// why (novox/hq ADR 0163, rule 6): a setting stored for it that its definition can no longer
+	// compose. Its held things are kept and its containers untouched — the machine is told so —
+	// and it is told everything else.
+	LeftOut map[string]string
+}
+
+// LeftOut is which of this machine's modules a declaration composed with these settings leaves
+// out, and why (novox/hq ADR 0163, rule 6): each whose stored settings its definition can no longer
+// compose. Empty when every module composes. The same judgement SetSettings makes before storing.
+func (r Resolution) LeftOut(settings SettingsBy, adopted bool) map[string]string {
+	out := map[string]string{}
+	for _, m := range r.Modules {
+		if err := JudgeSettings(m, settings[m.Module], adopted); err != nil {
+			out[m.Module] = err.Error()
+		}
+	}
+	return out
 }
 
 // Compose is Declaration with the owner of every resource said.
 func (r Resolution) Compose(with Rendering) (Composed, error) {
 	owner := map[string]string{}
-	resources, err := r.compose(with, owner)
+	leftOut := map[string]string{}
+	resources, err := r.compose(with, owner, leftOut)
 	if err != nil {
 		return Composed{}, err
 	}
@@ -261,7 +280,7 @@ func (r Resolution) Compose(with Rendering) (Composed, error) {
 			"sealed": with.BusMembership, "mode": "0600",
 		})
 	}
-	return Composed{Resources: resources, Owner: owner}, nil
+	return Composed{Resources: resources, Owner: owner, LeftOut: leftOut}, nil
 }
 
 // BusMembershipID names the resource carrying a machine's membership for the new bus, and
@@ -270,7 +289,25 @@ func BusMembershipID() string { return "bus-membership" }
 
 const BusMembershipPath = "/var/lib/mesh/membership-next.json"
 
-func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[string]any, error) {
+func (r Resolution) compose(with Rendering, owner map[string]string, leftOut map[string]string) ([]map[string]any, error) {
+	// **A setting is judged where it is stored, and an impossible one costs a module, not a
+	// machine** (novox/hq ADR 0163, rule 6). A definition that moved under a stored setting makes
+	// this module uncomposable; it is left out of the declaration — its held things kept, its
+	// containers untouched, the machine told so by name — and the machine is told everything else.
+	// Before placing, because a placement is a setting too.
+	left := r.LeftOut(with.Settings, with.Adopted)
+	kept := make([]Manifest, 0, len(r.Modules))
+	for _, m := range r.Modules {
+		if why, isLeft := left[m.Module]; isLeft {
+			if leftOut != nil {
+				leftOut[m.Module] = why
+			}
+			continue
+		}
+		kept = append(kept, m)
+	}
+	r.Modules = kept
+
 	// Every manifest is placed first (novox/hq ADR 0112): the maps naming where its bindings,
 	// credentials and contributions land are resolved against this node's directories, so every
 	// reader below — the binding files, the sealed secrets, the grant paths a contribution
@@ -693,6 +730,10 @@ func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[stri
 		// Which of this module's resources its preparation runs before, if it prepares anything.
 		prepareBefore := preparationTarget(m)
 
+		// Which found networks this machine's setting keeps for each of its containers (novox/hq
+		// ADR 0163, rule 4); judged above, so an invalid one is not here.
+		keptNetworks, _ := KeptNetworks(m, with.Settings[m.Module], with.Adopted)
+
 		for _, unsettled := range resources {
 			resource, err := ApplySettings(unsettled, with.Settings[m.Module])
 			if err != nil {
@@ -702,6 +743,16 @@ func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[stri
 			for k, v := range resource {
 				copied[k] = v
 			}
+			if networks, keeps := keptNetworks[fmt.Sprint(copied["id"])]; keeps {
+				// The container also joins the found network the setting names, so a neighbour
+				// that resolves it there keeps resolving it. Passed to the host as its own field,
+				// which it joins after the container is made.
+				joins := make([]any, 0, len(networks))
+				for _, n := range networks {
+					joins = append(joins, n)
+				}
+				copied["networks"] = joins
+			}
 			if err := refuseSecretsInEnvironment(copied, secretFiles, m.Module); err != nil {
 				return nil, err
 			}
@@ -947,8 +998,15 @@ func (r Resolution) filtersHere() string {
 // computed for this machine, and each module's per-node exposure. The same answer whether the node
 // is adopted or converged — the one loads it as a filter, the other declares it as openings.
 func (r Resolution) Rules(with Rendering) ([]Rule, error) {
+	// A module whose settings cannot compose is left out of the declaration (novox/hq ADR 0163,
+	// rule 6), and out of the filter with it: nothing of it is declared, so nothing of it is let
+	// through.
+	left := r.LeftOut(with.Settings, with.Adopted)
 	exposure := map[string]map[int]string{}
 	for _, m := range r.Modules {
+		if _, isLeft := left[m.Module]; isLeft {
+			continue
+		}
 		e, err := Exposure(m, with.Settings[m.Module])
 		if err != nil {
 			return nil, err

