diff --git a/cmd/mesh-builder/holder.go b/cmd/mesh-builder/holder.go
index 777ca6f5..ff962c44 100644
--- a/cmd/mesh-builder/holder.go
+++ b/cmd/mesh-builder/holder.go
@@ -14,8 +14,8 @@ import (
 
 	"github.com/nats-io/nats.go/micro"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/accept_outside.go b/cmd/mesh-controller/accept_outside.go
index a4b8ae96..2489f542 100644
--- a/cmd/mesh-controller/accept_outside.go
+++ b/cmd/mesh-controller/accept_outside.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -55,6 +55,8 @@ func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
 // its next send would, and the machines that could not be resolved, with why.
 func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
 	[]inventory.PairEnd, []string, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return nil, nil, err
@@ -62,7 +64,7 @@ func consumersFrom(ctx context.Context, open *stores, provider, providerModule,
 	var out []inventory.PairEnd
 	var unresolved []string
 	for _, n := range nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
+		plan, _, err := resolveNode(ctx, open, n.Name)
 		if err != nil {
 			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
 			continue
diff --git a/cmd/mesh-controller/acts.go b/cmd/mesh-controller/acts.go
index 4f02544c..3989f0f8 100644
--- a/cmd/mesh-controller/acts.go
+++ b/cmd/mesh-controller/acts.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -314,7 +314,7 @@ type afterAct struct {
 // after the write, which can only find more unmet than the closure would: a seat said held there is
 // held in the closure too.
 func resolvedAfter(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, node string) afterAct {
-	plan, _, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err == nil {
 		out := afterAct{plan: plan, unheld: plan.Unheld}
 		for _, m := range plan.Modules {
@@ -355,6 +355,8 @@ func splitModules(field string) []string {
 // Nothing here can fail the act it reports on. A mesh that cannot be read is worth saying and is
 // not a reason to claim the assignment did not happen — it did.
 func blockedElsewhere(ctx context.Context, open *stores, except string) string {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	nodes, err := open.inventory.Nodes(ctx)
 	if err != nil {
 		return "\n\nThe rest of the mesh could not be checked: " + err.Error()
@@ -364,7 +366,7 @@ func blockedElsewhere(ctx context.Context, open *stores, except string) string {
 		if n.Name == except {
 			continue
 		}
-		if _, _, err := planFor(ctx, open, n.Name); err != nil {
+		if _, _, err := resolveNode(ctx, open, n.Name); err != nil {
 			blocked[n.Name] = err.Error()
 		}
 	}
diff --git a/cmd/mesh-controller/acts_test.go b/cmd/mesh-controller/acts_test.go
index 2e8e6261..a7c6f819 100644
--- a/cmd/mesh-controller/acts_test.go
+++ b/cmd/mesh-controller/acts_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What an assignment says about the machines it was not about.
diff --git a/cmd/mesh-controller/addresses_integration_test.go b/cmd/mesh-controller/addresses_integration_test.go
index 3d85873d..d8c507b2 100644
--- a/cmd/mesh-controller/addresses_integration_test.go
+++ b/cmd/mesh-controller/addresses_integration_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
 )
diff --git a/cmd/mesh-controller/addresses_test.go b/cmd/mesh-controller/addresses_test.go
index 5eb8d617..ec44be96 100644
--- a/cmd/mesh-controller/addresses_test.go
+++ b/cmd/mesh-controller/addresses_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/adopting_test.go b/cmd/mesh-controller/adopting_test.go
index 5561bb05..5a5191c1 100644
--- a/cmd/mesh-controller/adopting_test.go
+++ b/cmd/mesh-controller/adopting_test.go
@@ -12,10 +12,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // novox/hq ADR 0100: taking a module is its cutover; converging a node is one act, previewed, and
diff --git a/cmd/mesh-controller/adoption.go b/cmd/mesh-controller/adoption.go
index afa90a07..0ff12403 100644
--- a/cmd/mesh-controller/adoption.go
+++ b/cmd/mesh-controller/adoption.go
@@ -12,9 +12,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // A node is adopted or converged (novox/hq ADR 0100), and it is said to be adopted wherever the
@@ -243,7 +243,7 @@ func take(ctx context.Context, open *stores, node, module string, opts takeOptio
 		return "", err
 	}
 	if !slices.Contains(assigned, module) {
-		if plan, _, err := planFor(ctx, open, node); err == nil {
+		if plan, _, err := resolveNode(ctx, open, node); err == nil {
 			if why, runs := plan.Because[module]; runs {
 				return "", fmt.Errorf("%w: %s runs on %s because %s — assign it to %s to take it",
 					inventory.ErrNotAssigned, module, node, why, node)
@@ -649,7 +649,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 	if err != nil {
 		return "", err
 	}
-	plan, settings, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err != nil {
 		return "", err
 	}
@@ -706,11 +706,8 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 			filter)
 	}
 
-	gens, err := generators(ctx, open)
-	if err != nil {
-		return "", err
-	}
-	with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Reading)
+	// What the filter is derived from: the rendering of this machine as a question reads it, with the private network.
+	with, err := renderingOf(ctx, open, node)
 	if err != nil {
 		return "", err
 	}
@@ -776,7 +773,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		if _, err := inv.Assign(ctx, node, filter); err != nil {
 			return "", err
 		}
-		if _, _, err := planFor(ctx, open, node); err != nil {
+		if _, _, err := resolveNode(ctx, open, node); err != nil {
 			_ = inv.Unassign(ctx, node, filter)
 			return "", fmt.Errorf("%s cannot run %s, so it was not converged: %w", node, filter, err)
 		}
diff --git a/cmd/mesh-controller/agent_account_integration_test.go b/cmd/mesh-controller/agent_account_integration_test.go
index 1d615a1c..ece0c1f5 100644
--- a/cmd/mesh-controller/agent_account_integration_test.go
+++ b/cmd/mesh-controller/agent_account_integration_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/conditions"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-host/rootsearch"
diff --git a/cmd/mesh-controller/agent_account_test.go b/cmd/mesh-controller/agent_account_test.go
index 63d5dff9..c8db9085 100644
--- a/cmd/mesh-controller/agent_account_test.go
+++ b/cmd/mesh-controller/agent_account_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/asker_wire.go b/cmd/mesh-controller/asker_wire.go
index 66651dc5..59c75efa 100644
--- a/cmd/mesh-controller/asker_wire.go
+++ b/cmd/mesh-controller/asker_wire.go
@@ -19,8 +19,8 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/awaiting_push_integration_test.go b/cmd/mesh-controller/awaiting_push_integration_test.go
index d3714080..b18d766f 100644
--- a/cmd/mesh-controller/awaiting_push_integration_test.go
+++ b/cmd/mesh-controller/awaiting_push_integration_test.go
@@ -8,10 +8,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T) {
@@ -25,21 +26,13 @@ func TestAModuleAssignedAndNotPushedIsAwaitingAPushNotUncomposable(t *testing.T)
 
 	// The read the rest of the mesh asks still refuses it, with the composer's typed error: nothing
 	// can be compared about a secret that does not exist (status), and nothing here string-matches.
-	plan, settings, err := planFor(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = declarationWith(ctx, open, "laptop", plan, settings, gens, Reading)
+	_, _, err := composeQuestion(ctx, open, "laptop", compose.Reading, false)
 	var notMade *catalogue.NotMadeError
 	if !errors.As(err, &notMade) || notMade.Module != "keeper" || notMade.Name != "repository" {
 		t.Fatalf("a read composition did not say which secret is not made, typed: %v", err)
 	}
 	// Foreseen, it composes, names what the push makes, and made nothing.
-	foreseen, err := declarationWith(ctx, open, "laptop", plan, settings, gens, Foreseeing)
+	foreseen, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false)
 	if err != nil || len(foreseen.foreseen) != 1 || foreseen.foreseen[0] != "keeper/repository" {
 		t.Fatalf("foreseen: %v %v", foreseen.foreseen, err)
 	}
diff --git a/cmd/mesh-controller/awaiting_push_test.go b/cmd/mesh-controller/awaiting_push_test.go
index 58efd557..74b7097b 100644
--- a/cmd/mesh-controller/awaiting_push_test.go
+++ b/cmd/mesh-controller/awaiting_push_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
@@ -29,7 +29,7 @@ func aKeeper() catalogue.Manifest {
 func pushedBy(t *testing.T, open *stores, node string) string {
 	t.Helper()
 	ctx := t.Context()
-	plan, settings, err := planFor(ctx, open, node)
+	plan, settings, err := resolveNode(ctx, open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -54,11 +54,10 @@ func pushedBy(t *testing.T, open *stores, node string) string {
 		if err != nil {
 			t.Fatal(err)
 		}
-		names := make([]string, 0, len(plan.Modules))
+		builds = map[string]string{}
 		for _, m := range plan.Modules {
-			names = append(names, m.Module)
+			builds[m.Module] = current[m.Module].Commit
 		}
-		builds = carriedBuilds(names, nil, current, nil)
 	}
 	if err := open.inventory.RecordSent(ctx, record.ID, digest, builds); err != nil {
 		t.Fatal(err)
diff --git a/cmd/mesh-controller/away_integration_test.go b/cmd/mesh-controller/away_integration_test.go
index 759b7ed9..72f18610 100644
--- a/cmd/mesh-controller/away_integration_test.go
+++ b/cmd/mesh-controller/away_integration_test.go
@@ -13,8 +13,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/backups_before_send_integration_test.go b/cmd/mesh-controller/backups_before_send_integration_test.go
index 10da5daa..2baca74b 100644
--- a/cmd/mesh-controller/backups_before_send_integration_test.go
+++ b/cmd/mesh-controller/backups_before_send_integration_test.go
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/batches_integration_test.go b/cmd/mesh-controller/batches_integration_test.go
index 880e9940..d7afe0af 100644
--- a/cmd/mesh-controller/batches_integration_test.go
+++ b/cmd/mesh-controller/batches_integration_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/batches_test.go b/cmd/mesh-controller/batches_test.go
index da7ad0e9..af52b8a9 100644
--- a/cmd/mesh-controller/batches_test.go
+++ b/cmd/mesh-controller/batches_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/bindings.go b/cmd/mesh-controller/bindings.go
index ea3309b8..aab111f1 100644
--- a/cmd/mesh-controller/bindings.go
+++ b/cmd/mesh-controller/bindings.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -73,6 +73,8 @@ func reportKept(ctx context.Context, plan catalogue.Resolution) {
 // sent, on every machine — the resolver kept it there (said, urgent, until a person pins), or a pin
 // moves it (said, so the data goes first), and never anything else.
 func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	inv := d.open.inventory
 	nodes, err := inv.Nodes(ctx)
 	if err != nil {
@@ -80,7 +82,7 @@ func probeBindings(ctx context.Context, d *doctor) ([]conditions.Observation, er
 	}
 	var out []conditions.Observation
 	for _, n := range nodes {
-		plan, _, err := planFor(ctx, d.open, n.Name)
+		plan, _, err := resolveNode(ctx, d.open, n.Name)
 		if err != nil {
 			if unresolvable(err) {
 				// D1 says it, with the binding that refused it when that is why.
diff --git a/cmd/mesh-controller/bindings_integration_test.go b/cmd/mesh-controller/bindings_integration_test.go
index 580c1fde..da08a10a 100644
--- a/cmd/mesh-controller/bindings_integration_test.go
+++ b/cmd/mesh-controller/bindings_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
@@ -37,7 +37,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
 		[2]string{"laptop", "board"})
 
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -64,7 +64,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.Unassign(ctx, "laptop", "store"); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
+	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || !unresolvable(err) ||
 		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
 		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
 		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
@@ -74,7 +74,7 @@ func TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T)
 	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = planFor(ctx, open, "laptop")
+	plan, _, err = resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/bindings_test.go b/cmd/mesh-controller/bindings_test.go
index 98cb6b69..2101e614 100644
--- a/cmd/mesh-controller/bindings_test.go
+++ b/cmd/mesh-controller/bindings_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
diff --git a/cmd/mesh-controller/build.go b/cmd/mesh-controller/build.go
index 5028bdf4..accc7e29 100644
--- a/cmd/mesh-controller/build.go
+++ b/cmd/mesh-controller/build.go
@@ -15,9 +15,9 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/build_seat_test.go b/cmd/mesh-controller/build_seat_test.go
index e40ca0a5..26e5942d 100644
--- a/cmd/mesh-controller/build_seat_test.go
+++ b/cmd/mesh-controller/build_seat_test.go
@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/build_source.go b/cmd/mesh-controller/build_source.go
index da098867..9dc1dc05 100644
--- a/cmd/mesh-controller/build_source.go
+++ b/cmd/mesh-controller/build_source.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -88,7 +88,7 @@ func newSourceForms(ctx context.Context, inv *inventory.Inventory) *sourceForms
 		if world == nil {
 			w := catalogue.World{}
 			if shelf, err := inv.Catalogue(ctx); err == nil {
-				if read, err := theRestOfTheMesh(ctx, inv, shelf, ""); err == nil {
+				if read, err := restOfTheMeshOf(ctx, inv, shelf, ""); err == nil {
 					w = read
 				}
 			}
diff --git a/cmd/mesh-controller/bus_step.go b/cmd/mesh-controller/bus_step.go
index e7785536..e52f97ce 100644
--- a/cmd/mesh-controller/bus_step.go
+++ b/cmd/mesh-controller/bus_step.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/busobjects_test.go b/cmd/mesh-controller/busobjects_test.go
index 349ab225..c40758f6 100644
--- a/cmd/mesh-controller/busobjects_test.go
+++ b/cmd/mesh-controller/busobjects_test.go
@@ -9,8 +9,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 
diff --git a/cmd/mesh-controller/busy_test.go b/cmd/mesh-controller/busy_test.go
index 8399dcdc..4b8433e5 100644
--- a/cmd/mesh-controller/busy_test.go
+++ b/cmd/mesh-controller/busy_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/chain_integration_test.go b/cmd/mesh-controller/chain_integration_test.go
index 81866f2b..ea086c9c 100644
--- a/cmd/mesh-controller/chain_integration_test.go
+++ b/cmd/mesh-controller/chain_integration_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/chain"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/changeplan.go b/cmd/mesh-controller/changeplan.go
index 2b3ae219..f6d3461e 100644
--- a/cmd/mesh-controller/changeplan.go
+++ b/cmd/mesh-controller/changeplan.go
@@ -7,7 +7,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/changeplan_test.go b/cmd/mesh-controller/changeplan_test.go
index 599cb20e..8e537227 100644
--- a/cmd/mesh-controller/changeplan_test.go
+++ b/cmd/mesh-controller/changeplan_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/check.go b/cmd/mesh-controller/check.go
index ce08029d..b6f605f8 100644
--- a/cmd/mesh-controller/check.go
+++ b/cmd/mesh-controller/check.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/check_builds_integration_test.go b/cmd/mesh-controller/check_builds_integration_test.go
index 37f33a6a..36a78eb6 100644
--- a/cmd/mesh-controller/check_builds_integration_test.go
+++ b/cmd/mesh-controller/check_builds_integration_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/check_builds_test.go b/cmd/mesh-controller/check_builds_test.go
index 7a339b51..8c4d0ccf 100644
--- a/cmd/mesh-controller/check_builds_test.go
+++ b/cmd/mesh-controller/check_builds_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/check_here.go b/cmd/mesh-controller/check_here.go
index 201e1dec..51e7c786 100644
--- a/cmd/mesh-controller/check_here.go
+++ b/cmd/mesh-controller/check_here.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/check_siblings_test.go b/cmd/mesh-controller/check_siblings_test.go
index b35e8e60..379ecd98 100644
--- a/cmd/mesh-controller/check_siblings_test.go
+++ b/cmd/mesh-controller/check_siblings_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/check_test.go b/cmd/mesh-controller/check_test.go
index eecf6139..608b6b69 100644
--- a/cmd/mesh-controller/check_test.go
+++ b/cmd/mesh-controller/check_test.go
@@ -8,8 +8,8 @@ import (
 
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/beside"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The check anybody can run is the check registration runs (novox/hq issue 148, ADR 0037): a manifest
diff --git a/cmd/mesh-controller/checks.go b/cmd/mesh-controller/checks.go
index eda91b65..007b4adb 100644
--- a/cmd/mesh-controller/checks.go
+++ b/cmd/mesh-controller/checks.go
@@ -14,8 +14,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -75,7 +75,7 @@ type checkScope struct {
 	// Mesh says the repository is the mesh's: modules are built from it on some branch, its owner is the
 	// core's, or the change adds a module to it.
 	Mesh bool
-	// Judge is who judges the gate (link.JudgeSelf, link.JudgeValidator, or the running controller).
+	// Judge is who judges the gate (link.JudgeSelf, or the running controller).
 	Judge string
 	// From is a module built from the repository, for how the mesh clones it; nil when none is.
 	From *inventory.Entry
@@ -101,10 +101,6 @@ func pullScope(p link.PullUpdated, entries []inventory.Entry, read map[string][]
 		switch e.Manifest.Module {
 		case "mesh-controller":
 			s.Judge = link.JudgeSelf
-		case "mesh-host":
-			if s.Judge == "" {
-				s.Judge = link.JudgeValidator
-			}
 		}
 	}
 	for _, d := range r.Added {
@@ -281,7 +277,7 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 	for _, e := range entries {
 		shelf[e.Manifest.Module] = e.Manifest
 	}
-	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
+	world, err := restOfTheMesh(ctx, open, shelf, "")
 	if err != nil {
 		return link.BuildRequest{}, err
 	}
diff --git a/cmd/mesh-controller/checks_queue_test.go b/cmd/mesh-controller/checks_queue_test.go
index d79c6207..b9fb48f2 100644
--- a/cmd/mesh-controller/checks_queue_test.go
+++ b/cmd/mesh-controller/checks_queue_test.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/checks_test.go b/cmd/mesh-controller/checks_test.go
index 24e37f3d..27bc6f8f 100644
--- a/cmd/mesh-controller/checks_test.go
+++ b/cmd/mesh-controller/checks_test.go
@@ -53,8 +53,8 @@ func TestThePullRequestIsMappedOntoTheModuleGraph(t *testing.T) {
 			"", "modules/newmod", "modules/newmod/module.json", true, ""},
 		{"the controller judges itself", pull("novox", "mesh-controller", "main", []string{"cmd/x.go"}),
 			"mesh-controller", "", "module.json", true, "self"},
-		{"the node-engine is judged with its validator", pull("novox", "mesh-host", "main", []string{"validate/v.go"}),
-			"mesh-host", "", "module.json", true, "validator"},
+		{"the node-engine is judged by the controller the mesh runs, as any module is (issue 1391)",
+			pull("novox", "mesh-host", "main", []string{"validate/v.go"}), "mesh-host", "", "module.json", true, ""},
 		{"the core's owner, no module: the mesh's, its own check alone", pull("novox", "hq", "main", []string{"README.md"}),
 			"", "", "", true, ""},
 		{"a branch nothing is built from: the mesh's repository, no module", pull("novox", "photos", "master",
diff --git a/cmd/mesh-controller/compose_callers_test.go b/cmd/mesh-controller/compose_callers_test.go
new file mode 100644
index 00000000..626860dd
--- /dev/null
+++ b/cmd/mesh-controller/compose_callers_test.go
@@ -0,0 +1,59 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// 1389: the controller's own composition is gone. No function of the package is named for it any more, and no function
+// calls one by that name: a name reappearing is a second copy of what mesh-sdk's go/compose holds (novox/hq ADR 0453).
+func TestTheControllersOwnCompositionIsGone(t *testing.T) {
+	gone := map[string]bool{"planFor": true, "declarationWith": true, "composedAndValidated": true, "generators": true,
+		"renderingFor": true, "theRestOfTheMesh": true, "whoResolves": true, "grantsFor": true, "namesInTheMesh": true,
+		"onThePrivateNetwork": true, "passSeatsOn": true, "theMeshPassesSeatsOn": true, "assignmentsOf": true,
+		"licencesFor": true, "seatsOn": true, "composeBusUsers": true, "adoptionFor": true, "localNetworksOf": true}
+	files, err := filepath.Glob("*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fset := token.NewFileSet()
+	var found []string
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(fset, f, nil, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, d := range file.Decls {
+			fn, ok := d.(*ast.FuncDecl)
+			if !ok {
+				continue
+			}
+			if gone[fn.Name.Name] {
+				found = append(found, f+": "+fn.Name.Name+" is declared")
+			}
+			if fn.Body == nil {
+				continue
+			}
+			ast.Inspect(fn.Body, func(n ast.Node) bool {
+				if c, ok := n.(*ast.CallExpr); ok {
+					if id, ok := c.Fun.(*ast.Ident); ok && gone[id.Name] {
+						found = append(found, f+": "+fn.Name.Name+" calls "+id.Name)
+					}
+				}
+				return true
+			})
+		}
+	}
+	sort.Strings(found)
+	for _, one := range found {
+		t.Errorf("%s: the controller's own composition is back; compose through mesh-sdk (compose_sdk.go)", one)
+	}
+}
diff --git a/cmd/mesh-controller/compose_fallbacks_test.go b/cmd/mesh-controller/compose_fallbacks_test.go
new file mode 100644
index 00000000..04537cc4
--- /dev/null
+++ b/cmd/mesh-controller/compose_fallbacks_test.go
@@ -0,0 +1,114 @@
+package main
+
+import (
+	"encoding/base64"
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/broker"
+)
+
+// aCoreInput is an Input of one machine that takes a core module whose credential the vault has not boxed: the composition
+// stands in a vault box for it, and the machine holds the controller's own seal of it.
+func aCoreInput(t *testing.T) (*meshInput, string) {
+	t.Helper()
+	raw := make([]byte, 32)
+	raw[0] = 9
+	key := base64.StdEncoding.EncodeToString(raw)
+	client := catalogue.Manifest{Module: "mesh-provisioner-client", Version: "1",
+		Claims:     []catalogue.Claim{{Name: broker.NodeProvisionerSeat, Scope: catalogue.ScopeNode}},
+		OwnSecrets: catalogue.OwnSecrets{broker.ProvisionerSecret: {Path: "/var/lib/mesh-provisioner-client/broker"}}}
+	return &meshInput{Input: compose.Input{
+		Catalogue: map[string]catalogue.Manifest{client.Module: client},
+		Nodes: []compose.Node{{Name: "laptop", Assigned: []string{client.Module}, SealingKey: key, Stated: true,
+			Contract: compose.VaultBoxContract}},
+		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: client.Module, Name: broker.ProvisionerSecret,
+			Origin: "made", SealedTo: key, Sealed: "SEALED-BY-THE-CONTROLLER"}},
+	}}, client.Module
+}
+
+// 1385 (the lead's answer 1): where the vault is silent and no box is kept, the declaration carries the controller's own seal
+// for the core credential, as ADR 0396 has it, and stands in for nothing. It failed first: the composition's declaration
+// carried the stand-in box, and a send was refused.
+func TestACoreCredentialTheVaultDidNotBoxIsSealedByTheController(t *testing.T) {
+	in, module := aCoreInput(t)
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(d.CoreBoxesWanted) != 1 || len(stillForeseen(d)) == 0 {
+		t.Fatalf("the composition does not stand in for the vault's box: %v", d.CoreBoxesWanted)
+	}
+	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if left := stillForeseen(sealed); len(left) != 0 {
+		t.Fatalf("the declaration still stands in for %v", left)
+	}
+	var file map[string]any
+	for _, r := range sealed.Resources {
+		if r["id"] == module+"."+catalogue.NeedID(broker.ProvisionerSecret) {
+			file = r
+		}
+	}
+	if file == nil || file["sealed"] != "SEALED-BY-THE-CONTROLLER" || file[catalogue.VaultSealedField] != nil {
+		t.Fatalf("the core credential is carried as %v: the controller's own seal, not the vault's box", file)
+	}
+	// And a module the vault did answer for is left as it is.
+	other, _, err := sealedByTheController(in, "laptop", d, []string{"another-module"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(stillForeseen(other)) == 0 {
+		t.Fatal("a module the vault answered for was sealed by the controller")
+	}
+}
+
+// 1383 (the lead's answer 4): the machine that runs the bus is refused where no user has a credential, with busUserList's
+// words, and a machine that does not run the bus is not. It failed first: the Input stood a list in and the bus node composed.
+func TestTheMachineThatRunsTheBusIsRefusedWhereNoUserHasACredential(t *testing.T) {
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	other := catalogue.Manifest{Module: "files", Version: "1"}
+	why := errors.New("this machine runs the bus and not one user has a credential, so the composed list would refuse every connection in the mesh")
+	in := &meshInput{busRefused: why, Input: compose.Input{
+		Catalogue: map[string]catalogue.Manifest{"nats": bus, "files": other},
+		Nodes:     []compose.Node{{Name: "anchor", Assigned: []string{"nats"}}, {Name: "laptop", Assigned: []string{"files"}}},
+	}}
+	if err := refusedBus(in, "anchor"); err == nil || !strings.Contains(err.Error(), "not one user has a credential") {
+		t.Fatalf("the machine that runs the bus is not refused: %v", err)
+	}
+	if err := refusedBus(in, "laptop"); err != nil {
+		t.Fatalf("a machine that does not run the bus is refused: %v", err)
+	}
+	if err := refusedBus(&meshInput{Input: in.Input}, "anchor"); err != nil {
+		t.Fatalf("a bus with users is refused: %v", err)
+	}
+}
+
+// The controller's seal replaces the stand-in box whatever path the resource carries: the path is the manifest's with the
+// machine's words filled in, not the manifest's own. It failed first, with the path compared (the live try: "composed twice and
+// still names ... asked of the vault by the next send").
+func TestTheControllersSealReplacesTheBoxWhateverPathTheFileCarries(t *testing.T) {
+	in, module := aCoreInput(t)
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range d.Resources {
+		if _, box := r[catalogue.VaultSealedField]; box {
+			r["path"] = "/home/someone/.var/lib/mesh-provisioner-client/broker"
+		}
+	}
+	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if left := stillForeseen(sealed); len(left) != 0 {
+		t.Fatalf("the declaration still stands in for %v", left)
+	}
+}
diff --git a/cmd/mesh-controller/compose_helpers_test.go b/cmd/mesh-controller/compose_helpers_test.go
new file mode 100644
index 00000000..918f2dfa
--- /dev/null
+++ b/cmd/mesh-controller/compose_helpers_test.go
@@ -0,0 +1,33 @@
+package main
+
+import (
+	"context"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// grantsOf is the grants a provider creates for its consumers, the consumers whose identity overflows the provision's bound
+// and the credentials bound to another consumer, as mesh-sdk's rendering gives them for the machine (it replaced the
+// controller's grantsFor, issue 1389).
+func grantsOf(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	rendered, err := compose.Render(in.Input, node, compose.Reading)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	return rendered.Rendering.Grants, rendered.Withheld, rendered.Unbound, nil
+}
+
+// madeAndRendered sends to the machine (so everything a send makes is made) and answers its rendering as a question reads it
+// afterwards: what the controller's Allocating rendering was.
+func madeAndRendered(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
+	if _, err := composeSend(ctx, open, node); err != nil {
+		return catalogue.Rendering{}, err
+	}
+	forgetInput(ctx)
+	return renderingOf(ctx, open, node)
+}
diff --git a/cmd/mesh-controller/compose_input.go b/cmd/mesh-controller/compose_input.go
new file mode 100644
index 00000000..fc102b93
--- /dev/null
+++ b/cmd/mesh-controller/compose_input.go
@@ -0,0 +1,436 @@
+package main
+
+import (
+	"context"
+	"os"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The controller's adapter from its stores to mesh-sdk's composition input (novox/hq ADR 0453 clause 3, design 47 R4b,
+// issues 1382 and 1383).
+//
+// **The adapter reads, and perform writes.** readComposeInput asks the stores once for everything the composition reads
+// and returns compose.Input, which the composition never changes; it makes, seals, allocates and records nothing. A
+// pair credential, a port, an own secret or a core box that the next send would make is not made here: the composition
+// names it foreseen, and compose_perform.go makes it for a send, then reads the stores again and composes again. A
+// question (status, facts, probes, the merge gate's reading) never performs.
+//
+// **The Input is built once per operation.** A verb that composes every node reads the stores once and hands the Input to
+// each node's composition of it.
+
+// composeInputBuilt is called once for each Input the adapter builds: the seam a test counts the reads of an operation by
+// (issue 1382, criterion 5).
+var composeInputBuilt = func() {}
+
+// readComposeInput reads the stores once and returns what the composition needs. ctx carries what a send keeps (the
+// recorded modules kept at the build their machine runs, recorded_kept.go): the same contexts every send composes under.
+func readComposeInput(ctx context.Context, open *stores) (*meshInput, error) {
+	in, shape, err := readMeshAndNodes(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	// What each node resolves to, with no credential given (the settings are read before it): the modules whose settings are read, and the
+	// needs whose pair credentials are asked of the stores. Nothing is written by it.
+	unread, err := readSettings(ctx, open, &in)
+	if err != nil {
+		return nil, err
+	}
+	plans := map[string]compose.Resolved{}
+	for _, n := range in.Nodes {
+		if shape.refused[n.Name] != nil {
+			continue // refused for what it keeps: nothing of it is read further
+		}
+		resolved, err := compose.Resolve(in, n.Name)
+		switch {
+		case compose.IsUnresolvable(err):
+			// Their set does not compose: nothing of theirs is read further, as the controller never read a thing for a
+			// node that did not resolve.
+			continue
+		case err != nil:
+			return nil, err
+		}
+		plans[n.Name] = resolved
+	}
+	if err := unreadSettings(unread, plans); err != nil {
+		return nil, err
+	}
+	var busRefused error
+	wouldMake, err := readCredentialsAndBuilds(ctx, open, &in, plans, shape, &busRefused)
+	if err != nil {
+		return nil, err
+	}
+	composeInputBuilt()
+	return &meshInput{Input: in, wouldMake: wouldMake, busRefused: busRefused, refused: shape.refused}, nil
+}
+
+// meshInput is the Input an operation composes over, and the pair credentials its reading found none held for: the ones the
+// next send makes, which perform makes.
+type meshInput struct {
+	compose.Input
+	wouldMake []inventory.PairCredential
+	// busRefused is why the bus's user list cannot be composed (no user has a credential): the machine that runs the bus is
+	// refused with it, as the controller's own composition refused it, and no other machine is.
+	busRefused error
+	// refused is, by node, why that machine alone cannot be composed (nodeRefusal).
+	refused map[string]error
+}
+
+// nodeOf is the node of that name in an Input.
+func nodeOf(in compose.Input, name string) (compose.Node, bool) {
+	for _, n := range in.Nodes {
+		if n.Name == name {
+			return n, true
+		}
+	}
+	return compose.Node{}, false
+}
+
+// inputShape is what the first half of the reading found that the second half needs.
+type inputShape struct {
+	sent    map[string]map[string]string // by node: module to the commit last sent
+	kept    map[string]map[string]string // by node: module to the commit kept
+	current map[string]inventory.CurrentBuild
+	// refused is, by node, why a recorded module cannot be kept at the build the machine runs (keepRecorded's refusal, in
+	// its words): that machine alone is refused with it, as planFor refused it, and nothing else of the mesh is.
+	refused map[string]error
+}
+
+// readMeshAndNodes is the mesh-wide and per-node half of the Input (issue 1382).
+func readMeshAndNodes(ctx context.Context, open *stores) (compose.Input, inputShape, error) {
+	inv := open.inventory
+	var in compose.Input
+	shape := inputShape{sent: map[string]map[string]string{}, kept: map[string]map[string]string{}, refused: map[string]error{}}
+
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	in.Catalogue = shelf
+	if in.Holdings, err = inv.Holdings(ctx); err != nil {
+		return in, shape, err
+	}
+	if in.Licences, err = readLicences(ctx, open); err != nil {
+		return in, shape, err
+	}
+
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	places, err := inv.Overlays(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	placed := map[string]inventory.Overlay{}
+	for _, p := range places {
+		placed[p.Name] = p
+	}
+	if shape.current, err = inv.CurrentBuilds(ctx); err != nil {
+		return in, shape, err
+	}
+
+	// The range the mesh allocates from and what its internal names end in, read from the environment here and nowhere else.
+	in.OverlayCIDR = strings.TrimSpace(os.Getenv(OverlayCIDRVar))
+	in.InternalSuffix = overlay.Suffix()
+	if in.Tunnels, err = readTunnels(ctx, inv); err != nil {
+		return in, shape, err
+	}
+	if in.Adopted, err = readAdopted(ctx, inv); err != nil {
+		return in, shape, err
+	}
+	carried, err := inv.CarriedPeers(ctx)
+	if err != nil {
+		return in, shape, err
+	}
+	for _, c := range carried {
+		in.CarriedPeers = append(in.CarriedPeers, compose.CarriedPeer{
+			PublicKey: c.PublicKey, Address: c.Address, EnrolledAs: c.EnrolledAs, Named: c.Named})
+	}
+	if in.Joining, err = inv.NodesWithALiveToken(ctx); err != nil {
+		return in, shape, err
+	}
+
+	keepsSecrets := false
+	for _, m := range shelf {
+		keepsSecrets = keepsSecrets || m.Keeps != ""
+	}
+
+	for _, n := range nodes {
+		var refusal error
+		node, err := readNode(ctx, open, n, placed[n.Name], &refusal)
+		if err != nil {
+			return in, shape, err
+		}
+		if refusal != nil {
+			shape.refused[n.Name] = refusal
+		}
+		shape.sent[n.Name], shape.kept[n.Name] = node.SentBuilds, node.KeptBuilds
+		in.Nodes = append(in.Nodes, node)
+	}
+	if keepsSecrets {
+		if in.OperatorExport, err = inv.OperatorExport(ctx); err != nil {
+			return in, shape, err
+		}
+	}
+	return in, shape, nil
+}
+
+// readNode is one node of the Input: everything the composition reads about it, in the order the controller read it.
+func readNode(ctx context.Context, open *stores, n inventory.Node, place inventory.Overlay,
+	refused *error) (compose.Node, error) {
+	inv := open.inventory
+	out := compose.Node{
+		Name: n.Name,
+		Place: compose.Place{Key: place.Key, Endpoint: place.Endpoint, Site: place.Site, Hub: place.Hub,
+			Address: place.Address},
+		Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount, AgentAccountHome: n.AgentAccountHome,
+		Adopted: n.Adopted,
+	}
+	var err error
+	if out.Assigned, err = inv.Assigned(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Capabilities, err = inv.ProfileOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.PublicDomain, err = inv.PublicDomainOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Pins, err = inv.PinsFor(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if out.Bound, err = inv.BindingsFor(ctx, n.Name); err != nil {
+		return out, err
+	}
+	given, err := inv.PortsFor(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	for _, a := range given {
+		if out.Ports == nil {
+			out.Ports = map[string]map[int]int{}
+		}
+		if out.Ports[a.Module] == nil {
+			out.Ports[a.Module] = map[int]int{}
+		}
+		out.Ports[a.Module][a.Wanted] = a.Machine
+	}
+	if out.SealingKey, err = inv.SealingKeyOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	if n.Adopted {
+		if out.Taken, err = inv.Taken(ctx, n.Name); err != nil {
+			return out, err
+		}
+	}
+	if out.OutwardLinks, err = inv.OutwardLinksOf(ctx, n.Name); err != nil {
+		return out, err
+	}
+	account, had, err := inv.MachineOf(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	if had && account.Machine != nil {
+		out.NetworksSaid = true
+		for _, a := range account.Machine.Networks {
+			out.Networks = append(out.Networks, catalogue.AttachedNetwork{Link: a.Link, Network: a.Network})
+		}
+	}
+	if out.Sequence, err = inv.Sequence(ctx, n.ID); err != nil {
+		return out, err
+	}
+	if out.Epoch, err = inv.SentEpoch(ctx, n.ID); err != nil {
+		return out, err
+	}
+	if out.Generation, err = inv.SentGeneration(ctx, n.ID); err != nil {
+		return out, err
+	}
+	if out.ReadsModules, err = inv.ReadsModules(ctx, n.ID); err != nil {
+		return out, err
+	}
+	if out.SentBuilds, out.SentKnown, err = inv.SentBuilds(ctx, n.Name); err != nil {
+		return out, err
+	}
+	runs, err := inv.AssignmentRuns(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	if len(runs) > 0 {
+		out.Runs = make(map[string]compose.Run, len(runs))
+		for module, ref := range runs {
+			out.Runs[module] = compose.Run{Commit: ref.Commit, Build: ref.Build}
+		}
+	}
+	// A recorded module kept at the build this machine runs, in the context a send composes under (recorded_kept.go): its
+	// manifest and the commit, applied to this node's own resolution only.
+	// What cannot be kept refuses this machine alone (keepRecorded's refusal, as planFor returned it).
+	kept, err := recordedKept(ctx, open, n.Name)
+	if err != nil {
+		*refused = err
+	} else if len(kept) > 0 {
+		out.KeptBuilds = kept
+		if out.Kept, err = keptManifests(ctx, open, n.Name, kept); err != nil {
+			*refused = err
+			out.KeptBuilds, out.Kept = nil, nil
+		}
+	}
+	stated, has, err := inv.HealthOf(ctx, n.Name)
+	if err != nil {
+		return out, err
+	}
+	out.Stated = has
+	if has {
+		out.Contract = stated.Contract
+	}
+	return out, nil
+}
+
+// keptManifests is the manifest of each module kept at the build a machine runs: keepRecorded's reads, and its refusals in its
+// words, without putting any of it into a shelf (that is the node's own Kept, applied by the composition).
+func keptManifests(ctx context.Context, open *stores, node string, kept map[string]string) (map[string]catalogue.Manifest, error) {
+	// applyKept puts each manifest into the shelf it is given and refuses a build that cannot be read; the shelf here is a
+	// scratch one, whose entries are the kept manifests.
+	scratch := map[string]catalogue.Manifest{}
+	if err := applyKept(ctx, open, node, kept, scratch); err != nil {
+		return nil, err
+	}
+	return scratch, nil
+}
+
+func readTunnels(ctx context.Context, inv *inventory.Inventory) (map[string]compose.FoundTunnel, error) {
+	found, err := inv.Tunnels(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if len(found) == 0 {
+		return nil, nil
+	}
+	out := make(map[string]compose.FoundTunnel, len(found))
+	for name, t := range found {
+		out[name] = compose.FoundTunnel{Tunnel: tunnelOf(t.Tunnel), NodeAdopted: t.NodeAdopted}
+	}
+	return out, nil
+}
+
+func readAdopted(ctx context.Context, inv *inventory.Inventory) (*compose.AdoptedTunnel, error) {
+	tunnel, hub, adopted, err := inv.AdoptedTunnel(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if hub == "" {
+		return nil, nil
+	}
+	return &compose.AdoptedTunnel{Tunnel: tunnelOf(tunnel), Hub: hub, Adopted: adopted}, nil
+}
+
+func tunnelOf(t inventory.Tunnel) compose.Tunnel {
+	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, p := range t.Peers {
+		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
+	}
+	return out
+}
+
+// readLicences is every licence the mesh holds, with who uses it and the key sealed to each holder: given even where empty,
+// so a holder the mesh holds no key for composes as that, and not as a key that was not asked for.
+func readLicences(ctx context.Context, open *stores) ([]compose.Licence, error) {
+	held, err := open.Licences(ctx)
+	if err != nil {
+		return nil, err
+	}
+	all, err := held.All(ctx)
+	if err != nil {
+		return nil, err
+	}
+	var out []compose.Licence
+	for _, one := range all {
+		l := compose.Licence{Name: one.Name, Serves: one.Serves, Keys: map[compose.Holder]string{}}
+		holders, err := held.HoldersOf(ctx, one.Name)
+		if err != nil {
+			return nil, err
+		}
+		for _, h := range holders {
+			holder := compose.Holder{Node: h.Node, Module: h.Module}
+			l.Holders = append(l.Holders, holder)
+			key, err := held.KeyFor(ctx, one.Name, h.Node, h.Module)
+			if err != nil {
+				return nil, err
+			}
+			l.Keys[holder] = key
+		}
+		node, module, err := held.ManagerOf(ctx, one.Name)
+		if err != nil {
+			return nil, err
+		}
+		l.Manager = compose.Holder{Node: node, Module: module}
+		out = append(out, l)
+	}
+	return out, nil
+}
+
+// readSettings is each node's settings layers for every module that has any, read BEFORE any node is resolved: the first pass
+// resolves a node whose set takes a provider's served facts from the node that runs it, with that node's settings on them
+// (servedOnNode), so a mesh whose provider says ${setting:domain} resolves only with the settings in the Input. A module's
+// settings that fail to read are returned in unread, by node and module, and are an error only for a module a node resolves to
+// (unreadSettings): the controller read none for a module nothing runs.
+func readSettings(ctx context.Context, open *stores, in *compose.Input) (unread map[string]map[string]error, err error) {
+	have, err := open.inventory.ModulesWithSettings(ctx)
+	if err != nil {
+		return nil, err
+	}
+	names := make([]string, 0, len(have))
+	for module := range have {
+		if _, onShelf := in.Catalogue[module]; onShelf {
+			names = append(names, module)
+		}
+	}
+	sort.Strings(names)
+	for i := range in.Nodes {
+		n := &in.Nodes[i]
+		for _, module := range names {
+			layers, err := open.inventory.SettingsFor(ctx, n.Name, module)
+			if err != nil {
+				if unread == nil {
+					unread = map[string]map[string]error{}
+				}
+				if unread[n.Name] == nil {
+					unread[n.Name] = map[string]error{}
+				}
+				unread[n.Name][module] = err
+				continue
+			}
+			if len(layers) == 0 {
+				continue
+			}
+			if n.Settings == nil {
+				n.Settings = map[string][]catalogue.Layer{}
+			}
+			n.Settings[module] = layers
+		}
+	}
+	return unread, nil
+}
+
+// unreadSettings is the error of a module's settings that did not read, for a module the node resolves to.
+func unreadSettings(unread map[string]map[string]error, plans map[string]compose.Resolved) error {
+	names := make([]string, 0, len(plans))
+	for node := range plans {
+		names = append(names, node)
+	}
+	sort.Strings(names)
+	for _, node := range names {
+		for _, m := range plans[node].Plan.Modules {
+			if err := unread[node][m.Module]; err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
diff --git a/cmd/mesh-controller/compose_input_credentials.go b/cmd/mesh-controller/compose_input_credentials.go
new file mode 100644
index 00000000..a15b28d4
--- /dev/null
+++ b/cmd/mesh-controller/compose_input_credentials.go
@@ -0,0 +1,285 @@
+package main
+
+import (
+	"context"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The second half of the adapter (issue 1383): the credential and build fields of the Input, read and never made.
+
+// readCredentialsAndBuilds fills what the first half left: the credentials, the own secrets, the vault's boxes, the bus,
+// each node's serving key and certificate, and the builds.
+func readCredentialsAndBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
+	shape inputShape, busRefused *error) ([]inventory.PairCredential, error) {
+	if err := readIdentity(ctx, open, in); err != nil {
+		return nil, err
+	}
+	wouldMake, err := readCredentials(ctx, open, in, plans, busRefused)
+	if err != nil {
+		return nil, err
+	}
+	return wouldMake, readBuilds(ctx, open, in, plans, shape)
+}
+
+// readIdentity is the mesh's authority and each node's serving key and the certificate kept for it, for a mesh in which a
+// module asks for a certificate. It establishes and issues nothing: a certificate not kept yet is composed with a stand-in, and
+// issued by the send (certificateFor).
+func readIdentity(ctx context.Context, open *stores, in *compose.Input) error {
+	needs := false
+	for _, m := range in.Catalogue {
+		needs = needs || m.Certificate != nil
+	}
+	if !needs {
+		return nil
+	}
+	ident, err := open.Identity(ctx)
+	if err != nil {
+		return err
+	}
+	if certificate, known, err := ident.KnownAuthority(ctx); err != nil {
+		return err
+	} else if known {
+		in.Authority = certificate
+	}
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		return err
+	}
+	ids := map[string]string{}
+	for _, n := range nodes {
+		ids[n.Name] = n.ID
+	}
+	for i := range in.Nodes {
+		n := &in.Nodes[i]
+		if n.ServingKey, err = ident.ServingKeyOf(ctx, ids[n.Name]); err != nil {
+			return err
+		}
+		if n.ServingKey == "" {
+			continue
+		}
+		if certificate, known, err := ident.KeptCertificate(ctx, overlay.InternalName(n.Name), n.ServingKey); err != nil {
+			return err
+		} else if known {
+			n.Certificate = certificate
+		}
+	}
+	return nil
+}
+
+// readCredentials is how each pair credential a node takes from elsewhere stands, the credentials made for each provider's
+// consumers, the own secrets, the vault's boxes and the bus. It reads and never makes: a credential a send would make is
+// left out (the composition's would-make), a credential only a person gives and nobody gave is not-given, and one the send
+// would be refused is refused with the controller's words.
+func readCredentials(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved,
+	busRefused *error) ([]inventory.PairCredential, error) {
+	var wouldMake []inventory.PairCredential
+	inv := open.inventory
+	shelf := in.Catalogue
+	nodeOf := map[string]compose.Node{}
+	for _, n := range in.Nodes {
+		nodeOf[n.Name] = n
+	}
+	names := make([]string, 0, len(plans))
+	for name := range plans {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		resolved := plans[name]
+		nodeShelf := shelfWith(shelf, nodeOf[name].Kept)
+		for _, need := range resolved.Plan.Needs {
+			if need.ByRecord {
+				continue
+			}
+			p := inventory.PairCredential{Name: need.Name, Consumer: name, ConsumerModule: need.For,
+				Provider: need.From, Local: need.Local}
+			if module, outside := issuedOutsideBy(nodeShelf, need); outside {
+				p.Kind, p.ProviderModule = inventory.PairOutside, module
+			} else if need.SharedOwn != "" {
+				p.Kind, p.Own = inventory.PairShared, need.SharedOwn
+				p.ProviderModule = sharedProviderModule(resolved.Plan, shelf, need)
+			}
+			state, err := inv.PairCredentialState(ctx, p)
+			if err != nil {
+				return nil, err
+			}
+			c := compose.Credential{Provision: need.Name, Consumer: name, ConsumerModule: need.For,
+				Provider: need.From, Local: need.Local}
+			switch state.State {
+			case inventory.PairHeld:
+				c.State, c.Sealed = compose.CredentialHeld, state.Sealed
+			case inventory.PairNotGiven:
+				c.State, c.Why = compose.CredentialNotGiven, state.Why
+			case inventory.PairRefused:
+				c.State, c.Why = compose.CredentialRefused, state.Why
+			default:
+				// Left out: a need with no entry is the credential the next send makes, and perform makes it.
+				wouldMake = append(wouldMake, p)
+				continue
+			}
+			in.Credentials = append(in.Credentials, c)
+		}
+	}
+
+	// The credentials made for each provider's consumers, so the grants it must create are read from them.
+	for _, n := range in.Nodes {
+		rows, err := inv.SecretsFrom(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		for _, s := range rows {
+			in.Issued = append(in.Issued, compose.Issued{Provision: s.Name, Consumer: s.Consumer,
+				ConsumerModule: s.ConsumerModule, Local: s.Local, Provider: n.Name, ForProvider: s.ForProvider})
+		}
+	}
+	own, err := inv.OwnSecretRows(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, r := range own {
+		in.OwnSecrets = append(in.OwnSecrets, compose.OwnSecretRow{Node: r.Node, Module: r.Module, Name: r.Name,
+			Origin: r.Origin, SealedTo: r.SealedTo, Sealed: r.Sealed})
+	}
+	for _, n := range in.Nodes {
+		boxes, err := inv.KeptCoreBoxes(ctx, n.Name)
+		if err != nil {
+			return nil, err
+		}
+		for module, byName := range boxes {
+			for name, b := range byName {
+				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: n.Name, Module: module, Name: name,
+					Generation: b.Generation, SealedTo: b.SealedTo, Box: b.Box})
+			}
+		}
+	}
+	sort.Slice(in.KeptCoreBoxes, func(i, j int) bool {
+		a, b := in.KeptCoreBoxes[i], in.KeptCoreBoxes[j]
+		if a.Node != b.Node {
+			return a.Node < b.Node
+		}
+		if a.Module != b.Module {
+			return a.Module < b.Module
+		}
+		return a.Name < b.Name
+	})
+
+	// The bus: its user list as the controller composes it, for the machine that runs it, and who the mesh has minted a
+	// credential for.
+	var bus []catalogue.Manifest
+	for _, m := range shelf {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			bus = append(bus, m)
+		}
+	}
+	if len(bus) > 0 {
+		list, missing, err := busUserList(ctx, inv, bus)
+		if err != nil && !strings.Contains(err.Error(), "not one user has a credential") {
+			return nil, err
+		}
+		if err != nil {
+			// The machine that runs the bus is refused, as the controller's own composition refused it: a list that
+			// refuses every connection in the mesh is never composed (refusedBus); the other machines compose.
+			*busRefused = err
+		}
+		in.BusUsers, in.BusMissing = list, missing
+	}
+	if in.BusMinted, err = inv.BusMinted(ctx); err != nil {
+		return nil, err
+	}
+	if in.BusMemberships, err = inv.BusMemberships(ctx); err != nil {
+		return nil, err
+	}
+	return wouldMake, nil
+}
+
+// readBuilds is the build half of the Input: every repository the mesh built, each module's current build, and the build made
+// from a commit of a module for the machines whose node-engine reads them.
+func readBuilds(ctx context.Context, open *stores, in *compose.Input, plans map[string]compose.Resolved, shape inputShape) error {
+	inv := open.inventory
+	held, err := inv.Held(ctx)
+	if err != nil {
+		return err
+	}
+	for repository := range held {
+		in.Built = append(in.Built, repository)
+	}
+	sort.Strings(in.Built)
+	in.CurrentBuilds = make(map[string]string, len(shape.current))
+	for module, b := range shape.current {
+		in.CurrentBuilds[module] = b.Commit
+	}
+	// The build made from each commit a declaration may carry, for the machines that read a build per module.
+	for _, n := range in.Nodes {
+		if !n.ReadsModules {
+			continue
+		}
+		resolved, ok := plans[n.Name]
+		if !ok {
+			continue
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, commit := range []string{shape.current[m.Module].Commit, shape.kept[n.Name][m.Module], shape.sent[n.Name][m.Module]} {
+				if commit == "" {
+					continue
+				}
+				if _, done := in.BuildIDs[m.Module][commit]; done {
+					continue
+				}
+				build, err := inv.BuildOf(ctx, m.Module, commit)
+				if err != nil {
+					return err
+				}
+				if in.BuildIDs == nil {
+					in.BuildIDs = map[string]map[string]string{}
+				}
+				if in.BuildIDs[m.Module] == nil {
+					in.BuildIDs[m.Module] = map[string]string{}
+				}
+				in.BuildIDs[m.Module][commit] = build
+			}
+		}
+	}
+	return nil
+}
+
+// shelfWith is the shelf with each module a node keeps at the build it runs put in place of the current one: a copy.
+func shelfWith(shelf map[string]catalogue.Manifest, kept map[string]catalogue.Manifest) map[string]catalogue.Manifest {
+	if len(kept) == 0 {
+		return shelf
+	}
+	out := make(map[string]catalogue.Manifest, len(shelf)+len(kept))
+	for name, m := range shelf {
+		out[name] = m
+	}
+	for name, m := range kept {
+		out[name] = m
+	}
+	return out
+}
+
+// sharedProviderModule is which module answers a shared credential on the providing node: the one in the plan, else the first
+// the catalogue names (providerModuleOf, in an order that does not move between calls).
+func sharedProviderModule(plan catalogue.Resolution, shelf map[string]catalogue.Manifest, n catalogue.Needed) string {
+	for _, m := range plan.Modules {
+		if _, shared := m.SharedCredentialOf(n.Name); shared {
+			return m.Module
+		}
+	}
+	names := make([]string, 0, len(shelf))
+	for name := range shelf {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		if _, shared := shelf[name].SharedCredentialOf(n.Name); shared {
+			return name
+		}
+	}
+	return ""
+}
diff --git a/cmd/mesh-controller/compose_input_credentials_integration_test.go b/cmd/mesh-controller/compose_input_credentials_integration_test.go
new file mode 100644
index 00000000..411ea852
--- /dev/null
+++ b/cmd/mesh-controller/compose_input_credentials_integration_test.go
@@ -0,0 +1,354 @@
+//go:build integration
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// tableState is every table's rows and every sequence's last value, as the adapter's reads must leave them.
+func tableState(t *testing.T, inv *inventory.Inventory) map[string]string {
+	t.Helper()
+	out := map[string]string{}
+	for _, row := range inv.QueryForTest(t, `select table_name from information_schema.tables
+		where table_schema = 'public' and table_type = 'BASE TABLE' order by table_name`) {
+		name := strings.Trim(row[0], `"`)
+		count := inv.QueryForTest(t, fmt.Sprintf(`select count(*)::text from %q`, name))
+		out["rows:"+name] = fmt.Sprint(count)
+		digest := inv.QueryForTest(t, fmt.Sprintf(`select coalesce(md5(string_agg(t::text, '|' order by t::text)), '') from %q t`, name))
+		out["content:"+name] = fmt.Sprint(digest)
+	}
+	for _, row := range inv.QueryForTest(t, `select sequencename, coalesce(last_value::text, '') from pg_sequences
+		where schemaname = 'public' order by sequencename`) {
+		out["sequence:"+row[0]] = row[1]
+	}
+	return out
+}
+
+// 1382/AC4 and 1383/AC6: building the Input writes nothing. The store's rows, their contents and its sequences are the same
+// before and after, on a mesh whose credentials are not made, whose ports are not given and which keeps a recorded build.
+func TestBuildingTheInputWritesNothing(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	// A consumer whose credential nothing has made yet, on a mesh that already composed.
+	register(t, open, catalogue.Manifest{Module: "reports", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/reports/config.json", "mode": "0600",
+			"content": "{}", "merge": "json"}}})
+	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, inv)
+	if _, err := readComposeInput(ctx, open); err != nil {
+		t.Fatal(err)
+	}
+	after := tableState(t, inv)
+	var moved []string
+	for k, v := range after {
+		if before[k] != v {
+			moved = append(moved, k)
+		}
+	}
+	sort.Strings(moved)
+	if len(moved) > 0 {
+		t.Fatalf("building the Input wrote: %v", moved)
+	}
+}
+
+// a consumer of the s3-bucket aMeshWithSecrets' provider offers, with a file the credential goes into.
+func aConsumerOfTheBucket(name string) catalogue.Manifest {
+	return catalogue.Manifest{Module: name, Version: "1", Requires: []string{"s3-bucket"},
+		Secrets: map[string]string{"s3-bucket": "/etc/" + name + "/s3"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/" + name + "/config.json", "mode": "0600",
+			"content": "{}", "merge": "json"}}}
+}
+
+// 1383/AC1: of a provider's three consumers, two have their credentials made and one has not: Issued holds the two rows, with
+// the copy sealed to the provider, the third is a credential the next send makes, and no row was inserted for it (planFor
+// inserted it, plan.go: SecretFor in every mode).
+func TestAPairCredentialNoRowHoldsIsAWouldMakeAndNoRowIsInserted(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aConsumerOfTheBucket("reports"))
+	if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil {
+		t.Fatal(err)
+	}
+	// A send makes the credentials of files and reports; a question makes none.
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, aConsumerOfTheBucket("metrics"))
+	if _, err := inv.Assign(ctx, "laptop", "metrics"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, inv)
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var rows []compose.Issued
+	for _, r := range in.Issued {
+		if r.Provider == "anchor" && r.Provision == "s3-bucket" {
+			rows = append(rows, r)
+			if r.ForProvider == "" {
+				t.Errorf("the row of %s carries no copy sealed to the provider", r.ConsumerModule)
+			}
+		}
+	}
+	if len(rows) != 2 {
+		t.Fatalf("Issued holds %d row(s) for anchor's s3-bucket, want files and reports: %+v", len(rows), rows)
+	}
+	var would []string
+	for _, p := range in.wouldMake {
+		would = append(would, p.ConsumerModule)
+	}
+	if len(would) != 1 || would[0] != "metrics" {
+		t.Fatalf("the credentials the next send makes are %v, want metrics", would)
+	}
+	for _, c := range in.Credentials {
+		if c.ConsumerModule == "metrics" {
+			t.Errorf("a credential nobody holds has an entry: %+v", c)
+		}
+	}
+	after := tableState(t, inv)
+	for k, v := range after {
+		if before[k] != v {
+			t.Errorf("reading the Input moved %s", k)
+		}
+	}
+}
+
+// 1383/AC2: a credential only a person gives that nobody gave is not given, and so is one given under a key the machine no
+// longer has; a credential given by a person for the pair and sealed to a key one end no longer has is refused: in the words
+// plan.go and secrets.go use.
+func TestACredentialOnlyAPersonGivesIsNotGivenAndAGivenOneUnderAnOldKeyIsSaidSo(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: "indexers", Version: "1", Provides: []catalogue.Offer{{
+		Name: "indexer-api", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
+	register(t, open, catalogue.Manifest{Module: "grabber", Version: "1", Requires: []string{"indexer-api"},
+		Secrets: map[string]string{"indexer-api": "/etc/grabber/key"}})
+	register(t, open, aConsumerOfTheBucket("ledger"))
+	register(t, open, catalogue.Manifest{Module: "objects", Version: "1", Provides: catalogue.FromAnywhere("s3-bucket")})
+	for _, a := range [][2]string{{"anchor", "indexers"}, {"laptop", "grabber"}, {"anchor", "objects"}, {"laptop", "ledger"}} {
+		if _, err := inv.Assign(ctx, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+	stateOf := func(provision, consumerModule string) (compose.Credential, bool) {
+		in, err := readComposeInput(ctx, open)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range in.Credentials {
+			if c.Provision == provision && c.ConsumerModule == consumerModule {
+				return c, true
+			}
+		}
+		return compose.Credential{}, false
+	}
+
+	c, found := stateOf("indexer-api", "grabber")
+	if !found || c.State != compose.CredentialNotGiven || !strings.Contains(c.Why, "nobody gave it") {
+		t.Fatalf("a credential nobody gave reads as %+v", c)
+	}
+	if err := inv.AcceptSecretForPair(ctx, "indexer-api", "laptop", "grabber", "anchor", "", "the-key"); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialHeld || c.Sealed == "" {
+		t.Fatalf("a credential a person gave reads as %+v", c)
+	}
+	// The consumer's machine generated a key of its own since.
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("indexer-api", "grabber"); !found || c.State != compose.CredentialNotGiven ||
+		!strings.Contains(c.Why, "a sealing key one end no longer has") {
+		t.Fatalf("a credential given under a key the machine no longer has reads as %+v", c)
+	}
+
+	// A credential for a pair, given by a person, under a key one end has since replaced: the mesh cannot make another.
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.AcceptSecretForPair(ctx, "s3-bucket", "laptop", "ledger", "anchor", "", "the-bucket-key"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if c, found := stateOf("s3-bucket", "ledger"); !found || c.State != compose.CredentialRefused ||
+		!strings.Contains(c.Why, "was accepted from a person, and a sealing key at one end has changed since") {
+		t.Fatalf("a credential given for the pair under an old key reads as %+v", c)
+	}
+}
+
+// 1383/AC3: the own secrets carry their origin, the key they are sealed to and the sealed value; the vault's kept boxes, the
+// licences (with their keys given, so an empty key means the mesh holds none), the users the bus has minted and the
+// memberships equal what the inventory answers.
+func TestTheAdaptersInputCarriesTheOwnSecretsTheBoxesTheLicencesAndTheBus(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	key, err := inv.SealingKeyOf(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	sealed, err := inv.SecretForModule(ctx, "anchor", "objects", "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	box := json.RawMessage(`{"v":1,"eph":"e","iv":"i","tag":"t","ct":"c"}`)
+	if err := inv.KeepCoreBox(ctx, "anchor", inventory.CoreBox{Module: "objects", Name: "admin", Generation: 4,
+		SealedTo: key, Box: box}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SeedBusUser(ctx, inventory.BusUser{Username: "anchor.objects", Kind: "module", Node: "anchor",
+		Module: "objects"}, "a-password"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.PutBusMembership(ctx, "laptop", "sealed-membership"); err != nil {
+		t.Fatal(err)
+	}
+	held, err := open.Licences(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := held.Add(ctx, "claude", "static", map[string]any{"model": "x"}); err != nil {
+		t.Fatal(err)
+	}
+
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var own *compose.OwnSecretRow
+	for i := range in.OwnSecrets {
+		if r := &in.OwnSecrets[i]; r.Node == "anchor" && r.Module == "objects" && r.Name == "admin" {
+			own = r
+		}
+	}
+	if own == nil || own.Origin != "made" || own.SealedTo != key || own.Sealed != sealed {
+		t.Errorf("the own secret reads as %+v; the inventory holds %q sealed to %q", own, sealed, key)
+	}
+	var kept *compose.CoreBox
+	for i := range in.KeptCoreBoxes {
+		if b := &in.KeptCoreBoxes[i]; b.Node == "anchor" && b.Module == "objects" && b.Name == "admin" {
+			kept = b
+		}
+	}
+	if kept == nil || kept.Generation != 4 || kept.SealedTo != key || string(kept.Box) != string(box) {
+		t.Errorf("the kept box reads as %+v", kept)
+	}
+	if got := strings.Join(in.BusMinted, ","); !strings.Contains(got, "anchor.objects") {
+		t.Errorf("BusMinted is %v", in.BusMinted)
+	}
+	if in.BusMemberships["laptop"] != "sealed-membership" {
+		t.Errorf("BusMemberships is %v", in.BusMemberships)
+	}
+	if len(in.Licences) != 1 || in.Licences[0].Name != "claude" || in.Licences[0].Keys == nil {
+		t.Errorf("Licences read as %+v", in.Licences)
+	}
+}
+
+// 1383/AC4: the bus's user list is what busUserList gives for the machine that runs the bus, and the Input carries none when
+// no module of the shelf runs the bus.
+func TestTheBusUsersAreWhatTheControllerComposesForTheMachineThatRunsTheBus(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if in.BusUsers != "" || len(in.BusMissing) != 0 {
+		t.Fatalf("a mesh whose shelf runs no bus carries a bus user list: %q %v", in.BusUsers, in.BusMissing)
+	}
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	register(t, open, bus)
+	if err := open.inventory.SeedBusUser(ctx, inventory.BusUser{Username: "controller", Kind: "controller"}, "pw"); err != nil {
+		t.Fatal(err)
+	}
+	in, err = readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	list, missing, _ := busUserList(ctx, open.inventory, []catalogue.Manifest{bus})
+	if in.BusUsers != list || fmt.Sprint(in.BusMissing) != fmt.Sprint(missing) {
+		t.Errorf("the Input carries %q (%v); busUserList gives %q (%v)", in.BusUsers, in.BusMissing, list, missing)
+	}
+}
+
+// 1383/AC5: Built, CurrentBuilds and BuildIDs equal the inventory's Held, CurrentBuilds and BuildOf, and the serving key and
+// the certificate are the machine's.
+func TestTheAdaptersInputCarriesTheBuildsAndTheMachinesKey(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := inv.Held(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var wantBuilt []string
+	for repository := range held {
+		wantBuilt = append(wantBuilt, repository)
+	}
+	sort.Strings(wantBuilt)
+	if fmt.Sprint(in.Built) != fmt.Sprint(wantBuilt) && !(len(in.Built) == 0 && len(wantBuilt) == 0) {
+		t.Errorf("Built is %v, the inventory's %v", in.Built, wantBuilt)
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for module, b := range current {
+		if in.CurrentBuilds[module] != b.Commit {
+			t.Errorf("CurrentBuilds[%s] is %q, the inventory's %q", module, in.CurrentBuilds[module], b.Commit)
+		}
+	}
+	for module, byCommit := range in.BuildIDs {
+		for commit, build := range byCommit {
+			if want, _ := inv.BuildOf(ctx, module, commit); want != build {
+				t.Errorf("BuildIDs[%s][%s] is %q, the inventory's %q", module, commit, build, want)
+			}
+		}
+	}
+}
+
+// The lead's answer 4: where the mesh holds no credential for any bus user, the machine that runs the bus is refused with
+// busUserList's words (the controller's composition refused it), the Input still builds, and another machine composes.
+func TestTheBusMachineIsRefusedWhereNoUserHasACredentialAndTheOthersCompose(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	register(t, open, bus)
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "anchor", "nats"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := composeQuestion(ctx, open, "anchor", compose.Foreseeing, false); err == nil ||
+		!strings.Contains(err.Error(), "not one user has a credential") {
+		t.Fatalf("the bus machine is composed: %v", err)
+	}
+	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil {
+		t.Fatalf("a machine that does not run the bus is refused: %v", err)
+	}
+}
diff --git a/cmd/mesh-controller/compose_input_integration_test.go b/cmd/mesh-controller/compose_input_integration_test.go
new file mode 100644
index 00000000..6e4f190c
--- /dev/null
+++ b/cmd/mesh-controller/compose_input_integration_test.go
@@ -0,0 +1,329 @@
+//go:build integration
+
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// 1382: the adapter's Input names, for every node, what the inventory answers for it, each compared with the read named
+// beside the field in go/compose/input.go (novox/hq ADR 0453 clause 3).
+func TestTheAdaptersInputNamesWhatTheInventoryAnswersForEachNode(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if err := inv.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.PortFor(ctx, "laptop", "files", 8080, false); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	shelf, err := inv.Catalogue(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in.Catalogue, shelf) {
+		t.Error("the Input's Catalogue is not the shelf the inventory holds")
+	}
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(in.Nodes) != len(nodes) {
+		t.Fatalf("the Input names %d node(s), the inventory has %d", len(in.Nodes), len(nodes))
+	}
+	places, err := inv.Overlays(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, record := range nodes {
+		n, ok := nodeOf(in.Input, record.Name)
+		if !ok {
+			t.Fatalf("%s is not in the Input", record.Name)
+		}
+		for _, p := range places {
+			if p.Name == record.Name {
+				if want := (compose.Place{Key: p.Key, Endpoint: p.Endpoint, Site: p.Site, Hub: p.Hub, Address: p.Address}); n.Place != want {
+					t.Errorf("%s: Place is %+v, the inventory's %+v", record.Name, n.Place, want)
+				}
+			}
+		}
+		assigned, _ := inv.Assigned(ctx, record.Name)
+		if !reflect.DeepEqual(n.Assigned, assigned) {
+			t.Errorf("%s: Assigned is %v, the inventory's %v", record.Name, n.Assigned, assigned)
+		}
+		caps, _ := inv.ProfileOf(ctx, record.Name)
+		if !reflect.DeepEqual(n.Capabilities, caps) {
+			t.Errorf("%s: Capabilities are %v, the inventory's %v", record.Name, n.Capabilities, caps)
+		}
+		domain, _ := inv.PublicDomainOf(ctx, record.Name)
+		if n.PublicDomain != domain {
+			t.Errorf("%s: PublicDomain is %q, the inventory's %q", record.Name, n.PublicDomain, domain)
+		}
+		if n.Account != record.Account || n.AccountHome != record.AccountHome || n.AgentAccount != record.AgentAccount ||
+			n.AgentAccountHome != record.AgentAccountHome || n.Adopted != record.Adopted {
+			t.Errorf("%s: the accounts or the mode differ from the inventory's: %+v", record.Name, n)
+		}
+		pins, _ := inv.PinsFor(ctx, record.Name)
+		if len(pins) != len(n.Pins) || (len(pins) > 0 && !reflect.DeepEqual(n.Pins, pins)) {
+			t.Errorf("%s: Pins are %v, the inventory's %v", record.Name, n.Pins, pins)
+		}
+		bound, _ := inv.BindingsFor(ctx, record.Name)
+		if len(bound) != len(n.Bound) || (len(bound) > 0 && !reflect.DeepEqual(n.Bound, bound)) {
+			t.Errorf("%s: Bound is %v, the inventory's %v", record.Name, n.Bound, bound)
+		}
+		key, _ := inv.SealingKeyOf(ctx, record.Name)
+		if n.SealingKey != key {
+			t.Errorf("%s: SealingKey is %q, the inventory's %q", record.Name, n.SealingKey, key)
+		}
+		ports, _ := inv.PortsFor(ctx, record.Name)
+		want := map[string]map[int]int{}
+		for _, a := range ports {
+			if want[a.Module] == nil {
+				want[a.Module] = map[int]int{}
+			}
+			want[a.Module][a.Wanted] = a.Machine
+		}
+		if len(want) != len(n.Ports) || (len(want) > 0 && !reflect.DeepEqual(n.Ports, want)) {
+			t.Errorf("%s: Ports are %v, the inventory's %v", record.Name, n.Ports, want)
+		}
+		// The settings of every module it resolves to, layer for layer.
+		resolved, err := compose.Resolve(in.Input, record.Name)
+		if err != nil {
+			continue
+		}
+		for _, m := range resolved.Plan.Modules {
+			layers, err := inv.SettingsFor(ctx, record.Name, m.Module)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(layers) != len(n.Settings[m.Module]) || (len(layers) > 0 && !reflect.DeepEqual(n.Settings[m.Module], layers)) {
+				t.Errorf("%s: the settings of %s are %v, the inventory's %v", record.Name, m.Module, n.Settings[m.Module], layers)
+			}
+		}
+	}
+	if domain := nodeDomain(in.Input, "anchor"); domain != "example.test" {
+		t.Errorf("anchor's PublicDomain is %q", domain)
+	}
+	if got := nodePorts(in.Input, "laptop"); got["files"][8080] == 0 {
+		t.Errorf("laptop's port for files:8080 is not in the Input: %v", got)
+	}
+}
+
+func nodeDomain(in compose.Input, name string) string {
+	n, _ := nodeOf(in, name)
+	return n.PublicDomain
+}
+
+func nodePorts(in compose.Input, name string) map[string]map[int]int {
+	n, _ := nodeOf(in, name)
+	return n.Ports
+}
+
+// 1382/AC2: a node keeping a recorded module at the build it runs has that module in Kept and KeptBuilds, and the Input's
+// Catalogue is the current shelf, not the kept manifest (R4a review round 1, finding 1).
+func TestANodeKeepingARecordedBuildHasItInKeptAndTheCatalogueStaysCurrent(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	start := time.Now().Add(-time.Hour)
+	image := "registry.invalid:5000/postgres/server@sha256:" + strings.Repeat("a", 64)
+	for _, b := range []link.BuildResult{
+		aContainerBuild(t, "postgres", "c1111111", catalogue.PolicyRecord, start, map[string][2]string{"server": {image, ""}}),
+	} {
+		if _, _, err := takeIn(ctx, inv, asTheOperator(t, inv, b)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := inv.Assign(ctx, "anchor", "postgres"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor", map[string]string{"postgres": "c1111111"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := takeIn(ctx, inv, aContainerBuild(t, "postgres", "c2222222", catalogue.PolicyRecord, start.Add(time.Minute),
+		map[string][2]string{"server": {image, "runtime"}})); err != nil {
+		t.Fatal(err)
+	}
+
+	// A send that is not a person's push keeps the build the machine runs.
+	in, err := readComposeInput(keepingRecorded(ctx), open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	anchor, _ := nodeOf(in.Input, "anchor")
+	if anchor.KeptBuilds["postgres"] != "c1111111" {
+		t.Fatalf("anchor keeps %v, want postgres at c1111111", anchor.KeptBuilds)
+	}
+	kept, found := anchor.Kept["postgres"]
+	if !found {
+		t.Fatalf("the kept manifest of postgres is not in anchor's Kept: %v", anchor.Kept)
+	}
+	current, err := inv.Catalogue(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in.Catalogue["postgres"], current["postgres"]) {
+		t.Error("the Input's Catalogue is not the current shelf")
+	}
+	if reflect.DeepEqual(kept, current["postgres"]) {
+		t.Error("the kept manifest is the current one: nothing is kept")
+	}
+	if laptop, _ := nodeOf(in.Input, "laptop"); len(laptop.Kept) != 0 || len(laptop.KeptBuilds) != 0 {
+		t.Errorf("laptop keeps what only anchor runs: %v", laptop.KeptBuilds)
+	}
+
+	// A person's push keeps nothing.
+	pushed, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a, _ := nodeOf(pushed.Input, "anchor"); len(a.Kept) != 0 || len(a.KeptBuilds) != 0 {
+		t.Errorf("a person's push keeps %v", a.KeptBuilds)
+	}
+}
+
+// 1382/AC3: the seats on record, the tunnels, the adopted tunnel, its carried peers and the nodes joining equal the
+// inventory's answers; the range and the suffix are read from the environment once, here.
+func TestTheAdaptersInputCarriesTheNetworkAsTheInventoryHoldsIt(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	t.Setenv(OverlayCIDRVar, "10.99.0.0/16")
+	t.Setenv("MESH_INTERNAL_SUFFIX", "mesh.test")
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	holdings, err := inv.Holdings(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(in.Holdings, holdings) {
+		t.Errorf("Holdings are %v, the inventory's %v", in.Holdings, holdings)
+	}
+	tunnels, err := inv.Tunnels(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tunnels) != len(in.Tunnels) {
+		t.Errorf("Tunnels are %v, the inventory's %v", in.Tunnels, tunnels)
+	}
+	if _, hub, _, err := inv.AdoptedTunnel(ctx); err != nil {
+		t.Fatal(err)
+	} else if (hub == "") != (in.Adopted == nil) {
+		t.Errorf("Adopted is %v, the inventory's hub is %q", in.Adopted, hub)
+	}
+	carried, err := inv.CarriedPeers(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(carried) != len(in.CarriedPeers) {
+		t.Errorf("CarriedPeers are %v, the inventory's %v", in.CarriedPeers, carried)
+	}
+	joining, err := inv.NodesWithALiveToken(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(joining) != len(in.Joining) {
+		t.Errorf("Joining is %v, the inventory's %v", in.Joining, joining)
+	}
+	if in.OverlayCIDR != "10.99.0.0/16" || in.InternalSuffix != "mesh.test" {
+		t.Errorf("the range and the suffix are %q and %q", in.OverlayCIDR, in.InternalSuffix)
+	}
+	// Read once: what the environment says afterwards moves nothing already read.
+	t.Setenv(OverlayCIDRVar, "10.1.0.0/16")
+	if in.OverlayCIDR != "10.99.0.0/16" {
+		t.Error("the range moved with the environment")
+	}
+}
+
+// The lead's equality finding (build 1792487777757012513): a provider on one machine serves a fact that says ${setting:domain},
+// the setting is set for it, and a consumer on another machine takes that fact. The first pass of the adapter resolved every
+// node with no settings in the Input, so the served fact could not be settled and the whole Input failed. The settings are in
+// the Input before any node is resolved, and the Input builds, with the same plan for the consumer as the controller's own
+// composition. It failed first, with the finding's words.
+func TestAServedFactThatSaysASettingIsResolvedWithTheSettingInTheInput(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
+		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
+		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
+	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
+	// The setting is there before the machines are assigned: an assignment resolves the mesh, and a served fact that says
+	// ${setting:domain} resolves only with it.
+	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatalf("the Input cannot be built: %v", err)
+	}
+	if anchor, _ := nodeOf(in.Input, "anchor"); len(anchor.Settings["step-ca"]) == 0 {
+		t.Fatalf("the Input does not carry the setting of the provider: %v", anchor.Settings)
+	}
+	oldPlan, _, err := resolveNode(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	newPlan, _, err := resolveNode(withInputCache(ctx), open, "laptop")
+	if err != nil {
+		t.Fatalf("the consumer does not resolve: %v", err)
+	}
+	if !reflect.DeepEqual(oldPlan.Needs, newPlan.Needs) {
+		t.Errorf("the consumer's needs are %+v, the controller's own %+v", newPlan.Needs, oldPlan.Needs)
+	}
+	t.Logf("a served fact that says a setting resolves with the setting in the Input: the Input builds and the consumer's needs equal planFor's")
+}
+
+// A setting that nothing sets, in a fact a provider serves, is not the adapter's to hide: the controller's own composition
+// refuses it as well (theRestOfTheMesh returns servedOnNode's error), and the adapter refuses with the same words rather than
+// building an Input that composes a placeholder.
+func TestAServedFactThatSaysAnUnsetSettingIsRefusedAsTheControllerRefusesIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
+		Provides: []catalogue.Offer{{Name: "acme-ca", Scope: catalogue.ScopeMesh}},
+		Serves:   map[string]map[string]any{"acme-ca": {"domain": "${setting:domain}"}}})
+	register(t, open, catalogue.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}})
+	// Assigned with the setting there, then the setting is cleared: the mesh the controller holds when someone clears it.
+	if err := open.inventory.KeepSettings(ctx, "", "step-ca", map[string]any{"domain": "example.test"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "laptop", "route-proxy"); err != nil {
+		t.Fatal(err)
+	}
+	if err := open.inventory.ClearSettings(ctx, "", "step-ca"); err != nil {
+		t.Fatal(err)
+	}
+	_, _, oldErr := resolveNode(ctx, open, "laptop")
+	_, newErr := readComposeInput(ctx, open)
+	if (oldErr == nil) != (newErr == nil) {
+		t.Fatalf("the controller's composition says %v, the adapter says %v", oldErr, newErr)
+	}
+	if oldErr != nil && !strings.Contains(newErr.Error(), "nothing sets \"domain\"") {
+		t.Errorf("the adapter's words are %q, the controller's %q", newErr, oldErr)
+	}
+	t.Logf("an unset setting in a served fact is refused alike: the controller says %v, the adapter says %v", oldErr != nil, newErr != nil)
+}
diff --git a/cmd/mesh-controller/compose_made_integration_test.go b/cmd/mesh-controller/compose_made_integration_test.go
new file mode 100644
index 00000000..ba875ea0
--- /dev/null
+++ b/cmd/mesh-controller/compose_made_integration_test.go
@@ -0,0 +1,54 @@
+//go:build integration
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+)
+
+// made is what a send made in a store, by key and never by value: the machine ports given, the pair credentials and the
+// own secrets.
+type made struct {
+	Ports      []string
+	Pairs      []string
+	OwnSecrets []string
+}
+
+// madeIn is what a store holds that a send makes, by key and never by value.
+func madeIn(ctx context.Context, open *stores) (made, error) {
+	var out made
+	inv := open.inventory
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		return out, err
+	}
+	for _, n := range nodes {
+		ports, err := inv.PortsFor(ctx, n.Name)
+		if err != nil {
+			return out, err
+		}
+		for _, p := range ports {
+			out.Ports = append(out.Ports, fmt.Sprintf("%s %s:%d->%d", n.Name, p.Module, p.Wanted, p.Machine))
+		}
+		rows, err := inv.SecretsFrom(ctx, n.Name)
+		if err != nil {
+			return out, err
+		}
+		for _, s := range rows {
+			out.Pairs = append(out.Pairs, fmt.Sprintf("%s %s on %s from %s local=%s", s.Name, s.ConsumerModule, s.Consumer, n.Name, s.Local))
+		}
+	}
+	own, err := inv.OwnSecretRows(ctx)
+	if err != nil {
+		return out, err
+	}
+	for _, r := range own {
+		out.OwnSecrets = append(out.OwnSecrets, fmt.Sprintf("%s %s/%s (%s)", r.Node, r.Module, r.Name, r.Origin))
+	}
+	sort.Strings(out.Ports)
+	sort.Strings(out.Pairs)
+	sort.Strings(out.OwnSecrets)
+	return out, nil
+}
diff --git a/cmd/mesh-controller/compose_once_integration_test.go b/cmd/mesh-controller/compose_once_integration_test.go
new file mode 100644
index 00000000..16dd7c4c
--- /dev/null
+++ b/cmd/mesh-controller/compose_once_integration_test.go
@@ -0,0 +1,44 @@
+//go:build integration
+
+package main
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// 1382/AC5: composing every node of one operation builds the Input once; without an operation's cache, once for each.
+func TestComposingEveryNodeOfAnOperationBuildsTheInputOnce(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	built := 0
+	was := composeInputBuilt
+	composeInputBuilt = func() { built++ }
+	t.Cleanup(func() { composeInputBuilt = was })
+	ctx := withInputCache(t.Context())
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range nodes {
+		if _, _, err := resolveNode(ctx, open, n.Name); err != nil && !unresolvable(err) {
+			t.Fatal(err)
+		}
+		if _, _, err := composeQuestion(ctx, open, n.Name, compose.Reading, false); err != nil && !unresolvable(err) {
+			t.Fatal(err)
+		}
+	}
+	if _, err := generatorsOf(ctx, open); err != nil {
+		t.Fatal(err)
+	}
+	if built != 1 {
+		t.Fatalf("an operation over %d node(s) built the Input %d time(s)", len(nodes), built)
+	}
+	built = 0
+	if _, _, err := resolveNode(t.Context(), open, nodes[0].Name); err != nil && !unresolvable(err) {
+		t.Fatal(err)
+	}
+	if built != 1 {
+		t.Fatalf("a composition with no cache built the Input %d time(s)", built)
+	}
+}
diff --git a/cmd/mesh-controller/compose_perform.go b/cmd/mesh-controller/compose_perform.go
new file mode 100644
index 00000000..c71c4bfe
--- /dev/null
+++ b/cmd/mesh-controller/compose_perform.go
@@ -0,0 +1,259 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// perform makes what a composition named foreseen (novox/hq ADR 0453 clause 3, design 47 R4b, issue 1385).
+//
+// **The composition makes nothing; a send does.** mesh-sdk's composition over an Input names what the next send would make
+// (the ports it would assign, the credentials it would seal, the core boxes it would ask the vault for, the seats it would
+// pass on, the certificate it would issue) and stands in for each. A send composes, performs, reads the stores again and
+// composes again (send in compose_sdk.go), and refuses to send a declaration that still names anything foreseen. A question
+// (status, facts, probes, the merge gate's reading) never reaches this file.
+//
+// What is made is exactly what the controller's own composition made on the way to a declaration it was going to send:
+//   - every pair credential no row holds, for every machine that resolves, since planning one node resolved them all;
+//   - the seats the mesh passes on, with the hand act (not on a throwaway mesh, whose hand act has nowhere to go);
+//   - the machine ports the node's modules were given none for;
+//   - the node's own secrets, by the controller's own rules (a bus credential nobody issued was refused by the composition);
+//   - the core credentials, asked of the vault every send, so a rotated one reaches the machine;
+//   - the certificate of a machine that was never certified.
+//
+// perform returns whether it made or recorded anything: the reason the caller reads the stores again.
+func perform(ctx context.Context, open *stores, in *meshInput, node string, d compose.Declared) (bool, error) {
+	did := false
+	inv := open.inventory
+
+	// The seats passed on: recorded in the store with the controller's own hand act (ADR 0449 §4, issue 1317).
+	if len(d.Passes.Passes) > 0 {
+		var w io.Writer = os.Stderr
+		if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+			w = lw
+		}
+		for _, line := range d.Passes.Said {
+			fmt.Fprintln(w, line)
+		}
+		if performSeatPasses(ctx, seatPassingOn(inv, w), d.Passes.Passes) {
+			did = true
+		}
+	}
+
+	// Every pair credential the stores hold none for: made once and kept, and sealed to both ends before it was ever written
+	// down. The error is the one planFor met: the machine that needs it, and why none could be made.
+	for _, p := range in.wouldMake {
+		if err := makePair(ctx, inv, p); err != nil {
+			return did, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %w",
+				p.ConsumerModule, p.Consumer, p.Name, p.Provider, err)
+		}
+		did = true
+	}
+
+	// The ports this node's modules were given none for.
+	if len(d.ForeseenPorts) > 0 {
+		shelf, err := inv.Catalogue(ctx)
+		if err != nil {
+			return did, err
+		}
+		for _, one := range d.ForeseenPorts {
+			module, port, ok := strings.Cut(one, ":")
+			wanted, perr := strconv.Atoi(port)
+			if !ok || perr != nil {
+				return did, fmt.Errorf("the composition named a port the controller cannot read: %q", one)
+			}
+			fixed := false
+			for _, l := range nodeShelf(in, shelf, node)[module].Listens {
+				if l.Port == wanted {
+					fixed = l.Fixed
+				}
+			}
+			if _, err := inv.PortFor(ctx, node, module, wanted, fixed); err != nil {
+				return did, fmt.Errorf("%s needs %d reachable on %s and it could not be assigned: %w", module, wanted, node, err)
+			}
+			did = true
+		}
+	}
+
+	// The node's own secrets: a module's superuser password, an administrator, an account. The composition refused what the
+	// send refuses (a bus credential nobody issued, a given value under an old key).
+	for _, one := range d.StoodIn {
+		module, name, ok := strings.Cut(one, "/")
+		if !ok || strings.Contains(one, " ") {
+			continue // a grant's sealed copy, the certificate or the bus's list: made below or by nobody
+		}
+		if _, err := inv.SecretForModule(ctx, node, module, name); err != nil {
+			return did, err
+		}
+		did = true
+	}
+
+	// The certificate of a machine that was never certified: issued and kept, with the authority when there is none yet.
+	for _, one := range d.StoodIn {
+		if strings.HasPrefix(one, "the certificate and the authority of ") {
+			if _, _, err := certificateFor(ctx, open, node); err != nil {
+				return did, err
+			}
+			did = true
+			break
+		}
+	}
+	return did, nil
+}
+
+// makePair makes one pair credential by the controller's own read of it: the credential for the pair, or the provider's one
+// credential sealed to this consumer too. A credential only a person gives is never made (it is not a would-make).
+func makePair(ctx context.Context, inv *inventory.Inventory, p inventory.PairCredential) error {
+	var err error
+	switch p.Kind {
+	case inventory.PairShared:
+		_, err = inv.SharedSecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.ProviderModule, p.Local, p.Own)
+	case inventory.PairPlain:
+		_, err = inv.SecretFor(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.Local)
+	default:
+		return errors.New("a credential only a person gives is not made")
+	}
+	if inventory.IsNotGiven(err) {
+		return nil
+	}
+	return err
+}
+
+// stillForeseen says what a composed declaration still stands in for: the lists the composition names, and the stand-in itself
+// anywhere in the body (a pair credential's stand-in is not in any list). A declaration that has any is never sent.
+func stillForeseen(d compose.Declared) []string {
+	var left []string
+	left = append(left, d.Foreseen...)
+	left = append(left, d.StoodIn...)
+	for _, p := range d.ForeseenPorts {
+		left = append(left, "the port "+p)
+	}
+	for _, c := range d.CoreBoxesWanted {
+		left = append(left, "the vault's box for "+c.Module+"/"+c.Name)
+	}
+	for _, p := range d.Passes.Passes {
+		left = append(left, "the pass of "+p.Seat.Name+" to "+p.To.Module+" on "+p.To.Node)
+	}
+	if body, err := d.Body(); err == nil {
+		for _, marker := range []string{catalogue.ForeseenSealed, "asked of the vault by the next send", compose.ForeseenCertificate,
+			compose.ForeseenBusUsers} {
+			if strings.Contains(string(body), marker) {
+				left = append(left, "a stand-in: "+marker)
+			}
+		}
+	}
+	sort.Strings(left)
+	return slicesCompact(left)
+}
+
+func slicesCompact(in []string) []string {
+	var out []string
+	for _, s := range in {
+		if len(out) == 0 || out[len(out)-1] != s {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// nodeShelf is the shelf as one node composes its own set: the current one with each module it keeps at the build it runs put
+// in place of the current.
+func nodeShelf(in *meshInput, shelf map[string]catalogue.Manifest, node string) map[string]catalogue.Manifest {
+	n, _ := nodeOf(in.Input, node)
+	return shelfWith(shelf, n.Kept)
+}
+
+// prepareSend is what a send does before it composes, every send and whatever the composition would have named: the
+// controller's own composition did it on the way, so a module's file that names an own secret composes (mesh-sdk's
+// composition can stand in for none: a file naming a secret not made yet is refused in every mode), and the core's credentials
+// are asked of the vault on every send, so a rotated one reaches the machine and a silent vault is said (core_box.go).
+//
+//   - Each own secret of a module the node runs (not one handed to the provisioner, not one issued outside the mesh, not one a
+//     person gives) that no row holds is made, unless the composition would refuse it (a bus credential nobody issued): that
+//     refusal is the composition's to say, in its words.
+//   - The core's credentials are asked of the vault, the boxes newly answered are kept, and the modules the vault did not answer
+//     for with no box kept are returned: the controller seals those itself until the vault holds them (ADR 0396).
+func prepareSend(ctx context.Context, open *stores, node string) ([]string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	if in.refused[node] != nil {
+		return nil, nil // empty-on-error: refused alone for what it keeps; the composition that follows says so, in its words
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		return nil, nil // empty-on-error: it does not compose for its own reasons; the composition that follows says them
+	}
+	n, _ := nodeOf(in.Input, node)
+	hands := n.Stated && n.Contract >= compose.HandedContract
+	handing := catalogue.Rendering{Hands: hands, Provisioner: provisionerAccount(resolved.Plan)}
+	inv := open.inventory
+	did := false
+	if n.SealingKey != "" {
+		held := map[string]bool{}
+		for _, r := range in.OwnSecrets {
+			// Held only when sealed to the key the machine has now, or given by a person (which is not the mesh's
+			// to make again): a made row under an old key is re-made, as SecretForModule did.
+			if r.Node == node && (r.SealedTo == n.SealingKey || r.Origin == inventory.OriginAccepted) {
+				held[r.Module+"/"+r.Name] = true
+			}
+		}
+		for _, m := range resolved.Plan.Modules {
+			if handing.Handing(m) {
+				continue
+			}
+			plain := m.OwnSecrets.Plain()
+			names := make([]string, 0, len(plain))
+			for name := range plain {
+				names = append(names, name)
+			}
+			sort.Strings(names)
+			for _, name := range names {
+				if plain[name].IssuedBy == catalogue.IssuedOutside || held[m.Module+"/"+name] {
+					continue
+				}
+				switch name {
+				case "broker":
+					if !slices.Contains(in.BusMinted, node+"."+m.Module) {
+						continue
+					}
+				case compose.ProvisionerSecret:
+					if !slices.Contains(in.BusMinted, "provisioner."+node) {
+						continue
+					}
+				}
+				if _, err := inv.SecretForModule(ctx, node, m.Module, name); err == nil {
+					did = true
+				}
+			}
+		}
+	}
+	var byController []string
+	if n.Stated && n.Contract >= compose.VaultBoxContract {
+		boxes, err := coreBoxesFor(ctx, inv, node, resolved.Plan.Modules, func(m catalogue.Manifest) bool {
+			return handing.Handing(m)
+		}, true)
+		if err != nil {
+			return nil, err
+		}
+		did = did || len(boxes.keep) > 0
+		byController = boxes.byController
+	}
+	if did {
+		// What was made is in the stores now: the composition reads them afresh.
+		forgetInput(ctx)
+	}
+	return byController, nil
+}
diff --git a/cmd/mesh-controller/compose_perform_integration_test.go b/cmd/mesh-controller/compose_perform_integration_test.go
new file mode 100644
index 00000000..d8aa9bad
--- /dev/null
+++ b/cmd/mesh-controller/compose_perform_integration_test.go
@@ -0,0 +1,235 @@
+//go:build integration
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+func aWebModule() catalogue.Manifest {
+	return catalogue.Manifest{Module: "web", Version: "1",
+		Listens:    []catalogue.Listening{{Port: 8080, From: catalogue.FromEverywhere}},
+		OwnSecrets: catalogue.OwnSecrets{"admin": {Path: "/etc/web/admin"}},
+		Resources: []map[string]any{
+			{"id": "server", "type": "container", "name": "web", "ports": []any{"8080"},
+				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
+		}}
+}
+
+// 1385/AC1: a port the composition names foreseen is allocated with the inventory's PortFor for that module and port, a second
+// composition names it no more, and the number is the one the controller's own Allocating composition gives in the same store.
+func TestPerformAllocatesAForeseenPortAndTheNumberIsTheControllers(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(d.ForeseenPorts) != 1 || d.ForeseenPorts[0] != "web:8080" {
+		t.Fatalf("the composition names the ports %v foreseen, want web:8080", d.ForeseenPorts)
+	}
+	did, err := perform(ctx, open, in, "laptop", d)
+	if err != nil || !did {
+		t.Fatalf("perform did %v: %v", did, err)
+	}
+	held, err := open.inventory.PortsFor(ctx, "laptop")
+	if err != nil || len(held) != 1 || held[0].Module != "web" || held[0].Wanted != 8080 {
+		t.Fatalf("the port perform allocated reads %+v: %v", held, err)
+	}
+	in, err = readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing); err != nil || len(again.ForeseenPorts) != 0 {
+		t.Fatalf("a second composition names %v foreseen: %v", again.ForeseenPorts, err)
+	}
+	// The number is the one the controller allocates in the same store.
+	plan, settings, err := resolveNode(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	old, err := declarationFor(ctx, open, "laptop", plan, settings)
+	if err != nil {
+		t.Fatal(err)
+	}
+	after, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := portsOf(after.Resources), portsOf(old.Resources); got != want {
+		t.Fatalf("the declaration publishes %s; the controller's allocation publishes %s", got, want)
+	}
+}
+
+func portsOf(resources []map[string]any) string {
+	var out []string
+	for _, r := range resources {
+		if r["type"] == "container" {
+			out = append(out, fmt.Sprint(r["name"], r["ports"]))
+		}
+	}
+	return strings.Join(out, ";")
+}
+
+// 1385/AC2: an own secret named foreseen is made with SecretForModule, and a pair credential the Input names would-make is
+// made as planFor chose; both exist after the send's composition and a second composition names neither.
+func TestPerformMakesTheOwnSecretsAndThePairCredentialsTheCompositionNamed(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aWebModule())
+	register(t, open, aConsumerOfTheBucket("reports"))
+	for _, m := range []string{"web", "reports"} {
+		if _, err := assign(ctx, open, "laptop", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, err := madeIn(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	declared, err := composeSend(ctx, open, "laptop")
+	if err != nil {
+		t.Fatalf("the send is refused: %v", err)
+	}
+	if len(declared.foreseen) != 0 {
+		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
+	}
+	after, err := madeIn(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	madeNow := func(have, was []string) []string {
+		seen := map[string]bool{}
+		for _, s := range was {
+			seen[s] = true
+		}
+		var out []string
+		for _, s := range have {
+			if !seen[s] {
+				out = append(out, s)
+			}
+		}
+		return out
+	}
+	if got := madeNow(after.OwnSecrets, before.OwnSecrets); len(got) != 1 || !strings.Contains(got[0], "web/admin") {
+		t.Errorf("the own secrets made are %v, want laptop web/admin", got)
+	}
+	if got := madeNow(after.Pairs, before.Pairs); len(got) != 1 || !strings.Contains(got[0], "reports") {
+		t.Errorf("the pair credentials made are %v, want the one of reports", got)
+	}
+	// And the credential is the one a second composition reads as held.
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(in.wouldMake) != 0 {
+		t.Errorf("after the send the next send would still make %v", in.wouldMake)
+	}
+	if _, err := inv.SecretsFrom(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 1385/AC3 (the lead's answer 1): with the vault unreachable and no box of the credential kept, the send carries the
+// controller's own seal for it (ADR 0396), says so as a condition, and keeps no box.
+func TestAVaultThatIsSilentSealsTheSendByTheControllerWhereNoBoxIsKept(t *testing.T) {
+	open, vault := aCoreMesh(t, link.VaultBoxContract)
+	vault.silent = errors.New("no responders")
+	declared, err := composeSend(t.Context(), open, "laptop")
+	if err != nil {
+		t.Fatalf("the send is refused: %v", err)
+	}
+	f := clientsBroker(declared.Resources)
+	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
+		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
+	}
+	if len(declared.foreseen) != 0 {
+		t.Fatalf("the declaration still names %v foreseen", declared.foreseen)
+	}
+	if c, found := vaultSilence(t, "laptop"); !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
+		t.Fatalf("no condition says why: %+v", c)
+	}
+	kept, err := open.inventory.KeptCoreBoxes(t.Context(), "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(kept["mesh-provisioner-client"]) != 0 {
+		t.Fatalf("a box was kept for a credential the vault never boxed: %v", kept)
+	}
+}
+
+// 1385/AC6: perform is idempotent: a second send's composition over the stores it left makes and records nothing.
+func TestAFinishedSendMakesNothingTheSecondTime(t *testing.T) {
+	open, _ := aMeshWithSecrets(t)
+	ctx := t.Context()
+	register(t, open, aWebModule())
+	if _, err := assign(ctx, open, "laptop", "web"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	before := tableState(t, open.inventory)
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	for k, v := range tableState(t, open.inventory) {
+		if before[k] != v {
+			t.Errorf("a second send of the same machine moved %s", k)
+		}
+	}
+}
+
+// Review round 1, finding 1: a machine that rejoined with a new sealing key keeps its made rows sealed to the old key. A
+// send re-makes them for the new key, as SecretForModule did on main, and the file naming the secret is not refused.
+func TestASendReMakesAnOwnSecretSealedToAKeyTheMachineNoLongerHas(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aBot("bot", false))
+	if _, err := assign(ctx, open, "laptop", "bot"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("the first send is refused: %v", err)
+	}
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("a machine that rejoined cannot be sent to: %v", err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n, _ := nodeOf(in.Input, "laptop")
+	found := false
+	for _, r := range in.OwnSecrets {
+		if r.Node == "laptop" && r.Module == "bot" && r.Name == "token" {
+			found = true
+			if r.SealedTo != n.SealingKey {
+				t.Fatalf("the own secret is still sealed to a key the machine no longer has")
+			}
+		}
+	}
+	if !found {
+		t.Fatal("the own secret has no row")
+	}
+}
diff --git a/cmd/mesh-controller/compose_sdk.go b/cmd/mesh-controller/compose_sdk.go
new file mode 100644
index 00000000..56653cf5
--- /dev/null
+++ b/cmd/mesh-controller/compose_sdk.go
@@ -0,0 +1,500 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"sync"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/validate"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// The controller's composition on mesh-sdk's (novox/hq ADR 0453 clause 3, design 47 R4b, issues 1386 to 1388): every
+// caller that planned or composed a node reads the Input once for its operation (compose_input.go), asks the SDK to
+// compose over it, and, when it sends, performs what the composition names foreseen (compose_perform.go) and composes again.
+
+// inputCacheKey carries an operation's Input in its context, so the planning of every node of one verb reads the stores once.
+type inputCacheKey struct{}
+
+type inputCache struct {
+	mu sync.Mutex
+	by map[string]*meshInput
+}
+
+// withInputCache is ctx for an operation: the Input read for it is kept until a send changes what it read. A context that
+// carries none reads the stores for each composition, which is correct and slow.
+func withInputCache(ctx context.Context) context.Context {
+	if _, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
+		return ctx
+	}
+	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
+}
+
+// freshInput is ctx for one composition whose Input is read afresh and kept only until the composition makes something: a
+// send that is composed after another one made and recorded things (a push's machines, one after the other).
+func freshInput(ctx context.Context) context.Context {
+	return context.WithValue(ctx, inputCacheKey{}, &inputCache{by: map[string]*meshInput{}})
+}
+
+// keptSignature is what the Input read depends on in ctx: which recorded modules each machine keeps at the build it runs
+// (recorded_kept.go), so an Input read for a person's push is never taken for one read for a gated send.
+func keptSignature(ctx context.Context) string {
+	skip, on := keptExcept(ctx)
+	var names []string
+	for m := range skip {
+		names = append(names, m)
+	}
+	sort.Strings(names)
+	every, _ := ctx.Value(keepEveryBuildKey{}).(string)
+	settings, _ := ctx.Value(keepForSettingsKey{}).(string)
+	return fmt.Sprintf("kept=%v;except=%v;every=%s;settings=%s", on, names, every, settings)
+}
+
+// inputFor is the Input for ctx's operation.
+func inputFor(ctx context.Context, open *stores) (*meshInput, error) {
+	cache, ok := ctx.Value(inputCacheKey{}).(*inputCache)
+	if !ok {
+		return readComposeInput(ctx, open)
+	}
+	sig := keptSignature(ctx)
+	cache.mu.Lock()
+	defer cache.mu.Unlock()
+	if in := cache.by[sig]; in != nil {
+		return in, nil
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	cache.by[sig] = in
+	return in, nil
+}
+
+// forgetInput drops what the operation read, because a send made or recorded something it read.
+func forgetInput(ctx context.Context) {
+	if cache, ok := ctx.Value(inputCacheKey{}).(*inputCache); ok {
+		cache.mu.Lock()
+		cache.by = map[string]*meshInput{}
+		cache.mu.Unlock()
+	}
+}
+
+// resolveNode works out everything a node should run, from what was assigned to it (planFor on the SDK): over the Input,
+// writing nothing. A failure to compose the node's own modules is marked notResolvable, as planFor marked it; every other
+// failure is returned as it is.
+func resolveNode(ctx context.Context, open *stores, node string) (catalogue.Resolution, catalogue.SettingsBy, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
+	if err := in.refused[node]; err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		if compose.IsUnresolvable(err) {
+			return catalogue.Resolution{}, nil, notResolvable{err}
+		}
+		return catalogue.Resolution{}, nil, err
+	}
+	logUnheld(node, resolved.Plan.Unheld)
+	return resolved.Plan, resolved.Settings, nil
+}
+
+// generatorsOf is what every node's declaration is composed with, over the whole mesh (generators on the SDK).
+func generatorsOf(ctx context.Context, open *stores) (map[string]catalogue.Generator, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, err
+	}
+	return compose.Generators(in.Input)
+}
+
+// renderingOf is what a machine is rendered with as a question reads it (nothing made), with the private network: what the
+// filter's rules, the roster and the like are derived from.
+func renderingOf(ctx context.Context, open *stores, node string) (catalogue.Rendering, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.Rendering{}, err
+	}
+	rendered, err := compose.Render(in.Input, node, compose.Reading)
+	if err != nil {
+		return catalogue.Rendering{}, markUnresolvable(err)
+	}
+	with := rendered.Rendering
+	if with.Generators, err = compose.Generators(in.Input); err != nil {
+		return catalogue.Rendering{}, err
+	}
+	return with, nil
+}
+
+// whoResolvesOn is the machines whose resolution answers a requirement, and why the others did not (whoResolves over the
+// Input): by what a module provides, not by its name. A machine whose set does not compose is in refused, said; one the mesh
+// could not be asked about is an error, never a refusal (novox/hq 04-ISSUES/152).
+func whoResolvesOn(ctx context.Context, open *stores, requirement string) (map[string]bool, map[string]string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return nil, nil, err
+	}
+	on := map[string]bool{}
+	refused := map[string]string{}
+	for _, n := range in.sortedNodes() {
+		if err := in.refused[n.Name]; err != nil {
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		resolved, err := compose.Resolve(in.Input, n.Name)
+		switch {
+		case compose.IsUnresolvable(err):
+			refused[n.Name] = err.Error()
+			continue
+		case err != nil:
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, offered := range m.Offers() {
+				if offered == requirement {
+					on[n.Name] = true
+				}
+			}
+		}
+	}
+	return on, refused, nil
+}
+
+// sortedNodes is the Input's nodes by name, the order the controller reads them in.
+func (in *meshInput) sortedNodes() []compose.Node {
+	out := append([]compose.Node(nil), in.Nodes...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// composeQuestion composes a node's declaration as a question asks it: nothing is made, and what a send would make is a
+// stand-in (Foreseeing) or left out (Reading). It also answers what the node-engine's validator refuses of it. The lines the
+// composition found are said where the controller says its own (standard error, or the writer an act gave).
+//
+// withOrder says the declaration carries the order it was last sent under (composedAndValidated's, which a comparison with the
+// last send needs); without it the order is none, as declarationWith left it for the sender to stamp.
+func composeQuestion(ctx context.Context, open *stores, node string, mode compose.Mode, withOrder bool) (sendable, []string, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	if err := in.refused[node]; err != nil {
+		return sendable{}, nil, err
+	}
+	d, problems, err := compose.ComposeIn(in.Input, node, mode)
+	if err != nil {
+		return sendable{}, nil, markUnresolvable(err)
+	}
+	if err := refusedBus(in, node); err != nil {
+		return sendable{}, nil, err
+	}
+	sayFound(ctx, d)
+	out := sendableOf(d)
+	if !withOrder {
+		out.Sequence, out.Epoch, out.Generation = 0, 0, 0
+	}
+	return out, problems, nil
+}
+
+// refusedBus is why the node cannot be composed because it runs the bus and the bus's user list cannot be: no user has a
+// credential, so the list would refuse every connection in the mesh (busUserList). The controller's own composition refused that
+// machine with those words; no other machine is refused for it. nil when nothing refuses the node.
+func refusedBus(in *meshInput, node string) error {
+	if in.busRefused == nil {
+		return nil
+	}
+	resolved, err := compose.Resolve(in.Input, node)
+	if err != nil {
+		return nil // it does not compose for its own reasons, which are said
+	}
+	for _, m := range resolved.Plan.Modules {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			return in.busRefused
+		}
+	}
+	return nil
+}
+
+// markUnresolvable is an error of a node whose own set does not compose, as planFor marked it.
+func markUnresolvable(err error) error {
+	if compose.IsUnresolvable(err) {
+		return notResolvable{err}
+	}
+	return err
+}
+
+// composeSend composes a node's declaration to send it, as the Allocating composition did: composed over what is read,
+// then what it named foreseen is made (perform), the stores are read again and it is composed again. A declaration that
+// still names anything foreseen is refused, said, and never sent.
+func composeSend(ctx context.Context, open *stores, node string) (sendable, error) {
+	declared, _, err := composeSendValidated(ctx, open, node)
+	return declared, err
+}
+
+// composeSendValidated is composeSend and what the node-engine's validator refuses of the declaration it composed, for the
+// merge gate's two passes (composedAndValidated in its Allocating mode).
+func composeSendValidated(ctx context.Context, open *stores, node string) (sendable, []string, error) {
+	// The core modules whose credentials the controller sealed itself because the vault was silent and no box was kept
+	// (ADR 0396): the composition stands in a vault box for each, and a send carries the controller's own seal instead.
+	byController, err := prepareSend(ctx, open, node)
+	if err != nil {
+		return sendable{}, nil, err
+	}
+	for attempt := 0; ; attempt++ {
+		in, err := inputFor(ctx, open)
+		if err != nil {
+			return sendable{}, nil, err
+		}
+		if err := in.refused[node]; err != nil {
+			return sendable{}, nil, err
+		}
+		d, problems, err := compose.ComposeIn(in.Input, node, compose.Foreseeing)
+		if err != nil {
+			return sendable{}, nil, markUnresolvable(err)
+		}
+		if err := refusedBus(in, node); err != nil {
+			return sendable{}, nil, err
+		}
+		if len(byController) > 0 {
+			if d, problems, err = sealedByTheController(in, node, d, byController); err != nil {
+				return sendable{}, nil, err
+			}
+		}
+		left := stillForeseen(d)
+		resolved, rerr := compose.Resolve(in.Input, node)
+		if rerr != nil {
+			return sendable{}, nil, markUnresolvable(rerr)
+		}
+		if len(resolved.Foreseen) > 0 {
+			left = append(left, resolved.Foreseen...)
+		}
+		if len(left) == 0 && len(in.wouldMake) == 0 {
+			sayFound(ctx, d)
+			out := sendableOf(d)
+			// The sender stamps the order it allots (order.stamp); a composition for a send carries none of its own.
+			out.Sequence, out.Epoch, out.Generation = 0, 0, 0
+			here, _ := nodeOf(in.Input, node)
+			out.Builds = buildsOf(in.Input, here, resolved.Plan, d.LeftOutWhy)
+			out.Bindings = boundToData(resolved.Plan, d.LeftOutWhy)
+			if len(d.Filled) > 0 {
+				if out.plans, err = handedPlans(in, node, resolved); err != nil {
+					return sendable{}, nil, err
+				}
+			}
+			return out, problems, nil
+		}
+		if attempt > 0 {
+			return sendable{}, nil, fmt.Errorf("%s was composed twice and still names what only a send makes (%s): nothing is sent "+
+				"that stands in for a value", node, strings.Join(left, "; "))
+		}
+		if _, err := perform(ctx, open, in, node, d); err != nil {
+			return sendable{}, nil, err
+		}
+		// What was made is in the stores now: the next read is a fresh one.
+		forgetInput(ctx)
+	}
+}
+
+// restOfTheMesh is what every other machine holds and offers (theRestOfTheMesh over the Input), for a question: the lines it
+// finds are said where the controller says its own, and a seat it would pass on is passed by the next send (perform), not by
+// the question. shelf, when given, replaces the Input's catalogue: a caller composing a change's shelf.
+func restOfTheMesh(ctx context.Context, open *stores, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
+	in, err := inputFor(ctx, open)
+	if err != nil {
+		return catalogue.World{}, err
+	}
+	input := in.Input
+	if shelf != nil {
+		input.Catalogue = shelf
+	}
+	world, passes, left, err := compose.TheRestOfTheMesh(input, exclude)
+	if err != nil {
+		return catalogue.World{}, err
+	}
+	var w io.Writer = os.Stderr
+	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+		w = lw
+	}
+	for _, l := range left {
+		fmt.Fprintln(w, l.String())
+	}
+	for _, line := range passes.Said {
+		fmt.Fprintln(w, line)
+	}
+	return world, nil
+}
+
+// restOfTheMeshOf is restOfTheMesh for a caller that holds the inventory alone: the other stores the Input reads are opened for
+// the call and let go of again.
+func restOfTheMeshOf(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
+	open := &stores{inventory: inv}
+	defer func() {
+		if open.licences != nil {
+			open.licences.Close()
+		}
+		if open.identity != nil {
+			open.identity.Close()
+		}
+	}()
+	return restOfTheMesh(ctx, open, shelf, exclude)
+}
+
+// sayFound says the lines a composition found while composing, once each: a machine left out of the rest of the mesh, a seat
+// that two claimants could take, the bus's users left out for want of a credential.
+func sayFound(ctx context.Context, d compose.Declared) {
+	if len(d.Said) == 0 {
+		return
+	}
+	var w io.Writer = os.Stderr
+	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
+		w = lw
+	}
+	for _, line := range d.Said {
+		fmt.Fprintln(w, line)
+	}
+}
+
+// sendableOf is a composed declaration as the controller's sends know it.
+func sendableOf(d compose.Declared) sendable {
+	out := sendable{Resources: d.Resources, Sequence: d.Sequence, Epoch: d.Epoch, Generation: d.Generation,
+		ReadsModules: d.ReadsModules, moduleOf: d.ModuleOf, buildIDs: d.BuildIDs, modules: d.Modules,
+		localNetwork: d.LocalNetwork, Received: d.Received, Mesh: d.Mesh, BusUsers: d.BusUsers,
+		LeftOut: d.LeftOut, leftOutWhy: d.LeftOutWhy, withheld: d.Withheld, unbound: d.Unbound, foreseen: d.Foreseen,
+		unplaced: d.Unplaced, handedOnly: d.HandedOnly, Filled: d.Filled, Provisioner: d.Provisioner,
+		requiredBy: d.RequiredBy}
+	if d.Adoption != nil {
+		out.Adoption = &adoptionEnvelope{Taken: d.Adoption.Taken, Untaken: d.Adoption.Untaken}
+	}
+	return out
+}
+
+// buildsOf is the build of each module a declaration for the node carries, as a send records it (novox/hq issue 259): the
+// module's current build for each module in it, the build it was last sent for one left out of it, and a module kept at the
+// build the machine runs carried at that one (ADR 0245). Never nil.
+func buildsOf(in compose.Input, node compose.Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
+	before := node.SentBuilds
+	if !node.SentKnown {
+		before = nil
+	}
+	out := map[string]string{}
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; left {
+			if was, kept := before[m.Module]; kept {
+				out[m.Module] = was
+			}
+			continue
+		}
+		out[m.Module] = in.CurrentBuilds[m.Module]
+	}
+	for m, was := range node.KeptBuilds {
+		if _, carried := out[m]; carried {
+			out[m] = was
+		}
+	}
+	return out
+}
+
+// handedPlans is the plan of each module handed to the provisioner, which the assignments mirror keeps with the send (design
+// 57 P6): the composition's declaration does not carry it, so it is composed from the same rendering again.
+func handedPlans(in *meshInput, node string, resolved compose.Resolved) (map[string]catalogue.Plan, error) {
+	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
+	if err != nil {
+		return nil, err
+	}
+	gens, err := compose.Generators(in.Input)
+	if err != nil {
+		return nil, err
+	}
+	with := rendered.Rendering
+	with.Generators = gens
+	composed, err := resolved.Plan.Compose(with)
+	if err != nil {
+		return nil, err
+	}
+	return composed.Plans, nil
+}
+
+// sealedByTheController is the declaration with the controller's own seal in place of the vault's box for each core module the
+// vault did not answer for and no box was kept for (core_box.go, ADR 0396): the file carries "sealed", as the controller's
+// composition sent it, until the vault holds the credential. What the composition stood in for the box is replaced and no longer
+// wanted; the validator is run again over the body.
+func sealedByTheController(in *meshInput, node string, d compose.Declared, modules []string) (compose.Declared, []string, error) {
+	rendered, err := compose.Render(in.Input, node, compose.Foreseeing)
+	if err != nil {
+		return d, nil, err
+	}
+	stood, _ := compactBox(catalogue.ForeseenVaultBox)
+	var wanted []compose.CoreBoxWanted
+	var foreseen []string
+	for _, w := range d.CoreBoxesWanted {
+		if !slices.Contains(modules, w.Module) {
+			wanted = append(wanted, w)
+			continue
+		}
+		sealed := rendered.Rendering.Needed[w.Module][w.Name]
+		if sealed == "" {
+			return d, nil, fmt.Errorf("%s/%s on %s has no seal of the controller's to carry until the vault holds it", w.Module, w.Name, node)
+		}
+		for _, r := range d.Resources {
+			box, isBox := r[catalogue.VaultSealedField]
+			// By the resource's id alone: its path is the manifest's with the machine's words filled in, and so is not the
+			// manifest's own.
+			if !isBox || r["id"] != w.Module+"."+catalogue.NeedID(w.Name) {
+				continue
+			}
+			if had, err := compactBox(box); err != nil || had != stood {
+				continue
+			}
+			delete(r, catalogue.VaultSealedField)
+			r["sealed"] = sealed
+		}
+	}
+	// A stand-in box that is left is said by its resource, never sent and never guessed at.
+	for _, r := range d.Resources {
+		if box, has := r[catalogue.VaultSealedField]; has {
+			if had, err := compactBox(box); err == nil && had == stood {
+				if id, _ := r["id"].(string); slices.ContainsFunc(modules, func(m string) bool { return strings.HasPrefix(id, m+".") }) {
+					return d, nil, fmt.Errorf("%s on %s still carries a stand-in for the vault's box, and the controller has "+
+						"no seal of its own for it", id, node)
+				}
+			}
+		}
+	}
+	d.CoreBoxesWanted = wanted
+	for _, f := range d.Foreseen {
+		module, _, _ := strings.Cut(f, "/")
+		if !slices.Contains(modules, module) {
+			foreseen = append(foreseen, f)
+		}
+	}
+	d.Foreseen = foreseen
+	body, err := d.Body()
+	if err != nil {
+		return d, nil, err
+	}
+	return d, validate.Declaration(body), nil
+}
+
+// compactBox is a value as the compact JSON it marshals to, so a box is compared by what it says and not by the type that
+// holds it.
+func compactBox(v any) (string, error) {
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	var out bytes.Buffer
+	if err := json.Compact(&out, raw); err != nil {
+		return "", err
+	}
+	return out.String(), nil
+}
diff --git a/cmd/mesh-controller/compose_sdk_test.go b/cmd/mesh-controller/compose_sdk_test.go
new file mode 100644
index 00000000..8d6a3cb8
--- /dev/null
+++ b/cmd/mesh-controller/compose_sdk_test.go
@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"reflect"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+)
+
+// A declaration as the SDK composes it is the one the controller sends, byte for byte, whatever it carries: the body is the
+// envelope's only marshaller on either side (design 47 R4b, issue 1386).
+func TestASendableIsTheComposedDeclarationByteForByte(t *testing.T) {
+	d := compose.Declared{
+		Resources: []map[string]any{{"id": "files.config", "type": "file"}, {"id": "mesh.hosts", "type": "file"}},
+		Sequence:  7, Epoch: 3, Generation: 9, ReadsModules: true,
+		ModuleOf: map[string]string{"files.config": "files"}, BuildIDs: map[string]string{"files": "b-1"},
+		Adoption: &compose.Adoption{Taken: []string{"files"}, Untaken: map[string][]string{"nats": {"nats.server"}}},
+		Filled:   []string{"/etc/files/filled.json"}, Provisioner: "mesh-provisioner",
+		LeftOut: []string{"cache"}, LeftOutWhy: map[string]string{"cache": "a setting cannot compose"},
+	}
+	want, err := d.Body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := sendableOf(d).Body()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != string(want) {
+		t.Fatalf("the controller would send\n%s\nand the composition made\n%s", got, want)
+	}
+	if empty, err := sendableOf(compose.Declared{}).Body(); err != nil || !strings.Contains(string(empty), `"owns_nothing":true`) {
+		t.Fatalf("an empty declaration is not deliberate: %s %v", empty, err)
+	}
+}
+
+// 1386: what a send records as carried: the current build of each module it carries, the build a module left out of it was last
+// sent (when that is known), and a module kept at the build the machine runs at that one. (The controller's carriedOn recorded
+// the same; mesh-sdk's node_test TestAModuleLeftOutKeepsTheBuildItWasLastSent holds the left-out case.)
+func TestWhatASendRecordsAsCarriedIsWhatTheControllerRecorded(t *testing.T) {
+	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "postgres"}, {Module: "files"}, {Module: "cache"}}}
+	leftOut := map[string]string{"cache": "a setting cannot compose"}
+	for name, c := range map[string]struct {
+		sent  map[string]string
+		known bool
+		kept  map[string]string
+		want  map[string]string
+	}{
+		"nothing sent": {want: map[string]string{"postgres": "p2", "files": "f2"}},
+		"sent and kept": {sent: map[string]string{"postgres": "p1", "cache": "c1", "files": "f1"}, known: true,
+			kept: map[string]string{"postgres": "p1"}, want: map[string]string{"postgres": "p1", "files": "f2", "cache": "c1"}},
+		"sent but not known":   {sent: map[string]string{"cache": "c1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
+		"kept a module not in": {known: true, kept: map[string]string{"mail": "m1"}, want: map[string]string{"postgres": "p2", "files": "f2"}},
+	} {
+		in := compose.Input{CurrentBuilds: map[string]string{"postgres": "p2", "files": "f2", "cache": "c2"}}
+		node := compose.Node{SentBuilds: c.sent, SentKnown: c.known, KeptBuilds: c.kept}
+		if got := buildsOf(in, node, plan, leftOut); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s: a send records %v, want %v", name, got, c.want)
+		}
+	}
+}
+
+// 1385: a declaration that stands in for a value anywhere is still foreseen, in a list the composition names or in the body
+// alone (a pair credential's stand-in is in no list); one that stands in for nothing is not. It failed first, before the body
+// was scanned.
+func TestADeclarationThatStandsInForAValueIsStillForeseen(t *testing.T) {
+	clean := compose.Declared{Resources: []map[string]any{{"id": "files.config", "type": "file", "content": "ok"}}}
+	if left := stillForeseen(clean); len(left) != 0 {
+		t.Fatalf("a declaration that stands in for nothing is foreseen: %v", left)
+	}
+	for name, d := range map[string]compose.Declared{
+		"an own secret":     {StoodIn: []string{"files/admin"}},
+		"a port":            {ForeseenPorts: []string{"files:80"}},
+		"a core box":        {CoreBoxesWanted: []compose.CoreBoxWanted{{Node: "anchor", Module: "mesh-vault", Name: "root"}}},
+		"a pass of a seat":  {Passes: compose.Passes{Passes: []catalogue.SeatPass{{Seat: catalogue.Seat{Name: "mesh-store"}}}}},
+		"a pair credential": {Resources: []map[string]any{{"id": "files.needs-db", "sealed": catalogue.ForeseenSealed}}},
+		"the certificate":   {Resources: []map[string]any{{"id": "proxy.cert", "content": compose.ForeseenCertificate}}},
+		"the bus's list":    {Resources: []map[string]any{{"id": "nats.users", "content": compose.ForeseenBusUsers}}},
+		"the vault's box":   {Resources: []map[string]any{{"id": "x", "box": catalogue.ForeseenVaultBox}}},
+	} {
+		if left := stillForeseen(d); len(left) == 0 {
+			t.Errorf("%s: a declaration that stands in for it is not foreseen", name)
+		}
+	}
+}
+
+// 1386: an Input read for a person's push is never the one read for a send that keeps recorded builds, and the cache is
+// emptied by what a send made.
+func TestAnInputIsCachedPerWhatItKeepsAndForgottenAfterASend(t *testing.T) {
+	ctx := withInputCache(context.Background())
+	plain := keptSignature(ctx)
+	kept := keptSignature(keepingRecorded(ctx))
+	bus := keptSignature(keepingRecorded(ctx, "nats"))
+	every := keptSignature(keepingEveryBuild(ctx, "anchor"))
+	for name, sig := range map[string]string{"a push": plain, "a kept send": kept, "the bus step": bus, "the grants step": every} {
+		for other, o := range map[string]string{"a push": plain, "a kept send": kept, "the bus step": bus, "the grants step": every} {
+			if name != other && sig == o {
+				t.Errorf("%s and %s read the same Input", name, other)
+			}
+		}
+	}
+	cache := ctx.Value(inputCacheKey{}).(*inputCache)
+	cache.by[plain] = &meshInput{}
+	forgetInput(ctx)
+	if len(cache.by) != 0 {
+		t.Fatal("what a send made left the Input it read in the cache")
+	}
+}
diff --git a/cmd/mesh-controller/composed_member_check_test.go b/cmd/mesh-controller/composed_member_check_test.go
index f5bbc15b..7943412f 100644
--- a/cmd/mesh-controller/composed_member_check_test.go
+++ b/cmd/mesh-controller/composed_member_check_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/composed_verdict_test.go b/cmd/mesh-controller/composed_verdict_test.go
index a8573833..f96bc00c 100644
--- a/cmd/mesh-controller/composed_verdict_test.go
+++ b/cmd/mesh-controller/composed_verdict_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/config_move.go b/cmd/mesh-controller/config_move.go
index 1b65621d..8052fae6 100644
--- a/cmd/mesh-controller/config_move.go
+++ b/cmd/mesh-controller/config_move.go
@@ -15,8 +15,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/config_moved_integration_test.go b/cmd/mesh-controller/config_moved_integration_test.go
index 7c930d12..f7a5b5cb 100644
--- a/cmd/mesh-controller/config_moved_integration_test.go
+++ b/cmd/mesh-controller/config_moved_integration_test.go
@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/overlay"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 func aConfiguredMesh(t *testing.T) (*stores, configuredMesh, map[string]map[string]any) {
diff --git a/cmd/mesh-controller/config_moved_test.go b/cmd/mesh-controller/config_moved_test.go
index 390a51e7..7aa2aa8c 100644
--- a/cmd/mesh-controller/config_moved_test.go
+++ b/cmd/mesh-controller/config_moved_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -127,21 +127,17 @@ type snapshotFacts = snapshot.Facts
 func toldEveryMachine(t *testing.T, open *stores, served map[string]map[string]any, on map[string][]string) map[string]string {
 	t.Helper()
 	ctx := t.Context()
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	shelf, err := open.inventory.Catalogue(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
 	told := map[string]string{}
 	for _, node := range fourMachines {
-		plan, settings, err := planFor(ctx, open, node)
+		plan, _, err := resolveNode(ctx, open, node)
 		if err != nil {
 			t.Fatalf("%s: %v", node, err)
 		}
-		with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Allocating)
+		with, err := madeAndRendered(ctx, open, node)
 		if err != nil {
 			t.Fatalf("%s: %v", node, err)
 		}
diff --git a/cmd/mesh-controller/core_box.go b/cmd/mesh-controller/core_box.go
index e3d1ac13..33c99192 100644
--- a/cmd/mesh-controller/core_box.go
+++ b/cmd/mesh-controller/core_box.go
@@ -13,10 +13,9 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
 )
 
 // The core's own credentials, sealed by the vault (novox/hq ADR 0349 §16, issue 755; the lead's decision on issue 755,
@@ -40,15 +39,6 @@ import (
 // the vault and the machine, cleared by the first send the vault answers whole. Only a machine with no sealing key, or
 // one whose key cannot be read, leaves its module out.
 
