The control plane's recipe starts FROM the base its manifest declares, and an undeclared base is refused

The mesh's own images declare theirs now, so the refusal ADR 0097 deferred is live.
The builder's own image and the examples take arguments with defaults; make builds
them, not the mesh.

internal/builder/builder.go

@@ -397,13 +397,13 @@ func one(ctx context.Context, run Runner, publish Publisher,
 				module, a.From, strings.Join(copies, ", "))
 		}
 		if len(bases) > 0 {
-			// Said, not yet refused: the mesh's own images start FROM a public base — the control
-			// plane's, the builder's, the tool runtime's — and refusing those refuses genesis.
-			// They declare their bases next; until then a base fetched on its own is named here,
-			// with the remedy, every build.
-			say("recipe", "UNDECLARED base(s) %s in %s — declare each under build.on as "+
-				"{arg, image@sha256:…} and read it from that argument (novox/hq ADR 0097)",
-				strings.Join(bases, ", "), a.From)
+			// Refused, since the mesh's own images declare theirs (ADR 0097): a base fetched on
+			// its own is a build that works when a public registry answers, which is sometimes.
+			return catalogue.Built{}, fmt.Errorf(
+				"%s: the recipe %s starts FROM %s, which the manifest does not declare. Declare "+
+					"each under build.on as {\"arg\": \"<NAME>\", \"image\": \"<image>@sha256:…\"} "+
+					"and start FROM ${<NAME>} (novox/hq ADR 0097)",
+				module, a.From, strings.Join(bases, ", "))
 		}
 		invocation := append([]string{"build", "-f", a.From, "-t", local}, args...)
 		if a.Target != "" {