internal/catalogue/placement_test.go

@@ -75,17 +75,26 @@ func TestAnAssignmentPlacesDirectoriesAndAccesses(t *testing.T) {
 }
 
 // An access declared by id and placed by nobody resolves to nowhere, and that is refused with the
-// setting to write — not mounted as the literal, not skipped.
+// setting to write — not mounted as the literal, not skipped. The refusal costs the module its
+// place in the declaration, not the machine its declaration (novox/hq ADR 0163, rule 6).
 func TestAnUnplacedAccessIsRefusedByName(t *testing.T) {
 	got, err := Resolve(shelf(placeable()), []string{"arr"}, workstation(), World{})
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, err = got.Declaration(placedBy(map[string]any{
+	with := placedBy(map[string]any{
 		AccessesSetting: map[string]any{"series": "/storage/media/series"},
-	}))
-	if err == nil || !strings.Contains(err.Error(), `"spool"`) || !strings.Contains(err.Error(), AccessesSetting) {
-		t.Fatalf("an access nobody placed was not refused by name: %v", err)
+	})
+	composed, err := got.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	why := composed.LeftOut["arr"]
+	if why == "" || !strings.Contains(why, `"spool"`) || !strings.Contains(why, AccessesSetting) {
+		t.Fatalf("an access nobody placed was not refused by name: %v", composed.LeftOut)
+	}
+	if _, declared := byID(composed.Resources)["arr.server"]; declared {
+		t.Fatal("the module with the unplaced access was declared anyway")
 	}
 }
 