-// engineOpensVaultBox says whether a machine's node-engine opens the vault's box, by its own newest statement.
-func engineOpensVaultBox(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
-	stated, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return false, err
-	}
-	return had && stated.Contract >= link.VaultBoxContract, nil
-}
-
 // coreAnswer is the vault's `get` answer as the controller reads it: the name, the generation and the box, never
 // opened.
 type coreAnswer struct {
@@ -121,7 +111,7 @@ func sealingKeyPEM(raw string) (string, error) {
 // own seal where nothing was kept; on any other question, the kept box, or a stand-in the next send asks for. Pure: what to keep and what to
 // say is answered, not done.
 func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[string]map[string]inventory.CoreBox,
-	choosing Choosing, ask coreAsk) coreBoxes {
+	allocating bool, ask coreAsk) coreBoxes {
 	out := coreBoxes{sealed: map[string]map[string]json.RawMessage{}, notPlaced: map[string]string{}}
 	modules := make([]string, 0, len(core))
 	for m := range core {
@@ -143,7 +133,7 @@ func coreBoxesOf(node, sealingKey string, core map[string][]string, kept map[str
 		for _, name := range core[module] {
 			k, has := kept[module][name]
 			valid := has && k.SealedTo == sealingKey && len(k.Box) > 0
-			if choosing != Allocating {
+			if !allocating {
 				if valid {
 					boxes[name] = k.Box
 				} else {
@@ -218,10 +208,10 @@ var coreVault = func(ctx context.Context) coreAsk {
 
 // coreBoxesFor is coreBoxesOf for one machine, read from and kept in the store, and said on a send.
 func coreBoxesFor(ctx context.Context, inv *inventory.Inventory, node string, modules []catalogue.Manifest,
-	handed func(catalogue.Manifest) bool, choosing Choosing) (coreBoxes, error) {
+	handed func(catalogue.Manifest) bool, allocating bool) (coreBoxes, error) {
 	core := coreModulesOf(modules, handed)
 	if len(core) == 0 {
-		if choosing == Allocating {
+		if allocating {
 			settleVaultSilent(ctx, node)
 		}
 		return coreBoxes{}, nil
@@ -235,16 +225,16 @@ func coreBoxesFor(ctx context.Context, inv *inventory.Inventory, node string, mo
 		return coreBoxes{}, err
 	}
 	var ask coreAsk
-	if choosing == Allocating {
+	if allocating {
 		ask = coreVault(ctx)
 	}
-	out := coreBoxesOf(node, key, core, kept, choosing, ask)
+	out := coreBoxesOf(node, key, core, kept, allocating, ask)
 	for _, b := range out.keep {
 		if err := inv.KeepCoreBox(ctx, node, b); err != nil {
 			return coreBoxes{}, err
 		}
 	}
-	if choosing == Allocating {
+	if allocating {
 		sayVaultSilent(ctx, node, out)
 	}
 	return out, nil
diff --git a/cmd/mesh-controller/core_box_integration_test.go b/cmd/mesh-controller/core_box_integration_test.go
index 55660821..d26e0e56 100644
--- a/cmd/mesh-controller/core_box_integration_test.go
+++ b/cmd/mesh-controller/core_box_integration_test.go
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -96,7 +96,7 @@ func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
 func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsSealedByTheController(t *testing.T) {
 	open, vault := aCoreMesh(t, link.VaultBoxContract)
 	vault.silent = errors.New("no responders")
-	plan, settings, err := planFor(t.Context(), open, "laptop")
+	plan, settings, err := resolveNode(t.Context(), open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/core_box_test.go b/cmd/mesh-controller/core_box_test.go
index 4a6872de..1148d0a1 100644
--- a/cmd/mesh-controller/core_box_test.go
+++ b/cmd/mesh-controller/core_box_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
@@ -68,7 +68,7 @@ func TestReplay908(t *testing.T) {
 	key := "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 	core := map[string][]string{"nats": {"password"}}
 	ask := func(name, publicKey string) (coreAnswer, error) { return coreAnswer{}, errors.New("no responders") }
-	got := coreBoxesOf("novox", key, core, nil, Allocating, ask)
+	got := coreBoxesOf("novox", key, core, nil, true, ask)
 	if _, sealed := got.sealed["nats"]; sealed || len(got.notPlaced) != 0 {
 		t.Fatalf("nats is vault-sealed %v or not placed %v", got.sealed, got.notPlaced)
 	}
@@ -81,7 +81,7 @@ func TestReplay908(t *testing.T) {
 	}
 	// A kept box is still carried while the vault is silent.
 	kept := map[string]map[string]inventory.CoreBox{"nats": {"password": {SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
-	got = coreBoxesOf("novox", key, core, kept, Allocating, ask)
+	got = coreBoxesOf("novox", key, core, kept, true, ask)
 	if string(got.sealed["nats"]["password"]) != `{"v":1}` || len(got.byController) != 0 {
 		t.Fatalf("the kept box was not held: %+v", got)
 	}
@@ -99,17 +99,17 @@ func TestOnlyASendAsksTheVault(t *testing.T) {
 		t.Fatal("the vault was asked by a question that is not a send")
 		return coreAnswer{}, nil
 	}
-	for _, choosing := range []Choosing{Reading, Foreseeing} {
-		if got := coreBoxesOf("anchor", key, core, kept, choosing, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
+	for _, allocating := range []bool{false} {
+		if got := coreBoxesOf("anchor", key, core, kept, allocating, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
 			t.Errorf("read %s", got.sealed["nats"]["broker"])
 		}
-		if got := coreBoxesOf("anchor", key, core, nil, choosing, never); string(got.sealed["nats"]["broker"]) !=
+		if got := coreBoxesOf("anchor", key, core, nil, allocating, never); string(got.sealed["nats"]["broker"]) !=
 			string(catalogue.ForeseenVaultBox) {
 			t.Errorf("with none kept, read %s", got.sealed["nats"]["broker"])
 		}
 	}
 	// A box kept for another key of the machine is never carried.
-	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, Allocating,
+	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, true,
 		func(string, string) (coreAnswer, error) { return coreAnswer{}, errors.New("silent") })
 	if _, vaultSealed := other.sealed["nats"]; vaultSealed || !reflect.DeepEqual(other.byController, []string{"nats"}) {
 		t.Fatalf("a box sealed to the machine's old key was carried: %+v", other)
diff --git a/cmd/mesh-controller/credential_on_assign_test.go b/cmd/mesh-controller/credential_on_assign_test.go
index 9c8133a0..0cbc1262 100644
--- a/cmd/mesh-controller/credential_on_assign_test.go
+++ b/cmd/mesh-controller/credential_on_assign_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -40,7 +40,7 @@ func TestAssigningAModuleThatSpeaksOnTheBusNamesItsCredential(t *testing.T) {
 	}
 
 	// And the push refuses to send it, naming the same verb, rather than sealing a placeholder.
-	plan, settings, err := planFor(ctx, open, "laptop")
+	plan, settings, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/data.go b/cmd/mesh-controller/data.go
index 142e2164..15a808c9 100644
--- a/cmd/mesh-controller/data.go
+++ b/cmd/mesh-controller/data.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -152,6 +152,8 @@ type consumerCopy struct {
 
 // probeData is D13.
 func probeData(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	if d.js == nil {
 		return nil, errors.New("no bus to ask the machines over")
 	}
@@ -180,7 +182,7 @@ func probeData(ctx context.Context, d *doctor) ([]conditions.Observation, error)
 	}
 	var machines []*machine
 	for _, n := range nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
+		plan, _, err := resolveNode(ctx, open, n.Name)
 		if err != nil {
 			if ctx.Err() != nil {
 				return nil, ctx.Err()
@@ -849,7 +851,7 @@ func deleteRetiredData(ctx context.Context, conn *nats.Conn, open *stores, r inv
 		return fmt.Errorf("%s of %s on %s was never measured, so where it is was never said; nothing was deleted",
 			r.Item, r.Module, r.Machine)
 	}
-	if plan, _, err := planFor(ctx, open, r.Machine); err == nil {
+	if plan, _, err := resolveNode(ctx, open, r.Machine); err == nil {
 		for _, m := range plan.Modules {
 			if _, still := m.DataItem(r.Item); still && m.Module == r.Module {
 				return fmt.Errorf("%s runs on %s again and declares %s: it is not retired any more. Nothing was done",
diff --git a/cmd/mesh-controller/data_integration_test.go b/cmd/mesh-controller/data_integration_test.go
index 4d8a9853..68247082 100644
--- a/cmd/mesh-controller/data_integration_test.go
+++ b/cmd/mesh-controller/data_integration_test.go
@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/data_test.go b/cmd/mesh-controller/data_test.go
index 15dcf45e..a9589f77 100644
--- a/cmd/mesh-controller/data_test.go
+++ b/cmd/mesh-controller/data_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/novox/mesh-controller/internal/link"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
diff --git a/cmd/mesh-controller/deadletters.go b/cmd/mesh-controller/deadletters.go
index 74f22cb0..489256ee 100644
--- a/cmd/mesh-controller/deadletters.go
+++ b/cmd/mesh-controller/deadletters.go
@@ -9,8 +9,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/delivery.go b/cmd/mesh-controller/delivery.go
index c24b2f43..e8d35fd8 100644
--- a/cmd/mesh-controller/delivery.go
+++ b/cmd/mesh-controller/delivery.go
@@ -15,7 +15,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -1179,7 +1179,7 @@ func askGroupCheck(ctx context.Context, open *stores, group string, members []or
 	request.Check.Group = group
 	// A group's check is queued as ready when any member's pull request is marked ready.
 	request.Check.Ready = slices.ContainsFunc(members, func(m orderMember) bool { return m.Ready })
-	world, err := theRestOfTheMesh(ctx, open.inventory, shelfOf(entries), "")
+	world, err := restOfTheMesh(ctx, open, shelfOf(entries), "")
 	if err != nil {
 		return "", err
 	}
diff --git a/cmd/mesh-controller/delivery_changes.go b/cmd/mesh-controller/delivery_changes.go
index 2fb5f82f..0e2a2966 100644
--- a/cmd/mesh-controller/delivery_changes.go
+++ b/cmd/mesh-controller/delivery_changes.go
@@ -12,7 +12,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/delivery_conditions.go b/cmd/mesh-controller/delivery_conditions.go
index d5fefbe8..74b14082 100644
--- a/cmd/mesh-controller/delivery_conditions.go
+++ b/cmd/mesh-controller/delivery_conditions.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/delivery_conditions_test.go b/cmd/mesh-controller/delivery_conditions_test.go
index cb3176fa..c9533fac 100644
--- a/cmd/mesh-controller/delivery_conditions_test.go
+++ b/cmd/mesh-controller/delivery_conditions_test.go
@@ -13,8 +13,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/delivery_edges_test.go b/cmd/mesh-controller/delivery_edges_test.go
index 195aa2eb..b858720c 100644
--- a/cmd/mesh-controller/delivery_edges_test.go
+++ b/cmd/mesh-controller/delivery_edges_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/delivery_integration_test.go b/cmd/mesh-controller/delivery_integration_test.go
index ed85ec2f..399df3a8 100644
--- a/cmd/mesh-controller/delivery_integration_test.go
+++ b/cmd/mesh-controller/delivery_integration_test.go
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
@@ -122,7 +122,7 @@ func TestAMergeWaitsForItsDeliverysWordAndThePersonsWordWorksWithoutIt(t *testin
 	advanceHeld(ctx, open)
 	got, _ = inv.PlanByID(ctx, p.ID)
 	if got.Waiting() || !strings.HasPrefix(got.Delivery.By, "a person") || len(*asked) < 4 {
-		t.Fatalf("a person's word did not start the walk: %+v, asked %v", got.Delivery, *asked)
+		t.Fatalf("a person's word did not start the walk: %+v, asked %v, state %q, tier %d, note %q", got.Delivery, *asked, got.State, got.Tier, got.Note)
 	}
 
 	// The owner's stop: failed, said as stopped by it.
diff --git a/cmd/mesh-controller/delivery_test.go b/cmd/mesh-controller/delivery_test.go
index d7f1b0df..a3127130 100644
--- a/cmd/mesh-controller/delivery_test.go
+++ b/cmd/mesh-controller/delivery_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/dependents_test.go b/cmd/mesh-controller/dependents_test.go
index 48cf8d9b..05c306b1 100644
--- a/cmd/mesh-controller/dependents_test.go
+++ b/cmd/mesh-controller/dependents_test.go
@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/doctor_test.go b/cmd/mesh-controller/doctor_test.go
index 8f5b0506..4c9e116e 100644
--- a/cmd/mesh-controller/doctor_test.go
+++ b/cmd/mesh-controller/doctor_test.go
@@ -10,8 +10,8 @@ import (
 
 	"golang.org/x/net/dns/dnsmessage"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/epoch_send_test.go b/cmd/mesh-controller/epoch_send_test.go
index 9e138c3c..4fc2e5e4 100644
--- a/cmd/mesh-controller/epoch_send_test.go
+++ b/cmd/mesh-controller/epoch_send_test.go
@@ -42,12 +42,8 @@ func TestAMachineIsSentTheEpochOnlyOnceItSaysItReadsOne(t *testing.T) {
 	if err := inv.RecordReadsEpoch(ctx, anchor.ID, true); err != nil {
 		t.Fatal(err)
 	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	d := &bodiesDelivery{recordedDelivery: recordedDelivery{inv: inv}, bodies: map[string][]byte{}}
-	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, composeForPush(open, gens), d, "", nil); err != nil {
+	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, composeForPush(open), d, "", nil); err != nil {
 		t.Fatal(err)
 	}
 	carried := func(node string) (epoch float64, has bool) {
@@ -89,12 +85,8 @@ func TestNothingIsComposedOrSentWithoutTheLease(t *testing.T) {
 	was := epochForActs
 	epochForActs = func(context.Context) (uint64, error) { return 0, errors.New("this controller lost the lease") }
 	t.Cleanup(func() { epochForActs = was })
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	d := &bodiesDelivery{recordedDelivery: recordedDelivery{inv: open.inventory}, bodies: map[string][]byte{}}
-	refused, err := sendRound(ctx, open, []string{"anchor"}, composeForPush(open, gens), d, "", nil)
+	refused, err := sendRound(ctx, open, []string{"anchor"}, composeForPush(open), d, "", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/facts.go b/cmd/mesh-controller/facts.go
index f1f38f76..67bd4c07 100644
--- a/cmd/mesh-controller/facts.go
+++ b/cmd/mesh-controller/facts.go
@@ -14,13 +14,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/novox/mesh-host/validate"
-
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/artifacts"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -170,10 +169,15 @@ func factsStore(ctx context.Context, open *stores) (string, error) {
 	return address, nil
 }
 
+// writtenFormat is the format of the snapshot this controller writes: 1, the format its own reader knew before mesh-sdk's
+// go/facts took the type over (issue 1390, novox/hq ADR 0456). The readers (the merge gate, the check) read formats 1 and
+// 2; the writer moves to 2, which also carries each machine's grants and bindings, in a later release of its own.
+const writtenFormat = 1
+
 // gatherFacts composes one snapshot from the store: read only, nothing made, nothing sent.
 func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot.Facts, error) {
 	inv := open.inventory
-	f := snapshot.Facts{Format: snapshot.Format, Taken: time.Now().UTC(), Controller: snapshot.Build{Version: version}}
+	f := snapshot.Facts{Format: writtenFormat, Taken: time.Now().UTC(), Controller: snapshot.Build{Version: version}}
 	f.Versions.Bus = busVersion
 	storeVersion, err := inv.ServerVersion(ctx)
 	if err != nil {
@@ -263,7 +267,9 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 		f.Controller.Commit = c.Commit
 	}
 
-	gens, gensErr := generators(ctx, open)
+	// The Input every machine's declaration below is composed over is read once for the whole snapshot.
+	ctx = withInputCache(ctx)
+	_, gensErr := generatorsOf(ctx, open)
 	hostShelf := shelf[hostModule]
 	meshWide := map[string]bool{}
 	engines := map[string]bool{}
@@ -361,7 +367,7 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 				m.Settings = append(m.Settings, snapshot.Settings{Module: module, Values: scrub.Values(layer.Whole())})
 			}
 		}
-		m.Declaration = declarationFacts(ctx, open, n.Name, gens, gensErr, scrub)
+		m.Declaration = declarationFacts(ctx, open, n.Name, gensErr, scrub)
 		if ctx.Err() != nil {
 			return snapshot.Facts{}, ctx.Err()
 		}
@@ -456,14 +462,14 @@ func gatherFacts(ctx context.Context, open *stores, busVersion string) (snapshot
 
 // declarationFacts is how one machine's declaration composes now, as the next push would compose it and
 // without making anything (D1's composition), and whether the node-engine's validator takes it.
-func declarationFacts(ctx context.Context, open *stores, node string, gens map[string]catalogue.Generator,
-	gensErr error, scrub *snapshot.Scrubber) snapshot.Declaration {
+func declarationFacts(ctx context.Context, open *stores, node string, gensErr error,
+	scrub *snapshot.Scrubber) snapshot.Declaration {
 	var d snapshot.Declaration
 	if gensErr != nil {
 		d.Problems = []string{scrub.Text("the private network cannot be computed: " + oneLine(gensErr.Error()))}
 		return d
 	}
-	declared, problems, err := composedAndValidated(ctx, open, node, gens, Foreseeing)
+	declared, problems, err := composeQuestion(ctx, open, node, compose.Foreseeing, true)
 	if err != nil {
 		d.Problems = []string{scrub.Text(oneLine(err.Error()))}
 		return d
@@ -496,41 +502,6 @@ func declarationFacts(ctx context.Context, open *stores, node string, gens map[s
 	return d
 }
 
-// composedAndValidated composes one machine's declaration — as a push would (Allocating) or as the next
-// push will without making anything (Foreseeing) — with the order it was last sent, and runs the
-// node-engine's own validator over the body. An error is that it did not compose; problems are what the
-// validator refuses.
-func composedAndValidated(ctx context.Context, open *stores, node string, gens map[string]catalogue.Generator,
-	choosing Choosing) (sendable, []string, error) {
-	plan, settings, err := planFor(ctx, open, node)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	declared, err := declarationWith(ctx, open, node, plan, settings, gens, choosing)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	record, err := open.inventory.NodeByName(ctx, node)
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	if declared.Sequence, err = open.inventory.Sequence(ctx, record.ID); err != nil {
-		return sendable{}, nil, err
-	}
-	if declared.Epoch, err = open.inventory.SentEpoch(ctx, record.ID); err != nil {
-		return sendable{}, nil, err
-	}
-	// And the generation it was last sent, as the would-send is (novox/hq issue 234).
-	if declared.Generation, err = open.inventory.SentGeneration(ctx, record.ID); err != nil {
-		return sendable{}, nil, err
-	}
-	body, err := declared.Body()
-	if err != nil {
-		return sendable{}, nil, err
-	}
-	return declared, validate.Declaration(body), nil
-}
-
 // resourceNames are a declaration's resources as `type:id`, sorted.
 func resourceNames(resources []map[string]any) []string {
 	out := make([]string, 0, len(resources))
diff --git a/cmd/mesh-controller/facts_format_test.go b/cmd/mesh-controller/facts_format_test.go
new file mode 100644
index 00000000..b5583fcd
--- /dev/null
+++ b/cmd/mesh-controller/facts_format_test.go
@@ -0,0 +1,58 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
+)
+
+// 1390 (novox/hq ADR 0456): the snapshot this controller writes is format 1, and the reader it shares with the build seat
+// (mesh-sdk's go/facts) takes formats 1 and 2 and refuses one newer than it knows. The writer moves to format 2 in a release
+// of its own. It failed first with the controller's own reader, which refused format 2 as newer than it knew.
+func TestTheWriterWritesFormatOneAndTheReaderTakesBothFormats(t *testing.T) {
+	if writtenFormat != 1 {
+		t.Fatalf("the writer writes format %d, not 1", writtenFormat)
+	}
+	taken := time.Date(2026, 10, 20, 9, 0, 0, 0, time.UTC)
+	for format, want := range map[int]bool{1: true, 2: true, 3: false} {
+		body, err := (snapshot.Facts{Format: format, Taken: taken}).Encode()
+		if err != nil {
+			t.Fatal(err)
+		}
+		f, err := snapshot.Decode(body)
+		switch {
+		case want && err != nil:
+			t.Errorf("format %d is refused: %v", format, err)
+		case want && f.Format != format:
+			t.Errorf("format %d is read as %d", format, f.Format)
+		case !want && (err == nil || !strings.Contains(err.Error(), "newer")):
+			t.Errorf("format %d is not refused as newer: %v", format, err)
+		}
+	}
+	// What the writer composes carries no field of format 2: a reader of 1 and of 2 read it alike.
+	body, err := (snapshot.Facts{Format: writtenFormat, Taken: taken, Machines: []snapshot.Machine{{Name: "abcdef", Length: 6}}}).Encode()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var raw struct {
+		Format   int                          `json:"facts"`
+		Machines []map[string]json.RawMessage `json:"machines"`
+	}
+	if err := json.Unmarshal(body, &raw); err != nil {
+		t.Fatal(err)
+	}
+	if raw.Format != 1 {
+		t.Errorf("the snapshot says format %d", raw.Format)
+	}
+	for _, m := range raw.Machines {
+		if _, has := m["grants"]; has {
+			t.Error("a format 1 snapshot carries grants")
+		}
+		if _, has := m["bindings"]; has {
+			t.Error("a format 1 snapshot carries bindings")
+		}
+	}
+}
diff --git a/cmd/mesh-controller/facts_test.go b/cmd/mesh-controller/facts_test.go
index 7f3c9544..5edc0095 100644
--- a/cmd/mesh-controller/facts_test.go
+++ b/cmd/mesh-controller/facts_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 )
 
 // The facts snapshot (novox/hq to-be 45 §9): composed from the store, every machine under a pseudonym
@@ -42,12 +42,8 @@ func aMeshWithSecrets(t *testing.T) (*stores, []string) {
 		t.Fatal(err)
 	}
 	// A push's worth of composition, which makes the pair credential the consumer is sent.
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	for _, node := range []string{"laptop", "anchor"} {
-		if _, _, err := composedAndValidated(ctx, open, node, gens, Allocating); err != nil {
+		if _, err := composeSend(ctx, open, node); err != nil {
 			t.Fatalf("%s does not compose: %v", node, err)
 		}
 	}
@@ -68,6 +64,9 @@ func TestTheFactsCarryNoSecretNoAddressAndNoName(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	if f.Format != 1 {
+		t.Fatalf("the writer wrote format %d: it keeps format 1 until its own release moves it (issue 1390)", f.Format)
+	}
 	body, err := f.Encode()
 	if err != nil {
 		t.Fatal(err)
diff --git a/cmd/mesh-controller/first_build_ask_integration_test.go b/cmd/mesh-controller/first_build_ask_integration_test.go
index 8f0a7ac8..68d84fdd 100644
--- a/cmd/mesh-controller/first_build_ask_integration_test.go
+++ b/cmd/mesh-controller/first_build_ask_integration_test.go
@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/first_builds_integration_test.go b/cmd/mesh-controller/first_builds_integration_test.go
index 133c79a7..e82d7284 100644
--- a/cmd/mesh-controller/first_builds_integration_test.go
+++ b/cmd/mesh-controller/first_builds_integration_test.go
@@ -12,8 +12,8 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/fixclass_test.go b/cmd/mesh-controller/fixclass_test.go
index 225089f9..9541c005 100644
--- a/cmd/mesh-controller/fixclass_test.go
+++ b/cmd/mesh-controller/fixclass_test.go
@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/gate.go b/cmd/mesh-controller/gate.go
index f0912525..30a7499d 100644
--- a/cmd/mesh-controller/gate.go
+++ b/cmd/mesh-controller/gate.go
@@ -13,8 +13,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/micro"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/gate_followup_test.go b/cmd/mesh-controller/gate_followup_test.go
index 9ba07bf3..ca5dbb9f 100644
--- a/cmd/mesh-controller/gate_followup_test.go
+++ b/cmd/mesh-controller/gate_followup_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/gate_integration_test.go b/cmd/mesh-controller/gate_integration_test.go
index fff52fa6..31e5c56d 100644
--- a/cmd/mesh-controller/gate_integration_test.go
+++ b/cmd/mesh-controller/gate_integration_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/gate_rule_test.go b/cmd/mesh-controller/gate_rule_test.go
index 69681695..b1b1033e 100644
--- a/cmd/mesh-controller/gate_rule_test.go
+++ b/cmd/mesh-controller/gate_rule_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 )
diff --git a/cmd/mesh-controller/gate_test.go b/cmd/mesh-controller/gate_test.go
index 589c4aa4..8109ede3 100644
--- a/cmd/mesh-controller/gate_test.go
+++ b/cmd/mesh-controller/gate_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/generation.go b/cmd/mesh-controller/generation.go
index b8d1203b..ce649ce0 100644
--- a/cmd/mesh-controller/generation.go
+++ b/cmd/mesh-controller/generation.go
@@ -6,11 +6,10 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"sort"
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -103,18 +102,6 @@ func senderOf(caller string) string {
 	return fmt.Sprintf("%s (pid %d on %s, build %s)", caller, os.Getpid(), host, version)
 }
 
-// namedModules are the modules a declaration names: its machine's set, less what was left out of it.
-func namedModules(plan catalogue.Resolution, leftOut map[string]string) []string {
-	out := make([]string, 0, len(plan.Modules))
-	for _, m := range plan.Modules {
-		if _, left := leftOut[m.Module]; !left {
-			out = append(out, m.Module)
-		}
-	}
-	sort.Strings(out)
-	return out
-}
-
 // heardGenerationRefusal keeps a machine's refusal of a send for its generation, so S20 names its sender
 // and says it (novox/hq issue 234): on the send it refused or — when the mesh has no record of sending that
 // sequence — as a refusal of its own, naming the sender as unknown. Either way S20 is raised: a refusal the
diff --git a/cmd/mesh-controller/grant_follows_binding_integration_test.go b/cmd/mesh-controller/grant_follows_binding_integration_test.go
index 74622b3d..0aed7741 100644
--- a/cmd/mesh-controller/grant_follows_binding_integration_test.go
+++ b/cmd/mesh-controller/grant_follows_binding_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
@@ -35,17 +35,21 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
 	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "anchor", "store"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
+	// Only a send makes a credential; a question makes nothing.
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
 	if n := need(t, plan, "board", "postgres-database"); n.From != "anchor" {
 		t.Fatalf("pinned to the anchor and bound to %s", n.From)
 	}
 	if err := inv.RecordBindings(ctx, "laptop", boundToData(plan, nil)); err != nil {
 		t.Fatal(err)
 	}
-	grants, _, unbound, err := grantsFor(ctx, open, "anchor")
+	grants, _, unbound, err := grantsOf(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -57,10 +61,13 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
 	if err := inv.PinProvision(ctx, "laptop", "postgres-database", "laptop", "store"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = planFor(ctx, open, "laptop")
+	plan, _, err = resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatal(err)
+	}
 	if n := need(t, plan, "board", "postgres-database"); n.From != "laptop" {
 		t.Fatalf("pinned back to the laptop and bound to %s", n.From)
 	}
@@ -76,7 +83,7 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
 	}
 
 	// The store it left: no longer granted, and said.
-	grants, _, unbound, err = grantsFor(ctx, open, "anchor")
+	grants, _, unbound, err = grantsOf(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -87,7 +94,7 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
 		strings.Join(unbound[0].BoundTo, ",") != "laptop" {
 		t.Fatalf("the consumer that moved is not the one said: %+v", unbound)
 	}
-	planned, settings, err := planFor(ctx, open, "anchor")
+	planned, settings, err := resolveNode(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -105,7 +112,7 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) {
 	}
 
 	// The store it is bound to: granted.
-	grants, _, unbound, err = grantsFor(ctx, open, "laptop")
+	grants, _, unbound, err = grantsOf(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -131,7 +138,7 @@ func TestAConsumerWhoseResolutionCannotBeReadIsNotWithdrawn(t *testing.T) {
 			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
 		}
 	}
-	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
 		t.Fatal(err)
 	}
 
@@ -144,14 +151,15 @@ func TestAConsumerWhoseResolutionCannotBeReadIsNotWithdrawn(t *testing.T) {
 	if err := inv.RecordSealingKey(ctx, laptop.ID, "not a key"); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := planFor(ctx, open, "laptop"); err == nil || unresolvable(err) {
+	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || unresolvable(err) {
 		t.Fatalf("the seam this test relies on moved: %v", err)
 	}
-	grants, _, unbound, err := grantsFor(ctx, open, "anchor")
+	grants, _, unbound, err := grantsOf(ctx, open, "anchor")
 	if err == nil {
 		t.Fatalf("an unreadable consumer was answered: grants %+v, unbound %+v", grants, unbound)
 	}
-	if !strings.Contains(err.Error(), "what laptop asked of postgres-database cannot be read") {
+	// mesh-sdk names the provider's node where the controller's own words named the provision.
+	if !strings.Contains(err.Error(), "what laptop asked of") || !strings.Contains(err.Error(), "cannot be read") {
 		t.Fatalf("the error does not say whose resolution could not be read: %v", err)
 	}
 }
diff --git a/cmd/mesh-controller/grant_follows_binding_test.go b/cmd/mesh-controller/grant_follows_binding_test.go
index 9b9c6cd4..2918e1f0 100644
--- a/cmd/mesh-controller/grant_follows_binding_test.go
+++ b/cmd/mesh-controller/grant_follows_binding_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/grants_step_integration_test.go b/cmd/mesh-controller/grants_step_integration_test.go
index c40c1bd3..7e54c6d8 100644
--- a/cmd/mesh-controller/grants_step_integration_test.go
+++ b/cmd/mesh-controller/grants_step_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The store test's manifests are manifests the controller takes in: checked here, where no store is needed,
diff --git a/cmd/mesh-controller/grants_step_store_test.go b/cmd/mesh-controller/grants_step_store_test.go
index 705dc8fb..8432483d 100644
--- a/cmd/mesh-controller/grants_step_store_test.go
+++ b/cmd/mesh-controller/grants_step_store_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -66,15 +66,11 @@ func TestTheGrantsStepSendsTheUserListAndNothingElse(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		plan, settings, err := planFor(under, open, "anchor")
+		plan, _, err := resolveNode(under, open, "anchor")
 		if err != nil {
 			t.Fatal(err)
 		}
-		gens, err := generators(under, open)
-		if err != nil {
-			t.Fatal(err)
-		}
-		declared, err := declarationWith(under, open, "anchor", plan, settings, gens, Allocating)
+		declared, err := composeSend(under, open, "anchor")
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/mesh-controller/grants_step_test.go b/cmd/mesh-controller/grants_step_test.go
index 48b34bb5..c484d693 100644
--- a/cmd/mesh-controller/grants_step_test.go
+++ b/cmd/mesh-controller/grants_step_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/group_wait.go b/cmd/mesh-controller/group_wait.go
index 46a22e03..8713318e 100644
--- a/cmd/mesh-controller/group_wait.go
+++ b/cmd/mesh-controller/group_wait.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/health_check_test.go b/cmd/mesh-controller/health_check_test.go
index 5ac0e1cc..4c4ddf53 100644
--- a/cmd/mesh-controller/health_check_test.go
+++ b/cmd/mesh-controller/health_check_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Every catalogue module that runs something long-lived declares how it is ready (novox/hq ADR 0240 rule
diff --git a/cmd/mesh-controller/health_probes.go b/cmd/mesh-controller/health_probes.go
index c0e59764..d9cc994c 100644
--- a/cmd/mesh-controller/health_probes.go
+++ b/cmd/mesh-controller/health_probes.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/held_back.go b/cmd/mesh-controller/held_back.go
index 66644ec2..16ffc4d5 100644
--- a/cmd/mesh-controller/held_back.go
+++ b/cmd/mesh-controller/held_back.go
@@ -7,7 +7,6 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -107,6 +106,8 @@ func buildName(commit string) string {
 // (heldBack), and answers only the machines held. A machine whose set cannot be worked out is left
 // to the send, which says why.
 func heldMachines(ctx context.Context, open *stores, names []string) (map[string][]string, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	out := map[string][]string{}
 	if len(names) == 0 {
 		return out, nil
@@ -125,7 +126,7 @@ func heldMachines(ctx context.Context, open *stores, names []string) (map[string
 		return nil, err
 	}
 	for _, node := range names {
-		plan, _, err := planFor(ctx, open, node)
+		plan, _, err := resolveNode(ctx, open, node)
 		if err != nil {
 			continue
 		}
@@ -263,15 +264,17 @@ func flushBehind(ctx context.Context, open *stores, nodes []inventory.Node, hand
 
 // composeForPush is how a push composes one machine: its set resolved, what it cannot host and what
 // is left out of it said, and its declaration allocated.
-func composeForPush(open *stores, gens map[string]catalogue.Generator) func(held context.Context, node string) (sendable, error) {
+func composeForPush(open *stores) func(held context.Context, node string) (sendable, error) {
 	return func(held context.Context, node string) (sendable, error) {
-		plan, settings, err := planFor(held, open, node)
+		// Read afresh for each machine: the send before it made and recorded things.
+		held = freshInput(held)
+		plan, _, err := resolveNode(held, open, node)
 		if err != nil {
 			return sendable{}, err
 		}
 		reportUnhostable(node, plan)
 		reportKept(held, plan)
-		declared, err := declarationWith(held, open, node, plan, settings, gens, Allocating)
+		declared, err := composeSend(held, open, node)
 		if err == nil {
 			reportLeftOut(node, declared)
 		}
diff --git a/cmd/mesh-controller/held_back_integration_test.go b/cmd/mesh-controller/held_back_integration_test.go
index e8e2eb5d..dc0b3d7d 100644
--- a/cmd/mesh-controller/held_back_integration_test.go
+++ b/cmd/mesh-controller/held_back_integration_test.go
@@ -28,11 +28,7 @@ func TestANamedPushLeavesAMachineAPolicyHoldsBack(t *testing.T) {
 	if err := inv.SetUpgradeOf(ctx, "resolver", inventory.Upgrade{Why: "each machine checked by hand"}); err != nil {
 		t.Fatal(err)
 	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	compose := composeForPush(open, gens)
+	compose := composeForPush(open)
 	d := &recordedDelivery{inv: inv}
 	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, "", nil); err != nil {
 		t.Fatal(err)
@@ -134,11 +130,7 @@ func TestANamedPushStillSendsAConsequenceNothingHolds(t *testing.T) {
 	if _, err := inv.Assign(ctx, "laptop", "resolver"); err != nil {
 		t.Fatal(err)
 	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	compose := composeForPush(open, gens)
+	compose := composeForPush(open)
 	d := &recordedDelivery{inv: inv}
 	if _, err := sendRound(ctx, open, []string{"anchor", "laptop"}, compose, d, "", nil); err != nil {
 		t.Fatal(err)
diff --git a/cmd/mesh-controller/held_back_test.go b/cmd/mesh-controller/held_back_test.go
index 2d5eb506..05e7c65a 100644
--- a/cmd/mesh-controller/held_back_test.go
+++ b/cmd/mesh-controller/held_back_test.go
@@ -3,14 +3,13 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"reflect"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // novox/hq issue 259, ADR 0221: a push that did not name a machine does not send it a build its
@@ -99,22 +98,6 @@ func TestAPlanWaitingOnItsFirstMachineHoldsTheRest(t *testing.T) {
 	}
 }
 
-// A send records the build of each module it carried; a module left out of it keeps the build it
-// was last sent, since the machine keeps that one.
-func TestASendCarriesTheCurrentBuildsAndALeftOutModuleKeepsItsOwn(t *testing.T) {
-	current := map[string]inventory.CurrentBuild{"a": {Commit: "a2"}, "b": {Commit: "b2"}, "c": {}}
-	got := carriedBuilds([]string{"a", "b", "c"}, map[string]string{"b": "a setting does not compose"},
-		current, map[string]string{"a": "a1", "b": "b1"})
-	if want := map[string]string{"a": "a2", "b": "b1", "c": ""}; !reflect.DeepEqual(got, want) {
-		t.Fatalf("carried %v, wanted %v", got, want)
-	}
-	// Not known before: the left-out module is not recorded at all, so it reads as never sent.
-	got = carriedBuilds([]string{"a", "b"}, map[string]string{"b": "x"}, current, nil)
-	if want := map[string]string{"a": "a2"}; !reflect.DeepEqual(got, want) {
-		t.Fatalf("carried %v, wanted %v", got, want)
-	}
-}
-
 // recordedDelivery sends nothing and records each send as the mesh does, so the next comparison
 // reads the machine as current — and writes down which machines it declared.
 type recordedDelivery struct {
diff --git a/cmd/mesh-controller/holders_silent_test.go b/cmd/mesh-controller/holders_silent_test.go
index 79362ec9..0f1486f6 100644
--- a/cmd/mesh-controller/holders_silent_test.go
+++ b/cmd/mesh-controller/holders_silent_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The live case of 2026-10-07 (novox/hq issue 299), replayed: the node-uplink seat gained its first
diff --git a/cmd/mesh-controller/holdings.go b/cmd/mesh-controller/holdings.go
index 3eab711c..d4893725 100644
--- a/cmd/mesh-controller/holdings.go
+++ b/cmd/mesh-controller/holdings.go
@@ -5,9 +5,9 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // recordDerivedHolders writes down who holds each mesh-scoped seat that nobody was ever recorded
@@ -36,7 +36,7 @@ func recordDerivedHolders(ctx context.Context, open *stores) ([]string, error) {
 		return nil, err
 	}
 	// exclude nobody: every node's claims, resolved with the holdings on record.
-	world, err := theRestOfTheMesh(ctx, inv, shelf, "")
+	world, err := restOfTheMesh(ctx, open, shelf, "")
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/mesh-controller/holdings_test.go b/cmd/mesh-controller/holdings_test.go
index efab46cd..420360c4 100644
--- a/cmd/mesh-controller/holdings_test.go
+++ b/cmd/mesh-controller/holdings_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A seat nobody ever handed over is held by whichever assignment happened to be alone — and the
@@ -63,7 +63,7 @@ func TestASecondEligibleHolderStandsBesideTheOneHeldByBeingAlone(t *testing.T) {
 
 	// And the record decides from here: the anchor's plan holds the seat, the laptop's does not.
 	for node, holds := range map[string]bool{"anchor": true, "laptop": false} {
-		plan, _, err := planFor(ctx, open, node)
+		plan, _, err := resolveNode(ctx, open, node)
 		if err != nil {
 			t.Fatalf("%s no longer resolves: %v", node, err)
 		}
diff --git a/cmd/mesh-controller/identity_bound_integration_test.go b/cmd/mesh-controller/identity_bound_integration_test.go
index 8195ab04..01774c33 100644
--- a/cmd/mesh-controller/identity_bound_integration_test.go
+++ b/cmd/mesh-controller/identity_bound_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
@@ -31,7 +31,7 @@ func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
 	}
 
 	// The consumer's machine resolves, and says which of its modules no provider will grant.
-	consumer, _, err := planFor(ctx, open, "laptop")
+	consumer, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -42,7 +42,7 @@ func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
 
 	// The provider's machine composes. Under ADR 0049's one bound this was a refusal naming
 	// networkmanager, and no push to the provider could go through.
-	plan, settings, err := planFor(ctx, open, "anchor")
+	plan, settings, err := resolveNode(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -53,7 +53,7 @@ func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
 	if len(declared.withheld) != 1 || declared.withheld[0].Identity != "mesh_laptop_photoalbum" {
 		t.Fatalf("the overflowing consumer is not the one withheld: %+v", declared.withheld)
 	}
-	grants, _, _, err := grantsFor(ctx, open, "anchor")
+	grants, _, _, err := grantsOf(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/issue201_integration_test.go b/cmd/mesh-controller/issue201_integration_test.go
index 413b2f1c..a138642c 100644
--- a/cmd/mesh-controller/issue201_integration_test.go
+++ b/cmd/mesh-controller/issue201_integration_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 )
@@ -79,7 +79,7 @@ func TestReplay201(t *testing.T) {
 		t.Fatalf("the send keeps the newer controller there: %v %v", keeps, err)
 	}
 	shelf := map[string]catalogue.Manifest{"mesh-controller": {Module: "mesh-controller", Version: "old"}}
-	if _, err := keepRecorded(keepingRecorded(judged), open, "anchor", shelf); err != nil || shelf["mesh-controller"].Version != "1" {
+	if err := applyKept(keepingRecorded(judged), open, "anchor", keeps, shelf); err != nil || shelf["mesh-controller"].Version != "1" {
 		t.Fatalf("the send composes the kept build's manifest: %+v %v", shelf, err)
 	}
 	key := coreDowngradeObservation(lease.ComponentController, "anchor", "").Key()
diff --git a/cmd/mesh-controller/issue348_integration_test.go b/cmd/mesh-controller/issue348_integration_test.go
index b2c5f29c..a723bda0 100644
--- a/cmd/mesh-controller/issue348_integration_test.go
+++ b/cmd/mesh-controller/issue348_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/issue352_integration_test.go b/cmd/mesh-controller/issue352_integration_test.go
index 7f604afe..1f7c399e 100644
--- a/cmd/mesh-controller/issue352_integration_test.go
+++ b/cmd/mesh-controller/issue352_integration_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
diff --git a/cmd/mesh-controller/issue352_test.go b/cmd/mesh-controller/issue352_test.go
index 3baa9b57..86e8cea5 100644
--- a/cmd/mesh-controller/issue352_test.go
+++ b/cmd/mesh-controller/issue352_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 )
diff --git a/cmd/mesh-controller/issue648_test.go b/cmd/mesh-controller/issue648_test.go
index 89fc9bb5..af1ba7d5 100644
--- a/cmd/mesh-controller/issue648_test.go
+++ b/cmd/mesh-controller/issue648_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/issued.go b/cmd/mesh-controller/issued.go
index 4ae02291..4c553807 100644
--- a/cmd/mesh-controller/issued.go
+++ b/cmd/mesh-controller/issued.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/secrets"
diff --git a/cmd/mesh-controller/issued_test.go b/cmd/mesh-controller/issued_test.go
index f2819a76..baa1b90a 100644
--- a/cmd/mesh-controller/issued_test.go
+++ b/cmd/mesh-controller/issued_test.go
@@ -5,7 +5,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/secrets"
@@ -138,42 +140,73 @@ func TestAnIssuedValueIsADecisionInTheHandActLog(t *testing.T) {
 	t.Fatal("secret issued is not in the hand-act table")
 }
 
+// needOf is the need a consumer has of a provision, as mesh-sdk's resolution gives it (the controller's issuedToHolder and
+// providerMoved became the fields Needed.IssuedToHolder and ProviderMoved of compose.Resolve, issue 1389): the shelf, the
+// provider on one machine and the consumer on another.
+func needOf(t *testing.T, shelf map[string]catalogue.Manifest, provider, consumer, provision string) catalogue.Needed {
+	t.Helper()
+	all := map[string]catalogue.Manifest{}
+	for name, m := range shelf {
+		all[name] = m
+	}
+	all[consumer] = catalogue.Manifest{Module: consumer, Version: "1", Requires: []string{provision}}
+	// The private network comes with the control plane, and both machines run it.
+	var network []string
+	for _, m := range provided {
+		all[m.Module] = m
+		if m.Module == overlay.Name {
+			network = append(network, m.Module)
+		}
+	}
+	in := compose.Input{Catalogue: all, OverlayCIDR: "10.77.0.0/16", InternalSuffix: "internal",
+		Nodes: []compose.Node{
+			{Name: "novox", Assigned: append([]string{provider}, network...), Place: compose.Place{Address: "10.77.0.1"}},
+			{Name: "ace", Assigned: append([]string{consumer}, network...), Place: compose.Place{Address: "10.77.0.2"}}}}
+	resolved, err := compose.Resolve(in, "ace")
+	if err != nil {
+		t.Fatalf("%s does not resolve beside %s: %v", consumer, provider, err)
+	}
+	for _, n := range resolved.Plan.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("%s has no need of %s: %+v", consumer, provision, resolved.Plan.Needs)
+	return catalogue.Needed{}
+}
+
 // **A need's credential is the vault's for its holder alone** (issue 757) exactly when its providing module is marked
 // moved, so `secret issued` goes to the vault naming each holder, and its software issues the provision's credential.
 func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssuesIt(t *testing.T) {
 	forge := func(moved bool, issued bool) catalogue.Manifest {
-		offer := catalogue.Offer{Name: "gitea-read"}
+		offer := catalogue.Offer{Name: "gitea-read", Scope: catalogue.ScopeMesh}
 		if issued {
 			offer.Credential = &catalogue.OfferCredential{IssuedBy: catalogue.IssuedBySoftware, Tool: "gitea_agent_token"}
 		}
-		return catalogue.Manifest{Module: "gitea", Moved: moved, Provides: []catalogue.Offer{offer}}
+		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, Provides: []catalogue.Offer{offer}}
 	}
 	shared := func(moved bool) catalogue.Manifest {
-		return catalogue.Manifest{Module: "gitea", Moved: moved, OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}},
-			Provides: []catalogue.Offer{{Name: "gitea-read", Credential: &catalogue.OfferCredential{Own: "key"}}}}
+		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}},
+			Provides: []catalogue.Offer{{Name: "gitea-read", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{Own: "key"}}}}
 	}
 	given := func() catalogue.Manifest {
-		return catalogue.Manifest{Module: "gitea", Moved: true, Provides: []catalogue.Offer{{Name: "gitea-read",
-			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}
+		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: true, Provides: []catalogue.Offer{{Name: "gitea-read",
+			Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}
 	}
-	need := catalogue.Needed{Name: "gitea-read", From: "novox", Module: "gitea", For: "claude-code"}
 	for why, c := range map[string]struct {
-		shelf map[string]catalogue.Manifest
-		need  catalogue.Needed
+		forge catalogue.Manifest
 		want  bool
 	}{
-		"moved and issued by its software": {map[string]catalogue.Manifest{"gitea": forge(true, true)}, need, true},
-		"not moved":                        {map[string]catalogue.Manifest{"gitea": forge(false, true)}, need, false},
-		"a login for each consumer":        {map[string]catalogue.Manifest{"gitea": forge(true, false)}, need, true},
-		"a login for each, not moved":      {map[string]catalogue.Manifest{"gitea": forge(false, false)}, need, false},
-		"a credential every holder shares": {map[string]catalogue.Manifest{"gitea": shared(true)}, need, false},
-		"a credential a person gives":      {map[string]catalogue.Manifest{"gitea": given()}, need, false},
-		"a provider not on the shelf":      {map[string]catalogue.Manifest{}, need, false},
-		"answered by a record": {map[string]catalogue.Manifest{"gitea": forge(true, true)},
-			catalogue.Needed{Name: "gitea-read", ByRecord: true, Module: "gitea", For: "claude-code"}, false},
+		"moved and issued by its software": {forge(true, true), true},
+		"not moved":                        {forge(false, true), false},
+		"a login for each consumer":        {forge(true, false), true},
+		"a login for each, not moved":      {forge(false, false), false},
+		"a credential every holder shares": {shared(true), false},
+		"a credential a person gives":      {given(), false},
 	} {
-		if got := issuedToHolder(c.shelf, c.need); got != c.want {
-			t.Errorf("%s: issued to its holder is %v, want %v", why, got, c.want)
+		got := needOf(t, map[string]catalogue.Manifest{"gitea": c.forge}, "gitea", "claude-code", "gitea-read")
+		if got.IssuedToHolder != c.want {
+			t.Errorf("%s: issued to its holder is %v, want %v", why, got.IssuedToHolder, c.want)
 		}
 	}
 }
@@ -182,17 +215,14 @@ func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssues
 // V3, so a need of `secret` is issued to its holder and answered by a moved provider, whether or not the module is
 // marked moved; another module is not.
 func TestTheModuleHoldingTheVaultSeatCountsAsMovedForItsConsumers(t *testing.T) {
-	vault := catalogue.Manifest{Module: "mesh-vault", Claims: []catalogue.Claim{{Name: "mesh-vault"}},
-		Provides: []catalogue.Offer{{Name: "secret"}}}
-	other := catalogue.Manifest{Module: "mesh-vault", Provides: []catalogue.Offer{{Name: "secret"}}}
-	need := catalogue.Needed{Name: "secret", Local: "admin", From: "novox", Module: "mesh-vault", For: "gitea"}
-	if !issuedToHolder(map[string]catalogue.Manifest{"mesh-vault": vault}, need) ||
-		!providerMoved(map[string]catalogue.Manifest{"mesh-vault": vault}, need) {
-		t.Error("the vault's consumer is not answered by a moved provider")
+	vault := catalogue.Manifest{Module: "mesh-vault", Version: "1", Claims: []catalogue.Claim{{Name: "mesh-vault", Scope: catalogue.ScopeMesh}},
+		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
+	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
+	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": vault}, "mesh-vault", "gitea", "secret"); !got.IssuedToHolder || !got.ProviderMoved {
+		t.Errorf("the vault's consumer is not answered by a moved provider: %+v", got)
 	}
-	if issuedToHolder(map[string]catalogue.Manifest{"mesh-vault": other}, need) ||
-		providerMoved(map[string]catalogue.Manifest{"mesh-vault": other}, need) {
-		t.Error("a module not holding the vault seat counts as moved")
+	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": other}, "mesh-vault", "gitea", "secret"); got.IssuedToHolder || got.ProviderMoved {
+		t.Errorf("a module not holding the vault seat counts as moved: %+v", got)
 	}
 }
 
@@ -200,21 +230,21 @@ func TestTheModuleHoldingTheVaultSeatCountsAsMovedForItsConsumers(t *testing.T)
 // provides entry says `"answered-by": "helper"`, the module need not be marked moved, and no credential is the vault's
 // for it. Another provision of the module, or a module without the entry, does not count.
 func TestAnOfferAnsweredByTheHelperCountsAsMovedForThatProvisionOnly(t *testing.T) {
-	proxy := catalogue.Manifest{Module: "route-proxy", Provides: []catalogue.Offer{
-		{Name: "route", AnsweredBy: catalogue.AnsweredByHelper}, {Name: "other"}}}
-	plain := catalogue.Manifest{Module: "route-proxy", Provides: []catalogue.Offer{{Name: "route"}}}
+	proxy := catalogue.Manifest{Module: "route-proxy", Version: "1", Provides: []catalogue.Offer{
+		{Name: "route", Scope: catalogue.ScopeMesh, AnsweredBy: catalogue.AnsweredByHelper}, {Name: "other", Scope: catalogue.ScopeMesh}}}
+	plain := catalogue.Manifest{Module: "route-proxy", Version: "1", Provides: []catalogue.Offer{{Name: "route", Scope: catalogue.ScopeMesh}}}
 	shelf := func(m catalogue.Manifest) map[string]catalogue.Manifest {
 		return map[string]catalogue.Manifest{m.Module: m}
 	}
-	route := catalogue.Needed{Name: "route", From: "novox", Module: "route-proxy", For: "gitea"}
-	other := catalogue.Needed{Name: "other", From: "novox", Module: "route-proxy", For: "gitea"}
-	if !providerMoved(shelf(proxy), route) {
+	if got := needOf(t, shelf(proxy), "route-proxy", "gitea", "route"); !got.ProviderMoved {
 		t.Error("a provision answered by the helper is not answered by a moved provider")
-	}
-	if providerMoved(shelf(proxy), other) || providerMoved(shelf(plain), route) {
-		t.Error("a provision not answered by the helper counts as moved")
-	}
-	if issuedToHolder(shelf(proxy), route) {
+	} else if got.IssuedToHolder {
 		t.Error("the flag made a credential the vault's")
 	}
+	if got := needOf(t, shelf(proxy), "route-proxy", "gitea", "other"); got.ProviderMoved {
+		t.Error("a provision not answered by the helper counts as moved")
+	}
+	if got := needOf(t, shelf(plain), "route-proxy", "gitea", "route"); got.ProviderMoved {
+		t.Error("a module without the entry counts as moved")
+	}
 }
diff --git a/cmd/mesh-controller/issued_to_vault.go b/cmd/mesh-controller/issued_to_vault.go
index 212a3d16..41703413 100644
--- a/cmd/mesh-controller/issued_to_vault.go
+++ b/cmd/mesh-controller/issued_to_vault.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/issued_to_vault_test.go b/cmd/mesh-controller/issued_to_vault_test.go
index 6f518918..50068d32 100644
--- a/cmd/mesh-controller/issued_to_vault_test.go
+++ b/cmd/mesh-controller/issued_to_vault_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // Every other test mints without a vault to hand to: a stand-in that takes anything, replaced by the tests below.
diff --git a/cmd/mesh-controller/left_out.go b/cmd/mesh-controller/left_out.go
index c66a21d3..94d1b9e5 100644
--- a/cmd/mesh-controller/left_out.go
+++ b/cmd/mesh-controller/left_out.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
diff --git a/cmd/mesh-controller/left_out_integration_test.go b/cmd/mesh-controller/left_out_integration_test.go
index feae280f..bcb7f947 100644
--- a/cmd/mesh-controller/left_out_integration_test.go
+++ b/cmd/mesh-controller/left_out_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/left_out_test.go b/cmd/mesh-controller/left_out_test.go
index 795bef55..dbe9c7c1 100644
--- a/cmd/mesh-controller/left_out_test.go
+++ b/cmd/mesh-controller/left_out_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
diff --git a/cmd/mesh-controller/local_network.go b/cmd/mesh-controller/local_network.go
index f3af5d91..8cd4ec06 100644
--- a/cmd/mesh-controller/local_network.go
+++ b/cmd/mesh-controller/local_network.go
@@ -1,30 +1,12 @@
 package main
 
 import (
-	"context"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
-// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local
-// network, from what it last said of itself and the links it said face outside it. A machine that has
-// said none judges to nothing, and a port reached from `local-network` is then admitted from the private
-// network only, and said so.
-func localNetworksOf(ctx context.Context, inv *inventory.Inventory, node string) ([]catalogue.LocalNetwork, error) {
-	account, had, err := inv.MachineOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	outward, err := inv.OutwardLinksOf(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	return judgedNetworks(account, had, outward, overlay.Interface), nil
-}
-
 // judgedNetworks is the judging alone, from what was read.
 func judgedNetworks(account inventory.MachineAccount, had bool, outward []string, tunnel string) []catalogue.LocalNetwork {
 	if !had || account.Machine == nil {
diff --git a/cmd/mesh-controller/local_network_test.go b/cmd/mesh-controller/local_network_test.go
index 739f39d2..0c46895e 100644
--- a/cmd/mesh-controller/local_network_test.go
+++ b/cmd/mesh-controller/local_network_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/lone_merge_test.go b/cmd/mesh-controller/lone_merge_test.go
index 4c9eb8f6..e5850d76 100644
--- a/cmd/mesh-controller/lone_merge_test.go
+++ b/cmd/mesh-controller/lone_merge_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/merge_gate.go b/cmd/mesh-controller/merge_gate.go
index 5557b96e..dad7db22 100644
--- a/cmd/mesh-controller/merge_gate.go
+++ b/cmd/mesh-controller/merge_gate.go
@@ -21,10 +21,10 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/artifacts"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/store"
@@ -972,7 +972,7 @@ func composeEveryMachine(ctx context.Context, in mergeCheckInput, shelf map[stri
 	if err != nil {
 		return nil, nil, notes, err
 	}
-	gens, gensErr := generators(ctx, open)
+	gens, gensErr := generatorsOf(ctx, open)
 	out := map[string]mergeComposed{}
 	for pass := 0; pass < 2; pass++ {
 		for _, m := range in.facts.Machines {
@@ -981,7 +981,7 @@ func composeEveryMachine(ctx context.Context, in mergeCheckInput, shelf map[stri
 					oneLine(gensErr.Error())}}
 				continue
 			}
-			declared, problems, err := composedAndValidated(ctx, open, m.Name, gens, Allocating)
+			declared, problems, err := composeSendValidated(ctx, open, m.Name)
 			if pass == 0 {
 				continue
 			}
@@ -1047,7 +1047,7 @@ func tryAssigning(ctx context.Context, open *stores, f snapshot.Facts, m catalog
 		if _, err := open.inventory.Assign(ctx, machine.Name, m.Module); err != nil {
 			return mergeTrial{Machine: machine.Described(), Said: oneLine(err.Error())}
 		}
-		_, problems, err := composedAndValidated(ctx, open, machine.Name, gens, Allocating)
+		_, problems, err := composeSendValidated(ctx, open, machine.Name)
 		_ = open.inventory.Unassign(ctx, machine.Name, m.Module)
 		t := mergeTrial{Machine: machine.Described()}
 		if err != nil {
diff --git a/cmd/mesh-controller/merge_gate_handing_integration_test.go b/cmd/mesh-controller/merge_gate_handing_integration_test.go
index 74720f4c..58259195 100644
--- a/cmd/mesh-controller/merge_gate_handing_integration_test.go
+++ b/cmd/mesh-controller/merge_gate_handing_integration_test.go
@@ -7,7 +7,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -55,8 +56,12 @@ func TestIssue969TheGateRaisesEachMachineAsItsEngineStatedItself(t *testing.T) {
 		t.Fatal(err)
 	}
 	for name, hands := range want {
-		got, err := engineTakesHanded(ctx, raised.inventory, name)
-		if err != nil || got != hands {
+		in, err := readComposeInput(ctx, raised)
+		if err != nil {
+			t.Fatal(err)
+		}
+		node, _ := nodeOf(in.Input, name)
+		if got := node.Stated && node.Contract >= compose.HandedContract; got != hands {
 			t.Errorf("%s: the gate raises it as taking handed files = %v (%v), the mesh says %v", name, got, err, hands)
 		}
 	}
diff --git a/cmd/mesh-controller/merge_gate_handing_test.go b/cmd/mesh-controller/merge_gate_handing_test.go
index 4dfa0c91..73c5a9da 100644
--- a/cmd/mesh-controller/merge_gate_handing_test.go
+++ b/cmd/mesh-controller/merge_gate_handing_test.go
@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	snapshot "github.com/novox/mesh-controller/internal/facts"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -14,15 +14,15 @@ func TestIssue969TheGateGivesAMachineItsContractSoItTakesHandedFiles(t *testing.
 	taken := time.Date(2026, 10, 16, 12, 0, 0, 0, time.UTC)
 
 	stated, ok := standInHealth(snapshot.Machine{Name: "f35", Contract: link.HandedContract}, taken)
-	if !ok || !takesHanded(stated, ok) {
+	if !ok || stated.Contract < link.HandedContract {
 		t.Fatalf("a machine whose engine takes handed files must be given that in the gate: %+v, %v", stated, ok)
 	}
 	old, ok := standInHealth(snapshot.Machine{Name: "e12", Contract: link.HandedContract - 1}, taken)
-	if !ok || takesHanded(old, ok) {
+	if !ok || old.Contract >= link.HandedContract {
 		t.Fatalf("a machine whose engine is older must not take handed files: %+v, %v", old, ok)
 	}
 	none, ok := standInHealth(snapshot.Machine{Name: "d01"}, taken)
-	if ok || takesHanded(none, ok) {
+	if ok {
 		t.Fatalf("a snapshot that carries no contract states nothing: %+v, %v", none, ok)
 	}
 }
diff --git a/cmd/mesh-controller/merge_gate_integration_test.go b/cmd/mesh-controller/merge_gate_integration_test.go
index 57ade01d..32965523 100644
--- a/cmd/mesh-controller/merge_gate_integration_test.go
+++ b/cmd/mesh-controller/merge_gate_integration_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/mesh_for_test.go b/cmd/mesh-controller/mesh_for_test.go
index aad02830..68be9da6 100644
--- a/cmd/mesh-controller/mesh_for_test.go
+++ b/cmd/mesh-controller/mesh_for_test.go
@@ -12,10 +12,10 @@ import (
 
 	"github.com/novox/mesh-controller/internal/conditions"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // A mesh a command can be run against.
diff --git a/cmd/mesh-controller/mirrors.go b/cmd/mesh-controller/mirrors.go
index 901d3a8c..a3e8f2a5 100644
--- a/cmd/mesh-controller/mirrors.go
+++ b/cmd/mesh-controller/mirrors.go
@@ -10,8 +10,8 @@ import (
 	"regexp"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/mirrors_integration_test.go b/cmd/mesh-controller/mirrors_integration_test.go
index b2e5cfc7..c45687f4 100644
--- a/cmd/mesh-controller/mirrors_integration_test.go
+++ b/cmd/mesh-controller/mirrors_integration_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/mirrors_test.go b/cmd/mesh-controller/mirrors_test.go
index fee175df..af0f21aa 100644
--- a/cmd/mesh-controller/mirrors_test.go
+++ b/cmd/mesh-controller/mirrors_test.go
@@ -9,8 +9,8 @@ import (
 	"sync"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/module_health.go b/cmd/mesh-controller/module_health.go
index 39ba6f01..f021b1b8 100644
--- a/cmd/mesh-controller/module_health.go
+++ b/cmd/mesh-controller/module_health.go
@@ -8,7 +8,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/module_health_test.go b/cmd/mesh-controller/module_health_test.go
index f3706247..c28989d4 100644
--- a/cmd/mesh-controller/module_health_test.go
+++ b/cmd/mesh-controller/module_health_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -172,11 +173,12 @@ func TestHealthIsSentOnlyToAnEngineThatSaysItReadsIt(t *testing.T) {
 	inv := open.inventory
 	reads := func() bool {
 		t.Helper()
-		got, err := engineReadsHealth(ctx, inv, "anchor")
+		in, err := readComposeInput(ctx, open)
 		if err != nil {
 			t.Fatal(err)
 		}
-		return got
+		node, _ := nodeOf(in.Input, "anchor")
+		return node.Stated && node.Contract >= compose.ReadinessContract
 	}
 	if reads() {
 		t.Fatal("an engine that never stated anything is sent health")
diff --git a/cmd/mesh-controller/modules.go b/cmd/mesh-controller/modules.go
index 030f2af0..12b84e9d 100644
--- a/cmd/mesh-controller/modules.go
+++ b/cmd/mesh-controller/modules.go
@@ -13,11 +13,11 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // the catalogue: what exists, what is assigned, and how it is configured.
diff --git a/cmd/mesh-controller/modules_test.go b/cmd/mesh-controller/modules_test.go
index 4de406cf..bbec2147 100644
--- a/cmd/mesh-controller/modules_test.go
+++ b/cmd/mesh-controller/modules_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // `module issue` makes a broker account and delivers it as the module's own secret named broker.
diff --git a/cmd/mesh-controller/modules_wire_store_test.go b/cmd/mesh-controller/modules_wire_store_test.go
index a708ddcd..ea3fcd6f 100644
--- a/cmd/mesh-controller/modules_wire_store_test.go
+++ b/cmd/mesh-controller/modules_wire_store_test.go
@@ -46,15 +46,7 @@ func TestAComposedDeclarationCarriesModulesAndBuildsOnlyForANodeThatReadsThem(t
 
 	declare := func(node string) sendable {
 		t.Helper()
-		plan, settings, err := planFor(ctx, open, node)
-		if err != nil {
-			t.Fatal(err)
-		}
-		gens, err := generators(ctx, open)
-		if err != nil {
-			t.Fatal(err)
-		}
-		d, err := declarationWith(ctx, open, node, plan, settings, gens, Allocating)
+		d, err := composeSend(ctx, open, node)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/mesh-controller/modules_wire_test.go b/cmd/mesh-controller/modules_wire_test.go
index 518ab17f..7dd25721 100644
--- a/cmd/mesh-controller/modules_wire_test.go
+++ b/cmd/mesh-controller/modules_wire_test.go
@@ -5,8 +5,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/chain"
-	"github.com/novox/mesh-host/validate"
+	"git.novox.be/novox/mesh-sdk/go/validate"
 )
 
 // The module of each resource and the build of each module (novox/hq issue 1145, design 47 release 1-2). The
@@ -69,19 +68,3 @@ func TestTheNodeEnginesValidatorTakesAModulePerResourceAndABuildPerModule(t *tes
 		t.Fatalf("1145/AC4: refused: %q\n%s", problems, fmt.Sprint(generic))
 	}
 }
-
-// The build a module carries is the one its assignment names when that is the commit carried, else the one built from
-// the commit carried; none when neither is known.
-func TestTheBuildOfACarriedCommitIsTheAssignmentsOrTheOneBuiltFromIt(t *testing.T) {
-	runs := map[string]chain.Ref{"a": {Build: "b-a", Commit: "c1"}, "b": {Build: "b-old", Commit: "c0"}}
-	looked := map[string]string{"b/c2": "b-new"}
-	got, err := wireBuilds(map[string]string{"a": "c1", "b": "c2", "c": "c3", "d": ""}, runs,
-		func(module, commit string) (string, error) { return looked[module+"/"+commit], nil })
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := map[string]string{"a": "b-a", "b": "b-new"}
-	if len(got) != len(want) || got["a"] != want["a"] || got["b"] != want["b"] {
-		t.Fatalf("1145: builds %v, want %v", got, want)
-	}
-}
diff --git a/cmd/mesh-controller/moved.go b/cmd/mesh-controller/moved.go
index 3e9d95da..f84c23bb 100644
--- a/cmd/mesh-controller/moved.go
+++ b/cmd/mesh-controller/moved.go
@@ -15,8 +15,8 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 	sdkdelivery "git.novox.be/novox/mesh-sdk/go/delivery"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/moved_bus_test.go b/cmd/mesh-controller/moved_bus_test.go
index 1e999dd2..e8aebce2 100644
--- a/cmd/mesh-controller/moved_bus_test.go
+++ b/cmd/mesh-controller/moved_bus_test.go
@@ -12,8 +12,8 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/network.go b/cmd/mesh-controller/network.go
index 283e8335..a05ee537 100644
--- a/cmd/mesh-controller/network.go
+++ b/cmd/mesh-controller/network.go
@@ -11,9 +11,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // the private network: who is on it, where, and what they are called.
@@ -308,83 +309,11 @@ func network(ctx context.Context, inv *inventory.Inventory, on map[string]bool,
 
 // graph is the whole mesh's network, for showing it.
 func graph(ctx context.Context, open *stores) ([]overlay.Node, overlay.Graph, error) {
-	inv := open.inventory
-	on, refused, err := whoResolves(ctx, open, overlay.Requirement)
+	in, err := inputFor(ctx, open)
 	if err != nil {
 		return nil, nil, err
 	}
-	g, err := network(ctx, inv, on, refused)
-	if err != nil {
-		return nil, nil, err
-	}
-	return g.Nodes(), g.Graph(), nil
-}
-
-// whoResolves is the machines whose resolution answers a requirement, and why the others did not.
-//
-// By what a module **provides**, not by its name. WireGuard is one way to have a private network
-// and there could be others, so a machine is on the network because something it runs provides
-// one — asking for a particular module by name would be the mistake this whole mechanism exists
-// to avoid.
-//
-// Resolved rather than read from the assignment table, because a module can arrive by being
-// required by something else, and a machine that needs the private network to do its job is on it
-// for the same reason as one that was handed it directly.
-func whoResolves(ctx context.Context, open *stores, requirement string) (
-	map[string]bool, map[string]string, error) {
-	inv := open.inventory
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	on := map[string]bool{}
-	// Why a node could not be resolved, kept rather than raised: one broken node must not stop
-	// the rest being described, and whoever is rendering that node will raise it themselves.
-	refused := map[string]string{}
-	for _, n := range nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
-		switch {
-		case unresolvable(err):
-			refused[n.Name] = err.Error()
-			continue
-		case err != nil:
-			// Not a node that does not resolve — a question that went unanswered. Recording it as a
-			// refusal would take the machine off the private network, and the generator that reads
-			// this would then write a roster and a filter without it (novox/hq 04-ISSUES/152).
-			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w",
-				n.Name, requirement, err)
-		}
-		for _, m := range plan.Modules {
-			for _, offered := range m.Offers() {
-				if offered == requirement {
-					on[n.Name] = true
-				}
-			}
-		}
-	}
-	return on, refused, nil
-}
-
-// rendering is everything a declaration needs, computed over the whole mesh.
-func generators(ctx context.Context, open *stores) (
-	map[string]catalogue.Generator, error) {
-	inv := open.inventory
-	on, refused, err := whoResolves(ctx, open, overlay.Addressing)
-	if err != nil {
-		return nil, err
-	}
-	net, err := network(ctx, inv, on, refused)
-	if err != nil {
-		return nil, err
-	}
-	// **One generator now.** Two more used to sit beside it — the names and a resolver's zone
-	// file — as modules that ran nothing. Both are facts a module asks for in its manifest
-	// (`facts:` — catalogue.FactsInto), computed from the same machines this sees: the ones on the
-	// private network, because a name for a machine not on it would resolve to an address nothing
-	// can reach.
-	return map[string]catalogue.Generator{
-		overlay.Name: net,
-	}, nil
+	return compose.Graph(in.Input)
 }
 
 func overlayShow(ctx context.Context, open *stores) error {
@@ -580,68 +509,6 @@ func onTheNetwork(ctx context.Context, inv *inventory.Inventory,
 	return out, nil
 }
 
-// onThePrivateNetwork is every node's address on the private network, sorted — the same set
-// the names and the resolver mean by it (onTheNetwork), so a rule saying "from the mesh" admits
-// exactly the machines the mesh names.
-//
-// A node with no address is left out rather than rendered as an empty source: an empty entry in a
-// source set is a syntax error in the rule file, and a rule file that does not load leaves the
-// node filtering whatever it was filtering before -- the one outcome worse than a wrong rule,
-// because nothing reports it.
-func onThePrivateNetwork(ctx context.Context, inv *inventory.Inventory,
-	shelf map[string]catalogue.Manifest) ([]string, error) {
-	places, err := onTheNetwork(ctx, inv, shelf)
-	if err != nil {
-		return nil, err
-	}
-	var out []string
-	for _, p := range places {
-		if strings.TrimSpace(p.Address) != "" {
-			out = append(out, p.Address)
-		}
-	}
-	sort.Strings(out)
-	return out, nil
-}
-
-// namesInTheMesh is every machine's internal name and the address behind it — every machine
-// that is on the private network, the same set the resolver means by that.
-//
-// A machine that is not has no name: writing one that resolves to nothing is worse than not
-// writing it, because a connection to an address that does not answer hangs where a name that
-// does not resolve fails at once and says so. A machine placed on the overlay but not running
-// the module that puts it there is exactly that (novox/hq issue 079).
-func namesInTheMesh(ctx context.Context, inv *inventory.Inventory,
-	shelf map[string]catalogue.Manifest) (map[string]string, error) {
-	places, err := onTheNetwork(ctx, inv, shelf)
-	if err != nil {
-		return nil, err
-	}
-	out := map[string]string{}
-	for _, p := range places {
-		out[overlay.InternalName(p.Name)] = p.Address
-	}
-	// And the carried peers the operator has named (novox/hq issue 112): machines the
-	// predecessor's resolver answers for and the mesh routes to, known by name on the operator's
-	// word until they enrol — at which point enrolment verifies the name and the node's own
-	// entry takes over above. A name the predecessor answers for must keep resolving until the
-	// machine behind it is a node; without these, taking the resolver silences three machines.
-	carried, err := inv.CarriedPeers(ctx)
-	if err != nil {
-		return nil, err
-	}
-	for _, p := range carried {
-		if p.Named == "" || p.EnrolledAs != "" {
-			continue
-		}
-		if _, taken := out[overlay.InternalName(p.Named)]; taken {
-			continue // a node of the mesh owns the name; the stale statement loses
-		}
-		out[overlay.InternalName(p.Named)] = p.Address
-	}
-	return out, nil
-}
-
 // artifactStoreOnNetwork is the machine on this network that offers the artifact store, and the
 // port THAT MACHINE put it on — the node's setting when it was given one (novox/hq ADR 0100,
 // 04-ISSUES/102), the mesh's assignment when it made one, and the manifest's own number only when
diff --git a/cmd/mesh-controller/network_test.go b/cmd/mesh-controller/network_test.go
index de917559..92ae3d31 100644
--- a/cmd/mesh-controller/network_test.go
+++ b/cmd/mesh-controller/network_test.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/beside"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // placementOf is what the mesh holds about where one node is.
@@ -84,37 +84,6 @@ func TestAPlacementAndNothingTogetherIsRefused(t *testing.T) {
 	}
 }
 
-// A machine is named for the others only while it is on the private network — placed AND running
-// what puts it there — the same set the resolver means by "on the private network". A machine
-// that has an address and no networking is not named: a name resolving to an address that does
-// not answer hangs where an unknown name fails at once (novox/hq issue 079).
-func TestOnlyAMachineOnThePrivateNetworkIsNamed(t *testing.T) {
-	open := aMesh(t) // two placed machines, both assigned what puts them on the private network
-	ctx := t.Context()
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	names, err := namesInTheMesh(ctx, open.inventory, shelf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if names["anchor.internal"] != "10.77.0.1" || names["laptop.internal"] != "10.77.0.2" {
-		t.Fatalf("two machines on the network are not both named: %v", names)
-	}
-	// The laptop keeps its place and its address, and stops running the network.
-	if err := open.inventory.Unassign(ctx, "laptop", overlay.Name); err != nil {
-		t.Fatal(err)
-	}
-	names, err = namesInTheMesh(ctx, open.inventory, shelf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, still := names["laptop.internal"]; still || names["anchor.internal"] != "10.77.0.1" {
-		t.Fatalf("a machine that left the network is still named, or the one that stayed is not: %v", names)
-	}
-}
-
 // novox/hq ADR 0105: the range every address is composed from is the adopted tunnel's, read from
 // the tunnel the hub holds — never stored anywhere else.
 func TestTheOverlaysRangeIsTheAdoptedTunnels(t *testing.T) {
@@ -315,16 +284,8 @@ func TestTheResolverIsToldEveryMachineOnTheNetworkAndToldAgainWhenOneLeaves(t *t
 func TestTheRosterNamesOnlyTheMachines(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	for _, node := range []string{"anchor", "laptop"} {
-		plan, settings, err := planFor(ctx, open, node)
-		if err != nil {
-			t.Fatal(err)
-		}
-		with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Reading)
+		with, err := renderingOf(ctx, open, node)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/mesh-controller/new_module_approved_test.go b/cmd/mesh-controller/new_module_approved_test.go
index 953aebc7..f5293efe 100644
--- a/cmd/mesh-controller/new_module_approved_test.go
+++ b/cmd/mesh-controller/new_module_approved_test.go
@@ -9,7 +9,7 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/new_module_bus_test.go b/cmd/mesh-controller/new_module_bus_test.go
index e4579d37..05f65214 100644
--- a/cmd/mesh-controller/new_module_bus_test.go
+++ b/cmd/mesh-controller/new_module_bus_test.go
@@ -12,8 +12,8 @@ import (
 
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/new_module_on_merge_test.go b/cmd/mesh-controller/new_module_on_merge_test.go
index 9bd9623d..a022c869 100644
--- a/cmd/mesh-controller/new_module_on_merge_test.go
+++ b/cmd/mesh-controller/new_module_on_merge_test.go
@@ -6,7 +6,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/nodes.go b/cmd/mesh-controller/nodes.go
index 8d8e19ec..232bd89e 100644
--- a/cmd/mesh-controller/nodes.go
+++ b/cmd/mesh-controller/nodes.go
@@ -14,12 +14,12 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 	"github.com/novox/mesh-controller/internal/token"
 )
 
@@ -924,7 +924,7 @@ func showNode(ctx context.Context, stored *stores, name string) error {
 	}
 	// And which of them a push leaves out, and why (novox/hq issue 380): judged as the push judges it, the same
 	// reason its condition says. Not computable is said, never read as "all applied".
-	plan, settings, err := planFor(ctx, stored, name)
+	plan, settings, err := resolveNode(ctx, stored, name)
 	switch {
 	case err != nil:
 		fmt.Printf("\n  whether a send leaves any assigned module out is NOT known: %s\n", oneLine(err.Error()))
diff --git a/cmd/mesh-controller/non_trunk_merge_test.go b/cmd/mesh-controller/non_trunk_merge_test.go
index be0ace88..71322750 100644
--- a/cmd/mesh-controller/non_trunk_merge_test.go
+++ b/cmd/mesh-controller/non_trunk_merge_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/one_group_one_plan_test.go b/cmd/mesh-controller/one_group_one_plan_test.go
index 84c7af6c..14c7647a 100644
--- a/cmd/mesh-controller/one_group_one_plan_test.go
+++ b/cmd/mesh-controller/one_group_one_plan_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/one_resolution_integration_test.go b/cmd/mesh-controller/one_resolution_integration_test.go
index 989f3ca2..f8972224 100644
--- a/cmd/mesh-controller/one_resolution_integration_test.go
+++ b/cmd/mesh-controller/one_resolution_integration_test.go
@@ -5,9 +5,11 @@ package main
 import (
 	"bytes"
 	"context"
-	"errors"
 	"strings"
+
 	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/compose"
 )
 
 func TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer(t *testing.T) {
@@ -23,7 +25,7 @@ func TestAnUnassignThatLeavesItsNodeUnresolvedSaysSoOnceInItsAnswer(t *testing.T
 
 	said := answered(t, func() error { return assignCommand(ctx, "unassign", []string{"laptop", "notes"}) })
 
-	if _, _, err := planFor(ctx, open, "laptop"); err == nil || !unresolvable(err) {
+	if _, _, err := resolveNode(ctx, open, "laptop"); err == nil || !unresolvable(err) {
 		t.Fatalf("laptop resolves with two claimants of one seat: %v", err)
 	}
 	if n := strings.Count(said, "laptop does not resolve now"); n != 1 {
@@ -45,7 +47,7 @@ func TestAnUnassignThatLeavesItsNodeResolvedSaysNothingOfIt(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+	if _, _, err := resolveNode(ctx, open, "laptop"); err != nil {
 		t.Fatal(err)
 	}
 	if strings.Contains(said, "does not resolve") || strings.Contains(said, "could not be read") {
@@ -65,7 +67,7 @@ func TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal(t *testing.T
 	if err == nil {
 		t.Fatalf("two claimants of one node seat resolved:\n%s", said)
 	}
-	_, _, planErr := planFor(ctx, open, "laptop")
+	_, _, planErr := resolveNode(ctx, open, "laptop")
 	if planErr == nil || planErr.Error() != err.Error() {
 		t.Errorf("the act's refusal is not the plan's right after:\nact:  %v\nplan: %v", err, planErr)
 	}
@@ -75,15 +77,16 @@ func TestAnAssignThatLeavesItsNodeUnresolvedSaysOnlyThePlansRefusal(t *testing.T
 }
 
 // The other readers of the whole mesh still say a machine they leave out, on standard error (novox/hq
-// issue 188); an act sends it elsewhere.
+// issue 188); an act sends it elsewhere. The line is mesh-sdk's (compose.Declared.Said); where it goes is the context's.
 func TestAMachineLeftOutIsSaidWhereTheContextSays(t *testing.T) {
+	line := "laptop is left out of the rest of the mesh: it does not resolve: why"
 	var buf bytes.Buffer
-	sayLeftOut(leftOutSaidBy(context.Background(), &buf), "laptop", errors.New("why"))
-	if buf.String() != "laptop is left out of the rest of the mesh: it does not resolve: why\n" {
+	sayFound(leftOutSaidBy(context.Background(), &buf), compose.Declared{Said: []string{line}})
+	if buf.String() != line+"\n" {
 		t.Errorf("said %q", buf.String())
 	}
 	got := answered(t, func() error {
-		sayLeftOut(context.Background(), "laptop", errors.New("why"))
+		sayFound(context.Background(), compose.Declared{Said: []string{line}})
 		return nil
 	})
 	if !strings.Contains(got, "laptop is left out") {
diff --git a/cmd/mesh-controller/one_resolution_test.go b/cmd/mesh-controller/one_resolution_test.go
index 82a873a9..406b9ec7 100644
--- a/cmd/mesh-controller/one_resolution_test.go
+++ b/cmd/mesh-controller/one_resolution_test.go
@@ -3,7 +3,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq issue 237: every line of an act's answer comes from one resolution of the node taken after
diff --git a/cmd/mesh-controller/operator_wait.go b/cmd/mesh-controller/operator_wait.go
index 48e8bae4..6de6747b 100644
--- a/cmd/mesh-controller/operator_wait.go
+++ b/cmd/mesh-controller/operator_wait.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/operator_wait_test.go b/cmd/mesh-controller/operator_wait_test.go
index 1961f821..15879fa7 100644
--- a/cmd/mesh-controller/operator_wait_test.go
+++ b/cmd/mesh-controller/operator_wait_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/order_test.go b/cmd/mesh-controller/order_test.go
index f362c8df..9bd36d56 100644
--- a/cmd/mesh-controller/order_test.go
+++ b/cmd/mesh-controller/order_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/outside_accept_test.go b/cmd/mesh-controller/outside_accept_test.go
index bf314b1c..f34f8d58 100644
--- a/cmd/mesh-controller/outside_accept_test.go
+++ b/cmd/mesh-controller/outside_accept_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // One accept for a provider reaches every consumer that binds the provision from it, and each consumer's send
@@ -32,7 +32,7 @@ func TestOneAcceptForAProviderIsPlacedForEveryConsumer(t *testing.T) {
 	}
 	placed := func(module string) bool {
 		t.Helper()
-		plan, settings, err := planFor(ctx, open, "laptop")
+		plan, settings, err := resolveNode(ctx, open, "laptop")
 		if err != nil {
 			t.Fatalf("laptop was refused: %v", err)
 		}
diff --git a/cmd/mesh-controller/outside_not_given_test.go b/cmd/mesh-controller/outside_not_given_test.go
index 74421aa9..c38ae56e 100644
--- a/cmd/mesh-controller/outside_not_given_test.go
+++ b/cmd/mesh-controller/outside_not_given_test.go
@@ -5,7 +5,8 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 )
 
 // An own secret issued outside the mesh that nobody gave is never made (novox/hq issue 401, ADR 0228). Seen on
@@ -28,7 +29,7 @@ func anAssistant() catalogue.Manifest {
 // sentTo composes what a push sends to a machine, on the send path.
 func sentTo(t *testing.T, open *stores, node string) []map[string]any {
 	t.Helper()
-	plan, settings, err := planFor(t.Context(), open, node)
+	plan, settings, err := resolveNode(t.Context(), open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -99,16 +100,8 @@ func TestAQuestionComposesWithoutAnOutsideSecretNobodyGave(t *testing.T) {
 		t.Fatal(err)
 	}
 	pushedBy(t, open, "laptop") // the mesh's own secret is made by the send
-	plan, settings, err := planFor(ctx, open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, choosing := range []Choosing{Reading, Foreseeing} {
-		got, err := declarationWith(ctx, open, "laptop", plan, settings, gens, choosing)
+	for _, choosing := range []compose.Mode{compose.Reading, compose.Foreseeing} {
+		got, _, err := composeQuestion(ctx, open, "laptop", choosing, false)
 		if err != nil {
 			t.Fatalf("%v: %v", choosing, err)
 		}
diff --git a/cmd/mesh-controller/outside_wait_test.go b/cmd/mesh-controller/outside_wait_test.go
index 1c7a76b8..f5f344a9 100644
--- a/cmd/mesh-controller/outside_wait_test.go
+++ b/cmd/mesh-controller/outside_wait_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/over_budget.go b/cmd/mesh-controller/over_budget.go
index a3b8101e..03c578ff 100644
--- a/cmd/mesh-controller/over_budget.go
+++ b/cmd/mesh-controller/over_budget.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/over_budget_integration_test.go b/cmd/mesh-controller/over_budget_integration_test.go
index 38fc57ab..c16b24ad 100644
--- a/cmd/mesh-controller/over_budget_integration_test.go
+++ b/cmd/mesh-controller/over_budget_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/over_budget_test.go b/cmd/mesh-controller/over_budget_test.go
index 52773bbc..9ba16ee4 100644
--- a/cmd/mesh-controller/over_budget_test.go
+++ b/cmd/mesh-controller/over_budget_test.go
@@ -5,8 +5,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/own_path_by_claim_test.go b/cmd/mesh-controller/own_path_by_claim_test.go
index a54bfd44..0b02f7ac 100644
--- a/cmd/mesh-controller/own_path_by_claim_test.go
+++ b/cmd/mesh-controller/own_path_by_claim_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/owned_paths_test.go b/cmd/mesh-controller/owned_paths_test.go
index 10784a11..1aa8aac4 100644
--- a/cmd/mesh-controller/owned_paths_test.go
+++ b/cmd/mesh-controller/owned_paths_test.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/novox/mesh-host/validate"
+	"git.novox.be/novox/mesh-sdk/go/validate"
 )
 
 // A directory or an archive that says how it reacts to files it does not know (novox/hq ADR 0422) is a
diff --git a/cmd/mesh-controller/pending_integration_test.go b/cmd/mesh-controller/pending_integration_test.go
index ba6a82fe..c6c5b90d 100644
--- a/cmd/mesh-controller/pending_integration_test.go
+++ b/cmd/mesh-controller/pending_integration_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/pending_test.go b/cmd/mesh-controller/pending_test.go
index c5171bca..ed5c12ee 100644
--- a/cmd/mesh-controller/pending_test.go
+++ b/cmd/mesh-controller/pending_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/person_wait_test.go b/cmd/mesh-controller/person_wait_test.go
index cd61536e..eeb3a77d 100644
--- a/cmd/mesh-controller/person_wait_test.go
+++ b/cmd/mesh-controller/person_wait_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/placement_moved_test.go b/cmd/mesh-controller/placement_moved_test.go
index f4a8938b..661f0691 100644
--- a/cmd/mesh-controller/placement_moved_test.go
+++ b/cmd/mesh-controller/placement_moved_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // **Placement leaves the settings layers and no machine is told anything new** (novox/hq ADR 0348 clause
@@ -63,16 +63,12 @@ func TestADeclarationIsTheSameAfterPlacementMoves(t *testing.T) {
 		}
 	}
 
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
 	for _, node := range []string{"anchor", "laptop"} {
-		plan, settings, err := planFor(ctx, open, node)
+		plan, _, err := resolveNode(ctx, open, node)
 		if err != nil {
 			t.Fatal(err)
 		}
-		with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Allocating)
+		with, err := madeAndRendered(ctx, open, node)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/mesh-controller/placement_words_moved_integration_test.go b/cmd/mesh-controller/placement_words_moved_integration_test.go
index f707f74d..75e3b000 100644
--- a/cmd/mesh-controller/placement_words_moved_integration_test.go
+++ b/cmd/mesh-controller/placement_words_moved_integration_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func aMeshWithTheWordsInItsLayers(t *testing.T) (*stores, wordedMesh) {
diff --git a/cmd/mesh-controller/placement_words_moved_test.go b/cmd/mesh-controller/placement_words_moved_test.go
index f6562433..3a8dbadc 100644
--- a/cmd/mesh-controller/placement_words_moved_test.go
+++ b/cmd/mesh-controller/placement_words_moved_test.go
@@ -49,15 +49,11 @@ func theWordedMesh(t *testing.T) wordedMesh {
 func toldOfTheWords(t *testing.T, open *stores, node string) string {
 	t.Helper()
 	ctx := t.Context()
-	gens, err := generators(ctx, open)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
-	plan, settings, err := planFor(ctx, open, node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	with, _, err := renderingFor(ctx, open, node, plan, settings, gens, Allocating)
+	with, err := madeAndRendered(ctx, open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/plan.go b/cmd/mesh-controller/plan.go
index 108c6d83..bd0a70fe 100644
--- a/cmd/mesh-controller/plan.go
+++ b/cmd/mesh-controller/plan.go
@@ -14,13 +14,10 @@ import (
 	"strings"
 	"sync"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/chain"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/licences"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // working out what one machine should be.
@@ -55,339 +52,6 @@ func unresolvable(err error) bool {
 	return errors.As(err, &n)
 }
 
-// planFor works out everything a node should run, from what was assigned to it.
-//
-// A failure to compose the node's own modules is wrapped as notResolvable; every other failure is
-// returned as it is. Callers gathering across the mesh must tell them apart — see notResolvable.
-func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Resolution, catalogue.SettingsBy, error) {
-	inv := open.inventory
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	assigned, err := inv.Assigned(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	capabilities, err := inv.ProfileOf(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	var site string
-	for _, p := range places {
-		if p.Name == nodeName {
-			site = p.Site
-		}
-	}
-
-	world, err := theRestOfTheMesh(ctx, inv, shelf, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	world.Pinned, err = inv.PinsFor(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-	// Where each of its consumers of a provision that keeps data was last sent (novox/hq ADR 0232):
-	// a resolution that would answer one from anywhere else keeps it there, and says so.
-	world.Bound, err = inv.BindingsFor(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// What this mesh can answer with a record rather than a machine, and which record each of
-	// this node's modules was put on. Read across a context boundary by name, which is what
-	// crossing one is allowed to carry (novox/hq ADR 0008).
-	world.Licences, world.Using, err = licencesFor(ctx, open, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// The domain this node composes its routed names under (novox/hq ADR 0066). A route
-	// contribution carries only a label; the resolver joins <label>.<public-domain> for this node,
-	// so the fact travels on the node it belongs to rather than being looked up where the name is
-	// composed.
-	publicDomain, err := inv.PublicDomainOf(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// The operator account this node logs a person in as, and where its home is (novox/hq to-be
-	// 29) — carried so a home-scoped file's owner and path resolve for this machine.
-	who, err := inv.NodeByName(ctx, nodeName)
-	if err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	// A recorded module is composed at the build this machine runs, on any send but a person's push
-	// (novox/hq issue 295, ADR 0245).
-	if _, err := keepRecorded(ctx, open, nodeName, shelf); err != nil {
-		return catalogue.Resolution{}, nil, err
-	}
-
-	resolved, err := catalogue.Resolve(shelf, assigned,
-		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
-			At: onNetwork[nodeName], PublicDomain: publicDomain,
-			Account: who.Account, AccountHome: who.AccountHome,
-			AgentAccount: who.AgentAccount, AgentAccountHome: who.AgentAccountHome}, world)
-	if err != nil {
-		// The node's own set does not compose. Marked, because this is the only failure here that
-		// a mesh-wide gatherer may pass over — see notResolvable.
-		return catalogue.Resolution{}, nil, notResolvable{err}
-	}
-	logUnheld(nodeName, resolved.Unheld)
-
-	// The credential for each thing this node takes from elsewhere. Made once and kept, so the
-	// password a provider is told to create is the one its consumer was given — and sealed to
-	// this node before it was ever written down, so nothing between here and there can read it.
-	for i, n := range resolved.Needs {
-		// **Issued for this holder alone and kept by the vault** (issue 757): where this consumer is handed to the
-		// provisioner, its machine's client asks the vault for it, and the declaration carries no value.
-		resolved.Needs[i].IssuedToHolder = issuedToHolder(shelf, n)
-		resolved.Needs[i].ProviderMoved = providerMoved(shelf, n)
-		if n.ByRecord {
-			// Answered by something the mesh holds, so there is no pair-wise secret between two
-			// machines. Its key was supplied by a person and sealed to this node then; the mesh
-			// discarded the plaintext and cannot make another.
-			sealed, err := keyFor(ctx, open, n.From, nodeName, n.For)
-			if err != nil {
-				return catalogue.Resolution{}, nil, err
-			}
-			resolved.Needs[i].Sealed = sealed
-			// If this holder is the licence's manager, hand it the manager node's PUBLIC sealing key
-			// in its bound facts (novox/hq ADR 0050). It is safe to disclose — a public key — and it
-			// is what the manager module needs to re-seal a rotated refresh token to this same node,
-			// having been given no private key of its own. A consumer holder gets none.
-			pub, err := managerPublicKeyFor(ctx, open, inv, n.From, nodeName, n.For)
-			if err != nil {
-				return catalogue.Resolution{}, nil, err
-			}
-			if pub != "" {
-				serves := map[string]any{}
-				for k, v := range resolved.Needs[i].Serves {
-					serves[k] = v
-				}
-				serves["manager_public_key"] = pub
-				resolved.Needs[i].Serves = serves
-				// The manager holder: its empty pre-adoption refresh token is a waiting state, not a
-				// missing consumer key, so the declaration tolerates it rather than refusing.
-				resolved.Needs[i].Manager = true
-			}
-			continue
-		}
-		var secret inventory.Secret
-		var err error
-		if outsideModule, outside := issuedOutsideBy(shelf, n); outside {
-			// Only a person can give it (novox/hq ADR 0337, issue 164): read as given, never made.
-			secret, err = inv.GivenPairSecret(ctx, n.Name, nodeName, n.For, n.From, outsideModule, n.Local)
-		} else if n.SharedOwn != "" {
-			// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
-			secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
-		} else {
-			secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
-		}
-		if inventory.IsNotGiven(err) {
-			// **Not given, and the rest of the consumer runs** (ADR 0337 §4): no credential file, so the module can
-			// tell it was not given and says it waits for it; the machine is not refused for what only a person can
-			// give, and nothing the mesh made stands in for it.
-			continue
-		}
-		if err != nil {
-			// Said rather than skipped. A machine that resolves cleanly and receives no
-			// credential is one that will fail to authenticate at some later, less obvious
-			// moment.
-			return catalogue.Resolution{}, nil, fmt.Errorf(
-				"%s on %s needs %s from %s and no credential could be made for it: %w",
-				n.For, nodeName, n.Name, n.From, err)
-		}
-		resolved.Needs[i].Sealed = secret.ForConsumer
-	}
-
-	// Settings for everything that resolved, including modules nobody assigned directly: a
-	// requirement pulled in by something else is still configurable, and finding out that it is
-	// not only when you try would be an arbitrary line nobody could predict.
-	//
-	// A setting that reaches nothing, or cannot compose with the definition it was stored for,
-	// no longer refuses the machine here: it is judged where it is stored, and a definition that
-	// moved under it costs that module its place in the declaration, said by name (novox/hq ADR
-	// 0163, rule 6 — see Compose).
-	settings := catalogue.SettingsBy{}
-	for _, m := range resolved.Modules {
-		layers, err := inv.SettingsFor(ctx, nodeName, m.Module)
-		if err != nil {
-			return catalogue.Resolution{}, nil, err
-		}
-		if len(layers) == 0 {
-			continue
-		}
-		settings[m.Module] = layers
-	}
-	return resolved, settings, nil
-}
-
-// theRestOfTheMesh is what every other node holds and offers.
-//
-// Two things at once because they come from the same place — resolving the other nodes — and
-// because both are facts about what is actually running rather than records that could disagree
-// with it. A claim is held by whatever a node runs; a provision is offered by whatever a node
-// runs; neither is a table somebody keeps up to date.
-//
-// **Two passes over the others.** What a node offers the mesh needs that node resolved, and
-// resolving it may need what the mesh offers. So the first pass takes brokered requirements on
-// trust and answers only *what does each node offer*; the second answers everything with that in
-// hand. Nothing is ever declared from the first.
-func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
-	shelf map[string]catalogue.Manifest, exclude string) (catalogue.World, error) {
-
-	// Every node, not only the placed ones. A machine that was never put on the private network
-	// still runs modules, still holds claims, and still offers whatever it offers.
-	// **Who holds each seat on record, before anything is resolved** (novox/hq ADR 0131). Both
-	// passes below need it: without it, the assignment standing beside a seat's holder — the next
-	// holder, waiting for the handover — is refused as a second holder, and its node's whole set
-	// with it.
-	holdings, err := inv.Holdings(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-	siteOf := map[string]string{}
-	for _, p := range places {
-		siteOf[p.Name] = p.Site
-	}
-	// Which machines are actually on the private network, and what they are called there. Not
-	// "has an address" — that was true of every placed machine and told you nothing about whether
-	// anything could reach it. It is what resolved the module.
-	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.World{}, err
-	}
-
-	type candidate struct {
-		node     catalogue.Node
-		assigned []string
-	}
-	var others []candidate
-	// **Every machine's assignments, before the holdings are read by any resolution** (novox/hq ADR 0449 §4): a
-	// seat held once whose holder on record is assigned on no machine needs the whole mesh to be known, and it
-	// passes to its only claimant here, in the composition that finds it.
-	everyAssigned := map[string][]string{}
-	var assignedErr error
-	for _, n := range nodes {
-		theirs, err := inv.Assigned(ctx, n.Name)
-		if err != nil {
-			assignedErr = errors.Join(assignedErr, fmt.Errorf("%s: %w", n.Name, err))
-			continue
-		}
-		if len(theirs) > 0 {
-			everyAssigned[n.Name] = theirs
-		}
-	}
-	holdings = theMeshPassesSeatsOn(ctx, inv, shelf, everyAssigned, assignedErr, holdings)
-	for _, n := range nodes {
-		if n.Name == exclude {
-			continue
-		}
-		theirs := everyAssigned[n.Name]
-		if len(theirs) == 0 {
-			continue
-		}
-		caps, _ := inv.ProfileOf(ctx, n.Name)
-		// Its public domain too (novox/hq ADR 0346): a provider elsewhere serves its own composed names,
-		// and composes them as its own plan does, under its own domain.
-		// Read as its profile is: a machine whose domain cannot be read (removed since the list was read)
-		// composes no public name, which leaves the key out and says so, and fails no other machine's plan.
-		domain, _ := inv.PublicDomainOf(ctx, n.Name)
-		others = append(others, candidate{
-			catalogue.Node{Name: n.Name, Site: siteOf[n.Name], Capabilities: caps,
-				At: onNetwork[n.Name], PublicDomain: domain}, theirs})
-	}
-
-	offered := map[string][]catalogue.Provider{}
-	var firstHeld []catalogue.Held
-	for _, o := range others {
-		got, err := catalogue.Resolve(shelf, o.assigned, o.node, catalogue.World{Unchecked: true, Holdings: holdings})
-		if err != nil {
-			// Said, not skipped: a machine dropped here offers nothing and holds nothing as far
-			// as every other machine's plan can tell (novox/hq issue 188).
-			sayLeftOut(ctx, o.node.Name, err)
-			continue
-		}
-		firstHeld = append(firstHeld, got.Claims...)
-		for _, m := range got.Modules {
-			for _, name := range m.OffersAt(catalogue.ScopeMesh) {
-				// What that module says a consumer needs to know, with that node's settings on
-				// it: a port somebody moved on the provider is a port its consumers must be told
-				// about, and the two coming from different places is how they come to disagree.
-				serves, layers, err := servedOnNode(ctx, inv, o.node.Name, m, name)
-				if err != nil {
-					return catalogue.World{}, err
-				}
-				// And its own composed names, as that node composes them (novox/hq ADR 0346): a name it
-				// does not compose leaves the key out, said under each consumer's need.
-				serves, leftOut, err := got.ServedOwnNames(m, name, serves, catalogue.WithDefaults(m, layers))
-				if err != nil {
-					return catalogue.World{}, err
-				}
-				offered[name] = append(offered[name], catalogue.Provider{
-					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
-			}
-		}
-	}
-	for k := range offered {
-		sort.Slice(offered[k], func(i, j int) bool {
-			return offered[k][i].Node < offered[k][j].Node
-		})
-	}
-
-	// **The second pass is given the first pass's holdings.** A seat's holder answers a requirement
-	// with several providers (novox/hq ADR 0110), so a node consuming one resolves only once the
-	// holder is known. Without them its set is refused here, and a refused node's own claims drop
-	// out of what the mesh holds — so a second holder of one of its seats would pass unrefused.
-	world := catalogue.World{Offered: offered, Held: firstHeld, Holdings: holdings}
-	var held []catalogue.Held
-	for _, o := range others {
-		// Each machine is resolved with its own pins, as its plan is: a machine that needs one to
-		// settle two providers would otherwise be refused here and vanish from the mesh — every
-		// seat it holds unheld, every build that needs one refused (2026-10-01, the control node;
-		// novox/hq issue 188).
-		theirs := world
-		if pins, err := inv.PinsFor(ctx, o.node.Name); err == nil {
-			theirs.Pinned = pins
-		}
-		got, err := catalogue.Resolve(shelf, o.assigned, o.node, theirs)
-		if err != nil {
-			// Said only for the whole-mesh view. With one machine excluded, the others are
-			// resolved without its offers, and one that consumes them cannot resolve here by
-			// design — that is not the machine being dropped, it is the view being partial.
-			if exclude == "" {
-				sayLeftOut(ctx, o.node.Name, err)
-			}
-			continue
-		}
-		held = append(held, got.Claims...)
-	}
-	world.Held = held
-	return world, nil
-}
-
 // leftOutKey carries where theRestOfTheMesh says a machine it leaves out, for an act that answers with
 // its own resolution instead (novox/hq issue 237).
 type leftOutKey struct{}
@@ -406,17 +70,6 @@ func leftOutSaidBy(ctx context.Context, w io.Writer) context.Context {
 	return context.WithValue(ctx, leftOutKey{}, w)
 }
 
-// sayLeftOut says that a machine is left out of the rest of the mesh, where ctx says to: standard
-// error unless an act said otherwise. Said, not skipped: a machine dropped there offers nothing and
-// holds nothing as far as every other machine's plan can tell (novox/hq issue 188).
-func sayLeftOut(ctx context.Context, node string, err error) {
-	w, ok := ctx.Value(leftOutKey{}).(io.Writer)
-	if !ok {
-		w = os.Stderr
-	}
-	fmt.Fprintf(w, "%s is left out of the rest of the mesh: it does not resolve: %v\n", node, err)
-}
-
 // declarationFor is everything a node would be sent.
 //
 // One place, because there were three and one of them was written before credentials existed and
@@ -424,170 +77,15 @@ func sayLeftOut(ctx context.Context, node string, err error) {
 // `plan --json` handed to anything reading it.
 func declarationFor(ctx context.Context, open *stores, node string,
 	plan catalogue.Resolution, settings catalogue.SettingsBy) (sendable, error) {
-	gens, err := generators(ctx, open)
-	if err != nil {
-		return sendable{}, err
-	}
-	// **Allocating, because `plan` is the send without the sending.** It is one machine, named by
+	// **A send, because `plan` is the send without the sending.** It is one machine, named by
 	// a person, who is asking what a push would do — so the port it shows and the secret it seals
 	// have to be the ones a push would use, and both are kept once chosen. Showing numbers that a
 	// later push would replace would make the command answer a question nobody asked.
 	//
 	// The line is not "a question may not write". It is who is asking and how often: this is a
 	// person, about one machine, on purpose. What may not write is the comparison the mesh runs
-	// over every machine to answer whether each is up to date — see Choosing.
-	return declarationWith(ctx, open, node, plan, settings, gens, Allocating)
-}
-
-// declarationWith is the same, for a caller that has already worked out the generators once and
-// is about to use them for every node.
-// Choosing says whether this composition may allocate what has not been allocated yet.
-//
-// **The comparison the mesh runs over every machine must not change what it is comparing.**
-// Composing a declaration assigns each module a machine port and seals its secrets, and `status`
-// composes one for every node to answer *is this machine running what I would send it* — so that
-// question allocated, minted, wrote, and contended with the very machine it was asking about. A
-// status polled every two seconds while a node applies is then two writers on the same rows,
-// which is how it came to hang rather than answer.
-//
-// `plan` sits on the other side of this and allocates, because it is a person asking what a push
-// would do to one named machine. The distinction is not question versus command; it is a person
-// asking once about one machine versus the mesh asking continuously about all of them.
-//
-// So the mesh chooses a port when it commits to sending one, and every other caller reads what
-// was chosen. A module with nothing assigned yet has never been sent, which is exactly what a
-// machine "waiting" means — the read needs no number to be right about that.
-type Choosing int
-
-const (
-	// Reading is every question: what is assigned is used, and nothing is created.
-	Reading Choosing = iota
-	// Allocating is the send path: what is not assigned yet is assigned now and kept.
-	Allocating
-	// Foreseeing is Reading, asked ahead of a send (the self-check's D1, novox/hq issue 275): nothing
-	// is created, and an own secret the next send WOULD make is composed with a stand-in and named
-	// (sendable.foreseen) rather than failing the composition — while one the send would be refused
-	// (a bus credential nobody issued, a given secret under an old key) is refused here as it would
-	// be there. Never sent: the stand-in is not a sealed value.
-	Foreseeing
-)
-
-func declarationWith(ctx context.Context, open *stores, node string,
-	plan catalogue.Resolution, settings catalogue.SettingsBy,
-	gens map[string]catalogue.Generator, choosing Choosing) (sendable, error) {
-	with, record, err := renderingFor(ctx, open, node, plan, settings, gens, choosing)
-	if err != nil {
-		return sendable{}, err
-	}
-	composed, err := plan.Compose(with)
-	if err != nil {
-		return sendable{}, err
-	}
-	// Which ports the filter admits from the local network, and from which networks, for plan to say
-	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
-	rules, err := plan.Rules(with)
-	if err != nil {
-		return sendable{}, err
-	}
-	// And what was taken on it, said in every declaration it is sent from this one place.
-	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
-	if err != nil {
-		return sendable{}, err
-	}
-	out := sendable{Resources: composed.Resources, Adoption: adoption,
-		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
-		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
-		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced, handedOnly: composed.HandedOnly,
-		modules: namedModules(plan, composed.LeftOut),
-		Filled:  composed.Filled, plans: composed.Plans,
-		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
-	if len(composed.Filled) > 0 {
-		out.Provisioner = with.Provisioner
-	}
-	// A handed module only pulled in by another keeps what requires it, for its value of its own in the assignments
-	// mirror (issue 765).
-	for module := range composed.Plans {
-		if by := plan.RequiredBy(module); by != "" {
-			if out.requiredBy == nil {
-				out.requiredBy = map[string]string{}
-			}
-			out.requiredBy[module] = by
-		}
-	}
-	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
-	// 0221). Read only on the send path: a question about what would be sent records nothing.
-	if choosing == Allocating {
-		carried, err := carriedOn(ctx, open, node, plan, composed.LeftOut, true)
-		if err != nil {
-			return sendable{}, err
-		}
-		out.Builds = carried
-		out.Bindings = boundToData(plan, composed.LeftOut)
-	}
-	// And the module of each resource and the build of each module, to a machine whose node-engine said it reads them
-	// (novox/hq issue 1145) and to no other; the same whatever the composition is for, so what a question about the
-	// send digests is what the send digests.
-	reads, err := open.inventory.ReadsModules(ctx, record.ID)
-	if err != nil {
-		return sendable{}, err
-	}
-	if reads {
-		carried := out.Builds
-		if choosing != Allocating {
-			if carried, err = carriedOn(ctx, open, node, plan, composed.LeftOut, false); err != nil {
-				return sendable{}, err
-			}
-		}
-		runs, err := open.inventory.AssignmentRuns(ctx, node)
-		if err != nil {
-			return sendable{}, err
-		}
-		builds, err := wireBuilds(carried, runs, func(module, commit string) (string, error) {
-			return open.inventory.BuildOf(ctx, module, commit)
-		})
-		if err != nil {
-			return sendable{}, err
-		}
-		out.ReadsModules, out.moduleOf, out.buildIDs = true, composed.Owner, builds
-	}
-	return out, nil
-}
-
-// carriedOn is the build of each module a declaration for node carries (see carriedBuilds), the module kept at the
-// build a machine runs included (ADR 0245). Only a send (strict) fails for a kept module that cannot be read: a question
-// about it is answered without.
-func carriedOn(ctx context.Context, open *stores, node string, plan catalogue.Resolution, leftOut map[string]string,
-	strict bool) (map[string]string, error) {
-	current, err := open.inventory.CurrentBuilds(ctx)
-	if err != nil {
-		return nil, err
-	}
-	before, known, err := open.inventory.SentBuilds(ctx, node)
-	if err != nil {
-		return nil, err
-	}
-	if !known {
-		before = nil
-	}
-	names := make([]string, 0, len(plan.Modules))
-	for _, m := range plan.Modules {
-		names = append(names, m.Module)
-	}
-	out := carriedBuilds(names, leftOut, current, before)
-	// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245).
-	kept, err := recordedKept(ctx, open, node)
-	if err != nil {
-		if strict {
-			return nil, err
-		}
-		kept = nil
-	}
-	for m, was := range kept {
-		if _, carried := out[m]; carried {
-			out[m] = was
-		}
-	}
-	return out, nil
+	// over every machine to answer whether each is up to date, which is a question and makes nothing (composeQuestion).
+	return composeSend(ctx, open, node)
 }
 
 // boundToData is every binding of this machine's consumers to a provision that keeps their data
@@ -614,25 +112,6 @@ func boundToData(plan catalogue.Resolution, leftOut map[string]string) []invento
 	return out
 }
 
-// carriedBuilds is the build of each module a declaration carries, as a send records it (novox/hq
-// issue 259): the module's current build for each module in it, and for a module left out of it
-// (ADR 0163, rule 6) the build it was last sent, since the machine keeps that one — or nothing, when
-// that is not known. Never nil, so a send through here always records what it knows.
-func carriedBuilds(modules []string, leftOut map[string]string, current map[string]inventory.CurrentBuild,
-	before map[string]string) map[string]string {
-	out := map[string]string{}
-	for _, m := range modules {
-		if _, left := leftOut[m]; left {
-			if was, kept := before[m]; kept {
-				out[m] = was
-			}
-			continue
-		}
-		out[m] = current[m].Commit
-	}
-	return out
-}
-
 // sortedKeysOf is a map's keys, sorted — so what a declaration says it left out does not move
 // for a reordering nobody made.
 func sortedKeysOf(m map[string]string) []string {
@@ -674,499 +153,6 @@ func reportLeftOut(node string, declared sendable) {
 	}
 }
 
-// busCredentialIssued refuses an own secret called `broker` whose bus account nobody issued.
-//
-// **The broker credential is never invented here** (novox/hq issue 203). Every other own secret is
-// the mesh's to make — a password nobody else knows — but this one is an account on the bus, minted
-// by `module issue` and sealed by it; a push that made a random one would deliver a file the process
-// cannot read and report the machine applied. Refused by name, with the verb — on the send, and on
-// a question asked ahead of it (Foreseeing), so that one is never told the push will make it.
-func busCredentialIssued(ctx context.Context, inv *inventory.Inventory, node, module, name string) error {
-	var user string
-	switch name {
-	case "broker":
-		user = broker.Principal{Kind: broker.KindModule, Node: node, Module: module}.Username()
-	case broker.ProvisionerSecret:
-		// And the machine's provisioner client's account, issued with its module (novox/hq ADR 0349 clause 11,
-		// design 57 P3): the same refusal, for the same reason.
-		user = broker.Principal{Kind: broker.KindProvisioner, Node: node, Module: module}.Username()
-	default:
-		return nil
-	}
-	if _, minted, err := inv.BusUserHash(ctx, user); err != nil {
-		return err
-	} else if !minted {
-		return fmt.Errorf(
-			"%s on %s has no bus credential: nothing was issued for %s, and a push "+
-				"would seal a placeholder its process cannot read (novox/hq issue 203). "+
-				"`module issue %s --node %s`, then push again",
-			module, node, user, module, node)
-	}
-	return nil
-}
-
-// givenUnderAnOldKey is the refusal for a value a person gave — a family's member, or an own secret issued outside
-// the mesh — sealed to a key the machine no longer holds: the mesh cannot make another, so it is given again.
-func givenUnderAnOldKey(module, node, name string) error {
-	return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
-		"since generated a new sealing key. The mesh cannot make another; give it again", module, node, name, node)
-}
-
-// renderingFor is everything a node's declaration is composed with, and the node's record.
-func renderingFor(ctx context.Context, open *stores, node string,
-	plan catalogue.Resolution, settings catalogue.SettingsBy,
-	gens map[string]catalogue.Generator, choosing Choosing) (catalogue.Rendering, inventory.Node, error) {
-	inv := open.inventory
-	grants, withheld, unbound, err := grantsFor(ctx, open, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// Where this machine puts what each module needs reachable (novox/hq ADR 0038).
-	//
-	// **Assigned here rather than written by a module**, because a module is written once and
-	// assigned anywhere: any number it picks is a guess about a machine it has never seen. Made
-	// before the declaration is composed, because the container's mapping, the rule set and what a
-	// consumer is told are all derived from it.
-	// What this machine was already given, for a composition that may not allocate.
-	already := map[string]map[int]int{}
-	if choosing != Allocating {
-		held, err := inv.PortsFor(ctx, node)
-		if err != nil {
-			return catalogue.Rendering{}, inventory.Node{}, err
-		}
-		for _, a := range held {
-			if already[a.Module] == nil {
-				already[a.Module] = map[int]int{}
-			}
-			already[a.Module][a.Wanted] = a.Machine
-		}
-	}
-
-	// The machine ports this node was given for its modules (novox/hq ADR 0100): the foundation's
-	// ports, as genesis chose them. A given port wins over anything assigned and over a manifest's
-	// own long-form mapping.
-	given := map[string]map[int]int{}
-	for _, m := range plan.Modules {
-		g, err := catalogue.GivenPorts(m, settings[m.Module])
-		if err != nil {
-			// A given port its definition no longer publishes: the module is left out of the
-			// declaration, by name, when it is composed (novox/hq ADR 0163, rule 6) — never the
-			// machine refused here for it.
-			continue
-		}
-		if g != nil {
-			given[m.Module] = g
-		}
-	}
-	// And one holder per machine port across the node's modules: settings written before this was
-	// refused where they are set are refused here rather than composed into two containers on
-	// one port.
-	holders := map[int]string{}
-	for _, m := range plan.Modules {
-		for _, at := range given[m.Module] {
-			if other, twice := holders[at]; twice && other != m.Module {
-				return catalogue.Rendering{}, inventory.Node{}, fmt.Errorf("%w: %s and %s are "+
-					"both given machine port %d on %s", inventory.ErrPortTaken, other, m.Module,
-					at, node)
-			}
-			holders[at] = m.Module
-		}
-	}
-
-	ports := map[string]map[int]int{}
-	for _, m := range plan.Modules {
-		for _, l := range m.Listens {
-			if at, isGiven := given[m.Module][l.Port]; isGiven {
-				if ports[m.Module] == nil {
-					ports[m.Module] = map[int]int{}
-				}
-				ports[m.Module][l.Port] = at
-				continue
-			}
-			// **Only a port the module actually publishes is the mesh's to move.** A container's
-			// mapping is the thing that translates; without one the software binds what it binds,
-			// and an assignment would not move the service — it would open the wrong number in the
-			// rule set and leave the real one shut. Recorded either way, because this map means
-			// *where this module's port is on this machine* and every reader of it needs that
-			// answer whether or not the mesh was the one who chose it.
-			where, mayAssign := m.MachineSide(l.Port)
-			switch {
-			case mayAssign && choosing == Allocating:
-				at, err := inv.PortFor(ctx, node, m.Module, l.Port, l.Fixed)
-				if err != nil {
-					return catalogue.Rendering{}, inventory.Node{}, fmt.Errorf(
-						"%s needs %d reachable on %s and it could not be assigned: %w",
-						m.Module, l.Port, node, err)
-				}
-				where = at.Machine
-			case mayAssign:
-				// Whatever was chosen last time, and nothing if there was no last time.
-				if at, known := already[m.Module][l.Port]; known {
-					where = at
-				}
-			}
-			if ports[m.Module] == nil {
-				ports[m.Module] = map[int]int{}
-			}
-			ports[m.Module][l.Port] = where
-		}
-	}
-
-	// And each module's own secrets — a superuser password, an administrator, an account. Made
-	// per node, so a module running on three machines has three.
-	needed := map[string]map[string]string{}
-	foreseen := map[string]map[string]bool{}
-	// **A module handed to the provisioner here has its secrets from the vault** (novox/hq ADR 0349 §7, §11,
-	// design 57 V4): its machine's client asks for each, so the controller makes, reads and seals none of them for
-	// this machine. Every other module's are made and sealed as before.
-	hands, err := engineTakesHanded(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	handing := catalogue.Rendering{Hands: hands, Provisioner: provisionerAccount(plan)}
-	for _, m := range plan.Modules {
-		if handing.Handing(m) {
-			continue
-		}
-		// **A secret family is never made** (novox/hq ADR 0283): each member a person gave on this machine is
-		// placed, and one not given is nothing — the module says it waits for it.
-		for _, family := range m.OwnSecrets.Families() {
-			members, err := inv.GivenMembers(ctx, node, m.Module, family)
-			if err != nil {
-				return catalogue.Rendering{}, inventory.Node{}, err
-			}
-			for _, g := range members {
-				if _, fam, ok := m.OwnSecrets.Lookup(g.Name); !ok || fam != family {
-					continue // a longer family's member, or a name no longer of this family
-				}
-				if !g.Current {
-					if choosing == Allocating {
-						return catalogue.Rendering{}, inventory.Node{}, givenUnderAnOldKey(m.Module, node, g.Name)
-					}
-					continue
-				}
-				if needed[m.Module] == nil {
-					needed[m.Module] = map[string]string{}
-				}
-				needed[m.Module][g.Name] = g.Sealed
-			}
-		}
-		for name, own := range m.OwnSecrets.Plain() {
-			// **An own secret issued outside the mesh is never made** (novox/hq issue 401, ADR 0228; ADR 0283 for
-			// a family): only a value a person gave is placed. One not given is nothing — no file, and an empty
-			// value where a file of the module names it — so the module can tell it was not given, where a value
-			// the mesh made looked given and wrong. A value the mesh made for it before is not one either.
-			if own.IssuedBy == catalogue.IssuedOutside {
-				g, given, err := inv.GivenOwnSecret(ctx, node, m.Module, name)
-				if err != nil {
-					return catalogue.Rendering{}, inventory.Node{}, err
-				}
-				if !given {
-					continue
-				}
-				if !g.Current {
-					if choosing == Allocating {
-						return catalogue.Rendering{}, inventory.Node{}, givenUnderAnOldKey(m.Module, node, name)
-					}
-					continue
-				}
-				if needed[m.Module] == nil {
-					needed[m.Module] = map[string]string{}
-				}
-				needed[m.Module][name] = g.Sealed
-				continue
-			}
-			// Minted on the send path and only read on every other. Making one is an insert, and
-			// a question that writes is a question that can block against the machine it is about.
-			var sealed string
-			var err error
-			if choosing == Allocating {
-				if err := busCredentialIssued(ctx, inv, node, m.Module, name); err != nil {
-					return catalogue.Rendering{}, inventory.Node{}, err
-				}
-				sealed, err = inv.SecretForModule(ctx, node, m.Module, name)
-			} else {
-				var held bool
-				sealed, held, err = inv.ModuleSecretIfIssued(ctx, node, m.Module, name)
-				if err == nil && !held && choosing == Foreseeing {
-					// Asked ahead of the send: what the send would do about it, by the send's own
-					// rules. Made by it — a stand-in, named; refused by it — refused here, the same
-					// words (novox/hq issue 275).
-					if err := busCredentialIssued(ctx, inv, node, m.Module, name); err != nil {
-						return catalogue.Rendering{}, inventory.Node{}, err
-					}
-					if err := inv.WouldMakeSecretForModule(ctx, node, m.Module, name); err != nil {
-						return catalogue.Rendering{}, inventory.Node{}, err
-					}
-					if foreseen[m.Module] == nil {
-						foreseen[m.Module] = map[string]bool{}
-					}
-					foreseen[m.Module][name] = true
-					continue
-				}
-				if err == nil && !held {
-					// Never issued, so this machine cannot be running it. Left out rather than
-					// invented: an empty string here would compose a declaration that differs
-					// from what would be sent, and the comparison this feeds would then be
-					// answering about a declaration nothing will ever push.
-					continue
-				}
-			}
-			if err != nil {
-				return catalogue.Rendering{}, inventory.Node{}, err
-			}
-			if needed[m.Module] == nil {
-				needed[m.Module] = map[string]string{}
-			}
-			needed[m.Module][name] = sealed
-		}
-	}
-	// **The core's own credentials as the vault sealed them** (novox/hq ADR 0349 §16, issue 755), for an engine that
-	// opens the vault's box (core_box.go): the declaration carries the box, never the seal made above. Below that
-	// contract nothing here is asked and the composition is as it was.
-	var core coreBoxes
-	opensBox, err := engineOpensVaultBox(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	if opensBox {
-		core, err = coreBoxesFor(ctx, inv, node, plan.Modules, func(m catalogue.Manifest) bool {
-			return handing.Handing(m)
-		}, choosing)
-		if err != nil {
-			return catalogue.Rendering{}, inventory.Node{}, err
-		}
-	}
-	// And a certificate for this machine's name inside the mesh, when anything on it asks. Issued
-	// rather than stored: the node's key does not change, so signing again produces an equally
-	// valid certificate and there is nothing to keep in step.
-	var certificate, authority string
-	for _, m := range plan.Modules {
-		if m.Certificate == nil {
-			continue
-		}
-		issued, meshCA, err := certificateFor(ctx, open, node)
-		if err != nil {
-			return catalogue.Rendering{}, inventory.Node{}, err
-		}
-		certificate, authority = issued, meshCA
-		break
-	}
-
-	// And who else is on the private network, which is what a rule saying "from the mesh"
-	// resolves to. Every node's address, including this one's: a machine reaching itself by its
-	// own overlay address rather than by loopback is ordinary, and leaving it out would filter
-	// the node's own traffic to itself with no rule naming why.
-	// One reading of the catalogue for the three questions below that resolve the whole mesh.
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	private, err := onThePrivateNetwork(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// The private network's range, offered to a module as ${machine:mesh-range} — a module that must
-	// name the whole mesh (an intrusion filter that must never ban a tunnel peer) names it here
-	// rather than hardcoding a value it cannot know.
-	meshRange, err := overlayRange(ctx, inv)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-
-	// The artifact store as this node reaches it now — the address every image and archive the
-	// mesh built is fetched through, composed here and recorded nowhere — with what the mesh has
-	// built, so a reference recorded with an address before that is re-routed too.
-	artifactStore, err := artifactStoreAddress(ctx, inv, shelf, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	held, err := inv.Held(ctx)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	built := make(map[string]bool, len(held))
-	for repository := range held {
-		built[repository] = true
-	}
-
-	// And every machine's name, so a container can reach one. The same set that writes the
-	// machine's own hosts file — one reading, so a container and its machine cannot disagree
-	// about where another machine is.
-	names, err := namesInTheMesh(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-
-	// Each machine's operator account, so an ssh Host block can name the login for every node
-	// (novox/hq to-be 29). Keyed by the bare node name, which entriesFrom falls back to.
-	allNodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	accounts := map[string]string{}
-	for _, n := range allNodes {
-		if n.Account != "" {
-			accounts[n.Name] = n.Account
-		}
-	}
-
-	// **The roster is the machines and nothing else** (novox/hq ADR 0191). Each node has one internal
-	// domain, `<node>.internal`, and every route on it is a name under that domain (ADR 0151), which
-	// the resolver answers with one wildcard per machine — so no route needs a line of its own. A
-	// node's public domains are the operator's and public DNS answers them; the mesh gives no private
-	// answer for any of them. The roster once carried every routed name, public ones included, and a
-	// resolver that also serves a LAN handed a phone a tunnel address for the mail server.
-	// `.Names` and `.Machines` stay two fields so a module's template keeps rendering (issue 111).
-	machines := make(map[string]string, len(names))
-	for name, at := range names {
-		machines[name] = at
-	}
-
-	// And every zone a module in the mesh answers itself (novox/hq ADR 0199), for the mesh's resolver
-	// to forward.
-	zones, err := zonesInTheMesh(ctx, open)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-
-	// And who holds each replicated seat, where (novox/hq ADR 0223): every machine's resolver file
-	// lists every holder of the mesh's resolver.
-	replicas, err := replicatedHolders(ctx, inv, shelf)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-
-	// **The bus is never public** (novox/hq ADR 0169). It was a foundation port — widened from the
-	// broker's own `from: mesh` to from-anywhere on the broker's host, so a machine could enrol
-	// before it had an address on the private network. A machine joins through the tunnel now, and
-	// every link to the bus crosses it, so its reach is what the `nats` module declares: the mesh.
-	// Nothing the mesh itself needs is opened beyond what a module declares.
-	var foundation []int
-
-	// And, for a module that keeps them, every operator-sealed secret in the mesh — the vault's
-	// copy, outside the store (novox/hq ADR 0085, amended). Read only; nothing here mints. The
-	// export changes whenever any secret in the mesh is made or rotated, so the vault's declaration
-	// changes with it and the vault node is sent again: that is what keeps its copy current, and
-	// the cost is one two-table read per composition of the vault's node, in every mode.
-	var kept *catalogue.KeptExport
-	for _, m := range plan.Modules {
-		if m.Keeps == "" {
-			continue
-		}
-		if kept, err = inv.OperatorExport(ctx); err != nil {
-			return catalogue.Rendering{}, inventory.Node{}, err
-		}
-		break
-	}
-
-	// Whether this node is adopted (novox/hq ADR 0100): then the found firewall stays in force, and
-	// the declaration carries openings and the mesh's guard in place of a filter.
-	record, err := inv.NodeByName(ctx, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// And, on an adopted node, which modules were taken there: the guard is derived from those
-	// only (novox/hq ADR 0103).
-	var taken map[string]bool
-	if record.Adopted {
-		list, err := inv.Taken(ctx, node)
-		if err != nil {
-			return catalogue.Rendering{}, inventory.Node{}, err
-		}
-		taken = map[string]bool{}
-		for _, m := range list {
-			taken[m] = true
-		}
-	}
-	// Where this node put the foundation's servers, for the control plane's own connections
-	// (novox/hq 04-ISSUES/102): read from the node's settings for whatever claims each seat,
-	// exactly as a consumer's binding is, never from what genesis wrote into a secret.
-	seats, err := seatsOn(ctx, inv, shelf, node, plan.Modules, record.Adopted, taken)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// The bus's user list, for the machine that runs the bus. Composed per push rather than kept,
-	// because it is a function of the mesh's records and a kept copy could disagree with them.
-	busUsers, err := composeBusUsers(ctx, inv, plan.Modules)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	memberships, err := inv.BusMemberships(ctx)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// Which of this machine's links face outside, which is what the derived filter is written
-	// around (novox/hq ADR 0140). Reported by the machine, never set.
-	outwardLinks, err := inv.OutwardLinksOf(ctx, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
-	// private ranges only, on a link facing outside it. Reported by the machine, never set.
-	local, err := localNetworksOf(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
-	// 0222): the artifact store as this network reaches it, which the container runtime is told to
-	// trust (ADR 0082). The same address composed into every reference the mesh built.
-	var reach map[string]string
-	if artifactStore != "" {
-		reach = map[string]string{"mesh-artifact-store": artifactStore}
-	}
-	readsHealth, err := engineReadsHealth(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	judgesRoot, err := engineJudgesRoot(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	readsBusy, err := engineReadsBusy(ctx, inv, node)
-	if err != nil {
-		return catalogue.Rendering{}, inventory.Node{}, err
-	}
-	return catalogue.Rendering{
-		ReadsHealth:   readsHealth,
-		JudgesRoot:    judgesRoot,
-		ReadsBusy:     readsBusy,
-		Hands:         hands,
-		Provisioner:   provisionerAccount(plan),
-		BusMembership: memberships[node],
-		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
-		VaultSealed: core.sealed, NotPlaced: core.notPlaced,
-		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
-		Machines: machines, Zones: zones, Holders: replicas,
-		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
-		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		LocalNetworks: catalogue.CountedLocalNetworks(local),
-		Given:         given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
-		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
-	}, record, nil
-}
-
-// engineReadsHealth says whether a machine's node-engine reads a declared `health` (novox/hq ADR 0240
-// Phase B), by its own newest statement: one older, or one that never stated anything, is not sent the
-// field, because it parses strictly and would refuse the whole declaration for it.
-func engineReadsHealth(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
-	stated, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return false, err
-	}
-	return had && stated.Contract >= link.ReadinessContract, nil
-}
-
-// engineJudgesRoot says whether a machine's node-engine judges a user's declared `root` (novox/hq ADR 0266),
-// by its own newest statement, for the same reason as engineReadsHealth: an older engine parses strictly.
-func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
-	stated, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return false, err
-	}
-	return had && stated.Contract >= link.RootContract, nil
-}
-
 // engineReadsBusy says whether a machine's node-engine reads a container's `busy` (novox/hq ADR 0335), by its
 // own newest statement, for the same reason as engineReadsHealth: an older engine parses strictly.
 func engineReadsBusy(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
@@ -1177,23 +163,6 @@ func engineReadsBusy(ctx context.Context, inv *inventory.Inventory, node string)
 	return had && stated.Contract >= link.BusyContract, nil
 }
 
-// engineTakesHanded says whether a machine's node-engine writes a filled file on the provisioner client's word alone
-// (link.HandedContract, design 57 P7), by its own newest statement: only there is a moved module handed to the
-// provisioner (design 57 P6). Anywhere else a filled file would have two writers, and the module is sent as before.
-func engineTakesHanded(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
-	stated, had, err := inv.HealthOf(ctx, node)
-	if err != nil {
-		return false, err
-	}
-	return takesHanded(stated, had), nil
-}
-
-// takesHanded is whether a machine's newest statement (had: it ever stated one) is of an engine that writes a
-// filled file on the provisioner client's word alone.
-func takesHanded(stated inventory.NodeHealth, had bool) bool {
-	return had && stated.Contract >= link.HandedContract
-}
-
 // provisionerAccount is the account the provisioner's client runs as on this machine (novox/hq ADR 0349 §4): the user
 // the process of the module running it runs as, empty where no such module is on the machine.
 func provisionerAccount(plan catalogue.Resolution) string {
@@ -1231,71 +200,6 @@ func busyNotSent(modules []catalogue.Manifest, reads bool) []string {
 	return out
 }
 
-// zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR
-// 0199): the zone settled from that node's settings, the node's private address, the port the
-// answering listen is published on there.
-//
-// Read across every machine's resolution, as the roster once read routed names: a node whose set does
-// not compose declares nothing and is passed over, so one broken machine does not cost the rest their
-// zones; a store that cannot be read is raised, naming the machine, because returning the zones
-// without it would withdraw them from the resolver as if the operator had (novox/hq 04-ISSUES/152).
-// What the mesh refuses about the zones together — one declared twice, one shadowing the mesh's
-// suffix or a node's public domain — is refused here, by name.
-func zonesInTheMesh(ctx context.Context, open *stores) ([]catalogue.ZoneAt, error) {
-	inv := open.inventory
-	places, err := inv.Overlays(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("where the machines are cannot be read: %w", err)
-	}
-	address := map[string]string{}
-	for _, p := range places {
-		if strings.TrimSpace(p.Address) != "" {
-			address[p.Name] = p.Address
-		}
-	}
-	nodes, err := inv.Nodes(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("which machines the mesh has cannot be read: %w", err)
-	}
-	var zones []catalogue.ZoneAt
-	var public []string
-	for _, n := range nodes {
-		plan, _, err := planFor(ctx, open, n.Name)
-		switch {
-		case unresolvable(err):
-			continue
-		case err != nil:
-			return nil, fmt.Errorf("the zones %s answers cannot be read: %w", n.Name, err)
-		}
-		if plan.PublicDomain != "" {
-			public = append(public, plan.PublicDomain)
-		}
-		for _, m := range plan.Modules {
-			if m.Zone == nil {
-				continue
-			}
-			at := address[n.Name]
-			if at == "" {
-				// Not on the private network yet: nothing could reach its answerer.
-				continue
-			}
-			published, layers, err := portsGivenOn(ctx, inv, n.Name, m)
-			if err != nil {
-				return nil, fmt.Errorf("the zone %s declares on %s cannot be read: %w", m.Module, n.Name, err)
-			}
-			z, err := catalogue.ZoneOn(m, layers, published, n.Name, at)
-			if err != nil {
-				return nil, err
-			}
-			zones = append(zones, *z)
-		}
-	}
-	if problems := catalogue.ZonesProblems(zones, overlay.Suffix(), public); len(problems) > 0 {
-		return nil, fmt.Errorf("the mesh's zones cannot be forwarded:\n  - %s", strings.Join(problems, "\n  - "))
-	}
-	return zones, nil
-}
-
 // certificateFor is what the mesh certifies about one machine's internal name.
 //
 // It reaches across two contexts and reads neither one's store from the other: `inventory` knows
@@ -1358,134 +262,6 @@ func certificateFor(ctx context.Context, open *stores, node string) (string, str
 	return issued, authority.Certificate, nil
 }
 
-// grantsFor is every credential this node must create, because something elsewhere uses it.
-//
-// The mirror of what a consumer is given, and the half that makes the credential real: a password
-// nothing was told to create is a password that authenticates nowhere. Sealed to this node, so
-// the mesh hands over something it cannot itself use.
-//
-// **One consumer's identity never refuses the provider's machine** (novox/hq ADR 0225, issue 263).
-// A consumer whose identity overflows the provision's bound is left out of the grants and returned
-// beside them, for push, plan and `status` to say; every other consumer is granted and the provider's
-// declaration composes. Refusing here once made a whole machine unpushable for one module elsewhere.
-//
-// **A provider is granted exactly the consumers whose own resolution binds them to it** (novox/hq
-// issue 274). The pair credentials on record say only whom this node was ever asked by: after a
-// consumer of a provision that keeps its data was moved and pinned back (issue 273, ADR 0232), the
-// credential from the provider it left was still on record, so that provider went on being asked for
-// five databases nobody used and never retired them. A credential whose consumer is bound elsewhere
-// is withdrawn here like one nobody asks for — the provider retires it and keeps its data (ADR 0230)
-// — and returned beside the grants, for plan and push to say. It stays on record: it is the key to
-// the login the provider keeps until `cleanup delete`, and to that data should a person pin it back.
-func grantsFor(ctx context.Context, open *stores, node string) (
-	[]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
-	inv := open.inventory
-	issued, err := inv.SecretsFrom(ctx, node)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	// Where each consumer is, so a provider that must reach back to one does not have to know how
-	// the mesh names machines.
-	shelf, err := inv.Catalogue(ctx)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
-	if err != nil {
-		return nil, nil, nil, err
-	}
-
-	// What each consumer actually asked for, taken from that machine's own resolution rather than
-	// from a record beside it. A provider told to create a password and not what to create it for
-	// can do nothing with it, and the name a consumer wants is the consumer's to say.
-	out := make([]catalogue.Grant, 0, len(issued))
-	var withheld []catalogue.Overflow
-	var unbound []catalogue.Unbound
-	for _, s := range issued {
-		plan, settings, err := planFor(ctx, open, s.Consumer)
-		switch {
-		case unresolvable(err):
-			// Their set does not resolve. Skipped rather than fatal: this node is not the place
-			// to report another machine's problem, and a grant for something that is not going to
-			// run would have the provider create a user nothing uses.
-			continue
-		case err != nil:
-			// The mesh could not be asked what they wanted, which is not the same as their wanting
-			// nothing — and withholding a grant on that reading takes a consumer's access away
-			// (novox/hq 04-ISSUES/152).
-			return nil, nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Name, err)
-		}
-		values, asks, err := plan.ContributionsFrom(s.Name, s.ConsumerModule, settings)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		// A port in there is the consumer's software port until this. The consumer is on another
-		// machine, so the assignment that moved it is that machine's — fetched here rather than
-		// looked for in this one's, which is the whole reason the co-located fix could not reach
-		// this case (novox/hq 04-ISSUES/038, the cross-node half).
-		published, err := portsOn(ctx, inv, s.Consumer, s.ConsumerModule)
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		values = catalogue.AtPublishedPort(values, s.ConsumerModule, published)
-		from := s.ConsumerModule
-		if !asks {
-			// That module no longer wants this. Left empty, which is what the declaration reads
-			// as "nobody asks for it any more" — and is how a login is withdrawn rather than kept
-			// working for ever after its consumer went away.
-			from = ""
-		}
-		if bound := plan.BindsFrom(s.Name, s.ConsumerModule, s.Local); from != "" && !slices.Contains(bound, node) {
-			// It still asks, and not of this node: its resolution — the same one read above, so an
-			// unreadable one is the error above and never an empty answer here (issue 152) — binds
-			// this credential to another provider, or under this local name to none. Withdrawn
-			// exactly as a credential nobody asks for, and said.
-			from = ""
-			unbound = append(unbound, catalogue.Unbound{Provision: s.Name, Provider: node,
-				Consumer: s.Consumer, Module: s.ConsumerModule, Local: s.Local, BoundTo: bound})
-		}
-		// The consumer's identity slug, from its own manifest, carried on the grant so the provider
-		// derives the same login the consumer does (novox/hq ADR 0049). Judged against the bound of
-		// this provision, as the consumer's resolution states it from the provider's offer (ADR
-		// 0225): a consumer it would not fit is left out of the grants and said, rather than a login a
-		// provider silently shortened — and rather than this whole machine refused for it.
-		slug := ""
-		for _, mm := range plan.Modules {
-			if mm.Module == s.ConsumerModule {
-				slug = mm.Slug
-				break
-			}
-		}
-		if from != "" {
-			bound := boundOfGrant(plan, s, node)
-			source := catalogue.IdentitySource(slug, s.ConsumerModule)
-			if catalogue.CheckIdentityWithin(s.Consumer, source, bound) != nil {
-				withheld = append(withheld, catalogue.Overflow{Provision: s.Name, Provider: node,
-					Consumer: s.Consumer, Module: s.ConsumerModule,
-					Identity: catalogue.ConsumerIdentity(s.Consumer, source), Bound: bound})
-				continue
-			}
-		}
-		out = append(out, catalogue.Grant{
-			Provision: s.Name, Consumer: s.Consumer, At: onNetwork[s.Consumer],
-			From: from, Values: values, Slug: slug, Sealed: s.ForProvider, Local: s.Local})
-	}
-	return out, withheld, unbound, nil
-}
-
-// boundOfGrant is the identity bound the consumer's own resolution states for the requirement this
-// grant answers. A requirement not found there is held to the tightest bound the mesh knows rather
-// than to none: what the provider keeps of it is not known here.
-func boundOfGrant(consumer catalogue.Resolution, s inventory.Secret, provider string) catalogue.IdentityBound {
-	for _, n := range consumer.Needs {
-		if n.Name == s.Name && n.For == s.ConsumerModule && n.From == provider {
-			return n.Identity
-		}
-	}
-	return catalogue.DefaultIdentityBound
-}
-
 // listensLines is what a person is told about what this module would open, and why — the same
 // `why` every listens entry already carries for the firewall it also feeds (novox/hq ADR 0007), so
 // deciding whether to assign a module can see what it would open before it opens it, not only
@@ -1503,6 +279,8 @@ func listensLines(m catalogue.Manifest) []string {
 }
 
 func planCommand(ctx context.Context, args []string) error {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	set := flag.NewFlagSet("plan", flag.ContinueOnError)
 	// Because "one resource" does not tell you whether the settings landed. Being able to read
 	// the file before it is sent is the difference between believing a merge worked and knowing.
@@ -1528,7 +306,7 @@ func planCommand(ctx context.Context, args []string) error {
 	}
 	defer open.Close()
 
-	plan, settings, err := planFor(ctx, open, args[0])
+	plan, settings, err := resolveNode(ctx, open, args[0])
 	if err != nil {
 		return err
 	}
@@ -1690,91 +468,6 @@ func shownAs(r map[string]any) string {
 	return heading
 }
 
-// licencesFor is what this node can be answered with by record, and what it was put on.
-//
-// A mesh with no licences at all is the ordinary case and must not be an error: every existing
-// mesh is one, and a control plane that refused to plan because nobody had bought an API key
-// would be unusable for the thing it already does.
-func licencesFor(ctx context.Context, open *stores, node string) (
-	map[string][]catalogue.Record, map[string]map[string]catalogue.Record, error) {
-
-	held, err := open.Licences(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	all, err := held.All(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	if len(all) == 0 {
-		return nil, nil, nil
-	}
-
-	offered := map[string][]catalogue.Record{}
-	byName := map[string]catalogue.Record{}
-	for _, one := range all {
-		record := catalogue.Record{Name: one.Name, Serves: one.Serves}
-		offered[licences.Provision] = append(offered[licences.Provision], record)
-		byName[one.Name] = record
-	}
-
-	using := map[string]map[string]catalogue.Record{}
-	for _, one := range all {
-		holders, err := held.HoldersOf(ctx, one.Name)
-		if err != nil {
-			return nil, nil, err
-		}
-		for _, h := range holders {
-			if h.Node != node {
-				continue
-			}
-			if using[h.Module] == nil {
-				using[h.Module] = map[string]catalogue.Record{}
-			}
-			using[h.Module][licences.Provision] = byName[one.Name]
-		}
-	}
-	return offered, using, nil
-}
-
-// keyFor is the licence key sealed to one machine, for one module.
-//
-// **Empty is not an error here.** The mesh discarded the plaintext when it was supplied, so a
-// holder recorded afterwards genuinely has no key — and the declaration refuses that by name,
-// where the module and the path are both in view, rather than here.
-func keyFor(ctx context.Context, open *stores, licence, node, module string) (string, error) {
-	held, err := open.Licences(ctx)
-	if err != nil {
-		return "", err
-	}
-	return held.KeyFor(ctx, licence, node, module)
-}
-
-// managerPublicKeyFor is the manager node's public sealing key, but only when (node, module) is the
-// licence's manager holder — empty otherwise.
-//
-// It is delivered to the manager module in its bound facts so it can re-seal a rotated refresh token
-// to this node (novox/hq ADR 0050). Public, so it travels in the clear like any other bound fact; and
-// scoped to the manager holder alone, so a consumer never receives it and nothing invites a consumer
-// to seal anything.
-func managerPublicKeyFor(
-	ctx context.Context, open *stores, inv *inventory.Inventory, licence, node, module string,
-) (string, error) {
-	held, err := open.Licences(ctx)
-	if err != nil {
-		return "", err
-	}
-	managerNode, managerModule, err := held.ManagerOf(ctx, licence)
-	if err != nil {
-		return "", err
-	}
-	if managerNode == "" || node != managerNode || module != managerModule {
-		return "", nil
-	}
-	return inv.SealingKeyOf(ctx, node)
-}
-
 // servedOnNode is what a module on a node tells a consumer of one of its provisions, with THAT
 // node's ports on it: the port the node was given (novox/hq ADR 0100) over the one the mesh
 // assigned over the manifest's own, settled with the node's settings layers.
@@ -1819,76 +512,6 @@ func portsGivenOn(ctx context.Context, inv *inventory.Inventory, node string,
 	return ports, layers, nil
 }
 
-// seatsOn is where a node put the holder of each mesh-scoped seat, by seat and by the port the
-// holder's software uses — what ${seat:…} answers with (novox/hq 04-ISSUES/102).
-//
-// Read for every module in the catalogue that claims a seat, in this node's set or not: the store
-// and the broker are given their ports at genesis, as settings on a module that may be registered
-// and not yet assigned (04-ISSUES/085), and the control plane must follow that setting from the
-// first declaration it composes for itself. A holder in this node's set wins over one that is not.
-func seatsOn(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest,
-	node string, inSet []catalogue.Manifest, adopted bool, taken map[string]bool) (map[string]map[int]int, error) {
-	assigned := map[string]bool{}
-	for _, m := range inSet {
-		assigned[m.Module] = true
-	}
-	names := make([]string, 0, len(shelf))
-	for name := range shelf {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	seats := map[string]map[int]int{}
-	for _, name := range names {
-		m := shelf[name]
-		var claims []string
-		for _, c := range m.Claims {
-			if c.At() == catalogue.ScopeMesh {
-				claims = append(claims, c.Name)
-			}
-		}
-		if len(claims) == 0 {
-			continue
-		}
-		// **Only a port the node was given or the mesh assigned — never the manifest's own
-		// number.** The sealed value the answer sits beside carries the port genesis wrote, which
-		// on a given-port node is the predecessor's; a manifest's long-form mapping is the
-		// catalogue's default, and answering with it would override the right number with one
-		// the mesh never checked (the contract in seat_into.go). And on an adopted node a holder
-		// assigned but not yet taken is the found container, on the ports it was found with, not
-		// the declaration's — so its mesh-assigned ports do not count there either; a given port
-		// does, because a given port is the found one by construction (ADR 0100).
-		ports, _, err := portsGivenOn(ctx, inv, node, m)
-		if err != nil {
-			return nil, err
-		}
-		if adopted && !taken[name] {
-			layers, err := inv.SettingsFor(ctx, node, m.Module)
-			if err != nil {
-				return nil, err
-			}
-			ports = map[int]int{}
-			if given, err := catalogue.GivenPorts(m, layers); err == nil {
-				ports = given
-			}
-		}
-		if len(ports) == 0 {
-			continue
-		}
-		for _, seat := range claims {
-			if seats[seat] == nil {
-				seats[seat] = map[int]int{}
-			}
-			for wanted, at := range ports {
-				if _, said := seats[seat][wanted]; said && !assigned[name] {
-					continue
-				}
-				seats[seat][wanted] = at
-			}
-		}
-	}
-	return seats, nil
-}
-
 // portsOn is one module's assignments on one machine, by the port the software uses.
 func portsOn(
 	ctx context.Context, inv *inventory.Inventory, node, module string,
@@ -1906,45 +529,6 @@ func portsOn(
 	return out, nil
 }
 
-// composeBusUsers is the bus's user list, for a push to the machine that runs the bus.
-//
-// Empty for every other machine, and for every machine while the mesh is on the bus it runs on
-// today — where accounts are a management call and there is no file to write.
-//
-// **Composed on each push, never kept.** The list is a function of the mesh's records (who exists,
-// what runs where, what each declares), and a stored copy would be a second account of who may reach
-// the bus, able to disagree with the records while both looked internally consistent (ADR 0043).
-//
-// A user the mesh has never minted a password for is **left out and said**, not written as a user
-// without one — the composer refuses that, because a user with no password is a user anybody is. That
-// is an ordinary situation with an obvious remedy (`module issue`, or enrolling), so the push carries
-// the rest rather than failing: a bus that is missing one module's user is a mesh where that module
-// cannot connect, and a bus with no file at all is a mesh where nothing can.
-func composeBusUsers(ctx context.Context, inv *inventory.Inventory,
-	onThisNode []catalogue.Manifest) (string, error) {
-
-	// **Not gated on which bus the controller is on, and that was a bug.** It read "compose this only
-	// once the mesh is on the new bus" — which cannot work, because the server needs its user list
-	// *before* anything moves onto it. Step 2 of the change is exactly that: the server stands in the
-	// mesh carrying nothing, on its own ports, while every node is still on the old bus (novox/hq
-	// ADR 0116). Under the old gating that step could not happen: the module would come up, find no
-	// accounts file, and its entrypoint would wait for one the controller had decided not to write.
-	//
-	// So the question is only whether this machine runs the module that asked for the file. A mesh
-	// that never moves has written a user list nothing reads, which costs a few hundred bytes on one
-	// node; the reverse cost a step that cannot be taken.
-	//
-	// Asked of what this push resolves to rather than of the seat's holder mesh-wide: the file is a
-	// resource of that module, so the question is whether it is here.
-	list, missing, err := busUserList(ctx, inv, onThisNode)
-	if len(missing) > 0 {
-		fmt.Printf("the bus's user list leaves out %d user(s) the mesh has minted no credential "+
-			"for: %s. Each is a user that cannot connect until one is issued\n",
-			len(missing), strings.Join(missing, ", "))
-	}
-	return list, err
-}
-
 // busUserList is composeBusUsers without saying anything: the list, and the users left out of it
 // for want of a credential. Asked on every send to decide whether the machine holding the bus must
 // go first (novox/hq issue 249), where saying the same missing users each time would bury them.
@@ -1999,60 +583,6 @@ func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (s
 	return catalogue.OffersIssuedOutside(shelf, n.Name)
 }
 
-// issuedToHolder is whether the vault keeps a need's credential for its holder alone (issues 749, 757 and 779): its
-// providing module is marked moved, so the vault holds the credential in a row of its own for each holder
-// (filledTheNewWay), and its offer says either that the provider's software issues the provision's credential, or
-// that the provider gives each consumer a login of its own (form pair, ADR 0158 §11). A credential every holder
-// shares, or one a person gives, is neither.
-func issuedToHolder(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
-	if n.ByRecord || n.Module == "" {
-		return false
-	}
-	provider, known := shelf[n.Module]
-	if !known || !movedProvider(provider) {
-		return false
-	}
-	if _, issued := provider.IssuedCredentialOf(n.Name); issued {
-		return true
-	}
-	return provider.CredentialFormOf(n.Name) == catalogue.CredentialFormPair
-}
-
-// providerMoved is whether a need is answered by a module marked moved (issue 788), or by one whose offer of the
-// provision says the provider helper answers it (issue 792).
-func providerMoved(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
-	if n.ByRecord || n.Module == "" {
-		return false
-	}
-	provider, known := shelf[n.Module]
-	return known && (movedProvider(provider) || provider.AnsweredByHelperFor(n.Name))
-}
-
-// movedProvider is whether a provider's credentials are the vault's: the module is marked moved, or it holds the
-// mesh-vault seat, whose pair rows have been in the vault since V3 (issue 793), so its consumers' credentials
-// (gitea's internal token and admin password) are filled from those very rows with the values unchanged.
-func movedProvider(m catalogue.Manifest) bool {
-	return m.Moved || slices.ContainsFunc(m.Claims, func(c catalogue.Claim) bool { return c.Name == "mesh-vault" })
-}
-
-func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
-	for _, m := range resolved.Modules {
-		if _, shared := m.SharedCredentialOf(n.Name); shared {
-			return m.Module
-		}
-	}
-	shelf, err := open.inventory.Catalogue(ctx)
-	if err != nil {
-		return ""
-	}
-	for name, m := range shelf {
-		if _, shared := m.SharedCredentialOf(n.Name); shared {
-			return name
-		}
-	}
-	return ""
-}
-
 // unheldLogger remembers what was last logged about each node's unmet seat dependencies, so the
 // log says each change once (novox/hq ADR 0207), on stderr so `status --json` stays a document.
 // A test gives its own writer and memory, and no longer shares the process's (novox/hq issue 486).
@@ -2168,27 +698,3 @@ func sortedNames[V any](m map[string]V) []string {
 	sort.Strings(out)
 	return out
 }
-
-// wireBuilds is the build of each carried module that goes on the wire (novox/hq issue 1145): the build its assignment
-// names when that assignment is of the commit carried, else the build made from that commit; a module with neither
-// is not named.
-func wireBuilds(carried map[string]string, runs map[string]chain.Ref, lookup func(module, commit string) (string, error)) (map[string]string, error) {
-	out := map[string]string{}
-	for module, commit := range carried {
-		if commit == "" {
-			continue
-		}
-		if ref, ok := runs[module]; ok && ref.Commit == commit && ref.Build != "" {
-			out[module] = ref.Build
-			continue
-		}
-		build, err := lookup(module, commit)
-		if err != nil {
-			return nil, err
-		}
-		if build != "" {
-			out[module] = build
-		}
-	}
-	return out, nil
-}
diff --git a/cmd/mesh-controller/plan_backups.go b/cmd/mesh-controller/plan_backups.go
index f741e126..024b2fdc 100644
--- a/cmd/mesh-controller/plan_backups.go
+++ b/cmd/mesh-controller/plan_backups.go
@@ -11,8 +11,8 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -124,7 +124,7 @@ func loadBackupFacts(ctx context.Context, inv *inventory.Inventory) (backupFacts
 		if err != nil {
 			return nil, err
 		}
-		world, err := theRestOfTheMesh(ctx, inv, shelf, "")
+		world, err := restOfTheMeshOf(ctx, inv, shelf, "")
 		if err != nil {
 			return nil, err
 		}
diff --git a/cmd/mesh-controller/plan_backups_test.go b/cmd/mesh-controller/plan_backups_test.go
index 522611ee..644f1950 100644
--- a/cmd/mesh-controller/plan_backups_test.go
+++ b/cmd/mesh-controller/plan_backups_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/plan_clock_integration_test.go b/cmd/mesh-controller/plan_clock_integration_test.go
index 8581e2e3..460db64f 100644
--- a/cmd/mesh-controller/plan_clock_integration_test.go
+++ b/cmd/mesh-controller/plan_clock_integration_test.go
@@ -5,7 +5,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/plan_clock_test.go b/cmd/mesh-controller/plan_clock_test.go
index dde106be..49631e53 100644
--- a/cmd/mesh-controller/plan_clock_test.go
+++ b/cmd/mesh-controller/plan_clock_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/plan_test.go b/cmd/mesh-controller/plan_test.go
index 0075d8fe..a9e0df65 100644
--- a/cmd/mesh-controller/plan_test.go
+++ b/cmd/mesh-controller/plan_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // `plan` tells a person what a module would open and why, from the same `why` every listens
diff --git a/cmd/mesh-controller/planner_records_test.go b/cmd/mesh-controller/planner_records_test.go
index 8bebf2df..a40d60ec 100644
--- a/cmd/mesh-controller/planner_records_test.go
+++ b/cmd/mesh-controller/planner_records_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/planner_rules_test.go b/cmd/mesh-controller/planner_rules_test.go
index 71d2b71f..fef72bb9 100644
--- a/cmd/mesh-controller/planner_rules_test.go
+++ b/cmd/mesh-controller/planner_rules_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	snapshot "github.com/novox/mesh-controller/internal/facts"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/plans_data_test.go b/cmd/mesh-controller/plans_data_test.go
index 27c74ed2..7250c300 100644
--- a/cmd/mesh-controller/plans_data_test.go
+++ b/cmd/mesh-controller/plans_data_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/predefined.go b/cmd/mesh-controller/predefined.go
index 7b93b748..87dbf140 100644
--- a/cmd/mesh-controller/predefined.go
+++ b/cmd/mesh-controller/predefined.go
@@ -6,7 +6,7 @@ import (
 	"path"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/predefined_integration_test.go b/cmd/mesh-controller/predefined_integration_test.go
index e0d28433..f999e3dc 100644
--- a/cmd/mesh-controller/predefined_integration_test.go
+++ b/cmd/mesh-controller/predefined_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestTheMergeGateJudgesEachManifestAgainstTheListOfTheTree(t *testing.T) {
diff --git a/cmd/mesh-controller/predefined_test.go b/cmd/mesh-controller/predefined_test.go
index c9cf3cd6..c1c1ecde 100644
--- a/cmd/mesh-controller/predefined_test.go
+++ b/cmd/mesh-controller/predefined_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/probe_agent_root.go b/cmd/mesh-controller/probe_agent_root.go
index 847d0d83..5cc94e20 100644
--- a/cmd/mesh-controller/probe_agent_root.go
+++ b/cmd/mesh-controller/probe_agent_root.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
diff --git a/cmd/mesh-controller/probe_agent_root_test.go b/cmd/mesh-controller/probe_agent_root_test.go
index 45f63d44..49a4a8d4 100644
--- a/cmd/mesh-controller/probe_agent_root_test.go
+++ b/cmd/mesh-controller/probe_agent_root_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/probes.go b/cmd/mesh-controller/probes.go
index 3c22c7ef..b082fbb5 100644
--- a/cmd/mesh-controller/probes.go
+++ b/cmd/mesh-controller/probes.go
@@ -13,20 +13,21 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/validate"
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 	"github.com/nats-io/nats.go/micro"
-	"github.com/novox/mesh-host/validate"
 	"golang.org/x/net/dns/dnsmessage"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/artifacts"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 	"github.com/novox/mesh-controller/internal/link"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // The probes of the self-check's registry (doctor.go), one function each. A probe answers what is
@@ -62,7 +63,9 @@ func probeDeclarations(ctx context.Context, d *doctor) ([]conditions.Observation
 	// The private network every declaration is composed with. Not computable is not "could not
 	// look": it is the finding — no machine's declaration composes without it — and the machines that
 	// do not resolve, which are usually why, are named below.
-	gens, gensErr := generators(ctx, open)
+	// Every machine below is composed over one reading of the mesh.
+	ctx = withInputCache(ctx)
+	_, gensErr := generatorsOf(ctx, open)
 	if gensErr != nil {
 		if ctx.Err() != nil {
 			return nil, ctx.Err()
@@ -73,7 +76,7 @@ func probeDeclarations(ctx context.Context, d *doctor) ([]conditions.Observation
 			Said:    firstLine(gensErr.Error())})
 	}
 	for _, n := range nodes {
-		plan, settings, err := planFor(ctx, open, n.Name)
+		plan, settings, err := resolveNode(ctx, open, n.Name)
 		if err != nil && !unresolvable(err) {
 			return nil, fmt.Errorf("%s cannot be worked out: %w", n.Name, err)
 		}
@@ -85,7 +88,7 @@ func probeDeclarations(ctx context.Context, d *doctor) ([]conditions.Observation
 		}
 		if err == nil && gensErr == nil {
 			var declared sendable
-			if declared, err = declarationWith(ctx, open, n.Name, plan, settings, gens, Foreseeing); err == nil {
+			if declared, _, err = composeQuestion(ctx, open, n.Name, compose.Foreseeing, false); err == nil {
 				foreseen = declared.foreseen
 				// With the order it was last sent, so the validator reads the envelope a machine is sent
 				// — its epoch included (novox/hq to-be 45 §6).
diff --git a/cmd/mesh-controller/process_issue_test.go b/cmd/mesh-controller/process_issue_test.go
index bf4d02b3..1d49ad62 100644
--- a/cmd/mesh-controller/process_issue_test.go
+++ b/cmd/mesh-controller/process_issue_test.go
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // mailSenderWithProcess is mesh-mail's real manifest shape (novox/hq ADR 0436 §7, §8, the lead's fixture):
diff --git a/cmd/mesh-controller/process_live_test.go b/cmd/mesh-controller/process_live_test.go
index 35841eb4..6ee474cb 100644
--- a/cmd/mesh-controller/process_live_test.go
+++ b/cmd/mesh-controller/process_live_test.go
@@ -13,8 +13,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/proposals.go b/cmd/mesh-controller/proposals.go
index aae0587e..3015d102 100644
--- a/cmd/mesh-controller/proposals.go
+++ b/cmd/mesh-controller/proposals.go
@@ -54,7 +54,7 @@ import (
 
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/proposals_integration_test.go b/cmd/mesh-controller/proposals_integration_test.go
index 7a58d0c2..1ac9ccca 100644
--- a/cmd/mesh-controller/proposals_integration_test.go
+++ b/cmd/mesh-controller/proposals_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestSetOnAWarrantJudgesTheLayerAndKeepsWhoApprovedIt(t *testing.T) {
diff --git a/cmd/mesh-controller/provider_hold.go b/cmd/mesh-controller/provider_hold.go
index b869d7e9..69a51e21 100644
--- a/cmd/mesh-controller/provider_hold.go
+++ b/cmd/mesh-controller/provider_hold.go
@@ -6,7 +6,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/provider_hold_test.go b/cmd/mesh-controller/provider_hold_test.go
index 8597e133..5212a9f7 100644
--- a/cmd/mesh-controller/provider_hold_test.go
+++ b/cmd/mesh-controller/provider_hold_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/provisioned_test.go b/cmd/mesh-controller/provisioned_test.go
index 754ffcf8..a9756c35 100644
--- a/cmd/mesh-controller/provisioned_test.go
+++ b/cmd/mesh-controller/provisioned_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/provisioner_account_integration_test.go b/cmd/mesh-controller/provisioner_account_integration_test.go
index 75ede30b..61f2515a 100644
--- a/cmd/mesh-controller/provisioner_account_integration_test.go
+++ b/cmd/mesh-controller/provisioner_account_integration_test.go
@@ -7,8 +7,9 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -21,8 +22,14 @@ func TestTheProvisionerClientsAccountIsIssuedForItsServiceAndNeverInvented(t *te
 	if _, err := assign(ctx, open, "laptop", m.Module); err != nil {
 		t.Fatal(err)
 	}
-	if err := busCredentialIssued(ctx, inv, "laptop", m.Module, broker.ProvisionerSecret); err == nil {
-		t.Fatal("a push would seal a placeholder for the client's account before it was issued")
+	// The module's own account exists, so the only account missing is the client's.
+	if _, err := inv.MintBusPassword(ctx, inventory.BusUser{
+		Username: "laptop.mesh-provisioner", Kind: inventory.BusModule, Node: "laptop", Module: "mesh-provisioner"}); err != nil {
+		t.Fatal(err)
+	}
+	// The composition refuses it in the send's words (mesh-sdk's go/compose: TestTheSendsRefusalsAreRefusedInTheSendsWords).
+	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err == nil || !strings.Contains(err.Error(), "provisioner.laptop") {
+		t.Fatalf("a push would seal a placeholder for the client's account before it was issued: %v", err)
 	}
 
 	if err := issueProvisionerClient(ctx, inv, m, "laptop", broker.Broker{Fingerprint: "ab"}, "10.0.0.1:4222"); err != nil {
@@ -38,7 +45,7 @@ func TestTheProvisionerClientsAccountIsIssuedForItsServiceAndNeverInvented(t *te
 	if !slices.ContainsFunc(states, func(s inventory.SecretState) bool { return s.Name == broker.ProvisionerSecret }) {
 		t.Fatalf("the client's account is not sealed to the machine for its service: %+v", states)
 	}
-	if err := busCredentialIssued(ctx, inv, "laptop", m.Module, broker.ProvisionerSecret); err != nil {
+	if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil && strings.Contains(err.Error(), "provisioner.laptop") {
 		t.Fatalf("an issued client account is refused: %v", err)
 	}
 	if !runsTheProvisionerClient(m) {
diff --git a/cmd/mesh-controller/provisioner_account_test.go b/cmd/mesh-controller/provisioner_account_test.go
index 7cc212d6..24b7d8a2 100644
--- a/cmd/mesh-controller/provisioner_account_test.go
+++ b/cmd/mesh-controller/provisioner_account_test.go
@@ -1,8 +1,8 @@
 package main
 
 import (
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 func aProvisioner() catalogue.Manifest {
diff --git a/cmd/mesh-controller/push.go b/cmd/mesh-controller/push.go
index f80a7d9d..241a5012 100644
--- a/cmd/mesh-controller/push.go
+++ b/cmd/mesh-controller/push.go
@@ -17,9 +17,10 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -521,8 +522,8 @@ func pushCommand(ctx context.Context, args []string) error {
 			return nil
 		}
 	}
-	gens, err := generators(ctx, open)
-	if err != nil {
+	// The private network every declaration of the push is composed with: not computable refuses the push up front.
+	if _, err := generatorsOf(ctx, open); err != nil {
 		return err
 	}
 
@@ -652,7 +653,9 @@ func pushCommand(ctx context.Context, args []string) error {
 	// for a machine named, as a count for each of many — the full list is `status`'s.
 	unheld := map[string][]catalogue.Unheld{}
 	sending, refusals := composeEach(asked, allotting(held, inv), func(node string) (sendable, error) {
-		plan, settings, err := planFor(held, open, node)
+		// What this machine's send reads is read afresh: the send before it made and recorded things.
+		held := freshInput(held)
+		plan, _, err := resolveNode(held, open, node)
 		if err != nil {
 			return sendable{}, err
 		}
@@ -665,7 +668,7 @@ func pushCommand(ctx context.Context, args []string) error {
 		// The private network is in here with everything else. It used to be composed separately
 		// and prepended, which meant every machine with an address was on it and no machine could
 		// be kept off. It is a module now, so it arrives the way a module does.
-		declared, err := declarationWith(held, open, node, plan, settings, gens, Allocating)
+		declared, err := composeSend(held, open, node)
 		if err == nil {
 			reportLeftOut(node, declared)
 		}
@@ -721,7 +724,7 @@ func pushCommand(ctx context.Context, args []string) error {
 		keep := keeping(func(held context.Context, sending []readyNode) ([]readyNode, error) {
 			return holdingBack(held, inv, sending, movable, &heldBack)
 		})
-		refused, err := flushBehind(ctx, open, nodes, handled, composeForPush(open, gens), bus, holder, keep, os.Stdout)
+		refused, err := flushBehind(ctx, open, nodes, handled, composeForPush(open), bus, holder, keep, os.Stdout)
 		refusals = append(refusals, refused...)
 		if err != nil {
 			return err
@@ -1152,7 +1155,7 @@ func brokerListState(ctx context.Context, open *stores, names []string) (busList
 	// refuses rather than sending code whose grants the bus may not hold. It said "not behind" until then: a
 	// send went ahead as if the bus held a list nobody could compose.
 	list, composeErr := "", error(nil)
-	plan, _, err := planFor(ctx, open, h.Node)
+	plan, _, err := resolveNode(ctx, open, h.Node)
 	if err != nil {
 		composeErr = err
 	} else if list, _, err = busUserList(ctx, inv, plan.Modules); err != nil {
@@ -1229,8 +1232,8 @@ func sendToEach(ctx context.Context, open *stores, names []string) ([]string, er
 	}
 	defer ident.Close()
 
-	gens, err := generators(ctx, open)
-	if err != nil {
+	// The private network every declaration of the send is composed with: not computable refuses the send up front.
+	if _, err := generatorsOf(ctx, open); err != nil {
 		return nil, err
 	}
 	holder, behind, err := brokerBehind(ctx, open, names)
@@ -1272,14 +1275,16 @@ func sendToEach(ctx context.Context, open *stores, names []string) ([]string, er
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
-		plan, settings, err := planFor(ctx, open, name)
+		// Read afresh for each machine: the send before it made and recorded things.
+		composing := freshInput(ctx)
+		plan, _, err := resolveNode(composing, open, name)
 		if err != nil {
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
 		}
 		reportUnhostable(name, plan)
 		reportKept(ctx, plan)
-		declared, err := declarationWith(ctx, open, name, plan, settings, gens, Allocating)
+		declared, err := composeSend(composing, open, name)
 		if err != nil {
 			refusals = append(refusals, fmt.Sprintf("%s:\n%v", name, err))
 			continue
@@ -1454,20 +1459,21 @@ type planned struct {
 func wouldSendFrom(ctx context.Context, open *stores,
 	nodes []inventory.Node, plans map[string]planned) (map[string]string, error) {
 
-	gens, err := generators(ctx, open)
-	if err != nil {
+	if _, err := generatorsOf(ctx, open); err != nil {
 		return nil, err
 	}
+	var err error
 	out := map[string]string{}
 	for _, n := range nodes {
 		known, have := plans[n.Name]
 		plan, settings := known.plan, known.settings
 		if !have {
-			if plan, settings, err = planFor(ctx, open, n.Name); err != nil {
+			if plan, settings, err = resolveNode(ctx, open, n.Name); err != nil {
 				continue
 			}
 		}
-		declared, err := declarationWith(ctx, open, n.Name, plan, settings, gens, Reading)
+		_, _ = plan, settings
+		declared, _, err := composeQuestion(ctx, open, n.Name, compose.Reading, false)
 		if err != nil {
 			continue
 		}
diff --git a/cmd/mesh-controller/push_recreates_test.go b/cmd/mesh-controller/push_recreates_test.go
index 2b73fd29..d8361730 100644
--- a/cmd/mesh-controller/push_recreates_test.go
+++ b/cmd/mesh-controller/push_recreates_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
@@ -48,15 +48,7 @@ func TestAPushSaysWhatItRecreates(t *testing.T) {
 	}
 
 	// Composed as a person's push composes it.
-	plan, settings, err := planFor(ctx, open, "anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	gens, err := generators(ctx, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Allocating)
+	declared, err := composeSend(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/queue_test.go b/cmd/mesh-controller/queue_test.go
index 82834cec..eb997872 100644
--- a/cmd/mesh-controller/queue_test.go
+++ b/cmd/mesh-controller/queue_test.go
@@ -9,8 +9,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/readable.go b/cmd/mesh-controller/readable.go
index 32155fbc..82657485 100644
--- a/cmd/mesh-controller/readable.go
+++ b/cmd/mesh-controller/readable.go
@@ -3,7 +3,7 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"sort"
diff --git a/cmd/mesh-controller/recorded_kept.go b/cmd/mesh-controller/recorded_kept.go
index 397bbd2b..7e16c74e 100644
--- a/cmd/mesh-controller/recorded_kept.go
+++ b/cmd/mesh-controller/recorded_kept.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -180,13 +180,10 @@ func recordedKept(ctx context.Context, open *stores, node string) (map[string]st
 	return out, nil
 }
 
-// keepRecorded puts, in a shelf about to be resolved for a machine, the build each recorded module there
-// runs in place of the one the mesh holds; it answers what it kept, module → commit.
-func keepRecorded(ctx context.Context, open *stores, node string, shelf map[string]catalogue.Manifest) (map[string]string, error) {
-	kept, err := recordedKept(ctx, open, node)
-	if err != nil || len(kept) == 0 {
-		return nil, err
-	}
+// applyKept puts the manifest of each module kept at the build its machine runs into a shelf, and refuses, in the words of
+// keepRecorded, a build the records no longer hold. The adapter to the composition's input (compose_input.go) calls it with
+// a scratch shelf, to read the manifests it gives the node as its own Kept.
+func applyKept(ctx context.Context, open *stores, node string, kept map[string]string, shelf map[string]catalogue.Manifest) error {
 	names := make([]string, 0, len(kept))
 	for m := range kept {
 		names = append(names, m)
@@ -195,28 +192,28 @@ func keepRecorded(ctx context.Context, open *stores, node string, shelf map[stri
 	for _, m := range names {
 		ran, found, err := open.inventory.ManifestAt(ctx, m, kept[m])
 		if err != nil {
-			return nil, err
+			return err
 		}
 		if !found && settingsKeptOn(ctx, node) {
-			return nil, fmt.Errorf("%w: %s runs %s's build %s, which the build records no longer hold (novox/hq ADR 0344)",
+			return fmt.Errorf("%w: %s runs %s's build %s, which the build records no longer hold (novox/hq ADR 0344)",
 				errSettingsCannotKeep, node, m, short(kept[m]))
 		}
 		if !found && everyBuildKept(ctx, node) {
-			return nil, fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
+			return fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
 				"list cannot be sent there alone with it kept (novox/hq issue 490)", node, m, short(kept[m]))
 		}
 		if !found && guarded(coreComponent(m)) {
-			return nil, fmt.Errorf("%s was last sent %s's build %s, newer than the one the mesh holds, and the build records "+
+			return fmt.Errorf("%s was last sent %s's build %s, newer than the one the mesh holds, and the build records "+
 				"no longer hold it: this send cannot keep it and does not move it back — `push %s` sends the older build on "+
 				"a person's word, and a newer merge or `rebuild %s` moves the record forward (novox/hq issue 201)",
 				node, m, short(kept[m]), node, m)
 		}
 		if !found {
-			return nil, fmt.Errorf("%s records rather than rolls out, and %s runs its build %s, which the build "+
+			return fmt.Errorf("%s records rather than rolls out, and %s runs its build %s, which the build "+
 				"records no longer hold: this send cannot keep it and does not move it — `push %s` sends the new "+
 				"one on a person's word (novox/hq ADR 0245)", m, node, short(kept[m]), node)
 		}
 		shelf[m] = ran
 	}
-	return kept, nil
+	return nil
 }
diff --git a/cmd/mesh-controller/recorded_kept_integration_test.go b/cmd/mesh-controller/recorded_kept_integration_test.go
index 50b76e46..8f96201e 100644
--- a/cmd/mesh-controller/recorded_kept_integration_test.go
+++ b/cmd/mesh-controller/recorded_kept_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -63,7 +63,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 
 	// A plan's, a release plan's, a healer's send: the database is kept as it runs, mail moves.
 	kept := keepingRecorded(ctx)
-	plan, settings, err := planFor(kept, open, "anchor")
+	plan, _, err := resolveNode(kept, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -76,11 +76,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 	if imageOf(t, plan, "postgres", "server") != pgImage {
 		t.Fatal("the recorded module's container lost its image")
 	}
-	gens, err := generators(kept, open)
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := declarationWith(kept, open, "anchor", plan, settings, gens, Allocating)
+	declared, err := composeSend(kept, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -89,7 +85,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 	}
 
 	// A person's push: the recorded module's new build.
-	plan, _, err = planFor(ctx, open, "anchor")
+	plan, _, err = resolveNode(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -98,7 +94,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 	}
 
 	// The bus step moves the bus alone: a recorded module it is told it may move moves, the others stay.
-	plan, _, err = planFor(keepingRecorded(ctx, "postgres"), open, "anchor")
+	plan, _, err = resolveNode(keepingRecorded(ctx, "postgres"), open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -128,7 +124,7 @@ func TestARecordedBuildIsCarriedOnlyByAPersonsPush(t *testing.T) {
 		map[string]string{"postgres": "c0000000", "mailu": "c2222222"}); err != nil {
 		t.Fatal(err)
 	}
-	if _, _, err := planFor(kept, open, "anchor"); err == nil || !strings.Contains(err.Error(), "push anchor") {
+	if _, _, err := resolveNode(kept, open, "anchor"); err == nil || !strings.Contains(err.Error(), "push anchor") {
 		t.Fatalf("a recorded build that cannot be kept did not refuse the send with its remedy: %v", err)
 	}
 
diff --git a/cmd/mesh-controller/recorded_kept_test.go b/cmd/mesh-controller/recorded_kept_test.go
index 38d626b4..27b6fab1 100644
--- a/cmd/mesh-controller/recorded_kept_test.go
+++ b/cmd/mesh-controller/recorded_kept_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/recorded_moves.go b/cmd/mesh-controller/recorded_moves.go
index e72bb0da..156b7466 100644
--- a/cmd/mesh-controller/recorded_moves.go
+++ b/cmd/mesh-controller/recorded_moves.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/recorded_moves_test.go b/cmd/mesh-controller/recorded_moves_test.go
index a464c940..64b705e3 100644
--- a/cmd/mesh-controller/recorded_moves_test.go
+++ b/cmd/mesh-controller/recorded_moves_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -349,7 +349,7 @@ func TestARecordedMoveThatCannotBeJudgedWaits(t *testing.T) {
 		!strings.Contains(v.said, "not in the build records") {
 		t.Fatalf("an unjudgeable move: %+v", v)
 	}
-	if _, _, err := planFor(keepingRecorded(t.Context()), rm.open, "anchor"); err == nil || !strings.Contains(err.Error(), "push anchor") {
+	if _, _, err := resolveNode(keepingRecorded(t.Context()), rm.open, "anchor"); err == nil || !strings.Contains(err.Error(), "push anchor") {
 		t.Fatalf("a send that cannot keep the unjudged build did not refuse with its remedy: %v", err)
 	}
 	// laptop, judged from c1, goes; anchor waits.
diff --git a/cmd/mesh-controller/recorded_push.go b/cmd/mesh-controller/recorded_push.go
index 676dbd19..c6ca5de3 100644
--- a/cmd/mesh-controller/recorded_push.go
+++ b/cmd/mesh-controller/recorded_push.go
@@ -93,7 +93,7 @@ func recordedPushOf(ctx context.Context, node string) ([]string, string, error)
 	}
 	defer open.Close()
 	inv := open.inventory
-	plan, _, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err != nil {
 		return nil, "", fmt.Errorf("its set cannot be worked out: %w", err)
 	}
diff --git a/cmd/mesh-controller/references.go b/cmd/mesh-controller/references.go
index 202f2cfa..c313d7e2 100644
--- a/cmd/mesh-controller/references.go
+++ b/cmd/mesh-controller/references.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/registry_verbs.go b/cmd/mesh-controller/registry_verbs.go
index 1399944b..c89f695d 100644
--- a/cmd/mesh-controller/registry_verbs.go
+++ b/cmd/mesh-controller/registry_verbs.go
@@ -12,8 +12,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -400,7 +400,7 @@ func imagesCommand(ctx context.Context, args []string) error {
 	}
 	// What the mesh would send now, composed as `plan` composes it.
 	var body []byte
-	plan, settings, err := planFor(ctx, open, node)
+	plan, settings, err := resolveNode(ctx, open, node)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/mesh-controller/registry_verbs_test.go b/cmd/mesh-controller/registry_verbs_test.go
index 3c0ea218..ec883231 100644
--- a/cmd/mesh-controller/registry_verbs_test.go
+++ b/cmd/mesh-controller/registry_verbs_test.go
@@ -12,8 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/release.go b/cmd/mesh-controller/release.go
index bd7604c7..ff063b71 100644
--- a/cmd/mesh-controller/release.go
+++ b/cmd/mesh-controller/release.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -247,7 +247,7 @@ func (f moveFacts) walkedBy(module, node, to string) string {
 
 // machineMoves is the moves no gate has seen on one machine, read from what it would be sent now.
 var machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
-	plan, _, err := planFor(ctx, open, node)
+	plan, _, err := resolveNode(ctx, open, node)
 	if err != nil {
 		return nil, nil // it cannot be worked out: the send says why
 	}
diff --git a/cmd/mesh-controller/release_plan.go b/cmd/mesh-controller/release_plan.go
index e6364de5..a6440771 100644
--- a/cmd/mesh-controller/release_plan.go
+++ b/cmd/mesh-controller/release_plan.go
@@ -15,8 +15,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/chain"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/release_test.go b/cmd/mesh-controller/release_test.go
index b80429be..6e052994 100644
--- a/cmd/mesh-controller/release_test.go
+++ b/cmd/mesh-controller/release_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 )
diff --git a/cmd/mesh-controller/replay164_test.go b/cmd/mesh-controller/replay164_test.go
index 78f0e6a8..d05d2362 100644
--- a/cmd/mesh-controller/replay164_test.go
+++ b/cmd/mesh-controller/replay164_test.go
@@ -5,7 +5,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // TestReplay164 replays novox/hq issue 164 (found provisioning the media machine's modules, re-checked
@@ -34,7 +34,7 @@ func TestReplay164(t *testing.T) {
 	}
 	sent := func() []map[string]any {
 		t.Helper()
-		plan, settings, err := planFor(ctx, open, "laptop")
+		plan, settings, err := resolveNode(ctx, open, "laptop")
 		if err != nil {
 			t.Fatalf("the consumer's machine was refused for a credential only a person gives: %v", err)
 		}
diff --git a/cmd/mesh-controller/replay201_test.go b/cmd/mesh-controller/replay201_test.go
index f7559eee..6e37021b 100644
--- a/cmd/mesh-controller/replay201_test.go
+++ b/cmd/mesh-controller/replay201_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -71,7 +71,7 @@ func TestReplay201ThePlansSend(t *testing.T) {
 		if keeping {
 			c = keepingRecorded(ctx)
 		}
-		plan, settings, err := planFor(c, open, "anchor")
+		plan, settings, err := resolveNode(c, open, "anchor")
 		if err != nil {
 			t.Fatalf("%s to anchor did not compose: %v", sends, err)
 		}
diff --git a/cmd/mesh-controller/replay237_test.go b/cmd/mesh-controller/replay237_test.go
index beafe80a..4fb913cc 100644
--- a/cmd/mesh-controller/replay237_test.go
+++ b/cmd/mesh-controller/replay237_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // TestReplay237 replays novox/hq issue 237 (2026-10-04): a workstation already ran a module that
@@ -34,7 +34,7 @@ func TestReplay237(t *testing.T) {
 
 	said := answered(t, func() error { return assignCommand(ctx, "assign", []string{"laptop", "docker"}) })
 
-	if _, _, err := planFor(ctx, open, "laptop"); err != nil {
+	if _, _, err := resolveNode(ctx, open, "laptop"); err != nil {
 		t.Fatalf("laptop does not resolve right after the act: %v\nthe answer was:\n%s", err, said)
 	}
 	if !strings.Contains(said, "web on laptop now has "+catalogue.ContainerRuntimeSeat+" held") {
diff --git a/cmd/mesh-controller/replay239_test.go b/cmd/mesh-controller/replay239_test.go
index ed9b9ffa..b8fdc228 100644
--- a/cmd/mesh-controller/replay239_test.go
+++ b/cmd/mesh-controller/replay239_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/replay318_test.go b/cmd/mesh-controller/replay318_test.go
index a84699b8..39ce20ec 100644
--- a/cmd/mesh-controller/replay318_test.go
+++ b/cmd/mesh-controller/replay318_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/replay325_test.go b/cmd/mesh-controller/replay325_test.go
index c058c2d1..2ca214b8 100644
--- a/cmd/mesh-controller/replay325_test.go
+++ b/cmd/mesh-controller/replay325_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/replay336_test.go b/cmd/mesh-controller/replay336_test.go
index 7e6b70f3..29471508 100644
--- a/cmd/mesh-controller/replay336_test.go
+++ b/cmd/mesh-controller/replay336_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
diff --git a/cmd/mesh-controller/replay340_test.go b/cmd/mesh-controller/replay340_test.go
index a1b2df52..6bdcfe4a 100644
--- a/cmd/mesh-controller/replay340_test.go
+++ b/cmd/mesh-controller/replay340_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Replay of novox/hq issue 340 (2026-10-09): the agent's module keeps the managed settings and tool servers every
diff --git a/cmd/mesh-controller/replay349_test.go b/cmd/mesh-controller/replay349_test.go
index ae71bb92..930961fb 100644
--- a/cmd/mesh-controller/replay349_test.go
+++ b/cmd/mesh-controller/replay349_test.go
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/replay401_test.go b/cmd/mesh-controller/replay401_test.go
index dfe1135f..12a489f3 100644
--- a/cmd/mesh-controller/replay401_test.go
+++ b/cmd/mesh-controller/replay401_test.go
@@ -5,7 +5,7 @@ package main
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // TestReplay401 replays novox/hq issue 401 (2026-10-10): the mounts module's smb-credentials, an own secret
@@ -33,7 +33,7 @@ func TestReplay401(t *testing.T) {
 	}
 	sent := func() []map[string]any {
 		t.Helper()
-		plan, settings, err := planFor(ctx, open, "laptop")
+		plan, settings, err := resolveNode(ctx, open, "laptop")
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/cmd/mesh-controller/replay614_test.go b/cmd/mesh-controller/replay614_test.go
index 411330c8..ffb8015f 100644
--- a/cmd/mesh-controller/replay614_test.go
+++ b/cmd/mesh-controller/replay614_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/replay867_test.go b/cmd/mesh-controller/replay867_test.go
index 49a5fc0f..879713e3 100644
--- a/cmd/mesh-controller/replay867_test.go
+++ b/cmd/mesh-controller/replay867_test.go
@@ -19,19 +19,19 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	meshfacts "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
-	meshfacts "github.com/novox/mesh-controller/internal/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
 // TestReplay867 is the replay of novox/hq issue 867, written with only what the controller and the build seat had
 // before the fix, so mesh-lab's prover can lay it over the commit before. A mesh-host change (#114) and a
-// mesh-controller change (#346) of one delivery group need each other: the node-engine change's own check reads the
-// controller's lock beside it, which only the controller change brings; the controller change builds only with the
-// validator word only the node-engine change brings. Each was read beside the other's repository at the commit the mesh
-// runs, which holds neither change, so neither could pass its own merge check — and the pair could not merge.
+// mesh-controller change (#346) of one delivery group: the node-engine change's own check reads the controller's lock
+// beside it, which only the controller change brings. It was read beside the other's repository at the commit the mesh
+// runs, which holds neither change, so the node-engine change could not pass its own merge check. (The controller
+// change once needed the node-engine's validator word too; the validator is mesh-sdk's now, issue 1391.)
 //
 // It runs the whole path: the forge announces each pull request (following.PullUpdated), the controller asks
 // mesh-delivery which pull requests the group holds, the ask is queued for the build seat, and the build seat's check
@@ -104,17 +104,16 @@ func r867Commit(t *testing.T, dir string, files map[string]string) string {
 // r867Controller is a controller whose judge says who it is and the validator word it was built with.
 func r867Controller(who, extra string) map[string]string {
 	return map[string]string{
-		"go.mod":             "module example.org/judge\n\ngo 1.22\n\nrequire github.com/novox/mesh-host v0.0.0\n",
-		"vendor/modules.txt": "# github.com/novox/mesh-host v0.0.0\n## explicit; go 1.22\ngithub.com/novox/mesh-host/validate\n",
-		"vendor/github.com/novox/mesh-host/validate/v.go":             "package validate\n\nconst Word = \"the vendored validator\"\n",
-		"vendor/github.com/novox/mesh-host/internal/declaration/d.go": "package declaration\n",
+		"go.mod":             "module example.org/judge\n\ngo 1.22\n\nrequire git.novox.be/novox/mesh-sdk/go v0.0.0\n",
+		"vendor/modules.txt": "# git.novox.be/novox/mesh-sdk/go v0.0.0\n## explicit; go 1.22\ngit.novox.be/novox/mesh-sdk/go/validate\n",
+		"vendor/git.novox.be/novox/mesh-sdk/go/validate/v.go": "package validate\n\nconst Word = \"the vendored validator\"\n",
 		"cmd/mesh-controller/main.go": `package main
 
 import (
 	"fmt"
 	"os"
 
-	"github.com/novox/mesh-host/validate"
+	"git.novox.be/novox/mesh-sdk/go/validate"
 )
 
 func main() {
@@ -161,12 +160,12 @@ func theGroupOfIssue867Into(t *testing.T, base string) *theIssue867 {
 	}
 	// The two pull requests of one group, feat/867.
 	r867Git(t, controller, "checkout", "--quiet", "-b", "feat/867", base)
-	change := r867Controller("the controller", "+validate.More")
+	change := r867Controller("the controller", "")
 	change["lock.txt"] = "foundation: new\n"
 	r.controllerHead = r867Commit(t, controller, change)
 	r867Git(t, controller, "checkout", "--quiet", "main")
 	r867Git(t, host, "checkout", "--quiet", "-b", "feat/867", base)
-	r.hostHead = r867Commit(t, host, map[string]string{"validate/more.go": "package validate\n\nconst More = \" and more\"\n"})
+	r.hostHead = r867Commit(t, host, map[string]string{"notes.txt": "the node-engine change\n"})
 	r867Git(t, host, "checkout", "--quiet", "main")
 
 	followed := func(string) string { return "main" }
@@ -217,7 +216,7 @@ func (r *theIssue867) checked(t *testing.T, repo string, number int, head string
 	servingBus.Store(js)
 	t.Cleanup(func() { servingBus.Store(nil) })
 	p := link.PullUpdated{Owner: "novox", Repo: repo, Number: number, Base: "main", Head: "feat/867", Commit: head,
-		Paths: []string{"lock.txt", "validate/more.go", "cmd/mesh-controller/main.go"}, ModuleDirsSaid: true,
+		Paths: []string{"lock.txt", "notes.txt", "cmd/mesh-controller/main.go"}, ModuleDirsSaid: true,
 		MergeCheck: true, MergeCheckSaid: true}
 	if recheck {
 		// As `delivery check --members <one head>` builds it from mesh-delivery's member: no head branch name.
@@ -350,7 +349,7 @@ func TestTheRecheckVerbAsksMeshDeliveryOnABusOfItsOwn(t *testing.T) {
 	}
 	t.Cleanup(func() { _ = sub.Unsubscribe() })
 	member := `[{"id":"novox/mesh-host@` + r.hostHead[:12] + `","repository":"novox/mesh-host","base":"main","head":"` +
-		r.hostHead + `","number":114,"paths":["validate/more.go"],"module_dirs_said":true}]`
+		r.hostHead + `","number":114,"paths":["notes.txt"],"module_dirs_said":true}]`
 	if err := deliveryCommand(t.Context(), []string{"check", "--members", member}); err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/replays_integration_test.go b/cmd/mesh-controller/replays_integration_test.go
index d0127410..da467d3d 100644
--- a/cmd/mesh-controller/replays_integration_test.go
+++ b/cmd/mesh-controller/replays_integration_test.go
@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
@@ -35,7 +35,7 @@ func TestReplay263AnIdentityTooLongNeverRefusesItsProvidersMachine(t *testing.T)
 	}
 	// The consumer's machine composes first, as a push does: what it is sent is what its provider grants.
 	for _, node := range []string{"laptop", "anchor"} {
-		plan, settings, err := planFor(ctx, open, node)
+		plan, settings, err := resolveNode(ctx, open, node)
 		if err != nil {
 			t.Fatalf("%s does not resolve: %v", node, err)
 		}
@@ -84,7 +84,7 @@ func TestReplay273AConsumerBesideItsStoreStaysBoundToIt(t *testing.T) {
 	assignAll([2]string{"laptop", "store"}, [2]string{"laptop", "resolver"}, [2]string{"laptop", "network"},
 		[2]string{"laptop", "board"})
 
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/rest_at_once_integration_test.go b/cmd/mesh-controller/rest_at_once_integration_test.go
index 1aabc267..0c10c878 100644
--- a/cmd/mesh-controller/rest_at_once_integration_test.go
+++ b/cmd/mesh-controller/rest_at_once_integration_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/rest_at_once_test.go b/cmd/mesh-controller/rest_at_once_test.go
index ea332777..053ab931 100644
--- a/cmd/mesh-controller/rest_at_once_test.go
+++ b/cmd/mesh-controller/rest_at_once_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/retirement_integration_test.go b/cmd/mesh-controller/retirement_integration_test.go
index 62c80b86..b6ffbb7b 100644
--- a/cmd/mesh-controller/retirement_integration_test.go
+++ b/cmd/mesh-controller/retirement_integration_test.go
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/rollout.go b/cmd/mesh-controller/rollout.go
index fbee3e1e..a8d16bec 100644
--- a/cmd/mesh-controller/rollout.go
+++ b/cmd/mesh-controller/rollout.go
@@ -11,8 +11,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
diff --git a/cmd/mesh-controller/rollout_events_test.go b/cmd/mesh-controller/rollout_events_test.go
index 1109247c..2110f60f 100644
--- a/cmd/mesh-controller/rollout_events_test.go
+++ b/cmd/mesh-controller/rollout_events_test.go
@@ -13,8 +13,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/rollout_test.go b/cmd/mesh-controller/rollout_test.go
index 409eb28e..c8b494da 100644
--- a/cmd/mesh-controller/rollout_test.go
+++ b/cmd/mesh-controller/rollout_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/roster_failure_test.go b/cmd/mesh-controller/roster_failure_test.go
index 2479f38c..97a0cca1 100644
--- a/cmd/mesh-controller/roster_failure_test.go
+++ b/cmd/mesh-controller/roster_failure_test.go
@@ -22,7 +22,7 @@ func TestASetThatDoesNotComposeIsMarkedAsTheNodesOwnProblem(t *testing.T) {
 		}
 	}
 
-	_, _, err := planFor(t.Context(), open, "laptop")
+	_, _, err := resolveNode(t.Context(), open, "laptop")
 	if err == nil {
 		t.Fatal("two modules claiming one seat composed anyway")
 	}
@@ -38,7 +38,7 @@ func TestAStoreThatCannotBeReadIsNotANodeThatDoesNotCompose(t *testing.T) {
 	stopped, cancel := context.WithCancel(t.Context())
 	cancel()
 
-	_, _, err := planFor(stopped, open, "anchor")
+	_, _, err := resolveNode(stopped, open, "anchor")
 	if err == nil {
 		t.Fatal("a plan composed against a store that could not be read")
 	}
diff --git a/cmd/mesh-controller/same_program_integration_test.go b/cmd/mesh-controller/same_program_integration_test.go
index 294ae773..9e608dbd 100644
--- a/cmd/mesh-controller/same_program_integration_test.go
+++ b/cmd/mesh-controller/same_program_integration_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/same_source_test.go b/cmd/mesh-controller/same_source_test.go
index 695e2244..b88fd010 100644
--- a/cmd/mesh-controller/same_source_test.go
+++ b/cmd/mesh-controller/same_source_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/seat_dependencies_integration_test.go b/cmd/mesh-controller/seat_dependencies_integration_test.go
index c54f7c41..a659d0d4 100644
--- a/cmd/mesh-controller/seat_dependencies_integration_test.go
+++ b/cmd/mesh-controller/seat_dependencies_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAnAssignmentWithoutItsHolderIsRefusedAndNotKept(t *testing.T) {
diff --git a/cmd/mesh-controller/seat_dependencies_test.go b/cmd/mesh-controller/seat_dependencies_test.go
index 2a61cf56..99517f65 100644
--- a/cmd/mesh-controller/seat_dependencies_test.go
+++ b/cmd/mesh-controller/seat_dependencies_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Defends novox/hq ADR 0207 at the controller's acts: `assign` refuses a module whose resources a
diff --git a/cmd/mesh-controller/seat_pass.go b/cmd/mesh-controller/seat_pass.go
index 8995c530..7aabc71f 100644
--- a/cmd/mesh-controller/seat_pass.go
+++ b/cmd/mesh-controller/seat_pass.go
@@ -4,33 +4,20 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"os"
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
-// seatPassing is what passing seats on needs of the outside: the record's compare-and-set, and the hand act.
-type seatPassing struct {
-	pass func(ctx context.Context, p catalogue.SeatPass) (bool, error)
-	act  func(ctx context.Context, p catalogue.SeatPass) error
-	say  io.Writer
-}
-
-// passSeatsOn records, in the composition that finds it, the new holder of each seat held once whose holder on
-// record is assigned nowhere and which has exactly one claimant able to hold it, and writes the controller's own
-// hand act for it (novox/hq ADR 0449 §4, issue 1317). It answers the holdings as they are after it, so the
-// resolution that follows reads the record it just moved. A failed write is said and leaves the record as it was:
-// a composition is never refused for it.
-func passSeatsOn(ctx context.Context, sp seatPassing, holdings []catalogue.Held,
-	assignments []catalogue.Assignment) []catalogue.Held {
-	passes, said := catalogue.SeatsToPassOn(holdings, assignments)
-	for _, line := range said {
-		fmt.Fprintln(sp.say, line)
-	}
+// performSeatPasses records, in the send that finds them, the new holder of each seat held once whose holder on record is
+// assigned nowhere and which has exactly one claimant able to hold it (the composition names them: catalogue.SeatsToPassOn,
+// novox/hq ADR 0449 §4, issue 1317), and writes the controller's own hand act for each. A failed write is said and leaves the
+// record as it was: a send is never refused for it. It answers whether it recorded any.
+func performSeatPasses(ctx context.Context, sp seatPassing, passes []catalogue.SeatPass) bool {
+	did := false
 	for _, p := range passes {
 		moved, err := sp.pass(ctx, p)
 		if err != nil {
@@ -41,21 +28,20 @@ func passSeatsOn(ctx context.Context, sp seatPassing, holdings []catalogue.Held,
 		if !moved {
 			continue // another composition passed it first, and wrote the act
 		}
+		did = true
 		if err := sp.act(ctx, p); err != nil {
 			fmt.Fprintf(sp.say, "%s passed from %s on %s to %s on %s, and the hand act could NOT be recorded: %v\n",
 				p.Seat.Name, p.From.Module, p.From.Node, p.To.Module, p.To.Node, err)
 		}
-		var next []catalogue.Held
-		for _, h := range holdings {
-			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == p.Seat.Name {
-				continue
-			}
-			next = append(next, h)
-		}
-		p.To.Site = p.From.Site
-		holdings = append(next, p.To)
 	}
-	return holdings
+	return did
+}
+
+// seatPassing is what passing seats on needs of the outside: the record's compare-and-set, and the hand act.
+type seatPassing struct {
+	pass func(ctx context.Context, p catalogue.SeatPass) (bool, error)
+	act  func(ctx context.Context, p catalogue.SeatPass) error
+	say  io.Writer
 }
 
 // seatPassHandAct is the controller's own entry for a pass: it is the act that puts the holder on record,
@@ -73,31 +59,10 @@ func seatPassHandAct(p catalogue.SeatPass) link.HandAct {
 	}
 }
 
-// assignmentsOf are the assignments of every machine, as the passing of a seat reads them. **A module assigned and
-// missing from the shelf is still assigned**: it is an assignment with no claims, so its holder is not taken for gone.
-func assignmentsOf(shelf map[string]catalogue.Manifest, assigned map[string][]string) []catalogue.Assignment {
-	var out []catalogue.Assignment
-	for node, modules := range assigned {
-		for _, module := range modules {
-			m, ok := shelf[module]
-			if !ok {
-				m = catalogue.Manifest{Module: module}
-			}
-			out = append(out, catalogue.Assignment{Node: node, Manifest: m})
-		}
-	}
-	return out
-}
-
-// seatPassingOn is how a composition on this inventory passes a seat: against the store's record with the hand act
-// on the bus, or, on a throwaway mesh (the merge gate's), in memory only, writing nothing anywhere.
+// seatPassingOn is how a send passes a seat: against the store's record, with the hand act on the bus; on a throwaway mesh
+// (the merge gate's) the record is kept in its store and no act is written, for there is no bus to write it to.
 func seatPassingOn(inv *inventory.Inventory, w io.Writer) seatPassing {
-	if inv.Throwaway() {
-		return seatPassing{say: w,
-			pass: func(context.Context, catalogue.SeatPass) (bool, error) { return true, nil },
-			act:  func(context.Context, catalogue.SeatPass) error { return nil }}
-	}
-	return seatPassing{
+	sp := seatPassing{
 		say: w,
 		pass: func(ctx context.Context, p catalogue.SeatPass) (bool, error) {
 			return inv.PassSeat(ctx, p.Seat.Name, p.Seat.Scope, p.From, p.To)
@@ -109,21 +74,8 @@ func seatPassingOn(inv *inventory.Inventory, w io.Writer) seatPassing {
 			})
 		},
 	}
-}
-
-// theMeshPassesSeatsOn is passSeatsOn as the composition runs it. **Only when every machine's assignments were
-// read** (assignedErr nil): a machine whose read failed would look as if its modules were assigned nowhere, and
-// its holder would lose the seat. Said to where the composition says its other lines (sayLeftOut).
-func theMeshPassesSeatsOn(ctx context.Context, inv *inventory.Inventory, shelf map[string]catalogue.Manifest,
-	assigned map[string][]string, assignedErr error, holdings []catalogue.Held) []catalogue.Held {
-	var w io.Writer = os.Stderr
-	if lw, ok := ctx.Value(leftOutKey{}).(io.Writer); ok {
-		w = lw
+	if inv.Throwaway() {
+		sp.act = func(context.Context, catalogue.SeatPass) error { return nil }
 	}
-	if assignedErr != nil {
-		fmt.Fprintf(w, "no seat is passed on in this composition: a machine's assignments could not be read, so a "+
-			"holder on record might look assigned nowhere: %v\n", assignedErr)
-		return holdings
-	}
-	return passSeatsOn(ctx, seatPassingOn(inv, w), holdings, assignmentsOf(shelf, assigned))
+	return sp
 }
diff --git a/cmd/mesh-controller/seat_pass_test.go b/cmd/mesh-controller/seat_pass_test.go
index 5181964e..7fded0da 100644
--- a/cmd/mesh-controller/seat_pass_test.go
+++ b/cmd/mesh-controller/seat_pass_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -26,9 +26,16 @@ func withBusSeat(t *testing.T) {
 	catalogue.UseSeats([]catalogue.Seat{{Name: "mesh-broker", Scope: catalogue.ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
 }
 
-// 1317/AC1: the composition records the claimant as the holder and writes one hand act by the controller naming
-// the seat, the former holder and the new one; the holdings it answers name the new holder.
-func TestACompositionPassesTheSeatAndWritesOneHandActByTheController(t *testing.T) {
+// passesFor is what the composition names to pass on for these holdings and assignments (mesh-sdk's SeatsToPassOn), with the
+// lines it says.
+func passesFor(holdings []catalogue.Held, as []catalogue.Assignment) ([]catalogue.SeatPass, []string) {
+	return catalogue.SeatsToPassOn(holdings, as)
+}
+
+// 1317/AC1: the send records the claimant as the holder and writes one hand act by the controller naming the seat, the former
+// holder and the new one. (Which seats to pass, and the holdings after it, are mesh-sdk's: go/compose rest_test.go
+// TestASeatWhoseHolderIsAssignedNowhereGoesToItsOnlyClaimant and TestAHolderOnRecordSettlesTheSeatInTheRestOfTheMesh.)
+func TestASendPassesTheSeatAndWritesOneHandActByTheController(t *testing.T) {
 	withBusSeat(t)
 	var passed []catalogue.SeatPass
 	var acts []link.HandAct
@@ -44,9 +51,9 @@ func TestACompositionPassesTheSeatAndWritesOneHandActByTheController(t *testing.
 		},
 	}
 	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
-	got := passSeatsOn(t.Context(), sp, holdings, []catalogue.Assignment{{Node: "novox", Manifest: aBrokerClaiming("gate")}})
-	if len(got) != 1 || got[0].Module != "gate" || got[0].Node != "novox" {
-		t.Fatalf("the holdings after the composition do not name the gate: %+v", got)
+	passes, _ := passesFor(holdings, []catalogue.Assignment{{Node: "novox", Manifest: aBrokerClaiming("gate")}})
+	if !performSeatPasses(t.Context(), sp, passes) {
+		t.Fatal("a pass was recorded and the send does not say it made something")
 	}
 	if len(passed) != 1 || len(acts) != 1 {
 		t.Fatalf("passes=%d acts=%d, want one each", len(passed), len(acts))
@@ -60,67 +67,35 @@ func TestACompositionPassesTheSeatAndWritesOneHandActByTheController(t *testing.
 	}
 }
 
-// 1317/AC2: two claimants, nothing recorded, the refusal said.
-func TestACompositionWithTwoClaimantsRecordsNoneAndSaysSo(t *testing.T) {
-	withBusSeat(t)
-	sp := seatPassing{say: &bytes.Buffer{},
-		pass: func(context.Context, catalogue.SeatPass) (bool, error) {
-			t.Fatal("a seat with two claimants was passed")
-			return false, nil
-		},
-		act: func(context.Context, catalogue.SeatPass) error { t.Fatal("an act was written"); return nil },
-	}
-	var said bytes.Buffer
-	sp.say = &said
-	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
-	got := passSeatsOn(t.Context(), sp, holdings, []catalogue.Assignment{
-		{Node: "novox", Manifest: aBrokerClaiming("gate")}, {Node: "ace", Manifest: aBrokerClaiming("other")}})
-	if len(got) != 1 || got[0].Module != "old-broker" {
-		t.Fatalf("the record changed: %+v", got)
-	}
-	if !strings.Contains(said.String(), "gate") || !strings.Contains(said.String(), "other") ||
-		!strings.Contains(said.String(), "seat mesh-broker --to") {
-		t.Fatalf("the refusal is not said with both and the remedy: %q", said.String())
-	}
-}
-
-// 1317/AC3 and AC4: nothing changes while the holder is assigned, nor with no claimant.
-func TestACompositionChangesNothingWhileTheHolderIsAssignedOrNobodyClaims(t *testing.T) {
-	withBusSeat(t)
-	sp := seatPassing{say: &bytes.Buffer{},
-		pass: func(context.Context, catalogue.SeatPass) (bool, error) { t.Fatal("passed"); return false, nil },
-		act:  func(context.Context, catalogue.SeatPass) error { t.Fatal("act"); return nil },
-	}
-	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
-	got := passSeatsOn(t.Context(), sp, holdings, []catalogue.Assignment{
-		{Node: "novox", Manifest: aBrokerClaiming("old-broker")}, {Node: "novox", Manifest: aBrokerClaiming("gate")}})
-	if len(got) != 1 || got[0].Module != "old-broker" {
-		t.Fatalf("holder assigned: record changed: %+v", got)
-	}
-	got = passSeatsOn(t.Context(), sp, holdings, nil)
-	if len(got) != 1 || got[0].Module != "old-broker" {
-		t.Fatalf("no claimant: record changed: %+v", got)
-	}
-}
-
-// A composition that lost the compare-and-set writes no act, and a failed write leaves the record.
+// A send that lost the compare-and-set writes no act, and a failed write leaves the record.
 func TestALostPassWritesNoActAndAFailedOneLeavesTheRecord(t *testing.T) {
 	withBusSeat(t)
 	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
 	as := []catalogue.Assignment{{Node: "novox", Manifest: aBrokerClaiming("gate")}}
+	passes, _ := passesFor(holdings, as)
 	lost := seatPassing{say: &bytes.Buffer{},
 		pass: func(context.Context, catalogue.SeatPass) (bool, error) { return false, nil },
 		act:  func(context.Context, catalogue.SeatPass) error { t.Fatal("act without a pass"); return nil },
 	}
-	passSeatsOn(t.Context(), lost, holdings, as)
+	if performSeatPasses(t.Context(), lost, passes) {
+		t.Fatal("a lost pass is said to have made something")
+	}
 	var said bytes.Buffer
 	sp := seatPassing{say: &said,
 		pass: func(context.Context, catalogue.SeatPass) (bool, error) { return false, context.DeadlineExceeded },
 		act:  func(context.Context, catalogue.SeatPass) error { t.Fatal("act"); return nil },
 	}
-	got := passSeatsOn(t.Context(), sp, holdings, as)
-	if got[0].Module != "old-broker" || !strings.Contains(said.String(), "could not be passed") {
-		t.Fatalf("got %+v said %q", got, said.String())
+	if performSeatPasses(t.Context(), sp, passes) || !strings.Contains(said.String(), "could not be passed") {
+		t.Fatalf("a failed pass is not said: %q", said.String())
+	}
+	// And an act that cannot be written is said, with the record kept.
+	var told bytes.Buffer
+	kept := seatPassing{say: &told,
+		pass: func(context.Context, catalogue.SeatPass) (bool, error) { return true, nil },
+		act:  func(context.Context, catalogue.SeatPass) error { return errors.New("no bus") },
+	}
+	if !performSeatPasses(t.Context(), kept, passes) || !strings.Contains(told.String(), "the hand act could NOT be recorded") {
+		t.Fatalf("a failed act is not said: %q", told.String())
 	}
 }
 
@@ -146,46 +121,15 @@ func TestTwoSeatPassesAreNoRepairAndRaiseNoHealerWanted(t *testing.T) {
 	}
 }
 
-// A failed read of one machine's assignments passes no seat: its holder would look assigned nowhere.
-func TestNoSeatIsPassedWhenAMachinesAssignmentsCouldNotBeRead(t *testing.T) {
-	withBusSeat(t)
-	var said bytes.Buffer
-	ctx := leftOutSaidBy(t.Context(), &said)
-	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "ace", Module: "old-broker"}}
-	shelf := map[string]catalogue.Manifest{"gate": aBrokerClaiming("gate")}
-	got := theMeshPassesSeatsOn(ctx, nil, shelf, map[string][]string{"novox": {"gate"}},
-		errors.New("ace: the bus did not answer"), holdings)
-	if len(got) != 1 || got[0].Module != "old-broker" {
-		t.Fatalf("the record moved: %+v", got)
-	}
-	if !strings.Contains(said.String(), "no seat is passed") || !strings.Contains(said.String(), "ace") {
-		t.Errorf("not said: %q", said.String())
-	}
-}
-
-// A holder that is assigned but missing from the shelf is still assigned.
-func TestAHolderAssignedButNotOnTheShelfIsNotTakenForGone(t *testing.T) {
-	withBusSeat(t)
-	as := assignmentsOf(map[string]catalogue.Manifest{"gate": aBrokerClaiming("gate")},
-		map[string][]string{"novox": {"gate", "old-broker"}})
-	passes, _ := catalogue.SeatsToPassOn(
-		[]catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}, as)
-	if len(passes) != 0 {
-		t.Fatalf("a holder missing from the shelf lost its seat: %+v", passes)
-	}
-}
-
-// The merge gate's throwaway mesh passes the seat in memory and writes nothing: no record, no hand act.
-func TestAThrowawayMeshPassesTheSeatInMemoryAndWritesNothing(t *testing.T) {
-	withBusSeat(t)
+// On the merge gate's throwaway mesh the pass is recorded in its store and no hand act is written: there is no bus to write
+// it to.
+func TestAThrowawayMeshWritesNoHandActForAPass(t *testing.T) {
 	inv := &inventory.Inventory{}
 	inv.MarkThrowaway()
 	var said bytes.Buffer
-	holdings := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
-	got := passSeatsOn(t.Context(), seatPassingOn(inv, &said), holdings,
-		[]catalogue.Assignment{{Node: "novox", Manifest: aBrokerClaiming("gate")}})
-	if len(got) != 1 || got[0].Module != "gate" {
-		t.Fatalf("the gate's view does not hold the pass: %+v", got)
+	sp := seatPassingOn(inv, &said)
+	if err := sp.act(t.Context(), catalogue.SeatPass{}); err != nil {
+		t.Fatalf("the throwaway mesh tried to write the act: %v", err)
 	}
 	if said.Len() != 0 {
 		t.Errorf("the throwaway composition said %q (a write was tried)", said.String())
diff --git a/cmd/mesh-controller/seats.go b/cmd/mesh-controller/seats.go
index fd44d2a5..c5da96b6 100644
--- a/cmd/mesh-controller/seats.go
+++ b/cmd/mesh-controller/seats.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 	"text/tabwriter"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What this mesh can have one of, and who fills each (novox/hq ADR 0110).
@@ -252,7 +252,7 @@ func seatsCommand(ctx context.Context, args []string) error {
 		return err
 	}
 	// Every node, none excluded: the same view of what each machine holds that planning uses.
-	world, err := theRestOfTheMesh(ctx, inv, shelf, "")
+	world, err := restOfTheMesh(ctx, open, shelf, "")
 	if err != nil {
 		return err
 	}
diff --git a/cmd/mesh-controller/seats_test.go b/cmd/mesh-controller/seats_test.go
index 435eb705..5273127b 100644
--- a/cmd/mesh-controller/seats_test.go
+++ b/cmd/mesh-controller/seats_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The overview of what a mesh has (novox/hq ADR 0110).
diff --git a/cmd/mesh-controller/seatverbs.go b/cmd/mesh-controller/seatverbs.go
index 5decbfef..b7b00d09 100644
--- a/cmd/mesh-controller/seatverbs.go
+++ b/cmd/mesh-controller/seatverbs.go
@@ -16,8 +16,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/seatverbs_integration_test.go b/cmd/mesh-controller/seatverbs_integration_test.go
index 84e0dea8..f2347d10 100644
--- a/cmd/mesh-controller/seatverbs_integration_test.go
+++ b/cmd/mesh-controller/seatverbs_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/seatverbs_schema_integration_test.go b/cmd/mesh-controller/seatverbs_schema_integration_test.go
index 88eb3882..c955119d 100644
--- a/cmd/mesh-controller/seatverbs_schema_integration_test.go
+++ b/cmd/mesh-controller/seatverbs_schema_integration_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func servedSchemas(t *testing.T) map[string]catalogue.Verb {
diff --git a/cmd/mesh-controller/secret.go b/cmd/mesh-controller/secret.go
index 4500f756..f2d5aae9 100644
--- a/cmd/mesh-controller/secret.go
+++ b/cmd/mesh-controller/secret.go
@@ -14,7 +14,7 @@ import (
 
 	"github.com/nats-io/nats.go"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/secrets"
diff --git a/cmd/mesh-controller/secret_move_test.go b/cmd/mesh-controller/secret_move_test.go
index cbf179d9..b60d6de0 100644
--- a/cmd/mesh-controller/secret_move_test.go
+++ b/cmd/mesh-controller/secret_move_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/sendable.go b/cmd/mesh-controller/sendable.go
index 6bea488a..ded06fac 100644
--- a/cmd/mesh-controller/sendable.go
+++ b/cmd/mesh-controller/sendable.go
@@ -1,13 +1,10 @@
 package main
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
-	"sort"
-	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -168,53 +165,3 @@ func (s sendable) Body() ([]byte, error) {
 	}
 	return json.Marshal(envelope)
 }
-
-// adoptionOf is the envelope for a node, nil when it is converged.
-func adoptionOf(ctx context.Context, inv *inventory.Inventory, record inventory.Node,
-	plan catalogue.Resolution, composed catalogue.Composed) (*adoptionEnvelope, error) {
-	if !record.Adopted {
-		return nil, nil
-	}
-	taken, err := inv.Taken(ctx, record.Name)
-	if err != nil {
-		return nil, err
-	}
-	return adoptionFor(plan, taken, composed), nil
-}
-
-// adoptionFor is the envelope computed from what was taken and who owns each resource.
-//
-// Every module the node runs that is not taken is untaken — including one pulled in by another
-// rather than assigned: what is found is kept until its module is taken, whoever put it there.
-func adoptionFor(plan catalogue.Resolution, taken []string,
-	composed catalogue.Composed) *adoptionEnvelope {
-	isTaken := map[string]bool{}
-	for _, m := range taken {
-		isTaken[m] = true
-	}
-	out := &adoptionEnvelope{Taken: []string{}}
-	runs := map[string]bool{}
-	for _, m := range plan.Modules {
-		runs[m.Module] = true
-		if isTaken[m.Module] {
-			out.Taken = append(out.Taken, m.Module)
-		}
-	}
-	sort.Strings(out.Taken)
-	for _, r := range composed.Resources {
-		id, _ := r["id"].(string)
-		module, owned := composed.Owner[id]
-		// Every kind, not only files and containers (novox/hq ADR 0103): a directory, a service, a
-		// container mounting what was found and an action run in a held container all reach what
-		// the machine already has. What the mesh declares of its own is never held.
-		if !owned || !runs[module] || isTaken[module] ||
-			strings.HasPrefix(id, catalogue.AdoptionPrefix) {
-			continue
-		}
-		if out.Untaken == nil {
-			out.Untaken = map[string][]string{}
-		}
-		out.Untaken[module] = append(out.Untaken[module], id)
-	}
-	return out
-}
diff --git a/cmd/mesh-controller/sendable_integration_test.go b/cmd/mesh-controller/sendable_integration_test.go
index e1817f27..ec51664d 100644
--- a/cmd/mesh-controller/sendable_integration_test.go
+++ b/cmd/mesh-controller/sendable_integration_test.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/overlay"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 )
 
 func TestAConvergedDeclarationIsByteForByteWhatItWas(t *testing.T) {
@@ -157,7 +157,7 @@ func TestConsumersAreToldTheGivenPort(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,7 +183,7 @@ func TestConsumersAreToldTheGivenPort(t *testing.T) {
 		!strings.Contains(err.Error(), "per node") {
 		t.Fatalf("a port given for the whole mesh was not refused: %v", err)
 	}
-	plan, settings, err := planFor(ctx, open, "anchor")
+	plan, settings, err := resolveNode(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -283,7 +283,7 @@ func TestTheMachineSideOfAMappingIsMovedEverywhereTheNumberIsUsed(t *testing.T)
 	}
 
 	// And the consumer on the other machine dials the same number.
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/sendable_test.go b/cmd/mesh-controller/sendable_test.go
index 47224eea..0616525f 100644
--- a/cmd/mesh-controller/sendable_test.go
+++ b/cmd/mesh-controller/sendable_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -26,7 +26,7 @@ func helloWeb() catalogue.Manifest {
 // composed is what node would be sent now, as push composes it.
 func composed(t *testing.T, open *stores, node string) sendable {
 	t.Helper()
-	plan, settings, err := planFor(t.Context(), open, node)
+	plan, settings, err := resolveNode(t.Context(), open, node)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/sent_required_by_integration_test.go b/cmd/mesh-controller/sent_required_by_integration_test.go
index 077a4192..5bc15604 100644
--- a/cmd/mesh-controller/sent_required_by_integration_test.go
+++ b/cmd/mesh-controller/sent_required_by_integration_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
@@ -38,7 +38,7 @@ func TestAModulePulledInIsHandedOnAMachineThatCanTakeItAndMirrored(t *testing.T)
 		t.Fatal(err)
 	}
 
-	plan, settings, err := planFor(ctx, open, "laptop")
+	plan, settings, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/sent_required_by_test.go b/cmd/mesh-controller/sent_required_by_test.go
index 7f611ca2..eb5a1113 100644
--- a/cmd/mesh-controller/sent_required_by_test.go
+++ b/cmd/mesh-controller/sent_required_by_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A send keeps, beside each handed module's plan, what requires a module only pulled in (issue 765), so the
diff --git a/cmd/mesh-controller/served_own_names_test.go b/cmd/mesh-controller/served_own_names_test.go
index 430d9f0f..f7f12f65 100644
--- a/cmd/mesh-controller/served_own_names_test.go
+++ b/cmd/mesh-controller/served_own_names_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq ADR 0346, issue 624: a provider on another machine serves its consumers its own composed
@@ -36,7 +36,7 @@ func TestAProviderElsewhereServesItsOwnComposedName(t *testing.T) {
 	if err := open.inventory.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -48,7 +48,7 @@ func TestAProviderElsewhereServesItsOwnComposedName(t *testing.T) {
 	if err := open.inventory.SetPublicDomain(ctx, "anchor", ""); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = planFor(ctx, open, "laptop")
+	plan, _, err = resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/settings_effective_integration_test.go b/cmd/mesh-controller/settings_effective_integration_test.go
index e23f7a4a..ac05ea1a 100644
--- a/cmd/mesh-controller/settings_effective_integration_test.go
+++ b/cmd/mesh-controller/settings_effective_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestPreferencesListedFromTheStores(t *testing.T) {
diff --git a/cmd/mesh-controller/settings_effective_test.go b/cmd/mesh-controller/settings_effective_test.go
index 23e20ab1..196c1376 100644
--- a/cmd/mesh-controller/settings_effective_test.go
+++ b/cmd/mesh-controller/settings_effective_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // `settings` says each value and where it came from, and the default a layer overrides (novox/hq ADR 0262).
diff --git a/cmd/mesh-controller/settings_forward.go b/cmd/mesh-controller/settings_forward.go
index c3c423de..2ac948cb 100644
--- a/cmd/mesh-controller/settings_forward.go
+++ b/cmd/mesh-controller/settings_forward.go
@@ -10,8 +10,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/settings_walk.go b/cmd/mesh-controller/settings_walk.go
index e5d69db6..08fd5aa4 100644
--- a/cmd/mesh-controller/settings_walk.go
+++ b/cmd/mesh-controller/settings_walk.go
@@ -9,7 +9,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/compose"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
@@ -97,15 +98,14 @@ var openSettingsWalk = func(ctx context.Context, open *stores, s inventory.PlanS
 // that send composes it, every build kept, and compared with what the machine was last sent (ADR 0217 §3).
 var settingsDataMoves = func(ctx context.Context, open *stores, node string) ([]dataMove, error) {
 	keeping := keepingBuildsForSettings(keepingRecorded(ctx), node)
-	gens, err := generators(keeping, open)
-	if err != nil {
+	keeping = withInputCache(keeping)
+	if _, err := generatorsOf(keeping, open); err != nil {
 		return nil, err
 	}
-	plan, settings, err := planFor(keeping, open, node)
-	if err != nil {
+	if _, _, err := resolveNode(keeping, open, node); err != nil {
 		return nil, err
 	}
-	declared, err := declarationWith(keeping, open, node, plan, settings, gens, Reading)
+	declared, _, err := composeQuestion(keeping, open, node, compose.Reading, false)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/mesh-controller/settings_walk_integration_test.go b/cmd/mesh-controller/settings_walk_integration_test.go
index 90bfe9ef..5f11ec27 100644
--- a/cmd/mesh-controller/settings_walk_integration_test.go
+++ b/cmd/mesh-controller/settings_walk_integration_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
 )
diff --git a/cmd/mesh-controller/silent_mid_tier_integration_test.go b/cmd/mesh-controller/silent_mid_tier_integration_test.go
index a6ec577d..b60784f0 100644
--- a/cmd/mesh-controller/silent_mid_tier_integration_test.go
+++ b/cmd/mesh-controller/silent_mid_tier_integration_test.go
@@ -13,8 +13,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/source.go b/cmd/mesh-controller/source.go
index c919abab..b54a6678 100644
--- a/cmd/mesh-controller/source.go
+++ b/cmd/mesh-controller/source.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // where a build's repository is (novox/hq ADR 0111).
@@ -68,7 +68,7 @@ func cloneFrom(ctx context.Context, source buildSource) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
+	world, err := restOfTheMesh(ctx, open, shelf, "")
 	if err != nil {
 		return "", err
 	}
@@ -154,7 +154,7 @@ func seatBases(ctx context.Context) map[string]string {
 	if err != nil {
 		return unread("the catalogue", err)
 	}
-	world, err := theRestOfTheMesh(ctx, open.inventory, shelf, "")
+	world, err := restOfTheMesh(ctx, open, shelf, "")
 	if err != nil {
 		return unread("who holds which seat", err)
 	}
diff --git a/cmd/mesh-controller/source_test.go b/cmd/mesh-controller/source_test.go
index cd0030b4..ab9c8ccd 100644
--- a/cmd/mesh-controller/source_test.go
+++ b/cmd/mesh-controller/source_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Defends novox/hq ADR 0111: a build source is on the git seat, or it is external.
diff --git a/cmd/mesh-controller/standing_integration_test.go b/cmd/mesh-controller/standing_integration_test.go
index 625f0f15..6ededc10 100644
--- a/cmd/mesh-controller/standing_integration_test.go
+++ b/cmd/mesh-controller/standing_integration_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/status.go b/cmd/mesh-controller/status.go
index 2a103cdc..5d262e36 100644
--- a/cmd/mesh-controller/status.go
+++ b/cmd/mesh-controller/status.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/overlay"
 )
 
 // is anything broken, is anything not answering, is anything out of date.
@@ -406,6 +406,8 @@ type builds struct {
 // anything out of date. The first has consequences now, the second may, the third is a plan for
 // later — and anything that led with the third would bury the first.
 func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
+	// One reading of the mesh for every machine this looks at.
+	ctx = withInputCache(ctx)
 	inv := open.inventory
 	var out answers
 	var err error
@@ -429,7 +431,7 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	//
 	// Read through whoResolves, which is what the private network is built from, so this and the
 	// network agree about who could not be resolved rather than deciding it twice.
-	_, out.refused, err = whoResolves(ctx, open, overlay.Addressing)
+	_, out.refused, err = whoResolvesOn(ctx, open, overlay.Addressing)
 	if err != nil {
 		return answers{}, err
 	}
@@ -453,7 +455,7 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	// resolve is already in refused, and is passed over here.
 	plans := map[string]planned{}
 	for _, n := range out.nodes {
-		plan, settings, err := planFor(ctx, open, n.Name)
+		plan, settings, err := resolveNode(ctx, open, n.Name)
 		if err != nil {
 			if unresolvable(err) {
 				continue
diff --git a/cmd/mesh-controller/stores.go b/cmd/mesh-controller/stores.go
index ff727dbc..0fbd2703 100644
--- a/cmd/mesh-controller/stores.go
+++ b/cmd/mesh-controller/stores.go
@@ -6,7 +6,7 @@ import (
 	"os"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/identity"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/licences"
diff --git a/cmd/mesh-controller/take_preview_test.go b/cmd/mesh-controller/take_preview_test.go
index c9f5fc5e..c7aac893 100644
--- a/cmd/mesh-controller/take_preview_test.go
+++ b/cmd/mesh-controller/take_preview_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/template_integration_test.go b/cmd/mesh-controller/template_integration_test.go
index 89338cd5..8b847819 100644
--- a/cmd/mesh-controller/template_integration_test.go
+++ b/cmd/mesh-controller/template_integration_test.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
-	snapshot "github.com/novox/mesh-controller/internal/facts"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	snapshot "git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/terminal_settings_test.go b/cmd/mesh-controller/terminal_settings_test.go
index 62dd3954..3c8c4d8d 100644
--- a/cmd/mesh-controller/terminal_settings_test.go
+++ b/cmd/mesh-controller/terminal_settings_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Where root creates and owns a module's directories, and which of the machine's paths reach its container,
diff --git a/cmd/mesh-controller/tier_send_integration_test.go b/cmd/mesh-controller/tier_send_integration_test.go
index d05dc9ca..9d0cdddf 100644
--- a/cmd/mesh-controller/tier_send_integration_test.go
+++ b/cmd/mesh-controller/tier_send_integration_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/lease"
diff --git a/cmd/mesh-controller/try_test.go b/cmd/mesh-controller/try_test.go
index f76953c1..49ef75a8 100644
--- a/cmd/mesh-controller/try_test.go
+++ b/cmd/mesh-controller/try_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 )
 
diff --git a/cmd/mesh-controller/unbound.go b/cmd/mesh-controller/unbound.go
index 670054bc..d038edde 100644
--- a/cmd/mesh-controller/unbound.go
+++ b/cmd/mesh-controller/unbound.go
@@ -3,7 +3,7 @@ package main
 import (
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // unboundLines say which optional requirements of a machine's modules nothing assigned answers
diff --git a/cmd/mesh-controller/unbound_test.go b/cmd/mesh-controller/unbound_test.go
index 554a744f..0114131b 100644
--- a/cmd/mesh-controller/unbound_test.go
+++ b/cmd/mesh-controller/unbound_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A machine running grafana without influxdb says so (novox/hq ADR 0330 §7, issue 166): `plan` and
@@ -24,7 +24,7 @@ func TestPlanAndNodeListAnOptionalRequirementLeftUnbound(t *testing.T) {
 		t.Fatalf("grafana could not be assigned on a mesh without influxdb: %v", err)
 	}
 
-	plan, _, err := planFor(ctx, open, "laptop")
+	plan, _, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -44,7 +44,7 @@ func TestPlanAndNodeListAnOptionalRequirementLeftUnbound(t *testing.T) {
 	if _, err := assign(ctx, open, "anchor", "influxdb"); err != nil {
 		t.Fatal(err)
 	}
-	plan, _, err = planFor(ctx, open, "laptop")
+	plan, _, err = resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/unheld_report_integration_test.go b/cmd/mesh-controller/unheld_report_integration_test.go
index ec1bdd51..287461c0 100644
--- a/cmd/mesh-controller/unheld_report_integration_test.go
+++ b/cmd/mesh-controller/unheld_report_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAnAssignmentSaysOnlyWhatItChangedOnItsOwnNode(t *testing.T) {
diff --git a/cmd/mesh-controller/unheld_report_test.go b/cmd/mesh-controller/unheld_report_test.go
index 6d7d2e61..e012a161 100644
--- a/cmd/mesh-controller/unheld_report_test.go
+++ b/cmd/mesh-controller/unheld_report_test.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // An act says what it changed about the node it acted on, and nothing about the rest of the mesh
diff --git a/cmd/mesh-controller/unknown_fields.go b/cmd/mesh-controller/unknown_fields.go
index 895a071d..e5871a4e 100644
--- a/cmd/mesh-controller/unknown_fields.go
+++ b/cmd/mesh-controller/unknown_fields.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"sort"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
diff --git a/cmd/mesh-controller/unknown_fields_test.go b/cmd/mesh-controller/unknown_fields_test.go
index 9776331c..46af22ea 100644
--- a/cmd/mesh-controller/unknown_fields_test.go
+++ b/cmd/mesh-controller/unknown_fields_test.go
@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 )
 
diff --git a/cmd/mesh-controller/upgrades.go b/cmd/mesh-controller/upgrades.go
index fc8cf122..23efee2d 100644
--- a/cmd/mesh-controller/upgrades.go
+++ b/cmd/mesh-controller/upgrades.go
@@ -12,8 +12,8 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/urgent_unhealthy_test.go b/cmd/mesh-controller/urgent_unhealthy_test.go
index 3ad82512..a1be7af0 100644
--- a/cmd/mesh-controller/urgent_unhealthy_test.go
+++ b/cmd/mesh-controller/urgent_unhealthy_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/vault_handed_test.go b/cmd/mesh-controller/vault_handed_test.go
index 8e9ca26b..174e7acf 100644
--- a/cmd/mesh-controller/vault_handed_test.go
+++ b/cmd/mesh-controller/vault_handed_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/cmd/mesh-controller/vault_secrets.go b/cmd/mesh-controller/vault_secrets.go
index 7eba9d78..85207ed3 100644
--- a/cmd/mesh-controller/vault_secrets.go
+++ b/cmd/mesh-controller/vault_secrets.go
@@ -11,8 +11,8 @@ import (
 
 	"github.com/nats-io/nats.go"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
diff --git a/cmd/mesh-controller/vault_secrets_test.go b/cmd/mesh-controller/vault_secrets_test.go
index e31041b7..e89183b1 100644
--- a/cmd/mesh-controller/vault_secrets_test.go
+++ b/cmd/mesh-controller/vault_secrets_test.go
@@ -8,7 +8,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
diff --git a/cmd/mesh-controller/vault_switch_test.go b/cmd/mesh-controller/vault_switch_test.go
index 98c9f189..d3d912aa 100644
--- a/cmd/mesh-controller/vault_switch_test.go
+++ b/cmd/mesh-controller/vault_switch_test.go
@@ -16,8 +16,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
 )
@@ -271,7 +271,7 @@ func TestAnIssuedValueTakesThePathOfItsProvidersModule(t *testing.T) {
 		}
 	}
 	// The consumer's send makes the pair, so the provision has a holder to take it for.
-	plan, settings, err := planFor(ctx, open, "laptop")
+	plan, settings, err := resolveNode(ctx, open, "laptop")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/cmd/mesh-controller/waiting_provider_test.go b/cmd/mesh-controller/waiting_provider_test.go
index d324ad83..684921c2 100644
--- a/cmd/mesh-controller/waiting_provider_test.go
+++ b/cmd/mesh-controller/waiting_provider_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
diff --git a/cmd/mesh-controller/walk_said.go b/cmd/mesh-controller/walk_said.go
index 3e5d9bad..17b7984c 100644
--- a/cmd/mesh-controller/walk_said.go
+++ b/cmd/mesh-controller/walk_said.go
@@ -8,8 +8,8 @@ import (
 	"sort"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/walk_said_integration_test.go b/cmd/mesh-controller/walk_said_integration_test.go
index eec2119c..633440e0 100644
--- a/cmd/mesh-controller/walk_said_integration_test.go
+++ b/cmd/mesh-controller/walk_said_integration_test.go
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/testbus"
diff --git a/cmd/mesh-controller/walk_said_test.go b/cmd/mesh-controller/walk_said_test.go
index aac59370..f279146a 100644
--- a/cmd/mesh-controller/walk_said_test.go
+++ b/cmd/mesh-controller/walk_said_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/cmd/mesh-controller/written_settings_test.go b/cmd/mesh-controller/written_settings_test.go
index a0a61224..2c5ecfa2 100644
--- a/cmd/mesh-controller/written_settings_test.go
+++ b/cmd/mesh-controller/written_settings_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // ADR 0326 §3 is judged where a definition is written (novox/hq issue 574): `module check`, and
diff --git a/examples/postgres-provisioner/where_test.go b/examples/postgres-provisioner/where_test.go
index 1097ae20..35fdb6d3 100644
--- a/examples/postgres-provisioner/where_test.go
+++ b/examples/postgres-provisioner/where_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The password comes from a file, because that is how the mesh delivers one.
diff --git a/go.mod b/go.mod
index a0aa03ee..069eec06 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261019091011-aa68b67389c9
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261020085642-ab0c16ddad26
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
diff --git a/go.sum b/go.sum
index cfc11098..abcbc3b8 100644
--- a/go.sum
+++ b/go.sum
@@ -4,6 +4,8 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018184557-238440d6f8c4 h1:yYDxFRJo
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261018184557-238440d6f8c4/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261019091011-aa68b67389c9 h1:qHpN/fpTDqijfMVoepxUT6mPkfcydb4LiPKsIokv6iM=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261019091011-aa68b67389c9/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261020085642-ab0c16ddad26 h1:oT1l3ZdjyF82MK14QMLKzoH2+iOFH/+UEYdlK3T2f7k=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261020085642-ab0c16ddad26/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/internal/artifacts/hold.go b/internal/artifacts/hold.go
index d8d1d9b0..2d914dfc 100644
--- a/internal/artifacts/hold.go
+++ b/internal/artifacts/hold.go
@@ -13,7 +13,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Every archive the store keeps is held by a manifest (novox/hq issue 253, ADR 0189).
diff --git a/internal/artifacts/hold_test.go b/internal/artifacts/hold_test.go
index 8f241f63..945c4c27 100644
--- a/internal/artifacts/hold_test.go
+++ b/internal/artifacts/hold_test.go
@@ -16,7 +16,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Every kept archive is held by a manifest (novox/hq issue 253, ADR 0189).
diff --git a/internal/artifacts/live_registry_test.go b/internal/artifacts/live_registry_test.go
index 1bbf32f2..89ffe10b 100644
--- a/internal/artifacts/live_registry_test.go
+++ b/internal/artifacts/live_registry_test.go
@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The registry's own collector keeps a held archive and takes a bare one (novox/hq issue 253,
diff --git a/internal/artifacts/platforms_test.go b/internal/artifacts/platforms_test.go
index e1784442..7f2b5dbe 100644
--- a/internal/artifacts/platforms_test.go
+++ b/internal/artifacts/platforms_test.go
@@ -11,7 +11,7 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // An index is let go of with the platform manifests it names, except those a kept index of the same
diff --git a/internal/artifacts/store.go b/internal/artifacts/store.go
index b84776b0..e105f785 100644
--- a/internal/artifacts/store.go
+++ b/internal/artifacts/store.go
@@ -16,7 +16,7 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Store is the artifact store at an address, as this machine reaches it.
diff --git a/internal/artifacts/store_test.go b/internal/artifacts/store_test.go
index 097b9a14..5ba0380f 100644
--- a/internal/artifacts/store_test.go
+++ b/internal/artifacts/store_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Asking the store to let go of what the mesh no longer keeps (novox/hq ADR 0189, issue 108).
diff --git a/internal/broker/agreement_catalogue_test.go b/internal/broker/agreement_catalogue_test.go
index 805ab90f..05c2c028 100644
--- a/internal/broker/agreement_catalogue_test.go
+++ b/internal/broker/agreement_catalogue_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/beside"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // **Do the catalogue's emitters and consumers agree?**
diff --git a/internal/broker/states_agreement_test.go b/internal/broker/states_agreement_test.go
index 955d4325..87ad8f70 100644
--- a/internal/broker/states_agreement_test.go
+++ b/internal/broker/states_agreement_test.go
@@ -4,8 +4,8 @@ import (
 	"slices"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/internal/broker/stream_names_agreement_test.go b/internal/broker/stream_names_agreement_test.go
index 29c4cf6c..c57e0d67 100644
--- a/internal/broker/stream_names_agreement_test.go
+++ b/internal/broker/stream_names_agreement_test.go
@@ -4,7 +4,7 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The catalogue's list of the mesh's own stream names, which a module's stream may not take, is the broker's
diff --git a/internal/builder/binary_name_test.go b/internal/builder/binary_name_test.go
index de0bfd27..efefbe1f 100644
--- a/internal/builder/binary_name_test.go
+++ b/internal/builder/binary_name_test.go
@@ -3,7 +3,7 @@ package builder
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The name a machine runs a binary by is not always the name of the package that built it. The host's
diff --git a/internal/builder/builder.go b/internal/builder/builder.go
index ea264e80..153f414d 100644
--- a/internal/builder/builder.go
+++ b/internal/builder/builder.go
@@ -21,8 +21,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // Turning a repository into artifacts the mesh can pin.
diff --git a/internal/builder/builder_integration_test.go b/internal/builder/builder_integration_test.go
index 56eac672..31447aec 100644
--- a/internal/builder/builder_integration_test.go
+++ b/internal/builder/builder_integration_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestABuildProducesAManifestThePinsAreIn(t *testing.T) {
diff --git a/internal/builder/builder_test.go b/internal/builder/builder_test.go
index 1cc165ac..47efb4f4 100644
--- a/internal/builder/builder_test.go
+++ b/internal/builder/builder_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A repository becoming artifacts the mesh can pin.
diff --git a/internal/builder/check.go b/internal/builder/check.go
index f49cc160..3d333a8c 100644
--- a/internal/builder/check.go
+++ b/internal/builder/check.go
@@ -20,8 +20,8 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/facts"
 )
 
 // A pull request's merge check, run on the build seat (novox/hq to-be 45 §9, ADR 0237).
@@ -37,8 +37,8 @@ import (
 //     (New). The touched manifests through `module check`; every machine of the facts snapshot composed
 //     with the change and validated by the node-engine's own validator; then mesh-lab's replays. The
 //     judge is the controller the mesh runs — or, for a change to the controller, the change's own
-//     controller, and for a change to the node-engine, the running controller with the change's validator
-//     in place of the one it vendors. The graph decides whether this runs, never the repository.
+//     controller. A change to the node-engine is judged as any module is: the validator is mesh-sdk's, at
+//     the controller's pin. The graph decides whether this runs, never the repository.
 //   - **the repository's own check** (`mesh/repo-check`): its merge-check.sh, its unit tests and code
 //     quality, run when present in the toolchain it declares (`# mesh-check-toolchain: go|typescript`
 //     among its first lines; go when it declares none). A repository that reaches the build seat with
@@ -88,8 +88,8 @@ type CheckSpec struct {
 	// Base is the branch the pull request merges into: what the gate compares the change against, and the trunk
 	// whose head the change is merged into before it is judged (novox/hq ADR 0323). Empty judges the head alone.
 	Base string
-	// Judge is who judges the gate: "" the controller the mesh runs, "self" the change's own, "validator"
-	// the running one with the change's validator.
+	// Judge is who judges the gate: "" the controller the mesh runs, "self" the change's own. Anything else,
+	// "validator" of an older request too, is the controller the mesh runs.
 	Judge string
 	// JudgeCache is the judge cache (novox/hq ADR 0358 §6): a directory of the build agent's own, outside the
 	// workspace, that only judge builds mount — never a check's containers, so no pull request's script can write it.
@@ -226,8 +226,8 @@ type CheckVerdict struct {
 	Members []JudgedHead
 	// Built are the builds it made for its merge (novox/hq ADR 0350 §1), each with its key, or why not.
 	Built []CheckBuilt
-	// Validator says which node-engine validator the group's judge was built with (ADR 0382 §3), empty for any other
-	// judge.
+	// Validator says which validator the group's judge was built with (ADR 0382 §3): mesh-sdk's, at the pin of the
+	// controller that judges (issue 1391); empty for any other judge.
 	Validator string
 	// Siblings are the pull requests of the delivery group the check read beside it, each merged onto its base commit
 	// (novox/hq ADR 0382 §4); SiblingsUnknown is why it could not learn them; JudgeFrom says where the judge came from
@@ -1175,11 +1175,11 @@ func gateLayer(ctx context.Context, spec CheckSpec, tree, root, gate, verdictFil
 	return "error", "the merge gate said " + said.Verdict
 }
 
-// judgeFor builds the judge of a check: the change's own controller (a change to the controller), the
-// running controller built with the change's validator (a change to the node-engine), or the controller
-// the mesh runs. It answers the judge's path; or, when the change makes its own judge unbuildable, why —
-// the change's fault, a failing gate; or an error when the check cannot build a judge at all. A check
-// whose gate does not run builds a judge only to hand its scripts one, and goes on without when it cannot.
+// judgeFor builds the judge of a check: the change's own controller (a change to the controller), or the controller
+// the mesh runs (any other change, the node-engine's too: its validator is mesh-sdk's, at the controller's pin). It
+// answers the judge's path; or, when the change makes its own judge unbuildable, why — the change's fault, a failing
+// gate; or an error when the check cannot build a judge at all. A check whose gate does not run builds a judge only to
+// hand its scripts one, and goes on without when it cannot.
 func judgeFor(ctx context.Context, labelled, run Runner, spec CheckSpec, root, tree string,
 	judged CheckVerdict, siblings *siblingJudgement,
 	inToolchain func(string, []string, ...string) []string, say func(step, format string, args ...any)) (string, string, error) {
@@ -1194,10 +1194,10 @@ func judgeFor(ctx context.Context, labelled, run Runner, spec CheckSpec, root, t
 			"go", "build", "-o", bin, "./cmd/mesh-controller")...); err != nil {
 			return "", "the change's controller, which judges itself, does not build: " + firstLine(err.Error()), nil
 		}
-		say("check", "judged by the change's own controller")
+		say("check", "judged by the change's own controller, with %s", validatorAt(tree))
 		return bin, "", nil
 	}
-	bin, judgeTree, err := judge(ctx, labelled, run, root, inToolchain, say)
+	bin, _, err := judge(ctx, labelled, run, root, inToolchain, say)
 	if err != nil {
 		if !gated {
 			say("check", "no judge for its script: %v", err)
@@ -1205,23 +1205,7 @@ func judgeFor(ctx context.Context, labelled, run Runner, spec CheckSpec, root, t
 		}
 		return "", "", err
 	}
-	if spec.Judge != "validator" {
-		return bin, "", nil
-	}
-	// The node-engine's change: its validator in place of the one the judge vendors.
-	vendored := filepath.Join(root, judgeTree, "vendor", "github.com", "novox", "mesh-host")
-	for _, pkg := range []string{"validate", filepath.Join("internal", "declaration")} {
-		if err := replaceGoFiles(filepath.Join(tree, pkg), filepath.Join(vendored, pkg)); err != nil {
-			return "", "", fmt.Errorf("the change's validator could not be put in the judge: %w", err)
-		}
-	}
-	withValidator := filepath.Join(root, "bin", "judge-with-this-validator")
-	if _, err := labelled(ctx, root, "docker", inToolchain(filepath.Join(root, judgeTree), nil,
-		"go", "build", "-o", withValidator, "./cmd/mesh-controller")...); err != nil {
-		return "", "the controller the mesh runs does not build with this change's validator: " + firstLine(err.Error()), nil
-	}
-	say("check", "judged by the controller the mesh runs, with this change's validator")
-	return withValidator, "", nil
+	return bin, "", nil
 }
 
 // judgeBuildEnv is JudgeBuildEnv, a seam only a test replaces: to show what the plain environment would let a planted
@@ -1462,42 +1446,6 @@ func refWords(ref string) string {
 // commitLike is a ref that names a commit.
 var commitLike = regexp.MustCompile(`^[0-9a-f]{7,40}$`)
 
-// replaceGoFiles puts a package's Go files — never its tests — in place of another copy's.
-func replaceGoFiles(from, into string) error {
-	old, err := filepath.Glob(filepath.Join(into, "*.go"))
-	if err != nil {
-		return err
-	}
-	for _, f := range old {
-		if err := os.Remove(f); err != nil {
-			return err
-		}
-	}
-	if err := os.MkdirAll(into, 0o755); err != nil {
-		return err
-	}
-	files, err := filepath.Glob(filepath.Join(from, "*.go"))
-	if err != nil {
-		return err
-	}
-	if len(files) == 0 {
-		return fmt.Errorf("%s holds no Go files", from)
-	}
-	for _, f := range files {
-		if strings.HasSuffix(f, "_test.go") {
-			continue
-		}
-		body, err := os.ReadFile(f)
-		if err != nil {
-			return err
-		}
-		if err := os.WriteFile(filepath.Join(into, filepath.Base(f)), body, 0o644); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 // problemLines are the lines of a module check's output that name a problem: not a manifest found ok, not
 // the count, not the closing note.
 func problemLines(s string) []string {
@@ -1689,6 +1637,54 @@ func dialable(ctx context.Context, address string) error {
 	return fmt.Errorf("nothing took a connection at %s", address)
 }
 
+// sdkPin is the mesh-sdk version the controller in dir takes (its go.mod's go requirement), or "" when it names none; and
+// local says that version is no real one: the placeholder v0.0.0, or a replace of mesh-sdk by a directory, which a
+// workspace or a fixture uses and no release holds.
+func sdkPin(dir string) (version string, local bool) {
+	body, err := os.ReadFile(filepath.Join(dir, "go.mod"))
+	if err != nil {
+		return "", false
+	}
+	const path = "git.novox.be/novox/mesh-sdk/go"
+	replaced := false
+	for _, line := range strings.Split(string(body), "\n") {
+		f := strings.Fields(strings.TrimPrefix(strings.TrimPrefix(strings.TrimSpace(line), "require "), "replace "))
+		switch {
+		case len(f) >= 3 && f[0] == path && f[len(f)-2] == "=>" && (strings.HasPrefix(f[len(f)-1], ".") || strings.HasPrefix(f[len(f)-1], "/")):
+			replaced = true
+		case len(f) >= 2 && f[0] == path && version == "" && f[1] != "=>":
+			version = f[1]
+		}
+	}
+	return version, version == "v0.0.0" || (replaced && version != "")
+}
+
+// validatorAt names the validator of the controller in dir as mesh-sdk's at that controller's pin (issue 1391): the
+// version when it is a real one, and a local mesh-sdk said as such when it is not.
+func validatorAt(dir string) string {
+	switch v, local := sdkPin(dir); {
+	case v == "":
+		return "mesh-sdk's validator at the controller's pin"
+	case local:
+		return "mesh-sdk's validator from a local mesh-sdk (" + v + ", replaced)"
+	default:
+		return "mesh-sdk's validator at " + v
+	}
+}
+
+// pinNote is the pin for a sentence that already says "the pin of": the version in brackets when it is a real one, a
+// local mesh-sdk said as such when it is not, or nothing.
+func pinNote(dir string) string {
+	switch v, local := sdkPin(dir); {
+	case v == "":
+		return ""
+	case local:
+		return " (a local mesh-sdk, " + v + ", replaced)"
+	default:
+		return " (" + v + ")"
+	}
+}
+
 // judge builds the controller that judges a change: the one the mesh runs, beside the check as
 // mesh-controller — or, when that one predates the merge gate, the controller's main, said. It answers
 // the binary and the directory it was built from.
@@ -1710,7 +1706,7 @@ func judge(ctx context.Context, run, plain Runner, root string, inToolchain func
 			return "", "", fmt.Errorf("the controller the mesh runs does not build: %w", err)
 		}
 		if hasGate() {
-			say("check", "judged by the controller the mesh runs")
+			say("check", "judged by the controller the mesh runs, with %s", validatorAt(filepath.Join(root, "mesh-controller")))
 			return bin, "mesh-controller", nil
 		}
 	}
@@ -1720,7 +1716,8 @@ func judge(ctx context.Context, run, plain Runner, root string, inToolchain func
 	if err := build("mesh-controller-main"); err != nil {
 		return "", "", fmt.Errorf("the controller's main does not build: %w", err)
 	}
-	say("check", "judged by the controller's main: the one the mesh runs predates the merge gate")
+	say("check", "judged by the controller's main: the one the mesh runs predates the merge gate, with %s",
+		validatorAt(filepath.Join(root, "mesh-controller-main")))
 	return bin, "mesh-controller-main", nil
 }
 
@@ -1810,20 +1807,20 @@ func groupDir(spec CheckSpec, root, tree, repo string) string {
 // to), and false leaves the judge to the rules before it.
 //
 //   - A member with a mesh-controller sibling is judged by the controller built from that sibling's merge (read beside
-//     the check), with the node-engine's validator from the member's own change when it is mesh-host's, else from a
-//     mesh-host sibling's merge, else the one that controller vendors.
-//   - A mesh-controller member is judged by itself, with a mesh-host sibling's validator in place of the one it vendors.
+//     the check), with the validator that controller takes from mesh-sdk at its pin.
+//   - A mesh-controller member is judged by itself, and a mesh-host sibling changes nothing of it: the node-engine holds
+//     no validator any more (issue 1391, novox/hq ADR 0446 clause 5).
 //
 // **The judge is unreviewed code** and is built where nothing the change's script does can reach it: from a copy of the
 // merge made apart from the workspace's tree, with the judge-build environment (JudgeBuildEnv) — a home and Go cache of
 // its own, no global or system git configuration, no version stamping from git — and kept in the judge cache, which no
 // check's container mounts, only for the same inputs: the controller merge and the base commits it was merged onto, the
-// validator's source and commit.
+// controller's pin of the validator.
 func judgeFromTheGroup(ctx context.Context, labelled, run Runner, spec CheckSpec, root, tree string, judged CheckVerdict,
 	said *siblingJudgement, inToolchain func(string, []string, ...string) []string,
 	say func(step, format string, args ...any)) (string, string, bool, error) {
-	controller, host := siblingIn(spec, "mesh-controller"), siblingIn(spec, "mesh-host")
-	var source, validatorDir, from, validator string
+	controller := siblingIn(spec, "mesh-controller")
+	var source, from, validator string
 	var inputs []string
 	merge := func(dir string, s *Sibling) string {
 		return fmt.Sprintf("sibling %s#%d merge %s", s.Repository, s.Number, judged.Beside[dir])
@@ -1831,33 +1828,19 @@ func judgeFromTheGroup(ctx context.Context, labelled, run Runner, spec CheckSpec
 	switch {
 	case len(spec.Group) > 0 && groupDir(spec, root, tree, "mesh-controller") != "":
 		// **A delivery group's composed check is judged by the group's own controller** (novox/hq ADR 0239 §14), whatever
-		// base it merges into: the member that moves mesh-controller, as merged, with the validator of the group's mesh-host member's
-		// merge when it has one, else the one that controller vendors.
-		source, validatorDir = groupDir(spec, root, tree, "mesh-controller"), groupDir(spec, root, tree, "mesh-host")
+		// base it merges into: the member that moves mesh-controller, as merged, with the validator it takes from mesh-sdk at
+		// its pin. A mesh-host member brings no validator (issue 1391), and its tree need hold none.
+		source = groupDir(spec, root, tree, "mesh-controller")
 		from = "the group's own controller, merge " + headAt(ctx, run, source)
-		validator = "the validator the group's controller vendors"
-		if validatorDir != "" {
-			validator = "the group's mesh-host merge " + headAt(ctx, run, validatorDir) + "'s validator"
-		}
+		validator = "mesh-sdk's validator at the pin of the group's controller" + pinNote(source)
 		inputs = append(inputs, "group member "+spec.Repo+" "+judged.Head+" onto "+judged.Trunk)
 		for _, m := range judged.Members {
 			inputs = append(inputs, "group member "+m.Repo+" "+m.Head+" onto "+m.Trunk)
 		}
-	case spec.Judge == "self" && host != nil:
-		source, validatorDir = tree, filepath.Join(root, "mesh-host")
-		from = "this change's own merge " + judged.Head
-		validator = merge("mesh-host", host) + "'s validator"
 	case spec.Judge != "self" && controller != nil:
 		source = filepath.Join(root, "mesh-controller")
 		from = merge("mesh-controller", controller)
-		switch {
-		case spec.Judge == "validator":
-			validatorDir, validator = tree, "the change's own validator"
-		case host != nil:
-			validatorDir, validator = filepath.Join(root, "mesh-host"), merge("mesh-host", host)+"'s validator"
-		default:
-			validator = "the validator " + merge("mesh-controller", controller) + " vendors"
-		}
+		validator = "mesh-sdk's validator at the pin of " + merge("mesh-controller", controller) + pinNote(source)
 	default:
 		return "", "", false, nil
 	}
@@ -1867,9 +1850,6 @@ func judgeFromTheGroup(ctx context.Context, labelled, run Runner, spec CheckSpec
 	// A merge made for a check is a new commit each time (its time is in it); what it holds is the same for the same
 	// heads and bases, so the key names those and the trees the judge is built from.
 	inputs = append(inputs, "member "+judged.Head+" onto "+judged.Trunk, "controller tree "+treeAt(ctx, run, source))
-	if validatorDir != "" {
-		inputs = append(inputs, "validator tree "+treeAt(ctx, run, validatorDir))
-	}
 	sum := sha256.Sum256([]byte(strings.Join(inputs, "\n")))
 	key := "siblings-" + hex.EncodeToString(sum[:16])
 	bin := filepath.Join(root, "bin", "judge-of-the-group")
@@ -1883,14 +1863,6 @@ func judgeFromTheGroup(ctx context.Context, labelled, run Runner, spec CheckSpec
 	if err := copyCheckout(ctx, run, source, src); err != nil {
 		return "", "", true, fmt.Errorf("the controller that judges (%s) could not be copied: %w", from, err)
 	}
-	if validatorDir != "" {
-		vendored := filepath.Join(src, "vendor", "github.com", "novox", "mesh-host")
-		for _, pkg := range []string{"validate", filepath.Join("internal", "declaration")} {
-			if err := replaceGoFiles(filepath.Join(validatorDir, pkg), filepath.Join(vendored, pkg)); err != nil {
-				return "", "the validator (" + validator + ") could not be put in the judge: " + err.Error(), true, nil
-			}
-		}
-	}
 	if _, err := labelled(ctx, root, "docker", inToolchain(src, nil,
 		"go", "build", "-o", bin, "./cmd/mesh-controller")...); err != nil {
 		return "", "the controller that judges (" + from + ") does not build with " + validator + ": " + firstLine(err.Error()),
diff --git a/internal/builder/check_builds.go b/internal/builder/check_builds.go
index fb10d051..8156b3ad 100644
--- a/internal/builder/check_builds.go
+++ b/internal/builder/check_builds.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The builds a merge check makes for its merge (novox/hq ADR 0350 §1): every artifact of every module the delivery
diff --git a/internal/builder/check_credential_test.go b/internal/builder/check_credential_test.go
index f0c63f1c..fd73cf5f 100644
--- a/internal/builder/check_credential_test.go
+++ b/internal/builder/check_credential_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/facts"
+	"git.novox.be/novox/mesh-sdk/go/facts"
 )
 
 // **A check's container never sees the forge credential** (novox/hq issue 462): the toolchain container
diff --git a/internal/builder/check_pin_test.go b/internal/builder/check_pin_test.go
new file mode 100644
index 00000000..721db0d8
--- /dev/null
+++ b/internal/builder/check_pin_test.go
@@ -0,0 +1,45 @@
+package builder
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Issue 1391, AC5: what a check says names the validator as mesh-sdk's at the controller's pin, with the version from the
+// judge's own go.mod.
+func TestTheValidatorIsNamedAsMeshSDKsAtTheControllersPin(t *testing.T) {
+	dir := t.TempDir()
+	mod := "module example.test/c\n\ngo 1.25\n\nrequire (\n\tgit.novox.be/novox/mesh-sdk/go v0.1.14-0.20261020085642-ab0c16ddad26\n)\n"
+	if err := os.WriteFile(filepath.Join(dir, "go.mod"), []byte(mod), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if got, want := validatorAt(dir), "mesh-sdk's validator at v0.1.14-0.20261020085642-ab0c16ddad26"; got != want {
+		t.Fatalf("the check says %q, not %q", got, want)
+	}
+	if got, want := pinNote(dir), " (v0.1.14-0.20261020085642-ab0c16ddad26)"; got != want {
+		t.Fatalf("the pin note is %q, not %q", got, want)
+	}
+	if got := validatorAt(t.TempDir()); got != "mesh-sdk's validator at the controller's pin" {
+		t.Fatalf("a controller with no go.mod is said as %q", got)
+	}
+
+	// A placeholder or a replaced pin is no version: it is said as a local mesh-sdk.
+	for name, mod := range map[string]string{
+		"placeholder": "module example.test/c\n\nrequire git.novox.be/novox/mesh-sdk/go v0.0.0\n",
+		"replaced": "module example.test/c\n\nrequire git.novox.be/novox/mesh-sdk/go v0.1.14\n\n" +
+			"replace git.novox.be/novox/mesh-sdk/go => ../mesh-sdk/go\n",
+	} {
+		d := t.TempDir()
+		if err := os.WriteFile(filepath.Join(d, "go.mod"), []byte(mod), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		if got := validatorAt(d); !strings.Contains(got, "a local mesh-sdk") || !strings.Contains(got, "replaced") {
+			t.Fatalf("%s: the check says %q, which does not say the mesh-sdk is local", name, got)
+		}
+		if got := pinNote(d); !strings.HasPrefix(got, " (a local mesh-sdk, v") {
+			t.Fatalf("%s: the pin note is %q", name, got)
+		}
+	}
+}
diff --git a/internal/builder/check_test.go b/internal/builder/check_test.go
index b712b25d..63aea2a4 100644
--- a/internal/builder/check_test.go
+++ b/internal/builder/check_test.go
@@ -3,13 +3,12 @@ package builder
 import (
 	"encoding/json"
 	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/facts"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/facts"
 )
 
 // A merge check on the build seat (novox/hq to-be 45 §9), against a real container runtime and a real
@@ -82,26 +81,6 @@ func TestAScriptDeclaresItsToolchain(t *testing.T) {
 	}
 }
 
-// A node-engine change's validator is put in place of the one the judge vendors: its Go files, never its tests.
-func TestTheChangesValidatorReplacesTheVendoredOne(t *testing.T) {
-	from, into := t.TempDir(), t.TempDir()
-	for name, body := range map[string]string{"v.go": "package validate // new", "v_test.go": "package validate"} {
-		if err := os.WriteFile(filepath.Join(from, name), []byte(body), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.WriteFile(filepath.Join(into, "old.go"), []byte("package validate // old"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := replaceGoFiles(from, into); err != nil {
-		t.Fatal(err)
-	}
-	got, _ := filepath.Glob(filepath.Join(into, "*.go"))
-	if len(got) != 1 || filepath.Base(got[0]) != "v.go" {
-		t.Fatalf("the vendored validator holds %v", got)
-	}
-}
-
 // aJudge is a controller that judges as told: `merge-gate` answers a warning, `module check` refuses a
 // manifest that says it is broken. What the gate layer is tested against without building the real one.
 var aJudge = map[string]string{
diff --git a/internal/builder/context_test.go b/internal/builder/context_test.go
index cf7e4e9c..4edf9e31 100644
--- a/internal/builder/context_test.go
+++ b/internal/builder/context_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A context on a seat is cloned from the base the mesh sent, joined to the repository's path; a
diff --git a/internal/builder/judge_build_test.go b/internal/builder/judge_build_test.go
index 63a3c896..b4cb2c64 100644
--- a/internal/builder/judge_build_test.go
+++ b/internal/builder/judge_build_test.go
@@ -62,21 +62,20 @@ func aRepositoryWithARelease(t *testing.T, mainFiles, releaseFiles map[string]st
 	return dir, main, head
 }
 
-// aJudgeOf is a controller that judges as told: its gate passes, saying who it is and the word of the node-engine
+// aJudgeOf is a controller that judges as told: its gate passes, saying who it is and the word of the mesh-sdk
 // validator it vendors — the one it was built with.
 func aJudgeOf(who string) map[string]string {
 	return map[string]string{
-		"go.mod":             "module example.org/judge\n\ngo 1.22\n\nrequire github.com/novox/mesh-host v0.0.0\n",
-		"vendor/modules.txt": "# github.com/novox/mesh-host v0.0.0\n## explicit; go 1.22\ngithub.com/novox/mesh-host/validate\n",
-		"vendor/github.com/novox/mesh-host/validate/v.go":             "package validate\n\nconst Word = \"the vendored validator\"\n",
-		"vendor/github.com/novox/mesh-host/internal/declaration/d.go": "package declaration\n",
+		"go.mod":             "module example.org/judge\n\ngo 1.22\n\nrequire git.novox.be/novox/mesh-sdk/go v0.0.0\n",
+		"vendor/modules.txt": "# git.novox.be/novox/mesh-sdk/go v0.0.0\n## explicit; go 1.22\ngit.novox.be/novox/mesh-sdk/go/validate\n",
+		"vendor/git.novox.be/novox/mesh-sdk/go/validate/v.go": "package validate\n\nconst Word = \"the vendored validator\"\n",
 		"cmd/mesh-controller/main.go": `package main
 
 import (
 	"fmt"
 	"os"
 
-	"github.com/novox/mesh-host/validate"
+	"git.novox.be/novox/mesh-sdk/go/validate"
 )
 
 func main() {
@@ -281,41 +280,6 @@ func TestAHookPlantedInTheWorkspaceDoesNotRunDuringTheJudgesBuild(t *testing.T)
 	}
 }
 
-// The same for the judge built with a node-engine change's own validator.
-func TestAHookPlantedInTheWorkspaceDoesNotRunDuringTheValidatorJudgesBuild(t *testing.T) {
-	aRuntimeThatBuildsTheJudge(t)
-	homes := filepath.Join(t.TempDir(), "homes")
-	t.Setenv("JUDGE_HOMES", homes)
-	registry := aFactsRegistry(t)
-	workspace, ran := aPlantedWorkspace(t)
-	beside, _, _, _ := theReleasedMesh(t)
-	delete(beside, "mesh-host")
-	files := aHostSaying("the release branch's validator")
-	files["module.json"] = `{"module":"mesh-host"}`
-	files[CheckScript] = "git status >/dev/null 2>&1; true\n"
-	host, head := aPullRequestInto(t, files, releaseBranch, aHostSaying("this change's validator"))
-	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-704-planted-validator", Repository: host, Ref: head,
-		Owner: "novox", Repo: "mesh-host", Number: 111, Base: releaseBranch, Judge: "validator",
-		JudgeCache: t.TempDir(), Paths: []string{"validate/v.go"}, Modules: []string{"mesh-host"}, Beside: beside,
-		Toolchain: "golang"}, workspace, registry, GitCredential{}, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if v.Gate == nil || !strings.HasSuffix(v.Gate.Summary, "controller with this change's validator") {
-		t.Fatalf("a node-engine change was not judged by the controller with its own "+
-			"validator: %+v\n%s", v.Gate, v.Report)
-	}
-	if body, _ := os.ReadFile(ran); !strings.Contains(string(body), "/check/mesh-host") {
-		t.Fatalf("the planted hook never ran, so this test proves nothing: %q", body)
-	}
-	if said := judgeRanTheHook(t, ran); said != "" {
-		t.Fatalf("the hook planted in the workspace ran during a judge's build:\n%s", said)
-	}
-	if body, _ := os.ReadFile(homes); strings.Count(string(body), "\n") != 2 || strings.Contains(string(body), workspace) {
-		t.Fatalf("the judges were not both built with a HOME outside the workspace: %q", body)
-	}
-}
-
 // **Judges are built warm and where no pull request reaches** (ADR 0358 §6): every judge build uses the judge cache's
 // one Go cache, kept between checks; its home is made fresh under the judge cache and removed after; nothing is left in
 // a temporary directory of the host; and no container a check runs for the pull request mounts the judge cache.
diff --git a/internal/builder/launchers_test.go b/internal/builder/launchers_test.go
index 8185eff8..0b38f2bc 100644
--- a/internal/builder/launchers_test.go
+++ b/internal/builder/launchers_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq ADR 0193: every entrypoint the runtime may serve is executable, and the runtime knows no
diff --git a/internal/builder/packages.go b/internal/builder/packages.go
index c961d9a9..6f3dc6fa 100644
--- a/internal/builder/packages.go
+++ b/internal/builder/packages.go
@@ -11,7 +11,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Npmrc is what a build needs to resolve the mesh's own shared library — and any other package the
diff --git a/internal/builder/predefined_test.go b/internal/builder/predefined_test.go
index b1315afa..7b9f6bde 100644
--- a/internal/builder/predefined_test.go
+++ b/internal/builder/predefined_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A build reads the list of predefined keys at the root of the repository at the commit it builds (novox/hq ADR
diff --git a/internal/builder/registry_unbound_test.go b/internal/builder/registry_unbound_test.go
index c5c1f963..0fb1c876 100644
--- a/internal/builder/registry_unbound_test.go
+++ b/internal/builder/registry_unbound_test.go
@@ -5,8 +5,8 @@ import (
 	"path/filepath"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/beside"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // **A build that needs the registry fails loudly while the build agent has none** (novox/hq ADR 0336
diff --git a/internal/builder/reuse.go b/internal/builder/reuse.go
index 5ff2446e..8c1b5ba1 100644
--- a/internal/builder/reuse.go
+++ b/internal/builder/reuse.go
@@ -15,8 +15,8 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/artifacts"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // One build per change (novox/hq ADR 0350).
diff --git a/internal/builder/reuse_test.go b/internal/builder/reuse_test.go
index 2f2c5277..75c4701c 100644
--- a/internal/builder/reuse_test.go
+++ b/internal/builder/reuse_test.go
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // One build per change (novox/hq ADR 0350): the merge check builds what the merge would move into the scratch
diff --git a/internal/builder/same_program.go b/internal/builder/same_program.go
index 8b4e5ccf..dfef2001 100644
--- a/internal/builder/same_program.go
+++ b/internal/builder/same_program.go
@@ -14,7 +14,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A module moves only when its program changes (novox/hq issue 721). A merge check builds every module the delivery
diff --git a/internal/builder/same_program_test.go b/internal/builder/same_program_test.go
index 612d1340..861800a9 100644
--- a/internal/builder/same_program_test.go
+++ b/internal/builder/same_program_test.go
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // aFilesystem is a filesystem tarball of files, each written at the time given.
diff --git a/internal/builder/siblings_test.go b/internal/builder/siblings_test.go
index 5fd1fd2c..e175158d 100644
--- a/internal/builder/siblings_test.go
+++ b/internal/builder/siblings_test.go
@@ -56,6 +56,12 @@ func (w aSiblingWorld) beside() map[string]Beside {
 
 // hostCheck is the node-engine's pull request checked, with or without its sibling.
 func (w aSiblingWorld) hostCheck(t *testing.T, id, workspace, cache string, siblings ...Sibling) CheckVerdict {
+	t.Helper()
+	return w.hostCheckAs(t, "", id, workspace, cache, siblings...)
+}
+
+// hostCheckAs is hostCheck for a request that names who judges: an older request says "validator" for a node-engine change.
+func (w aSiblingWorld) hostCheckAs(t *testing.T, judge, id, workspace, cache string, siblings ...Sibling) CheckVerdict {
 	t.Helper()
 	if workspace == "" {
 		workspace = t.TempDir()
@@ -63,7 +69,7 @@ func (w aSiblingWorld) hostCheck(t *testing.T, id, workspace, cache string, sibl
 	beside := w.beside()
 	delete(beside, "mesh-host")
 	v, err := Check(t.Context(), Command, CheckSpec{ID: id, Repository: w.host, Ref: w.hostHead, Owner: "novox",
-		Repo: "mesh-host", Number: 114, Base: "main", Judge: "validator", JudgeCache: cache,
+		Repo: "mesh-host", Number: 114, Base: "main", Judge: judge, JudgeCache: cache,
 		Paths: []string{"validate/v.go"}, Modules: []string{"mesh-host"}, Beside: beside, Siblings: siblings,
 		Toolchain: "golang"}, workspace, aFactsRegistry(t), GitCredential{}, nil)
 	if err != nil {
@@ -97,7 +103,7 @@ func (w aSiblingWorld) hostSibling() Sibling {
 