internal/catalogue/settings.go

@@ -3,6 +3,7 @@ package catalogue
 import (
 	"encoding/json"
 	"fmt"
+	"regexp"
 	"sort"
 	"strings"
 )
@@ -275,6 +276,11 @@ func UnusedSettings(m Manifest, layers []Layer) []string {
 			if key == AccessesSetting && len(m.Accesses) > 0 {
 				continue
 			}
+			// `networks` keeps a found network for a taken container on one adopted machine
+			// (novox/hq ADR 0163). Validated in KeptNetworks, so not stray.
+			if key == NetworksSetting {
+				continue
+			}
 			unused = append(unused, fmt.Sprintf(
 				"%s sets %q, and %s has no file that merges it, asks for no ${setting:%s}, and "+
 					"declares no %q in what it contributes or serves",
@@ -298,3 +304,125 @@ func stringsOf(v any) []string {
 	}
 	return out
 }
+
+// NetworksSetting is the settings key that keeps a found network for a taken container, on one
+// adopted machine (novox/hq ADR 0163, rule 4):
+//
+//	{"networks": {"server": ["predecessor_default"]}}
+//
+// has the module's container `server` also join `predecessor_default` once taken, so a neighbour
+// that resolves it by name on that network keeps resolving it. Migration scaffolding in the sense
+// of ADR 0104: assigned only on an adopted machine, reported while it stands, removed when the
+// neighbours are taken. Keyed by the container's resource id; the value is the networks it keeps.
+const NetworksSetting = "networks"
+
+// KeptNetworks reads which found networks each of a module's containers keeps, by container id.
+//
+// Refused from a mesh-wide layer — a found network is a fact about one machine — for an id the
+// module declares no container under, for a name that is not a network's, and on a machine that
+// is not adopted: the setting exists so neighbours the mesh has not taken yet keep reaching the
+// container, and a converged machine has no such neighbours.
+func KeptNetworks(m Manifest, layers []Layer, adopted bool) (map[string][]string, error) {
+	containers := map[string]bool{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "container" {
+			containers[fmt.Sprint(r["id"])] = true
+		}
+	}
+	out := map[string][]string{}
+	for _, layer := range layers {
+		raw, ok := layer.Values[NetworksSetting]
+		if !ok {
+			continue
+		}
+		if layer.From == MeshWideLayer {
+			return nil, fmt.Errorf("%s: %s is given per node — a found network is a fact about one "+
+				"machine; set it with --node", m.Module, NetworksSetting)
+		}
+		if !adopted {
+			return nil, fmt.Errorf("%s: %s keeps a found network for neighbours the mesh has not taken "+
+				"yet, and %s is converged — nothing on it is found; clear the setting", m.Module,
+				NetworksSetting, layer.From)
+		}
+		blocks, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { container: [network, …] } map, and %q set it to "+
+				"something else", m.Module, NetworksSetting, layer.From)
+		}
+		for id, body := range blocks {
+			if !containers[id] {
+				return nil, fmt.Errorf("%s: %s names the container %q, which it does not declare — "+
+					"the setting reaches nothing; it declares %s", m.Module, NetworksSetting, id,
+					orNothing(sortedKeys(containers)))
+			}
+			names := stringsOf(body)
+			if len(names) == 0 {
+				return nil, fmt.Errorf("%s: %s for %q is a list of network names, and %q set it to %v",
+					m.Module, NetworksSetting, id, layer.From, body)
+			}
+			for _, n := range names {
+				if !networkName.MatchString(n) {
+					return nil, fmt.Errorf("%s: %s for %q names %q, which is not a network name",
+						m.Module, NetworksSetting, id, n)
+				}
+			}
+			sort.Strings(names)
+			out[id] = names
+		}
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// networkName is what a container runtime accepts as a network's name.
+var networkName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`)
+
+// JudgeSettings composes a module's settings against its definition and refuses the first thing
+// that cannot work, naming the module, the layer and the key (novox/hq ADR 0163, rule 6).
+//
+// **The same judgement where a setting is stored and where a machine is declared.** Stored, a
+// setting that cannot compose is refused before it is kept; composed later, a definition that has
+// moved under a stored setting leaves that module out of the machine's declaration rather than
+// the machine without one. Every reader of settings runs here: a port given, an exposure, a reach,
+// an endpoint, a placement, an access, a kept network, a mergeable file's keys and a file's
+// `${setting:…}`. A key that reaches nothing is not here: it cannot break a composition, so it is
+// refused where it is stored (SetSettings, with UnusedSettings) and said where a plan is read,
+// and never costs a module its place.
+func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
+	// With no layers too: a definition may ask for a setting nobody made — an access placed by
+	// nobody, a file's ${setting:…} nothing sets — and that is the same statement, missing.
+	if _, err := GivenPorts(m, layers); err != nil {
+		return err
+	}
+	if _, err := Reaches(m, layers); err != nil {
+		return err
+	}
+	if _, err := Endpoints(m, layers); err != nil {
+		return err
+	}
+	if _, err := Places(m, layers); err != nil {
+		return err
+	}
+	if _, _, err := accessesFor(m, layers); err != nil {
+		return err
+	}
+	if _, err := KeptNetworks(m, layers, adopted); err != nil {
+		return err
+	}
+	for _, r := range m.Resources {
+		settled, err := ApplySettings(r, layers)
+		if err != nil {
+			return err
+		}
+		copied := map[string]any{}
+		for k, v := range settled {
+			copied[k] = v
+		}
+		if err := settingInto(copied, layers, m.Module); err != nil {
+			return err
+		}
+	}
+	return nil
+}