 // The node-engine's change fails its own check without its sibling (the controller's lock beside it is the trunk's),
 // and passes with it read at its merge: the check reads the lock the sibling's change brings, the judge is the
-// controller built from the sibling's merge with the node-engine change's own validator, and the verdict names both.
+// controller built from the sibling's merge with the validator that controller vendors (mesh-sdk's), and the verdict names both.
 func TestAHostMemberIsCheckedBesideItsControllerSibling(t *testing.T) {
 	aRuntimeThatBuildsTheJudge(t)
 	w := theSiblingWorld(t)
@@ -112,8 +118,8 @@ func TestAHostMemberIsCheckedBesideItsControllerSibling(t *testing.T) {
 	if v.Repo == nil || v.Repo.Verdict != "pass" {
 		t.Fatalf("beside its sibling the node-engine change should pass its own check: %+v\n%s", v.Repo, v.Report)
 	}
-	if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Gate.Summary, "the sibling controller with the sibling's validator") {
-		t.Fatalf("the judge was not the controller built from the sibling's merge with the change's own validator: %+v\n%s",
+	if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Gate.Summary, "the sibling controller with the vendored validator") {
+		t.Fatalf("the judge was not the controller built from the sibling's merge with the validator it vendors: %+v\n%s",
 			v.Gate, v.Report)
 	}
 	baseCommit := w.controllerMain
@@ -127,8 +133,9 @@ func TestAHostMemberIsCheckedBesideItsControllerSibling(t *testing.T) {
 	if want := "sibling novox/mesh-controller#346 merge " + v.Beside["mesh-controller"]; v.JudgeFrom != want {
 		t.Fatalf("the judge came from %q, not %q", v.JudgeFrom, want)
 	}
-	if v.Validator != "the change's own validator" {
-		t.Fatalf("the validator was %q", v.Validator)
+	if want := "mesh-sdk's validator at the pin of sibling novox/mesh-controller#346 merge " + v.Beside["mesh-controller"] +
+		" (a local mesh-sdk, v0.0.0, replaced)"; v.Validator != want {
+		t.Fatalf("the validator was %q, not %q", v.Validator, want)
 	}
 	// The statuses' "beside siblings" part is the forge module's to write, from the verdict's siblings.
 	if strings.Contains(v.Gate.Summary, "beside siblings") || strings.Contains(v.Repo.Summary, "beside siblings") {
@@ -140,43 +147,45 @@ func TestAHostMemberIsCheckedBesideItsControllerSibling(t *testing.T) {
 	}
 }
 
-// The controller's change fails with no sibling (it builds only with the node-engine change's validator), and passes with
-// it: judged by itself, with the sibling node-engine's validator in place of the one it vendors.
-func TestAControllerMemberIsJudgedByItselfWithItsHostSiblingsValidator(t *testing.T) {
+// The controller's change is judged by itself with the validator it vendors, whatever the node-engine sibling brings: the
+// node-engine holds no validator any more (issue 1391, novox/hq ADR 0446 clause 5). Nothing of the sibling is put into the judge.
+func TestAControllerMemberIsJudgedByItselfWithTheValidatorItVendors(t *testing.T) {
 	aRuntimeThatBuildsTheJudge(t)
 	w := theSiblingWorld(t)
-	// The controller change calls a function only the node-engine change brings.
-	gitInRepo(t, w.controller, "checkout", "--quiet", "change")
-	main := aJudgeOf("the sibling controller")["cmd/mesh-controller/main.go"]
-	w.controllerHead = commitFiles(t, w.controller, map[string]string{
-		"cmd/mesh-controller/main.go": strings.Replace(main, "validate.Word)", "validate.Word+validate.More)", 1)})
-	gitInRepo(t, w.controller, "checkout", "--quiet", "main")
-	gitInRepo(t, w.host, "checkout", "--quiet", "change")
-	w.hostHead = commitFiles(t, w.host, map[string]string{
-		"validate/more.go": "package validate\n\nconst More = \" and more\"\n"})
-	gitInRepo(t, w.host, "checkout", "--quiet", "main")
 
 	alone := w.controllerCheck(t, "check-867-controller-alone", "")
-	if alone.Gate == nil || alone.Gate.Verdict != "fail" || !strings.Contains(alone.Gate.Summary, "does not build") {
-		t.Fatalf("with no sibling the controller change should not build (the validator it vendors lacks More): %+v", alone.Gate)
-	}
-
 	v := w.controllerCheck(t, "check-867-controller", "", w.hostSibling())
-	if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Gate.Summary, "the sibling controller with the sibling's validator and more") {
-		t.Fatalf("the controller change was not judged by itself with the sibling's validator: %+v\n%s", v.Gate, v.Report)
+	for what, got := range map[string]CheckVerdict{"alone": alone, "beside its sibling": v} {
+		if got.Gate == nil || got.Gate.Verdict != "pass" || !strings.Contains(got.Gate.Summary, "the sibling controller with the vendored validator") {
+			t.Fatalf("the controller change %s was not judged by itself with the validator it vendors: %+v\n%s", what, got.Gate, got.Report)
+		}
 	}
 	if len(v.Siblings) != 1 || v.Siblings[0].Repository != "novox/mesh-host" || v.Siblings[0].BaseCommit != w.hostMain {
 		t.Fatalf("the verdict names siblings %+v", v.Siblings)
 	}
-	if want := "sibling novox/mesh-host#114 merge " + v.Beside["mesh-host"] + "'s validator"; v.Validator != want {
-		t.Fatalf("the validator was %q, not %q", v.Validator, want)
+	if v.Validator != "" {
+		t.Fatalf("the validator was %q: a controller judged by itself has the one it vendors", v.Validator)
 	}
-	if !strings.HasPrefix(v.JudgeFrom, "this change's own merge ") {
-		t.Fatalf("the judge came from %q", v.JudgeFrom)
+}
+
+// A node-engine member whose tree holds no validator (validate/ and internal/declaration/ deleted, as R4b deletes them) is judged
+// beside its controller sibling all the same: nothing of it is copied into the judge, so nothing is missing (issue 1391).
+func TestAHostMemberWithNoValidatorOfItsOwnDoesNotFailTheJudge(t *testing.T) {
+	aRuntimeThatBuildsTheJudge(t)
+	w := theSiblingWorld(t)
+	gitInRepo(t, w.host, "checkout", "--quiet", "change")
+	gitInRepo(t, w.host, "rm", "--quiet", "-r", "validate", "internal")
+	gitInRepo(t, w.host, "commit", "--quiet", "-m", "the validator is mesh-sdk's")
+	w.hostHead = gitInRepo(t, w.host, "rev-parse", "HEAD")
+	gitInRepo(t, w.host, "checkout", "--quiet", "main")
+
+	v := w.hostCheckAs(t, "validator", "check-1391-host-without-validator", "", "", w.controllerSibling())
+	if v.Gate == nil || v.Gate.Verdict != "pass" || !strings.Contains(v.Gate.Summary, "the sibling controller with the vendored validator") {
+		t.Fatalf("a node-engine change with no validator of its own was not judged: %+v\n%s", v.Gate, v.Report)
 	}
-	// The member's own tree keeps the validator it vendors: its own script reads the vendored files as they are.
-	if body := gitInRepo(t, w.controller, "show", "main:vendor/github.com/novox/mesh-host/validate/v.go"); strings.Contains(body, "sibling") {
-		t.Fatalf("the trunk's vendored validator was touched: %s", body)
+	alone := w.hostCheckAs(t, "validator", "check-1391-host-alone", "", "")
+	if alone.Gate == nil || strings.Contains(alone.Gate.Summary, "could not be put in the judge") {
+		t.Fatalf("the judge tried to copy the validator of a change that holds none: %+v", alone.Gate)
 	}
 }
 
@@ -208,7 +217,7 @@ func TestACheckThatCouldNotLearnItsSiblingsSaysSo(t *testing.T) {
 	beside := w.beside()
 	delete(beside, "mesh-host")
 	v, err := Check(t.Context(), Command, CheckSpec{ID: "check-867-unknown", Repository: w.host, Ref: w.hostHead,
-		Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Judge: "validator", Paths: []string{"validate/v.go"},
+		Owner: "novox", Repo: "mesh-host", Number: 114, Base: "main", Paths: []string{"validate/v.go"},
 		Modules: []string{"mesh-host"}, Beside: beside, SiblingsUnknown: "mesh-delivery did not answer",
 		Toolchain: "golang"}, t.TempDir(), aFactsRegistry(t), GitCredential{}, nil)
 	if err != nil {
@@ -217,7 +226,7 @@ func TestACheckThatCouldNotLearnItsSiblingsSaysSo(t *testing.T) {
 	if v.SiblingsUnknown != "mesh-delivery did not answer" || len(v.Siblings) != 0 || v.JudgeFrom != "" {
 		t.Fatalf("the verdict says %q, siblings %+v, judge from %q", v.SiblingsUnknown, v.Siblings, v.JudgeFrom)
 	}
-	if !strings.Contains(v.Gate.Summary, "the trunk's controller with the sibling's validator") {
+	if !strings.Contains(v.Gate.Summary, "the trunk's controller with the vendored validator") {
 		t.Fatalf("a check without siblings was not judged as before: %+v", v.Gate)
 	}
 	if strings.Contains(v.Gate.Summary, "[beside siblings") {
@@ -226,7 +235,7 @@ func TestACheckThatCouldNotLearnItsSiblingsSaysSo(t *testing.T) {
 }
 
 // The judge a group made is kept only for the same inputs: the controller's merge and the base commits it was merged
-// onto, the validator's source and commit. The same inputs take the judge kept; any other builds it again.
+// onto. The same inputs take the judge kept; any other builds it again.
 func TestTheGroupsJudgeIsReusedOnlyForTheSameInputs(t *testing.T) {
 	built := aRuntimeThatBuildsTheJudge(t)
 	w := theSiblingWorld(t)
@@ -253,14 +262,6 @@ func TestTheGroupsJudgeIsReusedOnlyForTheSameInputs(t *testing.T) {
 	if n := builds(t, built); n != 3 {
 		t.Fatalf("a moved base did not build the judge again: %d builds", n)
 	}
-	// The validator's source moves: the member's own change differs.
-	gitInRepo(t, w.host, "checkout", "--quiet", "change")
-	w.hostHead = commitFiles(t, w.host, aHostSaying("another validator"))
-	gitInRepo(t, w.host, "checkout", "--quiet", "main")
-	w.hostCheck(t, "check-867-cache-5", "", cache, w.controllerSibling())
-	if n := builds(t, built); n != 4 {
-		t.Fatalf("a moved validator did not build the judge again: %d builds", n)
-	}
 }
 
 // The contrast the isolation test stands on: built the old way, in the workspace with its HOME and no judge-build
diff --git a/internal/builder/source.go b/internal/builder/source.go
index 7ea82049..52cdb4a2 100644
--- a/internal/builder/source.go
+++ b/internal/builder/source.go
@@ -10,8 +10,8 @@ import (
 	"sort"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // A build's source fingerprint: what it was made from, hashed (novox/hq issue 280).
diff --git a/internal/builder/standing_on_test.go b/internal/builder/standing_on_test.go
index 3e1def4f..dc153f62 100644
--- a/internal/builder/standing_on_test.go
+++ b/internal/builder/standing_on_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A module naming a base the mesh has not built is refused, and the refusal names what is missing.
diff --git a/internal/builder/template.go b/internal/builder/template.go
index 544b78ac..a6d258d5 100644
--- a/internal/builder/template.go
+++ b/internal/builder/template.go
@@ -11,7 +11,7 @@ import (
 	"io"
 	"path/filepath"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // withTemplateTexts is what was built with each template's text, for a module whose files name templates (novox/hq ADR
diff --git a/internal/builder/template_integration_test.go b/internal/builder/template_integration_test.go
index a8880e35..3f0d3b27 100644
--- a/internal/builder/template_integration_test.go
+++ b/internal/builder/template_integration_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestABuildReadsEachTemplateBackFromItsArchive(t *testing.T) {
diff --git a/internal/builder/template_test.go b/internal/builder/template_test.go
index 2bbf8979..eec5588e 100644
--- a/internal/builder/template_test.go
+++ b/internal/builder/template_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A module's files kept as template files in its repository (novox/hq ADR 0349 §2, design 57 package T1, issue
diff --git a/internal/builder/upstream_file.go b/internal/builder/upstream_file.go
index 5b3a0ebf..6df2cf17 100644
--- a/internal/builder/upstream_file.go
+++ b/internal/builder/upstream_file.go
@@ -19,7 +19,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/therootcompany/xz"
 )
 