internal/catalogue/settings_judge_test.go

@@ -0,0 +1,127 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A setting is judged where it is stored, and an impossible one costs a module, not a machine
+// (novox/hq ADR 0163, rule 6): the one judgement, used by SetSettings before storing and by
+// Compose when a definition has moved under a stored setting.
+func TestASettingThatCannotComposeIsRefusedByNameAndLeavesOnlyItsModuleOut(t *testing.T) {
+	web := Manifest{Module: "hello-web",
+		Listens: []Listening{{Port: 8080, From: FromEverywhere}},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
+			"ports": []any{"8080"}}}}
+	for _, c := range []struct {
+		name   string
+		layer  map[string]any
+		refuse string
+	}{
+		{"a port the module does not publish", map[string]any{PortsSetting: map[string]any{"9999": 10000}},
+			"hello-web gives port 9999 a machine port, and no container of its publishes 9999"},
+		{"a mesh-wide port", map[string]any{PortsSetting: map[string]any{"8080": 10000}},
+			"a port is a fact about one machine"},
+	} {
+		from := "anchor"
+		if c.name == "a mesh-wide port" {
+			from = MeshWideLayer
+		}
+		err := JudgeSettings(web, []Layer{{From: from, Values: c.layer}}, true)
+		if err == nil || !strings.Contains(err.Error(), c.refuse) {
+			t.Errorf("%s: judged %v, want %q", c.name, err, c.refuse)
+		}
+	}
+	if err := JudgeSettings(web, []Layer{{From: "anchor", Values: map[string]any{PortsSetting: map[string]any{"8080": 10000}}}}, true); err != nil {
+		t.Fatalf("a port the module publishes was refused: %v", err)
+	}
+
+	// Composed, a module whose stored setting no longer works is left out by name; the rest of
+	// the machine is declared.
+	r := anAdoptedAnchor()
+	with := anchorRendering(false)
+	with.Settings = SettingsBy{"hello-web": {{From: "anchor", Values: map[string]any{PortsSetting: map[string]any{"9999": 10000}}}}}
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	why, left := composed.LeftOut["hello-web"]
+	if !left || !strings.Contains(why, "no container of its publishes 9999") {
+		t.Fatalf("hello-web is not left out by name: %v", composed.LeftOut)
+	}
+	if len(composed.LeftOut) != 1 {
+		t.Fatalf("more than hello-web is left out: %v", composed.LeftOut)
+	}
+	got := byID(composed.Resources)
+	if _, declared := got["hello-web.server"]; declared {
+		t.Fatal("the left-out module's container is still declared")
+	}
+	if _, declared := got["distribution.store"]; !declared {
+		t.Fatal("the rest of the machine was not declared")
+	}
+	if left := r.LeftOut(with.Settings, false); len(left) != 1 || left["hello-web"] == "" {
+		t.Fatalf("the judgement a plan reads differs from what compose did: %v", left)
+	}
+}
+
+// A taken container keeps a found network by a per-machine setting (novox/hq ADR 0163, rule 4):
+// on an adopted machine only, for a container the module declares, and it reaches the container's
+// declaration as the networks it also joins.
+func TestAKeptNetworkReachesTheContainerOnAnAdoptedMachineOnly(t *testing.T) {
+	r := anAdoptedAnchor()
+	keep := SettingsBy{"hello-web": {{From: "anchor",
+		Values: map[string]any{NetworksSetting: map[string]any{"server": []any{"predecessor_default"}}}}}}
+
+	with := anchorRendering(true)
+	with.Settings = keep
+	composed, err := r.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(composed.LeftOut) != 0 {
+		t.Fatalf("a kept network left a module out: %v", composed.LeftOut)
+	}
+	server := byID(composed.Resources)["hello-web.server"]
+	networks, _ := server["networks"].([]any)
+	if len(networks) != 1 || networks[0] != "predecessor_default" {
+		t.Fatalf("the container does not join the kept network: %v", server)
+	}
+	if _, has := byID(composed.Resources)["distribution.store"]["networks"]; has {
+		t.Fatal("another container joins a network nobody kept for it")
+	}
+
+	// Converged, the setting reaches nothing it was for, and the module is left out saying so.
+	with = anchorRendering(false)
+	with.Settings = keep
+	composed, err = r.Compose(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why := composed.LeftOut["hello-web"]; !strings.Contains(why, "anchor is converged") {
+		t.Fatalf("a kept network on a converged machine: %v", composed.LeftOut)
+	}
+
+	web := r.Modules[4]
+	for _, c := range []struct {
+		name  string
+		layer Layer
+		want  string
+	}{
+		{"mesh-wide", Layer{From: MeshWideLayer, Values: map[string]any{NetworksSetting: map[string]any{"server": []any{"x"}}}},
+			"a found network is a fact about one machine"},
+		{"an unknown container", Layer{From: "anchor", Values: map[string]any{NetworksSetting: map[string]any{"db": []any{"x"}}}},
+			`names the container "db", which it does not declare`},
+		{"not a list", Layer{From: "anchor", Values: map[string]any{NetworksSetting: map[string]any{"server": "x"}}},
+			"is a list of network names"},
+		{"not a network name", Layer{From: "anchor", Values: map[string]any{NetworksSetting: map[string]any{"server": []any{"a/b"}}}},
+			"which is not a network name"},
+	} {
+		_, err := KeptNetworks(web, []Layer{c.layer}, true)
+		if err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: %v, want %q", c.name, err, c.want)
+		}
+	}
+	if kept, err := KeptNetworks(web, nil, false); err != nil || kept != nil {
+		t.Fatalf("no setting: %v %v", kept, err)
+	}
+}