diff --git a/internal/builder/upstream_file_integration_test.go b/internal/builder/upstream_file_integration_test.go
index 31a1dfad..41da8959 100644
--- a/internal/builder/upstream_file_integration_test.go
+++ b/internal/builder/upstream_file_integration_test.go
@@ -13,7 +13,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAnArchivePinnedByURLIsFetchedCheckedAndPackedWithoutItsOwnDirectory(t *testing.T) {
diff --git a/internal/builder/upstream_file_test.go b/internal/builder/upstream_file_test.go
index 4cb07a49..f83c2dca 100644
--- a/internal/builder/upstream_file_test.go
+++ b/internal/builder/upstream_file_test.go
@@ -20,7 +20,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // An archive pinned by URL and sha256 (novox/hq ADR 0316 §2, §6; How it is checked: "an upstream artifact
diff --git a/internal/catalogue/a_service_process_test.go b/internal/catalogue/a_service_process_test.go
deleted file mode 100644
index 1e252767..00000000
--- a/internal/catalogue/a_service_process_test.go
+++ /dev/null
@@ -1,166 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// novox/hq issue 213 (ADR 0188 §1, §3): a module's own Go service is a bundle the host runs as a
-// process, not an image. Each test holds one thing that had to change in the composer for the
-// controller to be declared that way.
-
-const aServiceDigest = "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-
-// aServiceModule is the controller's shape in miniature: it answers tools of its own, its code is a
-// Go bundle a process runs as an account it declares, its secrets belong to that account, it
-// prepares its state, and its process replaces the container it used to run as.
-func aServiceModule(t *testing.T) Manifest {
-	t.Helper()
-	raw := `{
-	  "module": "svc", "version": "1", "tools": ["status"], "prepares": true,
-	  "own-secrets": {"store": "${dir:state}/store"},
-	  "secrets-owner": "svc",
-	  "resources": [
-	    {"id": "state", "type": "directory", "mode": "0700", "place": "mesh", "owner": "svc"},
-	    {"id": "service", "type": "process", "name": "svc", "artifact": "code",
-	     "run": ["./svc", "serve"], "user": "svc", "replaces": ["server"],
-	     "env": {"SVC_STORE_FILE": "${dir:state}/store", "SVC_STORE_PORT": "${seat:mesh-store:5432}"}},
-	    {"id": "account", "type": "user", "name": "svc", "shell": "/usr/bin/nologin", "home": "/var/lib/svc"}
-	  ],
-	  "build": {"artifacts": [{"name": "code", "kind": "bundle", "language": "go", "system": "arch",
-	    "from": "cmd/svc", "binary": "svc"}]}
-	}`
-	m, err := ParseManifest([]byte(raw))
-	if err != nil {
-		t.Fatalf("the service's manifest is refused: %v", err)
-	}
-	resolved, err := m.Resolve([]Built{{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "svc/code@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-func composeTheService(t *testing.T, with Rendering) []map[string]any {
-	t.Helper()
-	with.Needed = map[string]map[string]string{"svc": {"store": "sealed-store"}}
-	with.ArtifactStore = "anchor.internal:5100"
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{aServiceModule(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatalf("the service does not compose: %v", err)
-	}
-	return out
-}
-
-func indexOf(out []map[string]any, id string) int {
-	for i, r := range out {
-		if r["id"] == id {
-			return i
-		}
-	}
-	return -1
-}
-
-// A module that declares tools has every bundle served by the node's runtime unless it says
-// otherwise — and the controller declares the verbs it answers as tools. Its service bundle is run
-// by its own process; launched a second time by the runtime it would be a second controller
-// pretending to be an MCP server.
-func TestABundleItsOwnProcessRunsIsNotServedByTheRuntime(t *testing.T) {
-	m := aServiceModule(t)
-	if len(m.Bundles) != 1 {
-		t.Fatalf("the service's bundle was not kept: %+v", m.Bundles)
-	}
-	if loads := m.Bundles[0].Loads; len(loads) != 0 {
-		t.Fatalf("the runtime would launch the service's own bundle as tools: %v", loads)
-	}
-	// And a bundle no resource runs still is served, as a module declaring tools always had it.
-	tools := Manifest{Module: "t", Version: "1", Tools: []string{"x"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/t"}}}}
-	resolved, err := tools.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "t/tools@" + aServiceDigest, Digest: aServiceDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if loads := resolved.Bundles[0].Loads; len(loads) != 1 || loads[0] != "t" {
-		t.Fatalf("a tools bundle nothing runs is no longer served: %v", loads)
-	}
-}
-
-// The account is created before anything is given to it. Its secrets are mesh-computed and so
-// placed before the module's own resources; given to a user the machine did not have yet, they were
-// refused on the first apply and the process started without them.
-func TestAModulesAccountComesBeforeWhatBelongsToIt(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	account, secret := indexOf(out, "svc.account"), indexOf(out, "svc."+NeedID("store"))
-	if account < 0 || secret < 0 {
-		t.Fatalf("the account or the secret is missing: %v", out)
-	}
-	if account > secret {
-		t.Fatalf("the secret owned by svc is written before svc exists: account at %d, secret at %d",
-			account, secret)
-	}
-	if owner := out[secret]["owner"]; owner != "svc" {
-		t.Errorf("the secret belongs to %v, not the account its process runs as", owner)
-	}
-}
-
-// The process is the module's program; its preparation is the same program asked to prepare, as a
-// step before it — with the same account and environment, and handing nothing over.
-func TestAProcessIsPreparedByItsOwnProgram(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	step, process := indexOf(out, "svc.service-prepare"), indexOf(out, "svc.service")
-	if step < 0 || process < 0 || step > process {
-		t.Fatalf("the preparation is not a step before the process (%d, %d): %v", step, process, out)
-	}
-	s := out[step]
-	if s["type"] != "process" || s["run-once"] != true || s["name"] != "svc-prepare" {
-		t.Errorf("the preparation is not a run-once process: %v", s)
-	}
-	if run, _ := json.Marshal(s["run"]); string(run) != `["./svc","prepare"]` {
-		t.Errorf("the preparation runs %s", run)
-	}
-	if s["user"] != "svc" || s["source"] != out[process]["source"] {
-		t.Errorf("the preparation does not run the same bundle as the same account: %v", s)
-	}
-	if env, _ := s["env"].(map[string]any); env["SVC_STORE_FILE"] == nil {
-		t.Errorf("the preparation is not given the process's environment: %v", s["env"])
-	}
-	if _, has := s["replaces"]; has {
-		t.Errorf("the preparation would hand over what the process replaces: %v", s)
-	}
-	if _, has := s["args"]; has {
-		t.Errorf("the preparation carries a container's args: %v", s)
-	}
-}
-
-// What the process replaces is named as the host recorded it, `<module>.<id>`; unprefixed, the host
-// matches nothing and removes the container first, as before.
-func TestWhatAProcessReplacesIsNamedAsTheHostRecordedIt(t *testing.T) {
-	out := composeTheService(t, Rendering{})
-	p := out[indexOf(out, "svc.service")]
-	if got, _ := json.Marshal(p["replaces"]); string(got) != `["svc.server"]` {
-		t.Fatalf("the process replaces %s", got)
-	}
-}
-
-func TestWhatReplacesMayNameIsRefusedNearItsAuthor(t *testing.T) {
-	for what, resource := range map[string]string{
-		"a container":        `{"id":"c","type":"container","name":"c","image":"x@` + aServiceDigest + `","replaces":["old"]}`,
-		"a step":             `{"id":"p","type":"process","name":"p","run":["./p"],"run-once":true,"replaces":["old"]}`,
-		"something declared": `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["p"]}`,
-		"another module's":   `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["other.old"]}`,
-		"not a list":         `{"id":"p","type":"process","name":"p","run":["./p"],"replaces":"old"}`,
-	} {
-		raw := `{"module":"m","version":"1","resources":[` + resource + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "replace") {
-			t.Errorf("replaces on %s was accepted: %v", what, err)
-		}
-	}
-	ok := `{"module":"m","version":"1","resources":[{"id":"p","type":"process","name":"p","run":["./p"],"replaces":["old"]}]}`
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Errorf("a process replacing what its module no longer declares was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/accesses_test.go b/internal/catalogue/accesses_test.go
deleted file mode 100644
index b95250af..00000000
--- a/internal/catalogue/accesses_test.go
+++ /dev/null
@@ -1,108 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The fault 04-ISSUES/036 records: a media stack is several modules — a library server, the
-// acquisition managers, a download client — that must share directories on one machine. Written
-// as owned `directory` resources, two of them on one node are refused as rivalrous owners, which
-// is right in general and wrong here: sharing those directories is the whole point of the stack.
-//
-// Declared as accesses to an operator-owned path (novox/hq ADR 0051), they co-resolve. An access
-// is not a resource and never enters the duplicate-owner map, so this is the exact case the
-// resolver refuses above when the same path is owned — and does not, when it is merely accessed.
-func TestTwoModulesAccessingOnePathCoResolve(t *testing.T) {
-	a := mod("a", nil, nil, nil)
-	a.Accesses = []Access{{Path: "/services/media/downloads", Mode: AccessReadWrite}}
-	b := mod("b", nil, nil, nil)
-	b.Accesses = []Access{{Path: "/services/media/downloads", Mode: AccessRead}}
-
-	got, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), World{})
-	if err != nil {
-		t.Fatalf("two modules accessing one operator-owned path were refused: %v", err)
-	}
-
-	// And each accessing module's grant reaches the machine as its own `access` resource, so the
-	// host can find the path present or refuse — both naming the one operator-owned path.
-	var accesses int
-	for _, r := range mustDeclare(t, got) {
-		if r["type"] == "access" && r["path"] == "/services/media/downloads" {
-			accesses++
-		}
-	}
-	if accesses != 2 {
-		t.Errorf("expected both modules' accesses in the declaration, got %d", accesses)
-	}
-}
-
-// The mirror of the case above, so the sharing vocabulary does not weaken the rule it sits beside:
-// two modules OWNING one path is still refused, exactly as before accesses existed.
-func TestTwoModulesOwningOnePathAreStillRefused(t *testing.T) {
-	a := mod("a", nil, nil, nil)
-	a.Resources = []map[string]any{
-		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
-	b := mod("b", nil, nil, nil)
-	b.Resources = []map[string]any{
-		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
-
-	_, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("two modules owning the same directory were both assigned")
-	}
-	if !strings.Contains(err.Error(), "/services/media/movies") {
-		t.Errorf("the refusal does not name the path: %v", err)
-	}
-}
-
-// Shared data is the operator's, owned by no module (novox/hq ADR 0051). A module owning the path
-// another module was told to expect the operator to provide would create and chown it — and the
-// two intentions cannot both hold, so it is refused by name. This is what keeps the distinction
-// machine-checkable rather than a convention nobody enforces.
-func TestAModuleMayNotOwnWhatAnotherAccesses(t *testing.T) {
-	owns := mod("owns", nil, nil, nil)
-	owns.Resources = []map[string]any{
-		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
-	uses := mod("uses", nil, nil, nil)
-	uses.Accesses = []Access{{Path: "/services/media/movies", Mode: AccessRead}}
-
-	_, err := Resolve(shelf(owns, uses), []string{"owns", "uses"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("a module owning a path another accesses was allowed")
-	}
-	if !strings.Contains(err.Error(), "/services/media/movies") ||
-		!strings.Contains(err.Error(), "the operator's") {
-		t.Errorf("the refusal does not explain the ownership conflict: %v", err)
-	}
-}
-
-// A manifest states an access's extent, the way a listening port states its source. An absolute
-// path and a mode of read or read-write; anything else is refused rather than acted on wrongly.
-func TestAnAccessIsValidated(t *testing.T) {
-	good := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"read-write"}]}`)
-	if _, err := ParseManifest(good); err != nil {
-		t.Fatalf("a valid access was refused: %v", err)
-	}
-
-	// Mode is optional and narrows to read — the safe default, because the danger with an access
-	// is being given more than was meant, not less.
-	bare := []byte(`{"module":"m","accesses":[{"path":"/services/media"}]}`)
-	m, err := ParseManifest(bare)
-	if err != nil {
-		t.Fatalf("an access with no mode was refused: %v", err)
-	}
-	if m.Accesses[0].At() != AccessRead {
-		t.Errorf("an access with no mode is %q, want %q", m.Accesses[0].At(), AccessRead)
-	}
-
-	relative := []byte(`{"module":"m","accesses":[{"path":"services/media","mode":"read"}]}`)
-	if _, err := ParseManifest(relative); err == nil {
-		t.Error("a relative access path was accepted")
-	}
-
-	wrong := []byte(`{"module":"m","accesses":[{"path":"/services/media","mode":"append"}]}`)
-	if _, err := ParseManifest(wrong); err == nil {
-		t.Error("an access with an unknown mode was accepted")
-	}
-}
diff --git a/internal/catalogue/adoption_test.go b/internal/catalogue/adoption_test.go
deleted file mode 100644
index 8630fa4e..00000000
--- a/internal/catalogue/adoption_test.go
+++ /dev/null
@@ -1,683 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"slices"
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0100: on an adopted node the found firewall stays in force. The mesh declares
-// openings where it would have loaded a filter, and guards its own ports in a table that only
-// refuses.
-
-// hub is the private network's generator on the hub: it opens the hub's port from anywhere.
-type hub struct{}
-
-func (hub) Resources(string) ([]map[string]any, bool, error) {
-	return []map[string]any{{"id": "config", "type": "file", "path": "/etc/wireguard/mesh0.conf",
-		"content": "[Interface]\n"}}, true, nil
-}
-func (hub) Listens(string) ([]Listening, error) {
-	return []Listening{{Port: 51820, Protocol: "udp", From: FromEverywhere}}, nil
-}
-
-// anAdoptedAnchor is the control-node's set: the store, the bus, the registry, the private network,
-// a served module and the filter module.
-func anAdoptedAnchor() Resolution {
-	return Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "network", Computed: "overlay"},
-		{Module: "postgres", Guards: []int{5432},
-			Listens: []Listening{{Port: 5432, From: FromMesh}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
-				"ports": []any{"5432:5432"}}}},
-		{Module: "lavinmq", Guards: []int{15672},
-			Listens: []Listening{{Port: 5671, From: FromMesh}, {Port: 5672, From: FromMesh}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
-				"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}}}},
-		{Module: "distribution",
-			Listens: []Listening{{Port: 5000, From: FromMesh}},
-			Resources: []map[string]any{{"id": "store", "type": "container", "name": "registry",
-				"ports": []any{"5000"}}}},
-		{Module: "hello-web",
-			Listens: []Listening{{Port: 8080, From: FromEverywhere}},
-			Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
-				"ports": []any{"8080"}}}},
-		{Module: "helper", Listens: []Listening{{Port: 9000, From: FromMachine}}},
-		{Module: "nftables", Filtering: &Filtering{Into: "/etc/nftables.conf"},
-			Resources: []map[string]any{{"id": "load", "type": "service", "unit": "mesh-filter.service",
-				"state": "running", "restart-on": []any{"filtering"}}}},
-	}}
-}
-
-func anchorRendering(adopted bool) Rendering {
-	return Rendering{
-		Generators: map[string]Generator{"overlay": hub{}},
-		Ports:      map[string]map[int]int{"distribution": {5000: 5000}, "hello-web": {8080: 20001}},
-		Settings: SettingsBy{"distribution": {{From: "node anchor",
-			Placement: map[string]any{ExposeSetting: map[string]any{"5000": FromEverywhere}}}}},
-		Mesh:       []string{"10.42.0.1"},
-		Foundation: []int{5671},
-		// What the machine reported faces outside, which every rule in the filter is written
-		// around (novox/hq ADR 0140).
-		OutwardLinks:    []string{"eth0"},
-		TunnelInterface: "mesh0",
-		Adopted:         adopted,
-		// Genesis takes the foundation's modules.
-		Taken: map[string]bool{"postgres": true, "lavinmq": true},
-	}
-}
-
-func byID(resources []map[string]any) map[string]map[string]any {
-	out := map[string]map[string]any{}
-	for _, r := range resources {
-		out[r["id"].(string)] = r
-	}
-	return out
-}
-
-func TestAnAdoptedNodeIsDeclaredOpeningsFromTheSameInputsAsTheFilter(t *testing.T) {
-	composed, err := anAdoptedAnchor().Compose(anchorRendering(true))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := byID(composed.Resources)
-	want := map[string]map[string]any{
-		// The hub's port, from anywhere, received.
-		"adoption.opening-udp-51820-incoming": {"port": 51820, "protocol": "udp",
-			"from": "everywhere", "path": "incoming"},
-		// The store's port from the private network only, and forwarded: a container publishes it.
-		"adoption.opening-tcp-5432-forwarded": {"port": 5432, "protocol": "tcp", "from": "mesh",
-			"path": "forwarded", "to": 5432},
-		// The bus from anywhere: a node enrols over it before it has a private address.
-		"adoption.opening-tcp-5671-forwarded": {"port": 5671, "protocol": "tcp",
-			"from": "everywhere", "path": "forwarded", "to": 5671},
-		"adoption.opening-tcp-5672-forwarded": {"port": 5672, "protocol": "tcp", "from": "mesh",
-			"path": "forwarded", "to": 5672},
-		// The registry from anywhere, by its node's exposure setting.
-		"adoption.opening-tcp-5000-forwarded": {"port": 5000, "protocol": "tcp",
-			"from": "everywhere", "path": "forwarded", "to": 5000},
-		// A published port names the machine port and the container port it is forwarded to.
-		"adoption.opening-tcp-20001-forwarded": {"port": 20001, "protocol": "tcp",
-			"from": "everywhere", "path": "forwarded", "to": 8080},
-	}
-	for id, fields := range want {
-		opening, ok := got[id]
-		if !ok {
-			t.Errorf("no %s among %v", id, keys(got))
-			continue
-		}
-		if opening["type"] != "opening" {
-			t.Errorf("%s is a %v", id, opening["type"])
-		}
-		for k, v := range fields {
-			if opening[k] != v {
-				t.Errorf("%s: %s is %v, want %v", id, k, opening[k], v)
-			}
-		}
-	}
-	for id := range got {
-		if strings.HasPrefix(id, "adoption.opening-") && want[id] == nil {
-			t.Errorf("an opening nothing asked for: %s", id)
-		}
-	}
-	// A port for this machine only opens nothing, and the management port is not opened at all.
-	for id := range got {
-		if strings.Contains(id, "-9000-") || strings.Contains(id, "-15672-") {
-			t.Errorf("%s is opened", id)
-		}
-	}
-
-	// And openings come first, in the order the machine applies them.
-	if !strings.HasPrefix(composed.Resources[0]["id"].(string), "adoption.opening-") {
-		t.Errorf("openings are not first: %v", composed.Resources[0]["id"])
-	}
-}
-
-func TestAnAdoptedNodeLoadsNoFilterOfTheMeshs(t *testing.T) {
-	composed, err := anAdoptedAnchor().Compose(anchorRendering(true))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range composed.Resources {
-		if r["path"] == "/etc/nftables.conf" || strings.HasPrefix(r["id"].(string), "nftables.") {
-			t.Fatalf("an adopted node is declared the filter module's %v", r["id"])
-		}
-		if content, _ := r["content"].(string); strings.Contains(content, "policy drop") {
-			t.Fatalf("an adopted node is declared a table that drops by default: %v", r["id"])
-		}
-		// Nothing but refusals: the only accept in the guard is its policy.
-		if content, _ := r["content"].(string); r["id"] == GuardID() &&
-			strings.Count(content, "accept") != 1 {
-			t.Fatalf("the guard holds an accept:\n%s", content)
-		}
-	}
-	got := byID(composed.Resources)
-	guard := got[GuardID()]
-	if guard == nil || got[GuardUnitID()] == nil || got[GuardRunningID()] == nil {
-		t.Fatalf("no guard: %v", keys(got))
-	}
-	if guard["content"] != AsGuard([]int{5432, 5672, 15672}) {
-		t.Fatalf("the guard does not guard the store, the broker and its management port:\n%s",
-			guard["content"])
-	}
-	// The tool that loads it comes first, and the table after it: a node joining adopted has no
-	// filter module and may have no nft.
-	pkg, table := -1, -1
-	for i, r := range composed.Resources {
-		switch r["id"] {
-		case GuardPackageID():
-			pkg = i
-			if r["type"] != "package" || r["package"] != "nftables" {
-				t.Fatalf("the guard's package is %v", r)
-			}
-		case GuardID():
-			table = i
-		}
-	}
-	if pkg < 0 || pkg > table {
-		t.Fatalf("nftables is not declared before the guard's table (%d, %d)", pkg, table)
-	}
-	// A changed table is reloaded — one `nft -f`, atomic — never restarted, which would delete the
-	// table and leave the ports unguarded until it is loaded again. Only a changed unit restarts.
-	if !reflect.DeepEqual(got[GuardRunningID()]["reload-on"], []any{GuardID()}) ||
-		!reflect.DeepEqual(got[GuardRunningID()]["restart-on"], []any{GuardUnitID()}) {
-		t.Fatalf("the guard is not reloaded on its table and restarted on its unit: %v",
-			got[GuardRunningID()])
-	}
-	// Nothing of the mesh's own is anybody's to hold.
-	for id, module := range composed.Owner {
-		if strings.HasPrefix(id, AdoptionPrefix) {
-			t.Fatalf("%s is owned by %s", id, module)
-		}
-	}
-}
-
-func TestAConvergedNodeIsDeclaredItsFilterAndNoOpenings(t *testing.T) {
-	composed, err := anAdoptedAnchor().Compose(anchorRendering(false))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := byID(composed.Resources)
-	if got["nftables.filtering"] == nil || got["nftables.load"] == nil {
-		t.Fatalf("a converged node lost its filter: %v", keys(got))
-	}
-	for id := range got {
-		if strings.HasPrefix(id, AdoptionPrefix) {
-			t.Fatalf("a converged node is declared %s", id)
-		}
-	}
-	plain, err := anAdoptedAnchor().Declaration(anchorRendering(false))
-	if err != nil {
-		t.Fatal(err)
-	}
-	a, _ := json.Marshal(plain)
-	b, _ := json.Marshal(composed.Resources)
-	if string(a) != string(b) {
-		t.Fatal("Compose and Declaration disagree on a converged node")
-	}
-}
-
-// The table the installer raises and the controller declares, character for character.
-func TestTheGuardIsExactlyThisTable(t *testing.T) {
-	const golden = `table inet mesh_guard {}
-delete table inet mesh_guard
-table inet mesh_guard {
-	chain prerouting {
-		type filter hook prerouting priority raw; policy accept;
-		fib daddr type local iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
-	}
-}
-`
-	if got := AsGuard([]int{15672, 5432}); got != golden {
-		t.Fatalf("the guard changed:\n%s", got)
-	}
-	const unit = `[Unit]
-Description=The mesh's guard: refuses its own ports from outside (novox/hq ADR 0100)
-DefaultDependencies=no
-Wants=network-pre.target
-Before=network-pre.target shutdown.target
-Conflicts=shutdown.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=nft -f /etc/mesh/guard.nft
-ExecReload=nft -f /etc/mesh/guard.nft
-ExecStop=nft delete table inet mesh_guard
-
-[Install]
-WantedBy=multi-user.target
-`
-	if got := GuardUnitText(); got != unit {
-		t.Fatalf("the guard's unit changed:\n%s", got)
-	}
-	if GuardResources(nil) != nil {
-		t.Fatal("a guard with nothing to guard is an empty set nft refuses to load")
-	}
-}
-
-func TestAGuardedPortMustBeAPort(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[5432]}`)); err != nil {
-		t.Fatalf("guards is refused: %v", err)
-	}
-	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[0]}`)); err == nil {
-		t.Fatal("guarding port 0 was accepted")
-	}
-}
-
-func keys[V any](m map[string]V) []string {
-	return sortedKeys(m)
-}
-
-// novox/hq ADR 0100: the foundation's ports are the node's. Given 5433 for the store, every place
-// that uses the port reads it from there: the container, the filter, the openings, the guard.
-func TestAGivenPortIsUsedEverywhereThePortIs(t *testing.T) {
-	given := map[string]map[int]int{"postgres": {5432: 5433}, "lavinmq": {15672: 15673}}
-	for _, adopted := range []bool{true, false} {
-		with := anchorRendering(adopted)
-		with.Given = given
-		with.Ports["postgres"] = map[int]int{5432: 5433}
-		composed, err := anAdoptedAnchor().Compose(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		got := byID(composed.Resources)
-		if ports := got["postgres.server"]["ports"]; !reflect.DeepEqual(ports, []any{"5433:5432"}) {
-			t.Fatalf("the store's container publishes %v", ports)
-		}
-		if ports := got["lavinmq.server"]["ports"]; !reflect.DeepEqual(ports,
-			[]any{"5671:5671", "5672:5672", "127.0.0.1:15673:15672"}) {
-			t.Fatalf("the broker's container publishes %v", ports)
-		}
-		if !adopted {
-			filter, _ := got["nftables.filtering"]["content"].(string)
-			if !strings.Contains(filter, "tcp dport 5433 accept") || strings.Contains(filter, "5432") {
-				t.Fatalf("the filter does not use the given port:\n%s", filter)
-			}
-			continue
-		}
-		if o := got["adoption.opening-tcp-5433-forwarded"]; o == nil || o["to"] != 5432 {
-			t.Fatalf("no opening for the given port: %v", keys(got))
-		}
-		if guard := got[GuardID()]["content"]; guard != AsGuard([]int{5433, 5672, 15673}) {
-			t.Fatalf("the guard does not guard the given ports:\n%s", guard)
-		}
-	}
-}
-
-func TestAGivenPortIsTheNodesAndReachesSomething(t *testing.T) {
-	store := anAdoptedAnchor().Modules[1]
-	node := func(v any) []Layer {
-		return []Layer{{From: "anchor", Placement: map[string]any{PortsSetting: v}}}
-	}
-	if got, err := GivenPorts(store, node(map[string]any{"5432": float64(5433)})); err != nil ||
-		got[5432] != 5433 {
-		t.Fatalf("a node's given port was not read: %v %v", got, err)
-	}
-	if _, err := GivenPorts(store, []Layer{{From: MeshWideLayer,
-		Placement: map[string]any{PortsSetting: map[string]any{"5432": float64(5433)}}}}); err == nil {
-		t.Fatal("a port given for the whole mesh was accepted")
-	}
-	if _, err := GivenPorts(store, node(map[string]any{"6000": float64(6001)})); err == nil {
-		t.Fatal("a port the module neither listens on, publishes nor guards was given")
-	}
-	if _, err := GivenPorts(store, node(map[string]any{"5432": float64(70000)})); err == nil {
-		t.Fatal("a machine port that is not a port was given")
-	}
-	if _, err := GivenPorts(store, node(map[string]any{"5432": float64(22)})); err == nil {
-		t.Fatal("ssh's port was given")
-	}
-	broker := anAdoptedAnchor().Modules[2]
-	if _, err := GivenPorts(broker, node(map[string]any{"5671": float64(5700),
-		"5672": float64(5700)})); err == nil {
-		t.Fatal("one machine port was given for two of the module's ports")
-	}
-	if stray := UnusedSettings(store, node(map[string]any{"5432": float64(5433)})); len(stray) != 0 {
-		t.Fatalf("a given port is called stray: %v", stray)
-	}
-}
-
-// novox/hq ADR 0103: the guard is derived, and from taken modules only — every machine port a taken
-// module publishes that the filter admits from the private network only, and the ports its
-// manifest guards. A module assigned but not taken is not guarded: its port may still be the
-// predecessor's.
-func TestTheGuardIsDerivedFromTakenModulesOnly(t *testing.T) {
-	guardOf := func(with Rendering) string {
-		t.Helper()
-		composed, err := anAdoptedAnchor().Compose(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		content, _ := byID(composed.Resources)[GuardID()]["content"].(string)
-		return content
-	}
-
-	// The broker taken, the store not: the broker's plain port follows from its listens (from
-	// the mesh, published), its management port from its manifest; the store is not guarded, and
-	// neither is the bus, which the mesh needs from everywhere.
-	with := anchorRendering(true)
-	with.Taken = map[string]bool{"lavinmq": true}
-	if got := guardOf(with); got != AsGuard([]int{5672, 15672}) {
-		t.Fatalf("the guard is not the taken broker's ports:\n%s", got)
-	}
-
-	// A taken module publishing a port admitted from everywhere is not guarded; one admitted from
-	// the mesh is. The registry is exposed everywhere on this node, and hello-web listens from
-	// everywhere.
-	with.Taken = map[string]bool{"distribution": true, "hello-web": true}
-	if got := guardOf(with); got != "" {
-		t.Fatalf("a port admitted from everywhere is guarded:\n%s", got)
-	}
-	with.Settings = nil
-	if got := guardOf(with); got != AsGuard([]int{5000}) {
-		t.Fatalf("the registry, from the mesh only, is not guarded:\n%s", got)
-	}
-
-	// Nothing taken, nothing guarded — and no guard at all rather than an empty set.
-	with = anchorRendering(true)
-	with.Taken = nil
-	if got := guardOf(with); got != "" {
-		t.Fatalf("an untaken store is guarded:\n%s", got)
-	}
-
-	// A given port is followed: where the machine put it is what is refused.
-	with = anchorRendering(true)
-	with.Given = map[string]map[int]int{"lavinmq": {5672: 5682, 15672: 15673}}
-	with.Ports["lavinmq"] = map[int]int{5671: 5671, 5672: 5682}
-	if got := guardOf(with); got != AsGuard([]int{5432, 5682, 15673}) {
-		t.Fatalf("the guard does not follow the given ports:\n%s", got)
-	}
-}
-
-// A mapping bound to loopback is not published to anything off the machine — in either address
-// family — and an address's own colons never shift the ports.
-func TestPublishedLeavesOutLoopbackInBothFamilies(t *testing.T) {
-	got := Published([]map[string]any{{"type": "container", "ports": []any{
-		"127.0.0.1:15672:15672", "[::1]:8080:80", "localhost:9090:90",
-		"[::]:8443:443", "0.0.0.0:5000:5000", "5353:53/udp"}}})
-	want := map[string]map[int]int{"tcp": {8443: 443, 5000: 5000}, "udp": {5353: 53}}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("published is %v, want %v", got, want)
-	}
-}
-
-// novox/hq ADR 0038: only a published port is the mesh's to move. A module that binds the machine
-// itself listens where its software was told to, so giving it a machine port is refused.
-func TestAGivenPortIsRefusedForAPortNoContainerPublishes(t *testing.T) {
-	onTheMachine := Manifest{Module: "daemon",
-		Listens: []Listening{{Port: 9000, From: FromMesh}}, Guards: []int{9000}}
-	layers := []Layer{{From: "node anchor",
-		Placement: map[string]any{PortsSetting: map[string]any{"9000": float64(9100)}}}}
-	_, err := GivenPorts(onTheMachine, layers)
-	if err == nil || !strings.Contains(err.Error(), "does not publish") {
-		t.Fatalf("a port no container publishes was given: %v", err)
-	}
-}
-
-// novox/hq ADR 0103: a guarded port this node is told to open to everyone is opened, not guarded.
-// An opening from everywhere beside a guard dropping it is one statement refusing the other.
-func TestAGuardedPortOpenedToEveryoneIsNotGuarded(t *testing.T) {
-	with := anchorRendering(true)
-	with.Settings["postgres"] = []Layer{{From: "node anchor",
-		Placement: map[string]any{ExposeSetting: map[string]any{"5432": FromEverywhere}}}}
-	composed, err := anAdoptedAnchor().Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := byID(composed.Resources)
-	if o := got["adoption.opening-tcp-5432-forwarded"]; o == nil || o["from"] != OpeningFromEverywhere {
-		t.Fatalf("the store's port is not opened to everyone: %v", o)
-	}
-	if guard, _ := got[GuardID()]["content"].(string); guard != AsGuard([]int{5672, 15672}) {
-		t.Fatalf("a port opened to everyone is still guarded:\n%s", guard)
-	}
-}
-
-// A module that publishes its ssh port the long way — `2222:22`, because the machine's own daemon
-// holds 22 — and says it listens on the machine side of that mapping, which is what anything
-// reaching it dials.
-func aForge() Manifest {
-	return Manifest{Module: "forge",
-		Provides: []Offer{{Name: "git-over-ssh", Scope: ScopeMesh}},
-		Serves:   map[string]map[string]any{"git-over-ssh": {"port": 2222}},
-		Listens:  []Listening{{Port: 3000, From: FromMesh}, {Port: 2222, From: FromMesh}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "forge",
-			"ports": []any{"3000", "2222:22"}}}}
-}
-
-// portsAsThePlanWould is where this machine puts each of a module's ports, derived the way
-// cmd/mesh-controller/plan.go derives it: a given port first, looked up by the port the module
-// says it listens on, and otherwise wherever the manifest's own mapping already put it. Written
-// here because everything below — the filter, the openings, the guard, what a consumer is told —
-// reads that map, and a given port that the lookup does not find moves the container's mapping
-// and nothing else.
-//
-// It stands in for the plan only where the plan does not allocate: a port the manifest already
-// placed, or one a node was given. For a short form with no given port the real plan asks the
-// inventory for a machine port and may come back with one from the pool, which needs a store and
-// is what cmd/mesh-controller's own tests exercise. So an assertion here about such a port asserts
-// this helper, not the mesh; keep the assertions to the ports under test.
-func portsAsThePlanWould(m Manifest, given map[int]int) map[int]int {
-	out := map[int]int{}
-	for _, l := range m.Listens {
-		if at, is := given[l.Port]; is {
-			out[l.Port] = at
-			continue
-		}
-		at, _ := m.MachineSide(l.Port)
-		out[l.Port] = at
-	}
-	return out
-}
-
-// novox/hq ADR 0100 and 0038: the machine side of a long-form mapping is a port the module
-// publishes, so a node may move it — and a module may name a mapping by either end.
-func TestAGivenPortNamesEitherEndOfWhatTheModulePublishes(t *testing.T) {
-	forge := aForge()
-	node := func(v any) []Layer {
-		return []Layer{{From: "node anchor", Placement: map[string]any{PortsSetting: v}}}
-	}
-
-	// The machine side — the number this module says it listens on, and the one the predecessor
-	// had somewhere else. Answered under 2222, the end the module itself names, which is what
-	// every reader of this map asks for. One entry, not two: a second key for the same answer is
-	// an entry another mapping's reader could find instead.
-	given, err := GivenPorts(forge, node(map[string]any{"2222": float64(222)}))
-	if err != nil {
-		t.Fatalf("the machine side of a mapping cannot be given a port: %v", err)
-	}
-	if want := map[int]int{2222: 222}; !reflect.DeepEqual(given, want) {
-		t.Fatalf("the forge was given %v; the mapping it names is filed under %v", given, want)
-	}
-
-	// The container's own port names the same mapping and means the same thing — and is filed
-	// under the same name, because the module's name for it has not changed.
-	if inside, err := GivenPorts(forge, node(map[string]any{"22": float64(222)})); err != nil ||
-		!reflect.DeepEqual(inside, map[int]int{2222: 222}) {
-		t.Fatalf("the container's end of the mapping was given %v: %v", inside, err)
-	}
-
-	// A short form is published on the number it names, and is unchanged by any of this.
-	if short, err := GivenPorts(forge, node(map[string]any{"3000": float64(2999)})); err != nil ||
-		short[3000] != 2999 {
-		t.Fatalf("the short form was given %v: %v", short, err)
-	}
-
-	// A port no container publishes is still refused, in the same words.
-	if _, err := GivenPorts(forge, node(map[string]any{"9000": float64(9100)})); err == nil ||
-		!strings.Contains(err.Error(), "does not publish") {
-		t.Fatalf("a port the forge does not publish was given: %v", err)
-	}
-
-	// And the two ends of one mapping given two different numbers is one setting contradicting
-	// the other: the machine publishes it once.
-	if _, err := GivenPorts(forge, node(map[string]any{
-		"2222": float64(222), "22": float64(300)})); err == nil ||
-		!strings.Contains(err.Error(), "one mapping") {
-		t.Fatalf("the two ends of one mapping were given different ports: %v", err)
-	}
-	// Said at both ends with the same number, it is still said twice, and refused where every
-	// other repeated machine port is — as the inventory refuses it when the setting is stored,
-	// which is the layer that sees it first.
-	if _, err := GivenPorts(forge, node(map[string]any{
-		"2222": float64(222), "22": float64(222)})); err == nil ||
-		!strings.Contains(err.Error(), "to both its 22 and its 2222") {
-		t.Fatalf("one mapping given one machine port at both ends: %v", err)
-	}
-	// A number that names two different mappings names neither: which one to move is not said.
-	twice := aForge()
-	twice.Resources[0]["ports"] = []any{"22", "2222:22"}
-	if _, err := GivenPorts(twice, node(map[string]any{"22": float64(222)})); err == nil ||
-		!strings.Contains(err.Error(), "twice") {
-		t.Fatalf("a number naming two of the module's mappings was accepted: %v", err)
-	}
-
-	// And the same refusal when the number naming two mappings is not the one the setting used
-	// but the one the answer would be filed under. Here `80` is the module's own name for a
-	// mapping, and two mappings wear it; filing an answer there is one container's port standing
-	// where the other's is read, and both containers then publish it.
-	shared := Manifest{Module: "gallery",
-		Listens: []Listening{{Port: 80, From: FromMesh}},
-		Resources: []map[string]any{
-			{"id": "a", "type": "container", "name": "a", "ports": []any{"4001:80"}},
-			{"id": "b", "type": "container", "name": "b", "ports": []any{"4002:80"}}}}
-	if _, err := GivenPorts(shared, node(map[string]any{"4001": float64(1234)})); err == nil ||
-		!strings.Contains(err.Error(), "twice") {
-		t.Fatalf("two containers were put on one machine port: %v", err)
-	}
-
-	// A module whose mappings chain — one's machine side is another's container port — keeps them
-	// apart, because each is filed under the port the module names it by and neither name is
-	// shared. Given both, each moves on its own and neither overwrites the other.
-	chained := Manifest{Module: "chain",
-		Listens: []Listening{{Port: 80, From: FromMesh}, {Port: 9090, From: FromMesh}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "chain",
-			"ports": []any{"8080:80", "9090:8080"}}}}
-	both, err := GivenPorts(chained, node(map[string]any{"80": float64(1234), "9090": float64(5678)}))
-	if err != nil || !reflect.DeepEqual(both, map[int]int{80: 1234, 9090: 5678}) {
-		t.Fatalf("chained mappings were given %v: %v", both, err)
-	}
-	if moved := givenOuter("8080:80", both); moved != "1234:80" {
-		t.Fatalf("the first mapping moved to %q, and it was given 1234", moved)
-	}
-	if moved := givenOuter("9090:8080", both); moved != "5678:8080" {
-		t.Fatalf("the second mapping moved to %q, and it was given 5678", moved)
-	}
-}
-
-// And the number reaches everything derived from it. The fault this is written against moved the
-// container's mapping alone: the filter opened the port the software had left, the adopted node's
-// opening named it too, the guard refused it, and a consumer was sent to it.
-func TestAGivenMachineSideReachesTheFilterTheOpeningAndTheConsumer(t *testing.T) {
-	forge := aForge()
-	given, err := GivenPorts(forge, []Layer{{From: "node anchor",
-		Placement: map[string]any{PortsSetting: map[string]any{"2222": float64(222)}}}})
-	if err != nil {
-		t.Fatalf("the machine side of a mapping cannot be given a port: %v", err)
-	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{forge}}
-	with := Rendering{
-		Ports:           map[string]map[int]int{"forge": portsAsThePlanWould(forge, given)},
-		Given:           map[string]map[int]int{"forge": given},
-		Mesh:            []string{"10.77.0.1"},
-		Adopted:         true,
-		OutwardLinks:    []string{"eth0"},
-		TunnelInterface: "mesh0",
-		Taken:           map[string]bool{"forge": true},
-	}
-
-	// What the runtime is handed: the machine's own port on the outside, the container's within.
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatalf("the forge does not compose: %v", err)
-	}
-	got := byID(composed.Resources)
-	if ports := got["forge.server"]["ports"]; !reflect.DeepEqual(ports, []any{"3000:3000", "222:22"}) {
-		t.Fatalf("the forge's container publishes %v", ports)
-	}
-
-	// What the filter would open, were the node converged.
-	rules, err := r.Rules(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var opened []int
-	for _, rule := range rules {
-		opened = append(opened, rule.Port)
-	}
-	// Only the moved port is asserted: the forge's other port is a short form the real plan would
-	// allocate rather than read off the manifest, so its number here is portsAsThePlanWould's and
-	// not the mesh's.
-	if !slices.Contains(opened, 222) || slices.Contains(opened, 2222) {
-		t.Fatalf("the filter opens %v, not where the machine puts the forge", opened)
-	}
-
-	// And what it is declared instead, adopted: an opening on the machine's port, naming the
-	// container's port on the forwarded path — a published port is forwarded, never received.
-	opening := got[OpeningID("tcp", 222, PathForwarded)]
-	if opening == nil || opening["to"] != 22 || opening["from"] != OpeningFromMesh {
-		t.Fatalf("no opening for the port this node gave the forge: %v", keys(got))
-	}
-	for id := range got {
-		if strings.HasPrefix(id, "adoption.opening-tcp-2222-") {
-			t.Errorf("an opening for the port the forge was moved off: %s", id)
-		}
-	}
-
-	// The guard refuses it where the machine put it, and nothing where it used to be.
-	guard, _ := got[GuardID()]["content"].(string)
-	if !strings.Contains(guard, "222") || strings.Contains(guard, "2222") {
-		t.Fatalf("the guard does not follow the given port:\n%s", guard)
-	}
-
-	// And a consumer is sent to the same number, which is read from what the module serves.
-	if told := ServedOn(forge, "git-over-ssh", with.Ports["forge"])["port"]; told != 222 {
-		t.Fatalf("a consumer is told the forge answers on %v", told)
-	}
-}
-
-// And the mapping itself moves under either name, because Rendering.Given is a map anybody
-// composing a declaration hands in: keyed by the machine side, which is what a module declaring
-// 2222 calls its port, only the outside moves and the container's own port stays as written.
-func TestAMappingIsMovedUnderEitherOfItsNames(t *testing.T) {
-	for _, c := range []struct {
-		written string
-		given   map[int]int
-		want    string
-	}{
-		{"2222:22", map[int]int{2222: 222}, "222:22"},
-		{"2222:22", map[int]int{22: 222}, "222:22"},
-		{"127.0.0.1:15672:15672/tcp", map[int]int{15672: 15673}, "127.0.0.1:15673:15672/tcp"},
-		{"2222:22", map[int]int{3000: 2999}, "2222:22"},
-		{"2222:22", nil, "2222:22"},
-	} {
-		if got := givenOuter(c.written, c.given); got != c.want {
-			t.Errorf("%s given %v is published as %s, want %s", c.written, c.given, got, c.want)
-		}
-	}
-}
-
-// The same on a node that was given nothing, which is where the derivation was never at fault:
-// a long-form mapping is published where the manifest put it, and an adopted node opens that port
-// on the forwarded path like any other. What broke it was the number reaching only the mapping.
-func TestALongFormPortIsOpenedWhereTheManifestPublishesIt(t *testing.T) {
-	forge := aForge()
-	r := Resolution{Node: "anchor", Modules: []Manifest{forge}}
-	composed, err := r.Compose(Rendering{
-		Ports:           map[string]map[int]int{"forge": portsAsThePlanWould(forge, nil)},
-		Mesh:            []string{"10.77.0.1"},
-		Adopted:         true,
-		OutwardLinks:    []string{"eth0"},
-		TunnelInterface: "mesh0",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := byID(composed.Resources)
-	opening := got[OpeningID("tcp", 2222, PathForwarded)]
-	if opening == nil || opening["to"] != 22 {
-		t.Fatalf("no opening for the forge's published ssh port: %v", keys(got))
-	}
-}
diff --git a/internal/catalogue/agent_account_test.go b/internal/catalogue/agent_account_test.go
deleted file mode 100644
index 90efb041..00000000
--- a/internal/catalogue/agent_account_test.go
+++ /dev/null
@@ -1,119 +0,0 @@
-package catalogue
-
-import (
-	"testing"
-)
-
-// The account agents run as (novox/hq ADR 0266): a module names it as a machine fact — the agent account
-// where the node names one, the operator's otherwise — and asks the node-engine to judge it never to become
-// root only where it is the agents' own.
-
-func TestTheAgentAccountFactFallsBackToTheOperatorAndIsNeverRootOnlyWhenItsOwn(t *testing.T) {
-	facts := machineFacts(Resolution{Node: "anchor", Account: "ops"}, nil, "")
-	if facts["agent-account"] != "ops" || facts["agent-home"] != "/home/ops" || facts["agent-root"] != "" {
-		t.Errorf("with no agent account named, agents run as the operator: %v", facts)
-	}
-	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AccountHome: "/srv/ops"}, nil, "")
-	if facts["agent-home"] != "/srv/ops" {
-		t.Errorf("the operator's stated home is the agent's home when they are one account: %v", facts)
-	}
-	facts = machineFacts(Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent"}, nil, "")
-	if facts["agent-account"] != "agent" || facts["agent-home"] != "/home/agent" || facts["agent-root"] != RootNever {
-		t.Errorf("a named agent account is the agents', never root: %v", facts)
-	}
-	if facts["account"] != "ops" {
-		t.Errorf("the operator account is still the operator's: %v", facts)
-	}
-	facts = machineFacts(Resolution{Node: "anchor", AgentAccount: "agent", AgentAccountHome: "/var/lib/agent"}, nil, "")
-	if facts["agent-home"] != "/var/lib/agent" || facts["agent-root"] != RootNever {
-		t.Errorf("an agent account with a stated home on a machine with no operator: %v", facts)
-	}
-	if _, has := machineFacts(Resolution{Node: "anchor"}, nil, "")["agent-account"]; has {
-		t.Error("a machine with no account at all names an agent account")
-	}
-}
-
-// The agent's module, in the shape the catalogue's declares it: the account, never root where it is its
-// own; its directory under that home, owned by it.
-const agentModule = `{"module": "agent", "version": "1", "resources": [
-  {"id": "account", "type": "user", "name": "${machine:agent-account}", "home": "${machine:agent-home}",
-   "root": "${machine:agent-root}"},
-  {"id": "home", "type": "directory", "path": "${machine:agent-home}/.agent", "mode": "0700",
-   "owner": "${machine:agent-account}"}
-]}`
-
-func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
-	m, err := ParseManifest([]byte(agentModule))
-	if err != nil {
-		t.Fatal(err)
-	}
-	compose := func(r Resolution, with Rendering) (user, home map[string]any) {
-		t.Helper()
-		r.Node, r.Modules = "anchor", []Manifest{m}
-		out, err := r.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return fileNamed(out, "agent.account"), fileNamed(out, "agent.home")
-	}
-
-	user, home := compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{JudgesRoot: true})
-	if user["name"] != "agent" || user[RootField] != RootNever || user["home"] != "/home/agent" {
-		t.Errorf("an engine that judges root is sent the agent account never to become root: %v", user)
-	}
-	if home["path"] != "/home/agent/.agent" || home["owner"] != "agent" {
-		t.Errorf("the agent's directory is under its own home, its own: %v", home)
-	}
-
-	user, _ = compose(Resolution{Account: "ops", AgentAccount: "agent", AgentAccountHome: "/srv/agent"}, Rendering{JudgesRoot: true})
-	if user["home"] != "/srv/agent" {
-		t.Errorf("an agent account named with a home of its own is made there: %v", user)
-	}
-
-	user, _ = compose(Resolution{Account: "ops", AgentAccount: "agent"}, Rendering{})
-	if _, sent := user[RootField]; sent || user["name"] != "agent" {
-		t.Errorf("an older engine, which parses strictly, is sent root: %v", user)
-	}
-
-	user, home = compose(Resolution{Account: "ops"}, Rendering{JudgesRoot: true})
-	if _, sent := user[RootField]; sent || user["name"] != "ops" {
-		t.Errorf("where agents run as the operator, root asserts nothing and is not sent: %v", user)
-	}
-	if home["path"] != "/home/ops/.agent" || home["owner"] != "ops" {
-		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
-	}
-}
-
-func TestTheRuntimeIsToldTheAgentAccount(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	envOf := func(r Resolution) map[string]string {
-		t.Helper()
-		r.Node, r.Modules = "anchor", []Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
-		out, err := r.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-		if process == nil {
-			t.Fatal("no runtime process was composed")
-		}
-		return process["env"].(map[string]string)
-	}
-	env := envOf(Resolution{Account: "ops", AgentAccount: "agent"})
-	if env[RuntimeAgentAccount] != "agent" || env[RuntimeAgentHome] != "/home/agent" || env[RuntimeOperatorAccount] != "ops" {
-		t.Errorf("the runtime is not told whom agents run as: %v", env)
-	}
-	env = envOf(Resolution{Account: "ops"})
-	if env[RuntimeAgentAccount] != "ops" || env[RuntimeAgentHome] != "/home/ops" {
-		t.Errorf("with no agent account, agents run as the operator: %v", env)
-	}
-	env = envOf(Resolution{})
-	if _, set := env[RuntimeAgentAccount]; set {
-		t.Errorf("a machine with no account names an agent account: %v", env)
-	}
-	if problems := bundleEnvProblems("x", Artifact{Name: "b", Kind: ArtifactBundle, Loads: []string{"x"},
-		Env: map[string]string{RuntimeAgentAccount: "me"}}); len(problems) == 0 {
-		t.Error("a bundle may tell the runtime whom agents run as")
-	}
-}
diff --git a/internal/catalogue/amqp_is_not_a_provision_test.go b/internal/catalogue/amqp_is_not_a_provision_test.go
deleted file mode 100644
index 932c81df..00000000
--- a/internal/catalogue/amqp_is_not_a_provision_test.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// **The word does not come back through a manifest** (novox/hq ADR 0131). A module that wants
-// messaging wants the mesh's bus, reached through the sdk and named by the `mesh-broker` seat. Naming
-// the old wire protocol asks for the one server being retired, so both directions are refused at the
-// parser — this is judged from the manifest alone, no store needed.
-
-func TestAManifestProvidingAmqpIsRefused(t *testing.T) {
-	raw := []byte(`{"module":"old-broker","version":"1","provides":[{"name":"amqp","scope":"mesh"}]}`)
-	_, err := ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), `provides "amqp", which is not a provision`) {
-		t.Fatalf("a module providing amqp was not refused, or not for the reason: %v", err)
-	}
-}
-
-func TestAManifestRequiringAmqpIsRefused(t *testing.T) {
-	raw := []byte(`{"module":"forwarder","version":"1","requires":["amqp"]}`)
-	_, err := ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), `requires "amqp", which is not a provision`) {
-		t.Fatalf("a module requiring amqp was not refused, or not for the reason: %v", err)
-	}
-}
-
-// And the catalogue (internal/beside) names it nowhere — the three modules that did are removed under
-// design 28 task 5.4, not converted.
-func TestNoCatalogueManifestNamesAmqp(t *testing.T) {
-	modules, err := filepath.Glob(filepath.Join(beside.Catalogue(t), "*", "module.json"))
-	if err != nil || len(modules) == 0 {
-		t.Fatalf("no manifests in the catalogue, so this proved nothing: %v", err)
-	}
-	for _, path := range modules {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if strings.Contains(string(raw), `"amqp"`) {
-			t.Errorf("%s names amqp, which is not a provision (novox/hq ADR 0131)",
-				filepath.Base(filepath.Dir(path)))
-		}
-	}
-}
diff --git a/internal/catalogue/artifact_store_alias_test.go b/internal/catalogue/artifact_store_alias_test.go
deleted file mode 100644
index 761d4768..00000000
--- a/internal/catalogue/artifact_store_alias_test.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package catalogue
-
-import "testing"
-
-// A claim written before the rename still holds (novox/hq ADR 0122, ADR 0156): with the store's
-// aliases loaded, the former name resolves to the seat.
-func TestTheArtifactStoresFormerNameResolvesToIt(t *testing.T) {
-	was := aliases
-	t.Cleanup(func() { aliases = was })
-	UseAliases(map[string]string{"the-artifact-store": "mesh-artifact-store"})
-	seat, known := SeatNamed("the-artifact-store")
-	if !known || seat.Name != "mesh-artifact-store" || seat.Delivers != "artifact-store" {
-		t.Fatalf("the former name did not resolve: %+v %v", seat, known)
-	}
-	if _, known := SeatNamed("mesh-artifact-store"); !known {
-		t.Fatal("the seat is not in the set under its name")
-	}
-}
diff --git a/internal/catalogue/artifact_store_seat_test.go b/internal/catalogue/artifact_store_seat_test.go
deleted file mode 100644
index 182dcac8..00000000
--- a/internal/catalogue/artifact_store_seat_test.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The artifact store's seat is one per mesh, read from the catalogue beside this checkout.
-//
-// **A second store anywhere is refused by name, not discovered as a consumer failure.** The seat
-// was node-scoped, so a second `distribution` on another machine resolved cleanly there — and a
-// node-scoped requirement with one candidate installs that candidate on the node, so anything that
-// required the store's presence beside it would have raised a fresh, empty store on the wrong
-// machine. Only afterwards did the mesh notice: `artifact-store` offered by two nodes, and every
-// consumer elsewhere refusing to choose. The claim says it first, where the second store is
-// assigned.
-func TestASecondArtifactStoreAnywhereIsRefusedByName(t *testing.T) {
-	store := catalogueManifest(t, "distribution")
-
-	// The first store resolves as it always has.
-	if _, err := Resolve(shelf(store), []string{"distribution"}, workstation(), World{}); err != nil {
-		t.Fatalf("the store alone does not resolve: %v", err)
-	}
-
-	// A second one, on any other machine, is refused — and the refusal names the seat.
-	elsewhere := World{Held: []Held{{Claim: "mesh-artifact-store", Scope: ScopeMesh,
-		Node: "anchor", Module: "distribution"}}}
-	other := workstation()
-	other.Name = "laptop"
-	_, err := Resolve(shelf(store), []string{"distribution"}, other, elsewhere)
-	if err == nil {
-		t.Fatal("a second store was accepted on another machine; it would offer artifact-store a " +
-			"second time and every consumer elsewhere would refuse to choose")
-	}
-	if !strings.Contains(err.Error(), "mesh-artifact-store") || !strings.Contains(err.Error(), "one per mesh") {
-		t.Fatalf("refused without naming the seat: %v", err)
-	}
-}
diff --git a/internal/catalogue/artifacts_test.go b/internal/catalogue/artifacts_test.go
deleted file mode 100644
index 3d0ae70e..00000000
--- a/internal/catalogue/artifacts_test.go
+++ /dev/null
@@ -1,137 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A build is recorded by what it is; where it is pushed is composed where it is used (novox/hq
-// 04-ISSUES/102).
-
-var digest = "sha256:" + strings.Repeat("d", 64)
-
-func TestAReferenceIsRecordedWithoutTheStoresAddress(t *testing.T) {
-	cases := map[string]string{
-		"anchor.internal:5100/gitea/server@" + digest:                 ArtifactStoreScheme + "gitea/server@" + digest,
-		"localhost:5000/gitea/server@" + digest:                       ArtifactStoreScheme + "gitea/server@" + digest,
-		"http://anchor.internal:5100/v2/gitea/config/blobs/" + digest: ArtifactStoreScheme + "gitea/config/blobs/" + digest,
-		ArtifactStoreScheme + "gitea/server@" + digest:                ArtifactStoreScheme + "gitea/server@" + digest,
-		digest:                  digest,
-		"@novox/sdk@1.2.3":      "@novox/sdk@1.2.3",
-		"gitea/gitea@" + digest: "gitea/gitea@" + digest,
-		"https://registry.example/v2/gitea/config/blobs/" + digest: "https://registry.example/v2/gitea/config/blobs/" + digest,
-	}
-	for announced, want := range cases {
-		if got := Recorded(announced); got != want {
-			t.Errorf("Recorded(%q) = %q, want %q", announced, got, want)
-		}
-	}
-}
-
-func TestARecordedReferenceIsRoutedThroughTheStoreAsItIsNow(t *testing.T) {
-	if got := Routed(ArtifactStoreScheme+"gitea/server@"+digest, "anchor.internal:5101"); got != "anchor.internal:5101/gitea/server@"+digest {
-		t.Errorf("an image is fetched as %q", got)
-	}
-	if got := Routed(ArtifactStoreScheme+"gitea/config/blobs/"+digest, "anchor.internal:5101"); got != "http://anchor.internal:5101/v2/gitea/config/blobs/"+digest {
-		t.Errorf("an archive is fetched as %q", got)
-	}
-	if got := Routed("gitea/gitea@"+digest, "anchor.internal:5101"); got != "gitea/gitea@"+digest {
-		t.Errorf("a reference that is not the store's was routed: %q", got)
-	}
-	// One recorded before references were kept without their address follows the store too.
-	if got := Rerouted("anchor.internal:5100/gitea/server@"+digest, "anchor.internal:5101"); got != "anchor.internal:5101/gitea/server@"+digest {
-		t.Errorf("a reference recorded with the old address stays there: %q", got)
-	}
-}
-
-// **The address is composed into a declaration, and the record never carries it.**
-func TestAnImageTheMeshBuiltIsRoutedThroughTheStoreWhenDeclared(t *testing.T) {
-	m := Manifest{Module: "gitea", Version: "1", Resources: []map[string]any{
-		{"id": "server", "type": "container", "name": "mesh-gitea", "artifact": "server"},
-		{"id": "config", "type": "archive", "path": "/etc/gitea", "artifact": "config"},
-		{"id": "cache", "type": "container", "name": "mesh-gitea-cache", "image": "valkey/valkey@" + digest},
-	}, Build: &Build{Artifacts: []Artifact{
-		{Name: "server", Kind: ArtifactImage, From: "Dockerfile"},
-		{Name: "config", Kind: ArtifactArchive, From: "config"},
-	}}}
-	resolved, err := m.Resolve([]Built{
-		{Name: "server", Kind: ArtifactImage, Reference: ArtifactStoreScheme + "gitea/server@" + digest},
-		{Name: "config", Kind: ArtifactArchive, Reference: ArtifactStoreScheme + "gitea/config/blobs/" + digest, Digest: digest},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{resolved}}
-
-	out, err := r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := fileNamed(out, "gitea.server")["image"]; got != "anchor.internal:5101/gitea/server@"+digest {
-		t.Errorf("the image the mesh built is fetched as %v", got)
-	}
-	if got := fileNamed(out, "gitea.config")["source"]; got != "http://anchor.internal:5101/v2/gitea/config/blobs/"+digest {
-		t.Errorf("the archive the mesh built is fetched from %v", got)
-	}
-	if got := fileNamed(out, "gitea.cache")["image"]; got != "valkey/valkey@"+digest {
-		t.Errorf("an image from a public registry was routed through the store: %v", got)
-	}
-	// The manifest the mesh holds still says what it is, not where it was fetched from.
-	if got := resolved.Resources[0]["image"]; got != ArtifactStoreScheme+"gitea/server@"+digest {
-		t.Errorf("composing wrote the address into the catalogue's copy: %v", got)
-	}
-
-	// And the store moves: the same record, another address, without a rebuild.
-	out, err = r.Declaration(Rendering{ArtifactStore: "laptop.internal:5000"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := fileNamed(out, "gitea.server")["image"]; got != "laptop.internal:5000/gitea/server@"+digest {
-		t.Errorf("after the store moved, the image is still fetched as %v", got)
-	}
-}
-
-func TestAnImageInTheStoreWithNoStoreToFetchItFromIsRefused(t *testing.T) {
-	m := Manifest{Module: "gitea", Version: "1", Resources: []map[string]any{
-		{"id": "server", "type": "container", "name": "mesh-gitea",
-			"image": ArtifactStoreScheme + "gitea/server@" + digest},
-	}}
-	_, err := Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(Rendering{})
-	if err == nil || !strings.Contains(err.Error(), "no artifact store") {
-		t.Fatalf("a reference nothing can fetch was sent to a machine: %v", err)
-	}
-}
-
-// **A reference recorded with an address before this follows the store too** — when the mesh
-// built it. A module running an image straight from a public registry under its own name is left
-// exactly where it says: `quay.io/keycloak/keycloak` is not the mesh's, whatever it is called.
-func TestAReferenceRecordedWithAnAddressFollowsTheStoreWhenTheMeshBuiltIt(t *testing.T) {
-	m := Manifest{Module: "keycloak", Version: "1", Resources: []map[string]any{
-		{"id": "server", "type": "container", "name": "mesh-keycloak",
-			"image": "anchor.internal:5100/keycloak/server@" + digest},
-		{"id": "upstream", "type": "container", "name": "mesh-keycloak-upstream",
-			"image": "quay.io/keycloak/keycloak@" + digest},
-	}}
-	r := Resolution{Node: "anchor", Modules: []Manifest{m}}
-	out, err := r.Declaration(Rendering{
-		ArtifactStore: "anchor.internal:5101",
-		Built:         map[string]bool{"keycloak/server": true},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := fileNamed(out, "keycloak.server")["image"]; got != "anchor.internal:5101/keycloak/server@"+digest {
-		t.Errorf("an image the mesh built, recorded with the old address, is fetched as %v", got)
-	}
-	if got := fileNamed(out, "keycloak.upstream")["image"]; got != "quay.io/keycloak/keycloak@"+digest {
-		t.Errorf("a public image was re-routed through the store: %v", got)
-	}
-	// Nothing known to be built: nothing re-routed, nothing refused.
-	out, err = r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := fileNamed(out, "keycloak.server")["image"]; got != "anchor.internal:5100/keycloak/server@"+digest {
-		t.Errorf("with no build record, a reference was rewritten: %v", got)
-	}
-}
diff --git a/internal/catalogue/backup_placement_test.go b/internal/catalogue/backup_placement_test.go
deleted file mode 100644
index ba566ca2..00000000
--- a/internal/catalogue/backup_placement_test.go
+++ /dev/null
@@ -1,126 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A machine's backup lines are placement (design 57 L3, issue 794): the holder of node-backup names them as
-// `${backup:lines}` and `${backup:data}`, which a handed holder has its client fill from the plan and an unhanded
-// one has the controller fill as it fills `${contribution:node-backup:backup}` and `${...:data}`: the same text.
-
-const (
-	oldBackupText   = "# lines\n${contribution:node-backup:backup}"
-	oldDataText     = "# data\n${contribution:node-backup:data}"
-	placedBackupTxt = "# lines\n${backup:lines}"
-	placedDataTxt   = "# data\n${backup:data}"
-	backupHolder    = `{"module":"restic","version":"1","moved":true,"claims":[{"name":"node-backup","scope":"node"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"declared","type":"file","path":"/etc/backups.conf","template":"files/backups"},
-               {"id":"data-declared","type":"file","path":"/etc/data.conf","template":"files/data"}]}`
-)
-
-func dataModule(name string) string {
-	return `{"module":"` + name + `","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"}],
-  "data":{"own":[{"id":"d","path":"${dir:d}","class":"irreplaceable","why":"the ` + name + ` data"}]}}`
-}
-
-// backupsOn is a machine of a holder whose files say these texts and the modules that declare data.
-func backupsOn(t *testing.T, lines, data string, modules ...string) Resolution {
-	t.Helper()
-	all := []Manifest{held(t, backupHolder, builtWith("restic", map[string]string{"backups": lines, "data": data}))}
-	names := []string{"restic"}
-	for _, name := range modules {
-		all = append(all, mustParse(t, dataModule(name)))
-		names = append(names, name)
-	}
-	r, err := Resolve(shelf(all...), names, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	return r
-}
-
-var backupModules = []string{"alpha", "beta", "gamma"}
-
-// gammaLeftOut is a machine whose gamma does not place: its lines are kept, best effort.
-func gammaLeftOut(with Rendering) Rendering {
-	with.NotPlaced = map[string]string{"gamma": "its placement setting does not read"}
-	return with
-}
-
-func TestTheBackupPlacementIsTheTextTheOldPlaceholdersRender(t *testing.T) {
-	// The old form is an unmoved holder: its placeholders are the controller's alone.
-	oldHolder := strings.Replace(backupHolder, `"moved":true,`, "", 1)
-	all := []Manifest{held(t, oldHolder, builtWith("restic", map[string]string{"backups": oldBackupText, "data": oldDataText}))}
-	for _, name := range backupModules {
-		all = append(all, mustParse(t, dataModule(name)))
-	}
-	old, err := Resolve(shelf(all...), append([]string{"restic"}, backupModules...), workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	old.Account = "op"
-	wantLines, wantData := fileOf(t, old, gammaLeftOut(Rendering{}), "restic.declared"), fileOf(t, old, gammaLeftOut(Rendering{}), "restic.data-declared")
-	if !strings.Contains(wantLines, "# alpha\npath ") || !strings.Contains(wantLines, "# gamma\n") || !strings.Contains(wantData, "item d") {
-		t.Fatalf("the old form renders\n%s\n%s", wantLines, wantData)
-	}
-	moved := backupsOn(t, placedBackupTxt, placedDataTxt, backupModules...)
-	// Not handed: the controller fills the new placeholders with the old text.
-	if got := fileOf(t, moved, gammaLeftOut(Rendering{}), "restic.declared"); got != wantLines {
-		t.Errorf("not handed, the lines are\n%s\nwant\n%s", got, wantLines)
-	}
-	if got := fileOf(t, moved, gammaLeftOut(Rendering{}), "restic.data-declared"); got != wantData {
-		t.Errorf("not handed, the data is\n%s\nwant\n%s", got, wantData)
-	}
-	// Handed: the plan carries the same text as placement, and the files are the client's.
-	c, _ := composeWith(t, moved, gammaLeftOut(handingTo("store:5000")))
-	p := c.Plans["restic"].Placement
-	if got := "# lines\n" + p["backup:lines"]; got != wantLines {
-		t.Errorf("handed, the plan's lines are\n%s\nwant\n%s", got, wantLines)
-	}
-	if got := "# data\n" + p["backup:data"]; got != wantData {
-		t.Errorf("handed, the plan's data is\n%s\nwant\n%s", got, wantData)
-	}
-	if len(p) != 2 {
-		t.Errorf("the plan's placement is %v", p)
-	}
-}
-
-func TestAModuleAddedOrTakenAwayChangesTheBackupPlan(t *testing.T) {
-	plan := func(modules ...string) map[string]string {
-		c, _ := composeWith(t, backupsOn(t, placedBackupTxt, placedDataTxt, modules...), handingTo("store:5000"))
-		return c.Plans["restic"].Placement
-	}
-	two, three := plan("alpha", "beta"), plan("alpha", "beta", "gamma")
-	if reflect.DeepEqual(two, three) || strings.Contains(two["backup:lines"], "gamma") || !strings.Contains(three["backup:lines"], "# gamma\n") {
-		t.Errorf("two modules give %v, three give %v", two, three)
-	}
-}
-
-func TestAnUnknownBackupKeyIsRefused(t *testing.T) {
-	r := backupsOn(t, "${backup:rows}", placedDataTxt, backupModules...)
-	if _, err := r.Compose(handingTo("store:5000")); err == nil || !strings.Contains(err.Error(), "backup:rows") {
-		t.Errorf("handed, an unknown key is %v", err)
-	}
-	if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), "backup:rows") {
-		t.Errorf("not handed, an unknown key is %v", err)
-	}
-}
-
-func fileOf(t *testing.T, r Resolution, with Rendering, id string) string {
-	t.Helper()
-	out, err := r.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, res := range out {
-		if res["id"] == id {
-			return res["content"].(string)
-		}
-	}
-	t.Fatalf("%s was not composed", id)
-	return ""
-}
diff --git a/internal/catalogue/backup_test.go b/internal/catalogue/backup_test.go
deleted file mode 100644
index 4450ac27..00000000
--- a/internal/catalogue/backup_test.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A backup contribution written by hand still names its module's own directories; one it does not
-// declare is refused where it is written rather than reaching the holder as the literal text. (The
-// catalogue check refuses a hand-written backup line at all since ADR 0233; parsing still reads one,
-// because a module on the shelf was written before.)
-func TestABackupNamingAnUndeclaredDirectoryIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"pg","version":"1",
-		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:nowhere}"}]}`))
-	if err == nil || !strings.Contains(err.Error(), "nowhere") {
-		t.Fatalf("a backup of an undeclared directory was accepted: %v", err)
-	}
-}
-
-// A module on the shelf from before ADR 0233, which writes its backup lines by hand and declares no
-// data, is still backed up: its lines are placed as written, each module's under a comment naming it.
-func TestHandWrittenBackupLinesOfAnOlderModuleArePlaced(t *testing.T) {
-	pg, err := ParseManifest([]byte(`{"module":"pg","version":"1",
-		"resources":[{"id":"dumps","type":"directory","path":"/srv/pg/dumps","mode":"0700"}],
-		"contributions":[{"seat":"node-backup","kind":"backup","content":"run pg-dump-all\npath ${dir:dumps}"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	mail, err := ParseManifest([]byte(`{"module":"mail","version":"1",
-		"resources":[{"id":"spool","type":"directory","mode":"0700"}],
-		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:spool}"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	placed, _, err := seatContributions([]Manifest{pg, mail}, Manifest{}, BackupSeat+":"+"backup", Rendering{}, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{"# pg\nrun pg-dump-all\npath /srv/pg/dumps\n", "# mail\npath /var/lib/mail/spool\n"} {
-		if !strings.Contains(placed, want) {
-			t.Errorf("placed contributions lack %q:\n%s", want, placed)
-		}
-	}
-	if strings.Contains(placed, "${dir:") {
-		t.Errorf("a directory reached the holder unfilled:\n%s", placed)
-	}
-}
diff --git a/internal/catalogue/bootstrap_cycle_test.go b/internal/catalogue/bootstrap_cycle_test.go
deleted file mode 100644
index 9cbbd670..00000000
--- a/internal/catalogue/bootstrap_cycle_test.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The module that provides the artifact store may not be delivered through it.
-//
-// Building publishes to the store and the builder will not start without one, so a module that
-// provides the store and also builds something asks the mesh to put an artifact into the thing
-// that artifact is needed to create. On a mesh new enough to have no registry, that is a build
-// that never returns (novox/hq 04-ISSUES/029).
-func TestTheArtifactStoreCannotBeDeliveredThroughItself(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
-		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
-		`"build":{"artifacts":[{"name":"registry","kind":"upstream","from":"registry:2"}]},` +
-		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
-		`"artifact":"registry","ports":["5000:5000"]}]}`))
-	if err == nil {
-		t.Fatal("a registry module that builds its own image was accepted; the build has " +
-			"nowhere to publish until the module it belongs to is already running")
-	}
-	if !strings.Contains(err.Error(), "artifact-store") {
-		t.Fatalf("refused without naming the provision the cycle turns on: %v", err)
-	}
-}
-
-// Naming the image directly is the way out, and must stay accepted.
-func TestAnArtifactStoreThatNamesItsImageIsAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"registry","version":"1",` +
-		`"provides":[{"name":"artifact-store","scope":"mesh"}],` +
-		`"resources":[{"id":"store","type":"container","name":"mesh-registry",` +
-		`"image":"registry@sha256:` +
-		`266f282fabd7cd3df053ee7c658c77b42380d1a2f0d8e5a1c0d7a6d5b5c4a3b2",` +
-		`"ports":["5000:5000"]}]}`))
-	if err != nil {
-		t.Fatalf("the one way an artifact store can be delivered was refused: %v", err)
-	}
-}
-
-// And an ordinary module still builds whatever it likes.
-func TestAModuleThatDoesNotProvideTheStoreStillBuilds(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"forge","version":"1",` +
-		`"build":{"artifacts":[{"name":"forge","kind":"upstream","from":"gitea/gitea:1.22"}]},` +
-		`"resources":[{"id":"run","type":"container","name":"forge","artifact":"forge"}]}`))
-	if err != nil {
-		t.Fatalf("an ordinary module was caught by a rule about the artifact store: %v", err)
-	}
-}
-
-// A mapping that names an address still names the port, and the machine side is still the middle.
-//
-// The foundation bundle writes "127.0.0.1:5432:5432" today, so the shape is not hypothetical.
-// Found in review: the first cut split on the first colon, read "127.0.0.1" as the machine port,
-// failed to parse it, and silently skipped the mapping — which put the filter back on the
-// declared port, the exact fault MachineSide was written to end.
-func TestAnAddressedMappingStillNamesThePort(t *testing.T) {
-	m := Manifest{Module: "store", Resources: []map[string]any{
-		{"type": "container", "id": "server", "ports": []any{"127.0.0.1:8080:80"}},
-	}}
-	for _, named := range []int{8080, 80} {
-		at, mayAssign := m.MachineSide(named)
-		if mayAssign {
-			t.Fatalf("%d was reassigned though the manifest published it explicitly", named)
-		}
-		if at != 8080 {
-			t.Fatalf("naming %d gave %d; the machine side of 127.0.0.1:8080:80 is 8080", named, at)
-		}
-	}
-}
diff --git a/internal/catalogue/bound_into_files_test.go b/internal/catalogue/bound_into_files_test.go
deleted file mode 100644
index 7abfa3e7..00000000
--- a/internal/catalogue/bound_into_files_test.go
+++ /dev/null
@@ -1,265 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// A consumer writes its own connection string (novox/hq 04-ISSUES/023).
-//
-// Everything needed for one now reaches the file that needs it: the address and port from what the
-// provider serves, the name to present from what the mesh decided, the database name from what the
-// module itself contributed, and the password through the sealed hole the host fills.
-func TestAConsumerCanWriteAConnectionString(t *testing.T) {
-	r := Resolution{
-		Node: "workstation",
-		Modules: []Manifest{{
-			Module:   "keycloak",
-			Requires: []string{"postgres-database"},
-			Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
-			Resources: []map[string]any{{
-				"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
-				"mode": "0600",
-				"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:" +
-					"${bound:postgres-database:port}/keycloak\n" +
-					"KC_DB_USERNAME=${bound:postgres-database:as}\n" +
-					"KC_DB_PASSWORD=${secret:postgres-database}\n",
-			}},
-		}},
-		Needs: []Needed{{
-			Name: "postgres-database", From: "anchor", At: "anchor.internal", For: "keycloak",
-			Sealed: "sealed-db", Serves: map[string]any{"port": float64(5432)},
-		}},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := fileNamed(out, "keycloak.dbenv")
-	if file == nil {
-		t.Fatalf("no file in %v", out)
-	}
-	got := file["content"].(string)
-
-	want := "KC_DB_URL=jdbc:postgresql://anchor.internal:5432/keycloak\n" +
-		"KC_DB_USERNAME=mesh_workstation_keycloak\n" +
-		"KC_DB_PASSWORD=${secret:postgres-database}\n"
-	if got != want {
-		t.Errorf("the consumer cannot connect with what it was given:\n got %q\nwant %q", got, want)
-	}
-	// The password is still a hole. Only the host may fill that one, and only on the machine.
-	if sealed, _ := file["secrets"].(map[string]any); sealed["postgres-database"] != "sealed-db" {
-		t.Errorf("the credential did not travel with the file: %v", file)
-	}
-}
-
-// A provider answered on its consumer's own machine is announced at the port the machine PUBLISHES
-// it on, not the port the module declared (novox/hq 04-ISSUES/038).
-//
-// Issue 018 made the same-node provider announced at all; this is the promise after it — that the
-// port a co-located consumer is told is the one actually listening at the address it is handed. The
-// mesh assigns a bare `ports` mapping a host port (here the container's 5432 becomes 15432 on this
-// machine), and it must announce 15432, or the consumer dials workstation.internal:5432 where the
-// provider is not published. Cross-node consumers already got this (the plan re-derives the served
-// facts with the provider's assignment); the same-node need was settled before the assignment and
-// carried the declared port until now.
-func TestASameNodeProviderIsAnnouncedAtThePortItIsPublishedOn(t *testing.T) {
-	provider := Manifest{
-		Module: "postgres", Version: "1",
-		Provides: FromAnywhere("postgres-database"),
-		Listens:  []Listening{{Port: 5432, Protocol: "tcp", From: "mesh"}},
-		Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "postgres",
-			"ports": []any{"5432"},
-		}},
-	}
-	consumer := Manifest{
-		Module: "keycloak", Version: "1", Requires: []string{"postgres-database"},
-		Resources: []map[string]any{{
-			"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env", "mode": "0600",
-			"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:" +
-				"${bound:postgres-database:port}/keycloak\n",
-		}},
-	}
-	r, err := Resolve(shelf(provider, consumer),
-		[]string{"postgres", "keycloak"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// The mesh assigned the container's 5432 to 15432 on this machine.
-	out, err := r.Declaration(Rendering{Ports: map[string]map[int]int{"postgres": {5432: 15432}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Where the provider is actually published: the assigned host port, on the machine at large.
-	server := fileNamed(out, "postgres.server")
-	if server == nil {
-		t.Fatalf("the provider container is not in the declaration: %v", out)
-	}
-	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "15432:5432") {
-		t.Fatalf("the provider was not published on the assigned port: %v", server["ports"])
-	}
-
-	// What the consumer was told to dial: the SAME port, at the announced address — not the 5432 the
-	// module declared, which is closed on that address.
-	dbenv := fileNamed(out, "keycloak.dbenv")
-	if dbenv == nil {
-		t.Fatalf("the consumer's binding file is not in the declaration: %v", out)
-	}
-	got := dbenv["content"].(string)
-	want := "KC_DB_URL=jdbc:postgresql://workstation.internal:15432/keycloak\n"
-	if got != want {
-		t.Errorf("the consumer dials a port the provider does not listen on:\n got %q\nwant %q",
-			got, want)
-	}
-}
-
-// A port is 5432, not 5432.000000 — which is what a number decoded from JSON would write, and what
-// every connection string in the world would refuse.
-func TestAPortIsWrittenAsAPort(t *testing.T) {
-	if got := plainly(float64(5432)); got != "5432" {
-		t.Errorf("a port was rendered as %q", got)
-	}
-	if got := plainly("postgres"); got != "postgres" {
-		t.Errorf("a string was rendered as %q", got)
-	}
-}
-
-// The name the provider will create is the name the consumer is told to present. One derivation,
-// so the two agree by construction rather than by two conventions written on the same day.
-func TestTheProviderAndTheConsumerAgreeOnTheName(t *testing.T) {
-	provider, err := Resolve(shelf(Manifest{
-		Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database"),
-		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
-		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
-	}), []string{"postgres"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := provider.Declaration(Rendering{Grants: []Grant{{
-		Provision: "postgres-database", Consumer: "workstation", From: "keycloak",
-		Values: map[string]any{"name": "keycloak"}, Sealed: "sealed",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var told string
-	for _, res := range out {
-		if res["path"] == "/var/lib/postgres/grants/mesh.json" {
-			told = res["content"].(string)
-		}
-	}
-	if !strings.Contains(told, `"as": "mesh_workstation_keycloak"`) {
-		t.Errorf("the provider was not told what to call the login: %s", told)
-	}
-	if told == "" {
-		t.Fatal("the provider was told nothing at all")
-	}
-	// Which is exactly what the consumer, on its own machine, is told to present.
-	if ConsumerIdentity("workstation", "keycloak") != "mesh_workstation_keycloak" {
-		t.Errorf("got %q", ConsumerIdentity("workstation", "keycloak"))
-	}
-}
-
-// A binding the module does not have is a typo, refused where it was written.
-func TestAFileCannotNameABindingTheModuleDoesNotHave(t *testing.T) {
-	r := Resolution{
-		Node: "workstation",
-		Modules: []Manifest{{
-			Module: "keycloak", Requires: []string{"postgres-database"},
-			Resources: []map[string]any{{
-				"id": "conf", "type": "file", "path": "/etc/keycloak.conf",
-				"content": "host=${bound:s3-bucket:at}\n",
-			}},
-		}},
-		Needs: []Needed{{Name: "postgres-database", From: "anchor", At: "a", For: "keycloak"}},
-	}
-	_, err := r.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a module read a binding it does not have")
-	}
-	if !strings.Contains(err.Error(), "postgres-database") {
-		t.Errorf("the refusal does not say what it could have named: %v", err)
-	}
-}
-
-// A key the provider does not serve is refused too. Written through, the literal placeholder
-// becomes a hostname, and the failure names neither the module nor the mesh.
-func TestAKeyTheProviderDoesNotServeIsRefused(t *testing.T) {
-	r := Resolution{
-		Node: "workstation",
-		Modules: []Manifest{{
-			Module: "keycloak", Requires: []string{"postgres-database"},
-			Resources: []map[string]any{{
-				"id": "conf", "type": "file", "path": "/etc/keycloak.conf",
-				"content": "sock=${bound:postgres-database:socket}\n",
-			}},
-		}},
-		Needs: []Needed{{
-			Name: "postgres-database", From: "anchor", At: "a", For: "keycloak",
-			Serves: map[string]any{"port": float64(5432)},
-		}},
-	}
-	_, err := r.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a module read a key nothing serves, and the placeholder became a value")
-	}
-	if !strings.Contains(err.Error(), `"port"`) {
-		t.Errorf("the refusal does not say what is served: %v", err)
-	}
-}
-
-// A name too long to stay distinct is refused before anything is created.
-func TestAnIdentityTooLongToBeDistinctIsRefused(t *testing.T) {
-	if err := CheckIdentity("anchor", "keycloak"); err != nil {
-		t.Fatalf("an ordinary consumer was refused: %v", err)
-	}
-	if err := CheckIdentity(strings.Repeat("n", 40), strings.Repeat("m", 40)); err == nil {
-		t.Fatal("an identity that providers would shorten was accepted")
-	}
-}
-
-// Two modules on one node get two identities, which is the whole point of both issues.
-func TestTwoModulesOnOneNodeAreTwoIdentities(t *testing.T) {
-	if ConsumerIdentity("anchor", "gitea") == ConsumerIdentity("anchor", "keycloak") {
-		t.Fatal("two consumers on one machine share an identity")
-	}
-	// And one module on two nodes, likewise.
-	if ConsumerIdentity("anchor", "gitea") == ConsumerIdentity("laptop", "gitea") {
-		t.Fatal("one module on two machines shares an identity")
-	}
-}
-
-// A machine's resolver configuration must name its resolver by address — it cannot resolve the name
-// of the thing it resolves names with (novox/hq ADR 0194). So a binding offers the providing
-// machine's private address beside its name, and only when the machine has one.
-func TestABindingOffersTheProvidersAddress(t *testing.T) {
-	consumer := func() Resolution {
-		return Resolution{
-			Node: "workstation",
-			Modules: []Manifest{{
-				Module:   "resolv-conf",
-				Requires: []string{"wildcard-resolution"},
-				Resources: []map[string]any{{
-					"id": "resolv", "type": "file", "path": "/etc/resolv.conf", "mode": "0644",
-					"content": "nameserver ${bound:wildcard-resolution:address}\n",
-				}},
-			}},
-			Needs: []Needed{{Name: "wildcard-resolution", From: "anchor", At: "anchor.internal", For: "resolv-conf"}},
-		}
-	}
-	out, err := consumer().Declaration(Rendering{Machines: map[string]string{"anchor.internal": "10.77.0.1"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := fileNamed(out, "resolv-conf.resolv")["content"]; got != "nameserver 10.77.0.1\n" {
-		t.Fatalf("the resolver is not named by its address: %q", got)
-	}
-	// A machine with no address yet: refused, never written with a blank where the address belongs.
-	if _, err := consumer().Declaration(Rendering{}); err == nil {
-		t.Fatal("a file naming an address the mesh does not have was composed")
-	}
-}
diff --git a/internal/catalogue/bound_test.go b/internal/catalogue/bound_test.go
deleted file mode 100644
index d152fff4..00000000
--- a/internal/catalogue/bound_test.go
+++ /dev/null
@@ -1,257 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A consumer of a provision that keeps its data stays bound where its data is (novox/hq ADR 0232,
-// issue 273).
-//
-// The incident, exactly: a machine runs its own store and five consumers of it; the mesh's store seat
-// is held by the store on another machine. Issue 258's rule — the seat's holder elsewhere answers
-// before this machine's own provider — re-bound all five to the holder, each was made a fresh, empty
-// database there, and nothing said so.
-
-var incidentConsumers = []string{"board", "listings", "workflows", "agents", "game"}
-
-func storeMesh() map[string]Manifest {
-	shelf := map[string]Manifest{
-		"store": {Module: "store", Version: "1",
-			Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
-			Claims:   []Claim{{Name: "mesh-store", Scope: ScopeMesh}},
-			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
-			Grants:   map[string]string{"postgres-database": "/grants"}},
-		"resolver": {Module: "resolver", Version: "1",
-			Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
-			Claims:   []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}},
-		"network": {Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
-	}
-	for _, c := range incidentConsumers {
-		shelf[c] = Manifest{Module: c, Version: "1", Requires: []string{"postgres-database"}}
-	}
-	return shelf
-}
-
-// storeWorld is the rest of the mesh as the home server's plan sees it: the anchor runs a store and a
-// resolver and holds both seats; the home server runs its own of each.
-func storeWorld() World {
-	w := World{Offered: map[string][]Provider{
-		"postgres-database": {
-			{Node: "anchor", At: "anchor.internal", Module: "store", Serves: map[string]any{"port": 5432}},
-			{Node: "home", At: "home.internal", Module: "store", Serves: map[string]any{"port": 5434}},
-		},
-		"wildcard-resolution": {
-			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
-			{Node: "home", At: "home.internal", Module: "resolver"},
-		},
-	}}
-	w.Held = []Held{
-		{Claim: "mesh-store", Scope: ScopeMesh, Node: "anchor", Module: "store"},
-		{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "anchor", Module: "resolver"},
-	}
-	w.Holdings = w.Held
-	return w
-}
-
-var home = Node{Name: "home", At: "home.internal"}
-
-func homeAssigned() []string {
-	return append([]string{"store", "resolver", "network"}, incidentConsumers...)
-}
-
-func boundFrom(t *testing.T, r Resolution, consumer, provision string) Needed {
-	t.Helper()
-	for _, n := range r.Needs {
-		if n.For == consumer && n.Name == provision {
-			return n
-		}
-	}
-	t.Fatalf("no binding of %s for %s: %+v", consumer, provision, r.Needs)
-	return Needed{}
-}
-
-func TestTheIncidentAMachinesOwnStoreKeepsItsConsumersWhenTheSeatIsHeldElsewhere(t *testing.T) {
-	got, err := Resolve(storeMesh(), homeAssigned(), home, storeWorld())
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range incidentConsumers {
-		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" || n.Module != "store" {
-			t.Errorf("%s bound to %s/%s; its data is on the store beside it (issue 273)", c, n.From, n.Module)
-		}
-	}
-	// And the resolver, which keeps nothing of anybody's, still answers from the seat's holder (258).
-	if n := boundFrom(t, got, "network", "wildcard-resolution"); n.From != "anchor" {
-		t.Errorf("the resolver bound to %s; the seat is held on anchor (issue 258)", n.From)
-	}
-	if len(got.Kept) != 0 {
-		t.Errorf("nothing was moved, and %d kept: %+v", len(got.Kept), got.Kept)
-	}
-}
-
-func TestTheIncidentWithEveryConsumerOnRecordStillMovesNothing(t *testing.T) {
-	w := storeWorld()
-	w.Bound = map[string]map[string]Chosen{}
-	for _, c := range incidentConsumers {
-		w.Bound[c] = map[string]Chosen{"postgres-database": {Node: "home", Module: "store"}}
-	}
-	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range incidentConsumers {
-		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" {
-			t.Errorf("%s bound to %s", c, n.From)
-		}
-	}
-	if len(got.Kept) != 0 {
-		t.Errorf("kept %+v", got.Kept)
-	}
-}
-
-func TestAPinElsewhereStillMovesAStoresConsumers(t *testing.T) {
-	w := storeWorld()
-	w.Pinned = map[string]Chosen{"postgres-database": {Node: "anchor", Module: "store"}}
-	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
-	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" || n.Module != "store" {
-		t.Errorf("bound to %s/%s; a person pinned it to anchor", n.From, n.Module)
-	}
-	if len(got.Kept) != 0 {
-		t.Errorf("a pin is a person's move, not one to keep: %+v", got.Kept)
-	}
-}
-
-// A consumer on a machine with no store of its own, bound to one store, when the seat moves to
-// another: the holder would answer, and the binding stays.
-func laptopWorld(holder string) World {
-	w := storeWorld()
-	w.Held = []Held{{Claim: "mesh-store", Scope: ScopeMesh, Node: holder, Module: "store"}}
-	w.Holdings = w.Held
-	return w
-}
-
-var laptop = Node{Name: "laptop", At: "laptop.internal"}
-
-func TestABoundConsumerStaysWhenTheSeatsHolderChanges(t *testing.T) {
-	w := laptopWorld("home")
-	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "anchor", Module: "store"}}}
-	got, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	n := boundFrom(t, got, "board", "postgres-database")
-	if n.From != "anchor" || n.At != "anchor.internal" || n.Serves["port"] != 5432 {
-		t.Fatalf("bound to %s at %s %v; its data is on anchor", n.From, n.At, n.Serves)
-	}
-	if len(got.Kept) != 1 {
-		t.Fatalf("the move was not said: %+v", got.Kept)
-	}
-	k := got.Kept[0]
-	if k.Bound != (Chosen{"anchor", "store"}) || k.Would != (Chosen{"home", "store"}) || k.Consumer != "board" {
-		t.Fatalf("kept %+v", k)
-	}
-	for _, want := range []string{"would move board's postgres-database from anchor/store to home/store",
-		"its data is on anchor/store", "pin laptop postgres-database home store", "move the data first"} {
-		if !strings.Contains(k.String(), want) {
-			t.Errorf("%q does not say %q", k.String(), want)
-		}
-	}
-	// Without a record it is a binding being made, and the holder answers it as before.
-	w.Bound = nil
-	got, err = Resolve(storeMesh(), []string{"board"}, laptop, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "home" {
-		t.Errorf("a new consumer bound to %s; the seat is held on home", n.From)
-	}
-}
-
-func TestABoundConsumerWhoseProviderIsGoneIsRefusedNotMoved(t *testing.T) {
-	w := laptopWorld("anchor")
-	w.Offered["postgres-database"] = w.Offered["postgres-database"][:1] // only anchor's store is left
-	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
-	_, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
-	if err == nil {
-		t.Fatal("bound to home's store, which is gone, and answered by anchor's — the silent move")
-	}
-	for _, want := range []string{"board on laptop is bound to home/store", "home/store no longer provides it",
-		"pin laptop postgres-database anchor store"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("%q does not say %q", err, want)
-		}
-	}
-}
-
-func TestAMachinesOwnStoreUnassignedRefusesItsBoundConsumers(t *testing.T) {
-	w := storeWorld()
-	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
-	_, err := Resolve(storeMesh(), []string{"board"}, home, w)
-	if err == nil || !strings.Contains(err.Error(), "store no longer runs on home") {
-		t.Fatalf("got %v", err)
-	}
-}
-
-// The first pass asks only what a machine offers, and is never refused by a binding.
-func TestTheFirstPassKeepsNoBinding(t *testing.T) {
-	w := storeWorld()
-	w.Unchecked = true
-	w.Bound = map[string]map[string]Chosen{"board": {"postgres-database": {Node: "gone", Module: "store"}}}
-	if _, err := Resolve(storeMesh(), []string{"board"}, laptop, w); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestAnOfferSaysWhetherItKeepsConsumerData(t *testing.T) {
-	var o Offer
-	if err := json.Unmarshal([]byte(`{"name":"wildcard-resolution","scope":"mesh","keeps-consumer-data":false}`), &o); err != nil {
-		t.Fatal(err)
-	}
-	if o.KeepsConsumerData == nil || *o.KeepsConsumerData {
-		t.Fatalf("read %+v", o)
-	}
-	out, err := json.Marshal(o)
-	if err != nil || !strings.Contains(string(out), `"keeps-consumer-data":false`) {
-		t.Fatalf("wrote %s, %v", out, err)
-	}
-	yes, no := true, false
-	granting := Manifest{Module: "g", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}, Grants: map[string]string{"p": "/g"}}
-	if !granting.KeepsConsumerData("p") {
-		t.Error("a provider granting each consumer a credential keeps what it writes, unsaid")
-	}
-	if (Manifest{Module: "r", Provides: []Offer{{Name: "p", Scope: ScopeMesh}}}).KeepsConsumerData("p") {
-		t.Error("a provider granting nothing keeps nothing, unsaid")
-	}
-	granting.Provides[0].KeepsConsumerData = &no
-	if granting.KeepsConsumerData("p") {
-		t.Error("what an offer says, it gets")
-	}
-	said := Manifest{Module: "s", Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &yes}}}
-	if !said.KeepsConsumerData("p") || !KeepsConsumerData(map[string]Manifest{"s": said, "r": {Module: "r",
-		Provides: []Offer{{Name: "p", Scope: ScopeMesh, KeepsConsumerData: &no}}}}, "p") {
-		t.Error("a name any provider says keeps data keeps data")
-	}
-}
-
-// An offer saying it keeps nothing is answered by the seat's holder as the resolver is, even where it
-// grants a credential.
-func TestAStoreSayingItKeepsNothingFollowsTheSeat(t *testing.T) {
-	shelf := storeMesh()
-	no := false
-	s := shelf["store"]
-	s.Provides = []Offer{{Name: "postgres-database", Scope: ScopeMesh, KeepsConsumerData: &no}}
-	shelf["store"] = s
-	got, err := Resolve(shelf, homeAssigned(), home, storeWorld())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" {
-		t.Errorf("bound to %s; it keeps nothing, and the seat is held on anchor", n.From)
-	}
-}
diff --git a/internal/catalogue/broker_seat_test.go b/internal/catalogue/broker_seat_test.go
deleted file mode 100644
index c04389ab..00000000
--- a/internal/catalogue/broker_seat_test.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The mesh's bus is one per mesh, read from the catalogue beside this checkout.
-//
-// **This is step 2's claim, and it is checked here rather than in a bed** (novox/hq ADR 0116):
-// adoption puts the NATS server into the `mesh-broker` seat on a mesh that is already running,
-// and the property that matters is that a second one anywhere is refused *when it is assigned*,
-// not discovered later as two servers holding different halves of the mesh's traffic. A second
-// bus is not a degraded mesh; it is two meshes that both believe they are the one.
-func TestASecondMeshBusAnywhereIsRefusedByName(t *testing.T) {
-	nats := catalogueManifest(t, "nats")
-
-	if _, err := Resolve(shelf(nats), []string{"nats"}, workstation(), World{}); err != nil {
-		t.Fatalf("the bus alone does not resolve: %v", err)
-	}
-
-	elsewhere := World{Held: []Held{{Claim: "mesh-broker", Scope: ScopeMesh,
-		Node: "anchor", Module: "nats"}}}
-	other := workstation()
-	other.Name = "laptop"
-	_, err := Resolve(shelf(nats), []string{"nats"}, other, elsewhere)
-	if err == nil {
-		t.Fatal("a second bus was accepted on another machine")
-	}
-	if !strings.Contains(err.Error(), "mesh-broker") || !strings.Contains(err.Error(), "one per mesh") {
-		t.Fatalf("refused without naming the seat: %v", err)
-	}
-}
-
-// The seat is the server's role, not the product's name (novox/hq ADR 0079). A different
-// implementation of the bus claims the same seat, and the mesh refuses it for the same reason —
-// which is the property that lets the bus be replaced at all.
-func TestTheSeatRefusesADifferentBusToo(t *testing.T) {
-	nats := catalogueManifest(t, "nats")
-	held := World{Held: []Held{{Claim: "mesh-broker", Scope: ScopeMesh,
-		Node: "anchor", Module: "some-other-broker"}}}
-	other := workstation()
-	other.Name = "laptop"
-	if _, err := Resolve(shelf(nats), []string{"nats"}, other, held); err == nil {
-		t.Fatal("the seat admitted a second holder because the module's name differed")
-	}
-}
-
-// The old broker is gone from the catalogue (novox/hq ADR 0131, design 28 task 5.4), so it is no
-// longer a fixture here. That two eligible holders stand beside each other with one on record is
-// pinned in holdings_test.go against manifests this package owns.
-
-// **A seat and the interface it delivers are different names, and renaming one must not rename
-// the other** (novox/hq ADR 0118). This nearly went wrong: the seats were renamed to the `mesh-*`
-// prefix, and a blanket search-and-replace also renamed `npm-package-registry` and `git` where
-// they are *provisions* — which a consumer requires and a provider offers. The tests failed with
-// "the package registry is served on <nil>", which does not say "you renamed an interface".
-func TestRenamingASeatDidNotRenameTheInterfaceItDelivers(t *testing.T) {
-	for _, pair := range []struct{ seat, delivers string }{
-		{"git", "git"},
-		{"npm-package-registry", "npm-package-registry"},
-		{"mesh-artifact-store", "artifact-store"},
-		{"mesh-store", "postgres-database"},
-		{"mesh-broker", "mesh-bus"},
-	} {
-		s, known := SeatNamed(pair.seat)
-		if !known {
-			t.Fatalf("%q is not a seat", pair.seat)
-		}
-		if s.Delivers != pair.delivers {
-			t.Errorf("the %s seat delivers %q, expected %q — renaming the seat moved the "+
-				"interface with it, and every consumer requiring it would stop resolving",
-				pair.seat, s.Delivers, pair.delivers)
-		}
-		// **Three of these deliberately share a name with what they deliver**, and that is not an
-		// incomplete rename. Renaming a seat that delivers a provision cascades to every consumer
-		// requiring it, with a mesh-wide window where a holder stops resolving mid-flight — so the
-		// trunk deferred exactly those three (novox/hq ADR 0121) while renaming the node-scoped ones.
-		// What this test is for is the other direction: that renaming a seat never moves the
-		// interface, which once produced "the package registry is served on <nil>".
-	}
-}
-
-// A manifest written against an old seat name is told what it became rather than refused as
-// unknown. **That map is the controller's store now, not this package** (novox/hq ADR 0122): a
-// rename is a row, so the courtesy survives a rename nobody recompiled for. Checked where the
-// table is read, not here, where there is no longer a hardcoded list to check against.
diff --git a/internal/catalogue/brokered_test.go b/internal/catalogue/brokered_test.go
deleted file mode 100644
index c379f718..00000000
--- a/internal/catalogue/brokered_test.go
+++ /dev/null
@@ -1,332 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// Where the answer to a requirement is allowed to live.
-//
-// A shell, a display server and a private network have to be on the machine that needs them. A
-// database does not — it runs somewhere and is reached over the network. Both were written
-// `requires`, so both were answered the same way, and the second answer was to install PostgreSQL
-// on every machine that runs a web application.
-
-// onNetwork is a set of providers, all of them reachable. Written as a helper because a machine
-// that cannot reach the one answering its requirement is its own case, tested separately.
-// reachable is this machine, on the private network.
-func reachable() Node {
-	n := workstation()
-	n.At = "workstation.internal"
-	return n
-}
-
-func onNetwork(nodes ...string) map[string][]Provider {
-	out := make([]Provider, 0, len(nodes))
-	for _, n := range nodes {
-		out = append(out, Provider{Node: n, At: n + ".internal", Module: "postgres"})
-	}
-	return map[string][]Provider{"postgres-database": out}
-}
-
-func brokeredShelf() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database")},
-		Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}},
-	)
-}
-
-func TestADatabaseIsNotInstalledOnEveryMachineThatUsesOne(t *testing.T) {
-	// The fault this whole distinction exists for.
-	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: onNetwork("anchor")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if have := strings.Join(names(got), " "); strings.Contains(have, "postgres") {
-		t.Fatalf("using a database installed one here: %s", have)
-	}
-}
-
-func TestWhatAMachineTakesFromElsewhereIsRecorded(t *testing.T) {
-	// It is the only part of a node's set that stops working when a *different* machine goes
-	// away, and it is where a credential will have to be handed back.
-	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: onNetwork("anchor")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 {
-		t.Fatalf("got %v", got.Needs)
-	}
-	if got.Needs[0].Name != "postgres-database" || got.Needs[0].From != "anchor" {
-		t.Fatalf("got %v", got.Needs[0])
-	}
-	if got.Needs[0].For != "meshboard" {
-		t.Fatalf("it does not say what wanted it: %v", got.Needs[0])
-	}
-}
-
-func TestNothingInTheMeshProvidingItIsRefusedWithSomewhereToPutIt(t *testing.T) {
-	// Refused rather than installed here. Choosing a machine to put a database on is a decision
-	// with consequences, and nothing resolving a web application should make it silently.
-	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("a database was found in a mesh that has none")
-	}
-	if !strings.Contains(err.Error(), "assign") || !strings.Contains(err.Error(), "postgres") {
-		t.Fatalf("the refusal does not say what to do: %v", err)
-	}
-}
-
-func TestTwoNodesProvidingItIsRefusedRatherThanPicked(t *testing.T) {
-	// Same rule as everywhere else. Picking one would be a guess about which database a person
-	// meant, and the wrong guess is somebody's data in the wrong place.
-	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: onNetwork("anchor", "archive")})
-	if err == nil {
-		t.Fatal("one of two databases was picked silently")
-	}
-	for _, want := range []string{"anchor", "archive", "pin"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
-
-func TestSayingWhichOneSettlesIt(t *testing.T) {
-	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{
-			Offered: onNetwork("anchor", "archive"),
-			Pinned:  map[string]Chosen{"postgres-database": {Node: "archive", Module: "postgres"}},
-		})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 || got.Needs[0].From != "archive" {
-		t.Fatalf("the choice was not taken: %v", got.Needs)
-	}
-}
-
-func TestBeingPointedAtAMachineThatDoesNotProvideItIsRefused(t *testing.T) {
-	// Rather than falling back to one that does. A fallback would quietly move somebody's data to
-	// a machine they did not choose, which is the whole reason the question is asked.
-	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{
-			Offered: onNetwork("anchor", "archive"),
-			Pinned:  map[string]Chosen{"postgres-database": {Node: "somewhere-else", Module: "postgres"}},
-		})
-	if err == nil {
-		t.Fatal("a machine was silently given a different database from the one chosen")
-	}
-	if !strings.Contains(err.Error(), "somewhere-else") {
-		t.Fatalf("the refusal does not say what was chosen: %v", err)
-	}
-}
-
-func TestOneProviderDoesNotOverruleAChoice(t *testing.T) {
-	// A single answer is normally taken silently. Not when somebody said they wanted a different
-	// one -- that is the mesh overruling a person, which it does nowhere else.
-	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(),
-		World{
-			Offered: onNetwork("anchor"),
-			Pinned:  map[string]Chosen{"postgres-database": {Node: "archive", Module: "postgres"}},
-		})
-	if err == nil {
-		t.Fatal("the only database was used although another was chosen")
-	}
-	if !strings.Contains(err.Error(), "only anchor/postgres provides it") {
-		t.Fatalf("the refusal does not say what is available: %v", err)
-	}
-}
-
-func TestACatalogueThatDisagreesAboutScopeIsRefused(t *testing.T) {
-	// If one module says a database is local and another says it is anywhere, the same
-	// requirement means two things depending on which one happens to answer it.
-	_, err := Resolve(shelf(
-		Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database")},
-		Manifest{Module: "sqlite", Version: "1", Provides: Offers("postgres-database")},
-		Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}},
-	), []string{"meshboard"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("a catalogue that disagrees about where a database lives was accepted")
-	}
-	if !strings.Contains(err.Error(), "two things") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestALocalRequirementIsStillAnsweredLocally(t *testing.T) {
-	// The change must not have made everything brokered. A shell is still installed here.
-	got, err := Resolve(shelf(
-		Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")},
-		Manifest{Module: "tools", Version: "1", Requires: []string{"shell"}},
-	), []string{"tools"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if have := strings.Join(names(got), " "); !strings.Contains(have, "zsh") {
-		t.Fatalf("a shell was not installed on the machine that needs one: %s", have)
-	}
-}
-
-func TestTheShortFormStillMeansHere(t *testing.T) {
-	// `"provides": ["shell"]` must keep meaning what it meant, or every existing manifest
-	// silently changes meaning.
-	m, err := ParseManifest([]byte(`{"module":"zsh","version":"1","provides":["shell"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Provides) != 1 || m.Provides[0].At() != ScopeNode {
-		t.Fatalf("a plain name is no longer node-scoped: %v", m.Provides)
-	}
-}
-
-func TestASiteScopedProvisionIsRefused(t *testing.T) {
-	// Meaningful for a claim — one DHCP server per segment — and not yet meaningful for a
-	// provision, because nothing knows how to reach "the one at my site".
-	_, err := ParseManifest([]byte(
-		`{"module":"dns","version":"1","provides":[{"name":"resolver","scope":"site"}]}`))
-	if err == nil {
-		t.Fatal("a site-scoped provision was accepted")
-	}
-	if !strings.Contains(err.Error(), "site") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-// Being told, which is the difference between knowing and being able to.
-
-func boundShelf() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database"),
-			Serves: map[string]map[string]any{"postgres-database": {"port": 5432, "driver": "postgres"}}},
-		Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"},
-			Binds: map[string]string{"postgres-database": "/etc/meshboard/database.json"}},
-	)
-}
-
-func binding(t *testing.T, out []map[string]any) map[string]any {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] != "/etc/meshboard/database.json" {
-			continue
-		}
-		var parsed map[string]any
-		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
-			t.Fatalf("what the app is told is not readable: %v", err)
-		}
-		return parsed
-	}
-	t.Fatalf("the app was told nothing: %v", out)
-	return nil
-}
-
-func TestAnAppIsToldWhereItsDatabaseIs(t *testing.T) {
-	// Knowing it needs the anchor's database is useless to the program that needs it unless the
-	// program is told. This is the whole point of the field.
-	got, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal",
-			Serves: map[string]any{"port": 5432, "driver": "postgres"}}}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	told := binding(t, mustDeclare(t, got))
-	if told["from"] != "anchor" || told["at"] != "anchor.internal" {
-		t.Fatalf("it was not told where: %v", told)
-	}
-	serves, _ := told["serves"].(map[string]any)
-	if serves["port"] != float64(5432) || serves["driver"] != "postgres" {
-		t.Fatalf("it was not told how: %v", serves)
-	}
-}
-
-func TestItSaysWhereTheCredentialIsInstead(t *testing.T) {
-	// A missing field looks like a bug; a stated absence looks like a boundary. Somebody wiring
-	// this up must not spend an afternoon looking for the password field.
-	//
-	// It used to say only that the mesh had no way to issue one, which stopped being true when
-	// 021 was fixed. A stated absence is only useful while it is accurate — once it is not, it
-	// sends the reader somewhere there is nothing to find.
-	got, _ := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
-	told := binding(t, mustDeclare(t, got))
-	note, _ := told["generated"].(string)
-	if !strings.Contains(note, "not here") || !strings.Contains(note, "secrets") {
-		t.Fatalf("the file does not say where the credential is instead: %v", note)
-	}
-	for key := range told {
-		if strings.Contains(key, "password") || strings.Contains(key, "secret") {
-			t.Fatalf("something that looks like a credential appeared: %q", key)
-		}
-	}
-}
-
-func TestTwoMachinesThatCannotReachEachOtherAreRefused(t *testing.T) {
-	// An app on one machine and a database on another that share no private network is a mesh
-	// that reports itself configured and does not work. Said here rather than discovered as a
-	// connection timing out.
-	_, err := Resolve(boundShelf(), []string{"meshboard"}, workstation(), // not on the network
-		World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
-	if err == nil {
-		t.Fatal("an app was pointed at a database it has no path to")
-	}
-	if !strings.Contains(err.Error(), "private network") {
-		t.Fatalf("the refusal does not say what is wrong: %v", err)
-	}
-	if !strings.Contains(err.Error(), meshNetwork) {
-		t.Fatalf("the refusal does not say what to assign: %v", err)
-	}
-}
-
-func TestTheProviderBeingOffTheNetworkIsAlsoRefused(t *testing.T) {
-	// Both directions, because the failure is identical from either end and the remedy differs.
-	_, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(),
-		World{Offered: map[string][]Provider{"postgres-database": {{Node: "anchor"}}}})
-	if err == nil {
-		t.Fatal("an app was pointed at a database that is not on the private network")
-	}
-	if !strings.Contains(err.Error(), "anchor") {
-		t.Fatalf("the refusal does not name the unreachable end: %v", err)
-	}
-}
-
-func TestBindingSomethingAnsweredHereWritesNothing(t *testing.T) {
-	// A file saying "it is on this node" is a fact nobody needs and one more thing to keep true.
-	got, err := Resolve(shelf(
-		Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")},
-		Manifest{Module: "tools", Version: "1", Requires: []string{"shell"},
-			Binds: map[string]string{"shell": "/etc/tools/shell.json"}},
-	), []string{"tools"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range mustDeclare(t, got) {
-		if r["path"] == "/etc/tools/shell.json" {
-			t.Fatalf("a binding was written for something on this machine: %v", r)
-		}
-	}
-}
-
-func TestBindingWhatYouDoNotRequireIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"app","version":"1",
-		"binds":{"postgres-database":"/etc/app/db.json"}}`))
-	if err == nil {
-		t.Fatal("a module was told about something it never asked for")
-	}
-	if !strings.Contains(err.Error(), "does not require") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestServingWhatYouDoNotProvideIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"app","version":"1",
-		"serves":{"postgres-database":{"port":5432}}}`))
-	if err == nil {
-		t.Fatal("a module served something it does not provide")
-	}
-	if !strings.Contains(err.Error(), "does not provide") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
diff --git a/internal/catalogue/build_system_test.go b/internal/catalogue/build_system_test.go
deleted file mode 100644
index e1a97dd1..00000000
--- a/internal/catalogue/build_system_test.go
+++ /dev/null
@@ -1,82 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// bundleFor is a manifest whose one artifact is a bundle in the given language and system.
-func bundleFor(language, system string) Manifest {
-	return Manifest{Module: "a-component", Build: &Build{Artifacts: []Artifact{
-		{Name: "binary", Kind: ArtifactBundle, Language: language, System: system},
-	}}}
-}
-
-func problemsOf(t *testing.T, m Manifest) string {
-	t.Helper()
-	return strings.Join(m.Build.problems(m.Module), "\n")
-}
-
-// **A language that compiles to a binary must say which system.**
-//
-// A binary is pinned to one operating system at link time, so a host refuses to touch a machine it
-// was not built for. An artifact that says nothing would be compiled for whatever the build machine
-// happened to be — which reads as portable and is not, and is the fault this check exists for.
-func TestABinaryMustSayWhichSystemItIsFor(t *testing.T) {
-	got := problemsOf(t, bundleFor("go", ""))
-	if !strings.Contains(got, "says no system") {
-		t.Fatalf("a compiled bundle with no system was accepted:\n%s", got)
-	}
-	// And the refusal names what it could have said, so a reader is one edit from right.
-	for _, system := range []string{"alpine", "android", "arch"} {
-		if !strings.Contains(got, system) {
-			t.Fatalf("the refusal does not name %q as a choice:\n%s", system, got)
-		}
-	}
-}
-
-func TestABinaryThatNamesASystemIsAccepted(t *testing.T) {
-	if got := problemsOf(t, bundleFor("go", "arch")); got != "" {
-		t.Fatalf("a compiled bundle naming a system was refused:\n%s", got)
-	}
-}
-
-// A system the mesh does not build for is refused where it is written. These are the host's own
-// names, not a compiler's: the difference between two of them is a C library rather than a kernel,
-// so a value that looks like an operating system to a toolchain is still wrong here.
-func TestASystemTheMeshDoesNotBuildForIsRefused(t *testing.T) {
-	for _, wrong := range []string{"linux", "debian", "darwin"} {
-		got := problemsOf(t, bundleFor("go", wrong))
-		if !strings.Contains(got, "and a system is") {
-			t.Fatalf("%q was accepted as a system:\n%s", wrong, got)
-		}
-	}
-}
-
-// **And a language that runs anywhere must not name one.** A system that decides nothing reads as
-// though it did, which is the same fault as a restriction that restricts nothing (novox/hq ADR 0045).
-func TestAPortableBundleMayNotNameASystem(t *testing.T) {
-	got := problemsOf(t, bundleFor("typescript", "arch"))
-	if !strings.Contains(got, "runs anywhere") {
-		t.Fatalf("a portable bundle was allowed to name a system:\n%s", got)
-	}
-}
-
-func TestAPortableBundleNamingNoSystemIsAccepted(t *testing.T) {
-	if got := problemsOf(t, bundleFor("typescript", "")); got != "" {
-		t.Fatalf("an ordinary bundle was refused:\n%s", got)
-	}
-}
-
-// One component, one artifact per system: the shape the mesh's own binaries are declared in, and the
-// reason the target is the artifact's rather than the recipe's.
-func TestOneArtifactPerSystemIsAccepted(t *testing.T) {
-	m := Manifest{Module: "the-host", Build: &Build{Artifacts: []Artifact{
-		{Name: "arch", Kind: ArtifactBundle, Language: "go", System: "arch"},
-		{Name: "alpine", Kind: ArtifactBundle, Language: "go", System: "alpine"},
-		{Name: "android", Kind: ArtifactBundle, Language: "go", System: "android"},
-	}}}
-	if got := problemsOf(t, m); got != "" {
-		t.Fatalf("one artifact per system was refused:\n%s", got)
-	}
-}
diff --git a/internal/catalogue/build_test.go b/internal/catalogue/build_test.go
deleted file mode 100644
index c17c0ebe..00000000
--- a/internal/catalogue/build_test.go
+++ /dev/null
@@ -1,203 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The manifest in a repository and the manifest the mesh holds are two documents.
-//
-// A digest is not knowable until something is built, so a repository carrying one would be a
-// repository whose file is wrong the moment anybody edits anything — and the mesh would be pinning
-// a value nobody could have checked.
-
-func buildable() Manifest {
-	return Manifest{
-		Module: "meshboard", Version: "1",
-		Build: &Build{Artifacts: []Artifact{
-			{Name: "server", Kind: ArtifactImage, From: "Dockerfile"},
-			{Name: "theme", Kind: ArtifactArchive, From: "files"},
-		}},
-		Resources: []map[string]any{
-			{"id": "svc", "type": "container", "name": "meshboard", "artifact": "server"},
-			{"id": "look", "type": "archive", "path": "/opt/meshboard", "artifact": "theme"},
-			{"id": "dir", "type": "directory", "path": "/opt/meshboard"},
-		},
-	}
-}
-
-func wasBuilt() []Built {
-	return []Built{
-		{Name: "server", Kind: ArtifactImage,
-			Reference: "registry.invalid/meshboard@sha256:" + strings.Repeat("a", 64)},
-		{Name: "theme", Kind: ArtifactArchive,
-			Reference: "https://store.invalid/theme.tar.gz",
-			Digest:    "sha256:" + strings.Repeat("b", 64)},
-	}
-}
-
-func TestAResourceNamingAnArtifactBecomesOneNamingTheThing(t *testing.T) {
-	got, err := buildable().Resolve(wasBuilt())
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range got.Resources {
-		if r["artifact"] != nil {
-			// A build-time word the host has never heard of. Leaving it would be a field the
-			// strict decoder refuses on the machine, at the worst moment.
-			t.Fatalf("%v still names an artifact: %v", r["id"], r)
-		}
-	}
-	if got.Resources[0]["image"] != "registry.invalid/meshboard@sha256:"+strings.Repeat("a", 64) {
-		t.Fatalf("the image was not filled in: %v", got.Resources[0])
-	}
-	if got.Resources[1]["source"] != "https://store.invalid/theme.tar.gz" ||
-		got.Resources[1]["digest"] != "sha256:"+strings.Repeat("b", 64) {
-		t.Fatalf("the archive was not filled in: %v", got.Resources[1])
-	}
-	// And a resource that names nothing is untouched.
-	if got.Resources[2]["path"] != "/opt/meshboard" || len(got.Resources[2]) != 3 {
-		t.Fatalf("an ordinary resource was changed: %v", got.Resources[2])
-	}
-	// The built manifest carries no build section: it is the derived document, and something
-	// holding both would invite somebody to build from it again.
-	if got.Build != nil {
-		t.Fatal("the built manifest still says how to build itself")
-	}
-}
-
-func TestAnArtifactDeclaredAndNotBuiltIsRefused(t *testing.T) {
-	// A build that did not do what the manifest asked. Said here rather than by a machine later
-	// reporting an empty image.
-	_, err := buildable().Resolve(wasBuilt()[:1])
-	if err == nil {
-		t.Fatal("a manifest resolved with an artifact missing")
-	}
-	if !strings.Contains(err.Error(), "theme") {
-		t.Fatalf("the refusal does not name what is missing: %v", err)
-	}
-	// And it must blame the build rather than the resource. A resource asking for something that
-	// does not exist is a manifest fault; a build not producing what the manifest declared is a
-	// build fault, and telling somebody to fix the wrong one costs an afternoon.
-	if !strings.Contains(err.Error(), "the build did not produce") {
-		t.Fatalf("the refusal blames the wrong thing: %v", err)
-	}
-}
-
-func TestAResourceNamingSomethingTheModuleDoesNotBuildIsRefused(t *testing.T) {
-	m := buildable()
-	m.Resources = append(m.Resources,
-		map[string]any{"id": "other", "type": "archive", "path": "/x", "artifact": "nothing"})
-	if _, err := m.Resolve(wasBuilt()); err == nil {
-		t.Fatal("a resource naming an artifact nobody builds was accepted")
-	}
-}
-
-func TestAModuleThatBuildsNothingIsOrdinary(t *testing.T) {
-	// Most of what a person installs is configuration. Requiring an empty build section would be
-	// a field that exists to be left blank.
-	m := Manifest{Module: "shell", Version: "1", Resources: []map[string]any{
-		{"id": "rc", "type": "file", "path": "/etc/zsh/zshrc", "content": "setopt"},
-	}}
-	got, err := m.Resolve(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Resources) != 1 {
-		t.Fatalf("got %v", got.Resources)
-	}
-}
-
-func TestTwoArtifactsWithOneNameAreRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-		{"name":"x","kind":"image","from":"Dockerfile"},
-		{"name":"x","kind":"archive","from":"files"}]}}`))
-	if err == nil {
-		t.Fatal("two artifacts with one name were accepted")
-	}
-	if !strings.Contains(err.Error(), "could mean either") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestAnArtifactBuiltFromOutsideItsRepositoryIsRefused(t *testing.T) {
-	// A build reads its own repository and nothing else. A path leaving it would make what gets
-	// built depend on whatever happens to be on the machine doing the building.
-	for _, from := range []string{"/etc/passwd", "../elsewhere"} {
-		_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-			{"name":"x","kind":"archive","from":"` + from + `"}]}}`))
-		if err == nil {
-			t.Fatalf("%q was accepted as a build input", from)
-		}
-		if !strings.Contains(err.Error(), "outside its own repository") {
-			t.Fatalf("refused for the wrong reason: %v", err)
-		}
-	}
-}
-
-func TestAnArtifactOfAnUnknownKindIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-		{"name":"x","kind":"binary","from":"main.go"}]}}`))
-	if err == nil {
-		t.Fatal("an artifact of an unknown kind was accepted")
-	}
-}
-
-func TestAPackageParsesLikeABundleAndNeedsALanguage(t *testing.T) {
-	// The SDK's shape: a package built from the module's own directory, naming a language.
-	m, err := ParseManifest([]byte(`{"module":"mesh-sdk","version":"1","slug":"sdk",
-		"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript"}]},
-		"resources":[]}`))
-	if err != nil {
-		t.Fatalf("the SDK's package manifest did not parse: %v", err)
-	}
-	if m.Build.Artifacts[0].Kind != ArtifactPackage {
-		t.Fatalf("expected a package artifact, got %q", m.Build.Artifacts[0].Kind)
-	}
-
-	// A package that names what it is built from is refused, exactly as a bundle is: it is built
-	// from the module's own directory.
-	if _, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-		{"name":"lib","kind":"package","language":"typescript","from":"Dockerfile"}]}}`)); err == nil {
-		t.Fatal("a package naming a source was accepted")
-	}
-	// A package with no language cannot choose a toolchain.
-	if _, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-		{"name":"lib","kind":"package"}]}}`)); err == nil {
-		t.Fatal("a package with no language was accepted")
-	}
-}
-
-func TestAResourceNamingAPackageIsRefused(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"a","version":"1","slug":"a",
-		"build":{"artifacts":[{"name":"lib","kind":"package","language":"typescript"}]},
-		"resources":[{"id":"svc","type":"container","name":"a","artifact":"lib"}]}`))
-	if err != nil {
-		t.Fatalf("parse: %v", err)
-	}
-	_, err = m.Resolve([]Built{{Name: "lib", Kind: ArtifactPackage, Reference: "@novox/a@1.0.0"}})
-	if err == nil {
-		t.Fatal("a resource backed by a package was accepted; a package is not a resource")
-	}
-}
-
-// An image names the Go package its recipe compiles (novox/hq ADR 0267): within the tree it is built in,
-// and only an image says one.
-func TestOnlyAnImageNamesThePackageItCompilesWithinItsTree(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[
-		{"name":"x","kind":"image","from":"Dockerfile","compiles":"cmd/x"}]}}`))
-	if err != nil || m.Build.Artifacts[0].Compiles != "cmd/x" {
-		t.Fatalf("an image naming its package was refused or lost it: %v", err)
-	}
-	for _, c := range []struct{ artifact, says string }{
-		{`{"name":"x","kind":"archive","from":"files","compiles":"cmd/x"}`, "Only an image"},
-		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"../x"}`, "leaves the tree"},
-		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"/x"}`, "leaves the tree"},
-		{`{"name":"x","kind":"image","from":"Dockerfile","compiles":"a/../../x"}`, "leaves the tree"},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"a","version":"1","build":{"artifacts":[` + c.artifact + `]}}`))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v, wanted a refusal saying %q", c.artifact, err, c.says)
-		}
-	}
-}
diff --git a/internal/catalogue/bus_snapshot_test.go b/internal/catalogue/bus_snapshot_test.go
deleted file mode 100644
index e9904350..00000000
--- a/internal/catalogue/bus_snapshot_test.go
+++ /dev/null
@@ -1,80 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// The module holding mesh-broker is the bus, and its account is granted the bus's snapshot API and
-// nothing else (novox/hq ADR 0235). Anything it declared to say or hear on the bus would be granted
-// nothing, so it is refused at the parser rather than silently dropped.
-func TestTheBussAccountSaysNothingOnTheBus(t *testing.T) {
-	raw := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
-		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
-		"emits":["something.happened"]}`)
-	_, err := ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), "granted the bus's snapshot API and nothing else") {
-		t.Fatalf("a bus module declaring what it emits was not refused, or not for the reason: %v", err)
-	}
-
-	// Its tools bundle says what it emits (novox/hq ADR 0357): the node's runtime carries the bundle and is
-	// granted the module's events, so a bus module that ships one may declare them.
-	bundled := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
-		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
-		"emits":["bus.slow-consumer"],"tools":["bus_streams"],
-		"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/t","binary":"t"}]}}`)
-	if _, err := ParseManifest(bundled); err != nil {
-		t.Fatalf("a bus module whose tools bundle declares what it emits was refused: %v", err)
-	}
-
-	quiet := []byte(`{"module":"bus","version":"1","provides":[{"name":"mesh-bus","scope":"mesh"}],
-		"claims":[{"name":"mesh-broker","scope":"mesh"}],"own-secrets":{"broker":"/run/broker"},
-		"tools":["bus_streams"]}`)
-	m, err := ParseManifest(quiet)
-	if err != nil {
-		t.Fatalf("a bus module with an account and tools was refused: %v", err)
-	}
-	if !m.ClaimsSeat(BrokerSeat) {
-		t.Fatal("it does not read as holding the broker seat")
-	}
-}
-
-// The catalogue's bus protects its streams by the snapshot, not as live files: its streams' item is a
-// dump into its snapshots, it has the account the dump runs as, and the dump runs the snapshot
-// program in the bus's own container.
-func TestTheCataloguesBusIsBackedUpBySnapshot(t *testing.T) {
-	raw, err := os.ReadFile(filepath.Join(beside.Catalogue(t), "nats", "module.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, account := m.OwnSecrets["broker"]; !account {
-		t.Fatal("the bus declares no account, so its snapshot could not reach it")
-	}
-	var found bool
-	if m.Data == nil {
-		t.Fatal("the bus declares no data")
-	}
-	for _, it := range m.Data.Own {
-		if it.ID != "jetstream" {
-			continue
-		}
-		found = true
-		if !it.Backup.IsDump() || it.Backup.Into != "snapshots" {
-			t.Fatalf("the bus's streams are protected by %+v, not a snapshot into its snapshots", it.Backup)
-		}
-		if !strings.Contains(it.Backup.Dump, "mesh-nats-snapshot snapshot") {
-			t.Fatalf("the dump does not run the snapshot program: %s", it.Backup.Dump)
-		}
-	}
-	if !found {
-		t.Fatal("the bus declares no item for its streams")
-	}
-}
diff --git a/internal/catalogue/busy_test.go b/internal/catalogue/busy_test.go
deleted file mode 100644
index 871817d2..00000000
--- a/internal/catalogue/busy_test.go
+++ /dev/null
@@ -1,94 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/validate"
-)
-
-// A long-running container may say it is busy (novox/hq ADR 0335 §1): `module check` holds the field to its
-// shape near its author, and it is sent only to a node-engine that reads it, in words the engine's own
-// validator accepts.
-
-func busyManifest(t *testing.T, on string, busy any) []byte {
-	t.Helper()
-	extra := map[string]any{"id": "agent", "type": "container", "name": "app-agent",
-		"image": "registry.example/app" + healthDigest}
-	var m map[string]any
-	if err := json.Unmarshal(healthManifest(t, "", nil, extra), &m); err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range m["resources"].([]any) {
-		if r := r.(map[string]any); r["id"] == on {
-			r[BusyField] = busy
-		}
-	}
-	out, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-func TestABusyIsHeldToItsShape(t *testing.T) {
-	if _, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"})); err != nil {
-		t.Fatalf("a well-formed busy was refused: %v", err)
-	}
-	if _, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "x", "timeout": "30s"})); err != nil {
-		t.Fatalf("a busy with its timeout was refused: %v", err)
-	}
-	for name, c := range map[string]struct {
-		on   string
-		busy any
-		says string
-	}{
-		"text":           {"agent", "mesh-builder busy", "it is an object"},
-		"no command":     {"agent", map[string]any{"timeout": "5s"}, "names no command"},
-		"two lines":      {"agent", map[string]any{"command": "a\nb"}, "one line"},
-		"a long timeout": {"agent", map[string]any{"command": "x", "timeout": "5m"}, "at most 1m0s"},
-		"an unknown key": {"agent", map[string]any{"command": "x", "every": "1m"}, `says "every"`},
-		"on a step":      {"seed", map[string]any{"command": "x"}, "not a container that stays up"},
-		"on a service":   {"daemon", map[string]any{"command": "x"}, "not a container that stays up"},
-	} {
-		_, err := ParseManifest(busyManifest(t, c.on, c.busy))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: want a refusal saying %q, got %v", name, c.says, err)
-		}
-	}
-}
-
-func TestABusyIsSentOnlyToAnEngineThatReadsIt(t *testing.T) {
-	m, err := ParseManifest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	compose := func(with Rendering) []map[string]any {
-		out, err := Resolution{Node: "laptop", Modules: []Manifest{m}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return out
-	}
-	older := compose(Rendering{})
-	if b, sent := older[indexOfID(older, "app.agent")][BusyField]; sent {
-		t.Fatalf("busy was sent to an engine that does not read it: %v", b)
-	}
-	newer := compose(Rendering{ReadsBusy: true})
-	got, _ := newer[indexOfID(newer, "app.agent")][BusyField].(map[string]any)
-	if got["command"] != "mesh-builder busy" || got["timeout"] != "10s" {
-		t.Fatalf("busy composed as %v", got)
-	}
-	// And the engine's own validator takes the container with it.
-	body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": newer})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problems := validate.Declaration(body); len(problems) > 0 {
-		t.Fatalf("the node-engine's validator refuses the composed busy: %v", problems)
-	}
-	if _, has := m.Resources[len(m.Resources)-1][BusyField].(map[string]any)["timeout"]; has {
-		t.Error("composing wrote the timeout into the catalogue's own manifest")
-	}
-}
diff --git a/internal/catalogue/catalogue_check_test.go b/internal/catalogue/catalogue_check_test.go
deleted file mode 100644
index f853c010..00000000
--- a/internal/catalogue/catalogue_check_test.go
+++ /dev/null
@@ -1,138 +0,0 @@
-package catalogue
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// TestEveryCatalogueManifestParses runs the real catalogue through the real gate.
-//
-// Not a fixture: the point is whether the manifests as written are accepted by the control plane that
-// will read them, and a copy of one manifest proves nothing about the other seventy-one.
-// catalogueRoot is the catalogue these checks run over: in a merge check the clone the build seat put
-// beside this one, elsewhere the copy captured in testdata/beside (internal/beside). A check that only
-// ran when somebody remembered a variable was a check nobody ran (novox/hq issue 134), and one that read
-// whatever checkout sat beside judged the machine, not the change (novox/hq issue 432): it never skips.
-func catalogueRoot(t *testing.T) string {
-	t.Helper()
-	return beside.Dir(t, "mesh-catalog")
-}
-
-func TestEveryCatalogueManifestParses(t *testing.T) {
-	root := catalogueRoot(t)
-	found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil || len(found) == 0 {
-		t.Fatalf("no manifests under %s: %v", root, err)
-	}
-	named, routed := 0, 0
-	for _, p := range found {
-		m, err := ReadTreeManifest(root, filepath.Dir(p))
-		if err != nil {
-			t.Errorf("%s: %v", filepath.Base(filepath.Dir(p)), err)
-			continue
-		}
-		for _, l := range m.Listens {
-			if l.Name != "" {
-				named++
-			}
-		}
-		for port := range RoutedPorts(m) {
-			_ = port
-			routed++
-		}
-	}
-	t.Logf("%d manifests, %d named endpoints, %d routed endpoints resolved", len(found), named, routed)
-	if named == 0 {
-		t.Fatal("no endpoint in the catalogue is named, so this proved nothing")
-	}
-}
-
-// TestNoCatalogueManifestNamesAnInstallation is ADR 0112's check, run over the real catalogue: no
-// definition names a domain or a public address the mesh acts on, and every value that must for now
-// carries its reason (novox/hq ADR 0155, issue 134). The list it prints is the one that shrinks.
-func TestNoCatalogueManifestNamesAnInstallation(t *testing.T) {
-	root := catalogueRoot(t)
-	found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil || len(found) == 0 {
-		t.Fatalf("no manifests under %s: %v", root, err)
-	}
-	var named []string
-	for _, p := range found {
-		m, err := ReadTreeManifest(root, filepath.Dir(p))
-		if err != nil {
-			t.Errorf("%s: %v", p, err)
-			continue
-		}
-		named = append(named, InstallationProblems(m)...)
-	}
-	if len(named) > 0 {
-		t.Fatalf("%d value(s) name an installation:\n  %s", len(named), strings.Join(named, "\n  "))
-	}
-}
-
-// TestEveryCatalogueModuleDeclaresItsData is ADR 0233's check over the real catalogue (it replaced ADR
-// 0214's store list): every provider that grants says what it keeps for its consumers, nothing writes a
-// backup line by hand, every directory a container writes is declared, and every irreplaceable item is
-// backed up — so a store added is a store backed up, without a list of stores to keep in step.
-func TestEveryCatalogueModuleDeclaresItsData(t *testing.T) {
-	root := catalogueRoot(t)
-	found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil || len(found) == 0 {
-		t.Fatalf("no manifests under %s: %v", root, err)
-	}
-	shelf := Shelf{}
-	granting := 0
-	for _, p := range found {
-		m, err := ReadTreeManifest(root, filepath.Dir(p))
-		if err != nil {
-			continue // TestEveryCatalogueManifestParses says why
-		}
-		if len(m.Grants) > 0 {
-			granting++
-		}
-		shelf[m.Module] = m
-	}
-	for _, problem := range DataProblems(shelf) {
-		t.Error(problem)
-	}
-	if granting == 0 {
-		t.Fatal("no module in the catalogue grants a provision, so this proved nothing")
-	}
-}
-
-// TestEveryCatalogueIdentityFitsWhatItRequires is ADR 0225's check over the real catalogue: every
-// module's identity, on the longest machine name, fits the bound of every provision it wants. An
-// overflow fails here, in the pull request that introduces it, rather than on the provider's machine
-// the first time a real machine's name meets the module's (issue 263).
-func TestEveryCatalogueIdentityFitsWhatItRequires(t *testing.T) {
-	root := catalogueRoot(t)
-	found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
-	if err != nil || len(found) == 0 {
-		t.Fatalf("no manifests under %s: %v", root, err)
-	}
-	shelf := Shelf{}
-	for _, p := range found {
-		m, err := ReadTreeManifest(root, filepath.Dir(p))
-		if err != nil {
-			t.Fatalf("%s: %v", p, err)
-		}
-		shelf[m.Module] = m
-	}
-	for _, p := range IdentityProblems(shelf, DefaultLongestMachine) {
-		t.Error(p)
-	}
-	// The night it was found: the resolver provision bounds nothing, and the object store still 20.
-	if dns, ok := shelf["dnsmasq"]; ok {
-		if b := dns.IdentityBoundOf("wildcard-resolution"); b.Bounded() {
-			t.Errorf("the resolver provision bounds its consumers' identities: %+v", b)
-		}
-	}
-	if store, ok := shelf["minio"]; ok {
-		if b := store.IdentityBoundOf("s3-bucket"); b.Max != 20 {
-			t.Errorf("the object store's access key is not bounded at 20: %+v", b)
-		}
-	}
-}
diff --git a/internal/catalogue/catrust_manifest_test.go b/internal/catalogue/catrust_manifest_test.go
deleted file mode 100644
index dfad82cc..00000000
--- a/internal/catalogue/catrust_manifest_test.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package catalogue
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// **A machine trusts the mesh's authority because a module put its root there** (novox/hq ADR
-// 0147, issue 129). The module carries a shell script and a unit, and both are worthless unless
-// the mesh fills in where the authority is — which is the one thing about it the manifest cannot
-// state, because the authority's address is a fact about the mesh and not about the module.
-//
-// So what is checked here is the rendering, not the parsing: the script the machine will run
-// names the authority it was bound to, and the unit runs that script both ways. The verification
-// itself — a plain client trusting an internal name on a machine holding this, and failing on one
-// that does not — is the lab's, and cannot be had here.
-func TestCaTrustRendersTheAuthorityItWasBoundTo(t *testing.T) {
-	m, err := ReadTreeManifest(beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), "ca-trust"))
-	if err != nil {
-		t.Fatalf("the trust module does not parse:\n%v", err)
-	}
-
-	r := Resolution{
-		Node:    "workstation",
-		Modules: []Manifest{m},
-		Needs: []Needed{{
-			Name: "internal-acme-ca", From: "anchor", At: "anchor.internal", For: "ca-trust",
-			Serves: map[string]any{
-				"port": float64(9000), "path": "/acme/acme/directory", "roots": "/roots.pem",
-			},
-		}},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("the trust module could not be composed for a machine: %v", err)
-	}
-
-	script := fileNamed(out, "ca-trust.anchor")
-	if script == nil {
-		t.Fatalf("nothing writes the script the unit runs: %v", out)
-	}
-	body, _ := script["content"].(string)
-	if !strings.Contains(body, "https://anchor.internal:9000/roots.pem") {
-		t.Errorf("the script does not fetch from the authority it was bound to:\n%s", body)
-	}
-	if script["mode"] != "0755" {
-		t.Errorf("the script is written %v, which systemd cannot execute", script["mode"])
-	}
-
-	unit := fileNamed(out, "ca-trust.unit")
-	if unit == nil {
-		t.Fatalf("no unit: %v", out)
-	}
-	text, _ := unit["content"].(string)
-	// Both halves. A unit that only installs the anchor leaves a machine trusting an authority
-	// nobody assigned it to any more, which is the half issue 129 asked for by name.
-	for _, want := range []string{
-		"ExecStart=" + script["path"].(string) + " install",
-		"ExecStop=" + script["path"].(string) + " remove",
-		"RemainAfterExit=yes",
-	} {
-		if !strings.Contains(text, want) {
-			t.Errorf("the unit does not say %q:\n%s", want, text)
-		}
-	}
-}
diff --git a/internal/catalogue/co_located_test.go b/internal/catalogue/co_located_test.go
deleted file mode 100644
index 340a8138..00000000
--- a/internal/catalogue/co_located_test.go
+++ /dev/null
@@ -1,315 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A provider and its consumer on ONE machine, which is what ADR 0066's anchor is.
-//
-// **Every fault in this file is the same shape: the same-node path diverging from the cross-node
-// one.** A provider on another machine is walked by the control plane — its served facts are
-// re-derived from its manifest with that machine's port assignments and settled with that node's
-// settings layers — and only then handed to the consumer. A provider on the consumer's OWN machine
-// never passes through that walk, so every step of it had to be repeated here, and each step that
-// was not is a promise the co-located arrangement quietly breaks.
-//
-// 04-ISSUES/038 was the first of them (the port). These are the rest.
-
-// A root certificate, as a certificate authority serves one: a real, self-signed one made for these tests (its key
-// thrown away), because the one setting that may hold lines must parse as a certificate (novox/hq issue 339).
-const servedRoot = `-----BEGIN CERTIFICATE-----
-MIIBPjCB8aADAgECAhRZG3p93hUUB5bz00uxhYo/nJnTQjAFBgMrZXAwFDESMBAG
-A1UEAwwJdGVzdCByb290MCAXDTI2MTAwODIyMjE0NloYDzIxMjYwOTE0MjIyMTQ2
-WjAUMRIwEAYDVQQDDAl0ZXN0IHJvb3QwKjAFBgMrZXADIQA0pt/ld+W0MXwBhPfO
-cuAt56kIW6Qcn+4vqWpuvHTiqaNTMFEwHQYDVR0OBBYEFIjgaLk4OVGIOeZQiqnN
-p9vhciFjMB8GA1UdIwQYMBaAFIjgaLk4OVGIOeZQiqnNp9vhciFjMA8GA1UdEwEB
-/wQFMAMBAf8wBQYDK2VwA0EAl9uWeSM2XAV8u0reyV3BLRxNVik+4FCRO1QKPs2k
-IlB1rK9oAOYManH+VFuBMI/JJ31ajSti81q4E0CSw8r5DQ==
------END CERTIFICATE-----
-`
-
-// stepCA is an internal ACME authority: it answers `acme-ca` from anywhere in the mesh, and what a
-// consumer must know is the directory URL and the root to trust. **The root is not knowable when
-// the module is written** — it exists only once the CA has been initialised — so the manifest
-// declares the key and the operator supplies the value as a setting, which is exactly the shape the
-// cross-node path settles and the same-node path did not.
-func stepCA() Manifest {
-	return Manifest{
-		Module: "step-ca", Version: "1",
-		Provides: FromAnywhere("acme-ca"),
-		Listens:  []Listening{{Port: 9000, Protocol: "tcp", From: FromMesh}},
-		Serves: map[string]map[string]any{"acme-ca": {
-			"directory": "https://anchor.internal/acme/acme/directory",
-			// Declared empty: a manifest is the same on every mesh, and this mesh's root is not.
-			"root": "",
-		}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "step-ca", "ports": []any{"9000"},
-		}},
-	}
-}
-
-// stepCAWithItsRoot is the authority whose root the operator supplies: the served key asks for it as
-// `${setting:root}` (ADR 0155), the only way a setting reaches what a provider serves since a layer
-// stopped replacing a served key (novox/hq issue 696; before it, the empty `root` was replaced whole).
-func stepCAWithItsRoot() Manifest {
-	m := stepCA()
-	m.Serves["acme-ca"]["root"] = "${setting:root}"
-	return m
-}
-
-// routeProxy issues from that authority, so it must be told the root to verify it with.
-func routeProxy() Manifest {
-	return Manifest{
-		Module: "route-proxy", Version: "1",
-		Requires: []string{"acme-ca"},
-		Provides: FromAnywhere("route"),
-		Binds:    map[string]string{"acme-ca": "/var/lib/route-proxy/acme-ca.json"},
-		Receives: map[string]string{"route": "/var/lib/route-proxy/routes.json"},
-		Resources: []map[string]any{{
-			"id": "bundle", "type": "file", "path": "/var/lib/route-proxy/ca.pem", "mode": "0644",
-			"content": "${bound:acme-ca:root}",
-		}},
-	}
-}
-
-// A co-located provider's served VALUES reach its consumer, not just its served keys.
-//
-// The mesh walks a provider on ANOTHER machine and settles what it serves with that node's settings
-// layers before offering it (cmd/mesh-controller plan.go, theRestOfTheMesh). A provider on the
-// consumer's own machine was never settled at all: resolve.go's servedHere and declaration.go's
-// here() both read the manifest and stop there. So a served value the operator supplied — the one
-// kind of value a manifest cannot carry, because it is different on every mesh — arrived as the
-// manifest's empty default.
-//
-// The consequence is silent and total: route-proxy wrote an empty CA bundle, fell back to the
-// system trust store, could not verify the internal authority, and no certificate was ever issued.
-func TestACoLocatedProvidersServedValuesReachItsConsumer(t *testing.T) {
-	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
-		[]string{"step-ca", "route-proxy"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// What the operator set on the provider, on this node — the CA's root, which only exists once
-	// the CA has been initialised.
-	out, err := r.Declaration(Rendering{Settings: SettingsBy{
-		"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	bundle := fileNamed(out, "route-proxy.bundle")
-	if bundle == nil {
-		t.Fatalf("the consumer was given no bundle at all: %v", out)
-	}
-	if got := bundle["content"]; got != servedRoot {
-		t.Errorf("the co-located consumer was not told the root it must trust:\n got %q\nwant %q",
-			got, servedRoot)
-	}
-}
-
-// And the binding file says the same thing, for a consumer that reads the binding rather than a
-// substituted placeholder. The two are one fact and must not be able to disagree.
-func TestACoLocatedConsumersBindingCarriesTheSettledValues(t *testing.T) {
-	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
-		[]string{"step-ca", "route-proxy"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{
-		Settings: SettingsBy{
-			"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
-		},
-		// And the machine moved the provider's port while it was at it, so both halves of the
-		// cross-node derivation are exercised at once.
-		Ports: map[string]map[int]int{"step-ca": {9000: 19000}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	binding := fileNamed(out, "route-proxy.bound-acme-ca")
-	if binding == nil {
-		t.Fatalf("the consumer was given no binding at all: %v", out)
-	}
-	var said struct {
-		Serves map[string]any `json:"serves"`
-	}
-	if err := json.Unmarshal([]byte(binding["content"].(string)), &said); err != nil {
-		t.Fatal(err)
-	}
-	if said.Serves["root"] != servedRoot {
-		t.Errorf("the binding does not carry the settled root: %q", said.Serves["root"])
-	}
-	if port, _ := asPort(said.Serves["port"]); port != 19000 {
-		t.Errorf("the binding does not carry the port the machine publishes: %v", said.Serves["port"])
-	}
-}
-
-// A provider PULLED IN rather than assigned is settled the same way.
-//
-// The resolver's same-node need is built during the walk, from whichever modules had been chosen by
-// the time the requirement came up — so which path a co-located binding took depended on the order
-// a person happened to assign things in. Settling after the closure is known removes that: both
-// orders now produce the same file.
-func TestACoLocatedProviderIsSettledWhicheverWayItWasPulledIn(t *testing.T) {
-	for _, assigned := range [][]string{
-		{"step-ca", "route-proxy"},
-		{"route-proxy", "step-ca"},
-	} {
-		r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()), assigned, reachable(), World{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		out, err := r.Declaration(Rendering{Settings: SettingsBy{
-			"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
-		}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		bundle := fileNamed(out, "route-proxy.bundle")
-		if bundle == nil || bundle["content"] != servedRoot {
-			t.Errorf("assigned %v: the consumer was not told the root", assigned)
-		}
-	}
-}
-
-// A same-node contribution names the port the MACHINE publishes, not the one the module declared.
-//
-// 04-ISSUES/038 fixed this for what a consumer is TOLD about a provider. This is the other
-// direction: what a workload TELLS the provider about itself. gitea declares a bare container port
-// 3000, the mesh publishes it as 20000:3000 — and gitea's route contribution still said 3000, so
-// the proxy beside it dialled a port nothing listens on and answered 502 for every request.
-//
-// The redirect uses the CONTRIBUTING module's assignment: the port belongs to the workload, and
-// using the provider's map would move it to wherever the proxy happens to be published.
-func TestASameNodeContributionNamesThePortTheMachinePublishes(t *testing.T) {
-	gitea := Manifest{
-		Module: "gitea", Version: "1",
-		Listens:     []Listening{{Port: 3000, Protocol: "tcp", From: FromMesh}},
-		Contributes: map[string]map[string]any{"route": {"label": "git", "port": 3000}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "gitea", "ports": []any{"3000"},
-		}},
-	}
-	r, err := Resolve(shelf(gitea, routeProxy(), stepCA()),
-		[]string{"gitea", "route-proxy", "step-ca"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{
-		// The machine put gitea's 3000 on 20000, and published it that way.
-		Ports: map[string]map[int]int{"gitea": {3000: 20000}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Where the workload is actually published.
-	server := fileNamed(out, "gitea.server")
-	if published := strings.Join(asStrings(server["ports"]), ","); published != "20000:3000" {
-		t.Fatalf("the workload was not published on the assigned port: %v", server["ports"])
-	}
-
-	// What the proxy beside it was told to dial: the SAME port.
-	routes := fileNamed(out, "route-proxy.received-route")
-	if routes == nil {
-		t.Fatalf("the proxy was given no routes file at all: %v", out)
-	}
-	var given struct {
-		Given []Contribution `json:"given"`
-	}
-	if err := json.Unmarshal([]byte(routes["content"].(string)), &given); err != nil {
-		t.Fatal(err)
-	}
-	if len(given.Given) != 1 {
-		t.Fatalf("expected one route, got %v", given.Given)
-	}
-	port, ok := asPort(given.Given[0].Values["port"])
-	if !ok || port != 20000 {
-		t.Errorf("the proxy was told to dial a port nothing listens on: %v",
-			given.Given[0].Values["port"])
-	}
-}
-
-// A contribution from ANOTHER machine is left exactly as it was.
-//
-// Its port belongs to that machine's assignment, which this node's map knows nothing about —
-// applying this node's map to it would move a remote workload's port to wherever a local module of
-// the same name happens to be published, which is worse than the fault being fixed.
-func TestAContributionFromAnotherMachineKeepsItsOwnPort(t *testing.T) {
-	r, err := Resolve(shelf(routeProxy(), stepCA()),
-		[]string{"route-proxy", "step-ca"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{
-		// A same-named module on this machine, moved. The grant below is a laptop's, and must not
-		// be dragged along with it.
-		Ports: map[string]map[int]int{"gitea": {3000: 20000}},
-		Grants: []Grant{{
-			Provision: "route", Consumer: "laptop", From: "gitea", At: "laptop.internal",
-			Values: map[string]any{"name": "git.example", "port": 3000},
-		}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	routes := fileNamed(out, "route-proxy.received-route")
-	var given struct {
-		Given []Contribution `json:"given"`
-	}
-	if err := json.Unmarshal([]byte(routes["content"].(string)), &given); err != nil {
-		t.Fatal(err)
-	}
-	if len(given.Given) != 1 {
-		t.Fatalf("expected one route, got %v", given.Given)
-	}
-	if port, _ := asPort(given.Given[0].Values["port"]); port != 3000 {
-		t.Errorf("another machine's contribution was rewritten with this machine's ports: %v",
-			given.Given[0].Values["port"])
-	}
-}
-
-// The cross-node half of the same fault: a grant assembled on the providing machine carries the
-// consumer's declared port until the CONSUMER's machine's assignments are applied to it. The
-// declaration layer cannot do it — those assignments are not this machine's, which is the line the
-// test above holds — so the grant layer is handed them and does it there.
-func TestAContributionIsRedirectedToWhereItsOwnMachinePublishedIt(t *testing.T) {
-	published := map[int]int{3000: 20000}
-
-	got := AtPublishedPort(map[string]any{"name": "git.example.tld", "port": 3000}, "forge", published)
-	if port, _ := asPort(got["port"]); port != 20000 {
-		t.Errorf("the proxy would dial a port that machine never published: %v", got["port"])
-	}
-	if got["name"] != "git.example.tld" {
-		t.Errorf("redirecting the port disturbed the rest of the contribution: %v", got)
-	}
-
-	// Idempotent, and silent about a port nobody moved: a module that pinned its own mapping has no
-	// assignment, and must come back exactly as it was written.
-	again := AtPublishedPort(got, "forge", published)
-	if port, _ := asPort(again["port"]); port != 20000 {
-		t.Errorf("applying it twice moved the port again: %v", again["port"])
-	}
-	pinned := AtPublishedPort(map[string]any{"port": 9070}, "office", published)
-	if port, _ := asPort(pinned["port"]); port != 9070 {
-		t.Errorf("a port the mesh never assigned was rewritten: %v", pinned["port"])
-	}
-}
-
-func asStrings(v any) []string {
-	listed, ok := v.([]any)
-	if !ok {
-		return nil
-	}
-	out := make([]string, 0, len(listed))
-	for _, one := range listed {
-		out = append(out, strings.TrimSpace(plainly(one)))
-	}
-	return out
-}
diff --git a/internal/catalogue/collections_bar_test.go b/internal/catalogue/collections_bar_test.go
deleted file mode 100644
index 54de9d6e..00000000
--- a/internal/catalogue/collections_bar_test.go
+++ /dev/null
@@ -1,135 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-// A bar's blocks are a collection of text (design 57 L3, issue 781): the holder of node-bar names the kind as
-// `${collected:contribution:node-bar:block:bar=<b>,place=<p>}`, which a handed collector has its client fill from the
-// items and an unhanded one has the controller fill as it fills the old placeholder.
-
-const (
-	collectedBarsText = "top\n${collected:contribution:node-bar:block:bar=top,place=status}" +
-		"bottom\n${collected:contribution:node-bar:block:bar=bottom,place=status}"
-	collectedBars = `{"module":"bars","version":"1","moved":true,
-  "claims":[{"name":"node-bar","scope":"node","renders":{"block":"{{.shows}}"}}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"conf","type":"file","path":"/etc/bars.conf","template":"files/bars"}]}`
-	itemsOfPower = `{"module":"power","version":"1","moved":true,
-  "items":[{"collection":"contribution:node-bar:block","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"40"},"template":"files/battery"},
-           {"collection":"contribution:node-bar:block","name":"draw","attributes":{"bar":"bottom","place":"status","order":"45"},"template":"files/draw"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-)
-
-func collectedBarsOn(t *testing.T, caps map[string]bool) Resolution {
-	t.Helper()
-	bars := held(t, collectedBars, builtWith("bars", map[string]string{"bars": collectedBarsText}))
-	power := held(t, itemsOfPower, builtWith("power", map[string]string{"battery": "B\n", "draw": "D ${machine:name}\n"}))
-	r, err := Resolve(shelf(bars, power), []string{"bars", "power"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account, r.Capabilities = "op", caps
-	return r
-}
-
-func TestACollectorMayNameTheBarsBlocksAsACollectionAndNoOtherDataKind(t *testing.T) {
-	bars := held(t, collectedBars, builtWith("bars", map[string]string{"bars": collectedBarsText}))
-	if _, err := collectedBarsOn(t, nil).Compose(handingTo("store:5000")); err != nil {
-		t.Fatalf("the handed collector is refused: %v", err)
-	}
-	if got := collectedPlaceholderProblems(bars, map[string]any{"id": "x",
-		"content": "${collected:contribution:node-bar:block:bar=top,place=status}"}); len(got) != 0 {
-		t.Fatalf("the check refuses it: %v", got)
-	}
-	// A data kind whose shape does not say its items are text stays refused.
-	_, plain, _ := receivable(BarSeat, BarKindBlock)
-	plain.Shape = &Shape{}
-	if collectableAsText(plain) {
-		t.Fatal("a shape not marked as text is collectable")
-	}
-	if _, _, err := oldCollection("contribution:node-bar:block", false); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestTheBarsCollectionIsFilledTheOldWayWhereTheCollectorIsNotHanded(t *testing.T) {
-	for _, caps := range []map[string]bool{nil, {"battery": true}} {
-		got := composedFile(t, collectedBarsOn(t, caps), "bars.conf")
-		want := "top\nbottom\n# power\nD workstation\n"
-		if caps["battery"] {
-			want = "top\nbottom\n# power\nB\n# power\nD workstation\n"
-		}
-		if got != want {
-			t.Errorf("caps %v: the file is %q, want %q", caps, got, want)
-		}
-	}
-}
-
-func TestTheBarsCollectionIsNamedInTheHandedPlan(t *testing.T) {
-	c, _ := composeWith(t, collectedBarsOn(t, map[string]bool{"battery": true}), handingTo("store:5000"))
-	if !reflect.DeepEqual(c.Plans["bars"].Collections, []PlanCollection{{Name: "contribution:node-bar:block", Comment: "#"}}) {
-		t.Fatalf("the plan collects %+v", c.Plans["bars"].Collections)
-	}
-	if n := len(c.Plans["power"].Items); n != 2 {
-		t.Fatalf("the contributor's plan names %d items", n)
-	}
-}
-
-// The bars of the catalogue's i3status-rust, with the blocks of power's items, compose to the files the old shaped
-// contribution made (issue 781). testdata/bars holds the catalogue's bars and block texts as of the move and the bars as
-// composed before it, for a machine with neither capability, the battery, the power meter and both. Where the
-// collector is not handed the controller fills the files; where it is, it names the items for the client, which
-// fills the same files (mesh-catalog's provisioner client holds that half against the same golden files).
-func TestTheBarsOfTheCatalogueAreTheSameHandedOrNot(t *testing.T) {
-	read := func(name string) string {
-		b, err := os.ReadFile(filepath.Join("testdata", "bars", name))
-		if err != nil {
-			t.Fatal(err)
-		}
-		return string(b)
-	}
-	collector := `{"module":"bars","version":"1","moved":true,"claims":[{"name":"node-bar","scope":"node"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"top","type":"file","path":"/t","template":"files/top"},
-               {"id":"bottom","type":"file","path":"/b","template":"files/bottom"}]}`
-	power := `{"module":"power","version":"1","moved":true,
-  "items":[{"collection":"contribution:node-bar:block","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"40"},"template":"files/battery"},
-           {"collection":"contribution:node-bar:block","name":"power-draw","if-capability":"power-meter","attributes":{"bar":"bottom","place":"status","order":"45"},"template":"files/draw"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-	for name, caps := range map[string]map[string]bool{"none": nil, "battery": {"battery": true},
-		"power-meter": {"power-meter": true}, "both": {"battery": true, "power-meter": true}} {
-		bars := held(t, collector, builtWith("bars", map[string]string{"top": read("top-bar.toml"), "bottom": read("bottom-bar.toml")}))
-		blocks := held(t, power, builtWith("power", map[string]string{"battery": read("bar-battery"), "draw": read("bar-power-draw")}))
-		r, err := Resolve(shelf(bars, blocks), []string{"bars", "power"}, workstation(), World{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		r.Account, r.Capabilities = "op", caps
-		// Not handed: the controller fills them.
-		for id, which := range map[string]string{"bars.top": "top", "bars.bottom": "bottom"} {
-			if got := composedFile(t, r, id); got != read(name+"."+which+"-bar.toml") {
-				t.Errorf("%s, %s bar, not handed:\n%s\nwant\n%s", name, which, got, read(name+"."+which+"-bar.toml"))
-			}
-		}
-		// Handed: the plan names the items the machine's capabilities allow, for the client to fill.
-		c, _ := composeWith(t, r, handingTo("store:5000"))
-		var names []string
-		for _, it := range c.Plans["power"].Items {
-			names = append(names, it.Name)
-		}
-		want := []string{}
-		if caps["battery"] {
-			want = append(want, "battery")
-		}
-		if caps["power-meter"] {
-			want = append(want, "power-draw")
-		}
-		if !reflect.DeepEqual(append([]string{}, names...), want) {
-			t.Errorf("%s: the plan names %v, want %v", name, names, want)
-		}
-	}
-}
diff --git a/internal/catalogue/collections_l2_test.go b/internal/catalogue/collections_l2_test.go
deleted file mode 100644
index c16c4a0d..00000000
--- a/internal/catalogue/collections_l2_test.go
+++ /dev/null
@@ -1,60 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// The collectors design 57 L2 moved (issue 681), composed with nothing handed: zsh's rc, triggerhappy's triggers and
-// power's after-wake moment, from the catalogue's real templates and its moved contributors' real items, are byte
-// for byte what the controller composed from the old forms before the move (testdata/l2-moved: templates/ and items/
-// copied from mesh-catalog at the move, want/ composed at the feature branch before it).
-
-func l2Moved(t *testing.T, parts ...string) string {
-	t.Helper()
-	raw, err := os.ReadFile(filepath.Join(append([]string{"testdata", "l2-moved"}, parts...)...))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(raw)
-}
-
-func TestTheCollectorsL2MovedComposeAsBeforeWhereNothingIsHanded(t *testing.T) {
-	// Each moved contributor, its items read back from its templates archive as the mesh holds them.
-	items := map[string][]string{
-		"asus-zephyrus-g14":       {"shell:after-wake:normal", "contribution:node-hotkeys:trigger"},
-		"claude-code":             {"shell:zsh:normal"},
-		"mesh-cli":                {"shell:zsh:normal"},
-		"powerlevel10k":           {"shell:zsh:normal"},
-		"zsh-autosuggestions":     {"shell:zsh:normal"},
-		"zsh-syntax-highlighting": {"shell:zsh:last"},
-	}
-	var modules []Manifest
-	for _, module := range sortedKeys(items) {
-		m := Manifest{Module: module, Moved: true}
-		for _, collection := range items[module] {
-			m.Items = append(m.Items, Item{Collection: collection,
-				Content: l2Moved(t, "items", module+"."+strings.ReplaceAll(collection, ":", "-"))})
-		}
-		modules = append(modules, m)
-	}
-	for _, c := range []struct{ module, seat string }{{"zsh", LoginShellSeat}, {"triggerhappy", HotkeysSeat},
-		{"power", PowerSeat}} {
-		holder := Manifest{Module: c.module, Moved: true, Claims: []Claim{{Name: c.seat}}}
-		resource := map[string]any{"id": "file", "type": "file", "path": "/etc/" + c.module,
-			"content": l2Moved(t, "templates", c.module)}
-		var unplaced []string
-		if err := contributionsInto(resource, holder, append([]Manifest{holder}, modules...),
-			map[string]string{"name": "g14"}, Rendering{}, map[string]bool{}, &unplaced); err != nil {
-			t.Fatalf("%s: %v", c.module, err)
-		}
-		if got, want := resource["content"], l2Moved(t, "want", c.module); got != want {
-			t.Errorf("%s's file is not what the old forms made:\n%s\nwant:\n%s", c.module, got, want)
-		}
-		if len(unplaced) != 0 {
-			t.Errorf("%s: unplaced %v", c.module, unplaced)
-		}
-	}
-}
diff --git a/internal/catalogue/collections_l3_test.go b/internal/catalogue/collections_l3_test.go
deleted file mode 100644
index 4c687a45..00000000
--- a/internal/catalogue/collections_l3_test.go
+++ /dev/null
@@ -1,158 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// An item may carry attributes and a capability, a module may give several items to one collection, and a
-// placeholder may select by attributes (design 57 L3, issue 777). The controller leaves out of a plan an item whose
-// capability the machine lacks, accepts a selecting placeholder where it accepts the collection, and renders a
-// selected moved item into an old placeholder exactly as the contribution it replaces.
-
-const (
-	barCollector = `{"module":"bars","version":"1","moved":true,
-  "collections":[{"name":"blocks","comment":"#"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"conf","type":"file","path":"/etc/bars.conf","template":"files/bars"}]}`
-	barsText      = "top\n${collected:blocks:bar=top,place=status}bottom\n${collected:blocks:bar=bottom,place=status}${collected:blocks}"
-	barContribute = `{"module":"power","version":"1","moved":true,
-  "items":[{"collection":"blocks","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"20"},"template":"files/battery"},
-           {"collection":"blocks","name":"clock","attributes":{"bar":"top","place":"status"},"template":"files/clock"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-)
-
-func blocksOn(t *testing.T, caps map[string]bool) Composed {
-	t.Helper()
-	bars := held(t, barCollector, builtWith("bars", map[string]string{"bars": barsText}))
-	power := held(t, barContribute, builtWith("power", map[string]string{"battery": "B\n", "clock": "C\n"}))
-	r, err := Resolve(shelf(bars, power), []string{"bars", "power"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account, r.Capabilities = "op", caps
-	c, _ := composeWith(t, r, handingTo("store:5000"))
-	return c
-}
-
-func TestAnItemWhoseCapabilityTheMachineLacksIsLeftOutOfItsPlan(t *testing.T) {
-	with := blocksOn(t, map[string]bool{"battery": true}).Plans["power"]
-	want := []PlanItem{
-		{Collection: "blocks", Name: "battery", Template: "battery",
-			Attributes: map[string]string{"bar": "bottom", "place": "status", "order": "20"}},
-		{Collection: "blocks", Name: "clock", Template: "clock", Attributes: map[string]string{"bar": "top", "place": "status"}},
-	}
-	if !reflect.DeepEqual(with.Items, want) {
-		t.Fatalf("with the capability the plan carries %+v", with.Items)
-	}
-	without := blocksOn(t, map[string]bool{"seat": true}).Plans["power"]
-	if !reflect.DeepEqual(without.Items, want[1:]) {
-		t.Fatalf("without it the plan carries %+v", without.Items)
-	}
-}
-
-func TestACollectorSelectingByAttributesCollectsTheCollectionOnce(t *testing.T) {
-	bars := blocksOn(t, nil).Plans["bars"]
-	if !reflect.DeepEqual(bars.Collections, []PlanCollection{{Name: "blocks", Comment: "#"}}) {
-		t.Fatalf("the plan collects %+v", bars.Collections)
-	}
-}
-
-func TestASelectorIsRefusedWhenMalformedOrNamingACollectionNotCollected(t *testing.T) {
-	for placeholder, want := range map[string]string{
-		"${collected:blocks:bar}":                "", // no equals sign: a collection named blocks:bar
-		"${collected:blocks:bar=top,bar=bottom}": "names bar twice",
-		"${collected:blocks:bar=}":               "is not <attribute>=<value>",
-		"${collected:other:bar=top}":             `does not collect "other"`,
-	} {
-		raw := strings.Replace(barCollector, `"template":"files/bars"`, `"content":"`+placeholder+`"`, 1)
-		raw = strings.Replace(raw, `"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},`, "", 1)
-		raw = strings.Replace(raw, `"moved":true,`, "", 1)
-		m, err := ParseManifest([]byte(raw))
-		if err == nil {
-			_, err = (Resolution{Node: "n", Modules: []Manifest{m}}).Declaration(Rendering{})
-		}
-		if want == "" {
-			continue
-		}
-		if err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: %v, want %q", placeholder, err, want)
-		}
-	}
-}
-
-func TestItemNamesAttributesAndCapabilitiesAreJudged(t *testing.T) {
-	item := func(extra string) string {
-		return `{"module":"p","moved":true,"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},` +
-			`"items":[` + extra + `]}`
-	}
-	for items, want := range map[string]string{
-		`{"collection":"c","name":"a","template":"files/a"},{"collection":"c","template":"files/b"}`:            "has no name",
-		`{"collection":"c","name":"a","template":"files/a"},{"collection":"c","name":"a","template":"files/b"}`: "twice",
-		`{"collection":"c","name":"Big","template":"files/a"}`:                                                  "is not a name",
-		`{"collection":"c","attributes":{"order":"100"},"template":"files/a"}`:                                  "0 to 99",
-		`{"collection":"c","attributes":{"bar":"a b"},"template":"files/a"}`:                                    "is not a value",
-		`{"collection":"c","if-capability":"batery","template":"files/a"}`:                                      "no machine reports",
-		`{"collection":"contribution:node-bar:block","attributes":{"bar":"left"},"template":"files/a"}`:         "bar=left",
-		`{"collection":"contribution:node-bar:block","attributes":{"colour":"red"},"template":"files/a"}`:       `"colour" is none of them`,
-		`{"collection":"c","name":"a","template":"files/a","colour":"red"}`:                                     "colour",
-	} {
-		_, err := ParseManifest([]byte(item(items)))
-		if err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: %v, want %q", items, err, want)
-		}
-	}
-	ok := item(`{"collection":"contribution:node-bar:block","name":"a","attributes":{"bar":"top","place":"status","order":"5"},"if-capability":"battery","template":"files/a"}`)
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// A moved contributor's items, selected by the old placeholder's pair, render in the old order (order, module, item
-// name) and with the same lines as the contributions they replace.
-func TestASelectedMovedItemRendersIntoTheOldBarPlaceholderAsTheContributionDid(t *testing.T) {
-	piece := func(order, command string) string {
-		return "[[block]]\nblock = \"custom\"\ncommand = \"" + command + "\"\ninterval = 5\n"
-	}
-	asOld := Manifest{Module: "power", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","order":20,"shows":"command","options":{"command":"two","interval":5}}`),
-		block(`{"bar":"bottom","place":"status","shows":"command","options":{"command":"one","interval":5}}`),
-		block(`{"bar":"top","place":"resources","shows":"command","options":{"command":"up","interval":5}}`),
-	}}
-	asItems := Manifest{Module: "power", Moved: true, Items: []Item{
-		{Collection: "contribution:node-bar:block", Name: "b", Content: piece("", "one"),
-			Attributes: map[string]string{"bar": "bottom", "place": "status"}},
-		{Collection: "contribution:node-bar:block", Name: "a", Content: piece("", "two"),
-			Attributes: map[string]string{"bar": "bottom", "place": "status", "order": "20"}},
-		{Collection: "contribution:node-bar:block", Name: "c", Content: piece("", "up"),
-			Attributes: map[string]string{"bar": "top", "place": "resources"}},
-		{Collection: "contribution:node-bar:block", Name: "d", Content: "x\n", IfCapability: "battery",
-			Attributes: map[string]string{"bar": "bottom", "place": "status"}},
-	}}
-	other := Manifest{Module: "another", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","order":20,"shows":"command","options":{"command":"mid","interval":5}}`)}}
-	for _, caps := range []map[string]bool{nil, {"battery": true}} {
-		was := composedFile(t, Resolution{Node: "n", Account: "op", Capabilities: caps,
-			Modules: []Manifest{barHolder(), asOld, other}}, "a-bar.bottom")
-		is := composedFile(t, Resolution{Node: "n", Account: "op", Capabilities: caps,
-			Modules: []Manifest{barHolder(), asItems, other}}, "a-bar.bottom")
-		// The old form puts the contributions of a module under one line naming it and the item form puts one under
-		// each item: the same pieces in the same order, otherwise the same bytes.
-		want := "own-first\nown-middle\n# another\n" + piece("", "mid") + "# power\n" + piece("", "two") +
-			"# power\n" + piece("", "one")
-		if caps["battery"] {
-			want += "# power\nx\n"
-		}
-		want += "own-last\n"
-		if is != want {
-			t.Errorf("caps %v: the items render\n%s\nnot\n%s", caps, is, want)
-		}
-		if !strings.Contains(was, piece("", "two")) {
-			t.Errorf("the contributions made\n%s", was)
-		}
-	}
-	if got := composedFile(t, Resolution{Node: "n", Account: "op", Modules: []Manifest{barHolder(), asItems}}, "a-bar.top"); !strings.Contains(got, "\"up\"") || strings.Contains(got, `"one"`) {
-		t.Errorf("the top bar renders\n%s", got)
-	}
-}
diff --git a/internal/catalogue/collections_test.go b/internal/catalogue/collections_test.go
deleted file mode 100644
index c9aaf1b9..00000000
--- a/internal/catalogue/collections_test.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A collection is declared and filled by the client (novox/hq ADR 0349 §13, design 57 L1, issue 684): a collector
-// names a collection it collects, a contributor an item from a template of its own, and a handed composition plans
-// both for the node's provisioner client and renders neither. The three old namespaces read as collections of their
-// own name. Each file is filled one way: a piece of the other form on the machine is said as not placed.
-
-const (
-	collectorZsh = `{"module":"zsh","version":"1","moved":true,
-  "claims":[{"name":"node-login-shell","scope":"node"}],
-  "collections":[{"name":"widgets","comment":"#"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"rc","type":"file","path":"${machine:account-home}/.zshrc","owner":"${machine:account}",
-    "mode":"0644","template":"files/zshrc"}]}`
-	zshrcText       = "# zsh\n${shell:zsh:normal}${collected:widgets}"
-	contributorText = "source ${machine:account-home}/.p10k.zsh\n"
-	contributorP10k = `{"module":"prompt","version":"1","moved":true,
-  "items":[{"collection":"shell:zsh:normal","template":"files/zsh"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
-	oldFormAliases = `{"module":"aliases","version":"1",
-  "shell":[{"for":"zsh","slot":"normal","code":"alias ll='ls -l'\n"}]}`
-)
-
-func builtWith(module string, texts map[string]string) []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + module + "/files/blobs/sha256:" + strings.Repeat("e", 64),
-		Digest:    "sha256:" + strings.Repeat("e", 64), Texts: texts}}
-}
-
-func collectionsOn(t *testing.T) Resolution {
-	t.Helper()
-	zsh := held(t, collectorZsh, builtWith("zsh", map[string]string{"zshrc": zshrcText}))
-	prompt := held(t, contributorP10k, builtWith("prompt", map[string]string{"zsh": contributorText}))
-	aliases, err := ParseManifest([]byte(oldFormAliases))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r, err := Resolve(shelf(zsh, prompt, aliases), []string{"zsh", "prompt", "aliases"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	return r
-}
-
-func TestAContributorsBuildKeepsItsItemsTemplateAndText(t *testing.T) {
-	m := held(t, contributorP10k, builtWith("prompt", map[string]string{"zsh": contributorText}))
-	if m.Handed == nil || !reflect.DeepEqual(m.Handed.Items, map[string]string{"shell:zsh:normal": "zsh"}) {
-		t.Fatalf("the build kept %+v", m.Handed)
-	}
-	if !reflect.DeepEqual(m.Items, []Item{{Collection: "shell:zsh:normal", Content: contributorText}}) {
-		t.Fatalf("the held items are %+v: the template's text, read back", m.Items)
-	}
-}
-
-func TestAHandedCollectorAndContributorArePlannedAndNeitherIsRendered(t *testing.T) {
-	c, got := composeWith(t, collectionsOn(t), handingTo("store:5000"))
-	if strings.Contains(got, ".p10k.zsh") || strings.Contains(got, "alias ll") {
-		t.Fatalf("the controller rendered a contribution into a handed collector: %s", got)
-	}
-	zsh, prompt := c.Plans["zsh"], c.Plans["prompt"]
-	wantCollections := []PlanCollection{{Name: "shell:zsh:normal", Comment: "#"}, {Name: "widgets", Comment: "#"}}
-	if !reflect.DeepEqual(zsh.Collections, wantCollections) || len(zsh.Items) != 0 {
-		t.Fatalf("zsh's plan collects %+v and contributes %+v", zsh.Collections, zsh.Items)
-	}
-	if !reflect.DeepEqual(prompt.Items, []PlanItem{{Collection: "shell:zsh:normal", Template: "zsh"}}) ||
-		len(prompt.Files) != 0 || prompt.Placement["machine:account-home"] != "/home/op" {
-		t.Fatalf("prompt's plan is %+v: its item, by template, and the placement its template names", prompt)
-	}
-	// The old form on the same machine is not placed, and said so.
-	if len(c.Unplaced) != 1 || !strings.Contains(c.Unplaced[0], "aliases's shell:zsh:normal is not placed") {
-		t.Fatalf("unplaced: %v", c.Unplaced)
-	}
-}
-
-// A collector filled the old way holds the old forms and each moved contributor's item, rendered from the text the
-// mesh holds as its old form was (design 57 L2, issue 681), so the file loses no line where nothing is handed; a
-// collection of the new form stays empty.
-func TestACollectorFilledTheOldWayHoldsTheOldFormsAndEachHeldItem(t *testing.T) {
-	c, got := composeWith(t, collectionsOn(t), Rendering{ArtifactStore: "store:5000"})
-	if c.Plans != nil {
-		t.Fatalf("handed on a machine that cannot take it: %v", c.Plans)
-	}
-	if !strings.Contains(got, `"content":"# zsh\n# aliases\nalias ll='ls -l'\n# prompt\nsource /home/op/.p10k.zsh\n"`) {
-		t.Fatalf("the old way does not hold the old forms and the held item in module order: %s", got)
-	}
-	if len(c.Unplaced) != 0 {
-		t.Fatalf("unplaced: %v", c.Unplaced)
-	}
-}
-
-// An item the controller cannot render the old way (it names a value but a machine fact) is said as not placed.
-func TestAHeldItemNamingMoreThanAFactIsSaidNotPlacedTheOldWay(t *testing.T) {
-	zsh := held(t, collectorZsh, builtWith("zsh", map[string]string{"zshrc": zshrcText}))
-	if _, ok := heldItemText(Manifest{Module: "p", Items: []Item{{Collection: "shell:zsh:normal",
-		Content: "export THEME=${config:theme}\n"}}}, "shell:zsh:normal", map[string]string{}); ok {
-		t.Fatal("an item naming a config value was rendered by the controller")
-	}
-	if _, ok := heldItemText(Manifest{Module: "p", Items: []Item{{Collection: "shell:zsh:normal",
-		Content: "cd ${machine:account-home}\n"}}}, "shell:zsh:normal", map[string]string{}); ok {
-		t.Fatal("an item naming a fact this machine lacks was rendered")
-	}
-	if _, ok := heldItemText(Manifest{Module: "p", Items: []Item{{Collection: "widgets", Content: "x\n"}}},
-		"widgets", nil); ok {
-		t.Fatal("an item of a collection of the new form was rendered the old way")
-	}
-	left := itemsLeftOut([]Manifest{zsh, {Module: "p", Items: []Item{{Collection: "shell:zsh:normal",
-		Content: "export THEME=${config:theme}\n"}}}}, zsh, "shell:zsh:normal", map[string]string{})
-	if len(left) != 1 || !strings.Contains(left[0], "p's item of shell:zsh:normal is not placed") {
-		t.Fatalf("left out: %v", left)
-	}
-}
-
-// Each old namespace L2 moves renders a moved contributor's item exactly as its old form did, where the collector is
-// not handed: the same contributor written both ways composes the same bytes (design 57 L2, issue 681).
-func TestAMovedContributorsItemRendersAsItsOldFormDid(t *testing.T) {
-	code := "# two lines\nalias a=b"
-	asOld := Manifest{Module: "laptop", Shell: []ShellCode{{For: "zsh", Slot: "normal", Code: code}},
-		Contributions: []SeatContribution{{Seat: HotkeysSeat, Kind: "trigger", Content: "KEY_F21 1 touchpad\n"}}}
-	asItem := Manifest{Module: "laptop", Moved: true, Items: []Item{{Collection: "shell:zsh:normal", Content: code},
-		{Collection: "contribution:node-hotkeys:trigger", Content: "KEY_F21 1 touchpad\n"}}}
-	other := Manifest{Module: "zz-other", Shell: []ShellCode{{For: "zsh", Slot: "normal", Code: "x=1\n"}},
-		Contributions: []SeatContribution{{Seat: HotkeysSeat, Kind: "trigger", Content: "KEY_MUTE 1 mute\n"}}}
-	first := Manifest{Module: "aa-first", Shell: []ShellCode{{For: "zsh", Slot: "normal", Code: "y=2\n"}}}
-	for _, mods := range [][]Manifest{{other, first}, {}} {
-		was := append(append([]Manifest(nil), mods...), asOld)
-		is := append(append([]Manifest(nil), mods...), asItem)
-		if a, b := shellCodeOn(was, "zsh", "normal", nil), shellCodeOn(is, "zsh", "normal", nil); a != b || a == "" {
-			t.Errorf("shell: the old form made %q, the item %q", a, b)
-		}
-		a, _, errA := seatContributions(was, hotkeysHolder(), "node-hotkeys:trigger", Rendering{}, nil, nil)
-		b, left, errB := seatContributions(is, hotkeysHolder(), "node-hotkeys:trigger", Rendering{}, nil, nil)
-		if errA != nil || errB != nil || a != b || a == "" || len(left) != 0 {
-			t.Errorf("hotkeys: the old form made %q, the item %q (%v %v %v)", a, b, errA, errB, left)
-		}
-	}
-}
-
-func TestCollectionsAndItemsAreJudged(t *testing.T) {
-	for name, c := range map[string]struct{ raw, says string }{
-		"an item of a module not moved": {`{"module":"m","version":"1",
-  "items":[{"collection":"shell:zsh:normal","template":"files/x"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is marked moved"},
-		"two items to one collection": {`{"module":"m","version":"1","moved":true,
-  "items":[{"collection":"a","template":"files/x"},{"collection":"a","template":"files/y"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "contributes to a twice"},
-		"an item to no slot": {`{"module":"m","version":"1","moved":true,
-  "items":[{"collection":"shell:zsh:middle","template":"files/x"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is no slot"},
-		"an item outside the templates": {`{"module":"m","version":"1","moved":true,
-  "items":[{"collection":"a","template":"x"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, "is not a file under files/"},
-		"an item naming a secret": {`{"module":"m","version":"1",
-  "items":[{"collection":"a","content":"t=${secret:token}"}]}`, "where no secret is"},
-		"a collection not declared": {`{"module":"m","version":"1",
-  "resources":[{"id":"f","type":"file","path":"/f","content":"${collected:a}"}]}`, "does not collect"},
-		"an old namespace declared": {`{"module":"m","version":"1","collections":[{"name":"shell:zsh:normal"}],
-  "resources":[{"id":"f","type":"file","path":"/f","content":"x"}]}`, "read from its placeholder"},
-		"a collection placed nowhere": {`{"module":"m","version":"1","collections":[{"name":"a"}],
-  "resources":[{"id":"f","type":"file","path":"/f","content":"x"}]}`, "no file of its places it"},
-		"a collection in a path": {`{"module":"m","version":"1","collections":[{"name":"a"}],
-  "resources":[{"id":"f","type":"file","path":"/${collected:a}","content":"${collected:a}"}]}`,
-			"only in a file's content"},
-	} {
-		_, err := ParseManifest([]byte(c.raw))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v, want it to say %q", name, err, c.says)
-		}
-	}
-	if _, err := ParseManifest([]byte(collectorZsh)); err != nil {
-		t.Errorf("a collector: %v", err)
-	}
-}
diff --git a/internal/catalogue/computed_test.go b/internal/catalogue/computed_test.go
deleted file mode 100644
index ccdd1986..00000000
--- a/internal/catalogue/computed_test.go
+++ /dev/null
@@ -1,205 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// A module whose files cannot be written in advance.
-//
-// The mesh's private network is the case: a machine's peer list is derived from every other
-// machine, so it differs on each one and changes when any of them changes. What matters in these
-// tests is not that it works, but that being computed changes *nothing else* about being a
-// module — it is assigned, resolved, settled and absent when nobody asked for it.
-
-type fake struct {
-	on    map[string]bool
-	asked []string
-	err   error
-}
-
-func (f *fake) Resources(node string) ([]map[string]any, bool, error) {
-	f.asked = append(f.asked, node)
-	if f.err != nil {
-		return nil, false, f.err
-	}
-	if !f.on[node] {
-		return nil, false, nil
-	}
-	return []map[string]any{{"id": "peers", "type": "file", "path": "/etc/x.conf",
-		"merge": MergeJSON, "content": `{"peer":"` + node + `"}`}}, true, nil
-}
-
-func computedShelf() map[string]Manifest {
-	return shelf(Manifest{Module: "mesh-network", Computed: "mesh-network",
-		Provides: Offers("private-network")})
-}
-
-func TestAComputedModuleIsAskedAboutTheNodeItIsFor(t *testing.T) {
-	// The generator gets a node name, not a plan. Everything it needs is the whole mesh, which
-	// it was built with — this is the one thing a node could never work out for itself.
-	got, err := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	gen := &fake{on: map[string]bool{"workstation": true}}
-	out, err := got.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(gen.asked) != 1 || gen.asked[0] != "workstation" {
-		t.Fatalf("asked about %v, wanted workstation once", gen.asked)
-	}
-	if len(out) != 1 || !strings.Contains(out[0]["content"].(string), `"peer": "workstation"`) {
-		t.Fatalf("got %v", out)
-	}
-}
-
-func TestAMachineNobodyGaveItGetsNothing(t *testing.T) {
-	// The whole point of making the network a module. Before this, every machine with an address
-	// was on the private network and there was no way to say one should stay off.
-	got, err := Resolve(computedShelf(), nil, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	gen := &fake{on: map[string]bool{"workstation": true}}
-	out, err := got.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(out) != 0 {
-		t.Fatalf("a machine that was assigned nothing got %d resource(s)", len(out))
-	}
-	if len(gen.asked) != 0 {
-		t.Fatalf("the generator was asked about %v, and nobody had asked for it", gen.asked)
-	}
-}
-
-func TestAssignedAndNotYetPartOfItIsNotAFailure(t *testing.T) {
-	// A machine given the network module before it has a place on it. Brief and ordinary — the
-	// answer is "nothing yet", and treating it as an error would make an ordering a fault.
-	got, _ := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), World{})
-	gen := &fake{on: map[string]bool{}}
-	out, err := got.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
-	if err != nil {
-		t.Fatalf("refused a node that is not on the network yet: %v", err)
-	}
-	if len(out) != 0 {
-		t.Fatalf("got %v", out)
-	}
-}
-
-func TestAGeneratorThisControlPlaneDoesNotHaveIsRefused(t *testing.T) {
-	// Sending a machine a module with no files would look like it worked. Named in the message,
-	// because the only fix is a control plane that has it.
-	got, _ := Resolve(shelf(Manifest{Module: "weather", Computed: "the-weather"}), []string{"weather"}, workstation(), World{})
-
-	_, err := got.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": &fake{}}})
-	if err == nil {
-		t.Fatal("a module computed by nothing was accepted")
-	}
-	if !strings.Contains(err.Error(), "the-weather") {
-		t.Fatalf("the refusal does not name what is missing: %v", err)
-	}
-}
-
-func TestAModuleIsEitherWrittenOrComputedNotBoth(t *testing.T) {
-	// Otherwise nobody could say where a given file on a machine came from.
-	_, err := ParseManifest([]byte(`{"module":"mesh-network","version":"1",
-		"computed":"mesh-network",
-		"resources":[{"id":"a","type":"package","package":"wireguard-tools"}]}`))
-	if err == nil {
-		t.Fatal("a module that both ships files and has them computed was accepted")
-	}
-	if !strings.Contains(err.Error(), "one or the other") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestSettingsApplyToAComputedModuleToo(t *testing.T) {
-	// Being computed is about where the files come from, not about whether they are configurable.
-	// A line drawn there would be arbitrary and nobody could predict it.
-	got, _ := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), World{})
-	gen := &fake{on: map[string]bool{"workstation": true}}
-	out, err := got.Declaration(Rendering{
-		Generators: map[string]Generator{"mesh-network": gen},
-		Settings: SettingsBy{"mesh-network": {{From: "the mesh",
-			Values: map[string]any{"keepalive": 25}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	content := out[0]["content"].(string)
-	if !strings.Contains(content, `"keepalive": 25`) {
-		t.Fatalf("the setting did not reach a computed file: %s", content)
-	}
-	if !strings.Contains(content, `"peer": "workstation"`) {
-		t.Fatalf("the setting replaced what the generator computed: %s", content)
-	}
-}
-
-func TestTwoWaysToBeOnAPrivateNetworkRefuseAndNameBoth(t *testing.T) {
-	// WireGuard is one way. The refusing rule is what makes a second one safe to add: assigning
-	// both is caught rather than producing a machine on two networks that each half-work.
-	_, err := Resolve(shelf(
-		Manifest{Module: "mesh-network", Computed: "mesh-network",
-			Provides: Offers("private-network")},
-		Manifest{Module: "tailscale", Provides: Offers("private-network")},
-		Manifest{Module: "backups", Requires: []string{"private-network"}},
-	), []string{"backups"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("two answers to one requirement were taken silently")
-	}
-	for _, want := range []string{"mesh-network", "tailscale", "private-network"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
-
-// reloading answers the runtime's trust as the networking module once did (novox/hq ADR 0102; it no
-// longer does, ADR 0222 — and beside the runtime's module it is refused, generated_collision_test): a file
-// written into, and the runtime reloaded on it.
-type reloading struct{}
-
-func (reloading) Resources(node string) ([]map[string]any, bool, error) {
-	return []map[string]any{
-		{"id": "registry-trust", "type": "file", "path": "/etc/docker/daemon.json",
-			"merge": MergeJSON, "into": "json", "content": `{"insecure-registries":["r:5000"]}`},
-		{"id": "registry-trust-reload", "type": "service", "unit": "docker.service",
-			"state": "running", "reload-on": []string{"registry-trust"}},
-	}, true, nil
-}
-
-func TestWhatAServiceIsReloadedOnIsNamedAsTheHostWillSeeIt(t *testing.T) {
-	// Ids are prefixed with their module on the way out. An unprefixed reload-on would name a
-	// resource the host never sees, and the runtime would never be reloaded for its trust.
-	got, err := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": reloading{}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var file, service map[string]any
-	for _, r := range out {
-		switch r["type"] {
-		case "file":
-			file = r
-		case "service":
-			service = r
-		}
-	}
-	if file == nil || service == nil {
-		t.Fatalf("got %v", out)
-	}
-	if file["into"] != "json" {
-		t.Errorf("into did not reach the host: %v", file)
-	}
-	if want := "[" + file["id"].(string) + "]"; fmt.Sprint(service["reload-on"]) != want {
-		t.Errorf("reload-on names %v, the file is %v", service["reload-on"], file["id"])
-	}
-}
diff --git a/internal/catalogue/config_rename_test.go b/internal/catalogue/config_rename_test.go
deleted file mode 100644
index 35ed21aa..00000000
--- a/internal/catalogue/config_rename_test.go
+++ /dev/null
@@ -1,185 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A takes-config entry may lay a value under the name the file's software reads (issue 751): the key stays a
-// config key, lower-case, and the file names its own variable, such as ATLASSIAN_URL.
-
-// renaming is inConfigForm with its rules file taking `url` as NOTIFIER_URL, a value the code reading the file
-// falls back on when the file lacks it.
-func renaming() map[string]any {
-	m := inConfigForm()
-	m["config"].(map[string]any)["url"] = map[string]any{"type": "string",
-		"description": "the address the notifier posts to, a URL; unset, the notifier's own environment says it",
-		"default":     ""}
-	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme",
-		map[string]any{"key": "url", "as": "NOTIFIER_URL"}}
-	return m
-}
-
-// rulesComposed is the rules file's content as the module's defaults and these layers make it.
-func rulesComposed(t *testing.T, m Manifest, layers ...Layer) string {
-	t.Helper()
-	all := layers
-	if d, ok := Defaults(m); ok {
-		all = append([]Layer{d}, layers...)
-	}
-	for _, r := range m.Resources {
-		if r["id"] != "rules" {
-			continue
-		}
-		out, err := ApplySettings(r, all)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, left := out[TakesSettingsField]; left {
-			t.Fatalf("the composed file still says %s: %v", TakesSettingsField, out)
-		}
-		return out["content"].(string)
-	}
-	t.Fatal("no rules file")
-	return ""
-}
-
-func TestATakenValueIsLaidUnderTheFilesOwnName(t *testing.T) {
-	m, err := parseRaw(t, renaming())
-	if err != nil {
-		t.Fatalf("a renamed takes-config entry was refused: %v", err)
-	}
-	got := rulesComposed(t, m, Layer{From: "ace", Values: map[string]any{"url": "https://hooks.example.test/n"}})
-	var doc map[string]any
-	if err := json.Unmarshal([]byte(got), &doc); err != nil {
-		t.Fatal(err)
-	}
-	if doc["NOTIFIER_URL"] != "https://hooks.example.test/n" {
-		t.Fatalf("url was not laid as NOTIFIER_URL: %s", got)
-	}
-	if _, said := doc["url"]; said {
-		t.Fatalf("url was laid under the config key too: %s", got)
-	}
-}
-
-func TestAnUnsetRenamedValueLeavesTheFileAsItWas(t *testing.T) {
-	plain := inConfigForm()
-	base, err := parseRaw(t, plain)
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := parseRaw(t, renaming())
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := rulesComposed(t, base)
-	if got := rulesComposed(t, m); got != want {
-		t.Fatalf("with no layer the file is\n%s\nwanted, as without the entry,\n%s", got, want)
-	}
-	other := Layer{From: "ace", Values: map[string]any{"theme": "light"}}
-	if got, want := rulesComposed(t, m, other), rulesComposed(t, base, other); got != want {
-		t.Fatalf("with url unset the file is\n%s\nwanted\n%s", got, want)
-	}
-}
-
-// A layer said before its module moved names the file's own spelling, such as nodered's timeZone on one machine.
-// Until K5 moves the layer and renames the key, that spelling still reaches the file, so the move changes no
-// machine's file; the config key wins where one layer says both.
-func TestALayerStillSayingTheFilesNameReachesItUntilItsMove(t *testing.T) {
-	m, err := parseRaw(t, renaming())
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, said := range []string{"url", "NOTIFIER_URL"} {
-		if stray := UnusedSettings(m, []Layer{{From: "ace", Values: map[string]any{said: "https://x.test"}}}); len(stray) > 0 {
-			t.Fatalf("%s, which the rules file takes, is said stray: %v", said, stray)
-		}
-		got := rulesComposed(t, m, Layer{From: "ace", Values: map[string]any{said: "https://x.test"}})
-		var doc map[string]any
-		if err := json.Unmarshal([]byte(got), &doc); err != nil {
-			t.Fatal(err)
-		}
-		if doc["NOTIFIER_URL"] != "https://x.test" || doc["url"] != nil {
-			t.Fatalf("a layer saying %s made the file %s", said, got)
-		}
-	}
-	both := rulesComposed(t, m, Layer{From: "ace", Values: map[string]any{"url": "https://key.test", "NOTIFIER_URL": "https://old.test"}})
-	if !strings.Contains(both, "https://key.test") || strings.Contains(both, "old.test") {
-		t.Fatalf("where one layer says both, the config key did not win: %s", both)
-	}
-	later := rulesComposed(t, m, Layer{From: "mesh", Values: map[string]any{"url": "https://mesh.test"}},
-		Layer{From: "ace", Values: map[string]any{"NOTIFIER_URL": "https://ace.test"}})
-	if !strings.Contains(later, "https://ace.test") {
-		t.Fatalf("a later layer's old spelling did not beat an earlier layer's key: %s", later)
-	}
-	// Who may set it is the same under either spelling: the rules file is trusted, so both are the terminal's.
-	terminal := TerminalKeys(m)
-	for _, k := range []string{"url", "NOTIFIER_URL"} {
-		if !listHolds(terminal, k) {
-			t.Fatalf("%s is not the terminal's in a trusted file: %v", k, terminal)
-		}
-	}
-}
-
-func listHolds(list []string, s string) bool {
-	for _, x := range list {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-
-func TestARenamedEntryIsWrittenBackAsItWasSaid(t *testing.T) {
-	m, err := parseRaw(t, renaming())
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(raw), `"takes-config":["position","theme",{"as":"NOTIFIER_URL","key":"url"}]`) {
-		t.Fatalf("written back as %s", raw)
-	}
-	if _, err := ParseManifest(raw); err != nil {
-		t.Fatalf("read again: %v", err)
-	}
-}
-
-func TestARenamedEntryIsRefusedWhereItCouldNotHold(t *testing.T) {
-	entry := func(m map[string]any, e any) map[string]any {
-		resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", e}
-		return m
-	}
-	refused(t, entry(renaming(), map[string]any{"key": "url"}), "notifier's rules", `"key" and "as"`)
-	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER_URL", "when": "set"}), `"key" and "as"`)
-	refused(t, entry(renaming(), map[string]any{"key": "URL", "as": "NOTIFIER_URL"}), "not a usable key")
-	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER URL"}), "not a usable name")
-	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "endpoints"}), `"endpoints"`, "the mesh reads")
-	refused(t, entry(renaming(), map[string]any{"key": "url", "as": "theme"}), `"theme"`, "twice")
-	refused(t, entry(renaming(), map[string]any{"key": "theme", "as": "THEME"}), `"theme"`, "twice")
-	refused(t, entry(renaming(), map[string]any{"key": "nothing", "as": "NOTHING"}), `"nothing"`, "declares no such value")
-
-	kept := entry(renaming(), map[string]any{"key": "url", "as": "NOTIFIER_URL"})
-	resourceOf(kept, "rules")["protected"] = []any{"NOTIFIER_URL"}
-	refused(t, kept, `"NOTIFIER_URL"`, "protected")
-
-	// Laid only when set, so the code's own fallback holds: never required.
-	required := renaming()
-	declaration(required, "url")["required"] = true
-	delete(declaration(required, "url"), "default")
-	refused(t, required, `"url"`, "only when it is set", "never required")
-}
-
-func TestARenamedEntryIsTheConfigFormsOnly(t *testing.T) {
-	m := map[string]any{
-		"module": "notifier", "version": "1",
-		"resources": []any{
-			map[string]any{"id": "rules", "type": "file", "path": "/x/rules.json", "merge": "json", "content": "{}",
-				"takes-settings": []any{map[string]any{"key": "url", "as": "NOTIFIER_URL"}}},
-		},
-	}
-	refused(t, m, "notifier's rules", "config form")
-}
diff --git a/internal/catalogue/config_test.go b/internal/catalogue/config_test.go
deleted file mode 100644
index fd7f55ee..00000000
--- a/internal/catalogue/config_test.go
+++ /dev/null
@@ -1,484 +0,0 @@
-package catalogue
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"strings"
-	"testing"
-)
-
-// A module declares its config (novox/hq ADR 0348 §1, §4, §5, §6, §8, §11; design 57 package K1, issue 660):
-// one registration refusal per rule of design 57's K1, the old names read as aliases, and a module rewritten
-// from settings to config composing byte-identically.
-
-// inConfigForm is a module in the config form that registers: every value typed, described, defaulted or
-// required, placed in a file or read at runtime, and its mergeable file naming its keys.
-func inConfigForm() map[string]any {
-	return map[string]any{
-		"module":  "notifier",
-		"version": "1",
-		"config": map[string]any{
-			"font-size": map[string]any{"type": "number", "description": "the notification's font size, in points",
-				"minimum": 6, "maximum": 40, "default": 10},
-			"width": map[string]any{"type": "number", "description": "the notification's width, in pixels",
-				"default": 250},
-			"position": map[string]any{"type": "string", "description": "the corner it shows in, a word",
-				"enum": []any{"top-right", "top-left"}, "default": "top-right"},
-			"theme": map[string]any{"type": "string", "description": "the colour theme, a lower-case name",
-				"pattern": "[a-z]+", "default": "dark"},
-			"history": map[string]any{"type": "number", "description": "how many notifications it keeps, a count",
-				"default": 20, "runtime": true},
-			"sender": map[string]any{"type": "string", "description": "the address it mails a digest from",
-				"required": true},
-		},
-		"resources": []any{
-			map[string]any{"id": "configuration", "type": "file", "path": "/x/notifierrc",
-				"content": "font = Inter ${config:font-size}\nwidth = ${config:width}\nfrom = ${config:sender}\n"},
-			map[string]any{"id": "rules", "type": "file", "path": "/x/rules.json", "merge": "json",
-				"takes-config": []any{"position", "theme"}, "content": "{\"position\": \"top-right\"}\n"},
-			map[string]any{"id": "notifier", "type": "service", "unit": "notifier.service",
-				"reload-on": []any{"configuration"}, "restart-on": []any{"rules"}},
-		},
-	}
-}
-
-// declaration is one value of inConfigForm's config, to change in place.
-func declaration(m map[string]any, key string) map[string]any {
-	return m["config"].(map[string]any)[key].(map[string]any)
-}
-
-func resourceOf(m map[string]any, id string) map[string]any {
-	for _, r := range m["resources"].([]any) {
-		if r.(map[string]any)["id"] == id {
-			return r.(map[string]any)
-		}
-	}
-	return nil
-}
-
-func parseRaw(t *testing.T, m map[string]any) (Manifest, error) {
-	t.Helper()
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return ParseManifest(raw)
-}
-
-// refused is that the manifest is refused with every one of these words.
-func refused(t *testing.T, m map[string]any, words ...string) {
-	t.Helper()
-	_, err := parseRaw(t, m)
-	if err == nil {
-		t.Fatalf("registered; wanted a refusal saying %q", words)
-	}
-	for _, w := range words {
-		if !strings.Contains(err.Error(), w) {
-			t.Fatalf("refused without %q:\n%v", w, err)
-		}
-	}
-}
-
-func TestAModuleInTheConfigFormRegisters(t *testing.T) {
-	m, err := parseRaw(t, inConfigForm())
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.DeclaresConfig() {
-		t.Fatal("a module declaring config is not read as in the config form")
-	}
-	d := m.Settings["font-size"]
-	if d.Type != "number" || d.Description == "" || d.Minimum == nil || *d.Minimum != 6 || d.Default != float64(10) {
-		t.Fatalf("font-size read as %+v", d)
-	}
-	if s := m.Settings["sender"]; !s.Required || s.Default != nil {
-		t.Fatalf("sender read as %+v", s)
-	}
-}
-
-// Rule 1: a value without type or description.
-func TestConfigRefusesAValueWithoutTypeOrDescription(t *testing.T) {
-	m := inConfigForm()
-	delete(declaration(m, "width"), "type")
-	refused(t, m, `notifier's config value "width"`, "no type")
-	m = inConfigForm()
-	declaration(m, "width")["type"] = "colour"
-	refused(t, m, `"width"`, `type "colour"`)
-	m = inConfigForm()
-	delete(declaration(m, "width"), "description")
-	refused(t, m, `"width"`, "no description")
-}
-
-// Rule 2: a value with neither a default nor required.
-func TestConfigRefusesAValueWithNeitherDefaultNorRequired(t *testing.T) {
-	m := inConfigForm()
-	delete(declaration(m, "width"), "default")
-	refused(t, m, `"width"`, "neither a default nor required")
-	m = inConfigForm()
-	declaration(m, "sender")["default"] = "noreply@example.org"
-	refused(t, m, `"sender"`, "both a default and required")
-}
-
-// Rule 3: a default failing its validation.
-func TestConfigRefusesADefaultFailingItsValidation(t *testing.T) {
-	for _, c := range []struct {
-		key   string
-		value any
-		said  string
-	}{
-		{"font-size", 4, "below its minimum"},
-		{"font-size", 41, "above its maximum"},
-		{"font-size", "10", "not a number"},
-		{"position", "bottom", "not one of"},
-		{"theme", "Dark", "does not match"},
-	} {
-		m := inConfigForm()
-		declaration(m, c.key)["default"] = c.value
-		refused(t, m, `"`+c.key+`"`, c.said)
-	}
-}
-
-// Rule 4: an object or a list not trusted.
-func TestConfigRefusesAnObjectOrListNotTrusted(t *testing.T) {
-	for _, kind := range []string{"object", "list"} {
-		m := inConfigForm()
-		def := any(map[string]any{"a": 1})
-		if kind == "list" {
-			def = []any{"a"}
-		}
-		m["config"].(map[string]any)["rules"] = map[string]any{"type": kind, "description": "the rules, as " + kind,
-			"default": def, "runtime": true}
-		refused(t, m, `"rules"`, "is "+kind+" and not trusted")
-		m["config"].(map[string]any)["rules"].(map[string]any)["trusted"] = true
-		if _, err := parseRaw(t, m); err != nil {
-			t.Fatalf("a trusted %s is refused: %v", kind, err)
-		}
-	}
-}
-
-// withPredefined is the list of predefined keys the mesh published, for the length of a test.
-func withPredefined(t *testing.T, keys PredefinedList) {
-	t.Helper()
-	was := ReplacePublished(keys)
-	t.Cleanup(func() { ReplacePublished(was) })
-}
-
-// Rule 5: a predefined key not on the list, or of another type. Where no list is present, a value naming one is
-// refused saying so.
-func TestConfigRefusesAPredefinedKeyNotOnTheListOrOfAnotherType(t *testing.T) {
-	withPredefined(t, nil)
-	m := inConfigForm()
-	declaration(m, "font-size")["predefined"] = "font-size"
-	refused(t, m, `"font-size"`, "the list of predefined keys", "is not present")
-
-	withPredefined(t, map[string]PredefinedKey{"font-size": {Type: "number"}, "accent": {Type: "string"}})
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatalf("a value falling back to a listed key of its type is refused: %v", err)
-	}
-	m = inConfigForm()
-	declaration(m, "font-size")["predefined"] = "font-scale"
-	refused(t, m, `"font-size"`, `"font-scale"`, "not on the list")
-	m = inConfigForm()
-	declaration(m, "font-size")["predefined"] = "accent"
-	refused(t, m, `"font-size"`, `"accent"`, "is a string")
-}
-
-// Rule 6: an untrusted value falling back to a trusted predefined key.
-func TestConfigRefusesAnUntrustedValueFallingBackToATrustedKey(t *testing.T) {
-	withPredefined(t, nil)
-	m := inConfigForm()
-	declaration(m, "theme")["predefined"] = "theme"
-	refused(t, m, `"theme"`, "is not present")
-
-	withPredefined(t, map[string]PredefinedKey{"theme": {Type: "string", Trusted: true}})
-	refused(t, m, `"theme"`, "trusted", "is not")
-	declaration(m, "theme")["trusted"] = true
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatalf("a trusted value falling back to a trusted key is refused: %v", err)
-	}
-}
-
-// Rule 7: a value neither placed in a template nor read at runtime.
-func TestConfigRefusesAValueNeitherPlacedNorReadAtRuntime(t *testing.T) {
-	m := inConfigForm()
-	delete(declaration(m, "history"), "runtime")
-	refused(t, m, `"history"`, "${config:history}", `"runtime": true`)
-	// Taken by a mergeable file is placed.
-	m = inConfigForm()
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// Rule 8: a placeholder naming an undeclared value.
-func TestConfigRefusesAPlaceholderNamingAnUndeclaredValue(t *testing.T) {
-	m := inConfigForm()
-	resourceOf(m, "configuration")["content"] = "font = ${config:font-size}\nwidth = ${config:width}\n" +
-		"from = ${config:sender}\ncolour = ${config:colour}\n"
-	refused(t, m, "${config:colour}", "declares no such value")
-}
-
-// Rule 9: a reload-on or restart-on naming a file the module does not declare.
-func TestConfigRefusesAReloadOrRestartOnNamingAnUndeclaredFile(t *testing.T) {
-	m := inConfigForm()
-	resourceOf(m, "notifier")["reload-on"] = []any{"configuration", "dunstrc"}
-	refused(t, m, "reload-on", `"dunstrc"`, "declares no such")
-	m = inConfigForm()
-	resourceOf(m, "notifier")["restart-on"] = []any{"rule"}
-	refused(t, m, "restart-on", `"rule"`)
-	// Another module's file, and one the mesh makes for the module, are not the module's to declare.
-	m = inConfigForm()
-	resourceOf(m, "notifier")["restart-on"] = []any{"rules", "resolver.fact-zones", "secret-mail", "composed-jails"}
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatalf("refused: %v", err)
-	}
-}
-
-// Rule 10: a moved module's mergeable file not naming its keys under takes-config.
-func TestConfigRefusesAMergeableFileNotNamingItsKeys(t *testing.T) {
-	m := inConfigForm()
-	delete(resourceOf(m, "rules"), "takes-config")
-	// position and theme are then placed nowhere; say they are read at runtime so only the file's rule speaks.
-	declaration(m, "position")["runtime"] = true
-	declaration(m, "theme")["runtime"] = true
-	refused(t, m, "rules", "names no takes-config")
-}
-
-// Rule 11: a mesh word, puid or pgid in takes-config.
-func TestConfigRefusesAMeshWordOrAnAccountFactInTakesConfig(t *testing.T) {
-	for _, word := range []string{"ports", "expose", "reach", "endpoints", "places", "accesses", "networks", "puid", "pgid"} {
-		m := inConfigForm()
-		resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", word}
-		refused(t, m, `"`+word+`"`, "takes-config")
-	}
-}
-
-// A module uses one form or the other, never both.
-func TestAManifestMixingTheConfigAndSettingsFormsIsRefused(t *testing.T) {
-	m := inConfigForm()
-	resourceOf(m, "configuration")["content"] = "font = ${config:font-size}\nwidth = ${setting:width}\nfrom = ${config:sender}\n"
-	refused(t, m, "mixes", "${setting:", "config")
-
-	m = inConfigForm()
-	delete(resourceOf(m, "rules"), "takes-config")
-	resourceOf(m, "rules")["takes-settings"] = []any{"position", "theme"}
-	refused(t, m, "mixes", "takes-settings")
-
-	m = inConfigForm()
-	m["settings"] = map[string]any{"colour": map[string]any{"kind": "preference", "default": "red", "why": "red"}}
-	refused(t, m, "mixes", "settings")
-}
-
-// The settings form keeps its own declaration; the config form's has no kind or why.
-func TestEachFormKeepsItsOwnDeclaration(t *testing.T) {
-	m := inConfigForm()
-	declaration(m, "width")["why"] = "fits a title"
-	refused(t, m, `"width"`, "why")
-
-	err := parsed(t, Manifest{Module: "notifier",
-		Settings: map[string]SettingDeclaration{"width": {Kind: KindPreference, Default: float64(250),
-			Why: "fits a title", Type: "number"}},
-		Resources: []map[string]any{{"id": "c", "type": "file", "path": "/x", "content": "${setting:width}"}}})
-	if err == nil || !strings.Contains(err.Error(), "under config") {
-		t.Fatalf("a typed value under settings: %v", err)
-	}
-}
-
-// What the mesh holds is what was written: a module in the config form is written back in it, and read again
-// the same.
-func TestAConfigManifestIsWrittenBackInItsOwnForm(t *testing.T) {
-	m, err := parseRaw(t, inConfigForm())
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, said := range []string{`"config":`, `${config:font-size}`, `"takes-config":`, `"required":true`} {
-		if !strings.Contains(string(raw), said) {
-			t.Fatalf("written back without %s: %s", said, raw)
-		}
-	}
-	for _, unsaid := range []string{`"settings":`, `${setting:`, `"takes-settings"`, `"kind"`, `"why"`, `"default":null`} {
-		if strings.Contains(string(raw), unsaid) {
-			t.Fatalf("written back with %s: %s", unsaid, raw)
-		}
-	}
-	again, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	twice, _ := json.Marshal(again)
-	if !bytes.Equal(raw, twice) {
-		t.Fatalf("read again it is written\n%s\nwhere it was\n%s", twice, raw)
-	}
-}
-
-// A module in the settings form is written back byte for byte as before.
-func TestASettingsManifestIsWrittenBackAsBefore(t *testing.T) {
-	d := SettingDeclaration{Kind: KindPreference, Default: float64(10), Why: "readable"}
-	raw, err := json.Marshal(d)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(raw) != `{"kind":"preference","default":10,"why":"readable"}` {
-		t.Fatalf("written as %s", raw)
-	}
-}
-
-// settingsDunst is the dunst module as it is written today; configDunst the same module rewritten from settings to
-// config.
-const settingsDunst = `{"module": "dunst", "version": "1",
-  "settings": {
-    "font-size": {"kind": "preference", "default": 10, "why": "10 points of Inter reads well on a screen of about 100 DPI"},
-    "width": {"kind": "preference", "default": 250, "why": "250 pixels fits a title of about forty characters at 10 points"}
-  },
-  "resources": [
-    {"id": "package", "type": "package", "package": "dunst"},
-    {"id": "configuration", "type": "file", "path": "/home/me/.config/dunst/dunstrc", "mode": "0644",
-     "content": "[global]\n    font = Inter ${setting:font-size}\n    width = ${setting:width}\n"},
-    {"id": "rules", "type": "file", "path": "/home/me/.config/dunst/rules.json", "merge": "json",
-     "takes-settings": [], "content": "{\"urgency\": \"low\"}\n"},
-    {"id": "notifier", "type": "service", "unit": "dunst.service", "reload-on": ["configuration"]}
-  ]}`
-
-const configDunst = `{"module": "dunst", "version": "1",
-  "config": {
-    "font-size": {"type": "number", "description": "the font size of a notification, in points", "minimum": 6,
-                  "maximum": 40, "default": 10},
-    "width": {"type": "number", "description": "the width of a notification, in pixels", "minimum": 100,
-              "default": 250}
-  },
-  "resources": [
-    {"id": "package", "type": "package", "package": "dunst"},
-    {"id": "configuration", "type": "file", "path": "/home/me/.config/dunst/dunstrc", "mode": "0644",
-     "content": "[global]\n    font = Inter ${config:font-size}\n    width = ${config:width}\n"},
-    {"id": "rules", "type": "file", "path": "/home/me/.config/dunst/rules.json", "merge": "json",
-     "takes-config": [], "content": "{\"urgency\": \"low\"}\n"},
-    {"id": "notifier", "type": "service", "unit": "dunst.service", "reload-on": ["configuration"]}
-  ]}`
-
-// ${config:<key>} fills exactly as ${setting:<key>} does: the module rewritten from settings to config composes
-// to the same bytes, with no layer, with the node's, and with the mesh's under the node's.
-func TestAModuleRewrittenFromSettingsToConfigComposesByteIdentically(t *testing.T) {
-	composed := func(manifest string, layers []Layer) []byte {
-		t.Helper()
-		m, err := ParseManifest([]byte(manifest))
-		if err != nil {
-			t.Fatal(err)
-		}
-		r := anAdoptedAnchor()
-		r.Modules = append(r.Modules, m)
-		with := anchorRendering(false)
-		if layers != nil {
-			with.Settings["dunst"] = layers
-		}
-		c, err := r.Compose(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if why, left := c.LeftOut["dunst"]; left {
-			t.Fatalf("dunst was left out: %s", why)
-		}
-		raw, err := json.Marshal(c)
-		if err != nil {
-			t.Fatal(err)
-		}
-		return raw
-	}
-	for _, layers := range [][]Layer{
-		nil,
-		{{From: "anchor", Values: map[string]any{"font-size": float64(13)}}},
-		{{From: MeshWideLayer, Values: map[string]any{"width": float64(300)}},
-			{From: "anchor", Values: map[string]any{"font-size": float64(12), "width": float64(320)}}},
-	} {
-		was, is := composed(settingsDunst, layers), composed(configDunst, layers)
-		if !bytes.Equal(was, is) {
-			t.Fatalf("composed differently with %v:\nsettings: %s\nconfig:   %s", layers, was, is)
-		}
-		if !strings.Contains(string(is), "font = Inter 1") || strings.Contains(string(is), "${config:") {
-			t.Fatalf("not filled: %s", is)
-		}
-	}
-}
-
-// A key a mergeable file takes is a config value like every other: one not declared under config is refused by
-// name (ADR 0348 §4, review of mesh-controller#320).
-func TestConfigRefusesATakesConfigKeyNotDeclared(t *testing.T) {
-	m := inConfigForm()
-	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", "urgency"}
-	refused(t, m, `"urgency"`, "takes-config", "declares no such value under config")
-}
-
-// A required value nothing sets is refused at composition in the config form's words: ${config:<key>} and the
-// config verb, never `settings set` (review of mesh-controller#320). The settings form's words are unchanged.
-func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
-	m, err := parseRaw(t, inConfigForm())
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, m)
-	composed, err := r.Compose(anchorRendering(false))
-	if err != nil {
-		t.Fatal(err)
-	}
-	why, left := composed.LeftOut["notifier"]
-	if !left {
-		t.Fatal("a module whose required value nothing sets was not left out")
-	}
-	for _, said := range []string{"${config:sender}", `required config value "sender"`, "config verb"} {
-		if !strings.Contains(why, said) {
-			t.Fatalf("left out without %q: %s", said, why)
-		}
-	}
-	for _, unsaid := range []string{"${setting:", "settings set"} {
-		if strings.Contains(why, unsaid) {
-			t.Fatalf("left out in the settings form's words (%q): %s", unsaid, why)
-		}
-	}
-	var unset *UnsetSettingError
-	if err := unsetInConfigWords(settingInto(map[string]any{"type": "file", "content": "${setting:sender}"}, nil,
-		"notifier"), m); !errors.As(err, &unset) || unset.Setting != "sender" {
-		t.Fatalf("not typed as a value nobody gave: %v", err)
-	}
-
-	settingsForm := notifier()
-	settingsForm.Resources[0]["content"] = "from = ${setting:domain}\n"
-	err = unsetInConfigWords(settingInto(settingsForm.Resources[0], nil, "notifier"), settingsForm)
-	if err == nil || !strings.Contains(err.Error(), "`settings set notifier <file>`") {
-		t.Fatalf("the settings form's refusal changed: %v", err)
-	}
-}
-
-// A value named after the operator's own (a url, a user, an address) is `required` where nothing falls back when
-// it is unset; where a mergeable file takes it and no placeholder asks for it, the file's own content (or the
-// module's code reading the file) falls back, so it keeps a default and stays optional, as it is today: the
-// operator's decision on issue 664's second question (issue 735).
-func TestAnOperatorNamedValueAFileFallsBackOnMayHaveADefault(t *testing.T) {
-	m := inConfigForm()
-	m["config"].(map[string]any)["url"] = map[string]any{"type": "string",
-		"description": "the address the notifier posts to, a URL; empty for the one the file's software picks",
-		"default":     ""}
-	resourceOf(m, "rules")["takes-config"] = []any{"position", "theme", "url"}
-	if _, err := parseRaw(t, m); err != nil {
-		t.Fatalf("a taken value named after the operator's, with a default, was refused: %v", err)
-	}
-
-	// A placeholder asking for it has no fallback but the default, which would put a value in the definition
-	// where the operator's belongs (ADR 0112).
-	asked := inConfigForm()
-	asked["config"].(map[string]any)["url"] = map[string]any{"type": "string", "description": "a URL", "default": ""}
-	resourceOf(asked, "rules")["takes-config"] = []any{"position", "theme", "url"}
-	resourceOf(asked, "configuration")["content"] = "font = Inter ${config:font-size}\nwidth = ${config:width}\n" +
-		"from = ${config:sender}\npost = ${config:url}\n"
-	refused(t, asked, `"url"`, `a key naming "url" is the operator's value`)
-
-	// Read by the module's code alone, nothing in the definition says it falls back.
-	runtime := inConfigForm()
-	runtime["config"].(map[string]any)["url"] = map[string]any{"type": "string", "description": "a URL",
-		"default": "", "runtime": true}
-	refused(t, runtime, `"url"`, `a key naming "url" is the operator's value`)
-}
diff --git a/internal/catalogue/consumes_start_test.go b/internal/catalogue/consumes_start_test.go
deleted file mode 100644
index 33747922..00000000
--- a/internal/catalogue/consumes_start_test.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// 1279/AC4 (ADR 0443 §4): no module is given a way to ask where its consumer starts. A consumes entry is an event's
-// name; one that carries a key asking for the stream's history is refused by name, so the safe start is the only one.
-func TestAConsumesEntryAskingWhereItStartsIsRefused(t *testing.T) { // 1279/AC4
-	for _, key := range []string{"from", "start", "deliver"} {
-		raw := `{"module":"audit","version":"1","consumes":[{"event":"shop.order.placed","` + key + `":"beginning"}]}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil {
-			t.Fatalf("a consumes entry with %q was accepted", key)
-		}
-		if !strings.Contains(err.Error(), `"`+key+`"`) || !strings.Contains(err.Error(), "consumes") {
-			t.Errorf("the refusal for %q does not name the key and the field: %v", key, err)
-		}
-	}
-	if _, err := ParseManifest([]byte(`{"module":"audit","version":"1","consumes":["shop.order.placed"]}`)); err != nil {
-		t.Errorf("a plain consumes entry was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/contributes_test.go b/internal/catalogue/contributes_test.go
deleted file mode 100644
index beb6ab6e..00000000
--- a/internal/catalogue/contributes_test.go
+++ /dev/null
@@ -1,412 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// The other half of an edge.
-//
-// `requires` says a thing must be there. It never said what to do with it — a web application
-// requiring a reverse proxy has to say *which name, which port*, and there was nowhere to put
-// that. The two modules that needed it most, the proxy and the VPN, went round the outside and
-// opened a connection to the control plane's database, which is why every node held a credential
-// to it permanently.
-
-func published(module, host string, port int) Manifest {
-	return Manifest{Module: module, Version: "1",
-		Contributes: map[string]map[string]any{
-			"reverse-proxy": {"host": host, "port": port},
-		}}
-}
-
-func proxy() Manifest {
-	return Manifest{Module: "traefik", Version: "1",
-		Provides: Offers("reverse-proxy"),
-		Receives: map[string]string{"reverse-proxy": "/etc/traefik/mesh.json"},
-		Resources: []map[string]any{
-			{"id": "up", "type": "service", "unit": "traefik", "state": "running",
-				"restart-on": []any{ReceivedID("reverse-proxy")}},
-		}}
-}
-
-// received digs the delivered contributions back out of a declaration.
-func received(t *testing.T, out []map[string]any) []Contribution {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] != "/etc/traefik/mesh.json" {
-			continue
-		}
-		body := r["content"].(string)
-		var parsed struct {
-			Requirement string         `json:"requirement"`
-			Given       []Contribution `json:"given"`
-		}
-		if err := json.Unmarshal([]byte(body), &parsed); err != nil {
-			t.Fatalf("the file the proxy is given is not readable: %v\n%s", err, body)
-		}
-		if parsed.Requirement != "reverse-proxy" {
-			t.Fatalf("the file does not say what it is about: %q", parsed.Requirement)
-		}
-		return parsed.Given
-	}
-	t.Fatalf("the provider was given no file at all: %v", out)
-	return nil
-}
-
-func TestTheFileTheProviderGetsIsMachineReadable(t *testing.T) {
-	// It is written for a program, and the first version put a `//` header above the JSON — a
-	// file that says "do not edit" to a person and fails to parse for the thing meant to read it.
-	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	for _, r := range mustDeclare(t, got) {
-		if r["path"] != "/etc/traefik/mesh.json" {
-			continue
-		}
-		var any map[string]any
-		if err := json.Unmarshal([]byte(r["content"].(string)), &any); err != nil {
-			t.Fatalf("the file is not parseable: %v\n%s", err, r["content"])
-		}
-		if note, _ := any["generated"].(string); !strings.Contains(note, "do not edit") {
-			// Inside the document rather than above it, so it reaches a person without
-			// breaking the parse.
-			t.Fatalf("the file does not say it is generated: %v", any["generated"])
-		}
-		return
-	}
-	t.Fatal("no received file")
-}
-
-func TestAModuleTellsItsProviderWhatItNeeds(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, out)
-	if len(given) != 1 || given[0].From != "board" {
-		t.Fatalf("the proxy was not told about board: %v", given)
-	}
-	if given[0].Values["host"] != "board" || given[0].Values["port"] != float64(8080) {
-		t.Fatalf("the contribution did not survive: %v", given[0].Values)
-	}
-}
-
-func TestContributingToSomethingIsRequiringIt(t *testing.T) {
-	// Asking to be published means a publisher must exist. A module that had to say both would
-	// eventually say one, and the failure would be a machine where nothing serves the route.
-	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(strings.Join(names(got), " "), "traefik") {
-		t.Fatalf("contributing to reverse-proxy did not bring one in: %v", names(got))
-	}
-}
-
-func TestNothingToContributeToIsRefused(t *testing.T) {
-	_, err := Resolve(shelf(published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("a module was published through a proxy that does not exist")
-	}
-	if !strings.Contains(err.Error(), "reverse-proxy") {
-		t.Fatalf("the refusal does not name what is missing: %v", err)
-	}
-}
-
-func TestEveryPublisherOnTheMachineIsInOneFile(t *testing.T) {
-	got, err := Resolve(shelf(proxy(),
-		published("board", "board", 8080),
-		published("archive", "archive", 9000),
-	), []string{"board", "archive"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if len(given) != 2 {
-		t.Fatalf("the proxy was told about %d of 2: %v", len(given), given)
-	}
-	// Ordered by module, because this becomes a file and a file whose lines move about looks
-	// changed when nothing changed — which would restart the proxy for ever.
-	if given[0].From != "archive" || given[1].From != "board" {
-		t.Fatalf("the order is not stable: %v", given)
-	}
-}
-
-func TestAProviderWithNoConsumersStillGetsTheFile(t *testing.T) {
-	// Empty rather than absent. A provider that finds no file cannot tell "nothing asked for me"
-	// from "the mesh never wrote it", and those want completely different responses — the same
-	// rule the host follows about a service that does not exist.
-	got, err := Resolve(shelf(proxy()), []string{"traefik"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if given := received(t, mustDeclare(t, got)); len(given) != 0 {
-		t.Fatalf("got %v", given)
-	}
-}
-
-func TestTheProviderCanReloadWhenTheRoutesChange(t *testing.T) {
-	// A proxy that got a new route and did not reload is a route that silently does not work.
-	// The same fault the private network had when a peer list changed under a running interface,
-	// which is why the received file has a name a module can point at.
-	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	out := mustDeclare(t, got)
-	for _, r := range out {
-		if r["type"] != "service" {
-			continue
-		}
-		reflects, ok := r["restart-on"].([]any)
-		if !ok || len(reflects) != 1 {
-			t.Fatalf("the proxy does not reflect anything: %v", r)
-		}
-		if reflects[0] != "traefik."+ReceivedID("reverse-proxy") {
-			t.Fatalf("it reflects %v, which is not the file it was given", reflects[0])
-		}
-		return
-	}
-	t.Fatal("no service in the declaration")
-}
-
-func TestARouteCanBeSetPerMesh(t *testing.T) {
-	// The hostname is exactly the kind of thing that differs between one mesh and the next. A
-	// module whose route could not be set would have to be edited to be reused anywhere.
-	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	out, err := got.Declaration(Rendering{Settings: SettingsBy{
-		"board": {{From: "the mesh", Values: map[string]any{"host": "dashboard"}}},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, out)
-	if given[0].Values["host"] != "dashboard" {
-		t.Fatalf("the setting did not reach the route: %v", given[0].Values)
-	}
-	if given[0].Values["port"] != float64(8080) {
-		t.Fatalf("setting the host dropped the port: %v", given[0].Values)
-	}
-}
-
-func TestASettingReachesAContributionOnlyWhereItDeclaresTheKey(t *testing.T) {
-	// novox/hq 04-ISSUES/173: the mail module's site name, set so its environment file could read
-	// it, arrived in every route it contributed. A setting overrides a key the contribution
-	// declares and adds none — the provider reads the contribution as a contract.
-	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-
-	out, err := got.Declaration(Rendering{Settings: SettingsBy{
-		"board": {{From: "the mesh", Values: map[string]any{"host": "dashboard", "sitename": "Board"}}},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, out)
-	if given[0].Values["host"] != "dashboard" {
-		t.Fatalf("the setting did not override the route's host: %v", given[0].Values)
-	}
-	if _, leaked := given[0].Values["sitename"]; leaked {
-		t.Fatalf("a setting the route never declared reached the proxy: %v", given[0].Values)
-	}
-}
-
-func TestReceivingWhatYouDoNotProvideIsRefused(t *testing.T) {
-	// It would create a file nobody ever writes to, on a machine where nothing asked for it.
-	_, err := ParseManifest([]byte(`{"module":"traefik","version":"1",
-		"receives":{"reverse-proxy":"/etc/traefik/mesh.json"}}`))
-	if err == nil {
-		t.Fatal("a module received contributions to something it does not provide")
-	}
-	if !strings.Contains(err.Error(), "does not provide") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestAnEmptyContributionIsRefused(t *testing.T) {
-	// Either a mistake or a requirement written the long way round, and both are better said.
-	_, err := ParseManifest([]byte(`{"module":"board","version":"1",
-		"contributes":{"reverse-proxy":{}}}`))
-	if err == nil {
-		t.Fatal("a module contributed nothing and was accepted")
-	}
-	if !strings.Contains(err.Error(), "require it") {
-		t.Fatalf("the refusal does not say what to do instead: %v", err)
-	}
-}
-
-// A provision answered from anywhere in the mesh has consumers on other machines, and the
-// provider has to know who they are. Contributions were node-local until this, which meant the
-// one case that most needed them was the one they did not reach.
-
-func provider() Manifest {
-	return Manifest{Module: "postgres", Version: "1",
-		Provides: FromAnywhere("postgres-database"),
-		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
-		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
-	}
-}
-
-// oneGrant is a declaration with a single consumer on another machine.
-func oneGrant(t *testing.T) []map[string]any {
-	t.Helper()
-	got, err := Resolve(shelf(provider()), []string{"postgres"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Grants: []Grant{{
-		Provision: "postgres-database", Consumer: "workstation", From: "meshboard",
-		Values: map[string]any{"name": "meshboard"}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-func grantedTo(t *testing.T, out []map[string]any) []Contribution {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
-			continue
-		}
-		var parsed struct {
-			Given []Contribution `json:"given"`
-		}
-		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
-			t.Fatal(err)
-		}
-		return parsed.Given
-	}
-	t.Fatalf("the provider was given no manifest: %v", out)
-	return nil
-}
-
-func TestAProviderIsToldAboutConsumersOnOtherMachines(t *testing.T) {
-	// A database told to create a password and not who for can do nothing with it.
-	given := grantedTo(t, oneGrant(t))
-	if len(given) != 1 {
-		t.Fatalf("got %v", given)
-	}
-	if given[0].Node != "workstation" || given[0].From != "meshboard" {
-		t.Fatalf("it does not say who asked: %v", given[0])
-	}
-	if given[0].Values["name"] != "meshboard" {
-		t.Fatalf("it does not say what was asked for: %v", given[0].Values)
-	}
-}
-
-func TestTheManifestNamesTheFileRatherThanCarryingTheCredential(t *testing.T) {
-	// The mesh discarded the value and could not put it here if it wanted to. What is here is
-	// where to find it — and the readable half therefore stays readable.
-	out := oneGrant(t)
-	given := grantedTo(t, out)
-	// Named after the machine and the module, because a consumer is both (novox/hq
-	// 04-ISSUES/022). The machine alone, two modules on one node wrote to one path.
-	if given[0].Secret != "/var/lib/postgres/grants/workstation.meshboard.secret" {
-		t.Fatalf("the manifest does not name the credential's file: %q", given[0].Secret)
-	}
-	for _, r := range out {
-		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
-			continue
-		}
-		if strings.Contains(r["content"].(string), "c2VhbGVk") {
-			t.Fatal("the readable manifest carries the sealed credential")
-		}
-	}
-}
-
-func TestTheCredentialItselfLandsSealedBesideIt(t *testing.T) {
-	for _, r := range oneGrant(t) {
-		if r["path"] != "/var/lib/postgres/grants/workstation.meshboard.secret" {
-			continue
-		}
-		if r["sealed"] != "c2VhbGVk" {
-			t.Fatalf("got %v", r)
-		}
-		if r["content"] != nil {
-			t.Fatal("a credential was written in the clear")
-		}
-		return
-	}
-	t.Fatal("no credential file")
-}
-
-func TestAConsumersOwnContributionsAreStillThere(t *testing.T) {
-	// Cross-node grants are merged in with this machine's own, because from the provider's side
-	// they are the same thing — somebody wanting something — and a provider that had to read two
-	// lists would read one of them.
-	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)),
-		[]string{"board"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if len(given) != 1 || given[0].Node != "" {
-		t.Fatalf("a local contribution grew a node: %v", given)
-	}
-}
-
-func TestARequireOnlyConsumerOfAParameterlessProvisionStillAsks(t *testing.T) {
-	// A consumer that requires a parameterless provision (one whose serves names no consumer key —
-	// redis-cache, amqp) contributes no payload, but it still ASKS for the provision and must be
-	// granted a credential. Keying "asks" on contributions alone gave its grant From="" — read as
-	// withdrawn — so the provider never created the account and the consumer authenticated nowhere.
-	r := Resolution{
-		Node: "laptop",
-		Modules: []Manifest{{
-			Module:   "amqp-ping",
-			Requires: []string{"amqp"},
-		}},
-	}
-	values, asks, err := r.ContributionsFrom("amqp", "amqp-ping", SettingsBy{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !asks {
-		t.Fatal("a require-only consumer was treated as not asking; its grant would be withdrawn and it would never be provisioned")
-	}
-	if values == nil {
-		t.Fatalf("asks is true but values is nil; expected an empty contribution, got %v", values)
-	}
-}
-
-func TestAConsumerThatStoppedAskingIsWithdrawn(t *testing.T) {
-	// Withdrawal is how a credential is taken away. The provisioner removes what nobody asks for,
-	// and it can only do that if the mesh stops asking — a consumer that was unassigned would
-	// otherwise keep a working login for ever, and nothing would say so.
-	//
-	// A grant with no asking module is exactly that state: the mesh still holds the secret,
-	// because it is sealed and unusable to the mesh anyway, and the machine no longer wants it.
-	got, err := Resolve(shelf(provider()), []string{"postgres"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Grants: []Grant{
-		{Provision: "postgres-database", Consumer: "still-here", From: "meshboard",
-			Values: map[string]any{"name": "meshboard"}, Sealed: "c2VhbGVk"},
-		{Provision: "postgres-database", Consumer: "gone-away", Sealed: "c3RhbGU="},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	given := grantedTo(t, out)
-	if len(given) != 1 || given[0].Node != "still-here" {
-		t.Fatalf("the provider is still told about a machine that stopped asking: %v", given)
-	}
-	// And no credential is written for it either, or the provisioner would find a file for a
-	// consumer its manifest does not mention and have to guess what that means.
-	for _, r := range out {
-		if path, _ := r["path"].(string); strings.Contains(path, "gone-away") {
-			t.Fatalf("a withdrawn consumer's credential is still delivered: %v", r)
-		}
-	}
-}
diff --git a/internal/catalogue/contribution_dependencies_test.go b/internal/catalogue/contribution_dependencies_test.go
deleted file mode 100644
index 91e9bc03..00000000
--- a/internal/catalogue/contribution_dependencies_test.go
+++ /dev/null
@@ -1,136 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0210 §3: a contribution is a dependency on the seat that receives it.
-
-func TestAContributionDependsOnTheSeatThatPlacesIt(t *testing.T) {
-	env := mod("theme", nil, nil, nil)
-	env.Environment = &Environment{Variables: map[string]string{"GTK_THEME": "Adwaita:dark"}}
-	path := mod("toolchain", nil, nil, nil)
-	path.Environment = &Environment{Path: []PathEntry{{Entry: "/opt/x/bin"}}}
-	shell := mod("prompt", nil, nil, nil)
-	shell.Shell = []ShellCode{{For: "zsh", Slot: "first", Code: "true"}}
-	session := mod("wallpaper", nil, nil, nil)
-	session.Shell = []ShellCode{{For: "xinitrc", Slot: "normal", Code: "true"}}
-	resources := mod("bar", nil, nil, nil)
-	resources.Shell = []ShellCode{{For: "xresources", Slot: "normal", Code: "x: y"}}
-	empty := mod("nothing", nil, nil, nil)
-	empty.Environment = &Environment{}
-
-	cases := map[string]struct {
-		m    Manifest
-		want []string
-	}{
-		"a variable":                {env, []string{EnvironmentSeat}},
-		"a path entry":              {path, []string{EnvironmentSeat}},
-		"shell code":                {shell, []string{LoginShellSeat}},
-		"the session's start":       {session, []string{DisplayServerSeat}},
-		"the session's X resources": {resources, []string{DisplayServerSeat}},
-		"an empty environment":      {empty, nil},
-	}
-	for name, c := range cases {
-		got := DependsOn(nil, c.m)
-		if len(got) == 0 {
-			got = nil
-		}
-		if !reflect.DeepEqual(got, c.want) {
-			t.Errorf("%s depends on %v, want %v", name, got, c.want)
-		}
-	}
-}
-
-func TestAContributionIsMetByAHolderOnTheNodeAndRefusedWithout(t *testing.T) {
-	holder := mod("node-env", nil, nil, nil, Claim{Name: EnvironmentSeat})
-	contributor := mod("theme", nil, nil, nil)
-	contributor.Environment = &Environment{Variables: map[string]string{"GTK_THEME": "Adwaita:dark"}}
-	catalogue := map[string]Manifest{"node-env": holder, "theme": contributor}
-
-	if _, err := AssignRefusal(catalogue, "laptop", []string{"node-env"}, []string{"theme"}); err != nil {
-		t.Fatalf("a contributor beside the holder is refused: %v", err)
-	}
-	_, err := AssignRefusal(catalogue, "laptop", nil, []string{"theme"})
-	if err == nil {
-		t.Fatal("a contributor on a node without the holder was accepted, and its contribution would be written nowhere")
-	}
-	if !strings.Contains(err.Error(), EnvironmentSeat) || !strings.Contains(err.Error(), "node-env") {
-		t.Errorf("the refusal names neither the seat nor its holder: %v", err)
-	}
-	if _, err := AssignRefusal(catalogue, "laptop", nil, []string{"theme", "node-env"}); err != nil {
-		t.Errorf("the contributor and the holder assigned together are refused: %v", err)
-	}
-}
-
-func TestAHolderMeetsItsOwnContribution(t *testing.T) {
-	// The display server's module contributes nothing to its own seat today, but the zsh module's
-	// environment contributions do go to another seat: a claim meets only the seat it names.
-	zsh := mod("zsh", nil, nil, nil, Claim{Name: LoginShellSeat})
-	zsh.Shell = []ShellCode{{For: "zsh", Slot: "normal", Code: "true"}}
-	zsh.Environment = &Environment{Variables: map[string]string{"EDITOR": "vim"}}
-	catalogue := map[string]Manifest{"zsh": zsh,
-		"node-env": mod("node-env", nil, nil, nil, Claim{Name: EnvironmentSeat})}
-	unheld := UnheldDependencies(catalogue, "laptop", []Manifest{zsh}, nil)
-	if len(unheld) != 1 || unheld[0].Seat != EnvironmentSeat {
-		t.Errorf("zsh alone: unheld %v, want only %s (its shell code is its own seat's)", unheld, EnvironmentSeat)
-	}
-}
-
-func TestTwoModulesMayDeclareOnePackage(t *testing.T) {
-	pacman := withResources(mod("pacman", nil, nil, nil, Claim{Name: PackageManagerSeat}),
-		res("package", "pacman-contrib"))
-	bar := withResources(mod("bar", nil, nil, nil), res("package", "bar"), res("package", "pacman-contrib"))
-	catalogue := map[string]Manifest{"pacman": pacman, "bar": bar}
-	if err := CollisionRefusal(catalogue, "laptop", []string{"pacman"}, []string{"bar"}); err != nil {
-		t.Fatalf("a second declaration of a package was refused (novox/hq ADR 0303): %v", err)
-	}
-}
-
-func TestAPackageDeclaredPresentAndAbsentIsRefusedNamingBoth(t *testing.T) {
-	gone := res("package", "ufw")
-	gone["absent"] = true
-	filter := withResources(mod("nftables", nil, nil, nil), gone)
-	wants := withResources(mod("legacy", nil, nil, nil), res("package", "ufw"))
-	other := withResources(mod("other", nil, nil, nil), res("package", "other"))
-	catalogue := map[string]Manifest{"nftables": filter, "legacy": wants, "other": other}
-
-	err := CollisionRefusal(catalogue, "laptop", []string{"nftables"}, []string{"legacy"})
-	if err == nil || !strings.Contains(err.Error(), "ufw") || !strings.Contains(err.Error(), "nftables") ||
-		!strings.Contains(err.Error(), "legacy") || !strings.Contains(err.Error(), "ADR 0303") {
-		t.Fatalf("a package declared present and absent was not refused naming both: %v", err)
-	}
-	if strings.Contains(err.Error(), "one owner per node") {
-		t.Errorf("the refusal gives the one-owner rule, which no longer holds for packages: %v", err)
-	}
-	if err := CollisionRefusal(catalogue, "laptop", []string{"nftables"}, []string{"other"}); err != nil {
-		t.Errorf("a module declaring nothing contradictory is refused: %v", err)
-	}
-	// A contradiction already on the node is status's, not a reason to refuse an unrelated assignment.
-	if err := CollisionRefusal(catalogue, "laptop", []string{"nftables", "legacy"}, []string{"other"}); err != nil {
-		t.Errorf("an unrelated assignment is refused for a contradiction already there: %v", err)
-	}
-}
-
-func TestCodeForAPowerMomentDependsOnThePowerSeat(t *testing.T) {
-	for _, moment := range powerMoments {
-		m := mod("laptop", nil, nil, nil)
-		m.Shell = []ShellCode{{For: moment, Slot: "normal", Code: "true"}}
-		if got := DependsOn(nil, m); !reflect.DeepEqual(got, []string{PowerSeat}) {
-			t.Errorf("code for %s depends on %v, want %s", moment, got, PowerSeat)
-		}
-		if p := m.shellProblems(); len(p) != 0 {
-			t.Errorf("code for %s is refused: %v", moment, p)
-		}
-	}
-	m := mod("laptop", nil, nil, nil)
-	m.Shell = []ShellCode{{For: "after-lunch", Slot: "normal", Code: "true"}}
-	if p := m.shellProblems(); len(p) == 0 {
-		t.Error("code for a moment that does not exist was accepted")
-	}
-	if s, ok := SeatNamed(PowerSeat); !ok || s.Scope != ScopeNode {
-		t.Errorf("%s is not a node seat of the mesh's own: %+v %v", PowerSeat, s, ok)
-	}
-}
diff --git a/internal/catalogue/core_credentials_test.go b/internal/catalogue/core_credentials_test.go
deleted file mode 100644
index 1c123f3f..00000000
--- a/internal/catalogue/core_credentials_test.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// The core's own credentials travel sealed by the vault to their machine (novox/hq ADR 0349 §16, issue 755): the
-// controller carries the vault's box and cannot open it. The list is fixed here, and the composition carries the box
-// in place of the controller's own sealed value only where the rendering was given one.
-
-func TestTheCoresOwnCredentialsAreTheBusTheProvisionerAndItsClient(t *testing.T) {
-	if want := []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}; !reflect.DeepEqual(CoreCredentialModules, want) {
-		t.Fatalf("the core's modules are %v, want %v (mesh-vault's CoreModules is the same list)", CoreCredentialModules, want)
-	}
-	for _, m := range []string{"nats", "mesh-provisioner", "mesh-provisioner-client"} {
-		if !CarriesVaultSealed(m) {
-			t.Errorf("%s is not on the list", m)
-		}
-	}
-	for _, m := range []string{"postgres", "mesh-vault", "mesh-controller", ""} {
-		if CarriesVaultSealed(m) {
-			t.Errorf("%s is on the list", m)
-		}
-	}
-}
-
-const provisionerClient = `{"module":"mesh-provisioner-client","version":"1",
-  "own-secrets":{"provisioner-broker":"${dir:state}/broker"},
-  "resources":[{"id":"state","type":"directory","mode":"0700","place":"."}]}`
-
-func clientOn(t *testing.T) Resolution {
-	t.Helper()
-	m, err := ParseManifest([]byte(provisionerClient))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return notifierOn(t, m)
-}
-
-func brokerFile(t *testing.T, c Composed) map[string]any {
-	t.Helper()
-	for _, r := range c.Resources {
-		if r["id"] == "mesh-provisioner-client.needs-provisioner-broker" {
-			return r
-		}
-	}
-	return nil
-}
-
-var aVaultBox = json.RawMessage(`{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"Yw=="}`)
-
-func TestACoreCredentialCarriesTheVaultsBoxAndNoSealOfTheControllers(t *testing.T) {
-	r := clientOn(t)
-	with := Rendering{Needed: map[string]map[string]string{"mesh-provisioner-client": {"provisioner-broker": "nacl"}},
-		VaultSealed: map[string]map[string]json.RawMessage{"mesh-provisioner-client": {"provisioner-broker": aVaultBox}}}
-	c, got := composeWith(t, r, with)
-	f := brokerFile(t, c)
-	if f == nil {
-		t.Fatalf("the credential's file is not declared: %s", got)
-	}
-	if f["sealed"] != nil || !reflect.DeepEqual(f["vault-sealed"], aVaultBox) || strings.Contains(got, `"nacl"`) {
-		t.Fatalf("the file is %v: the vault's box alone, never the controller's seal", f)
-	}
-	// Without the controller's own value at all: the vault's box is enough.
-	with.Needed = nil
-	if c, _ := composeWith(t, r, with); brokerFile(t, c) == nil {
-		t.Fatal("a core credential with the vault's box and no seal of the controller's was refused or dropped")
-	}
-}
-
-func TestACoreModuleTheVaultGaveNothingForIsLeftOutWithWhy(t *testing.T) {
-	r := clientOn(t)
-	c, got := composeWith(t, r, Rendering{NotPlaced: map[string]string{
-		"mesh-provisioner-client": "the vault did not answer for its credential"}})
-	if brokerFile(t, c) != nil || strings.Contains(got, "mesh-provisioner-client.") {
-		t.Fatalf("a core module the vault gave nothing for was placed: %s", got)
-	}
-	if !strings.Contains(c.LeftOut["mesh-provisioner-client"], "the vault did not answer") {
-		t.Fatalf("left out %v", c.LeftOut)
-	}
-}
-
-// An engine below VaultBoxContract is rendered with neither field: its composition is the controller's sealed value,
-// byte for byte what it was.
-func TestWithoutTheVaultsBoxTheCompositionIsAsBefore(t *testing.T) {
-	r := clientOn(t)
-	with := Rendering{Needed: map[string]map[string]string{"mesh-provisioner-client": {"provisioner-broker": "nacl"}}}
-	before, _ := composeWith(t, r, with)
-	with.VaultSealed, with.NotPlaced = map[string]map[string]json.RawMessage{}, map[string]string{}
-	after, _ := composeWith(t, r, with)
-	if !reflect.DeepEqual(before, after) || brokerFile(t, before)["sealed"] != "nacl" {
-		t.Fatalf("the composition changed: %v", brokerFile(t, after))
-	}
-}
-
-// Asked ahead of a send that has no box kept yet: a stand-in, named as foreseen, never sent.
-func TestAForeseenVaultBoxIsNamed(t *testing.T) {
-	r := clientOn(t)
-	c, _ := composeWith(t, r, Rendering{VaultSealed: map[string]map[string]json.RawMessage{
-		"mesh-provisioner-client": {"provisioner-broker": ForeseenVaultBox}}})
-	if !reflect.DeepEqual(c.Foreseen, []string{"mesh-provisioner-client/provisioner-broker"}) {
-		t.Fatalf("foreseen %v", c.Foreseen)
-	}
-}
diff --git a/internal/catalogue/data_test.go b/internal/catalogue/data_test.go
deleted file mode 100644
index 9511cdaf..00000000
--- a/internal/catalogue/data_test.go
+++ /dev/null
@@ -1,227 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"strings"
-	"testing"
-)
-
-// A store as a module now declares it (novox/hq ADR 0233): its own data by directory with a class and a
-// dump, and what it keeps for its consumers.
-const declaredStore = `{"module":"pg","version":"1",
-	"provides":[{"name":"postgres-database","scope":"mesh"}],
-	"grants":{"postgres-database":"${dir:grants}"},
-	"data":{
-		"own":[
-			{"id":"store","path":"${dir:store}","class":"irreplaceable","backup":{"dump":"dump-all > ${dir:dumps}/all","into":"dumps"},"active":"1d"},
-			{"id":"dumps","path":"${dir:dumps}","class":"rebuildable","backup":"none"}],
-		"consumers":{"postgres-database":{"class":"irreplaceable","in":"store"}}},
-	"resources":[
-		{"id":"grants","type":"directory","mode":"0700"},
-		{"id":"store","type":"directory","path":"/srv/store","mode":"0700"},
-		{"id":"dumps","type":"directory","path":"${dir:store}/dumps","mode":"0700"},
-		{"id":"server","type":"container","image":"x@sha256:aa","volumes":["${dir:store}:/var/lib/postgresql/data"]}]}`
-
-func mustParse(t *testing.T, raw string) Manifest {
-	t.Helper()
-	m, err := ParseManifest([]byte(raw))
-	if err != nil {
-		t.Fatalf("refused: %v", err)
-	}
-	return m
-}
-
-func TestADeclaredStoreParsesAndPassesTheCheck(t *testing.T) {
-	m := mustParse(t, declaredStore)
-	if problems := DataProblems(Shelf{"pg": m}); len(problems) > 0 {
-		t.Fatalf("a store declaring its data was refused: %v", problems)
-	}
-	if !m.KeepsConsumerData("postgres-database") {
-		t.Fatal("an irreplaceable consumer class does not keep the consumer's data")
-	}
-	if it, _ := m.DataItem("store"); !it.BackedUp() || it.BackupWithin() != DefaultBackupWithin || it.ActiveWithin().Hours() != 24 {
-		t.Fatalf("the store item reads %+v", it)
-	}
-	if it, _ := m.DataItem("dumps"); it.BackedUp() {
-		t.Fatal("a rebuildable item that says none is backed up")
-	}
-}
-
-// Every rule of the section itself, refused at parse in the words of the module.
-func TestTheDataSectionIsRefusedWhereItIsWrong(t *testing.T) {
-	for _, c := range []struct{ name, data, want string }{
-		{"a class it does not know", `{"own":[{"id":"a","path":"${dir:d}","class":"precious"}]}`, "not one the mesh protects by"},
-		{"an access it does not have", `{"own":[{"id":"a","path":"${access:media}","class":"irreplaceable","redundancy":"an array"}]}`, "declares no access"},
-		{"irreplaceable and protected by nothing", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":"none"}]}`, "protected one way or the other"},
-		{"a cache on redundancy", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","redundancy":"an array"}]}`, "a cache is not protected"},
-		{"kept with something not required", `{"kept-by":{"s3-bucket":{"class":"irreplaceable"}}}`, "does not require"},
-		{"a measure it does not know", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","measure":"du"}]}`, "walk, dataset or shallow"},
-		{"a cache expecting writes", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","active":"1d"}]}`, "only irreplaceable and valuable"},
-		{"a machine path", `{"own":[{"id":"a","path":"/srv/a","class":"cache"}]}`, "names no machine path"},
-		{"a directory it does not declare", `{"own":[{"id":"a","path":"${dir:nowhere}","class":"cache"}]}`, "declares no directory"},
-		{"a cache backed up", `{"own":[{"id":"a","path":"${dir:d}","class":"cache","backup":"copy"}]}`, "disposable"},
-		{"a dump into nothing", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":{"dump":"x","into":"b"}}]}`, "not one of the module's data items"},
-		{"a dump into itself", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","backup":{"dump":"x","into":"a"}}]}`, "into itself"},
-		{"a bad duration", `{"own":[{"id":"a","path":"${dir:d}","class":"irreplaceable","within":"soon"}]}`, "not a duration"},
-		{"the same id twice", `{"own":[{"id":"a","path":"${dir:d}","class":"cache"},{"id":"a","path":"${dir:d}/x","class":"cache"}]}`, "declared twice"},
-		{"own data of class none", `{"own":[{"id":"a","path":"${dir:d}","class":"none"}]}`, "only a provision"},
-		{"consumers of something not provided", `{"consumers":{"s3-bucket":{"class":"cache"}}}`, "does not provide"},
-		{"consumer data that lives nowhere", `{"consumers":{"q":{"class":"irreplaceable"}}}`, "says nowhere it lives"},
-		{"consumer data in an item less precious", `{"own":[{"id":"a","path":"${dir:d}","class":"rebuildable"}],"consumers":{"q":{"class":"irreplaceable","in":"a"}}}`, "which is only rebuildable"},
-		{"consumer data in something unknown", `{"consumers":{"q":{"class":"rebuildable","in":"elsewhere"}}}`, "neither one of its data items"},
-	} {
-		raw := `{"module":"m","version":"1","provides":["q"],"resources":[{"id":"d","type":"directory","mode":"0700"}],"data":` + c.data + `}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: %v, want %q", c.name, err, c.want)
-		}
-	}
-}
-
-// The catalogue check: a granting provider says what it keeps, says it in one place, writes no backup
-// line by hand, and every directory a container writes is declared (novox/hq ADR 0233).
-func TestTheCatalogueCheckAsksEveryModuleForItsData(t *testing.T) {
-	unsaid := mustParse(t, `{"module":"q","version":"1","provides":[{"name":"queue","scope":"mesh"}],
-		"grants":{"queue":"${dir:g}"},"resources":[{"id":"g","type":"directory","mode":"0700"}]}`)
-	onTheOffer := mustParse(t, `{"module":"r","version":"1","provides":[{"name":"resolver","scope":"mesh","keeps-consumer-data":false}]}`)
-	byHand := mustParse(t, `{"module":"h","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"}],
-		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:d}"}]}`)
-	writes := mustParse(t, `{"module":"w","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"},
-		{"id":"c","type":"directory","mode":"0700"},
-		{"id":"app","type":"container","image":"x@sha256:aa","volumes":["${dir:d}:/data","${dir:c}:/etc/app:ro","${dir:d}/f:/f"]}]}`)
-	problems := strings.Join(DataProblems(Shelf{"q": unsaid, "r": onTheOffer, "h": byHand, "w": writes}), "\n")
-	for _, want := range []string{
-		"q grants queue and does not say what it keeps",
-		"r says keeps-consumer-data on its offer",
-		"h's contribution 1 is a backup line written by hand",
-		`w mounts its directory "d" into a container to be written`,
-	} {
-		if !strings.Contains(problems, want) {
-			t.Errorf("the check does not say %q:\n%s", want, problems)
-		}
-	}
-	if strings.Contains(problems, `"c"`) {
-		t.Errorf("a read-only mount was taken for written data:\n%s", problems)
-	}
-	// The same module declaring the directory, as a cache, passes.
-	declared := mustParse(t, `{"module":"w","version":"1","data":{"own":[{"id":"d","path":"${dir:d}","class":"cache"}]},
-		"resources":[{"id":"d","type":"directory","mode":"0700"},
-		{"id":"app","type":"container","image":"x@sha256:aa","volumes":["${dir:d}:/data"]}]}`)
-	if p := DataProblems(Shelf{"w": declared}); len(p) > 0 {
-		t.Fatalf("a declared directory is still refused: %v", p)
-	}
-}
-
-// Consumer data said to live in a provision the module requires is protected only as well as that
-// provision's provider protects its consumers' data.
-func TestConsumerDataInARequiredProvisionIsJudgedAgainstItsProvider(t *testing.T) {
-	idp := mustParse(t, `{"module":"idp","version":"1","requires":["postgres-database"],
-		"provides":[{"name":"oidc-client","scope":"mesh"}],"grants":{"oidc-client":"${dir:g}"},
-		"resources":[{"id":"g","type":"directory","mode":"0700"}],
-		"data":{"consumers":{"oidc-client":{"class":"irreplaceable","in":"postgres-database"}}}}`)
-	cachy := mustParse(t, strings.Replace(declaredStore, `"consumers":{"postgres-database":{"class":"irreplaceable","in":"store"}}`,
-		`"consumers":{"postgres-database":{"class":"cache"}}`, 1))
-	if p := strings.Join(DataProblems(Shelf{"idp": idp, "pg": cachy}), "\n"); !strings.Contains(p, "not protected as irreplaceable") {
-		t.Fatalf("irreplaceable data kept in a cache passed: %s", p)
-	}
-	if p := DataProblems(Shelf{"idp": idp, "pg": mustParse(t, declaredStore)}); len(p) > 0 {
-		t.Fatalf("refused against a provider that keeps its consumers' data: %v", p)
-	}
-}
-
-// What a binding is sticky by follows the class (ADR 0232, generalised by 0233): a cache's consumers
-// move freely, a store's do not; an older definition saying nothing still follows its grant.
-func TestKeepingConsumerDataFollowsTheClass(t *testing.T) {
-	for class, keeps := range map[string]bool{"irreplaceable": true, "valuable": true, "rebuildable": true, "cache": false, "none": false} {
-		in := `,"in":"d"`
-		own := `"own":[{"id":"d","path":"${dir:d}","class":"irreplaceable"}],`
-		if !keeps {
-			in, own = "", ""
-		}
-		m := mustParse(t, `{"module":"p","version":"1","provides":[{"name":"q","scope":"mesh"}],"grants":{"q":"${dir:d}"},
-			"resources":[{"id":"d","type":"directory","mode":"0700"}],
-			"data":{`+own+`"consumers":{"q":{"class":"`+class+`"`+in+`}}}}`)
-		if m.KeepsConsumerData("q") != keeps {
-			t.Errorf("class %s keeps consumer data: %v, want %v", class, !keeps, keeps)
-		}
-		shelf := map[string]Manifest{"p": m}
-		if KeepsConsumerData(shelf, "q") != keeps {
-			t.Errorf("class %s: the provision by name keeps: %v", class, !keeps)
-		}
-	}
-	older := mustParse(t, `{"module":"p","version":"1","provides":[{"name":"q","scope":"mesh"}],"grants":{"q":"${dir:d}"},
-		"resources":[{"id":"d","type":"directory","mode":"0700"}]}`)
-	if !older.KeepsConsumerData("q") {
-		t.Fatal("an older definition that grants no longer keeps its consumers' data")
-	}
-}
-
-// The backup holder's lines are derived: the dump runs and the directory it writes into is kept,
-// anything but a cache is copied by default — the standard nightly plan — an item on redundancy is not
-// copied, and every item is listed with its class and protection for the holder to measure and watch:
-// directories filled, a home directory filled from the machine, an operator's path from where the
-// assignment placed it. A backup line still written by hand beside a data section is not placed.
-func TestTheBackupHoldersLinesAreDerivedFromTheData(t *testing.T) {
-	pg := mustParse(t, declaredStore)
-	pg.Contributions = append(pg.Contributions, SeatContribution{Seat: BackupSeat, Kind: "backup", Content: "path /stale"})
-	agent := mustParse(t, `{"module":"agent","version":"1",
-		"data":{"own":[{"id":"home","path":"${dir:home}","class":"valuable"},{"id":"tmp","path":"${dir:home}/tmp","class":"cache"}]},
-		"resources":[{"id":"home","type":"directory","path":"${machine:account-home}/.agent","mode":"0700"}]}`)
-	media := mustParse(t, `{"module":"media","version":"1",
-		"accesses":[{"id":"films","mode":"read"}],
-		"data":{"own":[{"id":"films","path":"${access:films}","class":"irreplaceable","redundancy":"on a redundant array; no room for a copy","measure":"dataset"},
-			{"id":"meta","path":"${dir:meta}","class":"rebuildable"}]},
-		"resources":[{"id":"meta","type":"directory","mode":"0700"}]}`)
-	facts := map[string]string{"account-home": "/home/op"}
-	with := Rendering{Settings: SettingsBy{"media": {LayerOf("node", map[string]any{AccessesSetting: map[string]any{"films": "/tank/films"}})}}}
-	backup, _, err := seatContributions([]Manifest{pg, agent, media}, Manifest{}, BackupSeat+":"+BackupKindBackup, with, facts, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := "# agent\npath /home/op/.agent\n# media\npath /var/lib/media/meta\n# pg\nrun dump-all > /srv/store/dumps/all\npath /srv/store/dumps\n"
-	if backup != want {
-		t.Fatalf("backup lines:\n%s\nwant:\n%s", backup, want)
-	}
-	data, _, err := seatContributions([]Manifest{pg, agent, media}, Manifest{}, BackupSeat+":"+BackupKindData, with, facts, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	want = "# agent\nitem home valuable /home/op/.agent /home/op/.agent backup walk\nitem tmp cache /home/op/.agent/tmp - none walk\n" +
-		"# media\nitem films irreplaceable /tank/films - redundancy dataset\nitem meta rebuildable /var/lib/media/meta /var/lib/media/meta backup walk\n" +
-		"# pg\nitem store irreplaceable /srv/store /srv/store/dumps backup walk\nitem dumps rebuildable /srv/store/dumps - none walk\n"
-	if data != want {
-		t.Fatalf("data lines:\n%s\nwant:\n%s", data, want)
-	}
-	if _, _, err := seatContributions([]Manifest{agent}, Manifest{}, BackupSeat+":"+BackupKindData, Rendering{}, nil, nil); err == nil {
-		t.Fatal("a home directory with no account on the machine reached the holder as a placeholder")
-	}
-	// What keeps something irreplaceable depends on the machine's backup holder — it backs it up or
-	// watches its array; valuable data alone is backed up where a holder is, and refused nowhere.
-	if !slices.Contains(DependsOn(nil, media), BackupSeat) || !slices.Contains(DependsOn(nil, pg), BackupSeat) ||
-		slices.Contains(DependsOn(nil, agent), BackupSeat) {
-		t.Fatalf("depends: media %v, pg %v, agent %v", DependsOn(nil, media), DependsOn(nil, pg), DependsOn(nil, agent))
-	}
-	if it, _ := media.DataItem("films"); it.OwnedByModule() || it.Protection() != "redundancy" {
-		t.Fatalf("an operator's path reads %+v", it)
-	}
-}
-
-// Data a consumer keeps with a provider as irreplaceable must be protected there: the check refuses a
-// provider that keeps its consumers' data as a cache, or in an item with no protection.
-func TestIrreplaceableDataKeptWithAProviderMustBeProtectedThere(t *testing.T) {
-	photos := mustParse(t, `{"module":"photos","version":"1","requires":["s3-bucket"],
-		"data":{"kept-by":{"s3-bucket":{"class":"irreplaceable"}}}}`)
-	store := func(backup string) Manifest {
-		return mustParse(t, `{"module":"objects","version":"1","provides":[{"name":"s3-bucket","scope":"mesh"}],
-			"grants":{"s3-bucket":"${dir:g}"},
-			"data":{"own":[{"id":"data","path":"${dir:data}","class":"valuable","backup":"`+backup+`"}],
-				"consumers":{"s3-bucket":{"class":"valuable","in":"data"}}},
-			"resources":[{"id":"g","type":"directory","mode":"0700"},{"id":"data","type":"directory","mode":"0700"}]}`)
-	}
-	if p := DataProblems(Shelf{"photos": photos, "objects": store("copy")}); len(p) > 0 {
-		t.Fatalf("a provider backing its consumers' data up was refused: %v", p)
-	}
-	if p := strings.Join(DataProblems(Shelf{"photos": photos, "objects": store("none")}), "\n"); !strings.Contains(p, "neither backed up") {
-		t.Fatalf("irreplaceable photos in an unprotected store passed: %s", p)
-	}
-}
diff --git a/internal/catalogue/declaration_test.go b/internal/catalogue/declaration_test.go
deleted file mode 100644
index 23b1caaf..00000000
--- a/internal/catalogue/declaration_test.go
+++ /dev/null
@@ -1,80 +0,0 @@
-package catalogue
-
-import "testing"
-
-// The mesh's user list reaches the module holding the bus, and nothing else.
-//
-// Three refusals and one delivery, because each of the refusals would be silent in a different way:
-// a module that asked and was given it could read every credential on the bus; a bus given an empty
-// file refuses every connection in the mesh and looks like a machine problem; and a bus that never
-// asked gets nothing rather than a file it does not read.
-func TestTheMeshsUserListGoesOnlyToTheModuleHoldingTheBus(t *testing.T) {
-	theBus := func() Manifest {
-		return Manifest{
-			Module: "nats", Version: "1",
-			Claims:    []Claim{{Name: "mesh-broker", Scope: ScopeMesh}},
-			BusUsers:  "/var/lib/nats-module/conf/accounts.conf",
-			Resources: []map[string]any{},
-		}
-	}
-
-	on := func(t *testing.T, m Manifest, with Rendering) ([]map[string]any, error) {
-		t.Helper()
-		return Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(with)
-	}
-
-	t.Run("the holder is given it", func(t *testing.T) {
-		resources, err := on(t, theBus(), Rendering{BusUsers: "accounts { MESH { users = [] } }"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		// Prefixed with the module it came from, like every resource: two modules may reasonably
-		// both call something "config", and without the prefix the second would silently replace
-		// the first.
-		var found map[string]any
-		for _, r := range resources {
-			if r["id"] == "nats."+BusUsersID() {
-				found = r
-			}
-		}
-		if found == nil {
-			t.Fatalf("the bus was given no user list: %+v", resources)
-		}
-		if found["path"] != "/var/lib/nats-module/conf/accounts.conf" {
-			t.Errorf("written to %v rather than where the module asked", found["path"])
-		}
-		if found["mode"] != "0600" {
-			t.Errorf("mode %v: a list of every user in the mesh belongs to the one process that "+
-				"needs it", found["mode"])
-		}
-	})
-
-	t.Run("a module that does not claim the seat is refused", func(t *testing.T) {
-		m := theBus()
-		m.Claims = nil
-		if _, err := on(t, m, Rendering{BusUsers: "accounts {}"}); err == nil {
-			t.Fatal("a module that claims nothing was handed every user's password hash")
-		}
-	})
-
-	t.Run("the holder with nothing composed is refused", func(t *testing.T) {
-		if _, err := on(t, theBus(), Rendering{}); err == nil {
-			t.Fatal("the bus was given an empty user list, so it would refuse every connection in " +
-				"the mesh and look like a machine problem")
-		}
-	})
-
-	t.Run("a module that did not ask gets nothing", func(t *testing.T) {
-		m := theBus()
-		m.BusUsers = ""
-		resources, err := on(t, m, Rendering{BusUsers: "accounts {}"})
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, r := range resources {
-			if r["id"] == "nats."+BusUsersID() {
-				t.Fatal("a module that asked for no user list was given one")
-			}
-		}
-	})
-}
diff --git a/internal/catalogue/delivery_seat_test.go b/internal/catalogue/delivery_seat_test.go
deleted file mode 100644
index 7d3a6193..00000000
--- a/internal/catalogue/delivery_seat_test.go
+++ /dev/null
@@ -1,164 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// The delivery seat answers "what did the mesh's checks say of this pull request?" as a verb of its own,
-// `checks` (novox/hq ADR 0239): read by repository and a pull request's number or a commit.
-func TestTheDeliverySeatPromisesChecks(t *testing.T) {
-	seat, ok := SeatNamed(DeliverySeat)
-	if !ok {
-		t.Fatal("the delivery seat is not in the set")
-	}
-	var checks *Verb
-	for i := range seat.Serves {
-		if seat.Serves[i].Name == "checks" {
-			checks = &seat.Serves[i]
-		}
-	}
-	if checks == nil {
-		t.Fatalf("the delivery seat promises %v and not checks", VerbNames(seat.Serves))
-	}
-	props, _ := checks.Input["properties"].(map[string]any)
-	for _, arg := range []string{"repository", "number", "commit"} {
-		if _, has := props[arg]; !has {
-			t.Errorf("checks takes no %q", arg)
-		}
-	}
-	if req, _ := checks.Input["required"].([]string); !reflect.DeepEqual(req, []string{"repository"}) {
-		t.Errorf("checks requires %v, wanted only the repository", req)
-	}
-
-	// Added after the seat's holder shipped, it is optional: the holder serving the ten verbs before it still
-	// holds the seat, and one serving all eleven does too — so the controller and the catalogue can move in
-	// either order, and no check of the catalogue fails on a module nobody touched between the two.
-	if !checks.Optional {
-		t.Fatal("checks is a condition of holding before its holder serves it")
-	}
-	var before []string
-	for _, v := range VerbNames(seat.Serves) {
-		if v != "checks" {
-			before = append(before, v)
-		}
-	}
-	m := Manifest{Module: "mesh-delivery", Claims: []Claim{{Name: DeliverySeat, Scope: ScopeMesh, Serves: before}}}
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder without checks yet: %v", err)
-	}
-	m.Claims[0].Serves = VerbNames(seat.Serves)
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder serving every verb: %v", err)
-	}
-	// Every other verb is still a condition of holding.
-	m.Claims[0].Serves = append([]string{"checks"}, before[1:]...)
-	if err := CanHold(m, seat); err == nil || !strings.Contains(err.Error(), before[0]) {
-		t.Fatalf("a holder without %s: %v", before[0], err)
-	}
-}
-
-// The seat retires history on a person's word (novox/hq issue 313): `retire-history`, with why, one delivery by
-// id or every held one, dry to see first. Added after the holder shipped, it is optional, so the holder that
-// does not serve it yet still holds the seat, and one that does is not refused for a verb the seat lacks.
-func TestTheDeliverySeatPromisesRetireHistoryOptionally(t *testing.T) {
-	seat, _ := SeatNamed(DeliverySeat)
-	var retire *Verb
-	for i := range seat.Serves {
-		if seat.Serves[i].Name == "retire-history" {
-			retire = &seat.Serves[i]
-		}
-	}
-	if retire == nil || !retire.Optional {
-		t.Fatalf("the delivery seat promises %v, retire-history optionally", VerbNames(seat.Serves))
-	}
-	props, _ := retire.Input["properties"].(map[string]any)
-	for _, arg := range []string{"why", "id", "repository", "dry"} {
-		if _, has := props[arg]; !has {
-			t.Errorf("retire-history takes no %q", arg)
-		}
-	}
-	if req, _ := retire.Input["required"].([]string); !reflect.DeepEqual(req, []string{"why"}) {
-		t.Errorf("retire-history requires %v, wanted only why", req)
-	}
-	var without []string
-	for _, v := range VerbNames(seat.Serves) {
-		if v != "retire-history" {
-			without = append(without, v)
-		}
-	}
-	m := Manifest{Module: "mesh-delivery", Claims: []Claim{{Name: DeliverySeat, Scope: ScopeMesh, Serves: without}}}
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder without retire-history yet: %v", err)
-	}
-	m.Claims[0].Serves = VerbNames(seat.Serves)
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder serving retire-history: %v", err)
-	}
-}
-
-// The seat says delivery times (novox/hq ADR 0282, issue 382): `times`, over some days or for one delivery. Added
-// after the holder shipped, it is optional, so the holder that does not serve it yet still holds the seat, and one
-// that does is not refused for a verb the seat lacks.
-func TestTheDeliverySeatPromisesTimesOptionally(t *testing.T) {
-	seat, _ := SeatNamed(DeliverySeat)
-	var times *Verb
-	for i := range seat.Serves {
-		if seat.Serves[i].Name == "times" {
-			times = &seat.Serves[i]
-		}
-	}
-	if times == nil || !times.Optional {
-		t.Fatalf("the delivery seat promises %v, times optionally", VerbNames(seat.Serves))
-	}
-	props, _ := times.Input["properties"].(map[string]any)
-	for _, arg := range []string{"days", "id"} {
-		if _, has := props[arg]; !has {
-			t.Errorf("times takes no %q", arg)
-		}
-	}
-	var without []string
-	for _, v := range VerbNames(seat.Serves) {
-		if v != "times" {
-			without = append(without, v)
-		}
-	}
-	m := Manifest{Module: "mesh-delivery", Claims: []Claim{{Name: DeliverySeat, Scope: ScopeMesh, Serves: without}}}
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder without times yet: %v", err)
-	}
-	m.Claims[0].Serves = VerbNames(seat.Serves)
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder serving times: %v", err)
-	}
-}
-
-// The seat still promises `mark-ready`, optionally, for one more release (issue 1022); it was added by novox/hq issue 913: `mark-ready`, with the delivery's id, who reviewed it
-// and why, so a reviewer marks a pull request through one audited verb, label and comment in the order the forge
-// counts, instead of two raw forge calls. Added after the holder shipped, it is optional.
-func TestTheDeliverySeatPromisesMarkReadyOptionally(t *testing.T) {
-	seat, _ := SeatNamed(DeliverySeat)
-	var mark *Verb
-	for i := range seat.Serves {
-		if seat.Serves[i].Name == "mark-ready" {
-			mark = &seat.Serves[i]
-		}
-	}
-	if mark == nil || !mark.Optional {
-		t.Fatalf("the delivery seat promises %v, mark-ready optionally", VerbNames(seat.Serves))
-	}
-	if req, _ := mark.Input["required"].([]string); !reflect.DeepEqual(req, []string{"id", "reviewed-by", "why"}) {
-		t.Errorf("mark-ready requires %v, wanted id, reviewed-by and why", req)
-	}
-	var without []string
-	for _, v := range VerbNames(seat.Serves) {
-		if v != "mark-ready" {
-			without = append(without, v)
-		}
-	}
-	m := Manifest{Module: "mesh-delivery", Claims: []Claim{{Name: DeliverySeat, Scope: ScopeMesh, Serves: without}}}
-	if err := CanHold(m, seat); err != nil {
-		t.Fatalf("a holder without mark-ready yet: %v", err)
-	}
-}
diff --git a/internal/catalogue/derived_for_consumer_test.go b/internal/catalogue/derived_for_consumer_test.go
deleted file mode 100644
index 8d5e9734..00000000
--- a/internal/catalogue/derived_for_consumer_test.go
+++ /dev/null
@@ -1,346 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// What a provider derives for each consumer, said once and delivered to both ends
-// (novox/hq ADR 0202, issue 124).
-//
-// The failure these are written against: the object store's provisioner derived each consumer's
-// bucket from the login the mesh minted, in its own code, and the mesh had no channel to tell the
-// consumer which bucket that was — so all three consumers wrote the answer into their own
-// definitions by hand. Two were right. One named a predecessor's bucket and would have
-// authenticated successfully and been refused on every object. Each of them also named the
-// machine the module happens to run on, which a definition may not do.
-
-// store is an object store in the shape minio has: it serves a region and a port to everyone, and
-// a bucket named for whoever is asking.
-func store() Manifest {
-	return Manifest{
-		Module: "store", Version: "1",
-		Provides: FromAnywhere("s3-bucket"),
-		Listens:  []Listening{{Port: 9000, Protocol: "tcp", From: FromMesh}},
-		Serves: map[string]map[string]any{"s3-bucket": {
-			"region": "eu-west",
-			"bucket": "${consumer:as:dns}",
-		}},
-		Receives: map[string]string{"s3-bucket": "/var/lib/store/grants/mesh.json"},
-		Grants:   map[string]string{"s3-bucket": "/var/lib/store/grants"},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "store", "ports": []any{"9000"},
-		}},
-	}
-}
-
-// files is a consumer that writes the bucket into its own configuration — which is the thing it
-// could not do before, and had to transcribe.
-func files() Manifest {
-	return Manifest{
-		Module: "files", Version: "1", Slug: "files",
-		Requires: []string{"s3-bucket"},
-		Binds:    map[string]string{"s3-bucket": "/var/lib/files/store.json"},
-		Secrets:  map[string]string{"s3-bucket": "/var/lib/files/store.secret"},
-		Resources: []map[string]any{{
-			"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
-			"content": "BUCKET=${bound:s3-bucket:bucket}\nREGION=${bound:s3-bucket:region}\n",
-		}},
-	}
-}
-
-// pics is a second consumer of the same provider on the same machine: two derivations, neither
-// the other's.
-func pics() Manifest {
-	return Manifest{
-		Module: "pics", Version: "1", Slug: "pics",
-		Requires: []string{"s3-bucket"},
-		Binds:    map[string]string{"s3-bucket": "/var/lib/pics/store.json"},
-		Secrets:  map[string]string{"s3-bucket": "/var/lib/pics/store.secret"},
-		Resources: []map[string]any{{
-			"id": "env", "type": "file", "path": "/var/lib/pics/env", "mode": "0600",
-			"content": "BUCKET=${bound:s3-bucket:bucket}\n",
-		}},
-	}
-}
-
-// The three places the derived value lands must agree, because agreeing is the whole point: the
-// consumer's own file, the binding it reads as JSON, and the provider's contributions entry.
-func TestADerivedValueReachesBothEndsAndAgrees(t *testing.T) {
-	r, err := Resolve(shelf(store(), files()), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// The mesh minted this identity for the consumer; the bucket is that identity as a DNS label.
-	// Derived here with the mesh's own function, so the test cannot agree with a wrong rule.
-	as := ConsumerIdentity("workstation", IdentitySource("files", "files"))
-	want := strings.ReplaceAll(as, "_", "-")
-	if want == as || !strings.Contains(as, "_") {
-		t.Fatalf("the mesh's identity %q has no separator to rewrite; this test proves nothing", as)
-	}
-
-	env := fileNamed(out, "files.env")
-	if env == nil {
-		t.Fatalf("the consumer was given no file: %v", out)
-	}
-	if got := env["content"].(string); !strings.Contains(got, "BUCKET="+want+"\n") {
-		t.Errorf("the consumer's own file was not told the bucket:\n%s\nwant BUCKET=%s", got, want)
-	}
-
-	binding := fileNamed(out, "files.bound-s3-bucket")
-	if binding == nil {
-		t.Fatalf("the consumer was given no binding: %v", out)
-	}
-	var said struct {
-		Serves map[string]any `json:"serves"`
-	}
-	if err := json.Unmarshal([]byte(binding["content"].(string)), &said); err != nil {
-		t.Fatal(err)
-	}
-	if said.Serves["bucket"] != want {
-		t.Errorf("the binding says the bucket is %q, want %q", said.Serves["bucket"], want)
-	}
-	// And what is the same for everybody is still the same for everybody.
-	if said.Serves["region"] != "eu-west" {
-		t.Errorf("the binding lost what the provider serves to all: %v", said.Serves)
-	}
-
-	given := storeGrants(t, out)
-	if len(given) != 1 {
-		t.Fatalf("the provider was told about %d consumer(s): %v", len(given), given)
-	}
-	if given[0].Derived["bucket"] != want {
-		t.Errorf("the provider was told the bucket is %v, and the consumer was told %q — "+
-			"the two ends disagree, which is the whole failure", given[0].Derived["bucket"], want)
-	}
-	// Only the per-consumer half. The region is the same for everyone and is already in the
-	// provider's own definition; repeating it here would be a copy to go stale.
-	if _, carried := given[0].Derived["region"]; carried {
-		t.Errorf("the provider was handed back what it already says for everyone: %v", given[0].Derived)
-	}
-}
-
-// Two consumers of one provider on one machine get two buckets, and neither gets the other's.
-func TestTwoConsumersOfOneProviderGetTheirOwnDerivation(t *testing.T) {
-	r, err := Resolve(shelf(store(), files(), pics()),
-		[]string{"store", "files", "pics"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{Grants: []Grant{
-		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Values: map[string]any{}, Sealed: "c2VhbGVk"},
-		{Provision: "s3-bucket", Consumer: "workstation", From: "pics", Slug: "pics",
-			Values: map[string]any{}, Sealed: "c2VhbGVk"},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	forFiles := strings.ReplaceAll(ConsumerIdentity("workstation", IdentitySource("files", "files")), "_", "-")
-	forPics := strings.ReplaceAll(ConsumerIdentity("workstation", IdentitySource("pics", "pics")), "_", "-")
-	if forFiles == forPics {
-		t.Fatal("the two consumers were given the same identity; this test proves nothing")
-	}
-	if got := fileNamed(out, "files.env")["content"].(string); !strings.Contains(got, "BUCKET="+forFiles+"\n") {
-		t.Errorf("files was not given its own bucket:\n%s", got)
-	}
-	if got := fileNamed(out, "pics.env")["content"].(string); !strings.Contains(got, "BUCKET="+forPics+"\n") {
-		t.Errorf("pics was not given its own bucket:\n%s", got)
-	}
-	var buckets []any
-	for _, g := range storeGrants(t, out) {
-		buckets = append(buckets, g.Derived["bucket"])
-	}
-	if len(buckets) != 2 || buckets[0] == buckets[1] {
-		t.Errorf("the provider was told %v; it must be told one bucket per consumer", buckets)
-	}
-}
-
-// An operator may still set what the provider serves where its definition asks (${setting:…}), and
-// the mesh still derives the rest: the setting is filled first, then the consumer's half. (Until
-// novox/hq issue 696 the layer replaced the served bucket whole; a layer replaces no served key now.)
-func TestASettingComposesWithADerivedValue(t *testing.T) {
-	prefixed := store()
-	prefixed.Serves["s3-bucket"]["bucket"] = "${setting:bucket-prefix}${consumer:as:dns}"
-	r, err := Resolve(shelf(prefixed, files()), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{
-		Settings: SettingsBy{"store": {{From: "the operator",
-			Values: map[string]any{"bucket-prefix": "team-"}}}},
-		Grants: []Grant{{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Values: map[string]any{}, Sealed: "c2VhbGVk"}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := "team-" + strings.ReplaceAll(ConsumerIdentity("workstation", IdentitySource("files", "files")), "_", "-")
-	if got := fileNamed(out, "files.env")["content"].(string); !strings.Contains(got, "BUCKET="+want+"\n") {
-		t.Errorf("the operator's prefix did not survive the derivation:\n%s\nwant BUCKET=%s", got, want)
-	}
-	if given := storeGrants(t, out); given[0].Derived["bucket"] != want {
-		t.Errorf("the provider was told %v, the consumer %q", given[0].Derived["bucket"], want)
-	}
-}
-
-// A fact or an alphabet the mesh does not have is refused where the definition is, not where a
-// consumer happens to be resolved — and the refusal says what may be said instead.
-func TestAServedValueNamingSomethingTheMeshDoesNotHaveIsRefused(t *testing.T) {
-	for _, c := range []struct{ value, says string }{
-		{"${consumer:node}", "as"},
-		{"${consumer:as:punycode}", "dns"},
-	} {
-		m := store()
-		m.Serves["s3-bucket"]["bucket"] = c.value
-		raw, err := json.Marshal(m)
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, err = ParseManifest(raw)
-		if err == nil {
-			t.Fatalf("%s was accepted", c.value)
-		}
-		if !strings.Contains(err.Error(), c.value) {
-			t.Errorf("the refusal of %s does not quote it: %v", c.value, err)
-		}
-		if !strings.Contains(err.Error(), c.says) {
-			t.Errorf("the refusal of %s does not say what may be said (%q): %v", c.value, c.says, err)
-		}
-	}
-}
-
-// `dns` is checked against an identity the mesh actually mints, not an invented string.
-func TestTheDNSAlphabetIsTheMintedIdentityWithItsSeparatorRewritten(t *testing.T) {
-	as := ConsumerIdentity("anchor", IdentitySource("ncloud", "nextcloud"))
-	if err := CheckIdentity("anchor", IdentitySource("ncloud", "nextcloud")); err != nil {
-		t.Fatalf("the mesh would not mint this identity at all: %v", err)
-	}
-	label := asDNSLabel(as)
-	if strings.Contains(label, "_") {
-		t.Errorf("%q is not a DNS label", label)
-	}
-	if strings.ReplaceAll(label, "-", "_") != as {
-		t.Errorf("%q is not %q with its separator rewritten", label, as)
-	}
-}
-
-// The check that would have caught the one wrong instance: a consumer that writes the derived
-// value into its own definition instead of asking for it is refused, whether it transcribed the
-// right answer or a predecessor's.
-func TestAConsumerThatTranscribesWhatItsProviderDerivesIsRefused(t *testing.T) {
-	as := ConsumerIdentity("workstation", IdentitySource("files", "files"))
-	transcribed := strings.ReplaceAll(as, "_", "-")
-
-	m := files()
-	m.Resources = []map[string]any{{
-		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
-		// Exactly what the provider will create — correct today, and a copy of a rule that is
-		// not this module's.
-		"content": "BUCKET=" + transcribed + "\n",
-	}}
-	r, err := Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err == nil {
-		t.Fatal("a definition holding its own copy of the provider's naming rule was accepted")
-	}
-	if !strings.Contains(err.Error(), "${bound:s3-bucket:bucket}") {
-		t.Errorf("the refusal does not say what to write instead: %v", err)
-	}
-
-	// And a constant the provider serves to everyone is not a transcription: repeating it is
-	// redundant, not wrong, and refusing it would be the mesh policing style.
-	m.Resources = []map[string]any{{
-		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
-		"content": "REGION=eu-west\n",
-	}}
-	r, err = Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}}); err != nil {
-		t.Errorf("a value the provider serves to everyone was judged a transcription: %v", err)
-	}
-}
-
-func storeGrants(t *testing.T, out []map[string]any) []Contribution {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] != "/var/lib/store/grants/mesh.json" {
-			continue
-		}
-		var parsed struct {
-			Given []Contribution `json:"given"`
-		}
-		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
-			t.Fatal(err)
-		}
-		return parsed.Given
-	}
-	t.Fatalf("the provider was given no contributions file: %v", out)
-	return nil
-}
-
-// A consumer that keeps SEVERAL holders of one provision is refused, rather than told one thing
-// while its provider is told another.
-//
-// **This is issue 124's own failure, one case to the side.** The mesh gives each holder its own
-// login — `mesh_node_mod_<local>` (ADR 0094) — and the provider derives from the login, so it
-// would make one resource per holder. The consumer's side has no such dimension: there is one
-// binding file per provision and one `${bound:<provision>:<key>}`, both derived from the
-// un-suffixed identity. So the provider would create `…-mod-cold` and the consumer would be
-// configured against `…-mod`: it would authenticate successfully and be refused on every object,
-// which is exactly the fault this whole record exists to end.
-//
-// Refused, loudly, at the one place that can see both halves. Lifting it means giving the
-// consumer's side a local dimension, which is a decision and not an omission.
-func TestAConsumerWithSeveralHoldersOfADerivingProviderIsRefused(t *testing.T) {
-	m := files()
-	// Two holders of the one provision, the shape ADR 0094 gives a module that keeps several.
-	m.Secrets = nil
-	m.SecretsMany = map[string]map[string]string{"s3-bucket": {
-		"hot":  "/var/lib/files/hot.secret",
-		"cold": "/var/lib/files/cold.secret",
-	}}
-	m.Resources = []map[string]any{{
-		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
-		"content": "BUCKET=${bound:s3-bucket:bucket}\n",
-	}}
-	r, err := Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = r.Declaration(Rendering{Grants: []Grant{
-		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Local: "hot", Values: map[string]any{}, Sealed: "c2VhbGVk"},
-		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
-			Local: "cold", Values: map[string]any{}, Sealed: "c2VhbGVk"},
-	}})
-	if err == nil {
-		t.Fatal("a consumer with several holders of a deriving provider was accepted; " +
-			"its two ends would have disagreed in silence")
-	}
-	for _, want := range []string{"files", "s3-bucket", "bucket"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %q: %v", want, err)
-		}
-	}
-}
diff --git a/internal/catalogue/dir_into_test.go b/internal/catalogue/dir_into_test.go
deleted file mode 100644
index ee7a96e2..00000000
--- a/internal/catalogue/dir_into_test.go
+++ /dev/null
@@ -1,325 +0,0 @@
-package catalogue
-
-// A directory the mesh places (novox/hq ADR 0112). These tests pin the contract: a pathless
-// directory resolves under the node's root, ${dir:…} names it from every field a host path can
-// live in, a stated path is the adopted-data placement and wins, an unknown reference refuses at
-// the manifest, and filling for one node never leaks into the next composition.
-
-import (
-	"strings"
-	"testing"
-)
-
-func placedModule() Manifest {
-	return Manifest{
-		Module: "photos",
-		Resources: []map[string]any{
-			{"id": "data", "type": "directory", "mode": "0700"},
-			{"id": "server-env", "type": "file", "path": "${dir:data}/server.env",
-				"content": "STORE=${dir:data}/objects\n"},
-			{"id": "server", "type": "container", "name": "photos-server",
-				"volumes":  []any{"${dir:data}:/data"},
-				"env":      map[string]any{"DATA": "${dir:data}/objects"},
-				"env-file": []any{"${dir:data}/server.env"}},
-		},
-	}
-}
-
-func TestAPathlessDirectoryResolvesUnderTheNodesRoot(t *testing.T) {
-	m := placedModule()
-	dirs := dirsFor(m, Rendering{})
-	if dirs["data"] != "/var/lib/photos/data" {
-		t.Fatalf("the default root is /var/lib and the shape is <root>/<module>/<id>; got %q", dirs["data"])
-	}
-	dirs = dirsFor(m, Rendering{DataRoot: "/tank/nox/"})
-	if dirs["data"] != "/tank/nox/photos/data" {
-		t.Fatalf("a node's own root is honoured, trailing slash and all; got %q", dirs["data"])
-	}
-}
-
-func TestDirReferencesBecomeThePlaceInEveryField(t *testing.T) {
-	m := placedModule()
-	dirs := dirsFor(m, Rendering{})
-
-	directory := shallowCopy(m.Resources[0])
-	if err := dirInto(directory, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if directory["path"] != "/var/lib/photos/data" {
-		t.Fatalf("a pathless directory receives its resolved path; got %v", directory["path"])
-	}
-
-	file := shallowCopy(m.Resources[1])
-	if err := dirInto(file, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if file["path"] != "/var/lib/photos/data/server.env" {
-		t.Fatalf("a file's path names the place; got %v", file["path"])
-	}
-	if file["content"] != "STORE=/var/lib/photos/data/objects\n" {
-		t.Fatalf("a file's content names the place; got %v", file["content"])
-	}
-
-	container := shallowCopy(m.Resources[2])
-	if err := dirInto(container, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if container["volumes"].([]any)[0] != "/var/lib/photos/data:/data" {
-		t.Fatalf("a mount names the place; got %v", container["volumes"])
-	}
-	if container["env"].(map[string]any)["DATA"] != "/var/lib/photos/data/objects" {
-		t.Fatalf("an environment value names the place; got %v", container["env"])
-	}
-	if container["env-file"].([]any)[0] != "/var/lib/photos/data/server.env" {
-		t.Fatalf("an env-file names the place; got %v", container["env-file"])
-	}
-}
-
-func TestAStatedPathIsThePlacementAndStillAnswersByName(t *testing.T) {
-	m := placedModule()
-	// The adopted-machine case: data that must sit where the predecessor already put it.
-	m.Resources[0]["path"] = "/services/mssql/data/"
-	dirs := dirsFor(m, Rendering{})
-	if dirs["data"] != "/services/mssql/data" {
-		t.Fatalf("a stated path wins over the root, trimmed; got %q", dirs["data"])
-	}
-	container := shallowCopy(m.Resources[2])
-	if err := dirInto(container, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if container["volumes"].([]any)[0] != "/services/mssql/data:/data" {
-		t.Fatalf("references follow the placement; got %v", container["volumes"])
-	}
-}
-
-func TestFillingForOneNodeLeaksIntoNoOther(t *testing.T) {
-	m := placedModule()
-	first := shallowCopy(m.Resources[2])
-	if err := dirInto(first, dirsFor(m, Rendering{DataRoot: "/first"}), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	second := shallowCopy(m.Resources[2])
-	if err := dirInto(second, dirsFor(m, Rendering{DataRoot: "/second"}), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if got := second["volumes"].([]any)[0]; got != "/second/photos/data:/data" {
-		t.Fatalf("the second composition must see the manifest, not the first fill; got %v", got)
-	}
-	if m.Resources[2]["volumes"].([]any)[0] != "${dir:data}:/data" {
-		t.Fatalf("the manifest itself stays a template; got %v", m.Resources[2]["volumes"])
-	}
-}
-
-func TestAReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
-	m := placedModule()
-	m.Resources[2]["volumes"] = []any{"${dir:date}:/data"} // a typo, the likely shape
-	problems := m.unknownDirRefs()
-	if len(problems) != 1 || !strings.Contains(problems[0], `${dir:date}`) {
-		t.Fatalf("a reference naming no directory is a manifest problem; got %v", problems)
-	}
-	if got := placedModule().unknownDirRefs(); len(got) != 0 {
-		t.Fatalf("a correct definition has none; got %v", got)
-	}
-}
-
-func TestAReferenceToNoDirectoryRefusesAtCompositionToo(t *testing.T) {
-	m := placedModule()
-	container := shallowCopy(m.Resources[2])
-	container["env"] = map[string]any{"DATA": "${dir:date}"}
-	err := dirInto(container, dirsFor(m, Rendering{}), m.Module)
-	if err == nil || !strings.Contains(err.Error(), `"date"`) || !strings.Contains(err.Error(), `"data"`) {
-		t.Fatalf("the refusal names the mistake and what exists; got %v", err)
-	}
-}
-
-func TestTheAssignmentsOwnRootIsAPlace(t *testing.T) {
-	m := Manifest{Module: "mailu", Resources: []map[string]any{
-		{"id": "state", "type": "directory", "place": ".", "mode": "0700"},
-		{"id": "data-mail", "type": "directory"},
-	}}
-	dirs := dirsFor(m, Rendering{})
-	if dirs["state"] != "/var/lib/mailu" {
-		t.Fatalf("place %q is the assignment's root; got %q", ".", dirs["state"])
-	}
-	if dirs["data-mail"] != "/var/lib/mailu/data-mail" {
-		t.Fatalf("everything else sits beneath it; got %q", dirs["data-mail"])
-	}
-	root := shallowCopy(m.Resources[0])
-	if err := dirInto(root, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if root["path"] != "/var/lib/mailu" {
-		t.Fatalf("the root receives its path; got %v", root["path"])
-	}
-	if _, still := root["place"]; still {
-		t.Fatal("place must never reach the host, which parses strictly")
-	}
-}
-
-func TestTheManifestsMapsArePlaced(t *testing.T) {
-	m := Manifest{
-		Module: "photos",
-		Resources: []map[string]any{
-			{"id": "state", "type": "directory", "place": "."},
-		},
-		Binds:      map[string]string{"route": "${dir:state}/route.json"},
-		Secrets:    map[string]string{"mongodb-database": "${dir:state}/database.secret"},
-		OwnSecrets: OwnSecrets{"admin-key": {Path: "${dir:state}/admin-key.secret"}},
-		Receives:   map[string]string{"route": "${dir:state}/grants/mesh.json"},
-	}
-	placed, err := placedManifest(m, Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if placed.Binds["route"] != "/var/lib/photos/route.json" {
-		t.Fatalf("binds are placed; got %v", placed.Binds)
-	}
-	if placed.Secrets["mongodb-database"] != "/var/lib/photos/database.secret" {
-		t.Fatalf("secrets are placed; got %v", placed.Secrets)
-	}
-	if placed.OwnSecrets["admin-key"].Path != "/var/lib/photos/admin-key.secret" {
-		t.Fatalf("own-secrets are placed; got %v", placed.OwnSecrets)
-	}
-	if placed.Receives["route"] != "/var/lib/photos/grants/mesh.json" {
-		t.Fatalf("receives are placed; got %v", placed.Receives)
-	}
-	if m.Binds["route"] != "${dir:state}/route.json" {
-		t.Fatalf("the manifest itself stays a template; got %v", m.Binds)
-	}
-}
-
-func TestAMapReferenceToNoDirectoryRefusesAtTheManifest(t *testing.T) {
-	m := Manifest{
-		Module:    "photos",
-		Resources: []map[string]any{{"id": "state", "type": "directory", "place": "."}},
-		Binds:     map[string]string{"route": "${dir:stat}/route.json"},
-	}
-	problems := m.unknownDirRefs()
-	if len(problems) != 1 || !strings.Contains(problems[0], `${dir:stat}`) {
-		t.Fatalf("a map naming no directory is a manifest problem; got %v", problems)
-	}
-}
-
-func TestPlaceIsValidatedAtTheManifest(t *testing.T) {
-	both := Manifest{Module: "x", Resources: []map[string]any{
-		{"id": "d", "type": "directory", "place": ".", "path": "/somewhere"},
-	}}
-	if got := both.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "both path and place") {
-		t.Fatalf("path beside place refuses; got %v", got)
-	}
-	elsewhere := Manifest{Module: "x", Resources: []map[string]any{
-		{"id": "f", "type": "file", "place": ".", "path": "/somewhere", "content": ""},
-	}}
-	if got := elsewhere.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], "not a directory") {
-		t.Fatalf("place on a file refuses; got %v", got)
-	}
-	wrong := Manifest{Module: "x", Resources: []map[string]any{
-		{"id": "d", "type": "directory", "place": "sub/dir"},
-	}}
-	if got := wrong.unknownDirRefs(); len(got) != 1 || !strings.Contains(got[0], `the places are "."`) {
-		t.Fatalf("a place that is neither root refuses; got %v", got)
-	}
-}
-
-func TestTheMeshsDirectoryForAModuleIsAPlace(t *testing.T) {
-	// novox/hq issue 174. What the mesh writes for a module — its bus credential, its bindings —
-	// is the mesh's plumbing under <root>/mesh/<module>, and the definition names it by id.
-	m := Manifest{Module: "umami",
-		Resources: []map[string]any{
-			{"id": "mesh-state", "type": "directory", "place": "mesh"},
-			{"id": "state", "type": "directory", "place": "."},
-			{"id": "server", "type": "container", "image": "x@sha256:aa",
-				"volumes": []any{"${dir:mesh-state}/broker:/run/secrets/broker:ro"}},
-		},
-		OwnSecrets: OwnSecrets{"broker": {Path: "${dir:mesh-state}/broker"}},
-		Binds:      map[string]string{"route": "${dir:state}/route.json"},
-	}
-	if got := m.unknownDirRefs(); len(got) != 0 {
-		t.Fatalf("place %q is a place; got %v", "mesh", got)
-	}
-	dirs := dirsFor(m, Rendering{})
-	if dirs["mesh-state"] != "/var/lib/mesh/umami" || dirs["state"] != "/var/lib/umami" {
-		t.Fatalf("the mesh's directory sits beside the module's, not in it; got %v", dirs)
-	}
-	dirs = dirsFor(m, Rendering{DataRoot: "/srv"})
-	if dirs["mesh-state"] != "/srv/mesh/umami" {
-		t.Fatalf("a node's root moves the mesh's files with the module's; got %v", dirs)
-	}
-	placed, err := placedManifest(m, Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if placed.OwnSecrets["broker"].Path != "/var/lib/mesh/umami/broker" {
-		t.Fatalf("own-secrets are placed under the mesh's directory; got %v", placed.OwnSecrets)
-	}
-	container := shallowCopy(m.Resources[2])
-	if err := dirInto(container, dirsFor(m, Rendering{}), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if container["volumes"].([]any)[0] != "/var/lib/mesh/umami/broker:/run/secrets/broker:ro" {
-		t.Fatalf("the mount's host side is placed; got %v", container["volumes"])
-	}
-}
-
-func TestTwoModulesPlacedRootsAreNoCollision(t *testing.T) {
-	a := Manifest{Module: "gitea", Resources: []map[string]any{
-		{"id": "state", "type": "directory", "place": "."},
-		{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
-	}}
-	b := Manifest{Module: "nextcloud", Resources: []map[string]any{
-		{"id": "state", "type": "directory", "place": "."},
-		{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
-	}}
-	if got := checkResources([]Manifest{a, b}); len(got) != 0 {
-		t.Fatalf("alike templates are different places; got %v", got)
-	}
-	// And the real collision is still caught: a module stating another's placed root.
-	c := Manifest{Module: "squatter", Resources: []map[string]any{
-		{"id": "nest", "type": "directory", "path": "/var/lib/gitea"},
-	}}
-	got := checkResources([]Manifest{a, c})
-	if len(got) != 1 || !strings.Contains(got[0], `"/var/lib/gitea"`) {
-		t.Fatalf("a stated path on a placed root collides; got %v", got)
-	}
-}
-
-func shallowCopy(resource map[string]any) map[string]any {
-	copied := map[string]any{}
-	for k, v := range resource {
-		copied[k] = v
-	}
-	return copied
-}
-
-func TestADirectoryBeneathAPlacedOneIsPlacedWithIt(t *testing.T) {
-	// An adopted layout keeps a subdirectory the predecessor made under the mesh's directory
-	// (issue 174: a forge's runtime state, a manager's output). Stated as beneath the placed one,
-	// it moves with it — a node's root moves both, and the definition names no host path.
-	m := Manifest{Module: "gitea", Resources: []map[string]any{
-		{"id": "mesh-state", "type": "directory", "place": "mesh"},
-		{"id": "runtime-state", "type": "directory", "path": "${dir:mesh-state}/state"},
-		{"id": "server", "type": "container", "image": "x@sha256:aa",
-			"volumes": []any{"${dir:runtime-state}:/data"}},
-	}}
-	if got := m.unknownDirRefs(); len(got) != 0 {
-		t.Fatalf("a path beneath a placed directory is well formed; got %v", got)
-	}
-	dirs := dirsFor(m, Rendering{DataRoot: "/srv"})
-	if dirs["runtime-state"] != "/srv/mesh/gitea/state" {
-		t.Fatalf("the subdirectory follows the placed one; got %v", dirs)
-	}
-	sub := shallowCopy(m.Resources[1])
-	if err := dirInto(sub, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if sub["path"] != "/srv/mesh/gitea/state" {
-		t.Fatalf("the directory resource itself is resolved; got %v", sub["path"])
-	}
-	container := shallowCopy(m.Resources[2])
-	if err := dirInto(container, dirs, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if container["volumes"].([]any)[0] != "/srv/mesh/gitea/state:/data" {
-		t.Fatalf("a reference to the subdirectory resolves whole; got %v", container["volumes"])
-	}
-}
diff --git a/internal/catalogue/domain_test.go b/internal/catalogue/domain_test.go
deleted file mode 100644
index 967985b6..00000000
--- a/internal/catalogue/domain_test.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A domain module is a module with requirements and no files of its own.
-//
-// Most people want the network working and do not want to choose a VPN. Some want a particular
-// one. Both are the same mechanism: assigning `networking` takes the only answer to each of its
-// requirements silently, and the day there are two answers the resolver refuses and names them,
-// so choosing is assigning the one you want. There is no flavor field and nothing to configure.
-
-func networkingShelf(extra ...Manifest) map[string]Manifest {
-	base := []Manifest{
-		{Module: "networking", Requires: []string{"private-network", "name-resolution"}},
-		{Module: "mesh-wireguard", Computed: "mesh-wireguard",
-			Provides: Offers("private-network", "mesh-addressing"),
-			Claims:   []Claim{{Name: "the-private-network", Scope: ScopeNode}}},
-		{Module: "mesh-names", Computed: "mesh-names",
-			Provides: Offers("name-resolution"), Requires: []string{"mesh-addressing"}},
-	}
-	return shelf(append(base, extra...)...)
-}
-
-func TestOneWordBringsUpTheNetwork(t *testing.T) {
-	// The case that has to stay easy. Nothing is asked, because with one answer to each
-	// requirement there was never a question.
-	got, err := Resolve(networkingShelf(), []string{"networking"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	have := strings.Join(names(got), " ")
-	for _, want := range []string{"networking", "mesh-wireguard", "mesh-names"} {
-		if !strings.Contains(have, want) {
-			t.Fatalf("assigning networking did not bring in %s: %s", want, have)
-		}
-	}
-}
-
-func TestASecondVPNTurnsItIntoAChoice(t *testing.T) {
-	// And the choice is offered rather than made. A default here would be the flavor field coming
-	// back under another name.
-	_, err := Resolve(networkingShelf(
-		Manifest{Module: "tailscale", Provides: Offers("private-network"),
-			Claims: []Claim{{Name: "the-private-network", Scope: ScopeNode}}},
-	), []string{"networking"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("two VPNs and one was picked silently")
-	}
-	for _, want := range []string{"mesh-wireguard", "tailscale"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
-
-func TestChoosingIsAssigning(t *testing.T) {
-	// No second verb. Assigning the one you want answers the requirement, and the bundle takes it.
-	got, err := Resolve(networkingShelf(
-		Manifest{Module: "tailscale",
-			Provides: Offers("private-network", "name-resolution"),
-			Claims:   []Claim{{Name: "the-private-network", Scope: ScopeNode}}},
-	), []string{"networking", "tailscale"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	have := strings.Join(names(got), " ")
-	if !strings.Contains(have, "tailscale") {
-		t.Fatalf("the chosen VPN is not in the set: %s", have)
-	}
-	if strings.Contains(have, "mesh-wireguard") {
-		t.Fatalf("choosing tailscale still installed WireGuard: %s", have)
-	}
-}
-
-func TestChoosingOneVPNCannotDragTheOtherBackIn(t *testing.T) {
-	// This happened. The person chose tailscale; the names module required the mesh's own
-	// addressing; only WireGuard provides that; so both were installed and nobody was told.
-	//
-	// The claim is what catches it. Providing a private network is not the singular part — a
-	// machine could run two VPNs for two purposes — but being *the* one the mesh runs over is.
-	_, err := Resolve(networkingShelf(
-		Manifest{Module: "tailscale", Provides: Offers("private-network"),
-			Claims: []Claim{{Name: "the-private-network", Scope: ScopeNode}}},
-	), []string{"networking", "tailscale"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("a machine was given two private networks without being told")
-	}
-	if !strings.Contains(err.Error(), "the-private-network") {
-		t.Fatalf("the refusal does not say what collided: %v", err)
-	}
-}
-
-func TestNamesNeedTheMeshsOwnAddresses(t *testing.T) {
-	// Names are computed from addresses the mesh handed out. Over a VPN that hands out its own,
-	// the mesh has nothing to write, so the names module requires the addressing rather than a
-	// private network in general — otherwise a machine gets a hosts file full of addresses that
-	// mean nothing on it.
-	_, err := Resolve(shelf(
-		Manifest{Module: "mesh-names", Computed: "mesh-names",
-			Provides: Offers("name-resolution"), Requires: []string{"mesh-addressing"}},
-		Manifest{Module: "tailscale", Provides: Offers("private-network")},
-	), []string{"mesh-names", "tailscale"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("the mesh's names were installed over a VPN whose addresses it does not hand out")
-	}
-	if !strings.Contains(err.Error(), "mesh-addressing") {
-		t.Fatalf("the refusal does not say what is missing: %v", err)
-	}
-}
-
-func TestARequirementWantedTwiceIsReportedOnce(t *testing.T) {
-	// Two identical lines make a person hunt for the difference between them before realising
-	// there is none.
-	_, err := Resolve(shelf(
-		Manifest{Module: "one", Requires: []string{"shell"}},
-		Manifest{Module: "two", Requires: []string{"shell"}},
-		Manifest{Module: "bash", Provides: Offers("shell")},
-		Manifest{Module: "zsh", Provides: Offers("shell")},
-	), []string{"one", "two"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("two shells and one was picked silently")
-	}
-	if n := strings.Count(err.Error(), `"shell" is wanted by`); n != 1 {
-		t.Fatalf("the same requirement was reported %d times:\n%v", n, err)
-	}
-}
diff --git a/internal/catalogue/endpoint_test.go b/internal/catalogue/endpoint_test.go
deleted file mode 100644
index d05f0407..00000000
--- a/internal/catalogue/endpoint_test.go
+++ /dev/null
@@ -1,205 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// aMediaServer is the shape one port number per key cannot express: two endpoints of different kinds.
-// A web surface a proxy serves under a subdomain, and a protocol port clients dial directly because
-// the client expects that number.
-func aMediaServer() Manifest {
-	return Manifest{
-		Module: "media",
-		Listens: []Listening{
-			{Name: "web", Port: 80, From: FromMesh, Why: "the app, behind the proxy"},
-			{Name: "stream", Port: 32400, From: FromEverywhere, Fixed: true,
-				Why: "the client dials this number; the protocol chose it"},
-		},
-		Contributes: map[string]map[string]any{
-			"route": {"label": "media", RouteEndpoint: "web"},
-		},
-		// Both endpoints are published by its container, which is what lets a machine port be given
-		// for either: the mesh moves a port the module publishes, never one it merely listens on.
-		Resources: []map[string]any{
-			{"id": "server", "type": "container", "name": "media",
-				"ports": []any{"80", "32400"}},
-		},
-	}
-}
-
-// **A route names the endpoint it serves.** A route and a listen both carried a port and nothing said
-// they were the same thing; now one of them says so.
-func TestARouteNamesTheEndpointItServes(t *testing.T) {
-	m := aMediaServer()
-	if port, ok := EndpointPort(m, "web"); !ok || port != 80 {
-		t.Fatalf("the web endpoint resolves to %d (%v), want 80", port, ok)
-	}
-	if port, ok := EndpointPort(m, "stream"); !ok || port != 32400 {
-		t.Fatalf("the stream endpoint resolves to %d (%v), want 32400", port, ok)
-	}
-	if _, ok := EndpointPort(m, "absent"); ok {
-		t.Fatal("an endpoint the module does not declare resolved to a port")
-	}
-}
-
-// And the routed set is read through the name, so the endpoint the proxy serves is known without a
-// reader joining two numbers.
-func TestTheRoutedEndpointIsFoundByName(t *testing.T) {
-	routed := RoutedPorts(aMediaServer())
-	if !routed[80] {
-		t.Fatalf("the routed endpoint was not found by name: %v", routed)
-	}
-	// And the directly-dialled one is not routed, which is what lets its reach govern its port.
-	if routed[32400] {
-		t.Fatalf("the endpoint clients dial directly reads as routed: %v", routed)
-	}
-}
-
-// **Two endpoints of different shapes, configured as themselves.** The web endpoint's reach asks for
-// names and leaves its port to the proxy; the stream endpoint's reach governs its port, because
-// clients dial it and there is no name.
-func TestTwoEndpointsOfDifferentShapesAreConfiguredSeparately(t *testing.T) {
-	m := aMediaServer()
-	settings := SettingsBy{"media": {{From: "node anchor", Values: map[string]any{
-		ReachSetting: map[string]any{"80": ReachBoth, "32400": ReachPublic},
-	}}}}
-
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	rules, err := r.Rules(Rendering{Settings: settings})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, rule := range rules {
-		switch rule.Port {
-		case 80:
-			if rule.From != FromMesh {
-				t.Fatalf("the routed endpoint's port opened to %q; the proxy is how it is reached",
-					rule.From)
-			}
-		case 32400:
-			if rule.From != FromEverywhere {
-				t.Fatalf("the directly-dialled endpoint's port is %q, want anywhere", rule.From)
-			}
-		}
-	}
-
-	// And the routed one carries both names, asked for by the same statement.
-	given, err := r.contributions(settings, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var public, internal string
-	for _, c := range given["route"] {
-		public, _ = c.Values["name"].(string)
-		internal, _ = c.Values["internal-name"].(string)
-	}
-	if public != "media.example.test" || internal != "media.anchor.internal" {
-		t.Fatalf("names are %q and %q, want both", public, internal)
-	}
-}
-
-// A route naming an endpoint the module does not declare reaches nothing, and is refused where it is
-// written rather than resolving to no port and serving nothing.
-func TestARouteNamingAnEndpointTheModuleLacksIsRefused(t *testing.T) {
-	m := aMediaServer()
-	m.Contributes["route"][RouteEndpoint] = "absent"
-	got := strings.Join(RouteProblems(m), "\n")
-	if !strings.Contains(got, "does not declare") {
-		t.Fatalf("a route naming an absent endpoint was accepted:\n%s", got)
-	}
-}
-
-// **Two endpoints called the same would make an assignment configure whichever was read last.** The
-// point of a name is that it identifies one thing.
-func TestTwoEndpointsWithOneNameAreRefused(t *testing.T) {
-	m := Manifest{Module: "twice", Listens: []Listening{
-		{Name: "web", Port: 80, From: FromMesh},
-		{Name: "web", Port: 8080, From: FromMesh},
-	}}
-	got := strings.Join(endpointNameProblems(m), "\n")
-	if !strings.Contains(got, "could mean either") {
-		t.Fatalf("two endpoints with one name were accepted:\n%s", got)
-	}
-}
-
-// A name that is not a name is refused where it is written: it ends up in something a person types.
-func TestAnEndpointNameIsHeldToItsShape(t *testing.T) {
-	for _, wrong := range []string{"Web", "web port", "3000", "-web", "web_surface"} {
-		m := Manifest{Module: "odd", Listens: []Listening{{Name: wrong, Port: 80, From: FromMesh}}}
-		if got := strings.Join(endpointNameProblems(m), "\n"); !strings.Contains(got, "a name is lowercase") {
-			t.Fatalf("%q was accepted as an endpoint name:\n%s", wrong, got)
-		}
-	}
-}
-
-// **Every endpoint in the catalogue is unnamed today, and must stay valid.** The word ships one
-// release before anything uses it.
-func TestAnUnnamedEndpointIsStillValid(t *testing.T) {
-	m := Manifest{Module: "ordinary", Listens: []Listening{{Port: 443, From: FromEverywhere}}}
-	if got := endpointNameProblems(m); len(got) != 0 {
-		t.Fatalf("an unnamed endpoint was refused: %v", got)
-	}
-	if got := RouteProblems(m); len(got) != 0 {
-		t.Fatalf("a module with no route was refused: %v", got)
-	}
-}
-
-// **A route that names an endpoint still carries that endpoint's port.**
-//
-// Everything downstream reads the port: the provider is told where to reach the consumer, and the
-// redirection that turns a declared port into the number the machine published is keyed on it. A route
-// naming only its endpoint left the proxy with no port, and a proxy with no port has nothing to dial.
-//
-// Caught after the catalogue had already been changed to name endpoints, and before the mesh picked
-// those manifests up — which is the only reason nothing broke.
-func TestARouteNamingAnEndpointStillCarriesItsPort(t *testing.T) {
-	m := aMediaServer()
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	given, err := r.contributions(nil, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var saw bool
-	for _, c := range given["route"] {
-		saw = true
-		port, ok := asPort(c.Values["port"])
-		if !ok {
-			t.Fatalf("the route carries no port, so the proxy has nothing to dial: %v", c.Values)
-		}
-		if port != 80 {
-			t.Fatalf("the route carries port %d, want the web endpoint's 80", port)
-		}
-	}
-	if !saw {
-		t.Fatal("the module contributed no route")
-	}
-}
-
-// And the declared port, not the machine one: the redirection to where the machine published it
-// happens later and is keyed on the declared number, so filling the machine port in here would be
-// redirected twice or not at all.
-func TestTheEndpointsDeclaredPortIsFilledInNotTheMachineOne(t *testing.T) {
-	m := aMediaServer()
-	values := map[string]any{RouteEndpoint: "web", "label": "media"}
-	portOfEndpoint(values, endpointPorts(m))
-	if got, _ := asPort(values["port"]); got != 80 {
-		t.Fatalf("filled in port %d, want the declared 80", got)
-	}
-	// Then the ordinary redirection puts it where the machine published it.
-	moved := atMachinePort(values, m.Module, map[string]map[int]int{"media": {80: 20009}})
-	if got, _ := asPort(moved["port"]); got != 20009 {
-		t.Fatalf("after redirection the port is %d, want the machine's 20009", got)
-	}
-}
-
-// A route that repeats a port keeps it, because that is the older shape and still read.
-func TestARouteThatRepeatsItsPortKeepsIt(t *testing.T) {
-	values := map[string]any{RouteEndpoint: "web", "port": 8080}
-	portOfEndpoint(values, map[string]int{"web": 80})
-	if got, _ := asPort(values["port"]); got != 8080 {
-		t.Fatalf("the port it stated was overwritten with %d", got)
-	}
-}
diff --git a/internal/catalogue/endpoints_setting_test.go b/internal/catalogue/endpoints_setting_test.go
deleted file mode 100644
index bfab88cb..00000000
--- a/internal/catalogue/endpoints_setting_test.go
+++ /dev/null
@@ -1,140 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-func configured(block map[string]any) SettingsBy {
-	return SettingsBy{"media": {{From: "node anchor",
-		Placement: map[string]any{EndpointsSetting: block}}}}
-}
-
-// **One block per endpoint, saying all three things.** The machine port, the subdomain and the reach
-// were `ports`, the route's label and `reach`, each keyed by a port number, so configuring a module
-// with two endpoints of different shapes meant knowing which number was which.
-func TestAnEndpointsBlockSaysPortLabelAndReach(t *testing.T) {
-	m := aMediaServer()
-	// stream's reach NARROWS what the manifest says — the manifest has it from anywhere, the
-	// assignment says internal. Chosen deliberately: a reach that agrees with the manifest proves
-	// nothing about whether the block was read at all.
-	settings := configured(map[string]any{
-		"web":    map[string]any{"port": 20009, "label": "cinema", "reach": ReachBoth},
-		"stream": map[string]any{"reach": ReachInternal},
-	})
-
-	// The machine port, where the mapping is read.
-	given, err := GivenPorts(m, settings["media"])
-	if err != nil {
-		t.Fatal(err)
-	}
-	if given[80] != 20009 {
-		t.Fatalf("the web endpoint is on machine port %d, want 20009: %v", given[80], given)
-	}
-
-	// The reach, where the filter reads it.
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	rules, err := r.Rules(Rendering{Settings: settings})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, rule := range rules {
-		if rule.Port == 32400 && rule.From != FromMesh {
-			t.Fatalf("the directly-dialled endpoint is %q; the assignment narrowed it to the private "+
-				"network and the manifest's 'anywhere' should not win", rule.From)
-		}
-		if rule.Port == 80 && rule.From != FromMesh {
-			t.Fatalf("the routed endpoint's port opened to %q; the proxy is how it is reached", rule.From)
-		}
-	}
-
-	// And the subdomain, where the name is composed — the assignment's, not the module's.
-	nodes, err := r.contributions(settings, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range nodes["route"] {
-		if got, _ := c.Values["name"].(string); got != "cinema.example.test" {
-			t.Fatalf("the public name is %q, want the label the assignment gave", got)
-		}
-		if got, _ := c.Values["internal-name"].(string); got != "cinema.anchor.internal" {
-			t.Fatalf("the internal name is %q, want the label the assignment gave", got)
-		}
-	}
-}
-
-// A block that says only a reach leaves the port to the mesh and the label to the module, which is the
-// ordinary case and must not require writing the other two.
-func TestABlockMaySayOnlyAReach(t *testing.T) {
-	m := aMediaServer()
-	settings := configured(map[string]any{"web": map[string]any{"reach": ReachInternal}})
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	nodes, err := r.contributions(settings, nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range nodes["route"] {
-		if got, _ := c.Values["name"].(string); got != "" {
-			t.Fatalf("an internal endpoint composed the public name %q", got)
-		}
-		// The module's own label, untouched.
-		if got, _ := c.Values["internal-name"].(string); got != "media.anchor.internal" {
-			t.Fatalf("the internal name is %q, want the module's own label", got)
-		}
-	}
-}
-
-// An endpoint the module does not declare reaches nothing, and the refusal says what it does declare.
-func TestConfiguringAnEndpointTheModuleLacksIsRefused(t *testing.T) {
-	_, err := Endpoints(aMediaServer(), configured(map[string]any{
-		"admin": map[string]any{"reach": ReachInternal}})["media"])
-	if err == nil || !strings.Contains(err.Error(), "does not declare") {
-		t.Fatalf("configuring an absent endpoint was accepted: %v", err)
-	}
-	if err != nil && !strings.Contains(err.Error(), "stream") {
-		t.Fatalf("the refusal does not name what the module declares: %v", err)
-	}
-}
-
-func TestAReachInABlockIsHeldToTheFourValues(t *testing.T) {
-	_, err := Endpoints(aMediaServer(), configured(map[string]any{
-		"web": map[string]any{"reach": "mesh"}})["media"])
-	if err == nil || !strings.Contains(err.Error(), "a reach is") {
-		t.Fatalf("a filter word was accepted as a reach: %v", err)
-	}
-}
-
-// **Two places giving one endpoint a machine port is the confusion this key exists to end.**
-func TestAnEndpointGivenAPortTwiceIsRefused(t *testing.T) {
-	m := aMediaServer()
-	_, err := GivenPorts(m, []Layer{{From: "node anchor", Placement: map[string]any{
-		EndpointsSetting: map[string]any{"web": map[string]any{"port": 20009}},
-		PortsSetting:     map[string]any{"80": 30000},
-	}}})
-	if err == nil || !strings.Contains(err.Error(), "published once") {
-		t.Fatalf("an endpoint given two machine ports was accepted: %v", err)
-	}
-}
-
-// And the same for its reach, said once here and once through the older key.
-func TestAnEndpointWhoseReachIsAlsoExposedIsRefused(t *testing.T) {
-	_, err := Endpoints(aMediaServer(), []Layer{{From: "node anchor", Placement: map[string]any{
-		EndpointsSetting: map[string]any{"web": map[string]any{"reach": ReachInternal}},
-		ExposeSetting:    map[string]any{"80": FromEverywhere},
-	}}})
-	if err == nil || !strings.Contains(err.Error(), "same thing in different words") {
-		t.Fatalf("a reach said two ways was accepted: %v", err)
-	}
-}
-
-// A module whose endpoints are unnamed cannot be configured this way, and is told so rather than
-// having a block silently reach nothing — which is every module in the catalogue today.
-func TestAModuleWithNoNamedEndpointsIsToldSo(t *testing.T) {
-	m := Manifest{Module: "media", Listens: []Listening{{Port: 80, From: FromMesh}}}
-	_, err := Endpoints(m, configured(map[string]any{"web": map[string]any{"reach": ReachBoth}})["media"])
-	if err == nil || !strings.Contains(err.Error(), "no endpoints by name") {
-		t.Fatalf("a module with no named endpoints accepted a block: %v", err)
-	}
-}
diff --git a/internal/catalogue/engine_guard_test.go b/internal/catalogue/engine_guard_test.go
deleted file mode 100644
index 85b75970..00000000
--- a/internal/catalogue/engine_guard_test.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package catalogue
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// The controller refuses a definition's resolved path by the node-engine's own rules, no more (novox/hq issue
-// 496): the same lists, read here from mesh-host's internal/apply/placement_guard.go — in a merge check the clone
-// beside it at the commit the mesh runs, elsewhere the copy captured in testdata/beside. When the engine's lists
-// move, this fails until the controller's move with them, so the gate never refuses what the engine applies nor
-// passes what it refuses by path alone.
-func TestTheResolvedPathRulesAreTheNodeEnginesOwn(t *testing.T) {
-	file := filepath.Join(beside.Dir(t, "mesh-host"), "internal", "apply", "placement_guard.go")
-	parsed, err := parser.ParseFile(token.NewFileSet(), file, nil, 0)
-	if err != nil {
-		t.Fatalf("the node-engine's guard does not parse: %v", err)
-	}
-	lists := map[string][]string{}
-	consts := map[string]string{}
-	ast.Inspect(parsed, func(n ast.Node) bool {
-		spec, ok := n.(*ast.ValueSpec)
-		if !ok {
-			return true
-		}
-		for i, name := range spec.Names {
-			if i >= len(spec.Values) {
-				continue
-			}
-			switch v := spec.Values[i].(type) {
-			case *ast.CompositeLit:
-				for _, elt := range v.Elts {
-					if lit, ok := elt.(*ast.BasicLit); ok && lit.Kind == token.STRING {
-						s, _ := strconv.Unquote(lit.Value)
-						lists[name.Name] = append(lists[name.Name], s)
-					}
-				}
-			case *ast.BasicLit:
-				if v.Kind == token.STRING {
-					consts[name.Name], _ = strconv.Unquote(v.Value)
-				}
-			}
-		}
-		return true
-	})
-	for name, ours := range map[string][]string{
-		"protectedRoots": protectedRoots, "forbiddenBelow": forbiddenBelow, "engineTrees": engineTrees,
-	} {
-		theirs := lists[name]
-		if len(theirs) == 0 {
-			t.Errorf("the node-engine's guard names no %s any more; read it and say where its rule went", name)
-			continue
-		}
-		a, b := slices.Clone(ours), slices.Clone(theirs)