internal/inventory/catalogue.go

@@ -605,6 +605,12 @@ func (i *Inventory) SetSettings(ctx context.Context, nodeName, module string, va
 	if err != nil {
 		return err
 	}
+	// Judged here, against the module's current definition, before it is kept (novox/hq ADR 0163,
+	// rule 6): a setting that cannot compose is refused where it is set, naming the node, the
+	// module, the layer and the key — never stored to refuse the whole machine where it is read.
+	if err := i.judgeSettings(ctx, nodeName, module, values); err != nil {
+		return err
+	}
 	if nodeName == "" {
 		// A port is a fact about one machine (novox/hq ADR 0100). Refused here, in composition's
 		// words: stored, it refuses every node running the module at composition, and the mesh
@@ -661,6 +667,50 @@ func (i *Inventory) SetSettings(ctx context.Context, nodeName, module string, va
 	return tx.Commit(ctx)
 }
 
+// judgeSettings composes a layer somebody is about to store against the module's definition, with
+// the mesh-wide layer under it when the layer is one node's, and refuses the first thing that
+// cannot work (ADR 0163, rule 6). The same judgement composition makes; what passes here composes.
+func (i *Inventory) judgeSettings(ctx context.Context, nodeName, module string, values map[string]any) error {
+	m, err := i.declared(ctx, module)
+	if err != nil {
+		return fmt.Errorf("%w: %s", ErrNoSuchModule, module)
+	}
+	where, from := "the mesh", catalogue.MeshWideLayer
+	adopted := false
+	var layers []catalogue.Layer
+	if nodeName != "" {
+		node, err := i.NodeByName(ctx, nodeName)
+		if err != nil {
+			return err
+		}
+		where, from, adopted = nodeName, nodeName, node.Adopted
+		var meshWide []byte
+		err = i.store.Pool().QueryRow(ctx,
+			`select values from settings where module = $1 and node is null`, module).Scan(&meshWide)
+		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+			return err
+		}
+		if len(meshWide) > 0 {
+			var under map[string]any
+			if err := json.Unmarshal(meshWide, &under); err != nil {
+				return err
+			}
+			layers = append(layers, catalogue.Layer{From: catalogue.MeshWideLayer, Values: under})
+		}
+	}
+	layers = append(layers, catalogue.Layer{From: from, Values: values})
+	if err := catalogue.JudgeSettings(m, layers, adopted); err != nil {
+		return fmt.Errorf("refused: %s on %s cannot compose with the layer %q — %w", module, where, from, err)
+	}
+	// And a key that reaches nothing, refused here where somebody can still fix the spelling:
+	// stored, it would be a setting somebody believes they made.
+	if stray := catalogue.UnusedSettings(m, layers[len(layers)-1:]); len(stray) > 0 {
+		return fmt.Errorf("refused: %s on %s — these settings reach nothing:\n  - %s", module, where,
+			strings.Join(stray, "\n  - "))
+	}
+	return nil
+}
+
 // givenIn is the machine ports a node-level settings layer gives a module, software port →
 // machine port (novox/hq ADR 0100). Nothing when the layer gives none; what is not a port is left
 // for composition to refuse in its own words.

internal/inventory/forget_test.go

@@ -31,8 +31,11 @@ func TestRegisteringAModuleAgainKeepsWhatTheMeshHoldsForIt(t *testing.T) {
 	if err := inv.RecordSealingKey(ctx, node.ID, key); err != nil {
 		t.Fatal(err)
 	}
+	// A mergeable file, so any setting composes (novox/hq ADR 0163, rule 6: a setting is judged
+	// where it is stored).
 	m := catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: catalogue.Offers("acme-ca"), OwnSecrets: catalogue.OwnSecrets{"password": {Path: "/run/password"}}}
+		Provides: catalogue.Offers("acme-ca"), OwnSecrets: catalogue.OwnSecrets{"password": {Path: "/run/password"}},
+		Resources: []map[string]any{{"id": "conf", "type": "file", "path": "/etc/step-ca.json", "content": "{}", "merge": "json"}}}
 	if err := inv.RegisterModule(ctx, m, Source{}); err != nil {
 		t.Fatal(err)
 	}
@@ -229,5 +232,9 @@ func TestAModuleStillAssignedRefusesBeforeAnythingAboutWhatItHolds(t *testing.T)
 // declares (novox/hq 04-ISSUES/078).
 func withOwnSecret(m catalogue.Manifest, name string) catalogue.Manifest {
 	m.OwnSecrets = catalogue.OwnSecrets{name: {Path: "/run/" + name}}
+	// And a mergeable file, so any setting these tests store composes (novox/hq ADR 0163, rule 6:
+	// a setting is judged where it is stored).
+	m.Resources = append(m.Resources, map[string]any{"id": "conf", "type": "file",
+		"path": "/etc/" + m.Module + ".json", "content": "{}", "merge": "json"})
 	return m
 }

internal/inventory/ports_test.go

@@ -15,9 +15,16 @@ func aNodeWithModules(t *testing.T, modules ...string) (*Inventory, string) {
 	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
 		t.Fatal(err)
 	}
+	// Each publishes the port these tests give it a machine port for: a port given for one the
+	// module does not publish is refused where it is stored (novox/hq ADR 0163, rule 6).
+	publishes := map[string]string{"postgres": "5432", "another-database": "5432", "cache": "6379", "web": "8080"}
 	for _, m := range modules {
-		if err := inv.RegisterModule(ctx,
-			catalogue.Manifest{Module: m, Version: "1"}, Source{}); err != nil {
+		manifest := catalogue.Manifest{Module: m, Version: "1"}
+		if port, known := publishes[m]; known {
+			manifest.Resources = []map[string]any{{"id": "server", "type": "container", "name": m,
+				"image": "x", "ports": []any{port}}}
+		}
+		if err := inv.RegisterModule(ctx, manifest, Source{}); err != nil {
 			t.Fatal(err)
 		}
 	}

internal/inventory/secrets.go

@@ -820,3 +820,52 @@ func (i *Inventory) SharedHolders(ctx context.Context, provider, providerModule,
 	sort.Strings(out)
 	return out, nil
 }
+
+// SecretState is one secret a module holds on a machine, as a take compares it (novox/hq ADR
+// 0163): its name, where it came from — made by the mesh or accepted from a person — and, for a
+// credential the module requires from a provider, which node provides it and the local name it
+// goes by where the module keeps several.
+type SecretState struct {
+	Name string
+	// Local is the credential's name inside the module (ADR 0094); empty for an own secret or the
+	// ordinary one.
+	Local string
+	// Origin is OriginMade or OriginAccepted.
+	Origin string
+	// Provider is the node providing a required secret; empty for the module's own.
+	Provider string
+}
+
+// Own says the secret is the module's own rather than one it requires from a provider.
+func (s SecretState) Own() bool { return s.Provider == "" }
+
+// SecretsOf is every secret a module holds on a machine: its own, and each credential it requires
+// from a provider — with where each value came from. What a take reads to refuse minting over a
+// service that already has one (ADR 0163, rule 2).
+func (i *Inventory) SecretsOf(ctx context.Context, node, module string) ([]SecretState, error) {
+	record, err := i.NodeByName(ctx, node)
+	if err != nil {
+		return nil, err
+	}
+	rows, err := i.store.Pool().Query(ctx,
+		`select name, '' as local, origin, '' as provider from module_secret
+		  where node = $1 and module = $2
+		 union all
+		 select s.name, s.local, s.origin, p.name from secret s
+		   join node p on p.id = s.provider
+		  where s.consumer = $1 and s.consumer_module = $2
+		 order by 4, 1, 2`, record.ID, module)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []SecretState
+	for rows.Next() {
+		var s SecretState
+		if err := rows.Scan(&s.Name, &s.Local, &s.Origin, &s.Provider); err != nil {
+			return nil, err
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}