-		slices.Sort(a)
-		slices.Sort(b)
-		if !slices.Equal(a, b) {
-			t.Errorf("%s differs from the node-engine's:\n controller %v\n node-engine %v", name, a, b)
-		}
-	}
-	if consts["engineModule"] != engineModule {
-		t.Errorf("the node-engine's own module is %q there and %q here", consts["engineModule"], engineModule)
-	}
-}
diff --git a/internal/catalogue/environment_into_integration_test.go b/internal/catalogue/environment_into_integration_test.go
deleted file mode 100644
index b41864ec..00000000
--- a/internal/catalogue/environment_into_integration_test.go
+++ /dev/null
@@ -1,91 +0,0 @@
-//go:build integration
-
-package catalogue
-
-import (
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestThePOSIXEnvironmentSourcedTwiceLeavesPATHAsOnce(t *testing.T) {
-	sh, err := exec.LookPath("sh")
-	if err != nil {
-		t.Skip("no sh on this machine")
-	}
-	script := "PATH=/usr/bin:/bin\n" + composedPOSIX + "once=$PATH\n" + composedPOSIX +
-		`[ "$PATH" = "$once" ] || { echo "changed: $once -> $PATH"; exit 1; }` + "\n" +
-		`echo "$PATH"; echo "$GOPATH"`
-	out, err := exec.Command(sh, "-c", script).CombinedOutput()
-	if err != nil {
-		t.Fatalf("sourcing twice: %v\n%s", err, out)
-	}
-	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
-	want := "/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts"
-	if lines[0] != want {
-		t.Fatalf("PATH is %s, not %s", lines[0], want)
-	}
-	if lines[1] != "/home/op/go" {
-		t.Fatalf("GOPATH was not exported: %q", lines[1])
-	}
-	// And an entry the account already has stays where it is, and once.
-	out, err = exec.Command(sh, "-c", "PATH=/opt/scripts:/usr/bin\n"+composedPOSIX+`echo "$PATH"`).CombinedOutput()
-	if err != nil {
-		t.Fatalf("%v\n%s", err, out)
-	}
-	if got := strings.TrimSpace(string(out)); got !=
-		"/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/opt/scripts:/usr/bin:/opt/agent/bin" {
-		t.Fatalf("an entry already on PATH was added again or moved: %s", got)
-	}
-}
-
-func TestTheServiceManagerReadsTheSystemdRenderingAsMeant(t *testing.T) {
-	generator := "/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator"
-	if _, err := os.Stat(generator); err != nil {
-		t.Skip("NOT JUDGED: no environment.d generator on this machine, so the service manager's reading " +
-			"of the rendering is judged only where systemd runs; the rendering itself is held byte for byte " +
-			"by TestTheEnvironmentRendersForTheServiceManagerByteForByte")
-	}
-	const base = "/usr/bin:/bin"
-	read := func(conf string) map[string]string {
-		t.Helper()
-		config := t.TempDir()
-		if err := os.MkdirAll(filepath.Join(config, "environment.d"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if conf != "" {
-			if err := os.WriteFile(filepath.Join(config, "environment.d", "50-mesh.conf"), []byte(conf), 0o644); err != nil {
-				t.Fatal(err)
-			}
-		}
-		cmd := exec.Command(generator)
-		cmd.Env = []string{"PATH=" + base, "HOME=" + config, "XDG_CONFIG_HOME=" + config}
-		out, err := cmd.CombinedOutput()
-		if err != nil {
-			t.Fatalf("%v\n%s", err, out)
-		}
-		vars := map[string]string{}
-		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
-			if k, v, ok := strings.Cut(line, "="); ok {
-				vars[k] = v
-			}
-		}
-		return vars
-	}
-	machine, read50 := read(""), read(composedSystemd)
-
-	// What the machine's own files do to PATH: nothing, or append to it. One that replaces or prepends
-	// leaves nothing this test can say about the mesh's file, and says so rather than guess.
-	added, ok := strings.CutPrefix(machine["PATH"], base)
-	if machine["PATH"] != "" && !ok {
-		t.Skipf("NOT JUDGED: this machine's own environment.d sets PATH to %s, not %s with something after it, so "+
-			"what the mesh's file adds cannot be told apart from it", machine["PATH"], base)
-	}
-	want := "/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts" + added
-	if read50["PATH"] != want || read50["GOPATH"] != "/home/op/go" {
-		t.Fatalf("the service manager read PATH=%s GOPATH=%s, not PATH=%s GOPATH=/home/op/go (the machine's own "+
-			"files add %q to PATH)", read50["PATH"], read50["GOPATH"], want, added)
-	}
-}
diff --git a/internal/catalogue/environment_into_test.go b/internal/catalogue/environment_into_test.go
deleted file mode 100644
index ca112e9b..00000000
--- a/internal/catalogue/environment_into_test.go
+++ /dev/null
@@ -1,424 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0203 (the account's environment is one module's, and every module
-// contributes to it) and ADR 0204 (shell code in named slots, placed by the login shell's holder).
-
-// contributors is a fixed set of contributions, in no particular order: what the renderings are
-// asserted against byte for byte. go-toolchain and zsh both put ~/.local/bin on PATH, which is the
-// ordinary case of two modules sharing a directory, and is written once.
-func contributors() []Manifest {
-	return []Manifest{
-		{Module: "zsh", Environment: &Environment{
-			Variables: map[string]string{"XDG_CONFIG_HOME": "${machine:account-home}/.config", "EDITOR": "vim"},
-			Path: []PathEntry{
-				{Entry: "${machine:account-home}/.local/bin", At: PathAtStart},
-				{Entry: "${machine:account-home}/bin", At: PathAtStart},
-				{Entry: "/opt/scripts", At: PathAtEnd},
-			},
-		}},
-		{Module: "go-toolchain", Environment: &Environment{
-			Variables: map[string]string{"GOPATH": "${machine:account-home}/go"},
-			Path: []PathEntry{
-				{Entry: "${machine:account-home}/go/bin", At: PathAtStart},
-				{Entry: "/usr/local/go/bin", At: PathAtStart},
-				{Entry: "${machine:account-home}/.local/bin", At: PathAtStart},
-			},
-		}},
-		{Module: "agent", Environment: &Environment{
-			Variables: map[string]string{"DISABLE_AUTOUPDATER": "1"},
-			Path:      []PathEntry{{Entry: "/opt/agent/bin", At: PathAtEnd}},
-		}},
-		// A module contributing nothing is in the set and writes nothing.
-		{Module: "postgres"},
-	}
-}
-
-var operatorFacts = map[string]string{"name": "workstation", "account": "op", "account-home": "/home/op"}
-
-// The final PATH this set composes, around whatever the account had: the start entries in module
-// order and then declared order, the account's own, then the end entries.
-const composedPOSIX = `# agent
-export DISABLE_AUTOUPDATER='1'
-# go-toolchain
-export GOPATH='/home/op/go'
-# zsh
-export EDITOR='vim'
-export XDG_CONFIG_HOME='/home/op/.config'
-# zsh
-case ":${PATH}:" in *':/home/op/bin:'*) ;; *) PATH='/home/op/bin'"${PATH:+:${PATH}}" ;; esac
-# go-toolchain
-case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/usr/local/go/bin:'*) ;; *) PATH='/usr/local/go/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/go/bin:'*) ;; *) PATH='/home/op/go/bin'"${PATH:+:${PATH}}" ;; esac
-# agent
-case ":${PATH}:" in *':/opt/agent/bin:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/agent/bin' ;; esac
-# zsh
-case ":${PATH}:" in *':/opt/scripts:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/scripts' ;; esac
-export PATH
-`
-
-const composedSystemd = `# agent
-DISABLE_AUTOUPDATER=1
-# go-toolchain
-GOPATH=/home/op/go
-# zsh
-EDITOR=vim
-XDG_CONFIG_HOME=/home/op/.config
-# go-toolchain, zsh
-PATH=/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin${PATH:+:$PATH}
-# agent, zsh
-PATH=${PATH:+$PATH:}/opt/agent/bin:/opt/scripts
-`
-
-func TestTheEnvironmentRendersForAPOSIXShellByteForByte(t *testing.T) {
-	env, err := environmentOn(contributors(), operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := env.posix(); got != composedPOSIX {
-		t.Fatalf("the POSIX rendering is\n%s\nnot\n%s", got, composedPOSIX)
-	}
-}
-
-func TestTheEnvironmentRendersForTheServiceManagerByteForByte(t *testing.T) {
-	env, err := environmentOn(contributors(), operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := env.systemd(); got != composedSystemd {
-		t.Fatalf("the environment.d rendering is\n%s\nnot\n%s", got, composedSystemd)
-	}
-}
-
-// Sourcing twice changes nothing (ADR 0203 §3): a login shell that starts another reads the file
-// again, and a PATH that grew each time would be the symptom. Run by a real `sh`, because the claim
-// is about what a shell does with the file, not about what the file looks like.
-
-// The environment.d rendering, read by the service manager's own generator where this machine has
-// one — the same reader an account's user manager runs, so the PATH it composes is the one asserted.
-//
-// The generator also reads the machine's own environment.d (/etc, /run, /usr/lib, /usr/local/lib), and
-// no option points it elsewhere: a desktop whose snapd appends its bin directory failed this, on main,
-// for a file the mesh never wrote (novox/hq issue 432). So the generator is run twice, once without the
-// mesh's file, and what the machine's own files make of PATH and set is held out of the verdict.
-//
-// A machine without the generator — the build seat's toolchain image holds no systemd — cannot judge
-// this and says so: there the rendering is held byte for byte by
-// TestTheEnvironmentRendersForTheServiceManagerByteForByte, and this reading only where systemd runs.
-
-// Nothing contributed renders nothing, in both formats — not an empty `export PATH`.
-func TestNoContributionsRenderNothing(t *testing.T) {
-	env, err := environmentOn([]Manifest{{Module: "postgres"}}, operatorFacts)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if env.posix() != "" || env.systemd() != "" {
-		t.Fatalf("an empty environment rendered %q and %q", env.posix(), env.systemd())
-	}
-}
-
-// A ${machine:…} fact the machine does not have is refused naming the module, as a file's is.
-func TestAContributedFactTheMachineLacksIsRefused(t *testing.T) {
-	_, err := environmentOn(contributors(), map[string]string{"name": "server"})
-	if err == nil || !strings.Contains(err.Error(), "go-toolchain sets GOPATH") ||
-		!strings.Contains(err.Error(), "${machine:account-home}") {
-		t.Fatalf("a missing account home was not refused by name: %v", err)
-	}
-}
-
-// ADR 0203 §5: two modules setting one variable are refused, both named — neither silently wins.
-func TestAVariableTwoModulesSetIsRefusedNamingBoth(t *testing.T) {
-	modules := append(contributors(), Manifest{Module: "neovim", Environment: &Environment{
-		Variables: map[string]string{"EDITOR": "nvim"}}})
-	_, err := environmentOn(modules, operatorFacts)
-	if err == nil || err.Error() != "neovim and zsh both set EDITOR on this machine; the account has one "+
-		"environment, so one of them must stop setting it (novox/hq ADR 0203)" {
-		t.Fatalf("a variable set twice was not refused naming both: %v", err)
-	}
-	// And at composition, whether or not the node holds the environment.
-	r := Resolution{Node: "workstation", Account: "op", Modules: modules}
-	if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), "neovim and zsh both set EDITOR") {
-		t.Fatalf("composition accepted a variable set twice: %v", err)
-	}
-}
-
-// shells contributes code for several shells and slots, in no order.
-func shells() []Manifest {
-	return []Manifest{
-		{Module: "zsh-syntax-highlighting", Shell: []ShellCode{
-			{For: "zsh", Slot: "last", Code: "source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"},
-		}},
-		{Module: "powerlevel10k", Shell: []ShellCode{
-			{For: "zsh", Slot: "first", Code: "if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
-				"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n"},
-			{For: "zsh", Slot: "normal", Code: "source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme"},
-			{For: "zsh", Slot: "normal", Code: "[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh"},
-		}},
-		{Module: "zsh-autosuggestions", Shell: []ShellCode{
-			{For: "zsh", Slot: "normal", Code: "source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh"},
-			{For: "bash", Slot: "normal", Code: "echo not for zsh"},
-		}},
-		{Module: "direnv", Shell: []ShellCode{
-			{For: "fish", Slot: "last", Code: "direnv hook fish | source"},
-			{For: "bash", Slot: "last", Code: "eval \"$(direnv hook bash)\""},
-		}},
-	}
-}
-
-// ADR 0204 §3: a slot holds that shell's code only, in module order, each module's pieces in the
-// order it declared them under a line naming it; empty when nothing is contributed.
-func TestShellCodeLandsInItsSlotInModuleOrderForItsShellOnly(t *testing.T) {
-	if got, want := shellCode(shells(), "zsh", "normal"), "# powerlevel10k\n"+
-		"source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme\n"+
-		"[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh\n"+
-		"# zsh-autosuggestions\n"+
-		"source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n"; got != want {
-		t.Fatalf("zsh's normal slot is\n%s\nnot\n%s", got, want)
-	}
-	if got, want := shellCode(shells(), "zsh", "last"), "# zsh-syntax-highlighting\n"+
-		"source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n"; got != want {
-		t.Fatalf("zsh's last slot is\n%s\nnot\n%s", got, want)
-	}
-	if got, want := shellCode(shells(), "bash", "last"), "# direnv\neval \"$(direnv hook bash)\"\n"; got != want {
-		t.Fatalf("bash's last slot is %q, not %q", got, want)
-	}
-	if got := shellCode(shells(), "fish", "first"); got != "" {
-		t.Fatalf("a slot nobody contributed to holds %q", got)
-	}
-}
-
-// The holder of node-login-shell, as WP3's zsh module writes its block, with its own zsh around the
-// slots — which holds `${…}` of the shell's own that no mesh pass may touch either.
-func zshHolder() Manifest {
-	return Manifest{Module: "zsh", Claims: []Claim{{Name: LoginShellSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{
-			{"id": "zshrc", "type": "file", "path": "${machine:account-home}/.zshrc", "content": "" +
-				"${shell:zsh:first}" +
-				"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
-				"${shell:zsh:normal}" +
-				"alias ll='ls -l'\n" +
-				"${shell:zsh:last}"},
-		}}
-}
-
-// The case the ordering exists for: contributed zsh code full of `${…}` reaches the file byte for
-// byte, because the shell's code is placed after every other placeholder pass and in one pass — a
-// scanner for the mesh's placeholders that ran after it would read `${XDG_CACHE_HOME:-…}` and
-// `${(%):-%n}` as the mesh's, or fill a `${machine:…}` some module wrote for its shell to see.
-func TestShellCodeReachesTheHoldersFileByteForByte(t *testing.T) {
-	modules := append(shells(), zshHolder(), Manifest{Module: "sly", Shell: []ShellCode{
-		{For: "zsh", Slot: "last", Code: "echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}"},
-	}})
-	r := Resolution{Node: "workstation", Account: "op", Modules: modules}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var zshrc map[string]any
-	for _, res := range out {
-		if res["id"] == "zsh.zshrc" {
-			zshrc = res
-		}
-	}
-	if zshrc == nil {
-		t.Fatalf("the holder's file was not composed: %v", out)
-	}
-	if zshrc["path"] != "/home/op/.zshrc" {
-		t.Fatalf("the holder's own placeholders were not filled first: %v", zshrc["path"])
-	}
-	want := "# powerlevel10k\n" +
-		"if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
-		"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n" +
-		"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
-		"# powerlevel10k\n" +
-		"source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme\n" +
-		"[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh\n" +
-		"# zsh-autosuggestions\n" +
-		"source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n" +
-		"alias ll='ls -l'\n" +
-		"# sly\n" +
-		"echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}\n" +
-		"# zsh-syntax-highlighting\n" +
-		"source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n"
-	if got := zshrc["content"]; got != want {
-		t.Fatalf("the holder's .zshrc is\n%s\nnot\n%s", got, want)
-	}
-}
-
-// The holder of node-environment places both renderings, and they are the same as rendered alone.
-func TestTheEnvironmentHolderPlacesBothRenderings(t *testing.T) {
-	holder := Manifest{Module: "node-env", Claims: []Claim{{Name: EnvironmentSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{
-			{"id": "posix", "type": "file", "path": "${machine:account-home}/.config/mesh/environment.sh",
-				"content": "# The mesh's environment.\n${environment:posix}"},
-			{"id": "systemd", "type": "file", "path": "${machine:account-home}/.config/environment.d/50-mesh.conf",
-				"content": "${environment:systemd}"},
-		}}
-	r := Resolution{Node: "workstation", Account: "op", Modules: append(contributors(), holder)}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]any{}
-	for _, res := range out {
-		by[res["id"].(string)] = res["content"]
-	}
-	if by["node-env.posix"] != "# The mesh's environment.\n"+composedPOSIX {
-		t.Fatalf("the POSIX file is\n%v", by["node-env.posix"])
-	}
-	if by["node-env.systemd"] != composedSystemd {
-		t.Fatalf("the environment.d file is\n%v", by["node-env.systemd"])
-	}
-}
-
-// ADR 0203 §5 and ADR 0204 §3: a placeholder outside the seat's holder is refused — by the parser,
-// which is what the catalogue check and registration run, and again at composition, in the same words.
-func TestAPlaceholderOutsideTheHolderIsRefused(t *testing.T) {
-	for _, c := range []struct{ content, want string }{
-		{"${environment:posix}", "toolchain's resource rc names ${environment:posix} and toolchain does not claim node-environment"},
-		{"${shell:zsh:normal}", "toolchain's resource rc names ${shell:zsh:normal} and toolchain does not claim node-login-shell"},
-	} {
-		raw := `{"module":"toolchain","resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("the catalogue check accepted %s outside its holder: %v", c.content, err)
-		}
-		m := Manifest{Module: "toolchain", Resources: []map[string]any{
-			{"id": "rc", "type": "file", "path": "/etc/rc", "content": c.content}}}
-		r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}
-		if _, err := r.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("composition accepted %s outside its holder: %v", c.content, err)
-		}
-	}
-}
-
-// A key nobody renders is refused, not left in the file as a literal.
-func TestAnUnknownPlaceholderKeyIsRefused(t *testing.T) {
-	for _, c := range []struct{ content, want string }{
-		{"${environment:foo}", "names ${environment:foo}; the environment is ${environment:posix} or ${environment:systemd}"},
-		{"${shell:zsh:middle}", "names ${shell:zsh:middle}; shell code is ${shell:<shell>:<slot>}"},
-		{"${shell:tcsh:first}", "names ${shell:tcsh:first}; shell code is ${shell:<shell>:<slot>}"},
-		{"${shell:zsh}", "names ${shell:zsh}; shell code is ${shell:<shell>:<slot>}"},
-	} {
-		raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"},{"name":"node-login-shell","scope":"node"}],` +
-			`"resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` + c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s was accepted: %v", c.content, err)
-		}
-	}
-	// And outside a file's content, where nothing could be placed.
-	raw := `{"module":"holder","claims":[{"name":"node-environment","scope":"node"}],` +
-		`"resources":[{"id":"rc","type":"file","path":"/etc/${environment:posix}","content":"x"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil ||
-		!strings.Contains(err.Error(), "names ${environment:posix} in its path; the environment and the shell's code are placed only in a file's content") {
-		t.Errorf("a placeholder in a path was accepted: %v", err)
-	}
-}
-
-// What ADR 0203 §2 allows a contribution to say, refused at parse when it says anything else.
-func TestAMalformedEnvironmentIsRefusedAtParse(t *testing.T) {
-	for _, c := range []struct{ environment, want string }{
-		{`{"variables":{"1X":"a"}}`, `tool sets the variable "1X", which is not a name a shell accepts`},
-		{`{"variables":{"MY-VAR":"a"}}`, `tool sets the variable "MY-VAR", which is not a name a shell accepts`},
-		{`{"variables":{"PATH":"/bin"}}`, `tool sets PATH as a variable; a module adds an entry under environment.path`},
-		{`{"variables":{"A":"$HOME/x"}}`, `tool sets A to "$HOME/x", which holds a $ that is not one of the machine's ${machine:…} facts`},
-		{`{"variables":{"A":"${HOME}/x"}}`, `tool sets A to "${HOME}/x", which holds a $`},
-		{`{"variables":{"A":"it's"}}`, `tool sets A to "it's", which holds a quote`},
-		{`{"variables":{"A":"say \"hi\""}}`, `which holds a quote`},
-		{`{"variables":{"A":"a\\b"}}`, `which holds a backslash`},
-		{`{"variables":{"A":"a\nb"}}`, `which holds a line break`},
-		{`{"variables":{"A":"a\u0000b"}}`, `which holds a NUL`},
-		{`{"path":[{"entry":"","at":"start"}]}`, `tool's PATH entry 1 names no directory`},
-		{`{"path":[{"entry":"/a:/b","at":"start"}]}`, `tool puts "/a:/b" on PATH, which holds a colon`},
-		{`{"path":[{"entry":"$HOME/bin","at":"start"}]}`, `tool puts "$HOME/bin" on PATH, which holds a $`},
-		{`{"path":[{"entry":"/a","at":"middle"}]}`, `tool puts "/a" on PATH at "middle"; an entry goes at "start" or "end"`},
-		{`{"path":[{"entry":"/a"}]}`, `tool puts "/a" on PATH at ""`},
-		{`{"path":[{"entry":"/a","at":"start"},{"entry":"/a","at":"end"}]}`, `tool puts "/a" on PATH twice`},
-		{`{"variables":{"A":"x"},"paths":[]}`, `unknown field "paths"`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"tool","environment":` + c.environment + `}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.environment, c.want, err)
-		}
-	}
-	// What is allowed: a literal, and the machine's own facts.
-	if _, err := ParseManifest([]byte(`{"module":"tool","environment":{` +
-		`"variables":{"GOPATH":"${machine:account-home}/go","DISABLE_X":"1","ANSWER":"a b+c=d"},` +
-		`"path":[{"entry":"${machine:account-home}/go/bin","at":"start"},{"entry":"/opt/x","at":"end"}]}}`)); err != nil {
-		t.Fatalf("a well-formed environment was refused: %v", err)
-	}
-}
-
-func TestMalformedShellCodeIsRefusedAtParse(t *testing.T) {
-	for _, c := range []struct{ shell, want string }{
-		{`[{"for":"tcsh","slot":"normal","code":"x"}]`, `tool's shell code 1 is for "tcsh"; the shells are zsh, bash, fish`},
-		{`[{"for":"zsh","slot":"middle","code":"x"}]`, `tool's shell code 1 goes in the slot "middle"; the slots are first, normal, last`},
-		{`[{"for":"zsh","slot":"last","code":"x"},{"for":"zsh","slot":"last","code":" \n"}]`, `tool's shell code 2 has no code`},
-		{`[{"for":"zsh","slot":"last","code":"x","order":1}]`, `unknown field "order"`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"tool","shell":` + c.shell + `}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.shell, c.want, err)
-		}
-	}
-	// The code itself is never judged: a shell's own `${…}` is not the mesh's.
-	if _, err := ParseManifest([]byte(`{"module":"tool","shell":[{"for":"zsh","slot":"first",` +
-		`"code":"source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\""}]}`)); err != nil {
-		t.Fatalf("shell code was judged as if it were the mesh's: %v", err)
-	}
-}
-
-// ADR 0203 §1 and ADR 0204 §1: both seats are the mesh's own, held once per machine; the login
-// shell's contract is `execute`, described and with a schema an agent can call.
-func TestTheSeatTableCarriesTheEnvironmentAndTheLoginShell(t *testing.T) {
-	env, ok := SeatNamed("node-environment")
-	if !ok || env.Scope != ScopeNode || env.Decision != "novox/hq ADR 0203" ||
-		len(env.Serves)+len(env.Accepts)+len(env.Emits) != 0 || env.Delivers != "" {
-		t.Fatalf("node-environment is not a node seat with no protocol: %+v (defined %v)", env, ok)
-	}
-	shell, ok := SeatNamed("node-login-shell")
-	if !ok || shell.Scope != ScopeNode || shell.Decision != "novox/hq ADR 0204" {
-		t.Fatalf("node-login-shell is not a node seat: %+v (defined %v)", shell, ok)
-	}
-	if len(shell.Serves) != 1 || shell.Serves[0].Name != "execute" || shell.Serves[0].Description == "" {
-		t.Fatalf("the login shell serves %+v, not execute alone", shell.Serves)
-	}
-	props, _ := shell.Serves[0].Input["properties"].(map[string]any)
-	required, _ := shell.Serves[0].Input["required"].([]string)
-	if _, has := props["command"]; !has || len(required) != 1 || required[0] != "command" {
-		t.Fatalf("execute does not require a command: %v", shell.Serves[0].Input)
-	}
-	if _, has := props["timeout_seconds"]; !has {
-		t.Fatalf("execute takes no timeout: %v", props)
-	}
-}
-
-// ADR 0204 §1: the login shell is the mesh's, so no module declares it — neither under the mesh's
-// name nor under the name a module gave it before.
-func TestNoModuleMayDeclareTheLoginShell(t *testing.T) {
-	for _, n := range []string{"login-shell", "node-login-shell", "node-environment"} {
-		raw := `{"module":"zsh","seats":[{"name":"` + n + `","scope":"node","serves":["execute"]}],"tools":["execute"]}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil {
-			t.Errorf("a module declaring %q was accepted", n)
-		}
-	}
-	got := strings.Join(declaredSeatProblems(Manifest{Module: "zsh",
-		DefinesSeats: []SeatDeclaration{{Name: "login-shell", Scope: ScopeNode}}}), "; ")
-	if !strings.Contains(got, `zsh declares a seat named "login-shell"; the login shell is the mesh's own seat node-login-shell`) {
-		t.Fatalf("declaring login-shell was not refused by name: %q", got)
-	}
-	// And a shell module claiming the mesh's seat, serving execute, is what the seat is for.
-	m, err := ParseManifest([]byte(`{"module":"zsh","tools":["execute"],` +
-		`"claims":[{"name":"node-login-shell","scope":"node"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := CanHold(m, Seat{Name: LoginShellSeat, Scope: ScopeNode, Serves: loginShellVerbs()}); err != nil {
-		t.Fatalf("a shell module claiming the seat cannot hold it: %v", err)
-	}
-}
diff --git a/internal/catalogue/environment_items_test.go b/internal/catalogue/environment_items_test.go
deleted file mode 100644
index cd4c93bf..00000000
--- a/internal/catalogue/environment_items_test.go
+++ /dev/null
@@ -1,165 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// The session environment is a collection of typed items (design 57 L3, issue 795): a variable is an item with
-// kind=variable and name=<NAME>, a PATH entry one with kind=path and at=start|end, each a template whose text is the
-// value or the entry. Where node-env is not handed the controller renders the items as the old form was rendered;
-// where it is, it names the collection for the client, which fills the same files (mesh-catalog's provisioner client
-// holds that half against the same golden files). testdata/environment holds the environment of the catalogue's five
-// contributors as the old form composed it, with all five and with zsh alone.
-
-type envDecl struct{ module, item, name, value string }
-
-func environmentOfTheCatalogue() []envDecl {
-	return []envDecl{
-		{"adwaita", "gtk-theme", "GTK_THEME", "Adwaita:dark"},
-		{"adwaita", "gtk2-rc-files", "GTK2_RC_FILES", "/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc"},
-		{"adwaita", "qt-qpa-platformtheme", "QT_QPA_PLATFORMTHEME", "qt6ct"},
-		{"adwaita", "qt-style-override", "QT_STYLE_OVERRIDE", "Fusion"},
-		{"adwaita", "qt-select", "QT_SELECT", "6"},
-		{"adwaita", "xcursor-theme", "XCURSOR_THEME", "Adwaita"},
-		{"adwaita", "xcursor-size", "XCURSOR_SIZE", "24"},
-		{"clipmenu", "cm-selections", "CM_SELECTIONS", "clipboard"},
-		{"clipmenu", "cm-max-clips", "CM_MAX_CLIPS", "500"},
-		{"clipmenu", "cm-histlength", "CM_HISTLENGTH", "15"},
-		{"i3", "xdg-current-desktop", "XDG_CURRENT_DESKTOP", "i3"},
-		{"i3", "xdg-session-desktop", "XDG_SESSION_DESKTOP", "i3"},
-		{"xterm", "terminal", "TERMINAL", "xterm"},
-		{"zsh", "editor", "EDITOR", "vim"},
-		{"zsh", "visual", "VISUAL", "vim"},
-		{"zsh", "xdg-config-home", "XDG_CONFIG_HOME", "${machine:account-home}/.config"},
-		{"zsh", "path-local-bin", "path:10", "${machine:account-home}/.local/bin"},
-		{"zsh", "path-scripts", "path:20", "${machine:account-home}/scripts"},
-		{"zsh", "path-scripts-bin", "path:30", "${machine:account-home}/scripts/bin"},
-	}
-}
-
-const environmentCollector = `{"module":"node-env","version":"1","moved":true,
-  "claims":[{"name":"node-environment","scope":"node"}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"posix","type":"file","path":"/home/op/.config/mesh/environment.sh","template":"files/posix"},
-               {"id":"systemd","type":"file","path":"/home/op/.config/environment.d/50-mesh.conf","template":"files/systemd"}]}`
-
-// nodeEnvWith is node-env, its file placing the environment as plan says, with the declared contributors' items.
-func nodeEnvWith(t *testing.T, decls []envDecl, plan string) Resolution {
-	t.Helper()
-	collector := held(t, environmentCollector, builtWith("node-env", map[string]string{
-		"posix": "# header\n" + plan, "systemd": "${environment:systemd}"}))
-	mods := []Manifest{collector}
-	order := []string{"node-env"}
-	byModule := map[string][]envDecl{}
-	var modules []string
-	for _, d := range decls {
-		if byModule[d.module] == nil {
-			modules = append(modules, d.module)
-		}
-		byModule[d.module] = append(byModule[d.module], d)
-	}
-	for _, name := range modules {
-		var items []string
-		texts := map[string]string{}
-		for _, d := range byModule[name] {
-			attrs := fmt.Sprintf(`{"kind":"variable","name":%q}`, d.name)
-			if order, isPath := strings.CutPrefix(d.name, "path:"); isPath {
-				attrs = fmt.Sprintf(`{"kind":"path","at":"start","order":%q}`, order)
-			}
-			items = append(items, fmt.Sprintf(`{"collection":"environment","name":%q,"attributes":%s,"template":"files/env-%s"}`,
-				d.item, attrs, d.item))
-			texts["env-"+d.item] = d.value + "\n"
-		}
-		raw := fmt.Sprintf(`{"module":%q,"version":"1","moved":true,"items":[%s],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`, name, strings.Join(items, ","))
-		mods = append(mods, held(t, raw, builtWith(name, texts)))
-		order = append(order, name)
-	}
-	r, err := Resolve(shelf(mods...), order, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	return r
-}
-
-func TestTheEnvironmentOfTheCatalogueIsTheSameHandedOrNot(t *testing.T) {
-	read := func(name string) string {
-		b, err := os.ReadFile(filepath.Join("testdata", "environment", name))
-		if err != nil {
-			t.Fatal(err)
-		}
-		return string(b)
-	}
-	for name, only := range map[string]string{"all": "", "zsh": "zsh"} {
-		var decls []envDecl
-		for _, d := range environmentOfTheCatalogue() {
-			if only == "" || d.module == only {
-				decls = append(decls, d)
-			}
-		}
-		// Named as the collector names it, and as the old placeholder does.
-		for _, plan := range []string{"${collected:environment:posix}", "${environment:posix}"} {
-			r := nodeEnvWith(t, decls, plan)
-			// Not handed: the controller renders each moved contributor's items as the old form was rendered.
-			if got, want := composedFile(t, r, "node-env.posix"), "# header\n"+read(name+".posix"); got != want {
-				t.Errorf("%s, %s, not handed, the POSIX file is\n%s\nwant\n%s", name, plan, got, want)
-			}
-			if got, want := composedFile(t, r, "node-env.systemd"), read(name+".systemd"); got != want {
-				t.Errorf("%s, %s, not handed, the environment.d file is\n%s\nwant\n%s", name, plan, got, want)
-			}
-			// Handed: one collection, named for the client; each contributor's plan names its items.
-			c, _ := composeWith(t, r, handingTo("store:5000"))
-			if got := c.Plans["node-env"].Collections; !reflect.DeepEqual(got, []PlanCollection{{Name: "environment", Comment: "#"}}) {
-				t.Errorf("%s: the plan collects %+v", name, got)
-			}
-			items, got := len(decls), 0
-			for m := range c.Plans {
-				got += len(c.Plans[m].Items)
-			}
-			if got != items {
-				t.Errorf("%s: the plans name %d items, want %d", name, got, items)
-			}
-		}
-	}
-}
-
-func TestAnEnvironmentItemIsTypedAndNamesWhatItNeeds(t *testing.T) {
-	item := func(attrs map[string]string) []string {
-		return environmentItemProblems("x", Item{Collection: "environment", Attributes: attrs})
-	}
-	for _, ok := range []map[string]string{
-		{"kind": "variable", "name": "GTK_THEME"},
-		{"kind": "path", "at": "end", "order": "10"},
-	} {
-		if p := item(ok); len(p) != 0 {
-			t.Errorf("%v is refused: %v", ok, p)
-		}
-	}
-	for _, bad := range []map[string]string{
-		nil, {"kind": "other"}, {"kind": "variable"}, {"kind": "variable", "name": "PATH"},
-		{"kind": "path"}, {"kind": "path", "at": "middle"}, {"kind": "path", "at": "start", "name": "X"},
-		{"kind": "variable", "name": "A", "color": "red"},
-	} {
-		if p := item(bad); len(p) == 0 {
-			t.Errorf("%v is taken", bad)
-		}
-	}
-	if !attributeFits("environment", "name", "GTK_THEME") || attributeFits("shell:zsh:normal", "name", "GTK_THEME") ||
-		attributeFits("environment", "kind", "Variable") {
-		t.Error("an upper-case name is the environment's name alone")
-	}
-	// A module that sets a variable twice, in two modules, is refused as the old form refused it.
-	a := Manifest{Module: "a", Items: []Item{{Collection: "environment", Content: "1\n",
-		Attributes: map[string]string{"kind": "variable", "name": "X"}}}}
-	b := Manifest{Module: "b", Items: []Item{{Collection: "environment", Content: "2\n",
-		Attributes: map[string]string{"kind": "variable", "name": "X"}}}}
-	if err := variablesSetOnce([]Manifest{a, b}); err == nil || !strings.Contains(err.Error(), "both set X") {
-		t.Errorf("two modules setting X: %v", err)
-	}
-}
diff --git a/internal/catalogue/files_test.go b/internal/catalogue/files_test.go
deleted file mode 100644
index 63f69233..00000000
--- a/internal/catalogue/files_test.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// issue 900, novox/hq ADR 0394 §1: node-files is a node seat whose verbs say the commands they replace.
-func TestNodeFilesIsANodeSeatWithEveryVerbOfADR0394(t *testing.T) {
-	s, ok := SeatNamed(FilesSeat)
-	if !ok {
-		t.Fatalf("the mesh defines no seat %s", FilesSeat)
-	}
-	if s.Scope != ScopeNode || s.Delivers != "" || !strings.Contains(s.Decision, "ADR 0394") {
-		t.Errorf("%s: scope %q, delivers %q, decision %q", FilesSeat, s.Scope, s.Delivers, s.Decision)
-	}
-	have := map[string]bool{}
-	replaced := map[string]string{}
-	for _, v := range s.Serves {
-		have[v.Name] = true
-		if v.Optional {
-			t.Errorf("%s.%s is optional", FilesSeat, v.Name)
-		}
-		if len(v.Replaces) == 0 {
-			t.Errorf("%s.%s says nothing it replaces", FilesSeat, v.Name)
-		}
-		for _, c := range v.Replaces {
-			replaced[c] = v.Name
-		}
-	}
-	for _, name := range []string{"stat", "readlink", "list", "read", "search", "account", "write", "copy", "move",
-		"delete", "mkdir", "chmod", "chown", "trash", "restore"} {
-		if !have[name] {
-			t.Errorf("%s serves no verb %s", FilesSeat, name)
-		}
-	}
-	for command, verb := range map[string]string{"cat": "read", "tee": "write", "cp": "copy", "mv": "move",
-		"rm": "delete", "mkdir -p": "mkdir", "chmod": "chmod", "chgrp": "chown"} {
-		if replaced[command] != verb {
-			t.Errorf("%q is replaced by %q, want %s.%s", command, replaced[command], FilesSeat, verb)
-		}
-	}
-}
-
-// issue 900, ADR 0394 §2: a holder of node-files runs as the tool runner's account, so it declares no runs-as.
-func TestAHolderOfNodeFilesDeclaringRunsAsIsRefused(t *testing.T) {
-	p := FilesHolderProblems(Manifest{Module: "files", RunsAs: "mesh-files", Claims: []Claim{{Name: FilesSeat}}})
-	if len(p) != 1 || !strings.Contains(p[0], "0394") || !strings.Contains(p[0], "runs-as") {
-		t.Errorf("a holder declaring runs-as was not refused: %v", p)
-	}
-	if p := FilesHolderProblems(Manifest{Module: "files", Claims: []Claim{{Name: FilesSeat}}}); len(p) != 0 {
-		t.Errorf("a holder declaring none was refused: %v", p)
-	}
-	if p := FilesHolderProblems(Manifest{Module: "other", RunsAs: "x"}); len(p) != 0 {
-		t.Errorf("a non-holder was judged: %v", p)
-	}
-}
-
-// issue 900, ADR 0394 §4: the holder is told the secret places and the paths modules own on its node.
-func TestTheHolderOfNodeFilesIsToldSecretPlacesAndOwnedPaths(t *testing.T) {
-	files := Manifest{Module: "files", Version: "1", Claims: []Claim{{Name: FilesSeat}},
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/files/broker"}}}
-	host := Manifest{Module: "hostnames", Version: "1", Claims: []Claim{{Name: "node-hostname"}},
-		Resources: []map[string]any{{"id": "hosts", "type": "file", "path": "/etc/hosts"}}}
-	app := Manifest{Module: "app", Version: "1",
-		Resources: []map[string]any{{"id": "conf", "type": "file", "path": "/etc/app/app.conf"}}}
-	r := Resolution{Node: "anchor", Modules: []Manifest{files, host, app}}
-	words, err := r.filesWords(files, nil, Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var places []string
-	if err := json.Unmarshal([]byte(words[ReadsSecretPlaces]), &places); err != nil || len(places) == 0 {
-		t.Errorf("no secret places: %v %v", err, words)
-	}
-	var owned map[string]string
-	if err := json.Unmarshal([]byte(words[FilesOwnedPaths]), &owned); err != nil {
-		t.Fatalf("no owned paths: %v (%v)", err, words)
-	}
-	if !strings.HasPrefix(owned["/etc/hosts"], "hostnames") {
-		t.Errorf("/etc/hosts is owned by %q, want hostnames", owned["/etc/hosts"])
-	}
-	if !strings.HasPrefix(owned["/etc/app/app.conf"], "app") {
-		t.Errorf("a placed file is owned by %q, want app", owned["/etc/app/app.conf"])
-	}
-	if w, _ := r.filesWords(app, nil, Rendering{}); w[FilesOwnedPaths] != "" {
-		t.Error("a module not holding node-files is told the owned paths")
-	}
-}
-
-// issue 900: restore, like every write verb, takes a reason and an override.
-func TestNodeFilesRestoreTakesIdAndReason(t *testing.T) {
-	s, _ := SeatNamed(FilesSeat)
-	for _, v := range s.Serves {
-		if v.Name != "restore" {
-			continue
-		}
-		props, _ := v.Input["properties"].(map[string]any)
-		for _, p := range []string{"id", "reason", "override"} {
-			if _, has := props[p]; !has {
-				t.Errorf("restore has no input %s", p)
-			}
-		}
-		if req, _ := v.Input["required"].([]string); strings.Join(req, ",") != "id,reason" {
-			t.Errorf("restore requires %v, want id and reason", req)
-		}
-		return
-	}
-	t.Error("no restore verb")
-}
diff --git a/internal/catalogue/filtering_foundation_test.go b/internal/catalogue/filtering_foundation_test.go
deleted file mode 100644
index 60056513..00000000
--- a/internal/catalogue/filtering_foundation_test.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The mesh's own ports survive a ruleset derived from modules that do not mention them.
-//
-// **The firewall is computed from what modules declare they listen on, and the foundation is not a
-// module** (novox/hq 04-ISSUES/052). So the broker's port — the one every machine dials to enrol
-// and to receive every declaration it is ever sent — was absent from every ruleset the mesh ever
-// generated, and nothing caught it: a mesh of one never dials its own broker across the network,
-// so the ruleset looks complete right up until a second machine tries to join and is refused by
-// the packet filter, during enrolment, before the mesh can report anything about it.
-func TestTheBrokersPortIsOpenedThoughNoModuleDeclaresIt(t *testing.T) {
-	const brokerPort = 5671
-
-	// A machine on the private network, with one ordinary module rule, and nothing that mentions
-	// the broker — which is every machine.
-	rules := []Rule{{Port: 8080, From: FromMesh, Because: []string{"some-module"}}}
-	out := AsNftables(rules, []string{"10.42.0.1"}, false, []int{brokerPort}, nil, "mesh0")
-
-	if !strings.Contains(out, "tcp dport 5671 accept") {
-		t.Fatalf("the broker's port is not opened, so no machine could enrol:\n%s", out)
-	}
-
-	// From anywhere, deliberately: a node enrols BEFORE it has an address on the private network,
-	// so a rule narrowed to that network would close the door being knocked on.
-	for _, line := range strings.Split(out, "\n") {
-		if strings.Contains(line, "5671") && strings.Contains(line, "saddr") {
-			t.Fatalf("the broker's port is narrowed to the private network, which a machine that "+
-				"has not yet enrolled is not on:\n%s", line)
-		}
-	}
-
-	// And forwarded, not only accepted on input: the broker is a published container port, so a
-	// cross-node dial is redirected and forwarded and never reaches the input chain. Without this
-	// a joined node reaches the broker only until its first connection's conntrack entry drops —
-	// which a broker restart (adopting the foundation's broker) causes — and then never receives
-	// another declaration (novox/hq issue 063).
-	if !strings.Contains(out, "ct original proto-dst 5671 accept") {
-		t.Fatalf("the broker's port is not forwarded, so a DNAT'd broker is unreachable "+
-			"cross-node after it restarts:\n%s", out)
-	}
-}
-
-// And a mesh that was never told about a broker still gets a ruleset, rather than an empty one or
-// a panic. A control plane in that state cannot issue tokens either, which is where it surfaces.
-func TestNoBrokerMeansNoFoundationRuleRatherThanNoRuleset(t *testing.T) {
-	out := AsNftables(nil, []string{"10.42.0.1"}, false, nil, nil, "mesh0")
-	if !strings.Contains(out, "table inet mesh") {
-		t.Fatalf("no ruleset at all:\n%s", out)
-	}
-	if strings.Contains(out, "never derived, never closed\n\t\ttcp dport") {
-		t.Fatalf("a foundation rule was written for a mesh with no broker:\n%s", out)
-	}
-}
diff --git a/internal/catalogue/filtering_test.go b/internal/catalogue/filtering_test.go
deleted file mode 100644
index 11cb514d..00000000
--- a/internal/catalogue/filtering_test.go
+++ /dev/null
@@ -1,920 +0,0 @@
-package catalogue
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// A manifest key nothing reads is worse than a key that is refused: five HAL manifests carried
-// `scope:`, which read as a restriction and restricted nothing (novox/hq 04-ISSUES/003). The host's
-// declaration parser has always refused unknown keys; manifests never did.
-func TestAManifestKeyNothingReadsIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"web","scope":"mesh"}`))
-	if err == nil {
-		t.Fatal("a manifest with a key nothing reads was accepted, which is how scope: survived")
-	}
-	if !strings.Contains(err.Error(), "scope") {
-		t.Fatalf("refused without naming the key, which leaves the author guessing: %v", err)
-	}
-}
-
-// The same discipline must not refuse a manifest that is merely ordinary.
-func TestAnOrdinaryManifestIsStillAccepted(t *testing.T) {
-	m, err := ParseManifest([]byte(
-		`{"module":"web","listens":[{"port":443,"from":"anywhere","why":"the site"}]}`))
-	if err != nil {
-		t.Fatalf("an ordinary manifest was refused: %v", err)
-	}
-	if len(m.Listens) != 1 || m.Listens[0].At() != "tcp" {
-		t.Fatalf("listens did not survive parsing: %+v", m.Listens)
-	}
-}
-
-// A rule with no source is open, and must say so rather than appear to restrict something.
-func TestAPortWithNoSourceIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"web","listens":[{"port":443}]}`))
-	if err == nil {
-		t.Fatal("a port that never said who may reach it was accepted; it reads as a restriction")
-	}
-	if !strings.Contains(err.Error(), "from where") {
-		t.Fatalf("refused without saying what is missing: %v", err)
-	}
-}
-
-func TestASourceNobodyDefinedIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"web","listens":[{"port":443,"from":"lan"}]}`))
-	if err == nil {
-		t.Fatal("a source the mesh cannot render was accepted, and would be silently dropped")
-	}
-}
-
-// The derivation is over the whole node, not one module.
-func TestTheRuleSetIsEveryAssignedModulesPorts(t *testing.T) {
-	r := Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-	}}
-	rules := mustFilter(t, r, nil)
-	if len(rules) != 2 {
-		t.Fatalf("a node's rule set lost a module's ports: %+v", rules)
-	}
-	if rules[0].Port != 443 || rules[1].Port != 5432 {
-		t.Fatalf("rules are not in a stable order, so every diff is unreadable: %+v", rules)
-	}
-}
-
-// Every rule names what caused it, and both causes survive.
-func TestTwoModulesWantingOnePortAreBothNamed(t *testing.T) {
-	r := Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere, Why: "the site"}}},
-		{Module: "board", Listens: []Listening{{Port: 443, From: FromEverywhere, Why: "the board"}}},
-	}}
-	rules := mustFilter(t, r, nil)
-	if len(rules) != 1 {
-		t.Fatalf("one port became %d rules", len(rules))
-	}
-	if len(rules[0].Because) != 2 {
-		t.Fatalf("a module that wanted this port open is not named: %+v", rules[0])
-	}
-	// The consequence, which is the reason this matters: removing web must not read as closing 443.
-	nft := AsNftables(rules, nil, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "web") || !strings.Contains(nft, "board") {
-		t.Fatalf("the rendered rule set does not name both sources:\n%s", nft)
-	}
-}
-
-// Widening, and only widening.
-func TestAPortOpenToEveryoneIsNotAlsoRestrictedToTheMesh(t *testing.T) {
-	r := Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-		{Module: "board", Listens: []Listening{{Port: 443, From: FromMesh}}},
-	}}
-	rules := mustFilter(t, r, nil)
-	if len(rules) != 1 {
-		t.Fatalf("the same port was rendered twice, once restricting nothing: %+v", rules)
-	}
-	if rules[0].From != FromEverywhere {
-		t.Fatalf("the narrower rule won, which closes a port a module asked to open: %+v", rules[0])
-	}
-	if len(rules[0].Because) != 2 {
-		t.Fatalf("the covered module was dropped along with its rule: %+v", rules[0])
-	}
-}
-
-// What is not declared is closed.
-func TestWhatNoModuleDeclaredIsClosed(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}, nil), []string{"198.51.100.2"}, false, nil, nil, "mesh0")
-	// Naming the chain, not just the policy: the forward chain drops too, and an assertion on
-	// "policy drop" alone passes while the input chain accepts everything. It did, once, here.
-	if !strings.Contains(nft, "type filter hook input priority filter; policy drop;") {
-		t.Fatalf("the input chain does not drop by default, so nothing is filtered:\n%s", nft)
-	}
-	// Some port nothing asked for. **Not 22**, which this used to use: ssh is now the one line in
-	// the chain that nothing derives, because a mesh that has been assigned almost nothing computes
-	// a firewall that shuts the port used to fix it (novox/hq issue 047).
-	if strings.Contains(nft, "dport 9999") {
-		t.Fatalf("a port no module declared was opened:\n%s", nft)
-	}
-	// Dropping by default must not mean unreachable: the node's own outbound link to the broker
-	// is the one connection the whole mesh runs on, and it is a reply to something it started.
-	if !strings.Contains(nft, "ct state established,related accept") {
-		t.Fatalf("a node applying this would lose its own link to the mesh:\n%s", nft)
-	}
-	if !strings.Contains(nft, "iif lo accept") {
-		t.Fatalf("loopback is filtered, which breaks everything on the machine:\n%s", nft)
-	}
-}
-
-// Loading it twice must be the same as loading it once, and must not disturb anything else.
-//
-// `flush ruleset` would do the first and not the second: it empties every table on the machine,
-// including the ones the container runtime writes for its bridges.
-func TestReloadingReplacesOnlyTheMeshsOwnRules(t *testing.T) {
-	nft := AsNftables(nil, nil, false, nil, nil, "mesh0")
-	if strings.Contains(nft, "flush ruleset") {
-		t.Fatalf("loading the rule set empties every table on the machine:\n%s", nft)
-	}
-	if !strings.Contains(nft, "delete table inet mesh") {
-		t.Fatalf("loading it a second time would add to what is there rather than replace it:\n%s", nft)
-	}
-	// The delete must not fail on a machine that has never loaded one, or the service does not
-	// start and the machine filters nothing while reporting a configuration error.
-	if !strings.Contains(nft, "table inet mesh {}\ndelete table inet mesh") {
-		t.Fatalf("the delete has nothing to delete on a machine loading this for the first time:\n%s", nft)
-	}
-}
-
-// The rule set governs what is forwarded too, or it does not govern container ports at all.
-//
-// **This reverses an earlier decision, and keeps the thing that decision was protecting.** There was
-// no forward chain, on the reasoning that dropping there stops container traffic the runtime
-// allowed — every container on the node, control plane included. That much is true. What it missed
-// is that a published port is redirected and then forwarded, so it never reaches the input chain,
-// and a firewall without a forward chain is silent about exactly the ports worth protecting
-// (novox/hq issue 047).
-//
-// So the chain exists and denies by default, and the runtime's own networks are allowed explicitly
-// — which is how the system being replaced has been doing it on these machines for months.
-func TestWhatIsForwardedIsGovernedToo(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "hook forward priority filter; policy drop") {
-		t.Fatalf("forwarded traffic is not governed, so container ports are open:\n%s", nft)
-	}
-}
-
-// And this machine's own guests keep working, which is the whole reason the chain was left out
-// before — by not being mentioned (novox/hq ADR 0140).
-//
-// It used to be done by naming the address ranges they sit on: two fixed here and the rest recorded
-// per machine. That list broke a workstation's containers at a flip and could not be made correct,
-// because a range describes one machine and cannot tell a network the mesh made from one a
-// predecessor left behind. What replaced it is a single line about the links traffic arrives on.
-func TestThisMachinesOwnGuestsKeepWorkingWithoutBeingNamed(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, []string{"eth0"}, "mesh0")
-	if !strings.Contains(nft, `iifname != { "eth0", "mesh0" } accept`) {
-		t.Fatalf("what did not arrive from outside is not accepted, so this machine's own guests "+
-			"reach nothing:\n%s", nft)
-	}
-}
-
-// No address of a machine's own networks appears anywhere in a rendered filter.
-//
-// This is the assertion that fails against the previous behaviour, and it is why it is written on
-// the text rather than on an outcome: the two ranges were a constant in this file, so nothing but
-// reading the output catches one creeping back in.
-func TestNoNetworkOfTheMachinesOwnIsNamed(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, []string{"eth0"}, "mesh0")
-	for _, gone := range []string{"172.16.0.0/12", "192.168.128.0/17", "saddr 192.168", "saddr 172."} {
-		if strings.Contains(nft, gone) {
-			t.Fatalf("%q is named, and a range describes one machine and goes stale in silence:\n%s",
-				gone, nft)
-		}
-	}
-}
-
-// **The tunnel is constrained, not treated as inside.**
-//
-// Accepting everything arriving over the private network would make a port nothing declares
-// reachable from every machine in the mesh — the derivation abandoned, and a rule that reads as a
-// restriction while restricting nothing. So the tunnel is named beside the outward links, and
-// traffic arriving on it meets the declared rules like anything else.
-func TestTheTunnelIsConstrainedLikeAnOutwardLink(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, []string{"eth0"}, "mesh0")
-	line := `iifname != { "eth0", "mesh0" } accept`
-	if !strings.Contains(nft, line) {
-		t.Fatalf("the tunnel is not constrained, so an undeclared port is reachable from any "+
-			"machine in the mesh:\n%s", nft)
-	}
-}
-
-// A machine with two links facing outside has both constrained. Asserted on the one line, because a
-// rule covering one and not the other would leave a machine filtering half of what reaches it.
-func TestEveryOutwardLinkIsConstrained(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, []string{"eth0", "wlan0"}, "mesh0")
-	if !strings.Contains(nft, `iifname != { "eth0", "wlan0", "mesh0" } accept`) {
-		t.Fatalf("not every outward link is constrained:\n%s", nft)
-	}
-}
-
-// A guest asks its host for an address and for names, and those two arrive at the input chain. Asked
-// for by the link they arrive on, so a resolver bound anywhere but an outward link keeps answering.
-func TestGuestsMayAskTheirHostForAnAddressAndNames(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, []string{"eth0"}, "mesh0")
-	for _, want := range []string{
-		`iifname != { "eth0", "mesh0" } udp dport { 53, 67 } accept`,
-		`iifname != { "eth0", "mesh0" } tcp dport 53 accept`,
-	} {
-		if !strings.Contains(nft, want) {
-			t.Fatalf("a guest cannot ask its host for an address or a name, which is not a closed "+
-				"port but a network that does not work:\n%s", nft)
-		}
-	}
-}
-
-// With no link named at all the chain denies rather than rendering an empty set, which nftables
-// refuses — and a rule set that does not load is a machine filtering nothing while its unit reports
-// success. Composing a declaration for such a machine is refused upstream; this is the floor.
-func TestNoLinkNamedRendersNoCatchAllRatherThanAnEmptySet(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, false, nil, nil, "")
-	if strings.Contains(nft, "{  }") || strings.Contains(nft, "iifname != {}") {
-		t.Fatalf("an empty set is rendered, which nftables refuses:\n%s", nft)
-	}
-	if !strings.Contains(nft, "hook forward priority filter; policy drop") {
-		t.Fatalf("the forward chain does not deny:\n%s", nft)
-	}
-}
-
-// A machine that has not said which links face outside is sent no filter, and the refusal names the
-// module that would have loaded it so the reader knows what is being withheld.
-func TestAMachineThatNamedNoOutwardLinkIsSentNoFilter(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "nftables", Filtering: &Filtering{Into: "/etc/mesh/filter.nft"}},
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}
-	_, err := r.Declaration(Rendering{Mesh: []string{"198.51.100.2"}, TunnelInterface: "mesh0"})
-	if err == nil {
-		t.Fatal("a machine that named no outward link was sent a filter written around none")
-	}
-	for _, want := range []string{"anchor", "nftables", "face outside"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not say %q: %v", want, err)
-		}
-	}
-}
-
-// And a machine that names none but loads no filter is not refused: there is nothing to write.
-func TestAMachineWithNoFilterModuleIsNotRefused(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}
-	if _, err := r.Declaration(Rendering{Mesh: []string{"198.51.100.2"}}); err != nil {
-		t.Fatalf("a machine that loads no filter was refused one: %v", err)
-	}
-}
-
-// A published port is matched by what the client asked for, not by where the packet ends up.
-//
-// The runtime rewrites the destination before this chain sees it, so a rule naming the published
-// port would match nothing and the port would stay shut while reporting itself open.
-func TestAPublishedPortIsMatchedByWhatWasAskedFor(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 8080, From: FromEverywhere}}},
-	}}, nil), []string{"198.51.100.2"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "ct original proto-dst 8080 accept") {
-		t.Fatalf("the forwarded rule does not match the port a client asked for:\n%s", nft)
-	}
-}
-
-// And a mesh-scoped port stays mesh-scoped when it is reached through the runtime.
-func TestAMeshScopedPortIsMeshScopedWhenForwarded(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-	}}, nil), []string{"198.51.100.2"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "ip saddr { 198.51.100.2 } ct original proto-dst 5432 accept") {
-		t.Fatalf("a mesh-only port is reachable from anywhere once forwarded:\n%s", nft)
-	}
-}
-
-// "From the mesh" is the addresses the mesh actually has.
-func TestFromTheMeshIsTheNodesTheMeshKnows(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-	}}, nil), []string{"198.51.100.2", "198.51.100.3"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "ip saddr { 198.51.100.2, 198.51.100.3 } tcp dport 5432 accept") {
-		t.Fatalf("a mesh-scoped port was not restricted to the mesh's addresses:\n%s", nft)
-	}
-}
-
-// The case that must not be widened silently.
-func TestAMeshPortOnANodeWithNoMeshIsClosedAndSaysSo(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-	}}, nil), nil, false, nil, nil, "mesh0")
-	if strings.Contains(nft, "dport 5432 accept") {
-		t.Fatalf("a port meant for the mesh was opened to everything:\n%s", nft)
-	}
-	if !strings.Contains(nft, "closed") {
-		t.Fatalf("it was closed silently, which is a fault nobody can find:\n%s", nft)
-	}
-}
-
-// A port bound for something else on the same machine must not reach the network.
-func TestAMachineScopedPortIsNotOpened(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "cache", Listens: []Listening{{Port: 6379, From: FromMachine}}},
-	}}, nil), []string{"198.51.100.2"}, false, nil, nil, "mesh0")
-	if strings.Contains(nft, "dport 6379 accept") {
-		t.Fatalf("a port for this machine only was opened to the network:\n%s", nft)
-	}
-}
-
-// The rule set is the machine's, not the asking module's.
-func TestTheModuleAskingForTheRuleSetGetsEveryModulesPorts(t *testing.T) {
-	r := Resolution{Modules: []Manifest{
-		{Module: "firewall", Filtering: &Filtering{Into: "/etc/mesh/filter.nft"}},
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}
-	out, err := r.Declaration(Rendering{Mesh: []string{"198.51.100.2"},
-		OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"})
-	if err != nil {
-		t.Fatalf("declaration: %v", err)
-	}
-	var content string
-	for _, res := range out {
-		if res["path"] == "/etc/mesh/filter.nft" {
-			content, _ = res["content"].(string)
-		}
-	}
-	if content == "" {
-		t.Fatal("the module that asked for the rule set did not receive one")
-	}
-	if !strings.Contains(content, "dport 443 accept") {
-		t.Fatalf("the rule set holds only the asking module's ports:\n%s", content)
-	}
-}
-
-func TestAskingForTheRuleSetWithNowhereToPutItIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"firewall","filtering":{"into":""}}`))
-	if err == nil {
-		t.Fatal("a module asked for the rule set and named no path; it would receive nothing")
-	}
-}
-
-// nftables matches the two address families separately, and one set holding both is a syntax
-// error — so the file fails to load, the service reports a fault, and the machine filters nothing.
-func TestAMeshOnBothAddressFamiliesRendersBoth(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-	}}, nil), []string{"198.51.100.2", "2001:db8::2"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "ip saddr { 198.51.100.2 } tcp dport 5432 accept") {
-		t.Fatalf("the machines with v4 addresses were dropped:\n%s", nft)
-	}
-	if !strings.Contains(nft, "ip6 saddr { 2001:db8::2 } tcp dport 5432 accept") {
-		t.Fatalf("the machines with v6 addresses were dropped:\n%s", nft)
-	}
-	// And never in one set, which is the syntax error this exists to avoid.
-	if strings.Contains(nft, "198.51.100.2, 2001:db8::2") {
-		t.Fatalf("both families are in one set, so the file will not load:\n%s", nft)
-	}
-}
-
-// The host does not sort, so the order the mesh writes is the order a machine applies.
-//
-// A module's service or container routinely depends on a file the mesh computed — a certificate,
-// a credential, a rule set. Written after the service, the service is applied first, fails, and
-// the next reconcile fixes it. A fault that repairs itself on the second attempt is worse than one
-// that does not: what gets remembered is that it works.
-func TestWhatTheMeshComputesIsAppliedBeforeWhatTheModuleDeclared(t *testing.T) {
-	r := Resolution{Modules: []Manifest{{
-		Module:    "firewall",
-		Filtering: &Filtering{Into: "/etc/nftables.conf"},
-		Resources: []map[string]any{
-			{"id": "load", "type": "service", "unit": "nftables.service", "state": "running",
-				"restart-on": []any{"filtering"}},
-		},
-	}}}
-	out, err := r.Declaration(Rendering{Mesh: []string{"198.51.100.2"},
-		OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"})
-	if err != nil {
-		t.Fatalf("declaration: %v", err)
-	}
-	var order []string
-	for _, res := range out {
-		order = append(order, fmt.Sprint(res["id"]))
-	}
-	if len(order) != 2 {
-		t.Fatalf("expected the rule set and the service, got %v", order)
-	}
-	if order[0] != "firewall.filtering" {
-		t.Fatalf("the service is applied before the file it reflects: %v", order)
-	}
-}
-
-// The same, for a module whose resources are computed elsewhere — that branch replaces the
-// module's resources wholesale, and merging in the wrong place would throw away its credentials.
-func TestAComputedModuleStillGetsWhatTheMeshMadeForIt(t *testing.T) {
-	r := Resolution{Modules: []Manifest{{
-		Module: "networking", Computed: "mesh-network",
-		OwnSecrets: OwnSecrets{"key": {Path: "/var/lib/mesh/key"}},
-	}}}
-	out, err := r.Declaration(Rendering{
-		Needed:     map[string]map[string]string{"networking": {"key": "sealed"}},
-		Generators: map[string]Generator{"mesh-network": computedOnce{}},
-	})
-	if err != nil {
-		t.Fatalf("declaration: %v", err)
-	}
-	var ids []string
-	for _, res := range out {
-		ids = append(ids, fmt.Sprint(res["id"]))
-	}
-	if len(ids) == 0 || ids[0] != "networking."+NeedID("key") {
-		t.Fatalf("a computed module lost the secret the mesh made for it, or applies it late: %v", ids)
-	}
-}
-
-type computedOnce struct{}
-
-func (computedOnce) Resources(string) ([]map[string]any, bool, error) {
-	return []map[string]any{{"id": "wg", "type": "file", "path": "/etc/wireguard/wg0.conf",
-		"content": "x", "mode": "0600"}}, true, nil
-}
-
-// A consumer bound to something answered on its own machine still has to be told where it is.
-//
-// The location is a fact nobody needs — "it is here" — and everything beside it is not: the
-// binding carries what the provider said a consumer must know, which is the port. A build machine
-// sharing a node with the registry it pushes to sat in a loop saying it could not read its own
-// binding, because none was written.
-func TestSomethingAnsweredOnThisMachineIsStillBound(t *testing.T) {
-	r := Resolution{
-		Node: "anchor", At: "anchor.internal",
-		Modules: []Manifest{
-			{Module: "registry", Provides: []Offer{{Name: "artifact-store", Scope: ScopeMesh}},
-				Serves: map[string]map[string]any{"artifact-store": {"port": 5000}}},
-			{Module: "builder", Requires: []string{"artifact-store"},
-				Binds: map[string]string{"artifact-store": "/var/lib/builder/store.json"}},
-		},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("declaration: %v", err)
-	}
-	var content string
-	for _, res := range out {
-		if res["path"] == "/var/lib/builder/store.json" {
-			content, _ = res["content"].(string)
-		}
-	}
-	if content == "" {
-		t.Fatal("nothing was written, so the consumer cannot find a provider on its own machine")
-	}
-	if !strings.Contains(content, "5000") {
-		t.Fatalf("the binding does not carry the port, which is the part nobody can guess:\n%s", content)
-	}
-	if !strings.Contains(content, "anchor.internal") {
-		t.Fatalf("the binding does not say where to reach it:\n%s", content)
-	}
-}
-
-// And a machine not on the private network still reaches itself.
-func TestAMachineOffTheNetworkIsBoundToItselfByAnAddressThatWorks(t *testing.T) {
-	r := Resolution{
-		Node: "alone",
-		Modules: []Manifest{
-			{Module: "registry", Provides: []Offer{{Name: "artifact-store", Scope: ScopeMesh}},
-				Serves: map[string]map[string]any{"artifact-store": {"port": 5000}}},
-			{Module: "builder", Requires: []string{"artifact-store"},
-				Binds: map[string]string{"artifact-store": "/var/lib/builder/store.json"}},
-		},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("declaration: %v", err)
-	}
-	for _, res := range out {
-		if res["path"] != "/var/lib/builder/store.json" {
-			continue
-		}
-		content, _ := res["content"].(string)
-		if !strings.Contains(content, "127.0.0.1") {
-			t.Fatalf("bound by a name nothing on this machine resolves:\n%s", content)
-		}
-		return
-	}
-	t.Fatal("nothing was written")
-}
-
-// mustFilter is the rule set, refusing to continue if it could not be computed.
-func mustFilter(t *testing.T, r Resolution, computed map[string]Generator) []Rule {
-	t.Helper()
-	rules, err := r.Filtering(computed, nil, nil)
-	if err != nil {
-		t.Fatalf("no rule set could be computed: %v", err)
-	}
-	return rules
-}
-
-// opensOnHub is a generator that says a machine opens a port because of where it sits.
-type opensOnHub struct{ hub string }
-
-func (opensOnHub) Resources(string) ([]map[string]any, bool, error) { return nil, true, nil }
-
-func (o opensOnHub) Listens(node string) ([]Listening, error) {
-	if node != o.hub {
-		return nil, nil
-	}
-	return []Listening{{Port: 51820, Protocol: "udp", From: FromEverywhere,
-		Why: "the private network"}}, nil
-}
-
-// cannotSay is a generator that does not know what a machine opens.
-type cannotSay struct{}
-
-func (cannotSay) Resources(string) ([]map[string]any, bool, error) { return nil, true, nil }
-func (cannotSay) Listens(string) ([]Listening, error) {
-	return nil, errors.New("this machine's endpoint has no port in it")
-}
-
-// A computed module contributes listens the way it contributes resources.
-//
-// A static field is one answer for every machine that runs the module, and a hub's own port is
-// not one of those: the machine that most needs filtering — the one facing the public internet —
-// is exactly the one a static answer gets wrong.
-func TestAComputedModuleOpensThePortItsMachineNeeds(t *testing.T) {
-	network := Manifest{Module: "networking", Computed: "mesh-network"}
-	gens := map[string]Generator{"mesh-network": opensOnHub{hub: "anchor"}}
-
-	onHub := mustFilter(t, Resolution{Node: "anchor", Modules: []Manifest{network}}, gens)
-	if len(onHub) != 1 || onHub[0].Port != 51820 {
-		t.Fatalf("the hub's own way onto the private network was not opened: %+v", onHub)
-	}
-	if onHub[0].Because[0] != "networking" {
-		t.Fatalf("the rule does not name what caused it: %+v", onHub[0])
-	}
-
-	// And the machine that dials out opens nothing, from the same module.
-	elsewhere := mustFilter(t, Resolution{Node: "laptop", Modules: []Manifest{network}}, gens)
-	if len(elsewhere) != 0 {
-		t.Fatalf("a machine nothing dials opened a port because another machine needed one: %+v",
-			elsewhere)
-	}
-}
-
-// What a module says and what was computed for it are both kept.
-func TestAComputedModulesOwnListensAreNotLost(t *testing.T) {
-	network := Manifest{Module: "networking", Computed: "mesh-network",
-		Listens: []Listening{{Port: 9, From: FromMesh, Why: "something the module always wants"}}}
-	rules := mustFilter(t, Resolution{Node: "anchor", Modules: []Manifest{network}},
-		map[string]Generator{"mesh-network": opensOnHub{hub: "anchor"}})
-	if len(rules) != 2 {
-		t.Fatalf("one of the two sources was dropped: %+v", rules)
-	}
-}
-
-// A generator that cannot say is refused, not read as silence.
-//
-// Closing a port on the evidence of a failure to look is how a machine is severed by a fault
-// somewhere else entirely — and the machine it would sever is the hub.
-func TestAGeneratorThatCannotSayRefusesTheRuleSet(t *testing.T) {
-	_, err := Resolution{Node: "anchor",
-		Modules: []Manifest{{Module: "networking", Computed: "mesh-network"}},
-	}.Filtering(map[string]Generator{"mesh-network": cannotSay{}}, nil, nil)
-	if err == nil {
-		t.Fatal("a machine whose open ports could not be computed was given a rule set anyway")
-	}
-	if !strings.Contains(err.Error(), "anchor") {
-		t.Fatalf("the refusal does not name the machine: %v", err)
-	}
-}
-
-// A generator with nothing to say about ports is ordinary and must not be required to say so.
-func TestAGeneratorThatOpensNothingNeedsNoMethod(t *testing.T) {
-	rules := mustFilter(t, Resolution{Node: "anchor",
-		Modules: []Manifest{{Module: "names", Computed: "mesh-names"}}},
-		map[string]Generator{"mesh-names": computedOnce{}})
-	if len(rules) != 0 {
-		t.Fatalf("a generator that says nothing about ports opened one: %+v", rules)
-	}
-}
-
-// A module may reflect a file another module put on the machine.
-//
-// The case this exists for: a resolver restarting when the mesh rewrites the names. Those are
-// computed by the mesh and belong to its module, not to the daemon's — so without this the
-// daemon would serve the names it started with for ever, while every check reported success.
-func TestAServiceCanReflectAnotherModulesFile(t *testing.T) {
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{{
-		Module: "dnsmasq",
-		Resources: []map[string]any{
-			{"id": "config", "type": "file", "path": "/etc/dnsmasq.conf",
-				"content": "x", "mode": "0644"},
-			{"id": "run", "type": "service", "unit": "dnsmasq.service", "state": "running",
-				"restart-on": []any{"config", "mesh-resolver.nodes"}},
-		},
-	}}}.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if r["type"] != "service" {
-			continue
-		}
-		reflects := r["restart-on"].([]any)
-		var own, other bool
-		for _, id := range reflects {
-			switch id.(string) {
-			case "dnsmasq.config":
-				own = true
-			case "mesh-resolver.nodes":
-				other = true
-			}
-		}
-		if !own {
-			t.Fatalf("its own file was not prefixed with its module: %v", reflects)
-		}
-		if !other {
-			t.Fatalf("a file it named in full was prefixed again and now points at nothing: %v",
-				reflects)
-		}
-		return
-	}
-	t.Fatal("no service in the declaration")
-}
-
-// What answers a requirement is applied before what asked for it.
-//
-// The host does not sort, so the order written here is the order a machine applies. Selection
-// walks outward from what was assigned, which puts a consumer first — and a service that reads a
-// file another module writes then starts before the file exists, fails, and is fixed by the next
-// reconcile. That is the worst shape a fault can take: what gets remembered is that it works.
-func TestWhatAnsweredARequirementIsAppliedFirst(t *testing.T) {
-	got, err := Resolve(map[string]Manifest{
-		"dnsmasq": {Module: "dnsmasq", Requires: []string{"resolver-data"}},
-		"data":    {Module: "data", Provides: []Offer{{Name: "resolver-data"}}},
-	}, []string{"dnsmasq"}, Node{Name: "anchor"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got.Modules[0].Module != "data" {
-		t.Fatalf("the consumer is applied before what it requires: %v", named(got))
-	}
-}
-
-// Through a chain, not only one step: a machine applies what the thing it needs needs, first.
-func TestAChainOfRequirementsIsAppliedFromTheBottom(t *testing.T) {
-	got, err := Resolve(map[string]Manifest{
-		"top":    {Module: "top", Requires: []string{"middle-thing"}},
-		"middle": {Module: "middle", Provides: []Offer{{Name: "middle-thing"}}, Requires: []string{"bottom-thing"}},
-		"bottom": {Module: "bottom", Provides: []Offer{{Name: "bottom-thing"}}},
-	}, []string{"top"}, Node{Name: "anchor"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	order := named(got)
-	if order[0] != "bottom" || order[1] != "middle" || order[2] != "top" {
-		t.Fatalf("a chain was not applied from the bottom: %v", order)
-	}
-}
-
-// Modules with no relation keep the order selection gave them — assigned first, then what they
-// pulled in. A sort that reshuffled unrelated modules would make every declaration's diff
-// unreadable for no gain.
-func TestUnrelatedModulesKeepTheirOrder(t *testing.T) {
-	got, err := Resolve(map[string]Manifest{
-		"one":   {Module: "one"},
-		"two":   {Module: "two"},
-		"three": {Module: "three"},
-	}, []string{"one", "two", "three"}, Node{Name: "anchor"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	order := named(got)
-	if order[0] != "one" || order[1] != "two" || order[2] != "three" {
-		t.Fatalf("unrelated modules were reshuffled: %v", order)
-	}
-}
-
-// Two modules requiring each other are both applied rather than refused: a cycle here is not a
-// machine that cannot work, and refusing would make a cooperating pair impossible to assign.
-func TestTwoModulesRequiringEachOtherAreStillApplied(t *testing.T) {
-	got, err := Resolve(map[string]Manifest{
-		"a": {Module: "a", Provides: []Offer{{Name: "from-a"}}, Requires: []string{"from-b"}},
-		"b": {Module: "b", Provides: []Offer{{Name: "from-b"}}, Requires: []string{"from-a"}},
-	}, []string{"a"}, Node{Name: "anchor"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Modules) != 2 {
-		t.Fatalf("a cooperating pair was not applied: %v", named(got))
-	}
-}
-
-func named(r Resolution) []string {
-	var out []string
-	for _, m := range r.Modules {
-		out = append(out, m.Module)
-	}
-	return out
-}
-
-// A port's source is a per-node setting, not a manifest constant: the same module is internal on
-// one machine and public on another (novox/hq ADR 0046). postgres listens from the mesh by default;
-// a setting on one node exposes it to anywhere, and the rule set follows.
-func TestExposureSettingOverridesAListensSource(t *testing.T) {
-	postgres := Manifest{Module: "postgres", Version: "1",
-		Listens: []Listening{{Port: 5432, From: FromMesh, Why: "the database"}}}
-
-	base, err := Resolution{Node: "ace", Modules: []Manifest{postgres}}.Filtering(nil, nil, nil)
-	if err != nil {
-		t.Fatalf("filtering: %v", err)
-	}
-	if len(base) != 1 || base[0].From != FromMesh {
-		t.Fatalf("without a setting, the default source is the mesh: %+v", base)
-	}
-
-	expose := map[string]map[int]string{"postgres": {5432: FromEverywhere}}
-	exposed, err := Resolution{Node: "novox", Modules: []Manifest{postgres}}.Filtering(nil, nil, expose)
-	if err != nil {
-		t.Fatalf("filtering: %v", err)
-	}
-	if len(exposed) != 1 || exposed[0].From != FromEverywhere {
-		t.Fatalf("the setting did not open the port to anywhere: %+v", exposed)
-	}
-}
-
-// Exposure refuses a setting that names a port the module does not listen on, or a source that is
-// not a real one — a setting reaching nothing is worse than none (novox/hq ADR 0043/0046).
-func TestExposureRefusesAPortNotListenedOnAndABadSource(t *testing.T) {
-	postgres := Manifest{Module: "postgres", Listens: []Listening{{Port: 5432, From: FromMesh}}}
-	layer := func(port, source string) []Layer {
-		return []Layer{{From: "node", Placement: map[string]any{ExposeSetting: map[string]any{port: source}}}}
-	}
-
-	if _, err := Exposure(postgres, layer("5432", FromEverywhere)); err != nil {
-		t.Fatalf("a valid exposure was refused: %v", err)
-	}
-	if _, err := Exposure(postgres, layer("6379", FromEverywhere)); err == nil {
-		t.Error("a port the module does not listen on was accepted")
-	}
-	if _, err := Exposure(postgres, layer("5432", "everyone")); err == nil {
-		t.Error("a source that is not mesh/anywhere/machine was accepted")
-	}
-}
-
-// ssh survives whatever the mesh does or does not know about this machine.
-//
-// **The one rule here that nothing derives.** Every other line comes from what is assigned, which
-// is the point of the mechanism — and a mesh part-way through adopting a machine has been assigned
-// almost nothing, so what it computes is a chain that drops the port used to fix it. The session
-// loading the rules lives on conntrack until it drops, and then the machine is reached from a
-// rescue console (novox/hq issue 047).
-func TestSSHIsOpenFromTheMeshEvenWhenNothingIsAssigned(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2", "198.51.100.3"}, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "ip saddr { 198.51.100.2, 198.51.100.3 } tcp dport 22 accept") {
-		t.Fatalf("ssh is not open to the mesh, so a machine can lock everyone out:\n%s", nft)
-	}
-	// And not to the world, on a machine that does not face it.
-	if strings.Contains(nft, "\t\ttcp dport 22 accept") {
-		t.Fatalf("ssh is open to everywhere on a machine that faces inward only:\n%s", nft)
-	}
-}
-
-// And from outside as well, on a machine that faces outward — because that is the way in when the
-// private network is the thing that broke.
-func TestSSHIsOpenFromOutsideOnAMachineThatFacesIt(t *testing.T) {
-	nft := AsNftables(nil, []string{"198.51.100.2"}, true, nil, nil, "mesh0")
-	if !strings.Contains(nft, "\t\ttcp dport 22 accept") {
-		t.Fatalf("a machine reachable from outside does not answer ssh there:\n%s", nft)
-	}
-}
-
-// A machine the mesh knows no addresses for still answers ssh.
-//
-// **This is the machine it matters most for.** Before the private network exists there is nothing
-// to narrow the rule to, so narrowing it shuts the port entirely — on the first machine anybody
-// adopts, reached over the network, closed by the act of adopting it.
-func TestSSHIsNeverLeftWithoutARule(t *testing.T) {
-	nft := AsNftables(nil, nil, false, nil, nil, "mesh0")
-	if !strings.Contains(nft, "tcp dport 22 accept") {
-		t.Fatalf("a machine with no mesh addresses has no ssh rule, so adopting it locks it:\n%s", nft)
-	}
-}
-
-// chainBody is one chain's own lines, so an assertion cannot be satisfied by an identical line in
-// another chain.
-//
-// **Written because that happened.** The rule letting this machine's own callers through appears in the
-// input chain and, in the same words, in the forward chain. A test asserting on the whole rendered file
-// passed with the input chain's copy deleted — it was reading the forward chain's. ADR 0137's own tests
-// say to assert per chain body for exactly this reason, and this file was not doing it.
-func chainBody(t *testing.T, nft, chain string) string {
-	t.Helper()
-	open := "\tchain " + chain + " {"
-	i := strings.Index(nft, open)
-	if i < 0 {
-		t.Fatalf("no chain %q in:\n%s", chain, nft)
-	}
-	rest := nft[i+len(open):]
-	j := strings.Index(rest, "\n\t}")
-	if j < 0 {
-		t.Fatalf("chain %q does not close in:\n%s", chain, nft)
-	}
-	return rest[:j]
-}
-
-// **Anything on this machine may call anything on this machine.**
-//
-// Local is not a boundary this mesh draws, and whether a caller sits in a container was never meant to
-// change the answer. It did, because the chain asked about addresses: a caller on the machine carries
-// the machine's address and a caller in one of its containers carries a bridge address, so a rule
-// naming the machines' own addresses silently refused every container on them.
-//
-// Measured: a module reaching its database on its own machine's name timed out for eleven hours while
-// the machine itself could reach it (novox/hq 04-ISSUES/145).
-func TestAnythingOnThisMachineMayCallAnythingOnIt(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "store", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-		{Module: "private", Listens: []Listening{{Port: 9999, From: FromMachine}}},
-	}}, nil), []string{"10.10.0.1", "10.10.0.2"}, false, nil, []string{"eth0"}, "mesh0")
-
-	// In the INPUT chain, which is where a call to a service on this machine arrives. The forward
-	// chain carries the same line in the same words, so asserting on the whole file proves nothing.
-	input := chainBody(t, nft, "input")
-	if !strings.Contains(input, `iifname != { "eth0", "mesh0" } accept`) {
-		t.Fatalf("a caller on this machine cannot reach a service on it:\n%s", input)
-	}
-	// One rule, for every service here — not a line per port that only covers the ports somebody
-	// remembered to think about.
-	if strings.Contains(input, `iifname != { "eth0", "mesh0" } tcp dport 5432`) {
-		t.Fatalf("the local allowance is still written per port:\n%s", input)
-	}
-	// And the private network still reaches what is exposed to it, which is a different question.
-	if !strings.Contains(input, "ip saddr { 10.10.0.1, 10.10.0.2 } tcp dport 5432 accept") {
-		t.Fatalf("the private network no longer reaches a service exposed to it:\n%s", input)
-	}
-}
-
-// The three reaches, as three lines. This is the whole of what the filter says about who may call what.
-func TestTheThreeReachesAreThreeLines(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "internal-only", Listens: []Listening{{Port: 5432, From: FromMesh}}},
-		{Module: "public", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}, nil), []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "mesh0")
-
-	input := chainBody(t, nft, "input")
-	for what, want := range map[string]string{
-		"on this machine":          `iifname != { "eth0", "mesh0" } accept`,
-		"over the private network": "ip saddr { 10.10.0.1 } tcp dport 5432 accept",
-		"from anywhere":            "tcp dport 443 accept",
-	} {
-		if !strings.Contains(input, want) {
-			t.Fatalf("a caller %s cannot reach what is exposed to it (%q):\n%s", what, want, input)
-		}
-	}
-}
-
-// A port open to everything needs no such line — it is already open to a guest.
-func TestAPublicPortNeedsNoGuestLine(t *testing.T) {
-	nft := AsNftables(mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "web", Listens: []Listening{{Port: 443, From: FromEverywhere}}},
-	}}, nil), []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "mesh0")
-	if strings.Count(nft, `iifname != { "eth0", "mesh0" } tcp dport 443`) != 0 {
-		t.Fatalf("a public port was given a guest line it does not need:\n%s", nft)
-	}
-}
-
-// **The hub relays the mesh** (novox/hq ADR 0007, issue 196). Two machines that are not co-located
-// reach each other through the hub, so the hub forwards a packet that arrives on the tunnel and
-// leaves on it. The forward chain judged that packet by the hub's own published ports, and two
-// machines behind the hub reached each other only on the ports the hub happened to publish.
-//
-// Measured: from one home machine to another through the hub, 17 of 55 ports answered, and they
-// were exactly the hub's own; the SYN for the rest never left the hub.
-func TestTheMeshPassingThroughIsRelayedNotJudgedAsThisMachines(t *testing.T) {
-	nft := AsNftables(nil, []string{"10.42.0.1", "10.42.0.2"}, false, nil, []string{"eth0"}, "mesh0")
-	relay := `iifname "mesh0" oifname "mesh0" accept`
-	if !strings.Contains(chainBody(t, nft, "forward"), relay) {
-		t.Errorf("the forward chain does not relay the mesh through this machine:\n%s", chainBody(t, nft, "forward"))
-	}
-	// Relaying is not receiving: nothing in the input chain opens because of it.
-	if strings.Contains(chainBody(t, nft, "input"), "oifname") {
-		t.Errorf("the input chain names an outgoing interface, which no packet for this machine has:\n%s",
-			chainBody(t, nft, "input"))
-	}
-	// And off the tunnel into this machine's own containers is still judged: the tunnel is not
-	// accepted wholesale, only in and out on it.
-	if strings.Contains(chainBody(t, nft, "forward"), `iifname "mesh0" accept`) {
-		t.Errorf("the forward chain accepts everything off the tunnel:\n%s", chainBody(t, nft, "forward"))
-	}
-
-	// A machine with no tunnel relays nothing, and names no interface it does not have.
-	alone := AsNftables(nil, nil, false, nil, []string{"eth0"}, "")
-	if strings.Contains(alone, "oifname") {
-		t.Errorf("a machine with no tunnel was given a relay rule:\n%s", alone)
-	}
-}
diff --git a/internal/catalogue/foundation_manifests_test.go b/internal/catalogue/foundation_manifests_test.go
deleted file mode 100644
index 88e64de8..00000000
--- a/internal/catalogue/foundation_manifests_test.go
+++ /dev/null
@@ -1,368 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// The catalogue's foundation modules as they are — in a merge check the catalogue cloned beside it,
-// elsewhere the copy captured in testdata/beside (internal/beside, novox/hq issue 432) — parsed by the
-// real parser (novox/hq ADR 0100):
-// the store and the broker say which of their ports the mesh guards on an adopted node, and the
-// filter module loads its table through a unit of its own whose stop deletes only that table.
-// moduleTree is where a module is read from: this repository's own modules/<module> when it lives whole here
-// (novox/hq ADR 0420 §1, issue 1019: build-agent and route-proxy), with this repository as the tree root;
-// otherwise the catalogue beside, with the catalogue as the root.
-func moduleTree(t *testing.T, module string) (root, dir string) {
-	t.Helper()
-	own := filepath.Join("..", "..", "modules", module)
-	if _, err := os.Stat(filepath.Join(own, "module.json")); err == nil {
-		return filepath.Join("..", ".."), own
-	}
-	return beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), module)
-}
-
-func catalogueManifest(t *testing.T, module string) Manifest {
-	t.Helper()
-	root, dir := moduleTree(t, module)
-	m, err := ReadTreeManifest(root, dir)
-	if err != nil {
-		t.Fatalf("%s does not parse:\n%v", module, err)
-	}
-	return m
-}
-
-func TestTheStoreAndTheBrokerSayWhatTheMeshGuards(t *testing.T) {
-	if got := catalogueManifest(t, "postgres").Guards; !reflect.DeepEqual(got, []int{5432}) {
-		t.Errorf("postgres guards %v; the store's port must be refused from outside", got)
-	}
-	// The bus's monitoring port, not its client port: a node reaches the bus, nobody outside
-	// reads its state (novox/hq ADR 0131 — the broker that guarded 15672 has left the catalogue).
-	if got := catalogueManifest(t, "nats").Guards; !reflect.DeepEqual(got, []int{8222}) {
-		t.Errorf("nats guards %v; the monitoring port must be refused from outside", got)
-	}
-}
-
-func TestTheFilterModuleNeverFlushesTheRuleset(t *testing.T) {
-	m := catalogueManifest(t, "nftables")
-	var unit, stock, load map[string]any
-	for _, r := range m.Resources {
-		switch r["id"] {
-		case "unit":
-			unit = r
-		case "stock-unit-stop":
-			stock = r
-		case "load":
-			load = r
-		}
-	}
-	if load == nil || load["unit"] != "mesh-filter.service" {
-		t.Fatalf("the filter is not loaded by its own unit: %v", load)
-	}
-	content, _ := unit["content"].(string)
-	if unit == nil || unit["path"] != "/etc/systemd/system/mesh-filter.service" {
-		t.Fatalf("the filter's unit is not written: %v", unit)
-	}
-	if strings.Contains(content, "flush") {
-		t.Fatalf("stopping the filter flushes the whole ruleset — the runtime's and the found "+
-			"firewall's with it:\n%s", content)
-	}
-	if !strings.Contains(content, "ExecStop=nft delete table inet mesh\n") ||
-		!strings.Contains(content, "ExecStart=nft -f "+m.Filtering.Into+"\n") {
-		t.Fatalf("the unit does not load the computed rule set and delete only its own table:\n%s",
-			content)
-	}
-	// A node converged before the filter had its own unit still has the stock nftables.service
-	// enabled, whose stop flushes the whole ruleset: a drop-in makes it delete only the mesh's
-	// table, and the load is restarted on it so the host reloads units and the drop-in is read.
-	if stock == nil || stock["path"] != "/etc/systemd/system/nftables.service.d/mesh.conf" ||
-		!strings.HasSuffix(fmt.Sprint(stock["content"]),
-			"[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n") {
-		t.Fatalf("the stock unit's stop is not replaced with deleting the mesh's table: %v", stock)
-	}
-	// A changed rule set is RELOADED — ExecReload replaces the table in one `nft -f`, so the node
-	// is never unfiltered — and only the units themselves restart it, which is the one change a
-	// reload cannot carry.
-	if !reflect.DeepEqual(load["reload-on"], []any{"filtering"}) {
-		t.Fatalf("the filter is restarted rather than reloaded when its rules change, leaving the "+
-			"node unfiltered in between: %v", load)
-	}
-	if !reflect.DeepEqual(load["restart-on"], []any{"unit", "stock-unit-stop"}) {
-		t.Fatalf("the filter is not restarted when its unit or the stock unit's drop-in changes: %v",
-			load["restart-on"])
-	}
-}
-
-// The package registry's port is the node's, like every other foundation port (novox/hq
-// 04-ISSUES/085, ADR 0100). The forge is reached through what it says it serves, and consumers —
-// the builder among them — are told that, rather than carrying a number of their own.
-
-func TestTheForgesPortIsGivenLikeAnyOtherProvidersPort(t *testing.T) {
-	forge := catalogueManifest(t, "gitea")
-
-	// The catalogue's number is a default and the node's setting moves it.
-	given, err := GivenPorts(forge, []Layer{{From: "anchor",
-		Placement: map[string]any{PortsSetting: map[string]any{"3000": float64(3100)}}}})
-	if err != nil {
-		t.Fatalf("the forge's port cannot be given on a node: %v", err)
-	}
-	if given[3000] != 3100 {
-		t.Fatalf("the forge was given %v", given)
-	}
-
-	// And every consumer of the package registry is told where the machine actually put it,
-	// because that is read from what the forge serves rather than written in the consumer.
-	if got := ServedOn(forge, "npm-package-registry", given)["port"]; got != 3100 {
-		t.Errorf("the package registry is served on %v, not the port this node gave it", got)
-	}
-	if got := ServedOn(forge, "npm-package-registry", nil)["port"]; got != float64(3000) {
-		t.Errorf("without a setting the forge serves %v, not the catalogue's port", got)
-	}
-	// And so is where a repository on it is cloned from (novox/hq ADR 0111), for the same reason:
-	// a build composes the URL from what the forge serves, so a given port is a followed port.
-	if got := ServedOn(forge, "git", given)["port"]; got != 3100 {
-		t.Errorf("git is served on %v, not the port this node gave the forge", got)
-	}
-}
-
-// **The builder requires the registry the npm seat delivers, and carries no binding of its own.**
-//
-// It used to carry a hand-written binding because nothing provided a package registry to resolve
-// one from at genesis. The catalogue now requires it like any consumer, and ADR 0110 makes the
-// seat's holder the answer when more than one module provides it — so a carried copy would be a
-// second answer to the same question, free to drift from the first. Asserted gone, not merely
-// unused.
-//
-// The builder is the build-agent on every machine since novox/hq ADR 0190; this read the retired
-// `builder` and, finding no manifest, skipped unseen from then until novox/hq issue 432.
-func TestTheBuilderRequiresTheRegistryTheNpmSeatDelivers(t *testing.T) {
-	builder := catalogueManifest(t, "build-agent")
-	seat, _ := SeatNamed("npm-package-registry")
-	var requires bool
-	for _, r := range builder.Requires {
-		requires = requires || r == seat.Delivers
-	}
-	if !requires {
-		t.Fatalf("the builder does not require %q: %v", seat.Delivers, builder.Requires)
-	}
-	if builder.Binds[seat.Delivers] == "" {
-		t.Errorf("the builder is not told where the registry is: binds %v", builder.Binds)
-	}
-	for _, r := range builder.Resources {
-		if fmt.Sprint(r["id"]) == "package-binding" {
-			t.Fatal("the builder carries its own package binding beside the one the mesh resolves")
-		}
-	}
-}
-
-// The forge holds the seats it answers for (novox/hq ADR 0110, 0111), parsed by the real parser —
-// which refuses a delivering seat claimed by a module that does not provide what it delivers.
-func TestTheForgeHoldsTheNpmAndGitSeats(t *testing.T) {
-	forge := catalogueManifest(t, "gitea")
-	holds := map[string]bool{}
-	for _, c := range forge.Claims {
-		holds[c.Name] = true
-	}
-	for _, seat := range []string{"npm-package-registry", "git"} {
-		if !holds[seat] {
-			t.Errorf("gitea does not claim the %s seat: %+v", seat, forge.Claims)
-		}
-	}
-	git := ServedOn(forge, "git", nil)
-	if git["scheme"] != "http" || git["port"] != float64(3000) {
-		t.Errorf("gitea serves nothing a clone URL can be composed from: %v", git)
-	}
-	npm := ServedOn(forge, "npm-package-registry", nil)
-	if npm["npm-path"] != "/api/packages/novox/npm/" {
-		t.Errorf("gitea no longer says where its npm registry is: %v", npm)
-	}
-}
-
-// **And the forge's own address follows it**, composed from the manifest in the catalogue beside
-// this checkout (novox/hq 04-ISSUES/088).
-//
-// The forge is reached a third way that neither test above covers: by its own code, over the
-// machine's loopback, told where to go in its environment. The `2999:3000` mapping that lets the
-// forge go on binding 3000 does nothing for a caller dialling the machine — so a literal there is
-// wrong on every node whose assignment differs, and wrong for a second reason on a node given the
-// port (ADR 0100). Composed through the whole path, because what proves the placeholder resolves
-// in an `env` at all is a declaration, not a manifest.
-func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
-	forge, err := catalogueManifest(t, "gitea").Resolve(forgeBuilt(catalogueManifest(t, "gitea")))
-	if err != nil {
-		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
-	}
-	r := Resolution{Node: "anchor", Account: "op", PublicDomain: "example.org",
-		Modules: []Manifest{forge, theRuntime(t)}, Needs: []Needed{
-			{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
-				Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
-			{Name: "route", For: "gitea", From: "anchor"},
-			{Name: "secret", For: "gitea", From: "anchor", Local: "internal-token", Sealed: "sealed-token"},
-			{Name: "secret", For: "gitea", From: "anchor", Local: "admin", Sealed: "sealed-admin"},
-		}}
-
-	// The number this node was given for the forge — the one the machine it is about to run on
-	// already publishes.
-	out, err := r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-broker"}},
-		Given:  map[string]map[int]int{"gitea": {3000: 2999}},
-	})
-	if err != nil {
-		t.Fatalf("the forge does not compose: %v", err)
-	}
-
-	// What the machine publishes, and what the forge's sidecar is told to dial: one number.
-	server := fileNamed(out, "gitea.server")
-	if server == nil {
-		t.Fatalf("the forge's own container is not in the declaration: %v", out)
-	}
-	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "2999:3000") {
-		t.Fatalf("the forge is not published on the port this node gave it: %v", server["ports"])
-	}
-	// The forge's own code runs in the node's runtime (novox/hq ADR 0198), given its words there.
-	runtime := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if runtime == nil {
-		t.Fatalf("the node's runtime is not in the declaration: %v", ids(out))
-	}
-	env, _ := runtime["env"].(map[string]string)
-	var given map[string]map[string]string
-	if err := json.Unmarshal([]byte(env[RuntimeToolEnv]), &given); err != nil {
-		t.Fatalf("the runtime's %s is not JSON: %q", RuntimeToolEnv, env[RuntimeToolEnv])
-	}
-	if given["gitea"]["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
-		t.Fatalf("the forge's code dials %v while the machine publishes the forge on 2999 — "+
-			"whatever reads it dials a dead port", given["gitea"]["MESH_GITEA_URL"])
-	}
-}
-
-// gitea's own sshd is unmodified — the module's own internal port is 22, the number in
-// `listens`, the same convention every other module in the catalogue uses (its internal port,
-// not an invented identity). Composed from the manifest in the catalogue beside this checkout,
-// because what the mesh publishes is a fact about what the module actually writes.
-func declaredGiteaSsh(t *testing.T, given map[int]int) map[string]any {
-	t.Helper()
-	forge := catalogueManifest(t, "gitea")
-	resolved, err := forge.Resolve(forgeBuilt(forge))
-	if err != nil {
-		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
-	}
-	r := Resolution{Node: "anchor", Account: "op", PublicDomain: "example.org",
-		Modules: []Manifest{resolved, theRuntime(t)}, Needs: []Needed{
-			{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
-				Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
-			{Name: "route", For: "gitea", From: "anchor"},
-			{Name: "secret", For: "gitea", From: "anchor", Local: "internal-token", Sealed: "sealed-token"},
-			{Name: "secret", For: "gitea", From: "anchor", Local: "admin", Sealed: "sealed-admin"},
-		}}
-	givenPorts := map[int]int{3000: 3000}
-	for k, v := range given {
-		givenPorts[k] = v
-	}
-	out, err := r.Declaration(Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-broker"}},
-		Ports:  map[string]map[int]int{"gitea": givenPorts},
-		Given:  map[string]map[int]int{"gitea": given},
-	})
-	if err != nil {
-		t.Fatalf("the forge does not compose: %v", err)
-	}
-	server := fileNamed(out, "gitea.server")
-	if server == nil {
-		t.Fatalf("the forge's own container is not in the declaration: %v", out)
-	}
-	return server
-}
-
-// **The forge publishes ssh at the mesh's own fixed convention by default** (novox/hq ADR 0100).
-//
-// `222` is the mesh's own public convention for the forge's ssh, written directly in the
-// manifest's `ports` — every node the forge has run on used the same number, so it needs no
-// per-node setting to reach it.
-func TestTheForgesSshPortIsTheMeshsFixedConventionByDefault(t *testing.T) {
-	forge := catalogueManifest(t, "gitea")
-	// Nothing was given — no node moved this port — which is the ordinary answer: the mesh only
-	// reports what a setting moved, and the manifest's own `222:22` needs no move to be reached.
-	given, err := GivenPorts(forge, nil)
-	if err != nil {
-		t.Fatalf("the forge's ssh port cannot be given on a node: %v", err)
-	}
-	if len(given) != 0 {
-		t.Fatalf("nothing moved the forge's ssh port, yet it was given %v", given)
-	}
-	server := declaredGiteaSsh(t, given)
-	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "222:22") {
-		t.Fatalf("the forge is published on %v, not its own fixed convention", server["ports"])
-	}
-}
-
-// **A node whose predecessor served git on a different number can still be told to leave it
-// there.** The setting names the port the module itself listens on — 22, gitea's own sshd, the
-// same number `listens` uses — not the mesh's own default machine-side number, so moving it does
-// not require guessing what the manifest happens to default to.
-func TestANodeMayGiveTheForgesSshPortADifferentNumber(t *testing.T) {
-	forge := catalogueManifest(t, "gitea")
-	given, err := GivenPorts(forge, []Layer{{From: "anchor",
-		Placement: map[string]any{PortsSetting: map[string]any{"22": float64(9022)}}}})
-	if err != nil {
-		t.Fatalf("the forge's ssh port cannot be moved on a node: %v", err)
-	}
-	if want := map[int]int{22: 9022}; !reflect.DeepEqual(given, want) {
-		t.Fatalf("the forge was given %v, and the setting named %v", given, want)
-	}
-	server := declaredGiteaSsh(t, given)
-	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "9022:22") ||
-		strings.Contains(published, "222:22") {
-		t.Fatalf("the forge is published on %v, not the port this node gave it", server["ports"])
-	}
-}
-
-// forgeBuilt is a build of every artifact the forge's manifest declares: its code bundle and, since the
-// catalogue added it (novox/hq ADR 0251 §4), its npm registry's. Named from the manifest, so a third
-// artifact does not break every forge test again.
-func forgeBuilt(forge Manifest) []Built {
-	var out []Built
-	for _, a := range forge.Build.Artifacts {
-		out = append(out, Built{Name: a.Name, Kind: ArtifactBundle,
-			Reference: ArtifactStoreScheme + "gitea/" + a.Name + "/blobs/" + bundleDigest, Digest: bundleDigest})
-	}
-	return out
-}
-
-// catalogueResolved is a catalogue module as the mesh holds it once built: the manifest as written, resolved against
-// what the build produced besides the archive its templates are packed into, which carries the text read back from the
-// module's files/ directory as the real build reads it (novox/hq ADR 0349 §2) — so a module whose file text moved into
-// templates composes with it, and one that did not is resolved as it was.
-func catalogueResolved(t *testing.T, module string, built ...Built) Manifest {
-	t.Helper()
-	root, dir := moduleTree(t, module)
-	m, err := ReadTreeManifestWritten(root, dir)
-	if err != nil {
-		t.Fatalf("%s does not parse:\n%v", module, err)
-	}
-	if name := TemplatesArtifact(m); name != "" {
-		read, err := ReadTemplates(m, dir)
-		if err != nil {
-			t.Fatalf("%s: %v", module, err)
-		}
-		// By the path inside the archive, as the build reads it back, not by the path in the module's directory.
-		texts := map[string]string{}
-		for path, text := range read {
-			texts[strings.TrimPrefix(path, m.TemplatesDir()+"/")] = text
-		}
-		built = append(built, Built{Name: name, Kind: ArtifactArchive,
-			Reference: ArtifactStoreScheme + module + "/" + name + "/blobs/" + bundleDigest, Digest: bundleDigest,
-			Texts: texts})
-	}
-	held, err := m.Resolve(built)
-	if err != nil {
-		t.Fatalf("%s does not resolve against its own build: %v", module, err)
-	}
-	return held
-}
diff --git a/internal/catalogue/generated_collision_test.go b/internal/catalogue/generated_collision_test.go
deleted file mode 100644
index 45fcabe8..00000000
--- a/internal/catalogue/generated_collision_test.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
-// every module is — no two modules on a machine declare one path, unit or name (a package may be declared by
-// several, novox/hq ADR 0303). The
-// private network once declared the container runtime's file and service beside the runtime's own
-// module, and nothing refused it, because the collision check only ever saw catalogue manifests.
-
-func runtimesOwn() Manifest {
-	return Manifest{Module: "docker", Resources: []map[string]any{
-		{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "into": "json",
-			"content": `{"live-restore": true}`},
-		{"id": "runtime", "type": "service", "unit": "docker.service", "state": "running",
-			"reload-on": []any{"daemon"}},
-	}}
-}
-
-func TestAGeneratedResourceCollidingWithAModulesIsRefused(t *testing.T) {
-	r := Resolution{Node: "workstation", Modules: []Manifest{
-		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
-		runtimesOwn(),
-	}}
-	_, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": reloading{}}})
-	if err == nil {
-		t.Fatal("a generated resource declaring the runtime's file beside the runtime's module was accepted")
-	}
-	for _, want := range []string{"mesh-network", "docker", "/etc/docker/daemon.json", "docker.service"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
-
-func TestAGeneratedResourceBesideAModulesOwnIsComposed(t *testing.T) {
-	r := Resolution{Node: "workstation", Modules: []Manifest{
-		{Module: "mesh-network", Computed: "mesh-network", Provides: Offers("private-network")},
-		runtimesOwn(),
-	}}
-	gen := &fake{on: map[string]bool{"workstation": true}}
-	out, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": gen}})
-	if err != nil {
-		t.Fatalf("disjoint resources were refused: %v", err)
-	}
-	if fileNamed(out, "docker.daemon") == nil {
-		t.Fatalf("the runtime's own file is missing: %v", out)
-	}
-	// And a machine not on the network yet generates nothing, which collides with nothing.
-	if _, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-network": &fake{}}}); err != nil {
-		t.Fatalf("a machine off the network was refused: %v", err)
-	}
-}
-
-// The catalogue's container runtime module states the mesh's registry itself (ADR 0222).
-func TestTheRuntimesModuleTrustsTheMeshsRegistry(t *testing.T) {
-	docker := catalogueManifest(t, "docker")
-	r := Resolution{Node: "workstation", Modules: []Manifest{docker}}
-	out, err := r.Declaration(Rendering{
-		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	daemon := fileNamed(out, "docker.daemon")
-	if daemon == nil || daemon["into"] != "json" {
-		t.Fatalf("the runtime's file is not written into: %v", daemon)
-	}
-	content, _ := daemon["content"].(string)
-	if !strings.Contains(content, `"insecure-registries": ["anchor.internal:5100"]`) ||
-		!strings.Contains(content, `"live-restore": true`) {
-		t.Fatalf("the runtime's file says %q", content)
-	}
-
-	out, err = r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if content, _ := fileNamed(out, "docker.daemon")["content"].(string); strings.Contains(content, "insecure-registries") {
-		t.Fatalf("with no store on the network, the runtime is told %q", content)
-	}
-}
diff --git a/internal/catalogue/go_bundle_test.go b/internal/catalogue/go_bundle_test.go
deleted file mode 100644
index eb6cd2bb..00000000
--- a/internal/catalogue/go_bundle_test.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package catalogue
-
-import "testing"
-
-// A bundle is the module's own directory compiled whole, and naming a source would be describing its
-// own build. That holds for an interpreted language and cannot hold for a compiled one: a repository
-// written in Go carries several commands — the host and its bootstrap live in one — and "the module's
-// own directory" is then not a package at all (novox/hq 04-ISSUES/142).
-
-func TestAGoBundleMayNameItsCommand(t *testing.T) {
-	b := &Build{Artifacts: []Artifact{{
-		Name: "host-arch", Kind: ArtifactBundle, Language: "go", System: "arch",
-		From: "cmd/mesh-host",
-	}}}
-	if p := b.problems("mesh-host"); len(p) != 0 {
-		t.Fatalf("a go bundle naming its command was refused: %v", p)
-	}
-}
-
-func TestAnInterpretedBundleStillMayNotNameASource(t *testing.T) {
-	b := &Build{Artifacts: []Artifact{{
-		Name: "tools", Kind: ArtifactBundle, Language: "typescript", From: "src",
-	}}}
-	p := b.problems("something")
-	if len(p) == 0 {
-		t.Fatal("an interpreted bundle naming what it is built from was accepted")
-	}
-}
-
-func TestACompiledBundleStillMustSayItsSystem(t *testing.T) {
-	b := &Build{Artifacts: []Artifact{{
-		Name: "host", Kind: ArtifactBundle, Language: "go", From: "cmd/mesh-host",
-	}}}
-	if len(b.problems("mesh-host")) == 0 {
-		t.Fatal("a compiled bundle with no system was accepted")
-	}
-}
diff --git a/internal/catalogue/grant_secret_owner_test.go b/internal/catalogue/grant_secret_owner_test.go
deleted file mode 100644
index 5fdf7fe0..00000000
--- a/internal/catalogue/grant_secret_owner_test.go
+++ /dev/null
@@ -1,103 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A grant secret is read by whatever provisions, and that stopped being root (novox/hq issue 225).
-//
-// The mesh seals one credential per consumer beside the provider's contributions file. The
-// provider's harness reads both: the file to learn who asked, the secret to set their password.
-// While a module's own code ran in a container as root, a root-owned 0600 file was readable by
-// the thing that needed it. ADR 0198 moved that code under the node's runtime, which runs as the
-// operator's account — and the secret stayed root's.
-//
-// **The cost was silence.** The harness says `secret not readable yet`, which is true and
-// ordinary on the first pass, so four thousand refusals in three hours read as patience. No user
-// was ever created, and two consumers crash-looped against a database that had never heard of
-// them.
-//
-// The same reasoning is already written for a module's *own* secrets, three hundred lines above:
-// "a root-owned 0600 file is one that process cannot read". This is that rule reaching the other
-// kind of secret the mesh writes for a module.
-
-// aProviderWithABundle is a provider whose code is a bundle the node's runtime runs — the shape
-// every TypeScript provisioner has since ADR 0198.
-func aProviderWithABundle() Manifest {
-	return Manifest{
-		Module: "mongodb", Version: "1",
-		Provides: FromAnywhere("mongodb-database"),
-		Receives: map[string]string{"mongodb-database": "/var/lib/mongodb/grants/mesh.json"},
-		Grants:   map[string]string{"mongodb-database": "/var/lib/mongodb/grants"},
-		Bundles:  []Bundle{{Name: "code", Language: "typescript"}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "mongodb-server",
-			"image": "mongo@sha256:" + strings.Repeat("a", 64),
-		}},
-	}
-}
-
-func TestAGrantSecretIsOwnedByTheAccountThatProvisions(t *testing.T) {
-	r, err := Resolve(shelf(aProviderWithABundle()), []string{"mongodb"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "operator"
-	out, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var secret map[string]any
-	for _, res := range out {
-		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
-			secret = res
-		}
-	}
-	if secret == nil {
-		t.Fatalf("no grant secret was composed at all: %v", out)
-	}
-	if got := secret["owner"]; got != "operator" {
-		t.Fatalf("the grant secret at %v belongs to %v; the provisioner runs as %q and a "+
-			"root-owned 0600 file is one it cannot read — which is silent, because the harness "+
-			"calls it \"not readable yet\"", fmtPath(secret), got, "operator")
-	}
-}
-
-// And a provider whose code still runs in a container keeps the owner it declares, so this
-// changes nothing for the modules the runtime has not taken.
-func TestAContainerProvidersGrantSecretKeepsItsDeclaredOwner(t *testing.T) {
-	m := aProviderWithABundle()
-	m.Bundles = nil
-	m.SecretsOwner = "65534:65534"
-	r, err := Resolve(shelf(m), []string{"mongodb"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "operator"
-	out, err := r.Declaration(Rendering{Grants: []Grant{{
-		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
-		Values: map[string]any{}, Sealed: "c2VhbGVk",
-	}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, res := range out {
-		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
-			if got := res["owner"]; got != "65534:65534" {
-				t.Fatalf("a container provider's grant secret belongs to %v, not what it declares", got)
-			}
-			return
-		}
-	}
-	t.Fatal("no grant secret was composed")
-}
-
-func fmtPath(r map[string]any) string {
-	p, _ := r["path"].(string)
-	return p
-}
diff --git a/internal/catalogue/graphical_session_test.go b/internal/catalogue/graphical_session_test.go
deleted file mode 100644
index f412e246..00000000
--- a/internal/catalogue/graphical_session_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0208: the graphical session is one module per piece, on the mesh's seats.
-
-// §2: the eleven roles are the mesh's own node seats, each with the verbs it starts with.
-func TestTheGraphicalSessionsSeatsAreTheMeshsOwnWithTheirVerbs(t *testing.T) {
-	want := map[string][]string{
-		LoginManagerSeat:     {"sessions"},
-		DisplayServerSeat:    {"displays", "layout"},
-		DisplaySessionSeat:   {"reload", "workspaces", "windows"},
-		TerminalEmulatorSeat: {"open"},
-		LauncherSeat:         {"menu", "secret"},
-		NotifierSeat:         {"send", "history"},
-		LockScreenSeat:       {"lock"},
-		ClipboardSeat:        {"history", "copy"},
-		BarSeat:              nil,
-		CompositorSeat:       nil,
-		SecretServiceSeat:    nil,
-	}
-	for name, verbs := range want {
-		s, ok := SeatNamed(name)
-		if !ok {
-			t.Errorf("%s is not in the mesh's set", name)
-			continue
-		}
-		if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0208" {
-			t.Errorf("%s is %s-scoped under %q", name, s.Scope, s.Decision)
-		}
-		var got []string
-		for _, v := range s.Serves {
-			got = append(got, v.Name)
-			if v.Description == "" || v.Input["type"] != "object" {
-				t.Errorf("%s.%s has no description or no object schema", name, v.Name)
-			}
-		}
-		if !reflect.DeepEqual(got, verbs) {
-			t.Errorf("%s serves %v, want %v", name, got, verbs)
-		}
-	}
-	// The launcher's menu takes a list, and the layout verb says its actions.
-	menu, _ := SeatNamed(LauncherSeat)
-	choices := menu.Serves[0].Input["properties"].(map[string]any)["choices"].(map[string]any)
-	if choices["type"] != "array" {
-		t.Errorf("menu's choices are %v, not a list", choices["type"])
-	}
-	display, _ := SeatNamed(DisplayServerSeat)
-	action := display.Serves[1].Input["properties"].(map[string]any)["action"].(map[string]any)
-	if !reflect.DeepEqual(action["enum"], []string{"list", "save", "apply"}) {
-		t.Errorf("layout's actions are %v", action["enum"])
-	}
-	// And they survive the store's JSON, which is where the live set comes from.
-	if _, err := json.Marshal(graphicalSessionSeats()); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// §2: a module may claim one of them, and may not declare it as its own.
-func TestNoModuleMayDeclareAGraphicalSessionSeat(t *testing.T) {
-	raw := `{"module":"xorg","seats":[{"name":"node-display-server","scope":"node"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "mesh's own namespace") {
-		t.Fatalf("a module declared node-display-server as its own: %v", err)
-	}
-}
-
-func displayServer(name, display string, claims ...string) Manifest {
-	m := Manifest{Module: name, Provides: []Offer{{Name: display, Reach: ReachMachine}}}
-	for _, c := range claims {
-		m.Claims = append(m.Claims, Claim{Name: c})
-	}
-	return m
-}
-
-func windowManager() Manifest {
-	return Manifest{Module: "i3", Requires: []string{"x11-display"}}
-}
-
-// §3: a display is resolved on the requiring module's own node.
-func TestAMachineReachRequirementResolvesToTheProviderOnItsOwnNode(t *testing.T) {
-	cat := shelf(windowManager(), displayServer("xorg", "x11-display", DisplayServerSeat))
-	got, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), World{})
-	if err != nil {
-		t.Fatalf("i3 beside xorg did not resolve: %v", err)
-	}
-	if !reflect.DeepEqual(names(got), []string{"xorg", "i3"}) && !reflect.DeepEqual(names(got), []string{"i3", "xorg"}) {
-		t.Errorf("resolved %v", names(got))
-	}
-}
-
-// §3: never answered by installing a provider, and never by another machine's.
-func TestAMachineReachRequirementIsNotPulledInNorAnsweredFromAnotherNode(t *testing.T) {
-	cat := shelf(windowManager(),
-		displayServer("xorg", "x11-display", DisplayServerSeat),
-		displayServer("xwayland", "x11-display"))
-	// Another machine runs xorg and says so to the world; it does not count.
-	world := World{Offered: map[string][]Provider{
-		"x11-display": {{Node: "laptop", At: "laptop.mesh", Module: "xorg"}}}}
-	_, err := Resolve(cat, []string{"i3"}, workstation(), world)
-	if err == nil {
-		t.Fatal("i3 resolved on a machine with no display of its own")
-	}
-	for _, want := range []string{
-		`"x11-display" is wanted by i3`, "usable only on the machine that provides it",
-		"assign one to workstation", "xorg (holds node-display-server)", "xwayland",
-	} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not say %q:\n%v", want, err)
-		}
-	}
-	// With a single provider in the catalogue too: one candidate is still not a choice to make
-	// for somebody, unlike a node-scoped provision without the machine's reach.
-	_, err = Resolve(shelf(windowManager(), displayServer("xorg", "x11-display", DisplayServerSeat)),
-		[]string{"i3"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("xorg was pulled in for i3")
-	}
-	// Not in the first pass, whose refusals take the machine off the network.
-	if _, err := Resolve(cat, []string{"i3"}, workstation(), World{Unchecked: true}); err != nil {
-		t.Errorf("the first pass refused: %v", err)
-	}
-}
-
-func TestTheMachinesReachIsAProvisionsOnlyReachAndIsNodeScoped(t *testing.T) {
-	for _, c := range []struct{ provides, want string }{
-		{`{"name":"x11-display","reach":"internal"}`, `with reach "internal"; a provision's reach is "machine" or nothing`},
-		{`{"name":"x11-display","scope":"mesh","reach":"machine"}`, `at scope "mesh" with the machine's reach`},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"xorg","provides":[` + c.provides + `]}`))
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: want %q, got %v", c.provides, c.want, err)
-		}
-	}
-	m, err := ParseManifest([]byte(`{"module":"xorg","provides":[{"name":"x11-display","reach":"machine"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.Provides[0].MachineReach() {
-		t.Fatal("the reach was not read")
-	}
-	back, _ := json.Marshal(m.Provides[0])
-	if string(back) != `{"name":"x11-display","reach":"machine"}` {
-		t.Errorf("written back as %s", back)
-	}
-}
-
-func TestACatalogueDisagreeingAboutAProvisionsReachIsRefused(t *testing.T) {
-	cat := shelf(windowManager(), displayServer("xorg", "x11-display"),
-		Manifest{Module: "fake-x", Provides: Offers("x11-display")})
-	_, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), World{})
-	if err == nil || !strings.Contains(err.Error(), `the catalogue disagrees about "x11-display"`) {
-		t.Fatalf("a provision with and without the machine's reach gave %v", err)
-	}
-}
-
-// §4: xinitrc and xresources slots, placed by the display server's holder alone.
-func TestTheSessionsFilesArePlacedByTheDisplayServersHolderAlone(t *testing.T) {
-	xorg := Manifest{Module: "xorg", Claims: []Claim{{Name: DisplayServerSeat}},
-		Shell: []ShellCode{{For: "xinitrc", Slot: "first", Code: "xset s off"}},
-		Resources: []map[string]any{
-			{"id": "xinitrc", "type": "file", "path": "/home/op/.xinitrc",
-				"content": "${shell:xinitrc:first}${shell:xinitrc:normal}${shell:xinitrc:last}"},
-			{"id": "xresources", "type": "file", "path": "/home/op/.Xresources",
-				"content": "${shell:xresources:normal}"},
-		}}
-	i3 := Manifest{Module: "i3", Shell: []ShellCode{{For: "xinitrc", Slot: "last", Code: "exec i3"}}}
-	theme := Manifest{Module: "theme", Shell: []ShellCode{
-		{For: "xresources", Slot: "normal", Code: "Xft.dpi: 96"},
-		{For: "zsh", Slot: "normal", Code: "not for the session"},
-	}}
-	r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{xorg, i3, theme}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]any{}
-	for _, res := range out {
-		by[res["id"].(string)] = res["content"]
-	}
-	if got := by["xorg.xinitrc"]; got != "# xorg\nxset s off\n# i3\nexec i3\n" {
-		t.Errorf("the .xinitrc is %q", got)
-	}
-	if got := by["xorg.xresources"]; got != "# theme\nXft.dpi: 96\n" {
-		t.Errorf("the .Xresources is %q", got)
-	}
-
-	// The contributions parse; the placeholders parse only in the holder.
-	if _, err := ParseManifest([]byte(`{"module":"i3","shell":[{"for":"xinitrc","slot":"last","code":"exec i3"},` +
-		`{"for":"xresources","slot":"normal","code":"i3.font: x"}]}`)); err != nil {
-		t.Fatalf("a session contribution was refused: %v", err)
-	}
-	for _, c := range []struct{ claims, content, want string }{
-		{``, "${shell:xinitrc:normal}", "does not claim node-display-server; every module's xinitrc is placed by the display server's holder alone"},
-		{`{"name":"node-login-shell"}`, "${shell:xresources:normal}", "does not claim node-display-server"},
-		{`{"name":"node-display-server"}`, "${shell:zsh:normal}", "does not claim node-login-shell"},
-		{`{"name":"node-display-server"}`, "${shell:xsession:normal}", "the session's file one of xinitrc, xresources"},
-	} {
-		raw := `{"module":"holder","claims":[` + c.claims + `],"resources":[{"id":"rc","type":"file","path":"/etc/rc","content":"` +
-			c.content + `"}]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s with claims [%s]: want %q, got %v", c.content, c.claims, c.want, err)
-		}
-	}
-	if _, err := ParseManifest([]byte(`{"module":"xorg","claims":[{"name":"node-display-server"}],` +
-		`"resources":[{"id":"rc","type":"file","path":"/home/op/.xinitrc","content":"${shell:xinitrc:last}"}]}`)); err != nil {
-		t.Errorf("the display server's holder could not place the session's slots: %v", err)
-	}
-}
diff --git a/internal/catalogue/handed_bound_test.go b/internal/catalogue/handed_bound_test.go
deleted file mode 100644
index 526f4d29..00000000
--- a/internal/catalogue/handed_bound_test.go
+++ /dev/null
@@ -1,159 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// gitea's server.env, as the catalogue keeps it: its database as the provider told it and the consumer's own login.
-const giteaServerEnv = "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\n" +
-	"GITEA__database__DB_TYPE=postgres\n" +
-	"GITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\n" +
-	"GITEA__database__NAME=${bound:postgres-database:as}\n" +
-	"GITEA__database__USER=${bound:postgres-database:as}\n" +
-	"GITEA__database__PASSWD=${secret:postgres-database}\n"
-
-// databaseConsumer is a handed module, with the template gitea's server.env is, requiring a database from a provider
-// that has moved or not (issue 788); slug is the module's identity source when it declares one.
-func databaseConsumer(t *testing.T, slug string, moved bool) Resolution {
-	t.Helper()
-	raw := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
-		`"requires":["postgres-database"],"own-secrets":{"internal-token":"${dir:state}/internal-token"}`, 1)
-	if slug != "" {
-		raw = strings.Replace(raw, `"version":"1",`, `"version":"1","slug":"`+slug+`",`, 1)
-	}
-	return withDatabase(t, raw, giteaServerEnv, moved)
-}
-
-// withDatabase resolves the module in raw, whose template is text, against a provider of postgres-database that has
-// moved or not.
-func withDatabase(t *testing.T, raw, text string, moved bool) Resolution {
-	t.Helper()
-	r, err := Resolve(shelf(held(t, raw, builtBot(text)),
-		Manifest{Module: "postgres", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeNode}}}),
-		[]string{"bot"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	// Answered on this machine, it states no need; one from the provider's machine is stated, as the plan does.
-	r.Needs = []Needed{{Name: "postgres-database", For: "bot", Module: "postgres", From: "novox", At: "10.7.0.1",
-		CredentialForm: CredentialFormPair, IssuedToHolder: moved, ProviderMoved: moved}}
-	return r
-}
-
-// The forge's server.env composes for a handed module when what it requires has moved, its plan entry carrying the
-// provider's address, machine and the consumer's identity as today's binding file gives them; and is refused with the
-// text it has always had when the provider has not.
-func TestAHandedModuleMayNameWhatItRequiresWhereItsProviderHasMoved(t *testing.T) {
-	c, got := composeWith(t, databaseConsumer(t, "", true), handingTo("store:5000"))
-	if strings.Contains(got, "sealed") {
-		t.Fatalf("a handed module's declaration carries a sealed value: %s", got)
-	}
-	want := []PlanProvision{{Name: "postgres-database", Provision: "postgres-database", Provider: "novox",
-		ProviderModule: "postgres", CredentialForm: CredentialFormPair, At: "10.7.0.1", From: "novox",
-		As: ConsumerIdentity("workstation", "bot")}}
-	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
-		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
-	}
-	for _, unmoved := range []Resolution{databaseConsumer(t, "", false)} {
-		_, err := unmoved.Compose(handingTo("store:5000"))
-		if err == nil || !strings.Contains(err.Error(), "which is no secret of its own; a credential it requires moves "+
-			"with its provider (design 57 B1–B3)") {
-			t.Fatalf("a provider not moved, the credential: %v", err)
-		}
-		bound := strings.Replace(giteaServerEnv, "${secret:postgres-database}", "x", 1)
-		r := withDatabase(t, strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
-			`"requires":["postgres-database"],"own-secrets":{"internal-token":"${dir:state}/internal-token"}`, 1),
-			bound, false)
-		_, err = r.Compose(handingTo("store:5000"))
-		if err == nil || !strings.Contains(err.Error(), "the provisioner's client fills only config, secrets, "+
-			"collections and placement until that domain moves (design 57)") {
-			t.Fatalf("a provider not moved, the binding: %v", err)
-		}
-	}
-}
-
-// A module with a slug is told who it is as its binding file says, the slug first (issue 788).
-func TestAHandedModulesPlanEntryCarriesItsIdentityAsTheBindingFileGivesIt(t *testing.T) {
-	c, _ := composeWith(t, databaseConsumer(t, "agent", true), handingTo("store:5000"))
-	if got := c.Plans["bot"].Provisions[0].As; got != ConsumerIdentity("workstation", "agent") {
-		t.Fatalf("the plan entry says %q", got)
-	}
-	// Nothing known of where the provider is: the entry says none.
-	c, _ = composeWith(t, forgeReader(t, true, true), handingTo("store:5000"))
-	if p := c.Plans["bot"].Provisions[0]; p.At != "" || p.From != "novox" {
-		t.Fatalf("the entry says at %q from %q", p.At, p.From)
-	}
-}
-
-// A handed module's credentials the vault keeps as one login per local name (issue 793): gitea's internal token and
-// admin password, which the `secret` provision hands as `${secret:<local>}`. Each is a plan entry naming its local,
-// its file declared placed and without a value; the template naming the local is allowed.
-func TestAHandedModulesLocalCredentialsOfTheVaultAreNamedByLocalInItsPlan(t *testing.T) {
-	raw := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
-		`"requires":["secret"],"secrets":{"secret":{"internal-token":"${dir:state}/internal-token.secret",`+
-			`"admin":"${dir:state}/admin.secret"}},"own-secrets":{"token":"${dir:state}/token"}`, 1)
-	r, err := Resolve(shelf(held(t, raw, builtBot("T=${secret:internal-token}\n")),
-		Manifest{Module: "vault", Version: "1", Provides: []Offer{{Name: "secret", Scope: ScopeNode}}}),
-		[]string{"bot"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	r.Needs = []Needed{
-		{Name: "secret", Local: "internal-token", For: "bot", Module: "vault", From: "novox",
-			CredentialForm: CredentialFormPair, IssuedToHolder: true, ProviderMoved: true},
-		{Name: "secret", Local: "admin", For: "bot", Module: "vault", From: "novox",
-			CredentialForm: CredentialFormPair, IssuedToHolder: true, ProviderMoved: true},
-	}
-	c, got := composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, "sealed") {
-		t.Fatalf("the declaration carries a sealed value: %s", got)
-	}
-	var names []string
-	for _, p := range c.Plans["bot"].Provisions {
-		if p.Provision != "secret" || p.Provider != "novox" || p.Path == "" || p.Name != p.Local {
-			t.Errorf("the plan entry is %+v", p)
-		}
-		names = append(names, p.Name)
-	}
-	if !reflect.DeepEqual(names, []string{"admin", "internal-token"}) {
-		t.Fatalf("the plan names %v, want admin and internal-token", names)
-	}
-}
-
-// **Issue 969: a key its provider serves only at run time.** A moved module's file may name `${bound:…}` of a
-// provision whose provider tells it at run time (ssh-client's known_host of the forge). Where the machine takes
-// handed files the client fills it and the module composes; where it does not the controller must fill it from what
-// the provider serves statically, cannot, and refuses it with the very words an unmarked module is refused with
-// (ADR 0349 §17: the old way, byte for byte).
-func TestAHandedModuleNamingARunTimeBoundKeyComposesOnlyWhereItIsHanded(t *testing.T) {
-	text := "Host ${bound:postgres-database:at}\n  KnownHost ${bound:postgres-database:known_host}\n"
-	moved := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
-		`"requires":["postgres-database"],"own-secrets":{"token":"${dir:state}/token"}`, 1)
-	unmoved := strings.Replace(moved, `"moved":true,`, ``, 1)
-	if unmoved == moved {
-		t.Fatal("the twin is still marked moved")
-	}
-
-	c, got := composeWith(t, withDatabase(t, moved, text, true), handingTo("store:5000"))
-	if strings.Contains(got, "known_host") || len(c.Filled) == 0 {
-		t.Fatalf("handed, the module is filled by the client and the controller names nothing: %v %s", c.Filled, got)
-	}
-
-	for name, with := range map[string]Rendering{
-		"an engine that does not take a filled file alone": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
-		"no provisioner client on the machine":             {Hands: true, ArtifactStore: "store:5000"},
-	} {
-		_, err := withDatabase(t, moved, text, true).Compose(sealedForBot(with))
-		if err == nil || !strings.Contains(err.Error(), `asks its postgres-database binding for "known_host"`) {
-			t.Fatalf("%s: the key is not refused: %v", name, err)
-		}
-		_, before := withDatabase(t, unmoved, text, false).Compose(sealedForBot(with))
-		if before == nil || before.Error() != err.Error() {
-			t.Fatalf("%s: refused otherwise than the unmarked module: %v / %v", name, err, before)
-		}
-	}
-}
diff --git a/internal/catalogue/handed_consumers_test.go b/internal/catalogue/handed_consumers_test.go
deleted file mode 100644
index a93f6ead..00000000
--- a/internal/catalogue/handed_consumers_test.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A provider's consumers' credentials reach it in a file its machine's provisioner client fills (novox/hq ADR 0373,
-// issue 679): `${consumers:<provision>}`, which only a provider's template may hold, for a provision it provides, in a
-// file of mode 0600 owned at runtime; filled by the client alone, so a module not handed to it on a machine is
-// refused there rather than written the placeholder's text, or nothing.
-
-const (
-	handedProvider = `{"module":"db","version":"1","moved":true,
-  "provides":[{"name":"postgres-database","scope":"mesh","identity":{"max":63,"in":"a PostgreSQL role"}}],
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"state","type":"directory","mode":"0700","place":"."},
-    {"id":"consumers","type":"file","path":"${dir:state}/consumers.json","mode":"0600","template":"files/consumers.json"}]}`
-	consumersText = "${consumers:postgres-database}"
-)
-
-func builtProvider(text string) []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + "db/files/blobs/sha256:" + strings.Repeat("f", 64),
-		Digest:    "sha256:" + strings.Repeat("f", 64), Texts: map[string]string{"consumers.json": text}}}
-}
-
-func TestAHandedProvidersConsumersFileIsHandedToTheClient(t *testing.T) {
-	r := notifierOn(t, held(t, handedProvider, builtProvider(consumersText)))
-	c, got := composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, "${consumers:") {
-		t.Fatalf("the declaration carries the placeholder: %s", got)
-	}
-	plan := c.Plans["db"]
-	if len(plan.Files) != 1 || plan.Files[0].Template != "consumers.json" || plan.Files[0].OwnerAtRuntime != RuntimeOwned {
-		t.Fatalf("the plan fills %+v, want the consumers' file owned at runtime", plan.Files)
-	}
-}
-
-func TestWhatAConsumersPlaceholderMayNotBeIsRefused(t *testing.T) {
-	for why, c := range map[string]struct{ raw, text, want string }{
-		"a provision the module does not provide": {handedProvider, "${consumers:cache}", "does not provide"},
-		"a module providing nothing": {strings.Replace(handedProvider, `"provides":[{"name":"postgres-database","scope":"mesh","identity":{"max":63,"in":"a PostgreSQL role"}}],`,
-			"", 1), consumersText, "does not provide"},
-		"a file others may read": {strings.Replace(handedProvider, `"mode":"0600","template"`,
-			`"mode":"0640","template"`, 1), consumersText, "0600"},
-		"a file the program keeps": {strings.Replace(handedProvider, `"mode":"0600","template"`,
-			`"mode":"0600","create-once":true,"template"`, 1), consumersText, "owned"},
-	} {
-		m, err := ParseManifest([]byte(c.raw))
-		if err != nil {
-			t.Fatalf("%s: %v", why, err)
-		}
-		resolved, err := m.Resolve(builtProvider(c.text))
-		if err == nil {
-			r := notifierOn(t, resolved)
-			_, err = r.Compose(handingTo("store:5000"))
-		}
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: %v, want a refusal saying %q", why, err, c.want)
-		}
-	}
-}
-
-// Where the provider is not handed, nothing fills the placeholder, and it is never written as its text or as an empty
-// list the provider would read as no consumers: the file is left out, said once, and the module composes exactly as
-// it would without the file, so a provider below the handing contract keeps working from its grant files (issue 780).
-func TestAProvidersConsumersFileIsLeftOutWhereItIsNotHanded(t *testing.T) {
-	withFile := notifierOn(t, held(t, handedProvider, builtProvider(consumersText)))
-	without := strings.Replace(handedProvider, `,
-    {"id":"consumers","type":"file","path":"${dir:state}/consumers.json","mode":"0600","template":"files/consumers.json"}`, "", 1)
-	if without == handedProvider {
-		t.Fatal("the manifest without the file was not made")
-	}
-	bare := notifierOn(t, held(t, strings.Replace(strings.Replace(without, `"moved":true,`, "", 1),
-		`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},`, "", 1), nil))
-	for name, with := range map[string]Rendering{
-		"a node-engine that fills no file":      {},
-		"a node-engine that fills, no client":   {Hands: true, ArtifactStore: "store:5000"},
-		"a client, a node-engine that does not": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
-	} {
-		c, got := composeWith(t, withFile, with)
-		_, want := composeWith(t, bare, with)
-		if got != want {
-			t.Errorf("%s: composes\n%s\nwithout its file, it composed\n%s", name, got, want)
-		}
-		if strings.Contains(got, "consumers") {
-			t.Errorf("%s: the declaration names the consumers' file: %s", name, got)
-		}
-		if len(c.HandedOnly) != 1 || !strings.Contains(c.HandedOnly[0], "left out, handed only") {
-			t.Errorf("%s: said %q, want the one line saying it is left out", name, c.HandedOnly)
-		}
-		if len(c.Unplaced) != 0 || len(c.Filled) != 0 || len(c.Plans) != 0 {
-			t.Errorf("%s: unplaced %v, filled %v, plans %v", name, c.Unplaced, c.Filled, c.Plans)
-		}
-	}
-	// Where it is handed, the file is there and nothing is said.
-	c, _ := composeWith(t, withFile, handingTo("store:5000"))
-	if len(c.HandedOnly) != 0 || len(c.Filled) != 1 {
-		t.Fatalf("handed: said %q, filled %v", c.HandedOnly, c.Filled)
-	}
-}
-
-// What `module check` and the merge gate judge: the provider read from its tree, its text inline. Judged by the same
-// rules, a provider naming a provision it does not provide is refused there too, and one that does composes.
-func TestAProviderReadFromItsTreeIsJudgedByTheSameRules(t *testing.T) {
-	read := func(text string) (Manifest, error) {
-		dir := t.TempDir()
-		if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "files", "consumers.json"), []byte(text), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		m, err := ParseManifest([]byte(handedProvider))
-		if err != nil {
-			t.Fatal(err)
-		}
-		return WithTemplatesFrom(m, dir)
-	}
-	filled, err := read(consumersText)
-	if err != nil {
-		t.Fatalf("a provider read from its tree is refused: %v", err)
-	}
-	if _, err := notifierOn(t, filled).Compose(handingTo("store:5000")); err != nil {
-		t.Fatalf("a provider read from its tree does not compose where it would be handed: %v", err)
-	}
-	if _, err := read("${consumers:cache}"); err == nil || !strings.Contains(err.Error(), "does not provide") {
-		t.Fatalf("a provider read from its tree naming a provision it does not provide: %v", err)
-	}
-}
diff --git a/internal/catalogue/handed_merge_test.go b/internal/catalogue/handed_merge_test.go
deleted file mode 100644
index 32faf965..00000000
--- a/internal/catalogue/handed_merge_test.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// issue 831: a moved module's merging file is not handed (ADR 0349 clause 17, the lead's limit): the controller
-// fills and merges it as for a module not moved, and the module's other files stay handed.
-func TestAMovedModulesMergingFileIsFilledTheOldWayAndItsPlainFileIsHanded(t *testing.T) {
-	raw := strings.Replace(handedNotifier, `{"id":"legacy"`,
-		`{"id":"settings","type":"file","path":"${machine:account-home}/.config/notify/settings.json","owner":"${machine:account}","mode":"0644","template":"files/settings.json","merge":"json","takes-config":["width"]},
-    {"id":"legacy"`, 1)
-	moved := strings.Replace(raw, `"version":"1",`, `"version":"1","moved":true,`, 1)
-	built := []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + "notify/files/blobs/sha256:" + strings.Repeat("d", 64),
-		Digest:    "sha256:" + strings.Repeat("d", 64),
-		Texts:     map[string]string{"rc": notifierText, "settings.json": "{\"theme\": \"dark\"}\n"}}}
-	cb, _ := composeWith(t, notifierOn(t, held(t, raw, built)), handingTo("store:5000"))
-	c, got := composeWith(t, notifierOn(t, held(t, moved, built)), handingTo("store:5000"))
-	var merged, plain map[string]any
-	for _, r := range c.Resources {
-		switch r["id"] {
-		case "notify.settings":
-			merged = r
-		case "notify.configuration":
-			plain = r
-		}
-	}
-	if merged == nil || plain == nil {
-		t.Fatalf("not composed: %s", got)
-	}
-	if text, _ := merged["content"].(string); !strings.Contains(text, `"theme"`) || merged["owner-at-runtime"] != nil {
-		t.Fatalf("the merging file is not filled the old way: %v", merged)
-	}
-	if plain["content"] != nil || plain["owner-at-runtime"] != "owned" {
-		t.Fatalf("the plain file is not handed: %v", plain)
-	}
-	for _, p := range c.Filled {
-		if strings.HasSuffix(p, "settings.json") {
-			t.Fatalf("the merging file is named among the filled files: %v", c.Filled)
-		}
-	}
-	if len(c.Plans["notify"].Files) != 1 || c.Plans["notify"].Files[0].ID != "configuration" {
-		t.Fatalf("the plan is %+v", c.Plans)
-	}
-	if len(c.Unplaced) > 0 {
-		t.Fatalf("unplaced: %v", c.Unplaced)
-	}
-	// byte-identical to the not-moved composition
-	for _, r := range cb.Resources {
-		if r["id"] == "notify.settings" && !reflect.DeepEqual(r, merged) {
-			t.Fatalf("the merging file differs from the not-moved composition:\nbefore %v\nnow %v", r, merged)
-		}
-	}
-}
diff --git a/internal/catalogue/handed_providers_test.go b/internal/catalogue/handed_providers_test.go
deleted file mode 100644
index 22744f8a..00000000
--- a/internal/catalogue/handed_providers_test.go
+++ /dev/null
@@ -1,274 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A handed module's plan names the provider serving each provision it requires (design 57 V5a, issue 760): the
-// module on the machine resolution chose for this consumer, and the local name it keeps the credential under where
-// it keeps several, so the vault, which reads the plan in the assignments mirror, sees a consumer bind and unbind
-// (novox/hq ADR 0349 clause 8). One entry per provision and local name, the same entry that names a credential
-// the vault keeps for it alone (issue 757).
-
-// notifierConsumer is the notifier requiring a mesh-scoped database, marked moved when moved, with its credential
-// kept under two local names (ADR 0094) when locals is set.
-func notifierConsumer(t *testing.T, moved, locals bool) Manifest {
-	t.Helper()
-	raw := handedNotifier
-	if moved {
-		raw = notifierMoved()
-	}
-	add := `"requires":["postgres-database"],`
-	if locals {
-		add += `"secrets":{"postgres-database":{"hot":"/var/lib/notify/hot","cold":"/var/lib/notify/cold"}},`
-	}
-	raw = strings.Replace(raw, `"build":`, add+`"build":`, 1)
-	return held(t, raw, builtNotifier())
-}
-
-// twoStores is a mesh where two machines each run a store providing the database, the consumer pinned to one.
-func twoStores(pin string) World {
-	return World{Offered: map[string][]Provider{"postgres-database": {
-		{Node: "anchor", At: "anchor.internal", Module: "store", Serves: map[string]any{"port": 5432}},
-		{Node: "home", At: "home.internal", Module: "store-two", Serves: map[string]any{"port": 5434}},
-	}}, Pinned: map[string]Chosen{"postgres-database": {Node: pin}}}
-}
-
-func consumerOn(t *testing.T, m Manifest, w World) Resolution {
-	t.Helper()
-	node := workstation()
-	node.At = "workstation.internal"
-	stores := shelf(m,
-		Manifest{Module: "store", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
-			Serves: map[string]map[string]any{"postgres-database": {"port": 5432}}},
-		Manifest{Module: "store-two", Version: "1", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh}},
-			Serves: map[string]map[string]any{"postgres-database": {"port": 5434}}})
-	r, err := Resolve(stores, []string{m.Module}, node, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	return r
-}
-
-func TestAHandedModulesPlanNamesTheProviderServingEachProvision(t *testing.T) {
-	c, _ := composeWith(t, consumerOn(t, notifierConsumer(t, true, false), twoStores("anchor")), handingTo("store:5000"))
-	want := []PlanProvision{{Provision: "postgres-database", Provider: "anchor", ProviderModule: "store",
-		CredentialForm: CredentialFormPair, At: "anchor.internal", From: "anchor", As: ConsumerIdentity("workstation", "notify")}}
-	if got := c.Plans["notify"].Provisions; !reflect.DeepEqual(got, want) {
-		t.Fatalf("the plan names %+v, want %+v", got, want)
-	}
-
-	// **A changed binding changes the plan**: pinned to the other store, the plan names it and not the first.
-	c, _ = composeWith(t, consumerOn(t, notifierConsumer(t, true, false), twoStores("home")), handingTo("store:5000"))
-	want = []PlanProvision{{Provision: "postgres-database", Provider: "home", ProviderModule: "store-two",
-		CredentialForm: CredentialFormPair, At: "home.internal", From: "home", As: ConsumerIdentity("workstation", "notify")}}
-	if got := c.Plans["notify"].Provisions; !reflect.DeepEqual(got, want) {
-		t.Fatalf("rebound, the plan names %+v, want %+v", got, want)
-	}
-}
-
-// A consumer keeping one provider's credential under several local names is bound once per local name.
-func TestAHandedModulesPlanNamesEachLocalName(t *testing.T) {
-	c, _ := composeWith(t, consumerOn(t, notifierConsumer(t, true, true), twoStores("anchor")), handingTo("store:5000"))
-	want := []PlanProvision{
-		{Provision: "postgres-database", Local: "cold", Provider: "anchor", ProviderModule: "store",
-			CredentialForm: CredentialFormPair, At: "anchor.internal", From: "anchor", As: ConsumerIdentity("workstation", "notify")},
-		{Provision: "postgres-database", Local: "hot", Provider: "anchor", ProviderModule: "store",
-			CredentialForm: CredentialFormPair, At: "anchor.internal", From: "anchor", As: ConsumerIdentity("workstation", "notify")},
-	}
-	if got := c.Plans["notify"].Provisions; !reflect.DeepEqual(got, want) {
-		t.Fatalf("the plan names %+v, want %+v", got, want)
-	}
-}
-
-// A module not moved, or moved where it is not handed, composes as before and has no plan.
-func TestAConsumerNotHandedComposesAsBefore(t *testing.T) {
-	_, before := composeWith(t, consumerOn(t, notifierConsumer(t, false, false), twoStores("anchor")),
-		handingTo("store:5000"))
-	c, got := composeWith(t, consumerOn(t, notifierConsumer(t, true, false), twoStores("anchor")),
-		Rendering{Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"})
-	if got != before {
-		t.Fatalf("the moved consumer composes differently where it is not handed:\nbefore: %s\nnow:    %s", before, got)
-	}
-	if c.Plans != nil {
-		t.Fatalf("a consumer not handed has plans %+v", c.Plans)
-	}
-}
-
-// A credential the vault keeps for the holder alone is its provision's one entry, with its provider's module too.
-func TestAHandedModulesIssuedCredentialIsItsProvisionsOneEntry(t *testing.T) {
-	r := forgeReader(t, true, true)
-	r.Needs = append(r.Needs, Needed{Name: "s3-bucket", From: "ace", For: "bot", Module: "minio"},
-		Needed{Name: "openai", From: "personal", For: "bot", ByRecord: true})
-	c, _ := composeWith(t, r, handingTo("store:5000"))
-	got := c.Plans["bot"].Provisions
-	if len(got) != 2 || got[0].Provision != "forge-read" || got[0].Name != "forge-read" ||
-		got[0].ProviderModule != "forge" || got[0].Path == "" ||
-		!reflect.DeepEqual(got[1], PlanProvision{Provision: "s3-bucket", Provider: "ace", ProviderModule: "minio",
-			From: "ace", As: ConsumerIdentity("workstation", "bot")}) {
-		t.Fatalf("the plan names %+v: one entry per provision, the issued credential's with its name and file, "+
-			"none for a licence", got)
-	}
-}
-
-// Each entry names the credential form the provider's offer declares (issue 768), from the provider's manifest, so
-// the vault makes a first value in that form for a provider it holds no row of: one of its own secrets shared by
-// every consumer, a login per consumer when the offer says no credential, issued by its software, or given by a
-// person (the offer's own secret issued outside).
-func TestAHandedModulesPlanNamesTheCredentialFormOfItsProvidersOffer(t *testing.T) {
-	storeOffering := func(credential string) Manifest {
-		raw := `{"module":"store","version":"1","provides":[{"name":"postgres-database","scope":"mesh"` +
-			credential + `}],"serves":{"postgres-database":{"port":5432}}`
-		if strings.Contains(credential, `"own"`) {
-			raw += `,"own-secrets":{"admin":{"path":"/var/lib/store/admin","taken":"at-start"},` +
-				`"token":{"path":"/var/lib/store/token","taken":"at-start","issued-by":"outside"}}`
-		}
-		return mustParse(t, raw+`}`)
-	}
-	for credential, want := range map[string]string{
-		``:                                      CredentialFormPair,
-		`,"credential":{"own":"admin"}`:         CredentialFormShared,
-		`,"credential":{"own":"token"}`:         CredentialFormGiven,
-		`,"credential":{"issued-by":"outside"}`: CredentialFormGiven,
-		`,"credential":{"issued-by":"software","tool":"store_issued_token"}`: CredentialFormIssued,
-	} {
-		node := workstation()
-		node.At = "workstation.internal"
-		consumer := notifierConsumer(t, true, false)
-		r, err := Resolve(shelf(consumer, storeOffering(credential)), []string{consumer.Module}, node, twoStores("anchor"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		r.Account = "op"
-		c, _ := composeWith(t, r, handingTo("store:5000"))
-		got := c.Plans["notify"].Provisions
-		if len(got) != 1 || got[0].CredentialForm != want {
-			t.Errorf("an offer with %q: the plan names %+v, want the form %q", credential, got, want)
-		}
-	}
-	if got := (Manifest{Module: "x"}).CredentialFormOf("postgres-database"); got != "" {
-		t.Errorf("a module offering nothing has the credential form %q", got)
-	}
-}
-
-// A consumer's plan entry carries what its manifest contributes to that provision (issue 776), so the provider's
-// helper learns a database's name from the bus; a consumer contributing nothing has the entry it had.
-func TestAHandedModulesPlanEntryCarriesWhatItContributesToItsProvider(t *testing.T) {
-	m := notifierConsumer(t, true, false)
-	m.Contributes = map[string]map[string]any{"postgres-database": {"name": "nextcloud"}}
-	c, _ := composeWith(t, consumerOn(t, m, twoStores("anchor")), handingTo("store:5000"))
-	want := []PlanProvision{{Provision: "postgres-database", Provider: "anchor", ProviderModule: "store",
-		CredentialForm: CredentialFormPair, Contributes: map[string]any{"name": "nextcloud"}, At: "anchor.internal", From: "anchor", As: ConsumerIdentity("workstation", "notify"),
-		// What the binding file says as `${bound:postgres-database:name}` (issue 792).
-		Names: map[string]string{"name": "nextcloud"}}}
-	if got := c.Plans["notify"].Provisions; !reflect.DeepEqual(got, want) {
-		t.Fatalf("the plan names %+v, want %+v", got, want)
-	}
-
-	m = notifierConsumer(t, true, false)
-	c, _ = composeWith(t, consumerOn(t, m, twoStores("anchor")), handingTo("store:5000"))
-	raw, err := json.Marshal(c.Plans["notify"].Provisions)
-	if err != nil {
-		t.Fatal(err)
-	}
-	const before = `[{"provision":"postgres-database","provider":"anchor","provider-module":"store",` +
-		`"credential-form":"pair","at":"anchor.internal","from":"anchor","as":"mesh_workstation_notify"}]`
-	if string(raw) != before {
-		t.Fatalf("a consumer contributing nothing has the entry %s, want %s", raw, before)
-	}
-}
-
-// A consumer's plan entry carries the names the mesh composed for it through that provision (issue 792): what its
-// binding file names as `${bound:<provision>:name|internal-name|name-<local>|internal-name-<local>}`, so a moved
-// provider's helper copies them into the consumer's entry and the client fills the same text. A consumer
-// contributing no label has the entry it had.
-func TestAHandedModulesPlanEntryCarriesTheNamesComposedForIt(t *testing.T) {
-	m := notifierConsumer(t, true, false)
-	m.ContributesMany = map[string]map[string]map[string]any{
-		"postgres-database": {"web": {"label": "git"}, "api": {"label": "git-api"}}}
-	r := consumerOn(t, m, twoStores("anchor"))
-	r.PublicDomain = "example.org"
-	c, _ := composeWith(t, r, handingTo("store:5000"))
-	got := c.Plans["notify"].Provisions
-	if len(got) != 1 {
-		t.Fatalf("the plan names %+v", got)
-	}
-	want := map[string]string{"name-web": "git.example.org", "name-api": "git-api.example.org"}
-	own, err := r.ownNames(m, "postgres-database", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := map[string]string{}
-	withOwnNames(file, own)
-	for k, v := range file {
-		if strings.HasPrefix(k, "internal-") {
-			want[k] = v
-		}
-	}
-	if !reflect.DeepEqual(got[0].Names, want) {
-		t.Fatalf("the entry carries %v, the binding file names %v", got[0].Names, want)
-	}
-}
-
-// The flag a provides entry carries, `"answered-by": "helper"`, is read and written back, and refused with any other
-// word (issue 792). It is no part of moving the module: the flag alone hands none of the module's files, and the
-// module composes byte for byte as it did without it.
-func TestAnOfferAnsweredByTheHelperIsReadAndHandsNoFile(t *testing.T) {
-	with := strings.Replace(handedNotifier, `"version":"1",`,
-		`"version":"1","provides":[{"name":"route","scope":"mesh","answered-by":"helper"}],`, 1)
-	without := strings.Replace(handedNotifier, `"version":"1",`,
-		`"version":"1","provides":[{"name":"route","scope":"mesh"}],`, 1)
-	flagged := held(t, with, builtNotifier())
-	if flagged.Moved || len(flagged.Provides) != 1 || flagged.Provides[0].AnsweredBy != AnsweredByHelper {
-		t.Fatalf("the flag was read as %+v (moved %v)", flagged.Provides, flagged.Moved)
-	}
-	if flagged.Handed != nil {
-		t.Fatalf("the flag alone kept what a moved module's build keeps: %+v", flagged.Handed)
-	}
-	raw, err := json.Marshal(flagged.Provides[0])
-	if err != nil || !strings.Contains(string(raw), `"answered-by":"helper"`) {
-		t.Fatalf("written back as %s: %v", raw, err)
-	}
-	if _, err := ParseManifest([]byte(strings.Replace(with, `"helper"`, `"harness"`, 1))); err == nil {
-		t.Fatal("an unknown answerer was accepted")
-	}
-	c1, before := composeWith(t, notifierOn(t, held(t, without, builtNotifier())), handingTo("store:5000"))
-	c2, got := composeWith(t, notifierOn(t, flagged), handingTo("store:5000"))
-	if got != before || len(c2.Filled) > 0 || c2.Plans != nil || c1.Plans != nil {
-		t.Fatalf("the flag changed what is composed or handed:\nbefore: %s\nnow:    %s\n%v %v", before, got, c2.Filled, c2.Plans)
-	}
-}
-
-// A plan entry names the tool of an offer whose credential the provider's software issues (issue 928), so the vault
-// asks that tool for each holder; an offer of any other form names none.
-func TestAHandedModulesPlanNamesTheCredentialToolOfASoftwareIssuedOffer(t *testing.T) {
-	for credential, want := range map[string]string{
-		``:                                      "",
-		`,"credential":{"own":"admin"}`:         "",
-		`,"credential":{"issued-by":"outside"}`: "",
-		`,"credential":{"issued-by":"software","tool":"gitea_agent_token"}`: "gitea_agent_token",
-	} {
-		raw := `{"module":"store","version":"1","provides":[{"name":"postgres-database","scope":"mesh"` +
-			credential + `}],"serves":{"postgres-database":{"port":5432}}`
-		if strings.Contains(credential, `"own"`) {
-			raw += `,"own-secrets":{"admin":{"path":"/var/lib/store/admin","taken":"at-start"}}`
-		}
-		node := workstation()
-		node.At = "workstation.internal"
-		consumer := notifierConsumer(t, true, false)
-		r, err := Resolve(shelf(consumer, mustParse(t, raw+`}`)), []string{consumer.Module}, node, twoStores("anchor"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		r.Account = "op"
-		c, _ := composeWith(t, r, handingTo("store:5000"))
-		got := c.Plans["notify"].Provisions
-		if len(got) != 1 || got[0].CredentialTool != want {
-			t.Errorf("an offer with %q: the plan names %+v, want the tool %q", credential, got, want)
-		}
-	}
-}
diff --git a/internal/catalogue/handed_pulled_in_test.go b/internal/catalogue/handed_pulled_in_test.go
deleted file mode 100644
index cfec741f..00000000
--- a/internal/catalogue/handed_pulled_in_test.go
+++ /dev/null
@@ -1,121 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A module only pulled in by another is handed exactly like an assigned one (issue 765): its templated files, its
-// own secrets and its items go to the machine's provisioner client wherever the machine can take them. A module not
-// moved composes as before, pulled in or not.
-
-// pulledInBy is a module that requires what raw's module provides, so resolving it alone pulls that module in.
-const pulledInBy = `{"module":"desk","version":"1","requires":["pulled-in-here"]}`
-
-// providing is raw's module providing what desk requires.
-func providing(raw string) string {
-	return strings.Replace(raw, `"version":"1",`, `"version":"1","provides":[{"name":"pulled-in-here"}],`, 1)
-}
-
-// onWorkstation resolves m on the workstation either assigned beside desk, or pulled in by desk alone.
-func onWorkstation(t *testing.T, m Manifest, assigned bool) Resolution {
-	t.Helper()
-	desk, err := ParseManifest([]byte(pulledInBy))
-	if err != nil {
-		t.Fatal(err)
-	}
-	want := []string{"desk"}
-	if assigned {
-		want = append(want, m.Module)
-	}
-	r, err := Resolve(shelf(m, desk), want, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	why := map[bool]string{true: "assigned", false: "required by desk"}[assigned]
-	if r.Because[m.Module] != why {
-		t.Fatalf("%s is on the workstation because %q, want %q", m.Module, r.Because[m.Module], why)
-	}
-	r.Account = "op"
-	return r
-}
-
-// resourcesOf is the module's resources in a composition, as JSON.
-func resourcesOf(t *testing.T, c Composed, module string) string {
-	t.Helper()
-	var out []map[string]any
-	for _, r := range c.Resources {
-		if strings.HasPrefix(r["id"].(string), module+".") {
-			out = append(out, r)
-		}
-	}
-	raw, err := json.Marshal(out)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(raw)
-}
-
-func TestAModulePulledInIsHandedLikeAnAssignedOne(t *testing.T) {
-	for name, m := range map[string]struct {
-		module string
-		held   Manifest
-		with   Rendering
-	}{
-		"its templated file": {"notify", held(t, providing(notifierMoved()), builtNotifier()), handingTo("store:5000")},
-		"its own secret": {"bot", held(t, providing(botMoved()), builtBot(botText)),
-			sealedForBot(handingTo("store:5000"))},
-		"its item": {"prompt", held(t, providing(contributorP10k),
-			builtWith("prompt", map[string]string{"zsh": contributorText})), handingTo("store:5000")},
-	} {
-		assigned, _ := composeWith(t, onWorkstation(t, m.held, true), m.with)
-		pulled, got := composeWith(t, onWorkstation(t, m.held, false), m.with)
-		plan, handed := pulled.Plans[m.module]
-		if !handed {
-			t.Errorf("%s: a pulled-in moved module is not handed: plans %+v", name, pulled.Plans)
-			continue
-		}
-		if !reflect.DeepEqual(plan, assigned.Plans[m.module]) || !reflect.DeepEqual(pulled.Filled, assigned.Filled) {
-			t.Errorf("%s: pulled in, its plan is %+v and the filled files %v; assigned, %+v and %v", name, plan,
-				pulled.Filled, assigned.Plans[m.module], assigned.Filled)
-		}
-		if a, p := resourcesOf(t, assigned, m.module), resourcesOf(t, pulled, m.module); a != p {
-			t.Errorf("%s: pulled in, its resources are\n%s\nassigned,\n%s", name, p, a)
-		}
-		if strings.Contains(got, "sealed-to-the-node") || strings.Contains(got, "width = ") {
-			t.Errorf("%s: the controller filled or sealed something of a handed module: %s", name, got)
-		}
-	}
-}
-
-func TestAModulePulledInAndNotMovedComposesAsBefore(t *testing.T) {
-	for name, m := range map[string]Manifest{
-		"a file":   held(t, providing(handedNotifier), builtNotifier()),
-		"a secret": held(t, providing(handedBot), builtBot(botText)),
-	} {
-		_, before := composeWith(t, onWorkstation(t, m, false), sealedForBot(Rendering{ArtifactStore: "store:5000"}))
-		c, got := composeWith(t, onWorkstation(t, m, false), sealedForBot(handingTo("store:5000")))
-		if got != before || c.Plans != nil || len(c.Filled) > 0 {
-			t.Errorf("%s: a pulled-in module not moved composes differently where the machine hands:\nbefore: %s\nnow:    %s"+
-				"\nplans %v, filled %v", name, before, got, c.Plans, c.Filled)
-		}
-	}
-}
-
-// What requires a module pulled in is said by name, for its value in the assignments mirror; nothing for one
-// assigned.
-func TestAPulledInModuleSaysWhatRequiresIt(t *testing.T) {
-	m := held(t, providing(notifierMoved()), builtNotifier())
-	if by := onWorkstation(t, m, false).RequiredBy("notify"); by != "desk" {
-		t.Errorf("pulled in, notify is required by %q, want desk", by)
-	}
-	assigned := onWorkstation(t, m, true)
-	if by := assigned.RequiredBy("notify"); by != "" {
-		t.Errorf("assigned, notify is required by %q", by)
-	}
-	if by := assigned.RequiredBy("absent"); by != "" {
-		t.Errorf("a module not on the machine is required by %q", by)
-	}
-}
diff --git a/internal/catalogue/handed_secrets_test.go b/internal/catalogue/handed_secrets_test.go
deleted file mode 100644
index 5d06214e..00000000
--- a/internal/catalogue/handed_secrets_test.go
+++ /dev/null
@@ -1,252 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"slices"
-	"strings"
-	"testing"
-)
-
-// A moved module's own secrets come from the vault (novox/hq ADR 0349 clauses 7 and 11, design 57 V4, issue 647):
-// where the module is handed, its declaration carries no sealed value — each file holding a secret alone is placed
-// without one and filled by the client, and the plan names every secret its templates and those files need, by
-// name. Where it is not handed, and for every module not moved, the composition is byte for byte what it was.
-
-const (
-	handedBot = `{"module":"bot","version":"1",
-  "own-secrets":{"token":"${dir:state}/token"},
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"state","type":"directory","mode":"0700","place":"."},
-    {"id":"conf","type":"file","path":"/etc/bot/bot.conf","mode":"0640","template":"files/bot.conf"},
-    {"id":"daemon","type":"process","name":"bot","run":["bot"],"env":{"BOT_TOKEN_FILE":"${dir:state}/token"}}]}`
-	botText = "token = ${secret:token}\nhome = ${machine:account-home}\n"
-)
-
-func botMoved() string {
-	return strings.Replace(handedBot, `"version":"1",`, `"version":"1","moved":true,`, 1)
-}
-
-func builtBot(text string) []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + "bot/files/blobs/sha256:" + strings.Repeat("e", 64),
-		Digest:    "sha256:" + strings.Repeat("e", 64), Texts: map[string]string{"bot.conf": text}}}
-}
-
-// What the controller seals for the bot when it fills it the old way: a stand-in sealed value.
-func sealedForBot(with Rendering) Rendering {
-	with.Needed = map[string]map[string]string{"bot": {"token": "sealed-to-the-node"}}
-	return with
-}
-
-func TestAHandedModulesSecretsAreNamedAndNoValueIsSealed(t *testing.T) {
-	r := notifierOn(t, held(t, botMoved(), builtBot(botText)))
-	c, got := composeWith(t, r, handingTo("store:5000"))
-	if strings.Contains(got, "sealed") || strings.Contains(got, "${secret:") {
-		t.Fatalf("a handed module's declaration carries a sealed value or a secret placeholder: %s", got)
-	}
-	var token map[string]any
-	for _, res := range c.Resources {
-		if res["id"] == "bot.needs-token" {
-			token = res
-		}
-	}
-	if token == nil {
-		t.Fatalf("the token's file is not declared: %s", got)
-	}
-	if token["path"] == nil || strings.Contains(token["path"].(string), "${") || token["mode"] != "0600" ||
-		token["owner-at-runtime"] != "owned" || token[HandedSecretField] != nil {
-		t.Fatalf("the token's file is declared %v: placed, 0600, owned at runtime, no value", token)
-	}
-	path := token["path"].(string)
-	if !reflect.DeepEqual(c.Filled, []string{path, "/etc/bot/bot.conf"}) {
-		t.Fatalf("the filled files are %v", c.Filled)
-	}
-	if want := []PlanSecret{{Name: "token", Path: path}}; !reflect.DeepEqual(c.Plans["bot"].Secrets, want) {