internal/inventory/secrets_test.go

@@ -934,3 +934,47 @@ func TestASharedCredentialIsOneValueSealedToEveryHolder(t *testing.T) {
 		t.Fatalf("a consumer binding after an acceptance must be refused with the way out: %v", err)
 	}
 }
+
+// SecretsOf is every secret a module holds on a machine with where each came from — what a take
+// reads to refuse minting over a service that already has a value (novox/hq ADR 0163, rule 2).
+func TestSecretsOfSaysEachSecretsOriginAndProvider(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "forge", Version: "1",
+		Requires:   []string{"secret", "postgres-database"},
+		Secrets:    map[string]string{"secret": "/run/secret", "postgres-database": "/run/pg"},
+		OwnSecrets: catalogue.OwnSecrets{"admin": {Path: "/run/admin"}}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.SecretForModule(ctx, "consumer", "forge", "admin"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.SecretFor(ctx, "postgres-database", "consumer", "forge", "provider", ""); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.AcceptSecretForPair(ctx, "secret", "consumer", "forge", "provider", "", "hunter2"); err != nil {
+		t.Fatal(err)
+	}
+	got, err := inv.SecretsOf(ctx, "consumer", "forge")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []SecretState{
+		{Name: "admin", Origin: OriginMade},
+		{Name: "postgres-database", Origin: OriginMade, Provider: "provider"},
+		{Name: "secret", Origin: OriginAccepted, Provider: "provider"},
+	}
+	if len(got) != len(want) {
+		t.Fatalf("got %+v", got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("secret %d: got %+v, want %+v", i, got[i], want[i])
+		}
+	}
+	if !got[0].Own() || got[1].Own() {
+		t.Error("own and required are not told apart")
+	}
+	if other, _ := inv.SecretsOf(ctx, "consumer", "gitea"); len(other) != 0 {
+		t.Fatalf("another module's secrets: %+v", other)
+	}
+}

internal/inventory/settings_judged_test.go

@@ -0,0 +1,69 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// A setting is judged where it is stored (novox/hq ADR 0163, rule 6): one that cannot compose with
+// the module's definition is refused naming the node, the module, the layer and the key, and is not
+// kept; one that reaches nothing is refused the same way.
+func TestASettingIsJudgedWhereItIsStored(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	web := catalogue.Manifest{Module: "web", Version: "1",
+		Resources: []map[string]any{
+			{"id": "server", "type": "container", "name": "web", "image": "x", "ports": []any{"8080"}},
+			{"id": "conf", "type": "file", "path": "/etc/web.json", "content": "{}", "merge": "json"},
+		}}
+	plain := catalogue.Manifest{Module: "plain", Version: "1",
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "plain", "image": "x"}}}
+	for _, m := range []catalogue.Manifest{web, plain} {
+		if err := inv.RegisterModule(ctx, m, Source{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	err := inv.SetSettings(ctx, "anchor", "web", map[string]any{catalogue.PortsSetting: map[string]any{"9999": 10000}})
+	for _, want := range []string{"refused: web on anchor", `layer "anchor"`, "9999"} {
+		if err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("a port the module does not publish: %v, want %q", err, want)
+		}
+	}
+	if layers, _ := inv.SettingsFor(ctx, "anchor", "web"); len(layers) != 0 {
+		t.Fatalf("the refused layer was stored: %v", layers)
+	}
+	// A key that reaches nothing is refused too, where the spelling can still be fixed; a module
+	// with a mergeable file takes any key.
+	err = inv.SetSettings(ctx, "", "plain", map[string]any{"colour": "blue"})
+	if err == nil || !strings.Contains(err.Error(), "reach nothing") || !strings.Contains(err.Error(), `"colour"`) {
+		t.Fatalf("a stray key was stored: %v", err)
+	}
+	if err := inv.SetSettings(ctx, "", "web", map[string]any{"colour": "blue"}); err != nil {
+		t.Fatal(err)
+	}
+	// The mesh-wide layer is under the node's when the node's is judged.
+	if err := inv.SetSettings(ctx, "anchor", "web", map[string]any{catalogue.PortsSetting: map[string]any{"8080": 10000}}); err != nil {
+		t.Fatal(err)
+	}
+	// A kept network is for an adopted machine only (rule 4).
+	keep := map[string]any{catalogue.NetworksSetting: map[string]any{"server": []any{"predecessor_default"}}}
+	err = inv.SetSettings(ctx, "anchor", "plain", keep)
+	if err == nil || !strings.Contains(err.Error(), "anchor is converged") {
+		t.Fatalf("a kept network on a converged machine was stored: %v", err)
+	}
+	if err := inv.SetAdopted(ctx, "anchor", true); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetSettings(ctx, "anchor", "plain", keep); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetSettings(ctx, "anchor", "nothing", keep); err == nil {
+		t.Fatal("a setting for a module the mesh does not know was stored")
+	}
+}