-		t.Fatalf("the plan names secrets %+v, want %+v", c.Plans["bot"].Secrets, want)
-	}
-	// A process naming the token's file still restarts when its client writes it.
-	for _, res := range c.Resources {
-		if res["id"] == "bot.daemon" && !strings.Contains(strings.Join(stringsIn(res["restart-on"]), " "), "bot.needs-token") {
-			t.Errorf("the daemon does not restart on its token's file: %v", res["restart-on"])
-		}
-	}
-}
-
-// A secret only a template names is in the plan by name alone.
-func TestASecretOnlyATemplateNamesIsPlannedByName(t *testing.T) {
-	raw := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"},`,
-		`"own-secrets":{"token":"${dir:state}/token","api-key":"${dir:state}/api-key"},`, 1)
-	r := notifierOn(t, held(t, raw, builtBot(botText+"key = ${secret:api-key}\n")))
-	c, _ := composeWith(t, r, handingTo("store:5000"))
-	names := []string{}
-	for _, s := range c.Plans["bot"].Secrets {
-		names = append(names, s.Name)
-	}
-	if strings.Join(names, " ") != "api-key token" {
-		t.Fatalf("the plan names %v", c.Plans["bot"].Secrets)
-	}
-}
-
-// Nothing changes for a module that has not moved, nor for a moved one where it is not handed: its secrets are
-// sealed into the declaration as before.
-func TestAMovedModulesSecretsAreSealedAsBeforeWhereItIsNotHanded(t *testing.T) {
-	_, before := composeWith(t, notifierOn(t, held(t, handedBot, builtBot(botText))),
-		sealedForBot(handingTo("store:5000")))
-	if !strings.Contains(before, "sealed-to-the-node") {
-		t.Fatalf("the unmoved module is not sealed the old way: %s", before)
-	}
-	for name, with := range map[string]Rendering{
-		"an engine that does not take a filled file alone": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
-		"no provisioner client on the machine":             {Hands: true, ArtifactStore: "store:5000"},
-	} {
-		c, got := composeWith(t, notifierOn(t, held(t, botMoved(), builtBot(botText))), sealedForBot(with))
-		if got != before {
-			t.Errorf("%s: the moved module composes differently from its unmarked twin:\nbefore: %s\nnow:    %s",
-				name, before, got)
-		}
-		if len(c.Filled) > 0 || c.Plans != nil {
-			t.Errorf("%s: something was handed: %v %v", name, c.Filled, c.Plans)
-		}
-	}
-}
-
-func TestWhatAHandedModuleCannotHaveFromTheVaultIsRefused(t *testing.T) {
-	// A template naming a credential the module requires: a binding's, which moves with its provider.
-	requires := strings.Replace(botMoved(), `"own-secrets":`, `"requires":["database"],"secrets":{"database":"/etc/bot/db"},"own-secrets":`, 1)
-	r, err := Resolve(shelf(held(t, requires, builtBot("db = ${secret:database}\n")),
-		Manifest{Module: "db", Version: "1", Provides: []Offer{{Name: "database", Scope: ScopeNode}}}),
-		[]string{"bot"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	if _, err := r.Compose(handingTo("store:5000")); err == nil || !strings.Contains(err.Error(), "moves with its provider") {
-		t.Errorf("a template naming a required credential: %v", err)
-	}
-	// A file with its text inline naming a secret, in a handed module.
-	inline := strings.Replace(botMoved(), `{"id":"daemon"`,
-		`{"id":"legacy","type":"file","path":"/etc/bot/legacy","content":"t = ${secret:token}\n"},{"id":"daemon"`, 1)
-	r = notifierOn(t, held(t, inline, builtBot(botText)))
-	if _, err := r.Compose(handingTo("store:5000")); err == nil || !strings.Contains(err.Error(), "keep it in a template") {
-		t.Errorf("an inline file naming a secret in a handed module: %v", err)
-	}
-	// A family and a secret issued outside the mesh are not handed by name yet: the mark is refused.
-	for why, raw := range map[string]string{
-		"a family":       strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`, `"own-secrets":{"token":"${dir:state}/token","key-*":"${dir:state}/keys"}`, 1),
-		"issued outside": strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`, `"own-secrets":{"token":{"path":"${dir:state}/token","issued-by":"outside"}}`, 1),
-	} {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "design 57 V4") {
-			t.Errorf("a moved module with %s: %v", why, err)
-		}
-	}
-}
-
-// A credential of what a handed module requires that the vault keeps for it alone (issue 757): the forge's read
-// token for one agent, issued by the forge's software per holder. Where the module is handed, its file is declared
-// placed and without a value, and the plan names it with its provision and provider; anywhere else, and for a
-// credential the mesh makes, the composition is what it was.
-func forgeReader(t *testing.T, moved bool, issued bool) Resolution {
-	t.Helper()
-	raw := strings.Replace(handedBot, `"own-secrets":`,
-		`"requires":[{"name":"forge-read","optional":true}],"secrets":{"forge-read":"${dir:state}/forge.secret"},"own-secrets":`, 1)
-	if moved {
-		raw = strings.Replace(raw, `"version":"1",`, `"version":"1","moved":true,`, 1)
-	}
-	r := notifierOn(t, held(t, raw, builtBot(botText)))
-	r.Needs = append(r.Needs, Needed{Name: "forge-read", From: "novox", For: "bot", Module: "forge",
-		Sealed: "sealed-forge-read", IssuedToHolder: issued})
-	return r
-}
-
-func TestAHandedModulesCredentialIssuedForItIsNamedInItsPlanAndNoValueIsSealed(t *testing.T) {
-	c, got := composeWith(t, forgeReader(t, true, true), handingTo("store:5000"))
-	if strings.Contains(got, "sealed") || strings.Contains(got, HandedProvisionField) {
-		t.Fatalf("a handed module's declaration carries a sealed value or the marker: %s", got)
-	}
-	var file map[string]any
-	for _, res := range c.Resources {
-		if res["id"] == "bot."+SecretID("forge-read") {
-			file = res
-		}
-	}
-	if file == nil {
-		t.Fatalf("the credential's file is not declared: %s", got)
-	}
-	path, _ := file["path"].(string)
-	if path == "" || strings.Contains(path, "${") || file["mode"] != "0600" || file["owner-at-runtime"] != "owned" {
-		t.Fatalf("the credential's file is declared %v: placed, 0600, owned at runtime, no value", file)
-	}
-	if !strings.Contains(strings.Join(c.Filled, " "), path) {
-		t.Fatalf("the credential's file is not among the filled files %v", c.Filled)
-	}
-	want := []PlanProvision{{Name: "forge-read", Provision: "forge-read", Provider: "novox", ProviderModule: "forge",
-		Path: path, From: "novox", As: ConsumerIdentity("workstation", "bot")}}
-	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
-		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
-	}
-}
-
-func TestACredentialIssuedForAHolderIsSealedAsBeforeWhereItsModuleIsNotHanded(t *testing.T) {
-	_, before := composeWith(t, forgeReader(t, false, false), sealedForBot(handingTo("store:5000")))
-	if !strings.Contains(before, "sealed-forge-read") {
-		t.Fatalf("the unmoved module's credential is not sealed the old way: %s", before)
-	}
-	for why, r := range map[string]Resolution{
-		"a module not moved":                      forgeReader(t, false, true),
-		"a moved module whose credential is made": forgeReader(t, true, false),
-	} {
-		c, got := composeWith(t, r, sealedForBot(handingTo("store:5000")))
-		if !strings.Contains(got, "sealed-forge-read") {
-			t.Errorf("%s: the credential is not sealed the old way: %s", why, got)
-		}
-		// Its provider is named (issue 760), and no credential for the client to fill.
-		if p, ok := c.Plans["bot"]; ok && slices.ContainsFunc(p.Provisions, func(pr PlanProvision) bool {
-			return pr.Name != "" || pr.Path != ""
-		}) {
-			t.Errorf("%s: the plan names a credential to fill: %+v", why, p.Provisions)
-		}
-	}
-	c, got := composeWith(t, forgeReader(t, true, true), sealedForBot(Rendering{Provisioner: "mesh-provisioner-client",
-		ArtifactStore: "store:5000"}))
-	if !strings.Contains(got, "sealed-forge-read") || c.Plans != nil {
-		t.Errorf("where the engine does not take a filled file alone, the credential is not sealed the old way: %s", got)
-	}
-}
-
-// A handed consumer's own login from a provider that gives each consumer one (issue 779): the same entry as for an
-// issued credential, with the provider's form on it, and nothing sealed; where the consumer is not handed, the
-// login is sealed as it was.
-func TestAHandedConsumersOwnLoginFromAPerLoginProviderIsNamedInItsPlanAndNoValueIsSealed(t *testing.T) {
-	pair := func(handed bool) Resolution {
-		r := forgeReader(t, true, handed)
-		r.Needs[len(r.Needs)-1].CredentialForm = CredentialFormPair
-		return r
-	}
-	c, got := composeWith(t, pair(true), handingTo("store:5000"))
-	if strings.Contains(got, "sealed") || strings.Contains(got, HandedProvisionField) {
-		t.Fatalf("a handed consumer's declaration carries its login sealed or the marker: %s", got)
-	}
-	var path string
-	for _, res := range c.Resources {
-		if res["id"] == "bot."+SecretID("forge-read") {
-			path, _ = res["path"].(string)
-			if res["mode"] != "0600" || res["owner-at-runtime"] != "owned" || res["content"] != nil || res["sealed"] != nil {
-				t.Fatalf("the login's file is declared %v: placed, 0600, owned at runtime, no value", res)
-			}
-		}
-	}
-	if path == "" || !strings.Contains(strings.Join(c.Filled, " "), path) {
-		t.Fatalf("the login's file %q is not declared and filled: %v", path, c.Filled)
-	}
-	want := []PlanProvision{{Name: "forge-read", Provision: "forge-read", Provider: "novox", ProviderModule: "forge",
-		CredentialForm: CredentialFormPair, Path: path, From: "novox", As: ConsumerIdentity("workstation", "bot")}}
-	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
-		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
-	}
-	// Not marked as the vault's, the login is sealed as before.
-	_, before := composeWith(t, pair(false), sealedForBot(handingTo("store:5000")))
-	if !strings.Contains(before, "sealed-forge-read") {
-		t.Fatalf("a consumer whose login the vault does not keep for it has it sealed no more: %s", before)
-	}
-}
diff --git a/internal/catalogue/handed_test.go b/internal/catalogue/handed_test.go
deleted file mode 100644
index dbe3bec3..00000000
--- a/internal/catalogue/handed_test.go
+++ /dev/null
@@ -1,188 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// A module marked moved hands its templated files to the provisioner (novox/hq ADR 0349 §4, §6, §17, design 57 P6,
-// issue 672): on a machine whose node-engine takes a filled file on the client's word and that runs a client, each
-// is declared placed and without its text, named among the filled files, and planned for the client; anywhere
-// else, and for every module not marked, the composition is byte for byte what it was.
-
-const (
-	handedNotifier = `{"module":"notify","version":"1",
-  "config":{"width":{"type":"number","description":"How wide a notification is, in pixels.","default":250}},
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"configuration-dir","type":"directory","path":"${machine:account-home}/.config/notify","owner":"${machine:account}","mode":"0755"},
-    {"id":"configuration","type":"file","path":"${machine:account-home}/.config/notify/rc","owner":"${machine:account}","mode":"0644","template":"files/rc"},
-    {"id":"legacy","type":"file","path":"/etc/notify.conf","content":"plain = yes\n"},
-    {"id":"notifier","type":"service","unit":"notify.service","scope":"user","user":"${machine:account}","reload-on":["configuration"]}]}`
-	notifierText = "width = ${config:width}\nhome = ${machine:account-home}\n"
-)
-
-func notifierMoved() string {
-	return strings.Replace(handedNotifier, `"version":"1",`, `"version":"1","moved":true,`, 1)
-}
-
-func builtNotifier() []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + "notify/files/blobs/sha256:" + strings.Repeat("d", 64),
-		Digest:    "sha256:" + strings.Repeat("d", 64), Texts: map[string]string{"rc": notifierText}}}
-}
-
-func notifierOn(t *testing.T, m Manifest) Resolution {
-	t.Helper()
-	r, err := Resolve(shelf(m), []string{m.Module}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r.Account = "op"
-	return r
-}
-
-func composeWith(t *testing.T, r Resolution, with Rendering) (Composed, string) {
-	t.Helper()
-	c, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, err := json.Marshal(c.Resources)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return c, string(raw)
-}
-
-func handingTo(store string) Rendering {
-	return Rendering{Hands: true, Provisioner: "mesh-provisioner-client", ArtifactStore: store}
-}
-
-func TestAMovedModulesBuildKeepsWhatTheProvisionerNeeds(t *testing.T) {
-	m := held(t, notifierMoved(), builtNotifier())
-	want := &Handed{Source: ArtifactStoreScheme + "notify/files/blobs/sha256:" + strings.Repeat("d", 64),
-		Digest: "sha256:" + strings.Repeat("d", 64), Templates: map[string]string{"configuration": "rc"}}
-	if !reflect.DeepEqual(m.Handed, want) {
-		t.Fatalf("the build kept %+v, want %+v", m.Handed, want)
-	}
-	if notMoved := held(t, handedNotifier, builtNotifier()); notMoved.Handed != nil {
-		t.Fatalf("a module not marked moved kept %+v", notMoved.Handed)
-	}
-}
-
-// Nothing changes for a module that has not moved, nor for a moved one where it cannot be handed.
-func TestAMovedModuleComposesAsBeforeWhereItIsNotHanded(t *testing.T) {
-	_, before := composeWith(t, notifierOn(t, held(t, handedNotifier, builtNotifier())), handingTo("store:5000"))
-	for name, with := range map[string]Rendering{
-		"an engine that does not take a filled file alone": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
-		"no provisioner client on the machine":             {Hands: true, ArtifactStore: "store:5000"},
-	} {
-		c, got := composeWith(t, notifierOn(t, held(t, notifierMoved(), builtNotifier())), with)
-		if got != before {
-			t.Errorf("%s: the moved module composes differently from its unmarked twin:\nbefore: %s\nnow:    %s",
-				name, before, got)
-		}
-		if len(c.Filled) > 0 || c.Plans != nil {
-			t.Errorf("%s: something was handed: %v %v", name, c.Filled, c.Plans)
-		}
-	}
-	if !strings.Contains(before, `width = 250`) {
-		t.Fatalf("the unmarked module is not filled the old way: %s", before)
-	}
-}
-
-func TestAMovedModulesTemplatedFileIsHandedToTheProvisioner(t *testing.T) {
-	c, got := composeWith(t, notifierOn(t, held(t, notifierMoved(), builtNotifier())), handingTo("store:5000"))
-	var file, legacy, dir map[string]any
-	for _, r := range c.Resources {
-		switch r["id"] {
-		case "notify.configuration":
-			file = r
-		case "notify.legacy":
-			legacy = r
-		case "notify.configuration-dir":
-			dir = r
-		}
-	}
-	if file == nil || legacy == nil || dir == nil {
-		t.Fatalf("not composed: %s", got)
-	}
-	wantFile := map[string]any{"id": "notify.configuration", "type": "file", "path": "/home/op/.config/notify/rc",
-		"owner": "op", "mode": "0644", "owner-at-runtime": "owned"}
-	if !reflect.DeepEqual(file, wantFile) {
-		t.Fatalf("the handed file is declared %v, want %v (placed, no text, owned at runtime)", file, wantFile)
-	}
-	if legacy["content"] != "plain = yes\n" || legacy["owner-at-runtime"] != nil {
-		t.Fatalf("a file with its text inline is not composed the old way: %v", legacy)
-	}
-	if dir["path"] != "/home/op/.config/notify" {
-		t.Fatalf("the module's other resources are not placed as before: %v", dir)
-	}
-	if strings.Contains(got, "width = ") {
-		t.Fatalf("the controller filled the handed file: %s", got)
-	}
-	if !reflect.DeepEqual(c.Filled, []string{"/home/op/.config/notify/rc"}) {
-		t.Fatalf("filled files %v", c.Filled)
-	}
-	want := map[string]Plan{"notify": {
-		Templates: PlanTemplates{Source: "http://store:5000/v2/notify/files/blobs/sha256:" + strings.Repeat("d", 64),
-			Digest: "sha256:" + strings.Repeat("d", 64)},
-		Files: []PlanFile{{ID: "configuration", Path: "/home/op/.config/notify/rc", Template: "rc",
-			OwnerAtRuntime: "owned", Takes: "reload-on"}},
-		Placement: map[string]string{"machine:account-home": "/home/op"},
-	}}
-	if !reflect.DeepEqual(c.Plans, want) {
-		t.Fatalf("the plans are %+v, want %+v", c.Plans, want)
-	}
-}
-
-func TestAMovedModulesMarkIsJudged(t *testing.T) {
-	for name, raw := range map[string]string{
-		"marked moved and naming no template": `{"module":"bare","version":"1","moved":true,
-  "resources":[{"id":"conf","type":"file","path":"/etc/bare","content":"x"}]}`,
-		"handed written in a repository": `{"module":"bare","version":"1","moved":true,
-  "handed":{"source":"s","digest":"d","templates":{}},
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"conf","type":"file","path":"/etc/bare","template":"files/bare"}]}`,
-		"handed and not moved": `{"module":"bare","version":"1",
-  "handed":{"source":"s","digest":"d","templates":{}},
-  "resources":[{"id":"conf","type":"file","path":"/etc/bare","content":"x"}]}`,
-	} {
-		if _, err := ParseManifest([]byte(raw)); err == nil {
-			t.Errorf("%s: accepted", name)
-		}
-	}
-}
-
-// What `module check` and the merge gate judge: a moved module read from its tree, its text inline. It is still
-// marked moved, and composes as before, since nothing of its build's archive is there to hand.
-func TestAMovedModuleReadFromItsTreeIsJudgedAsItComposesUnhanded(t *testing.T) {
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "files", "rc"), []byte(notifierText), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest([]byte(notifierMoved()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	filled, err := WithTemplatesFrom(m, dir)
-	if err != nil {
-		t.Fatalf("a moved module read from its tree is refused: %v", err)
-	}
-	if !filled.Moved || filled.Handed != nil {
-		t.Fatalf("read from its tree: moved %v, handed %+v", filled.Moved, filled.Handed)
-	}
-	_, got := composeWith(t, notifierOn(t, filled), handingTo("store:5000"))
-	_, want := composeWith(t, notifierOn(t, held(t, handedNotifier, builtNotifier())), handingTo("store:5000"))
-	if got != want {
-		t.Fatalf("read from its tree it composes differently:\nwant: %s\ngot:  %s", want, got)
-	}
-}
diff --git a/internal/catalogue/health_test.go b/internal/catalogue/health_test.go
deleted file mode 100644
index c5a68de1..00000000
--- a/internal/catalogue/health_test.go
+++ /dev/null
@@ -1,217 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/validate"
-)
-
-// A module says how each long-running resource is ready (novox/hq ADR 0240 rule 2, to-be 48 §8): `module
-// check` refuses each part out of its bounds, each endpoint named by a port or an address, a tool the
-// module does not serve, and a tool check alone — a test per refusal.
-
-const healthDigest = "@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-
-// healthManifest is a module of one web container, one running service and one step, with the health
-// given on the container (or on the resource named by on).
-func healthManifest(t *testing.T, on string, health map[string]any, more ...map[string]any) []byte {
-	t.Helper()
-	resources := []map[string]any{
-		{"id": "server", "type": "container", "name": "app-server", "image": "registry.example/app" + healthDigest,
-			"ports": []any{"8080"}},
-		{"id": "daemon", "type": "service", "unit": "app.service", "state": "running"},
-		{"id": "seed", "type": "container", "name": "app-seed", "image": "registry.example/app" + healthDigest,
-			"run-once": true},
-		{"id": "sweep", "type": "container", "name": "app-sweep", "image": "registry.example/app" + healthDigest,
-			"schedule": "0 3 * * *"},
-	}
-	resources = append(resources, more...)
-	for _, r := range resources {
-		if r["id"] == on && health != nil {
-			r["health"] = health
-		}
-	}
-	m := map[string]any{"module": "app", "requires": []any{"postgres-database"}, "tools": []any{"app_status"},
-		"listens": []any{
-			map[string]any{"name": "web", "port": 8080, "from": "mesh"},
-			map[string]any{"name": "beacon", "port": 9999, "protocol": "udp", "from": "mesh"},
-		},
-		"resources": resources}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-func TestAWellFormedHealthIsAccepted(t *testing.T) {
-	for _, h := range []map[string]any{
-		{"kind": "http", "endpoint": "web", "path": "/healthz", "status": 200, "body": "ok", "needs": "postgres-database"},
-		{"kind": "tcp", "endpoint": "web", "interval": "10s", "timeout": "2s", "looks": 2, "grace": "0s"},
-		{"kind": "runtime"},
-		{"kind": "exec", "command": "pg_isready -q", "grace": "4m", "looks": 2, "interval": "30s"},
-	} {
-		if _, err := ParseManifest(healthManifest(t, "server", h)); err != nil {
-			t.Errorf("%v was refused: %v", h, err)
-		}
-	}
-	if _, err := ParseManifest(healthManifest(t, "daemon", map[string]any{"kind": "unit"})); err != nil {
-		t.Errorf("a service's own readiness was refused: %v", err)
-	}
-	// A tool beside a check of another kind on the module.
-	raw := healthManifest(t, "server", map[string]any{"kind": "http", "endpoint": "web"},
-		map[string]any{"id": "admin", "type": "service", "unit": "app-admin.service", "state": "running",
-			"health": map[string]any{"kind": "tool", "tool": "app_status"}})
-	if _, err := ParseManifest(raw); err != nil {
-		t.Errorf("a tool check beside an http check was refused: %v", err)
-	}
-}
-
-func TestEveryOutOfBoundsHealthIsRefusedByName(t *testing.T) {
-	cases := []struct {
-		name   string
-		on     string
-		health map[string]any
-		says   string
-	}{
-		{"no kind", "server", map[string]any{"endpoint": "web"}, "with no kind"},
-		{"an unknown kind", "server", map[string]any{"kind": "ping"}, `of kind "ping"`},
-		{"a port", "server", map[string]any{"kind": "tcp", "port": 8080}, "names a port"},
-		{"an address", "server", map[string]any{"kind": "http", "endpoint": "web", "address": "127.0.0.1"}, "names a address"},
-		{"a url", "server", map[string]any{"kind": "http", "url": "http://localhost:8080/"}, "names a url"},
-		{"an unknown key", "server", map[string]any{"kind": "tcp", "endpoint": "web", "retries": 3}, `"retries"`},
-		{"no endpoint", "server", map[string]any{"kind": "http"}, "names no endpoint"},
-		{"an undeclared endpoint", "server", map[string]any{"kind": "tcp", "endpoint": "admin"}, "does not declare"},
-		{"a udp endpoint", "server", map[string]any{"kind": "tcp", "endpoint": "beacon"}, "a check connects over tcp"},
-		{"an interval under the floor", "server", map[string]any{"kind": "tcp", "endpoint": "web", "interval": "5s", "timeout": "1s"}, "no more often than every 10s"},
-		{"a timeout of the interval", "server", map[string]any{"kind": "tcp", "endpoint": "web", "interval": "10s", "timeout": "10s"}, "under its interval"},
-		{"one failing look", "server", map[string]any{"kind": "tcp", "endpoint": "web", "looks": 1}, "at least 2"},
-		{"a grace and looks past five minutes", "server", map[string]any{"kind": "tcp", "endpoint": "web", "grace": "4m", "looks": 3, "interval": "30s"}, "at most 5m0s"},
-		{"a duration that is not one", "server", map[string]any{"kind": "tcp", "endpoint": "web", "interval": "often"}, "is a duration"},
-		{"looks that are not a number", "server", map[string]any{"kind": "tcp", "endpoint": "web", "looks": "three"}, "whole number"},
-		{"a path without a slash", "server", map[string]any{"kind": "http", "endpoint": "web", "path": "health"}, "starts with /"},
-		{"a status that is not one", "server", map[string]any{"kind": "http", "endpoint": "web", "status": 700}, "is not one"},
-		{"a scheme that is not one", "server", map[string]any{"kind": "http", "endpoint": "web", "scheme": "ftp"}, "http or https"},
-		{"a status on a tcp check", "server", map[string]any{"kind": "tcp", "endpoint": "web", "status": 200}, "only an http check has"},
-		{"an exec with no command", "server", map[string]any{"kind": "exec"}, "says no command"},
-		{"a command on an http check", "server", map[string]any{"kind": "http", "endpoint": "web", "command": "true"}, "only an exec check runs"},
-		{"a runtime check on a service", "daemon", map[string]any{"kind": "runtime"}, "only a container has"},
-		{"a unit check on a container", "server", map[string]any{"kind": "unit"}, "a service's or a process's"},
-		{"a tool the module does not serve", "server", map[string]any{"kind": "tool", "tool": "app_admin"}, "does not serve"},
-		{"a tool check alone", "server", map[string]any{"kind": "tool", "tool": "app_status"}, "judges itself only by its own tool"},
-		{"needs not required", "server", map[string]any{"kind": "tcp", "endpoint": "web", "needs": "redis"}, "does not require"},
-		{"health on a step", "seed", map[string]any{"kind": "runtime"}, "does not stay up"},
-		{"health on a schedule", "sweep", map[string]any{"kind": "runtime"}, "does not stay up"},
-		{"health that is not an object", "server", nil, "is an object"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			raw := healthManifest(t, c.on, c.health)
-			if c.health == nil {
-				raw = []byte(strings.Replace(string(raw), `"name":"app-server"`, `"name":"app-server","health":"tcp"`, 1))
-			}
-			_, err := ParseManifest(raw)
-			if err == nil {
-				t.Fatalf("%s was accepted", c.name)
-			}
-			if !strings.Contains(err.Error(), c.says) {
-				t.Errorf("refused, but not for saying %q: %v", c.says, err)
-			}
-		})
-	}
-}
-
-func TestHealthIsComposedAsThePortThisMachineGaveTheEndpoint(t *testing.T) {
-	m, err := ParseManifest(healthManifest(t, "server", map[string]any{"kind": "http", "endpoint": "web", "path": "/healthz",
-		"needs": "postgres-database"}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	compose := func(with Rendering) map[string]any {
-		out, err := Resolution{Node: "laptop", Modules: []Manifest{m}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		at := indexOfID(out, "app.server")
-		if at < 0 {
-			t.Fatal("the container was lost")
-		}
-		return out[at]
-	}
-	// An engine older than the field is not sent it: it would refuse the whole declaration.
-	if h, sent := compose(Rendering{Ports: map[string]map[int]int{"app": {8080: 31001}}})["health"]; sent {
-		t.Fatalf("health was sent to an engine that does not read it: %v", h)
-	}
-	got := compose(Rendering{ReadsHealth: true, Ports: map[string]map[int]int{"app": {8080: 31001}}})["health"].(map[string]any)
-	if got["port"] != 31001 || got["endpoint"] != "web" || got["path"] != "/healthz" || got["needs"] != "postgres-database" {
-		t.Errorf("composed as %v", got)
-	}
-	if got["interval"] != "30s" || got["timeout"] != "5s" || got["looks"] != 3 || got["grace"] != "1m0s" {
-		t.Errorf("the defaults were not written out: %v", got)
-	}
-	// The port this machine gives the endpoint moves, and the check moves with it.
-	moved := compose(Rendering{ReadsHealth: true, Ports: map[string]map[int]int{"app": {8080: 31002}}})["health"].(map[string]any)
-	if moved["port"] != 31002 {
-		t.Errorf("after the port moved the check still dials %v", moved["port"])
-	}
-	// And the catalogue's manifest is untouched by composing it.
-	if _, ok := m.Resources[0]["health"].(map[string]any)["port"]; ok {
-		t.Error("composing wrote the port into the catalogue's own manifest")
-	}
-}
-
-func TestTheUndeclaredAreTheLongRunningWithoutHealth(t *testing.T) {
-	m, err := ParseManifest(healthManifest(t, "server", map[string]any{"kind": "runtime"}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := strings.Join(Undeclared(m), ","); got != "daemon" {
-		t.Errorf("undeclared: %q; the step and the schedule are not long-running, the server declares", got)
-	}
-}
-
-func TestATooledHealthIsGrantedToTheEngine(t *testing.T) {
-	raw := healthManifest(t, "server", map[string]any{"kind": "http", "endpoint": "web"},
-		map[string]any{"id": "admin", "type": "service", "unit": "app-admin.service", "state": "running",
-			"health": map[string]any{"kind": "tool", "tool": "app_status"}})
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := HealthChecks(m); len(got) != 1 || got[0] != "app.app_status" {
-		t.Errorf("checks %v", got)
-	}
-}
-
-// What the controller composes the node-engine takes: every kind, composed for an engine that reads it,
-// passes the engine's own validator (mesh-host/validate) — one set of words on both sides.
-func TestEveryComposedHealthIsOneTheNodeEngineTakes(t *testing.T) {
-	for _, h := range []map[string]any{
-		{"kind": "http", "endpoint": "web", "path": "/healthz", "status": 200, "body": "ok", "needs": "postgres-database"},
-		{"kind": "tcp", "endpoint": "web", "interval": "10s", "timeout": "2s", "looks": 2, "grace": "0s"},
-		{"kind": "runtime"},
-		{"kind": "exec", "command": "pg_isready -q"},
-	} {
-		m, err := ParseManifest(healthManifest(t, "server", h,
-			map[string]any{"id": "admin", "type": "service", "unit": "app-admin.service", "state": "running",
-				"health": map[string]any{"kind": "tool", "tool": "app_status"}}))
-		if err != nil {
-			t.Fatal(err)
-		}
-		m.Resources[1]["health"] = map[string]any{"kind": "unit"}
-		out, err := Resolution{Node: "laptop", Modules: []Manifest{m}}.Declaration(Rendering{ReadsHealth: true,
-			Ports: map[string]map[int]int{"app": {8080: 31001}}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": out})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if problems := validate.Declaration(body); len(problems) > 0 {
-			t.Errorf("%v composed into something the node-engine refuses: %v", h, problems)
-		}
-	}
-}
diff --git a/internal/catalogue/holdings_test.go b/internal/catalogue/holdings_test.go
deleted file mode 100644
index 01594905..00000000
--- a/internal/catalogue/holdings_test.go
+++ /dev/null
@@ -1,194 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// **A seat's holder on record settles who holds it, and lets the next holder stand beside the
-// current one** (novox/hq ADR 0131, design 28 task 5.3). Until the record existed, two assignments
-// whose modules both claimed a seat were refused outright — which left no way to hand a seat over
-// without a moment where nobody held it, and the control plane finds its own bus through one of
-// these seats. That moment was the outage of 2026-09-27.
-
-func busSeatDelivering(t *testing.T, delivers string) {
-	t.Helper()
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: delivers, Decision: "test"}})
-}
-
-func oldBroker() Manifest {
-	return Manifest{Module: "old-broker", Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
-}
-
-func newBroker() Manifest {
-	return Manifest{Module: "new-broker", Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
-}
-
-// Nothing on record: exactly the old rule. One claimant holds; two are refused.
-func TestWithNoHolderOnRecordTheSoleClaimantHoldsAndTwoAreRefused(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	node := Node{Name: "anchor"}
-
-	held, problems := checkClaims([]Manifest{oldBroker()}, node, nil, nil)
-	if len(problems) != 0 || len(held) != 1 || held[0].Module != "old-broker" {
-		t.Fatalf("a sole claimant did not hold the seat: held=%v problems=%v", held, problems)
-	}
-	_, problems = checkClaims([]Manifest{oldBroker(), newBroker()}, node, nil, nil)
-	if len(problems) != 1 || !strings.Contains(problems[0], "both claim") {
-		t.Fatalf("two claimants with nothing on record were not refused: %v", problems)
-	}
-}
-
-// With a holder on record, the other eligible assignment is silent: not refused, and not holding.
-func TestTheHolderOnRecordHoldsAndTheOtherClaimantStandsBesideIt(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	node := Node{Name: "anchor"}
-	record := []Held{{Claim: "mesh-broker", Scope: ScopeMesh, Node: "anchor", Module: "new-broker"}}
-
-	held, problems := checkClaims([]Manifest{oldBroker(), newBroker()}, node, nil, record)
-	if len(problems) != 0 {
-		t.Fatalf("the assignment beside the holder was refused: %v", problems)
-	}
-	if len(held) != 1 || held[0].Module != "new-broker" {
-		t.Fatalf("the holder on record is not the one holding: %v", held)
-	}
-}
-
-// The record names a node too: an eligible module on another machine holds nothing, and its
-// machine's set still resolves.
-func TestAHolderOnRecordElsewhereLeavesThisMachinesClaimantSilent(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	record := []Held{{Claim: "mesh-broker", Scope: ScopeMesh, Node: "anchor", Module: "new-broker"}}
-
-	held, problems := checkClaims([]Manifest{oldBroker()}, Node{Name: "laptop"}, nil, record)
-	if len(problems) != 0 || len(held) != 0 {
-		t.Fatalf("a claimant elsewhere than the recorded holder was not simply silent: held=%v problems=%v",
-			held, problems)
-	}
-}
-
-// A record naming a seat's former name still applies to it after a rename (ADR 0122).
-func TestAHolderRecordedUnderAFormerNameStillHolds(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	wasAliases := aliases
-	t.Cleanup(func() { UseAliases(wasAliases) })
-	UseAliases(map[string]string{"the-broker": "mesh-broker"})
-	record := []Held{{Claim: "the-broker", Scope: ScopeMesh, Node: "anchor", Module: "new-broker"}}
-
-	held, problems := checkClaims([]Manifest{oldBroker(), newBroker()}, Node{Name: "anchor"}, nil, record)
-	if len(problems) != 0 || len(held) != 1 || held[0].Module != "new-broker" {
-		t.Fatalf("a record under the former name did not settle the seat: held=%v problems=%v", held, problems)
-	}
-}
-
-// CanHold is the one judgement registration and the handover share, against the store's row.
-func TestCanHoldJudgesClaimScopeAndWhatTheSeatDelivers(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	seat, _ := SeatNamed("mesh-broker")
-
-	if err := CanHold(newBroker(), seat); err != nil {
-		t.Fatalf("a module that claims the seat and provides what it delivers was refused: %v", err)
-	}
-	noClaim := Manifest{Module: "quiet", Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh}}}
-	if err := CanHold(noClaim, seat); err == nil || !strings.Contains(err.Error(), "does not claim") {
-		t.Fatalf("a module that never claimed the seat was allowed to hold it: %v", err)
-	}
-	wrongScope := newBroker()
-	wrongScope.Claims[0].Scope = ScopeNode
-	if err := CanHold(wrongScope, seat); err == nil || !strings.Contains(err.Error(), "scope") {
-		t.Fatalf("a claim at the wrong scope was allowed: %v", err)
-	}
-	cannotAnswer := Manifest{Module: "amqp-only", Provides: []Offer{{Name: "amqp", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
-	if err := CanHold(cannotAnswer, seat); err == nil || !strings.Contains(err.Error(), `does not provide "mesh-bus"`) {
-		t.Fatalf("a holder that cannot answer for the seat was allowed: %v", err)
-	}
-	// A holder's own tools need not be the seat's verbs: the claim may name what it serves for the
-	// role (ADR 0160), and then only those count — and only the seat's verbs may be named.
-	promising := seat
-	promising.Serves = []Verb{{Name: "databases"}, {Name: "query"}}
-	engine := newBroker()
-	engine.Tools = []string{"engine_list_databases", "engine_query"}
-	if err := CanHold(engine, promising); err == nil || !strings.Contains(err.Error(), "does not serve databases, query") {
-		t.Fatalf("a holder whose tools are not the seat's verbs was allowed without saying what it serves: %v", err)
-	}
-	engine.Claims[0].Serves = []string{"databases", "query"}
-	if err := CanHold(engine, promising); err != nil {
-		t.Fatalf("a claim naming the seat's verbs was refused: %v", err)
-	}
-	engine.Claims[0].Serves = []string{"databases"}
-	if err := CanHold(engine, promising); err == nil || !strings.Contains(err.Error(), "does not serve query") {
-		t.Fatalf("a claim naming half the verbs was allowed: %v", err)
-	}
-	engine.Claims[0].Serves = []string{"databases", "query", "engine_query"}
-	if err := CanHold(engine, promising); err == nil || !strings.Contains(err.Error(), "does not promise") {
-		t.Fatalf("a claim naming a verb the seat never promised was allowed: %v", err)
-	}
-	// And the judgement follows the store's row, not a compiled copy.
-	busSeatDelivering(t, "amqp")
-	seat, _ = SeatNamed("mesh-broker")
-	if err := CanHold(cannotAnswer, seat); err != nil {
-		t.Fatalf("with the row saying amqp, an amqp provider was refused: %v", err)
-	}
-}
-
-// A machine being moved is handed its membership for the new bus as a sealed file in its own
-// declaration — the machine's, not any module's (design 28, task 5.2).
-func TestAMembershipForTheNewBusIsComposedAsASealedFile(t *testing.T) {
-	r := Resolution{Node: "anchor"}
-	got, err := r.Compose(Rendering{BusMembership: "sealed-blob"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var found map[string]any
-	for _, res := range got.Resources {
-		if res["id"] == BusMembershipID() {
-			found = res
-		}
-	}
-	if found == nil {
-		t.Fatalf("no membership resource in %v", got.Resources)
-	}
-	if found["path"] != BusMembershipPath || found["sealed"] != "sealed-blob" || found["mode"] != "0600" {
-		t.Fatalf("the membership is not a sealed 0600 file where the host reads it: %v", found)
-	}
-	// And a machine not being moved is handed nothing.
-	got, _ = r.Compose(Rendering{})
-	for _, res := range got.Resources {
-		if res["id"] == BusMembershipID() {
-			t.Fatal("a machine with no membership on record was handed one")
-		}
-	}
-}
-
-// The store's seat rows have no protocol columns yet; loading them must not drop the protocol the
-// bus is derived from, or no role's work queue is ever raised (found live, 2026-09-28).
-func TestAStoreRowWithoutAProtocolKeepsTheCompiledOne(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	UseSeats([]Seat{{Name: "mesh-build-machine", Scope: ScopeMesh, Decision: "row"}})
-	got, ok := SeatNamed("mesh-build-machine")
-	if !ok || len(got.Accepts) == 0 {
-		t.Fatalf("the build machine's seat lost what it accepts when loaded from the store: %+v", got)
-	}
-	if got.Decision != "row" {
-		t.Fatalf("the store's own columns were not kept: %+v", got)
-	}
-}
-
-func TestARefusalWithNothingOnRecordNamesTheHandover(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	elsewhere := []Held{{Claim: "mesh-broker", Scope: ScopeMesh, Node: "anchor", Module: "old-broker"}}
-
-	_, problems := checkClaims([]Manifest{newBroker()}, Node{Name: "laptop"}, elsewhere, nil)
-	if len(problems) != 1 {
-		t.Fatalf("two derived claimants across machines were not refused: %v", problems)
-	}
-	if !strings.Contains(problems[0], "`seat mesh-broker --to anchor/old-broker`") {
-		t.Fatalf("the refusal does not name the handover that records the holder: %s", problems[0])
-	}
-}
diff --git a/internal/catalogue/holds_test.go b/internal/catalogue/holds_test.go
deleted file mode 100644
index 2a39fb71..00000000
--- a/internal/catalogue/holds_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0377 §3: a move under a module's own `record` rolls out when it recreates none of its containers
-// and moves none of its data, judged from the two builds' manifests.
-func TestWhatAMoveUnderRecordHoldsFor(t *testing.T) {
-	base := func() Manifest {
-		raw := `{"module":"mailu","tools":["mailu_status"],
-		  "requires":["postgres-database"],
-		  "data":{"own":[{"id":"mail","path":"${dir:data-mail}","class":"valuable"}]},
-		  "bundles":[{"name":"tools","source":"store/mailu-tools@sha256:aaa","digest":"sha256:aaa"}],
-		  "resources":[
-		    {"id":"state","type":"directory"},
-		    {"id":"mesh-state","type":"directory"},
-		    {"id":"data-mail","type":"directory"},
-		    {"id":"config-env","type":"file","path":"${dir:state}/mailu.env","content":"A=1"},
-		    {"id":"runtime-config","type":"file","path":"${dir:mesh-state}/config.json","content":"{}"},
-		    {"id":"inbox-note","type":"file","path":"${dir:data-mail}/README","content":"x"},
-		    {"id":"imap","type":"container","image":"registry/imap@sha256:1","volumes":["${dir:data-mail}:/mail"],
-		     "env-file":["${dir:state}/mailu.env"]},
-		    {"id":"watcher","type":"process","command":"watch"},
-		    {"id":"installation","type":"archive","path":"/opt/mailu-tools","artifact":"archive"},
-		    {"id":"guard","type":"package","package":"nftables"}]}`
-		var m Manifest
-		if err := json.Unmarshal([]byte(raw), &m); err != nil {
-			t.Fatal(err)
-		}
-		return m
-	}
-	resource := func(m *Manifest, id string) map[string]any {
-		for _, r := range m.Resources {
-			if r["id"] == id {
-				return r
-			}
-		}
-		t.Fatalf("no resource %s", id)
-		return nil
-	}
-	cases := []struct {
-		name   string
-		change func(m *Manifest)
-		holds  string // empty: it rolls out
-	}{
-		{"nothing", func(*Manifest) {}, ""},
-		{"a tools bundle", func(m *Manifest) {
-			m.Bundles[0].Digest, m.Bundles[0].Source = "sha256:bbb", "store/mailu-tools@sha256:bbb"
-		}, ""},
-		{"the tool list", func(m *Manifest) { m.Tools = append(m.Tools, "mailu_queue") }, ""},
-		{"a file no container mounts", func(m *Manifest) { resource(m, "runtime-config")["content"] = `{"a":1}` }, ""},
-		{"a container's image", func(m *Manifest) { resource(m, "imap")["image"] = "registry/imap@sha256:2" }, "recreates 1 of mailu's 1"},
-		{"a container's declaration", func(m *Manifest) { resource(m, "imap")["health"] = map[string]any{"kind": "runtime"} }, "recreates 1"},
-		{"a container added", func(m *Manifest) {
-			m.Resources = append(m.Resources, map[string]any{"id": "smtp", "type": "container", "image": "x"})
-		}, "recreates"},
-		{"a mounted file", func(m *Manifest) { resource(m, "config-env")["content"] = "A=2" }, "which its container imap mounts"},
-		{"a file within declared data", func(m *Manifest) { resource(m, "inbox-note")["content"] = "y" }, "which its container imap mounts"},
-		{"a directory holding declared data", func(m *Manifest) { resource(m, "data-mail")["mode"] = "0700" }, "data-mail"},
-		{"the data declaration", func(m *Manifest) { m.Data.Own[0].Class = ClassIrreplaceable }, "data declaration"},
-		{"a provider", func(m *Manifest) { m.Requires = append(m.Requires, "s3") }, "what it requires"},
-		{"what it provides", func(m *Manifest) { m.Provides = append(m.Provides, Offer{Name: "smtp"}) }, "what it provides"},
-		{"a process of a module with data", func(m *Manifest) { resource(m, "watcher")["command"] = "watch2" }, "long-running process watcher"},
-		{"an archive resource", func(m *Manifest) { resource(m, "installation")["artifact"] = "archive2" }, "the archive installation"},
-		{"a package resource", func(m *Manifest) { resource(m, "guard")["package"] = "nftables2" }, "the package guard"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			from, to := base(), base()
-			c.change(&to)
-			got := Holds(from, to)
-			switch {
-			case c.holds == "" && got != "":
-				t.Fatalf("held: %s", got)
-			case c.holds != "" && !strings.Contains(got, c.holds):
-				t.Fatalf("holds %q; want it to say %q", got, c.holds)
-			}
-		})
-	}
-	// A data directory nothing mounts still holds its data.
-	from, to := base(), base()
-	from.Data.Own = append(from.Data.Own, DataItem{ID: "archive", Path: "${dir:mesh-state}/archive", Class: "valuable"})
-	to.Data = &Data{Own: append([]DataItem(nil), from.Data.Own...)}
-	resource(&to, "runtime-config")["path"] = "${dir:mesh-state}/archive/config.json"
-	resource(&from, "runtime-config")["path"] = "${dir:mesh-state}/archive/config.json"
-	resource(&to, "runtime-config")["content"] = "new"
-	if got := Holds(from, to); !strings.Contains(got, "lies within its data archive") {
-		t.Fatalf("a file within data nothing mounts: %q", got)
-	}
-	// A process of a module with no data of its own may change.
-	from, to = base(), base()
-	from.Data, to.Data = nil, nil
-	resource(&to, "watcher")["command"] = "watch2"
-	if got := Holds(from, to); got != "" {
-		t.Fatalf("a process of a module with no data held: %s", got)
-	}
-}
diff --git a/internal/catalogue/hostname_seat_test.go b/internal/catalogue/hostname_seat_test.go
deleted file mode 100644
index c151efa8..00000000
--- a/internal/catalogue/hostname_seat_test.go
+++ /dev/null
@@ -1,98 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0223 part 3: a machine's names are one seat's. The `hosts` module holding
-// `node-hosts-file` became `hostname` holding `node-hostname`, which writes /etc/hostname beside the
-// machine's own lines in /etc/hosts. The seat was renamed (ADR 0122), so what claims the old name — a
-// manifest registered before the rename — still holds the one seat.
-
-func withHostnameAlias(t *testing.T) {
-	t.Helper()
-	was := aliases
-	t.Cleanup(func() { aliases = was })
-	UseAliases(map[string]string{"node-hosts-file": "node-hostname"})
-}
-
-func TestTheHostsFilesFormerNameResolvesToTheHostnameSeat(t *testing.T) {
-	if _, known := SeatNamed("node-hostname"); !known {
-		t.Fatal("node-hostname is not in the mesh's set")
-	}
-	withHostnameAlias(t)
-	seat, known := SeatNamed("node-hosts-file")
-	if !known || seat.Name != "node-hostname" || seat.Scope != ScopeNode {
-		t.Fatalf("the former name did not resolve: %+v %v", seat, known)
-	}
-	var verbs []string
-	for _, v := range seat.Serves {
-		verbs = append(verbs, v.Name)
-	}
-	if strings.Join(verbs, " ") != "entries add remove" {
-		t.Errorf("the renamed seat serves %v; its verbs are unchanged", verbs)
-	}
-}
-
-// One seat under either name: the module registered before the rename and the one after cannot both
-// hold it on one machine.
-func TestTheOldAndTheNewClaimantAreOneSeatOnAMachine(t *testing.T) {
-	withHostnameAlias(t)
-	cat := shelf(
-		mod("hosts", nil, nil, nil, Claim{Name: "node-hosts-file"}),
-		mod("hostname", nil, nil, nil, Claim{Name: "node-hostname"}),
-	)
-	_, err := Resolve(cat, []string{"hosts", "hostname"}, workstation(), World{})
-	if err == nil || !strings.Contains(err.Error(), "node-hostname") {
-		t.Errorf("hosts and hostname both held the machine's names on one machine: %v", err)
-	}
-	if _, err := Resolve(cat, []string{"hosts"}, workstation(), World{}); err != nil {
-		t.Errorf("a machine still assigned hosts under the old name does not resolve: %v", err)
-	}
-}
-
-// The catalogue's module: /etc/hostname is the operator's `hostname` setting. Without it the module is
-// left out, naming the key — the mesh never renames a machine on its own — and a mesh-wide setting
-// naming ${machine:name} gives every machine its mesh name.
-func TestTheMachinesNameIsItsSetting(t *testing.T) {
-	cat := map[string]Manifest{"hostname": catalogueManifest(t, "hostname")}
-	got, err := Resolve(cat, []string{"hostname"}, Node{Name: "ace", At: "ace.internal"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	machines := map[string]string{"ace.internal": "10.42.0.2"}
-	nameOf := func(settings SettingsBy) (string, string) {
-		t.Helper()
-		composed, err := got.Compose(Rendering{Names: machines, Machines: machines, Suffix: "internal",
-			Settings: settings})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if why := composed.LeftOut["hostname"]; why != "" {
-			return "", why
-		}
-		for _, r := range composed.Resources {
-			if r["path"] == "/etc/hostname" {
-				return r["content"].(string), ""
-			}
-		}
-		t.Fatal("no /etc/hostname composed")
-		return "", ""
-	}
-
-	if _, why := nameOf(nil); !strings.Contains(why, "hostname") {
-		t.Errorf("with no setting the machine's name was written, or left out for another reason: %q", why)
-	}
-	if name, why := nameOf(SettingsBy{"hostname": {{From: "ace", Values: map[string]any{"hostname": "Ace"}}}}); name != "Ace\n" {
-		t.Errorf("the operator's name for the machine gave %q (%s)", name, why)
-	}
-	mesh := Layer{From: "the mesh", Values: map[string]any{"hostname": "${machine:name}"}}
-	if name, why := nameOf(SettingsBy{"hostname": {mesh}}); name != "ace\n" {
-		t.Errorf("a mesh-wide ${machine:name} gave %q (%s)", name, why)
-	}
-	node := Layer{From: "ace", Values: map[string]any{"hostname": "Ace"}}
-	if name, why := nameOf(SettingsBy{"hostname": {mesh, node}}); name != "Ace\n" {
-		t.Errorf("a machine's own name over the mesh-wide one gave %q (%s)", name, why)
-	}
-}
diff --git a/internal/catalogue/identity_bound_test.go b/internal/catalogue/identity_bound_test.go
deleted file mode 100644
index f7f27c06..00000000
--- a/internal/catalogue/identity_bound_test.go
+++ /dev/null
@@ -1,190 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// Each test names the decision it defends: novox/hq ADR 0225, which refines ADR 0049 after issue 263.
-
-// The provision a module requires sets the bound on its identity, not the tightest backend anywhere.
-func TestABoundIsTheProvisionsOwn(t *testing.T) {
-	store := Manifest{Module: "objects", Provides: []Offer{{Name: "s3-bucket", Scope: ScopeMesh,
-		Identity: &OfferIdentity{Max: 20, In: "an S3 access key"}}},
-		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}}
-	database := Manifest{Module: "db", Provides: []Offer{{Name: "postgres-database", Scope: ScopeMesh,
-		Identity: &OfferIdentity{Max: 63, In: "a PostgreSQL role"}}},
-		Receives: map[string]string{"postgres-database": "/var/lib/mesh/db/mesh.json"}}
-	if b := store.IdentityBoundOf("s3-bucket"); b.Max != 20 || b.In != "an S3 access key" {
-		t.Errorf("an object store's stated bound was not taken: %+v", b)
-	}
-	if b := database.IdentityBoundOf("postgres-database"); b.Max != 63 {
-		t.Errorf("a database's stated bound was not taken: %+v", b)
-	}
-	// mesh_workstation_keycloak is 25: refused by the object store, accepted by the database.
-	if CheckIdentityWithin("workstation", "keycloak", store.IdentityBoundOf("s3-bucket")) == nil {
-		t.Error("a 25-character identity fit a 20-character access key")
-	}
-	if err := CheckIdentityWithin("workstation", "keycloak", database.IdentityBoundOf("postgres-database")); err != nil {
-		t.Errorf("a database consumer paid the object store's limit: %v", err)
-	}
-}
-
-// What an offer leaves unsaid follows from whether its provider can keep a name at all.
-func TestAnUnstatedBoundFollowsWhatTheProviderIsTold(t *testing.T) {
-	// Told nothing about its consumers — no receives, nothing served from their identity: no bound.
-	// The resolver provision is exactly this, and its consumers paid an object store's limit (263).
-	resolver := Manifest{Module: "resolver", Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}}}
-	if b := resolver.IdentityBoundOf("wildcard-resolution"); b.Bounded() {
-		t.Errorf("a provision that is told nothing of its consumers bounds them: %+v", b)
-	}
-	// Told each consumer and silent about its backend: the old global bound, not none.
-	told := Manifest{Module: "told", Provides: []Offer{{Name: "thing", Scope: ScopeMesh}},
-		Receives: map[string]string{"thing": "/var/lib/mesh/told/mesh.json"}}
-	if b := told.IdentityBoundOf("thing"); b.Max != DefaultIdentityLimit {
-		t.Errorf("a provider told its consumers and silent about its backend is not held to %d: %+v",
-			DefaultIdentityLimit, b)
-	}
-	// Serving a value built from the identity is being told it, too.
-	serving := Manifest{Module: "serving", Provides: []Offer{{Name: "bucket", Scope: ScopeMesh}},
-		Serves: map[string]map[string]any{"bucket": {"name": "b-${consumer:as:dns}"}}}
-	if b := serving.IdentityBoundOf("bucket"); b.Max != DefaultIdentityLimit {
-		t.Errorf("a provider deriving a name from its consumers is not bounded: %+v", b)
-	}
-	// And `false` says it outright, even for a provider that receives.
-	routes := Manifest{Module: "routes", Provides: []Offer{{Name: "route", Scope: ScopeMesh,
-		Identity: &OfferIdentity{None: true}}},
-		Receives: map[string]string{"route": "/var/lib/mesh/routes/mesh.json"}}
-	if b := routes.IdentityBoundOf("route"); b.Bounded() {
-		t.Errorf("`identity: false` still bounds: %+v", b)
-	}
-}
-
-// The field reads as written and writes back the same, and refuses what says nothing.
-func TestAnOffersIdentityIsParsedStrictly(t *testing.T) {
-	for _, raw := range []string{
-		`{"name":"s3-bucket","scope":"mesh","identity":{"max":20,"in":"an S3 access key"}}`,
-		`{"name":"wildcard-resolution","scope":"mesh","identity":false}`,
-		`{"name":"redis-cache","scope":"mesh","identity":{"in":"a Redis ACL user"}}`,
-	} {
-		var o Offer
-		if err := json.Unmarshal([]byte(raw), &o); err != nil {
-			t.Fatalf("%s: %v", raw, err)
-		}
-		back, err := json.Marshal(o)
-		if err != nil || string(back) != raw {
-			t.Errorf("did not round-trip:\n%s\n%s (%v)", raw, back, err)
-		}
-	}
-	for _, raw := range []string{
-		`{"name":"x","identity":true}`,
-		`{"name":"x","identity":{"max":20,"in":"y","most":3}}`,
-	} {
-		var o Offer
-		if err := json.Unmarshal([]byte(raw), &o); err == nil {
-			t.Errorf("accepted %s", raw)
-		}
-	}
-	bad := Manifest{Module: "bad", Version: "1", Provides: []Offer{
-		{Name: "unsaid", Scope: ScopeMesh, Identity: &OfferIdentity{Max: 20}},
-		{Name: "tiny", Scope: ScopeMesh, Identity: &OfferIdentity{Max: 4, In: "nothing usable"}},
-	}}
-	raw, err := json.Marshal(bad)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = ParseManifest(raw)
-	if err == nil || !strings.Contains(err.Error(), "without saying what keeps them") ||
-		!strings.Contains(err.Error(), "the shortest the mesh makes") {
-		t.Fatalf("a bound with no `in`, or too short for any identity, was accepted: %v", err)
-	}
-}
-
-// Refused before merge: the catalogue check judges each module's identity, on the longest machine
-// name, against the bound of every provision it wants — and names the module and the slug to set.
-func TestTheCatalogueCheckRefusesAnIdentityThatOverflowsWhatItRequires(t *testing.T) {
-	shelf := Shelf{
-		"objects": {Module: "objects", Provides: []Offer{{Name: "s3-bucket", Scope: ScopeMesh,
-			Identity: &OfferIdentity{Max: 20, In: "an S3 access key"}}},
-			Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}},
-		"photoalbum": {Module: "photoalbum", Requires: []string{"s3-bucket"}},
-		"files":      {Module: "files", Requires: []string{"s3-bucket"}},
-	}
-	problems := IdentityProblems(shelf, 6)
-	if len(problems) != 1 || !strings.Contains(problems[0], "photoalbum wants s3-bucket") ||
-		!strings.Contains(problems[0], `"mesh_nnnnnn_photoalbum", 22`) ||
-		!strings.Contains(problems[0], "`slug` of at most 8 characters") {
-		t.Fatalf("one overflow, named with its remedy, was expected: %q", problems)
-	}
-	// A longer machine name refuses more: the check is about the mesh's machines, not one.
-	if got := IdentityProblems(shelf, 10); len(got) != 2 {
-		t.Fatalf("on a 10-character name both overflow (mesh_nnnnnnnnnn_files is 21): %q", got)
-	}
-	// And a slug is the remedy it names.
-	album := shelf["photoalbum"]
-	album.Slug = "album"
-	shelf["photoalbum"] = album
-	if got := IdentityProblems(shelf, 6); len(got) != 0 {
-		t.Fatalf("a slug that fits is still refused: %q", got)
-	}
-}
-
-// Tonight's case (issue 263): networkmanager, no slug, requiring the mesh's resolver provision on a
-// machine with a six-character name. Under ADR 0049's one bound it was refused, and its provider's
-// whole machine with it; the resolver keeps no name, so it is not refused at all.
-func TestARequirementOnAKeylessProvisionComposesWithALongName(t *testing.T) {
-	shelf := Shelf{
-		"resolver":       {Module: "resolver", Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}}},
-		"networkmanager": {Module: "networkmanager", Requires: []string{"wildcard-resolution"}},
-	}
-	if CheckIdentity("laptop", "networkmanager") == nil {
-		t.Fatal("the regression is not reproduced: mesh_laptop_networkmanager fits the old global bound")
-	}
-	if got := IdentityProblems(shelf, 6); len(got) != 0 {
-		t.Fatalf("a requirement on a keyless provision was refused for its length: %q", got)
-	}
-	r := Resolution{Node: "laptop", Modules: []Manifest{shelf["networkmanager"]},
-		Needs: []Needed{{Name: "wildcard-resolution", From: "anchor", For: "networkmanager",
-			Identity: shelf["resolver"].IdentityBoundOf("wildcard-resolution")}}}
-	if got := r.Overflowing(); len(got) != 0 {
-		t.Fatalf("a keyless requirement is reported as overflowing: %+v", got)
-	}
-}
-
-// The consumer's side of the same judgement the provider's composition makes: what `status` says.
-func TestAnOverflowingRequirementIsNamedFromTheConsumersSide(t *testing.T) {
-	bound := IdentityBound{Max: 20, In: "an S3 access key"}
-	r := Resolution{Node: "laptop",
-		Modules: []Manifest{{Module: "photoalbum"}, {Module: "files"}, {Module: "gallery", Slug: "gal"}},
-		Needs: []Needed{
-			{Name: "s3-bucket", From: "anchor", For: "photoalbum", Identity: bound},
-			{Name: "s3-bucket", From: "anchor", For: "photoalbum", Local: "second", Identity: bound},
-			{Name: "s3-bucket", From: "anchor", For: "files", Identity: bound},
-			{Name: "s3-bucket", From: "anchor", For: "gallery", Identity: bound},
-			{Name: "licence", From: "records", For: "photoalbum", ByRecord: true, Identity: bound},
-		}}
-	got := r.Overflowing()
-	if len(got) != 1 || got[0].Module != "photoalbum" || got[0].Identity != "mesh_laptop_photoalbum" ||
-		got[0].Provider != "anchor" {
-		t.Fatalf("one overflow, once, was expected: %+v", got)
-	}
-	if said := got[0].String(); !strings.Contains(said, "an S3 access key keeps 20") ||
-		!strings.Contains(said, "slug") {
-		t.Fatalf("the overflow does not say what keeps it or the remedy: %s", said)
-	}
-}
-
-// An identity served as a DNS label is never truncated, so the offer's bound must keep it in one.
-func TestAnIdentityServedAsADNSLabelIsBoundedToOne(t *testing.T) {
-	serves := map[string]map[string]any{"bucket": {"name": "${consumer:as:dns}"}}
-	wide := Manifest{Module: "wide", Serves: serves, Provides: []Offer{{Name: "bucket", Scope: ScopeMesh,
-		Identity: &OfferIdentity{Max: 255, In: "a client id"}}}}
-	if got := CheckServes(wide); len(got) != 1 || !strings.Contains(got[0], "a label keeps 63") {
-		t.Fatalf("a 255-character bound on a DNS label passed: %q", got)
-	}
-	unsaid := Manifest{Module: "unsaid", Serves: serves, Provides: []Offer{{Name: "bucket", Scope: ScopeMesh}}}
-	if got := CheckServes(unsaid); len(got) != 0 {
-		t.Fatalf("the default bound (20) on a DNS label was refused: %q", got)
-	}
-}
diff --git a/internal/catalogue/identity_test.go b/internal/catalogue/identity_test.go
deleted file mode 100644
index 580bc2e6..00000000
--- a/internal/catalogue/identity_test.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package catalogue
-
-import "testing"
-
-// Each test names the decision it defends (novox/hq ADR 0017).
-
-func TestASlugIsPreferredOverTheModuleName(t *testing.T) {
-	// A module that declared a slug is identified by it, so a long name can be made to fit the
-	// tightest backend without a hash (novox/hq ADR 0049).
-	if got := IdentitySource("kc", "keycloak"); got != "kc" {
-		t.Errorf("the slug was not preferred: %q", got)
-	}
-	if got := IdentitySource("", "redis"); got != "redis" {
-		t.Errorf("without a slug, the name should be used: %q", got)
-	}
-	if ConsumerIdentity("anchor", IdentitySource("bkt", "bucketuser")) != "mesh_anchor_bkt" {
-		t.Error("a slug did not shape the identity")
-	}
-}
-
-func TestCheckIdentityFitsTheTightestBackend(t *testing.T) {
-	// 20 is an S3 access key's limit (04-ISSUES/010), and the one that binds. mesh_anchor_keycloak
-	// is exactly 20 and allowed; the un-slugged bucketuser is 22 and refused, with the remedy a slug.
-	if err := CheckIdentity("anchor", "keycloak"); err != nil { // mesh_anchor_keycloak = 20
-		t.Errorf("a 20-character identity was refused: %v", err)
-	}
-	if err := CheckIdentity("anchor", "bucketuser"); err == nil { // mesh_anchor_bucketuser = 22
-		t.Error("an over-long identity was accepted")
-	}
-	// But with a slug it fits, and is accepted.
-	if err := CheckIdentity("anchor", IdentitySource("bkt", "bucketuser")); err != nil {
-		t.Errorf("a slugged identity that fits was refused: %v", err)
-	}
-}
-
-func TestTheRefusalNamesTheRemedy(t *testing.T) {
-	err := CheckIdentity("anchor", "bucketuser")
-	if err == nil {
-		t.Fatal("expected a refusal")
-	}
-	if !contains(err.Error(), "slug") {
-		t.Errorf("the refusal did not point at the slug as the remedy: %v", err)
-	}
-}
-
-func contains(s, sub string) bool {
-	for i := 0; i+len(sub) <= len(s); i++ {
-		if s[i:i+len(sub)] == sub {
-			return true
-		}
-	}
-	return false
-}
diff --git a/internal/catalogue/installation_test.go b/internal/catalogue/installation_test.go
deleted file mode 100644
index 563ed727..00000000
--- a/internal/catalogue/installation_test.go
+++ /dev/null
@@ -1,93 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A definition names no installation (novox/hq ADR 0112, ADR 0155). What the mesh acts on is judged;
-// prose is not; the world's registries and resolvers are the world's; a declared exception is a
-// reason a reader sees.
-func TestADefinitionNamingAnInstallationIsNamedBack(t *testing.T) {
-	m := Manifest{Module: "idp", Resources: []map[string]any{
-		{"id": "server", "type": "container", "image": "quay.io/keycloak/keycloak@sha256:aa",
-			"env": map[string]any{"KC_HOSTNAME": "https://login.mesh-one.be"}},
-		{"id": "env", "type": "file", "content": "REAL_IP_FROM=192.168.1.0/24,127.0.0.0/8,203.0.113.7,51.15.22.9\n"},
-	}, Listens: []Listening{{Port: 8080, From: FromMesh, Why: "the login page; login.mesh-one.be is a route grant"}}}
-	got := strings.Join(InstallationProblems(m), "\n")
-	for _, want := range []string{
-		"idp names login.mesh-one.be at resources[0].env.KC_HOSTNAME",
-		"idp names the public address 51.15.22.9 at resources[1].content",
-	} {
-		if !strings.Contains(got, want) {
-			t.Errorf("missing %q in:\n%s", want, got)
-		}
-	}
-	for _, mustNot := range []string{"quay.io", "why", "203.0.113.7", "192.168.1.0", "127.0.0.0"} {
-		if strings.Contains(got, mustNot) {
-			t.Errorf("%q was reported and should not be:\n%s", mustNot, got)
-		}
-	}
-}
-
-func TestTheWorldsNamesAreNotAnInstallations(t *testing.T) {
-	m := Manifest{Module: "resolver", Resources: []map[string]any{
-		{"id": "conf", "type": "file", "content": "server=1.1.1.1\nserver=8.8.8.8\nlisten=127.0.0.55\n"},
-		{"id": "proxy", "type": "container", "image": "docker.io/library/traefik@sha256:bb"},
-		{"id": "adapter", "type": "file", "content": "{\"machine\": \"host.docker.internal\"}\n"},
-		{"id": "doc", "type": "file", "content": "root = https://git.example.tld/\n"},
-	}}
-	if got := InstallationProblems(m); len(got) != 0 {
-		t.Fatalf("the world's names were reported: %v", got)
-	}
-}
-
-func TestANameMeantOnPurposeIsDeclaredWithItsReason(t *testing.T) {
-	// The federation's public directory in a homeserver's config: the world's, said so, and a name
-	// the map does not cover is still reported.
-	m := Manifest{Module: "homeserver", Resources: []map[string]any{
-		{"id": "conf", "type": "file", "content": "trusted_key_servers: matrix.org\nwell_known: https://mesh-one.be\n",
-			NamesOnPurpose: map[string]any{"matrix.org": "the federation's public key server, the world's"}},
-	}}
-	got := InstallationProblems(m)
-	if len(got) != 1 || !strings.Contains(got[0], "mesh-one.be") {
-		t.Fatalf("got %v", got)
-	}
-}
-
-func TestAnImageFromAnInstallationsRegistryNeedsAReason(t *testing.T) {
-	bare := Manifest{Module: "site", Resources: []map[string]any{
-		{"id": "server", "type": "container", "image": "registry.mesh-one.be/org/site@sha256:cc"},
-	}}
-	if got := InstallationProblems(bare); len(got) != 1 || !strings.Contains(got[0], "registry.mesh-one.be") {
-		t.Fatalf("an image on an installation's registry was not named: %v", got)
-	}
-	excepted := Manifest{Module: "site", Resources: []map[string]any{
-		{"id": "server", "type": "container", "image": "registry.mesh-one.be/org/site@sha256:cc",
-			NamesOnPurpose: map[string]any{"registry.mesh-one.be": "built outside the mesh until the site's repository is a build source here"}},
-	}}
-	if got := InstallationProblems(excepted); len(got) != 0 {
-		t.Fatalf("a declared exception was still reported: %v", got)
-	}
-}
-
-func TestAModuleNamedAfterADomainIsNamedBack(t *testing.T) {
-	got := InstallationProblems(Manifest{Module: "mesh-one.be"})
-	if len(got) != 1 || !strings.Contains(got[0], "named after mesh-one.be") {
-		t.Fatalf("got %v", got)
-	}
-}
-
-func TestABuildContextOnASeatNamesNoForge(t *testing.T) {
-	m := Manifest{Module: "packager", Build: &Build{Artifacts: []Artifact{
-		{Name: "server", Kind: "image", From: "Dockerfile",
-			Context: &ArtifactContext{Seat: "git", Repository: "org/controller", Ref: "main"}},
-	}}}
-	if got := InstallationProblems(m); len(got) != 0 {
-		t.Fatalf("a context on a seat was reported: %v", got)
-	}
-	m.Build.Artifacts[0].Context = &ArtifactContext{Repository: "https://git.mesh-one.be/org/controller.git"}
-	if got := InstallationProblems(m); len(got) != 1 {
-		t.Fatalf("a context by URL was not reported: %v", got)
-	}
-}
diff --git a/internal/catalogue/invokes_test.go b/internal/catalogue/invokes_test.go
deleted file mode 100644
index 7612ad24..00000000
--- a/internal/catalogue/invokes_test.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A manifest may say which tools its module calls (novox/hq ADR 0152), and the parser accepts the
-// two shapes the grant has: a named tool, and every tool.
-func TestAManifestMaySayWhatItInvokes(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mesh-console","version":"1",` +
-		`"invokes":["mesh-catalog.catalog_modules","*"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Invokes) != 2 || m.Invokes[1] != "*" {
-		t.Fatalf("invokes not read: %v", m.Invokes)
-	}
-}
-
-// An entry that names a module and no tool is refused at parse, in the manifest's words, rather than
-// at the composition of the bus's user list where it would stop the file for everybody.
-func TestAnInvokeThatNamesNoToolIsRefusedAtParse(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"mesh-console","version":"1","invokes":["shop"]}`))
-	if err == nil {
-		t.Fatal("an invoke naming no tool was accepted")
-	}
-	if !strings.Contains(err.Error(), `invokes "shop", which does not name a tool`) {
-		t.Fatalf("refused for the wrong reason: %v", err)
-	}
-}
diff --git a/internal/catalogue/issued_credential_test.go b/internal/catalogue/issued_credential_test.go
deleted file mode 100644
index 88b235d0..00000000
--- a/internal/catalogue/issued_credential_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A provision's credential may be issued by its provider's software (novox/hq ADR 0305, issue 526): the offer
-// names the tool that answers it and no own secret, and every other shape is refused at parse.
-func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"media","version":"1",
-		"provides":[{"name":"media-api","scope":"mesh","credential":{"issued-by":"software","tool":"media_issued_credential"}}],
-		"serves":{"media-api":{"port":32400}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if tool, issued := m.IssuedCredentialOf("media-api"); !issued || tool != "media_issued_credential" {
-		t.Fatalf("the offer's issued credential was not read: %q %v", tool, issued)
-	}
-	if _, shared := m.SharedCredentialOf("media-api"); shared {
-		t.Fatal("an issued credential was read as an own secret shared")
-	}
-	if _, issued := m.IssuedCredentialOf("other"); issued {
-		t.Fatal("a provision the module does not offer reads as issued")
-	}
-
-	for want, raw := range map[string]string{
-		"the issuers an offer may name": `{"module":"d","version":"1",
-			"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
-		"names no tool that answers it": `{"module":"d","version":"1",
-			"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
-		"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
-			"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
-		"the issuers an offer may name ": `{"module":"d","version":"1",
-			"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
-	} {
-		want = strings.TrimSpace(want)
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("expected a refusal saying %q, got %v", want, err)
-		}
-	}
-}
diff --git a/internal/catalogue/issued_outside_test.go b/internal/catalogue/issued_outside_test.go
deleted file mode 100644
index 54e5d293..00000000
--- a/internal/catalogue/issued_outside_test.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
-// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
-// either. An offer that says `software` keeps ADR 0305's shape.
-func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
-		"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
-		"serves":{"tv-api":{"port":8989}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.IssuedOutsideOf("tv-api") {
-		t.Fatal("the offer's credential issued outside was not read")
-	}
-	if m.IssuedOutsideOf("other") {
-		t.Fatal("a provision the module does not offer reads as issued outside")
-	}
-	if _, issued := m.IssuedCredentialOf("tv-api"); issued {
-		t.Fatal("a credential issued outside was read as issued by the software")
-	}
-	if _, shared := m.SharedCredentialOf("tv-api"); shared {
-		t.Fatal("a credential issued outside was read as an own secret shared")
-	}
-	if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
-		t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
-	}
-
-	for want, raw := range map[string]string{
-		"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
-			"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
-		"names the tool": `{"module":"d","version":"1",
-			"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
-		"the issuers an offer may name": `{"module":"d","version":"1",
-			"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
-	} {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("expected a refusal saying %q, got %v", want, err)
-		}
-	}
-}
diff --git a/internal/catalogue/jail_problems_test.go b/internal/catalogue/jail_problems_test.go
deleted file mode 100644
index 800d36a1..00000000
--- a/internal/catalogue/jail_problems_test.go
+++ /dev/null
@@ -1,49 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A jail whose pattern names <HOST> twice is refused by name: fail2ban would read it as a duplicate
-// capture group and refuse its whole configuration, leaving the machine with no bans at all — which
-// is what happened on the control node the day this was built (novox/hq ADR 0179).
-func TestAJailsPatternNamesTheHostOncePerShape(t *testing.T) {
-	twice := Manifest{Module: "route-proxy", Jails: []Jail{{
-		Name:      "route-proxy",
-		Failregex: `^.*(?:refused for <HOST>:\d+|asked from <HOST>:\d+)$`,
-		Jail:      "backend = systemd",
-	}}}
-	problems := twice.jailProblems()
-	if len(problems) != 1 || !strings.Contains(problems[0], "names <HOST> 2 times") {
-		t.Fatalf("a pattern naming <HOST> twice was not refused by name: %v", problems)
-	}
-	if !strings.Contains(problems[0], "no bans at all") {
-		t.Errorf("the refusal does not say what it costs: %q", problems[0])
-	}
-
-	// The same two shapes, one pattern each, is how it is written — and is accepted.
-	split := Manifest{Module: "route-proxy", Jails: []Jail{{
-		Name:      "route-proxy",
-		Failregex: "^.*refused for <HOST>:\\d+$\n            ^.*asked from <HOST>:\\d+$",
-		Jail:      "backend = systemd",
-	}}}
-	if problems := split.jailProblems(); len(problems) != 0 {
-		t.Fatalf("one <HOST> per pattern was refused: %v", problems)
-	}
-}
-
-// A jail with no name, no pattern, or a name another jail of the same module already took is refused.
-func TestAJailIsNamedOnceAndSaysWhatAFailureLooksLike(t *testing.T) {
-	m := Manifest{Module: "mailu", Jails: []Jail{
-		{Name: "", Failregex: "^.*rip=<HOST>$"},
-		{Name: "mailu-front", Failregex: "  "},
-		{Name: "mailu-front", Failregex: "^.*rip=<HOST>$"},
-	}}
-	problems := strings.Join(m.jailProblems(), "\n")
-	for _, want := range []string{"a jail with no name", "says nothing a failed attempt looks like", "two jails called"} {
-		if !strings.Contains(problems, want) {
-			t.Errorf("missing %q in:\n%s", want, problems)
-		}
-	}
-}
diff --git a/internal/catalogue/jails_into_test.go b/internal/catalogue/jails_into_test.go
deleted file mode 100644
index 95864581..00000000
--- a/internal/catalogue/jails_into_test.go
+++ /dev/null
@@ -1,72 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A node's fail2ban jails are composed from the modules it runs (novox/hq to-be 31): the holder
-// (jailing) gathers every module's declared jail into one jail file and a filter file per jail.
-func TestJailsAreComposedFromTheNodesModules(t *testing.T) {
-	modules := []Manifest{
-		{Module: "fail2ban", Jailing: &Jailing{Into: "/etc/fail2ban/jail.d/mesh-composed.conf", FilterInto: "/etc/fail2ban/filter.d"}},
-		{Module: "postgres", Jails: []Jail{{Name: "postgres-auth", Failregex: "auth failed from <HOST>", Jail: "port = 5432\nmaxretry = 5"}}},
-	}
-	files := jailsInto(modules, modules[0].Jailing)
-
-	by := map[string]map[string]any{}
-	for _, f := range files {
-		by[f["id"].(string)] = f
-	}
-	jail := by[ComposedJailsID()]
-	if jail == nil || jail["path"] != "/etc/fail2ban/jail.d/mesh-composed.conf" {
-		t.Fatalf("the composed jail file was not written: %v", jail)
-	}
-	body := jail["content"].(string)
-	if !strings.Contains(body, "[postgres-auth]") || !strings.Contains(body, "filter = postgres-auth") ||
-		!strings.Contains(body, "port = 5432") {
-		t.Fatalf("the postgres jail stanza was not composed in:\n%s", body)
-	}
-	filter := by["filter-postgres-auth"]
-	if filter == nil || filter["path"] != "/etc/fail2ban/filter.d/postgres-auth.conf" {
-		t.Fatalf("the jail's filter file was not written: %v", filter)
-	}
-	if !strings.Contains(filter["content"].(string), "failregex = auth failed from <HOST>") {
-		t.Fatalf("the failregex was not written: %v", filter["content"])
-	}
-}
-
-// A holder whose node runs no jail-declaring module still gets the file, empty — so removing the
-// last jail is a change the service restarts on, not a file that vanishes.
-func TestTheComposedJailFileIsWrittenEvenWhenEmpty(t *testing.T) {
-	files := jailsInto([]Manifest{{Module: "fail2ban"}}, &Jailing{Into: "/x", FilterInto: "/f"})
-	if len(files) != 1 || files[0]["id"] != ComposedJailsID() {
-		t.Fatalf("the empty composed jail file was not written alone: %v", files)
-	}
-}
-
-// A changed pattern restarts fail2ban (novox/hq issue 191's rollout): the service restarts when the
-// composed jail file changes, and the filter is a file of its own, so the jail file names the
-// filter's digest. Changing only the failregex must change the jail file; the same pattern must not.
-func TestAChangedFilterChangesTheJailFile(t *testing.T) {
-	jailFile := func(failregex string) string {
-		modules := []Manifest{
-			{Module: "fail2ban", Jailing: &Jailing{Into: "/etc/fail2ban/jail.d/mesh.conf", FilterInto: "/etc/fail2ban/filter.d"}},
-			{Module: "gitea", Jails: []Jail{{Name: "gitea", Failregex: failregex, Jail: "port = 222"}}},
-		}
-		for _, f := range jailsInto(modules, modules[0].Jailing) {
-			if f["id"] == ComposedJailsID() {
-				return f["content"].(string)
-			}
-		}
-		t.Fatal("no composed jail file")
-		return ""
-	}
-	before := jailFile("web login failed from <HOST>")
-	if again := jailFile("web login failed from <HOST>"); again != before {
-		t.Errorf("the same pattern composed a different jail file, which would restart fail2ban for nothing")
-	}
-	if after := jailFile("web login failed from <HOST>\n            Invalid user .* from <HOST>"); after == before {
-		t.Errorf("a changed pattern left the jail file as it was, so fail2ban keeps the old filter:\n%s", after)
-	}
-}
diff --git a/internal/catalogue/kept_test.go b/internal/catalogue/kept_test.go
deleted file mode 100644
index f60f8c34..00000000
--- a/internal/catalogue/kept_test.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A module that keeps the operator-sealed secrets is handed the export as a file, at 0600, and a
-// module that does not keep them is handed nothing — the export goes to the vault and nowhere else.
-func TestOnlyAModuleThatKeepsGetsTheExport(t *testing.T) {
-	vault := Manifest{Module: "mesh-vault", Version: "1", Provides: FromAnywhere("secret"),
-		Keeps: "/var/lib/mesh-vault/root"}
-	other := Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")}
-	got, err := Resolve(shelf(vault, other), []string{"mesh-vault", "zsh"},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	kept := &KeptExport{Export: 1, OperatorKey: "OPERATOR", Fingerprint: "sha256:abcd",
-		Kept: []Kept{{Node: "anchor", Module: "postgres", Name: "superuser", Origin: "accepted", Sealed: "CIPHERTEXT", Key: "OPERATOR"}}}
-	out, err := got.Declaration(Rendering{Kept: kept})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var files int
-	for _, r := range out {
-		if r["path"] != "/var/lib/mesh-vault/root/export.json" {
-			continue
-		}
-		files++
-		if r["mode"] != "0600" {
-			t.Errorf("the export is written at mode %v, and it is the mesh's root secrets, sealed or not", r["mode"])
-		}
-		content, _ := r["content"].(string)
-		for _, want := range []string{`"operator-key": "OPERATOR"`, `"sealed": "CIPHERTEXT"`, `"module": "postgres"`} {
-			if !strings.Contains(content, want) {
-				t.Errorf("the export lacks %s:\n%s", want, content)
-			}
-		}
-		if id, _ := r["id"].(string); !strings.Contains(id, "mesh-vault") {
-			t.Errorf("the export's resource id %q does not carry its module", id)
-		}
-	}
-	if files != 1 {
-		t.Fatalf("%d export files; one module keeps them", files)
-	}
-
-	// No operator key yet: the vault is declared without the file, not with an empty one.
-	out, err = got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if r["path"] == "/var/lib/mesh-vault/root/export.json" {
-			t.Fatal("an export was written with nothing to export")
-		}
-	}
-}
-
-func TestKeepsMustBeAnAbsolutePath(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"mesh-vault","version":"1","keeps":"root"}`))
-	if err == nil || !strings.Contains(err.Error(), "keeps") {
-		t.Fatalf("a relative keeps path was not refused: %v", err)
-	}
-	if _, err := ParseManifest([]byte(`{"module":"mesh-vault","version":"1","keeps":"/var/lib/mesh-vault/root"}`)); err != nil {
-		t.Fatalf("an absolute keeps path was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/kinded_test.go b/internal/catalogue/kinded_test.go
deleted file mode 100644
index 896a87f3..00000000
--- a/internal/catalogue/kinded_test.go
+++ /dev/null
@@ -1,168 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The router of novox/hq ADR 0259: it declares the operator's seat and the two kinded benches.
-func router() Manifest {
-	return Manifest{Module: "messenger", Tools: []string{"open", "history", "notify"},
-		State: []StateDeclaration{{Name: "asks"}}, RunsAs: "messenger", SecretsOwner: "messenger",
-		DefinesSeats: []SeatDeclaration{
-			{Name: "operator-channel", Scope: ScopeMesh, Accepts: []string{"ask", "cancel"}, Emits: []string{"decided"},
-				ByCaller: []string{"ask", "cancel", "decided"}, Records: []string{"asks"},
-				Serves: []Verb{{Name: "open"}, {Name: "history"}, {Name: "notify"}}},
-			{Name: "channel", Scope: ScopeMesh, Kinded: true, Accepts: []string{"show", "edit", "send"}},
-			{Name: "intake", Scope: ScopeMesh, Kinded: true, Emits: []string{"choice", "link"}, Proofs: []string{"code"}},
-		},
-		Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh}},
-		Uses:   []string{"channel"}}
-}
-
-func aChannel(module, kind string) Manifest {
-	return Manifest{Module: module, Claims: []Claim{
-		{Name: "channel", Scope: ScopeMesh, Kind: kind}, {Name: "intake", Scope: ScopeMesh, Kind: kind}}}
-}
-
-func TestTwoChannelsOfDifferentKindsHoldTheBenches(t *testing.T) {
-	shelf := Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"desk-channel": aChannel("desk-channel", "desktop")}
-	if got := problemsFor(t, shelf); got != "" {
-		t.Fatalf("two kinds were refused: %s", got)
-	}
-	for _, m := range shelf {
-		if got := declaredSeatProblems(m); len(got) > 0 {
-			t.Fatalf("%s: %v", m.Module, got)
-		}
-	}
-}
-
-func TestASecondClaimOfOneKindIsRefused(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": aChannel("telegram", "telegram"),
-		"telegram-two": aChannel("telegram-two", "telegram")})
-	if !strings.Contains(got, `of kind "telegram", which telegram already claims`) {
-		t.Fatalf("a second holder of one kind stood: %s", got)
-	}
-}
-
-func TestAKindedBenchNeedsAKindAndNoOtherSeatTakesOne(t *testing.T) {
-	got := problemsFor(t, Shelf{"messenger": router(), "nameless": aChannel("nameless", "")})
-	if !strings.Contains(got, "claims the kinded bench channel and names no kind") {
-		t.Fatalf("a claim without a kind stood: %s", got)
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Kind: "telegram"}}}
-	got = problemsFor(t, Shelf{"messenger": router(), "odd": odd})
-	if !strings.Contains(got, "only a kinded bench takes a kind") {
-		t.Fatalf("a kind on a seat that is not kinded stood: %s", got)
-	}
-	dotted := problemsFor(t, Shelf{"messenger": router(), "dotted": aChannel("dotted", "a.b")})
-	if !strings.Contains(dotted, "not a usable name") {
-		t.Fatalf("a kind that would widen a subject stood: %s", dotted)
-	}
-}
-
-func TestOnlyChannelAndIntakeAreKinded(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "pager", Kinded: true, Accepts: []string{"page"}}}}
-	if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "only channel and intake are kinded") {
-		t.Fatalf("another kinded bench was declared: %s", got)
-	}
-}
-
-func TestTheNewRulesAreHeldToWhatTheSeatSays(t *testing.T) {
-	m := Manifest{Module: "x", DefinesSeats: []SeatDeclaration{{Name: "thing", Accepts: []string{"do"},
-		ByCaller: []string{"undo"}, Proofs: []string{"code"}, Records: []string{"nothing"}}}}
-	got := strings.Join(declaredSeatProblems(m), "; ")
-	for _, want := range []string{"names thing.undo by its caller, which the seat neither accepts nor emits",
-		"declares proofs on thing, which is not kinded", `read its records "nothing", which it keeps no state of`} {
-		if !strings.Contains(got, want) {
-			t.Errorf("not refused: %q in %s", want, got)
-		}
-	}
-}
-
-// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
-func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
-	modules := []Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
-	held, problems := checkClaims(modules, Node{Name: "anchor"}, nil, nil)
-	if len(problems) > 0 || len(held) != 4 {
-		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
-	}
-	_, problems = checkClaims([]Manifest{aChannel("telegram", "telegram")}, Node{Name: "home"}, held, nil)
-	if len(problems) == 0 {
-		t.Fatal("one kind held on two machines was not refused")
-	}
-}
-
-// A channel's capabilities come from the fixed vocabulary, and only a kinded claim carries any.
-func TestCapabilitiesAreTheVocabularysAndOnlyOnAKindedClaim(t *testing.T) {
-	good := aChannel("telegram", "telegram")
-	good.Claims[0].Capabilities = []string{"deliver", "choice", "verified-sender", "max-length:4096"}
-	good.RunsAs = "telegram"
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": good}); got != "" {
-		t.Fatalf("the vocabulary was refused: %s", got)
-	}
-	bad := aChannel("telegram", "telegram")
-	bad.Claims[0].Capabilities = []string{"trusted", "max-length:lots"}
-	got := problemsFor(t, Shelf{"messenger": router(), "telegram": bad})
-	for _, w := range []string{`"trusted"`, `"max-length:lots"`} {
-		if !strings.Contains(got, w+", which channel-capabilities/1 does not have") {
-			t.Errorf("%s was not refused: %s", w, got)
-		}
-	}
-	odd := Manifest{Module: "odd", Claims: []Claim{{Name: "operator-channel", Scope: ScopeMesh, Capabilities: []string{"deliver"}}}}
-	if got := problemsFor(t, Shelf{"messenger": router(), "odd": odd}); !strings.Contains(got, "only a kinded bench's claim carries them") {
-		t.Errorf("capabilities on a seat that is not kinded stood: %s", got)
-	}
-}
-
-// novox/hq ADR 0259 §8: a module saying warrants, or speaking for a kind that proves its sender, runs as an
-// account of its own — never carried by the machine's runtime, which runs as the operator's account.
-func TestATrustedHolderMustRunAsAnAccountOfItsOwn(t *testing.T) {
-	r := router()
-	r.RunsAs = ""
-	if got := problemsFor(t, Shelf{"messenger": r}); !strings.Contains(got, "messenger must run as an account of its own") {
-		t.Errorf("a router on the machine's runtime stood: %s", got)
-	}
-	tg := aChannel("telegram", "telegram")
-	tg.Claims[0].Capabilities = []string{"choice", "verified-sender"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "telegram": tg}); !strings.Contains(got, "telegram must run as an account of its own") {
-		t.Errorf("a verified channel on the machine's runtime stood: %s", got)
-	}
-	desk := aChannel("desk-channel", "desktop")
-	desk.Claims[0].Capabilities = []string{"choice"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": desk}); got != "" {
-		t.Errorf("a channel proving nothing was held to it: %s", got)
-	}
-	// A kind that is `private` shows a link's code, which links an account as the operator: its holder is
-	// trusted with it, so it runs as its own account too (the confirmation review of 2026-10-09).
-	private := aChannel("desk-channel", "desktop")
-	private.Claims[0].Capabilities = []string{"choice", "private"}
-	if got := problemsFor(t, Shelf{"messenger": router(), "desk-channel": private}); !strings.Contains(got, "desk-channel must run as an account of its own") {
-		t.Errorf("a private channel on the machine's runtime stood: %s", got)
-	}
-}
-
-func TestRunsAsIsAnAccountOfTheModulesOwn(t *testing.T) {
-	ok := Manifest{Module: "telegram", RunsAs: "telegram", SecretsOwner: "telegram",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}},
-		Resources:  []map[string]any{{"id": "account", "type": "user", "name": "telegram"}}}
-	if got := RunsAsProblems(ok); len(got) != 0 {
-		t.Fatalf("a sound runs-as was refused: %v", got)
-	}
-	for want, change := range map[string]func(*Manifest){
-		"never root":                 func(m *Manifest) { m.RunsAs, m.SecretsOwner = "root", "root" },
-		"not an account name":        func(m *Manifest) { m.RunsAs = "${machine:account}" },
-		"which it does not make":     func(m *Manifest) { m.Resources = nil },
-		"declares no own secret":     func(m *Manifest) { m.OwnSecrets = nil },
-		"they are the account's own": func(m *Manifest) { m.SecretsOwner = "" },
-	} {
-		m := ok
-		m.Resources = append([]map[string]any(nil), ok.Resources...)
-		m.OwnSecrets = OwnSecrets{"broker": {Path: "/x"}}
-		change(&m)
-		if got := strings.Join(RunsAsProblems(m), "; "); !strings.Contains(got, want) {
-			t.Errorf("want %q, got %q", want, got)
-		}
-	}
-}
diff --git a/internal/catalogue/licence_test.go b/internal/catalogue/licence_test.go
deleted file mode 100644
index 0860b62e..00000000
--- a/internal/catalogue/licence_test.go
+++ /dev/null
@@ -1,269 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-func aModelUser() Manifest {
-	return Manifest{Module: "assistant", Requires: []string{"model-access"},
-		Binds:   map[string]string{"model-access": "/etc/assistant/model.json"},
-		Secrets: map[string]string{"model-access": "/etc/assistant/key"}}
-}
-
-// A provision answered by a record rather than a node.
-//
-// novox/hq ADR 0024: a hosted model is on nobody's machine and is reached over the public
-// internet, so the rule that refuses two ends sharing no private network must not apply. This
-// node is deliberately not on the private network at all — under the old rule that alone would
-// refuse it.
-func TestAProvisionAnsweredByARecordDoesNotNeedAPrivateNetwork(t *testing.T) {
-	got, err := Resolve(
-		map[string]Manifest{"assistant": aModelUser()},
-		[]string{"assistant"},
-		Node{Name: "workstation"},
-		World{
-			Licences: map[string][]Record{"model-access": {{Name: "personal",
-				Serves: map[string]any{"model": "a-model"}}}},
-			Using: map[string]map[string]Record{"assistant": {"model-access": {Name: "personal",
-				Serves: map[string]any{"model": "a-model"}}}},
-		})
-	if err != nil {
-		t.Fatalf("a machine off the private network could not be given model access: %v", err)
-	}
-	if len(got.Needs) != 1 {
-		t.Fatalf("the licence was not recorded as something this node takes: %+v", got.Needs)
-	}
-	if !got.Needs[0].ByRecord {
-		t.Fatal("the licence was treated as a machine, so the reachability rule would apply to it")
-	}
-	if got.Needs[0].From != "personal" {
-		t.Fatalf("the licence is not named by what a person calls it: %+v", got.Needs[0])
-	}
-}
-
-// Refused when the consumer has not said which — and the refusal names the candidates and the
-// command, because ADR 0024 warns this will be felt: a mesh holding three ways to reach a model
-// refuses every consumer that has not chosen.
-func TestAConsumerThatHasNotSaidWhichLicenceIsRefusedWithTheCandidates(t *testing.T) {
-	_, err := Resolve(
-		map[string]Manifest{"assistant": aModelUser()},
-		[]string{"assistant"},
-		Node{Name: "workstation"},
-		World{Licences: map[string][]Record{"model-access": {
-			{Name: "personal"}, {Name: "the-organisation"},
-		}}})
-	if err == nil {
-		t.Fatal("a consumer was given model access without anybody saying which")
-	}
-	said := err.Error()
-	for _, want := range []string{"personal", "the-organisation", "licence use"} {
-		if !strings.Contains(said, want) {
-			t.Fatalf("the refusal does not name %q, so it is correct and unusable:\n%s", want, said)
-		}
-	}
-}
-
-// A model the mesh runs itself answers it locally, and a record is not consulted.
-func TestAModelInTheMeshsOwnSetAnswersItWithoutALicence(t *testing.T) {
-	got, err := Resolve(
-		map[string]Manifest{
-			"assistant": aModelUser(),
-			"ollama": {Module: "ollama",
-				Provides: []Offer{{Name: "model-access", Scope: ScopeNode}}},
-		},
-		[]string{"assistant", "ollama"},
-		Node{Name: "workstation"},
-		World{Licences: map[string][]Record{"model-access": {{Name: "personal"}}}})
-	if err != nil {
-		t.Fatalf("a machine running its own model was asked to choose a licence: %v", err)
-	}
-	for _, n := range got.Needs {
-		if n.ByRecord {
-			t.Fatal("a record was used although the answer was on this machine")
-		}
-	}
-}
-
-// A key that was never supplied is refused by name rather than silently not written.
-//
-// The mesh discarded the plaintext when the key was accepted and cannot seal another, so a
-// machine that resolved cleanly would receive no file and fail at whatever read it.
-func TestAModuleOnALicenceWithNoKeyIsRefusedRatherThanLeftEmpty(t *testing.T) {
-	r := Resolution{
-		Node:    "workstation",
-		Modules: []Manifest{aModelUser()},
-		Needs:   []Needed{{Name: "model-access", From: "personal", ByRecord: true, For: "assistant"}},
-	}
-	_, err := r.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a module was given a licence with no key, so it receives nothing and fails later")
-	}
-	if !strings.Contains(err.Error(), "licence key personal") {
-		t.Fatalf("the refusal does not say how to fix it: %v", err)
-	}
-}
-
-// And with a key, both files arrive: what is public, and what is not.
-func TestALicenceDeliversWhatIsPublicAndWhatIsSealed(t *testing.T) {
-	r := Resolution{
-		Node:    "workstation",
-		Modules: []Manifest{aModelUser()},
-		Needs: []Needed{{Name: "model-access", From: "personal", ByRecord: true, For: "assistant",
-			Serves: map[string]any{"model": "a-model"}, Sealed: "sealed-blob"}},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	files := map[string]map[string]any{}
-	for _, res := range out {
-		if path, ok := res["path"].(string); ok {
-			files[path] = res
-		}
-	}
-	bound, given := files["/etc/assistant/model.json"]
-	if !given {
-		t.Fatal("the consumer was not told what it needs to know that is not secret")
-	}
-	content, _ := bound["content"].(string)
-	if !strings.Contains(content, "a-model") {
-		t.Fatalf("the binding does not carry what the licence serves:\n%s", content)
-	}
-	// The binding says it is a record rather than leaving an empty address, which a reader would
-	// take for something the mesh failed to fill in.
-	if !strings.Contains(content, "not a machine") {
-		t.Fatalf("the binding leaves an empty address with no explanation:\n%s", content)
-	}
-	key, delivered := files["/etc/assistant/key"]
-	if !delivered {
-		t.Fatal("the key was not delivered")
-	}
-	if key["sealed"] != "sealed-blob" {
-		t.Fatalf("the key is not the sealed one: %+v", key)
-	}
-	// And never in the open. The whole arrangement is that what travels is unreadable by
-	// everything between here and the machine.
-	if strings.Contains(content, "sealed-blob") {
-		t.Fatal("the key was written into the public file as well")
-	}
-}
-
-// One machine's unresolvable module must not remove it from the private network.
-//
-// The pass that answers *what does this node offer* takes a failed resolution to mean it learned
-// nothing — so refusing an unanswerable requirement there makes the machine disappear, and every
-// other machine is then told, wrongly, that the two of them share no network. A wrong answer about
-// a machine nobody asked about, caused by a fault on a third.
-func TestAnUnanswerableRequirementDoesNotRemoveAMachineFromTheMesh(t *testing.T) {
-	shelf := map[string]Manifest{
-		"assistant": aModelUser(),
-		"networking": {Module: "networking",
-			Provides: []Offer{{Name: "mesh-network", Scope: ScopeNode}}},
-	}
-	// The first pass: what does this machine offer? It is assigned something nothing answers.
-	got, err := Resolve(shelf, []string{"assistant", "networking"},
-		Node{Name: "laptop"}, World{Unchecked: true})
-	if err != nil {
-		t.Fatalf("a machine with one unanswerable requirement was lost entirely: %v", err)
-	}
-	var offers bool
-	for _, m := range got.Modules {
-		for _, o := range m.Offers() {
-			if o == "mesh-network" {
-				offers = true
-			}
-		}
-	}
-	if !offers {
-		t.Fatal("the machine's own network module was not seen, so it looks off the network")
-	}
-
-	// And the second pass, where the question is actually being asked, still refuses it.
-	if _, err := Resolve(shelf, []string{"assistant", "networking"},
-		Node{Name: "laptop"}, World{}); err == nil {
-		t.Fatal("the requirement nothing answers was accepted when it was actually asked")
-	}
-}
-
-// A same-node provider that mints no credential but serves a port the consumer cannot guess must
-// still deliver that port. A `local-model` provider (ollama) provides `model-access` at node scope
-// and serves a port and a model name, minting nothing; a co-located consumer requires and binds it
-// and has a file that names `${bound:model-access:port}`. The served facts never reached the
-// consumer's needs — node scope set `local`, not `brokered`, so the delivering branch was skipped —
-// and the consumer's file was refused for naming a provision it "did not require". The endpoint is
-// keyless, but a port is still a fact nobody can invent.
-func TestAKeylessSameNodeProviderStillDeliversWhatItServes(t *testing.T) {
-	provider := Manifest{Module: "local-model",
-		Provides: []Offer{{Name: "model-access", Scope: ScopeNode}},
-		Serves: map[string]map[string]any{
-			"model-access": {"port": 11434, "model": "a-model"}}}
-	consumer := Manifest{Module: "assistant", Requires: []string{"model-access"},
-		Binds: map[string]string{"model-access": "/etc/assistant/model.json"}}
-
-	// node.At empty: a single-node deployment with no private network. The delivered binding must
-	// still carry a usable address — loopback, because a machine off the network still reaches
-	// itself, and an empty `at` would be written into the consumer's file as a host that resolves
-	// to nothing.
-	got, err := Resolve(
-		map[string]Manifest{"local-model": provider, "assistant": consumer},
-		[]string{"assistant", "local-model"},
-		Node{Name: "workstation"},
-		World{})
-	if err != nil {
-		t.Fatalf("a keyless same-node model endpoint was refused: %v", err)
-	}
-
-	var found *Needed
-	for i := range got.Needs {
-		if got.Needs[i].Name == "model-access" && got.Needs[i].For == "assistant" {
-			found = &got.Needs[i]
-		}
-	}
-	if found == nil {
-		t.Fatalf("the served endpoint was not delivered to the consumer at all: %+v", got.Needs)
-	}
-	if found.ByRecord {
-		t.Fatal("a same-node endpoint was treated as a record, so the reachability rule would apply")
-	}
-	if found.At == "" {
-		t.Fatalf("the binding carries no address, so its file names a host that resolves to nothing: %+v", found)
-	}
-	if found.At != "127.0.0.1" {
-		t.Fatalf("off the private network the address must fall back to loopback, got %q", found.At)
-	}
-	if got, want := plainly(found.Serves["port"]), "11434"; got != want {
-		t.Fatalf("the port the consumer cannot guess was not delivered: got %q want %q", got, found.Serves)
-	}
-	if found.Serves["model"] != "a-model" {
-		t.Fatalf("the extra served fact was not delivered: %+v", found.Serves)
-	}
-
-	// End to end: a file that names ${bound:model-access:...} is filled rather than refused, which
-	// is the whole failure this fixes — boundInto reads knownFor, and knownFor reads the needs.
-	consumer.Resources = []map[string]any{{
-		"id": "env", "type": "file", "path": "/etc/assistant/.env",
-		"content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\n",
-	}}
-	got, err = Resolve(
-		map[string]Manifest{"local-model": provider, "assistant": consumer},
-		[]string{"assistant", "local-model"},
-		Node{Name: "workstation"},
-		World{})
-	if err != nil {
-		t.Fatalf("resolution refused the consumer with a bound file: %v", err)
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("the declaration refused the consumer's bound file: %v", err)
-	}
-	var env string
-	for _, res := range out {
-		if res["path"] == "/etc/assistant/.env" {
-			env, _ = res["content"].(string)
-		}
-	}
-	if want := "http://127.0.0.1:11434/v1"; !strings.Contains(env, want) {
-		t.Fatalf("the bound file was not filled with the served endpoint, want %q:\n%s", want, env)
-	}
-}
diff --git a/internal/catalogue/localnetwork_test.go b/internal/catalogue/localnetwork_test.go
deleted file mode 100644
index 4a0cd6f9..00000000
--- a/internal/catalogue/localnetwork_test.go
+++ /dev/null
@@ -1,195 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
-// provider handed it, beside the private network's own link and a container bridge.
-var homeServer = []AttachedNetwork{
-	{Link: "eth0", Network: "192.168.1.10/24"},
-	{Link: "eth1", Network: "203.0.113.7/24"},
-	{Link: "eth0", Network: "fe80::1/64"},
-	{Link: "eth0", Network: "fd12:3456:789a::5/64"},
-	{Link: "wg-mesh", Network: "10.10.0.4/24"},
-	{Link: "docker0", Network: "172.17.0.1/16"},
-}
-
-func judged(t *testing.T) []LocalNetwork {
-	t.Helper()
-	return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
-}
-
-// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
-// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
-func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
-	got := CountedLocalNetworks(judged(t))
-	want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
-	if strings.Join(got, " ") != strings.Join(want, " ") {
-		t.Fatalf("counted %v, want %v", got, want)
-	}
-	for _, j := range judged(t) {
-		if j.Why == "" {
-			t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
-		}
-		switch j.Network {
-		case "203.0.113.0/24":
-			if j.Counts || !strings.Contains(j.Why, "public") {
-				t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
-			}
-		case "fe80::/64":
-			if j.Counts || !strings.Contains(j.Why, "link-local") {
-				t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
-			}
-		case "10.10.0.0/24", "172.17.0.0/16":
-			if j.Counts {
-				t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
-			}
-		}
-	}
-}
-
-// A network overlapping a private range without lying wholly inside it does not count either, so a
-// wide prefix around a private range cannot carry the internet with it.
-func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
-	for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
-		got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
-		if len(got) != 1 || got[0].Counts {
-			t.Errorf("%s counts as a local network: %+v", n, got)
-		}
-	}
-}
-
-// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
-// in both chains, and never the public subnet.
-func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
-	rules := []Rule{
-		{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}},
-		{Port: 5432, Protocol: "tcp", From: FromMesh, Because: []string{"postgres"}},
-	}
-	local := CountedLocalNetworks(judged(t))
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
-		[]string{"eth0", "eth1"}, "wg-mesh", local)
-
-	for _, want := range []string{
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
-		"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
-		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
-		// The mesh-only port is not widened by the machine having a local network.
-		"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
-	} {
-		if !strings.Contains(out, want) {
-			t.Errorf("the rule set lacks %q:\n%s", want, out)
-		}
-	}
-	if strings.Contains(out, "203.0.113") {
-		t.Errorf("the public subnet reached the rule set:\n%s", out)
-	}
-	if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
-		t.Errorf("1883 is open to anywhere:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("1883 is open to anywhere:\n%s", out)
-		}
-	}
-}
-
-// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
-// port from the private network only, and the rule set says it found none — never widened to anywhere.
-func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
-	rules := []Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}}}
-	out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
-	if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
-		t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
-	}
-	if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
-		t.Errorf("the port is not admitted from the private network:\n%s", out)
-	}
-	for _, line := range strings.Split(out, "\n") {
-		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
-			t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
-		}
-	}
-	said := LocalNetworkPorts(rules, nil)[0].Said()
-	if !strings.Contains(said, "none") {
-		t.Errorf("plan says %q, want it to say no local network was found", said)
-	}
-}
-
-// `local-network` is a source a manifest may name (§1, changing ADR 0045 §3), and an unknown source is
-// still refused.
-func TestAManifestMayListenFromTheLocalNetwork(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"local-network"}]}`)); err != nil {
-		t.Fatalf("a listen from the local network is refused: %v", err)
-	}
-	_, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
-		"listens":[{"port":1883,"from":"lan"}]}`))
-	if err == nil || !strings.Contains(err.Error(), `from "lan"`) {
-		t.Fatalf("a source the mesh cannot render is not refused: %v", err)
-	}
-}
-
-// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
-// filter opens — the internal name, not the public one.
-func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachLocalNetwork))
-	if public != "" || internal != "app.anchor.internal" {
-		t.Fatalf("names are %q and %q, want the internal name only", public, internal)
-	}
-	bare := aRoutedWeb()
-	bare.Contributes = nil
-	r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
-	rules, err := r.Rules(Rendering{Settings: reachSet(ReachLocalNetwork)})
-	if err != nil {
-		t.Fatalf("rules: %v", err)
-	}
-	if len(rules) != 1 || rules[0].From != FromLocalNetwork {
-		t.Fatalf("reach local-network made the filter say %+v", rules)
-	}
-}
-
-// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
-// the local network: it covers the mesh, and anywhere covers it.
-func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
-	got := widest([]Rule{
-		{Port: 53, Protocol: "udp", From: FromMesh, Because: []string{"a"}},
-		{Port: 53, Protocol: "udp", From: FromLocalNetwork, Because: []string{"b"}},
-	})
-	if len(got) != 1 || got[0].From != FromLocalNetwork || len(got[0].Because) != 2 {
-		t.Fatalf("got %+v", got)
-	}
-	got = widest(append(got, Rule{Port: 53, Protocol: "udp", From: FromEverywhere, Because: []string{"c"}}))
-	if len(got) != 1 || got[0].From != FromEverywhere {
-		t.Fatalf("got %+v", got)
-	}
-}
-
-// On an adopted node the opening is the private network's part only: the found firewall admits the
-// local network, and an opening that widened to everywhere would open the port to the internet.
-func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
-	out := Openings([]Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork}}, nil, nil)
-	if len(out) != 1 || out[0]["from"] != OpeningFromMesh {
-		t.Fatalf("openings %v", out)
-	}
-}
-
-// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
-// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
-func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
-	got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
-	if len(got) != 1 {
-		t.Fatalf("judged %+v", got)
-	}
-	if got[0].Counts {
-		t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
-	}
-	if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
-		t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
-	}
-	if n := CountedLocalNetworks(got); len(n) != 0 {
-		t.Fatalf("counted %v", n)
-	}
-}
diff --git a/internal/catalogue/login_shell_execute_test.go b/internal/catalogue/login_shell_execute_test.go
deleted file mode 100644
index 51b16e4c..00000000
--- a/internal/catalogue/login_shell_execute_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package catalogue
-
-import "testing"
-
-// The login shell's `execute` runs any command as the operator account, which can become root without a
-// person, so the operator withheld it on the control-node until a call to it needs a person's approval
-// (novox/hq ADR 0268). It is withheld per machine by the holder's own setting, so the seat must let a
-// holder hold it without serving the verb there: `execute` is optional (ADR 0246's mark), and stays so in
-// a seat row read back from the store, which never keeps the mark.
-func TestTheLoginShellsExecuteIsOptionalSoAMachineMayWithholdIt(t *testing.T) {
-	check := func(t *testing.T) {
-		t.Helper()
-		seat, ok := SeatNamed(LoginShellSeat)
-		if !ok {
-			t.Fatal("node-login-shell is not defined")
-		}
-		if len(seat.Serves) != 1 || seat.Serves[0].Name != "execute" {
-			t.Fatalf("the login shell promises %+v, not execute alone", seat.Serves)
-		}
-		if !seat.Serves[0].Optional {
-			t.Fatal("execute is required, so a holder that withholds it on one machine could not hold the seat there")
-		}
-		withholding := Manifest{Module: "zsh", Version: "1", Claims: []Claim{{Name: LoginShellSeat, Scope: ScopeNode}}}
-		if err := CanHold(withholding, seat); err != nil {
-			t.Fatalf("a holder serving no execute is refused: %v", err)
-		}
-		serving := withholding
-		serving.Claims = []Claim{{Name: LoginShellSeat, Scope: ScopeNode, Serves: []string{"execute"}}}
-		if err := CanHold(serving, seat); err != nil {
-			t.Fatalf("a holder serving execute is refused: %v", err)
-		}
-	}
-	t.Run("compiled", check)
-	t.Run("read back from the store", func(t *testing.T) {
-		before := seats
-		t.Cleanup(func() { seats = before })
-		UseSeats([]Seat{{Name: LoginShellSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0204",
-			Serves: []Verb{{Name: "execute"}}}})
-		check(t)
-	})
-}
diff --git a/internal/catalogue/logs_test.go b/internal/catalogue/logs_test.go
deleted file mode 100644
index 76e7ee0d..00000000
--- a/internal/catalogue/logs_test.go
+++ /dev/null
@@ -1,68 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A module declares the logs it keeps (novox/hq ADR 0297 §1): a log by its bare name, or with its cap
-// in MiB; the default cap where none is said.
-func TestAManifestMaySayWhatLogsItKeeps(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mesh-issues","version":"1",` +
-		`"logs":["changes",{"name":"moves","max-mib":2048}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Logs) != 2 || m.Logs[0].Name != "changes" || m.Logs[1].Name != "moves" {
-		t.Fatalf("logs not read: %+v", m.Logs)
-	}
-	if m.Logs[0].Cap() != LogDefaultMiB || m.Logs[0].Cap() != 1024 || m.Logs[1].Cap() != 2048 {
-		t.Fatalf("caps read as %d and %d", m.Logs[0].Cap(), m.Logs[1].Cap())
-	}
-	out, _ := json.Marshal(m.Logs)
-	if string(out) != `["changes",{"name":"moves","max-mib":2048}]` {
-		t.Fatalf("written back as %s", out)
-	}
-	for _, edge := range []string{`{"name":"a","max-mib":1}`, `{"name":"a","max-mib":8192}`} {
-		if _, err := ParseManifest([]byte(`{"module":"a","version":"1","logs":[` + edge + `]}`)); err != nil {
-			t.Errorf("%s is inside the caps and was refused: %v", edge, err)
-		}
-	}
-}
-
-// The catalogue check refuses a log outside the caps, with a name that is not one plain token, with a
-// field the mesh does not know, or kept by a module whose own name is not one plain token.
-func TestALogIsNamedLocallyAndCapped(t *testing.T) {
-	for _, c := range []struct{ manifest, says string }{
-		{`{"module":"a","version":"1","logs":["mesh.changes"]}`, `keeps log "mesh.changes": a log is named locally`},
-		{`{"module":"a","version":"1","logs":["my_changes"]}`, `keeps log "my_changes"`},
-		{`{"module":"a","version":"1","logs":["Changes"]}`, `keeps log "Changes"`},
-		{`{"module":"a","version":"1","logs":["c","c"]}`, `keeps log "c" twice`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":8193}]}`, `between 1 and 8192 MiB`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":-1}]}`, `between 1 and 8192 MiB`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","max-mib":0}]}`, `max-mib is between 1 and 8192, not 0`},
-		{`{"module":"a","version":"1","logs":[{"name":"c","stream":"LOG_x"}]}`, `{name, max-mib}`},
-		{`{"module":"a.b","version":"1","logs":["c"]}`, `no dot`},
-	} {
-		_, err := ParseManifest([]byte(c.manifest))
-		if err == nil {
-			t.Errorf("%s was accepted", c.manifest)
-			continue
-		}
-		if !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s refused for the wrong reason: %v", c.manifest, err)
-		}
-	}
-}
-
-// **Across the whole catalogue**: every log is named locally and capped within the mesh's caps.
-func TestEveryManifestsLogsAreLocalAndCapped(t *testing.T) {
-	var problems []string
-	for _, m := range theCatalogue(t) {
-		problems = append(problems, LogProblems(m)...)
-	}
-	if len(problems) > 0 {
-		t.Fatalf("the catalogue's logs are not what ADR 0297 says:\n  %s", strings.Join(problems, "\n  "))
-	}
-}
diff --git a/internal/catalogue/machine_into_files_test.go b/internal/catalogue/machine_into_files_test.go
deleted file mode 100644
index 74bc60b5..00000000
--- a/internal/catalogue/machine_into_files_test.go
+++ /dev/null
@@ -1,128 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0066 — a module that must name ITSELF to something else.
-//
-// The authority inside the mesh is the case. A proxy reaches it at the address the mesh handed
-// over, so its certificate has to be issued for that name — and it has no binding to learn the name
-// from, because it provides rather than requires. Written as a literal it would be one deployment's
-// machine name living in a manifest, which is the shape the decision exists to remove.
-
-// anchored is a machine on the private network, which is where a name worth certifying comes from.
-func anchored() Node {
-	n := workstation()
-	n.At = "workstation.internal"
-	return n
-}
-
-// authority is a module that must put its own machine's name into a file it writes.
-func authority() Manifest {
-	return Manifest{
-		Module: "authority", Version: "1",
-		Provides: FromAnywhere("acme-ca"),
-		Serves:   map[string]map[string]any{"acme-ca": {}},
-		Resources: []map[string]any{{
-			"id": "init", "type": "file", "path": "/var/lib/authority/init.env",
-			"content": "NAMES=${machine:at},${machine:name},localhost\n",
-		}},
-	}
-}
-
-func TestAModuleNamesTheMachineItWasAssignedTo(t *testing.T) {
-	got, err := Resolve(shelf(authority()), []string{"authority"}, anchored(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	content := ""
-	for _, r := range mustDeclare(t, got) {
-		if strings.HasSuffix(plainly(r["id"]), "init") {
-			content = plainly(r["content"])
-		}
-	}
-	if content == "" {
-		t.Fatal("the authority's file was not declared")
-	}
-	if strings.Contains(content, "${machine:") {
-		t.Fatalf("the placeholder was written into the file as a value: %q", content)
-	}
-	// The machine's own name on the private network — the one a consumer is handed as `at`, and so
-	// the one a certificate has to carry.
-	if !strings.Contains(content, "workstation.internal") {
-		t.Errorf("the file does not name the address consumers reach it at: %q", content)
-	}
-}
-
-// A machine not on the private network has no such address, and a module asking to be reached at
-// one is named here rather than left to fail later as a certificate nobody can verify.
-func TestAnAddressAMachineDoesNotHaveIsRefused(t *testing.T) {
-	got, err := Resolve(shelf(authority()), []string{"authority"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := got.Declaration(Rendering{}); err == nil {
-		t.Fatal("an address the machine does not have was substituted rather than refused")
-	} else if !strings.Contains(err.Error(), "at") {
-		t.Errorf("the refusal does not name what was asked for: %v", err)
-	}
-}
-
-// A module that must give software the machine's ADDRESS rather than its name — a resolver pointing
-// the container runtime at itself, whose list of resolvers cannot be a name — says
-// ${machine:address}, and gets what the machine's name resolves to on the private network: the same
-// address every other machine's hosts file carries for it.
-func TestAModuleNamesTheAddressBehindItsMachinesName(t *testing.T) {
-	pointing := Manifest{Module: "pointing", Version: "1", Resources: []map[string]any{{
-		"id": "runtime", "type": "file", "path": "/etc/runtime.json",
-		"content": `{"dns":["${machine:address}"]}`,
-	}}}
-	got, err := Resolve(shelf(pointing), []string{"pointing"}, anchored(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Names: map[string]string{
-		"workstation.internal": "10.42.0.7", "anchor.internal": "10.42.0.1"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if content := plainly(out[0]["content"]); content != `{"dns":["10.42.0.7"]}` {
-		t.Fatalf("the machine's address was not the one its name resolves to: %q", content)
-	}
-
-	// Off the network there is no such address, and the refusal says what the machine does have —
-	// rather than a placeholder written into the runtime's file and read as an address.
-	got, err = Resolve(shelf(pointing), []string{"pointing"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := got.Declaration(Rendering{}); err == nil || !strings.Contains(err.Error(), "${machine:address}") {
-		t.Fatalf("a machine off the network was given an address, or refused for another reason: %v", err)
-	}
-}
-
-// The mesh's private range is offered as ${machine:mesh-range}, so a module names it rather than
-// hardcoding a value it cannot know (novox/hq ADR 0112) — the fail2ban ignoreip is the case.
-func TestAModuleNamesTheMeshRange(t *testing.T) {
-	facts := machineFacts(Resolution{Node: "anchor", At: "anchor.internal"},
-		map[string]string{"anchor.internal": "10.10.0.1"}, "10.10.0.0/24")
-	if facts["mesh-range"] != "10.10.0.0/24" {
-		t.Fatalf("the mesh range is not a machine fact: %v", facts)
-	}
-	res := map[string]any{"type": "file", "id": "jail", "content": "ignoreip = 127.0.0.1/8 ${machine:mesh-range}\n"}
-	if err := machineInto(res, facts, "fail2ban"); err != nil {
-		t.Fatal(err)
-	}
-	if got := res["content"].(string); !strings.Contains(got, "10.10.0.0/24") || strings.Contains(got, "${machine:") {
-		t.Fatalf("the mesh range was not written in: %q", got)
-	}
-	// A mesh with no range gives no such fact, and a file that names it is refused rather than
-	// left with a literal placeholder in it.
-	none := machineFacts(Resolution{Node: "anchor"}, nil, "")
-	if _, has := none["mesh-range"]; has {
-		t.Fatal("a mesh with no range still offered one")
-	}
-}
diff --git a/internal/catalogue/machineside_test.go b/internal/catalogue/machineside_test.go
deleted file mode 100644
index 553e1a5a..00000000
--- a/internal/catalogue/machineside_test.go
+++ /dev/null
@@ -1,60 +0,0 @@
-package catalogue
-
-import "testing"
-
-// A module with nothing that publishes binds what it binds, and the mesh may not move it.
-//
-// This is the case that made novox/hq 04-ISSUES/028's fix wrong on its first pass: a port was
-// assigned to every module that declared one, so a service listening directly had the rule set
-// opened on a number nothing was listening on, and its real port shut. The firewall reported
-// success and blocked the service, which is the exact failure the mechanism exists to prevent.
-func TestAPortNothingPublishesIsNotTheMeshsToMove(t *testing.T) {
-	m := Manifest{Module: "talker", Listens: []Listening{{Port: 9101, From: FromMesh}}}
-	at, mayAssign := m.MachineSide(9101)
-	if mayAssign {
-		t.Fatal("the mesh took a port it cannot move: nothing translates it, so assigning one " +
-			"opens the wrong number and leaves the service unreachable")
-	}
-	if at != 9101 {
-		t.Fatalf("a port nothing publishes reaches the machine where it binds, not at %d", at)
-	}
-}
-
-// A container publishing in short form is exactly the case the mesh may choose.
-func TestAContainerPublishingShortIsTheMeshsToChoose(t *testing.T) {
-	m := Manifest{Module: "store", Resources: []map[string]any{
-		{"type": "container", "id": "server", "ports": []any{"5432"}},
-	}}
-	if _, mayAssign := m.MachineSide(5432); !mayAssign {
-		t.Fatal("a container's mapping is what translates a port, so this one is the mesh's to " +
-			"choose; refusing it puts every module back on a number it guessed")
-	}
-}
-
-// A manifest that wrote its own mapping already chose, and the machine side is the outer one.
-func TestAMappingTheManifestWroteIsNotReassigned(t *testing.T) {
-	m := Manifest{Module: "mail", Resources: []map[string]any{
-		{"type": "container", "id": "front", "ports": []any{"7080:80"}},
-	}}
-	for _, named := range []int{7080, 80} {
-		at, mayAssign := m.MachineSide(named)
-		if mayAssign {
-			t.Fatalf("%d was reassigned though the manifest published it explicitly, which "+
-				"would open a rule on a port the container does not publish", named)
-		}
-		if at != 7080 {
-			t.Fatalf("naming %d gave %d; the machine side of 7080:80 is 7080", named, at)
-		}
-	}
-}
-
-// A port some other container publishes is not this port.
-func TestAPortNotInTheMappingIsNotFound(t *testing.T) {
-	m := Manifest{Module: "mail", Resources: []map[string]any{
-		{"type": "container", "id": "front", "ports": []any{"25", "7080:80"}},
-	}}
-	if at, mayAssign := m.MachineSide(993); mayAssign || at != 993 {
-		t.Fatalf("993 is published by nothing here, so it binds where it binds: got %d, %v",
-			at, mayAssign)
-	}
-}
diff --git a/internal/catalogue/mounts_test.go b/internal/catalogue/mounts_test.go
deleted file mode 100644
index f929a5d3..00000000
--- a/internal/catalogue/mounts_test.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package catalogue
-
-import (
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// A bind mount the module never declared is refused where it is written (novox/hq 04-ISSUES/026,
-// ADR 0091). The container runtime creates a missing bind source itself, as root, with a mode it
-// picks, so the module's own owner and mode never reach the directory holding its data, and the
-// rule that keeps data when a module goes away (ADR 0030) does not cover it.
-
-const aContainerMounting = `{"id":"server","type":"container","name":"store","image":"x@sha256:` +
-	`0000000000000000000000000000000000000000000000000000000000000000","volumes":["%s:/inside"]}`
-
-func manifestMounting(from string, beside string) []byte {
-	res := aContainerMounting
-	if beside != "" {
-		res = beside + "," + res
-	}
-	return []byte(`{"module":"store","resources":[` + strings.Replace(res, "%s", from, 1) + `]}`)
-}
-
-func TestAMountNothingDeclaresIsRefused(t *testing.T) {
-	_, err := ParseManifest(manifestMounting("/services/store/data", ""))
-	if err == nil {
-		t.Fatal("a container mounting a path no resource declares was accepted; the runtime " +
-			"would create it as root and the module's owner and mode would never apply")
-	}
-	if !strings.Contains(err.Error(), "/services/store/data") {
-		t.Fatalf("refused without naming the path, which leaves the author guessing: %v", err)
-	}
-}
-
-// Declaring it is enough — including declaring the directory above it.
-func TestAMountUnderADeclaredDirectoryIsAccepted(t *testing.T) {
-	_, err := ParseManifest(manifestMounting("/services/store/data",
-		`{"id":"state","type":"directory","path":"/services/store","mode":"0700"}`))
-	if err != nil {
-		t.Fatalf("a module that said where its data lives was refused anyway: %v", err)
-	}
-}
-
-// The operator's path, granted for use (ADR 0051), is declared by `accesses`, not by a directory the
-// module would then own.
-func TestAMountOfAnAccessedPathIsAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"store","accesses":[{"path":"/services/media/movies","mode":"read"}],` +
-		`"resources":[` + strings.Replace(aContainerMounting, "%s", "/services/media/movies", 1) + `]}`))
-	if err != nil {
-		t.Fatalf("a mount of a path the module declares it accesses was refused: %v", err)
-	}
-}
-
-// The machine's facility — the container runtime's socket — is granted by the capability that names
-// it, and declaring it as the module's own directory would be a lie the host would act on. This is
-// the case the first version of this check refused, and was withdrawn for: the builder.
-func TestTheRuntimeSocketIsGrantedByTheCapabilityAndNotOtherwise(t *testing.T) {
-	granted := `{"module":"builder","capabilities":["container-runtime"],"resources":[` +
-		strings.Replace(aContainerMounting, "%s", "/var/run/docker.sock", 1) + `]}`
-	if _, err := ParseManifest([]byte(granted)); err != nil {
-		t.Fatalf("a module with the container-runtime capability may mount its socket: %v", err)
-	}
-	if _, err := ParseManifest(manifestMounting("/var/run/docker.sock", "")); err == nil {
-		t.Fatal("a module mounted the container runtime's socket without declaring the capability, and was accepted")
-	}
-}
-
-// **Every manifest in the catalogue (internal/beside) passes**, so the rule is not one the catalogue
-// is already breaking.
-func TestEveryCatalogueManifestDeclaresWhatItMounts(t *testing.T) {
-	files, _ := filepath.Glob(filepath.Join(beside.Catalogue(t), "*", "module.json"))
-	if len(files) == 0 {
-		t.Fatal("no manifests in the catalogue, so this proved nothing")
-	}
-	root := beside.Dir(t, "mesh-catalog") // once: it copies the captured tree
-	for _, file := range files {
-		if _, err := ReadTreeManifest(root, filepath.Dir(file)); err != nil {
-			t.Errorf("%s: %v", filepath.Base(filepath.Dir(file)), err)
-		}
-	}
-}
-
-// Where a bound fact lands is the mesh's file too, and a container may mount it directly.
-func TestAMountOfABoundFactIsAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"store","requires":["model-access"],` +
-		`"binds":{"model-access":"/var/lib/store/model.json"},"resources":[` +
-		strings.Replace(aContainerMounting, "%s", "/var/lib/store/model.json", 1) + `]}`))
-	if err != nil {
-		t.Fatalf("a mount of the file the mesh writes a binding to was refused: %v", err)
-	}
-}
-
-// The file a filter module's rule set is written to is declared by `filtering.into` (novox/hq ADR
-// 0169): the module's runtime mounts it to reload the mesh's own table, and nothing else declares it.
-func TestAMountOfTheFilterFileIsDeclaredByFilteringInto(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"nftables","filtering":{"into":"/etc/nftables.conf"},` +
-		`"resources":[` + strings.Replace(aContainerMounting, "%s", "/etc/nftables.conf", 1) + `]}`))
-	if err != nil {
-		t.Fatalf("a filter module mounting its own filter file was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/names_test.go b/internal/catalogue/names_test.go
deleted file mode 100644
index 846d9e99..00000000
--- a/internal/catalogue/names_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func containersOf(t *testing.T, r Resolution, with Rendering) []map[string]any {
-	t.Helper()
-	out, err := r.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var found []map[string]any
-	for _, res := range out {
-		if res["type"] == "container" {
-			found = append(found, res)
-		}
-	}
-	return found
-}
-
-func namesOf(r map[string]any) []string {
-	var out []string
-	if given, ok := r["hosts"].([]any); ok {
-		for _, h := range given {
-			out = append(out, h.(string))
-		}
-	}
-	return out
-}
-
-// No mesh name is written into a container (novox/hq ADR 0148). It resolves them through its
-// machine's resolver at the moment it asks, so a name that moves is answered differently by the
-// next lookup, in every container, with nothing recreated.
-//
-// Checked the way the record says: the declaration a container gets does not move when the mesh's
-// roster does. A roster with one machine and a roster with three produce the same container, byte
-// for byte, so the digest a host computes from it cannot move either — which is what stopped one
-// name moving from replacing every container in the mesh (issue 151).
-func TestAContainerIsTheSameWhateverTheMeshsRosterSays(t *testing.T) {
-	module := Manifest{Module: "app", Resources: []map[string]any{{"id": "web", "type": "container",
-		"name": "web", "image": "registry.example/web@sha256:" + strings.Repeat("a", 64)}}}
-	one := containersOf(t, Resolution{Node: "laptop", Modules: []Manifest{module}},
-		Rendering{Names: map[string]string{"laptop.internal": "10.42.0.2"}})
-	three := containersOf(t, Resolution{Node: "laptop", Modules: []Manifest{module}},
-		Rendering{Names: map[string]string{
-			"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2", "git.example.tld": "10.42.0.1",
-		}})
-	if len(one) != 1 || len(three) != 1 {
-		t.Fatalf("expected one container each, got %d and %d", len(one), len(three))
-	}
-	if given := namesOf(three[0]); len(given) != 0 {
-		t.Fatalf("the mesh's names were copied into the container: %v", given)
-	}
-	if !reflect.DeepEqual(one[0], three[0]) {
-		t.Fatalf("the container moved with the roster:\n%v\n%v", one[0], three[0])
-	}
-}
-
-// The names a module declares for itself are its own: part of what the module is, kept exactly as
-// written, and the mesh does not know what they mean. They are the one thing in a container's
-// hosts that does move its identity, because they do not move when the mesh's roster does.
-func TestAContainersOwnNamesAreKeptAsWritten(t *testing.T) {
-	got := containersOf(t, Resolution{Node: "laptop", Modules: []Manifest{{
-		Module: "app",
-		Resources: []map[string]any{{"id": "web", "type": "container", "name": "web",
-			"image": "registry.example/web@sha256:" + strings.Repeat("a", 64),
-			"hosts": []any{"something.else:203.0.113.9"}}},
-	}}}, Rendering{Names: map[string]string{"anchor.internal": "10.42.0.1"}})
-
-	given := namesOf(got[0])
-	if len(given) != 1 || given[0] != "something.else:203.0.113.9" {
-		t.Fatalf("the container's own names were not kept as written: %v", given)
-	}
-}
-
-// No resource is given a `hosts` key it did not declare. A file or a service carrying one is a
-// declaration the host refuses outright — it takes no unknown field — so an invented key breaks
-// the whole machine rather than one resource.
-func TestNothingIsGivenNamesItDidNotDeclare(t *testing.T) {
-	out, err := Resolution{Node: "laptop", Modules: []Manifest{{
-		Module: "app",
-		Resources: []map[string]any{
-			{"id": "conf", "type": "file", "path": "/etc/app.conf", "content": "x", "mode": "0644"},
-			{"id": "run", "type": "service", "unit": "app.service", "state": "running"},
-			{"id": "web", "type": "container", "name": "web",
-				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
-		},
-	}}}.Declaration(Rendering{Names: map[string]string{"anchor.internal": "10.42.0.1"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if _, given := r["hosts"]; given {
-			t.Fatalf("a %v was given names it never declared: %v", r["type"], r)
-		}
-	}
-}
diff --git a/internal/catalogue/naming_test.go b/internal/catalogue/naming_test.go
deleted file mode 100644
index c168ea46..00000000
--- a/internal/catalogue/naming_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A provision names what the consumer is coupled to (novox/hq ADR 0027).
-//
-// The fault this defends against does not look like a fault: resolution succeeds, the module
-// deploys, and the first query fails somewhere else entirely. Every earlier test had exactly one
-// provider of each name, so no mismatch was expressible and none was caught.
-func TestAModuleMayNotProvideAGenericDatabase(t *testing.T) {
-	for _, hidden := range []string{"database", "db", "sql", "sql-database"} {
-		_, err := ParseManifest([]byte(`{"module":"postgres","version":"1",
-			"provides":[{"name":"` + hidden + `","scope":"mesh"}]}`))
-		if err == nil {
-			t.Fatalf("providing %q was accepted; a requirement for it matches any engine", hidden)
-		}
-		for _, want := range []string{hidden, "postgres-database", "first query"} {
-			if !strings.Contains(err.Error(), want) {
-				t.Errorf("refusing %q did not mention %q, so nobody learns what to write:\n%v",
-					hidden, want, err)
-			}
-		}
-	}
-}
-
-// The rule is about coupling, not about specificity everywhere. Naming `route` after a particular
-// proxy would be the same error in the other direction.
-func TestARoleNameIsFineWhereTheConsumerCannotTellTheDifference(t *testing.T) {
-	for _, role := range []string{"route", "resolver", "artifact-store", "postgres-database"} {
-		if _, err := ParseManifest([]byte(`{"module":"m","version":"1",
-			"provides":[{"name":"` + role + `","scope":"mesh"}]}`)); err != nil {
-			t.Errorf("providing %q was refused, and it names what a consumer actually gets: %v",
-				role, err)
-		}
-	}
-}
-
-// A module may not declare an action, and it is refused where it was written.
-//
-// The host refuses one arriving over the link, which is the bound the whole security argument
-// rests on (novox/hq ADR 0005) and is enforced in the right place. But a module's resources reach
-// a machine *over* the link, so a manifest carrying an action used to be accepted here, stored,
-// resolved and pushed — and then refused on the machine, in a log, with nothing tying it back to
-// the manifest. Enforced at the far end only is enforced and not usable.
-func TestAModuleMayNotDeclareAnAction(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"probe","version":"1","resources":[
-		{"id":"migrate","type":"action","command":["/bin/true"],"verify":["/bin/true"]}]}`))
-	if err == nil {
-		t.Fatal("a manifest declaring an action was accepted, and the machine would refuse it")
-	}
-	if !strings.Contains(err.Error(), "may not") || !strings.Contains(err.Error(), "0005") {
-		t.Errorf("the refusal does not say what rule it is: %v", err)
-	}
-	// And it says what to do instead, because "you may not" without an alternative is where a
-	// module author stops.
-	if !strings.Contains(err.Error(), "ships a program") {
-		t.Errorf("the refusal names no alternative: %v", err)
-	}
-}
-
-// Every other shape a module may declare still passes, so the check above bounds one thing.
-func TestTheOtherShapesAreStillAccepted(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"probe","version":"1","resources":[
-		{"id":"d","type":"directory","path":"/var/lib/probe","mode":"0700"},
-		{"id":"f","type":"file","path":"/var/lib/probe/x","content":"x\n"},
-		{"id":"n","type":"network","name":"probe"},
-		{"id":"c","type":"container","name":"probe","image":"probe@sha256:` +
-		`0000000000000000000000000000000000000000000000000000000000000000"}]}`))
-	if err != nil {
-		t.Fatalf("an ordinary manifest was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/needs_test.go b/internal/catalogue/needs_test.go
deleted file mode 100644
index 8a176a19..00000000
--- a/internal/catalogue/needs_test.go
+++ /dev/null
@@ -1,124 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A secret a module needs in order to be itself.
-//
-// A database has a superuser password, a broker an administrator, a registry an account. None is
-// *for* anybody — it is not the credential a consumer is given, and the mechanism that hands
-// those out has a consumer in the middle of it.
-
-func needy() Manifest {
-	return Manifest{
-		Module: "postgres", Version: "1",
-		OwnSecrets: OwnSecrets{"superuser": {Path: "/var/lib/mesh/postgres/superuser"}},
-		Resources: []map[string]any{
-			{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
-		},
-	}
-}
-
-func TestAModulesOwnSecretLandsSealed(t *testing.T) {
-	got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{
-		Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if r["path"] != "/var/lib/mesh/postgres/superuser" {
-			continue
-		}
-		if r["sealed"] != "c2VhbGVk" {
-			t.Fatalf("got %v", r)
-		}
-		if r["content"] != nil {
-			t.Fatal("a module's own secret was written in the clear")
-		}
-		return
-	}
-	t.Fatalf("no secret was written: %v", out)
-}
-
-func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
-	// Skipping it would start a database with no password it knows, which fails to authenticate
-	// three layers from the machine reporting it.
-	got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
-	_, err := got.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a module needing a secret was declared without one")
-	}
-	if !strings.Contains(err.Error(), "superuser") {
-		t.Fatalf("the refusal does not name what is missing: %v", err)
-	}
-}
-
-func TestANeedIsAnAbsolutePath(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"postgres","version":"1",
-		"own-secrets":{"superuser":"superuser.txt"}}`))
-	if err == nil {
-		t.Fatal("a relative path was accepted")
-	}
-	if !strings.Contains(err.Error(), "absolute path") {
-		t.Fatalf("unhelpful refusal: %v", err)
-	}
-}
-
-func TestAModuleMayNeedSeveralThings(t *testing.T) {
-	// A password and a token, say. Telling them apart is the module's business, not the mesh's.
-	m := needy()
-	m.OwnSecrets["replication"] = OwnSecret{Path: "/var/lib/mesh/postgres/replication"}
-	got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), World{})
-	out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{
-		"postgres": {"superuser": "b25l", "replication": "dHdv"},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	seen := map[string]string{}
-	for _, r := range out {
-		if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
-			seen[path], _ = r["sealed"].(string)
-		}
-	}
-	if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
-		t.Fatalf("two needs did not land as two secrets: %v", seen)
-	}
-}
-
-// A manifest written against the old name is told what the field became.
-//
-// `needs` and `secrets` were both name-to-path and differed only in whose secret it was, so
-// reaching for the wrong one parsed cleanly and failed somewhere else entirely. Refusing the old
-// name with "unknown field" would be correct and unhelpful: whoever wrote it knew what they meant,
-// and the mesh knows what it is called now.
-func TestAManifestUsingTheOldNameIsToldTheNewOne(t *testing.T) {
-	_, err := ParseManifest([]byte(
-		`{"module":"postgres","version":"1","needs":{"superuser":"/var/lib/superuser"}}`))
-	if err == nil {
-		t.Fatal("a manifest using the old name was accepted, so two fields now mean one thing")
-	}
-	for _, want := range []string{"needs", "own-secrets"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not mention %q: %v", want, err)
-		}
-	}
-}
-
-// And an ordinary unknown key is still refused as one, rather than being guessed at.
-func TestAnInventedKeyIsNotTreatedAsARename(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"postgres","version":"1","nonsense":{}}`))
-	if err == nil {
-		t.Fatal("an invented key was accepted")
-	}
-	if strings.Contains(err.Error(), "is now called") {
-		t.Fatalf("an invented key was reported as a rename: %v", err)
-	}
-}
diff --git a/internal/catalogue/no_subjects_test.go b/internal/catalogue/no_subjects_test.go
deleted file mode 100644
index 23c46c34..00000000
--- a/internal/catalogue/no_subjects_test.go
+++ /dev/null
@@ -1,124 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// **A manifest holds no subject** (novox/hq design 29 §1).
-//
-// A module names its events, tools and seats locally, and the mesh derives where they land. The
-// property that buys: reorganise the subject space and every manifest in the catalogue is still
-// correct. It holds today by construction — nothing reads a subject from a manifest — and a rule
-// held by construction is one a later field breaks quietly, with the symptom appearing as a
-// permission that does not match a subject rather than as a manifest that was wrong.
-func TestNoManifestContainsASubject(t *testing.T) {
-	root := beside.Catalogue(t)
-	entries, err := os.ReadDir(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Anything in the mesh's own subject space, and anything shaped like a wire address.
-	subject := regexp.MustCompile(`^(mesh|\$JS)\.[a-zA-Z0-9_*>.-]+$`)
-
-	var found []string
-	var walk func(module string, path string, v any)
-	walk = func(module, path string, v any) {
-		switch t := v.(type) {
-		case string:
-			if subject.MatchString(t) {
-				found = append(found, module+" "+path+" = "+t)
-			}
-		case map[string]any:
-			for k, inner := range t {
-				walk(module, path+"."+k, inner)
-			}
-		case []any:
-			for _, inner := range t {
-				walk(module, path+"[]", inner)
-			}
-		}
-	}
-
-	checked := 0
-	for _, e := range entries {
-		if !e.IsDir() {
-			continue
-		}
-		raw, err := os.ReadFile(filepath.Join(root, e.Name(), "module.json"))
-		if err != nil {
-			continue
-		}
-		var m any
-		if err := json.Unmarshal(raw, &m); err != nil {
-			t.Errorf("%s: %v", e.Name(), err)
-			continue
-		}
-		checked++
-		walk(e.Name(), "", m)
-	}
-	if checked == 0 {
-		t.Fatal("no manifests read, so this proved nothing")
-	}
-	if len(found) > 0 {
-		t.Errorf("a manifest names a subject, so reorganising the subject space would mean "+
-			"editing the catalogue:\n  %s", strings.Join(found, "\n  "))
-	}
-	t.Logf("%d manifests hold no subject", checked)
-}
-
-// **Every module's event names are what design 29 says, across the whole catalogue.**
-//
-// The rule above holds by construction and turned out to be weaker than it reads: a manifest holds
-// no subject, and every manifest in the catalogue still held the old bus's routing key, which
-// derives into a namespace nobody owns (novox/hq 04-ISSUES/127). Nothing failed — the services
-// started and none of them reacted. This is the check that was missing.
-func TestEveryManifestsEventNamesAreLocal(t *testing.T) {
-	manifests := theCatalogue(t)
-
-	var problems []string
-	for _, m := range manifests {
-		problems = append(problems, EventProblems(m)...)
-	}
-	if len(problems) > 0 {
-		t.Fatalf("the catalogue holds %d event name(s) the mesh would derive wrongly:\n  %s",
-			len(problems), strings.Join(problems, "\n  "))
-	}
-}
-
-// theCatalogue is every manifest of the catalogue internal/beside finds, parsed the way registration
-// parses one.
-func theCatalogue(t *testing.T) []Manifest {
-	t.Helper()
-	root := beside.Catalogue(t)
-	entries, err := os.ReadDir(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var out []Manifest
-	for _, e := range entries {
-		if !e.IsDir() {
-			continue
-		}
-		raw, err := os.ReadFile(filepath.Join(root, e.Name(), "module.json"))
-		if err != nil {
-			continue
-		}
-		var m Manifest
-		if err := json.Unmarshal(raw, &m); err != nil {
-			t.Fatalf("%s: %v", e.Name(), err)
-		}
-		out = append(out, m)
-	}
-	if len(out) == 0 {
-		t.Fatalf("no manifests under %s, so this proved nothing", root)
-	}
-	return out
-}
diff --git a/internal/catalogue/node_resolver_test.go b/internal/catalogue/node_resolver_test.go
deleted file mode 100644
index b5cec6d8..00000000
--- a/internal/catalogue/node_resolver_test.go
+++ /dev/null
@@ -1,216 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0247: a machine's own resolver is a node seat, held only where something requires
-// `split-dns`; where it is held it writes the resolver file and the uplink's holder steps back from it.
-
-// The seat: node-scoped, decided by ADR 0247, and its three verbs required of every holder — a holder
-// exists only once the module serving them does, so nothing has to be optional while it catches up.
-func TestTheMachinesOwnResolverIsANodeSeatWithItsVerbs(t *testing.T) {
-	s, ok := SeatNamed(ResolverSeat)
-	if !ok {
-		t.Fatalf("%s is not in the mesh's set", ResolverSeat)
-	}
-	if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0247" || s.Delivers != "" || s.Replicated {
-		t.Errorf("%s is %+v; a node seat under ADR 0247 that delivers nothing", ResolverSeat, s)
-	}
-	var got []string
-	for _, v := range s.Serves {
-		got = append(got, v.Name)
-		if v.Optional {
-			t.Errorf("%s.%s is optional; its first holder serves it", ResolverSeat, v.Name)
-		}
-		if v.Description == "" || v.Input["type"] != "object" || len(v.Replaces) == 0 {
-			t.Errorf("%s.%s has no description, no object schema or says it replaces nothing", ResolverSeat, v.Name)
-		}
-	}
-	if strings.Join(got, " ") != "routes route unroute" {
-		t.Errorf("%s serves %v, not routes, route and unroute", ResolverSeat, got)
-	}
-	// The verbs name a link, domains and servers, and never a VPN: the resolver knows nothing of one.
-	for _, v := range s.Serves {
-		if strings.Contains(strings.ToLower(v.Description), "forti") {
-			t.Errorf("%s.%s names a VPN client: %s", ResolverSeat, v.Name, v.Description)
-		}
-	}
-}
-
-// localResolver is a stand-in holder: it claims the seat and renders the resolver file naming the
-// machine's own address. What is under test is the controller's rule, not the catalogue's module.
-func localResolver() Manifest {
-	return Manifest{Module: "local-resolver", Version: "1",
-		Claims: []Claim{{Name: ResolverSeat, Scope: ScopeNode}},
-		Facts: map[string]RosterFile{"resolvers": {Path: ResolverFile,
-			Template: "# Managed by the mesh\n{{range .Machines}}{{if eq .Name $.Node}}nameserver {{.Address}}\n{{end}}{{end}}"}}}
-}
-
-func splitDNSLaptop() Node {
-	return Node{Name: "laptop", At: "laptop.internal", Capabilities: map[string]bool{
-		"package-manager": true, "service-manager": true, "uplink-systemd-networkd": true}}
-}
-
-// Where a module holds node-resolver, the machine is composed one resolver file, the holder's, naming
-// the machine's own address; the uplink's holder composes everything else it declares, and not that file.
-func TestWhereTheResolverIsHeldItWritesTheFileAndTheUplinkStepsBack(t *testing.T) {
-	shelf := resolverShelf(t)
-	shelf["local-resolver"] = localResolver()
-	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "local-resolver"}, splitDNSLaptop(), World{})
-	if err != nil {
-		t.Fatalf("the resolver's holder and the uplink's were refused together: %v", err)
-	}
-	out, err := got.Declaration(Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
-		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
-		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var files []string
-	for _, r := range out {
-		if r["path"] == ResolverFile {
-			files = append(files, r["id"].(string))
-		}
-	}
-	if strings.Join(files, " ") != "local-resolver.fact-resolvers" {
-		t.Fatalf("the resolver file is composed as %v; once, the resolver's", files)
-	}
-	content := byID(out)["local-resolver.fact-resolvers"]["content"].(string)
-	if !strings.Contains(content, "nameserver 10.42.0.2\n") || strings.Contains(content, "10.42.0.1") {
-		t.Errorf("the resolver file does not name this machine's own resolver alone:\n%s", content)
-	}
-	// The uplink's holder is still composed: only the one file moved.
-	uplinkComposed := false
-	for _, r := range out {
-		if id, _ := r["id"].(string); strings.HasPrefix(id, "systemd-networkd.") {
-			uplinkComposed = true
-		}
-	}
-	if !uplinkComposed {
-		t.Errorf("the uplink's holder composed nothing once the resolver was held")
-	}
-}
-
-// Where nobody holds it, nothing changes: the uplink's holder writes the file, listing the mesh's
-// resolvers (ADR 0223) — every machine but the one that requires split-dns.
-func TestWithoutTheResolverTheUplinkWritesTheFileAsBefore(t *testing.T) {
-	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "systemd-networkd"}, splitDNSLaptop(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
-		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
-		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if r := byID(out)["systemd-networkd.fact-resolvers"]; r == nil || r["path"] != ResolverFile {
-		t.Fatalf("without the resolver, the uplink's holder no longer writes the resolver file: %v", r)
-	}
-}
-
-// Only the uplink's holder steps back. A third module rendering or declaring the file beside the
-// resolver's is two owners of one path, refused as before; and a module rendering it without holding
-// the seat is not the resolver, so the uplink's holder does not step back for it.
-func TestOnlyTheUplinkStepsBackForTheResolver(t *testing.T) {
-	uplink := Manifest{Module: "uplink", Version: "1", Claims: []Claim{{Name: "node-uplink"}},
-		Facts: map[string]RosterFile{"resolvers": {Path: ResolverFile, Template: "nameserver 10.42.0.1\n"}}}
-	if p := checkResources([]Manifest{uplink, localResolver()}); len(p) != 0 {
-		t.Errorf("the uplink's holder and the resolver's were refused together: %v", p)
-	}
-	other := Manifest{Module: "other", Version: "1",
-		Facts: map[string]RosterFile{"mine": {Path: ResolverFile, Template: "nameserver 10.42.0.9\n"}}}
-	if p := checkResources([]Manifest{uplink, localResolver(), other}); len(p) == 0 {
-		t.Error("a third module wrote the resolver file beside the resolver's")
-	}
-	if p := checkResources([]Manifest{uplink, other}); len(p) == 0 {
-		t.Error("a module that does not hold node-resolver took the resolver file from the uplink's holder")
-	}
-	declared := Manifest{Module: "declared", Version: "1", Resources: []map[string]any{
-		{"id": "mine", "type": "file", "path": ResolverFile, "content": "nameserver 10.42.0.9\n"}}}
-	if p := checkResources([]Manifest{uplink, localResolver(), declared}); len(p) == 0 {
-		t.Error("a module declaring the resolver file was let beside the resolver's")
-	}
-	// What steps back is the one file: the uplink's other facts stay.
-	uplink.Facts["hosts"] = RosterFile{Path: "/etc/elsewhere", Template: "x"}
-	if got := stepsBack(uplink, []Manifest{uplink, localResolver()}); len(got.Facts) != 1 || got.Facts["hosts"].Path == "" {
-		t.Errorf("the uplink's holder lost more than the resolver file: %v", got.Facts)
-	}
-	if got := stepsBack(uplink, []Manifest{uplink}); len(got.Facts) != 2 {
-		t.Errorf("the uplink's holder stepped back with no resolver held: %v", got.Facts)
-	}
-}
-
-// The catalogue as it is: every holder of node-resolver renders the resolver file as the mesh's own
-// (its header is how the uplink's verb and the node-engine read a file as the mesh's), and provides
-// split-dns at the machine's reach — a requirement is answered only on the same machine and never pulls
-// the resolver in. Skipped while the catalogue has no holder.
-func TestTheCataloguesResolverHoldersWriteTheFileAndProvideSplitDNS(t *testing.T) {
-	held := 0
-	for _, m := range theCatalogue(t) {
-		if !holdsSeat(m, ResolverSeat) {
-			continue
-		}
-		held++
-		f, ok := m.Facts["resolvers"]
-		if !ok || f.Path != ResolverFile || !strings.HasPrefix(f.Template, "# Managed by the mesh") {
-			t.Errorf("%s holds %s and does not render the resolver file as the mesh's: %+v", m.Module, ResolverSeat, f)
-		}
-		provides := false
-		for _, o := range m.Provides {
-			if o.Name == "split-dns" && o.Reach == ReachMachine {
-				provides = true
-			}
-		}
-		if !provides {
-			t.Errorf("%s holds %s and does not provide split-dns at the machine's reach", m.Module, ResolverSeat)
-		}
-	}
-	if held == 0 {
-		t.Skip("no module of the catalogue holds node-resolver yet")
-	}
-}
-
-// The catalogue's systemd-resolved, composed on a machine beside its uplink: the resolver file names the
-// machine's own private address alone, its kept copy is the same file, and resolved is given every mesh
-// resolver as its default route and the private address to listen on. Skipped without the catalogue.
-func TestTheCataloguesResolverComposesOnAMachine(t *testing.T) {
-	shelf := resolverShelf(t)
-	shelf["systemd-resolved"] = catalogueManifest(t, "systemd-resolved")
-	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "systemd-resolved"}, splitDNSLaptop(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
-		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1", "home.internal": "10.42.0.3"}},
-		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ids := byID(out)
-	resolv, _ := ids["systemd-resolved.fact-resolvers"]["content"].(string)
-	kept, _ := ids["systemd-resolved.fact-kept"]["content"].(string)
-	if !strings.Contains(resolv, "\nnameserver 10.42.0.2\noptions timeout:1 attempts:2 edns0\n") || resolv != kept {
-		t.Errorf("the resolver file does not name this machine's own resolver alone, or its copy differs:\n%s", resolv)
-	}
-	if ids["systemd-networkd.fact-resolvers"] != nil {
-		t.Error("the uplink's holder still writes the resolver file beside the resolver's")
-	}
-	conf, _ := ids["systemd-resolved.fact-resolved"]["content"].(string)
-	for _, want := range []string{"\nDNS=10.42.0.1 10.42.0.3 \n", "\nDNSStubListenerExtra=10.42.0.2\n", "\nFallbackDNS=\n"} {
-		if !strings.Contains(conf, want) {
-			t.Errorf("resolved's drop-in lacks %q:\n%s", want, conf)
-		}
-	}
-	if s, _ := ids["systemd-resolved.fact-suffix"]["content"].(string); s != "internal\n" {
-		t.Errorf("the mesh's domain is rendered as %q", s)
-	}
-}
diff --git a/internal/catalogue/operators_machine_test.go b/internal/catalogue/operators_machine_test.go
deleted file mode 100644
index 9dfa7b37..00000000
--- a/internal/catalogue/operators_machine_test.go
+++ /dev/null
@@ -1,191 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"strings"
-	"testing"
-)
-
-// A `user` shape and a user-scoped unit name the operator account the way a home file does
-// (novox/hq ADR 0176, ADR 0177): with ${machine:account}, resolved when the module is assigned.
-func TestAUserShapeAndAUserScopedUnitNameTheAccount(t *testing.T) {
-	facts := map[string]string{"account": "ops", "account-home": "/home/ops"}
-	login := map[string]any{"type": "user", "id": "login", "name": "${machine:account}", "shell": "/usr/bin/zsh"}
-	if err := machineInto(login, facts, "zsh"); err != nil {
-		t.Fatal(err)
-	}
-	if login["name"] != "ops" {
-		t.Fatalf("the user shape did not learn the account: %v", login["name"])
-	}
-	watcher := map[string]any{"type": "service", "id": "watcher", "unit": "i3-reload-watcher.service",
-		"scope": "user", "user": "${machine:account}"}
-	if err := machineInto(watcher, facts, "i3"); err != nil {
-		t.Fatal(err)
-	}
-	if watcher["user"] != "ops" {
-		t.Fatalf("the user-scoped unit did not learn the account: %v", watcher["user"])
-	}
-	// A machine with no operator account refuses rather than writing the literal.
-	err := machineInto(map[string]any{"type": "user", "id": "login", "name": "${machine:account}"},
-		map[string]string{"address": "10.0.0.1"}, "zsh")
-	if err == nil || !strings.Contains(err.Error(), "${machine:account}") {
-		t.Fatalf("a user shape on a machine with no account was not refused by name: %v", err)
-	}
-}
-
-// The service manager is a seat of the mesh's own with the unit verbs as its contract (novox/hq
-// ADR 0177): every verb described, with a schema, taking a scope.
-func TestTheServiceManagerSeatServesTheUnitVerbs(t *testing.T) {
-	seat, ok := SeatNamed("node-service-manager")
-	if !ok {
-		t.Fatal("node-service-manager is not a seat the mesh defines")
-	}
-	if seat.Scope != ScopeNode {
-		t.Fatalf("the service manager is a role each machine has once, and the seat is %s-scoped", seat.Scope)
-	}
-	want := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal", "failed", "reset-failed", "wanted-by", "unlink-dangling"}
-	var got []string
-	for _, v := range seat.Serves {
-		got = append(got, v.Name)
-		if v.Description == "" || v.Input == nil {
-			t.Fatalf("%s is promised without a description or a schema", v.Name)
-		}
-		props, _ := v.Input["properties"].(map[string]any)
-		if _, has := props["scope"]; !has {
-			t.Fatalf("%s takes no scope, and a user unit could not be asked for", v.Name)
-		}
-	}
-	if strings.Join(got, ",") != strings.Join(want, ",") {
-		t.Fatalf("the seat serves %v, not %v", got, want)
-	}
-}
-
-// **`failed` joins the seat optional** (the operator's direction 2026-10-07): the holder running today,
-// which does not serve it, still holds the seat; the holder that serves it is not refused; and a verb
-// the seat does not promise is still refused, and one it requires is still required.
-func TestFailedIsAnOptionalVerbOfTheServiceManager(t *testing.T) {
-	seat, _ := SeatNamed(ServiceManagerSeat)
-	holder := func(serves ...string) Manifest {
-		return Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode, Serves: serves}}}
-	}
-	eight := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-		"reset-failed", "wanted-by", "unlink-dangling"}
-	if err := CanHold(holder(eight...), seat); err != nil {
-		t.Fatalf("a holder without failed is refused: %v", err)
-	}
-	if err := CanHold(holder(append(eight, "failed")...), seat); err != nil {
-		t.Fatalf("a holder serving failed is refused: %v", err)
-	}
-	if err := CanHold(holder(append(eight, "fail")...), seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
-		t.Fatalf("a verb the seat does not promise was accepted: %v", err)
-	}
-	if err := CanHold(holder(eight[1:]...), seat); err == nil || !strings.Contains(err.Error(), "does not serve units") {
-		t.Fatalf("a holder missing a required verb was accepted: %v", err)
-	}
-	optional := map[string]bool{"failed": true}
-	for _, v := range seat.Serves {
-		if v.Optional != optional[v.Name] {
-			t.Errorf("%s optional: %v", v.Name, v.Optional)
-		}
-	}
-}
-
-// **`reset-failed`, `wanted-by` and `unlink-dangling` are required** (novox/hq issue 332, ADR 0246 step 3):
-// every holder serves them, so a holder serving only the nine verbs before them is refused by the verb it
-// lacks; a holder serving all twelve holds the seat; each replaces the shell command it names; and read
-// back from the store's row they stay required.
-func TestResetFailedWantedByAndUnlinkDanglingAreRequiredVerbsOfTheServiceManager(t *testing.T) {
-	defer UseSeats(DefaultSeats())
-	nine := []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal", "failed"}
-	all := append(slices.Clone(nine), "reset-failed", "wanted-by", "unlink-dangling")
-	holder := func(serves ...string) Manifest {
-		return Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode, Serves: serves}}}
-	}
-	refusedWithout := func(seat Seat) {
-		t.Helper()
-		for _, verb := range []string{"reset-failed", "wanted-by", "unlink-dangling"} {
-			serves := slices.DeleteFunc(slices.Clone(all), func(v string) bool { return v == verb })
-			if err := CanHold(holder(serves...), seat); err == nil || !strings.Contains(err.Error(), "does not serve "+verb) {
-				t.Errorf("a holder not serving %s holds the seat: %v", verb, err)
-			}
-		}
-	}
-	seat, _ := SeatNamed(ServiceManagerSeat)
-	if err := CanHold(holder(nine...), seat); err == nil {
-		t.Fatal("a holder serving only the nine verbs before issue 332 holds the seat")
-	}
-	refusedWithout(seat)
-	if err := CanHold(holder(all...), seat); err != nil {
-		t.Fatalf("a holder serving all twelve is refused: %v", err)
-	}
-	if err := CanHold(holder(append(slices.Clone(all), "why-started")...), seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
-		t.Fatalf("a verb the seat does not promise was accepted: %v", err)
-	}
-	replaces := map[string]string{"reset-failed": "systemctl reset-failed", "wanted-by": "systemctl list-dependencies --reverse",
-		"unlink-dangling": "rm ~/.config/systemd/user/*.wants/<unit>"}
-	for _, v := range seat.Serves {
-		want, ok := replaces[v.Name]
-		if !ok {
-			continue
-		}
-		if v.Optional {
-			t.Errorf("%s is still optional", v.Name)
-		}
-		if !slices.Contains(v.Replaces, want) {
-			t.Errorf("%s does not say it replaces %q: %v", v.Name, want, v.Replaces)
-		}
-		props, _ := v.Input["properties"].(map[string]any)
-		if _, has := props["unit"]; !has {
-			t.Errorf("%s takes no unit", v.Name)
-		}
-		if v.Name == "unlink-dangling" {
-			// Removing is the person's act: their reason is required, and kept with the record.
-			if required, _ := v.Input["required"].([]string); !slices.Contains(required, "why") {
-				t.Errorf("unlink-dangling does not require why: %v", v.Input["required"])
-			}
-		}
-		delete(replaces, v.Name)
-	}
-	if len(replaces) > 0 {
-		t.Fatalf("the seat does not promise %v", replaces)
-	}
-	// The row as seeding stores it: every verb, the mark not a column.
-	var rows []Seat
-	for _, s := range DefaultSeats() {
-		row := s
-		row.Serves = nil
-		for _, v := range s.Serves {
-			row.Serves = append(row.Serves, Verb{Name: v.Name, Description: v.Description, Input: v.Input})
-		}
-		rows = append(rows, row)
-	}
-	UseSeats(rows)
-	seat, _ = SeatNamed(ServiceManagerSeat)
-	refusedWithout(seat)
-	if err := CanHold(holder(all...), seat); err != nil {
-		t.Fatalf("read back from the row, a holder serving all twelve is refused: %v", err)
-	}
-}
-
-// The optional mark is not stored, so a seat set read back from the store's rows takes it from the
-// compiled seat: otherwise `failed`, seeded into the row, would come back required.
-func TestAnOptionalVerbStaysOptionalInASetReadFromTheStore(t *testing.T) {
-	defer UseSeats(DefaultSeats())
-	var rows []Seat
-	for _, s := range DefaultSeats() {
-		row := s
-		row.Serves = nil
-		for _, v := range s.Serves {
-			row.Serves = append(row.Serves, Verb{Name: v.Name, Description: v.Description, Input: v.Input})
-		}
-		rows = append(rows, row)
-	}
-	UseSeats(rows)
-	seat, _ := SeatNamed(ServiceManagerSeat)
-	holder := Manifest{Module: "systemd", Version: "1", Claims: []Claim{{Name: ServiceManagerSeat, Scope: ScopeNode,
-		Serves: []string{"units", "status", "start", "stop", "restart", "enable", "disable", "journal",
-			"reset-failed", "wanted-by", "unlink-dangling"}}}}
-	if err := CanHold(holder, seat); err != nil {
-		t.Fatalf("a set read from rows refuses a holder without the optional failed: %v", err)
-	}
-}
diff --git a/internal/catalogue/optional_requirements_test.go b/internal/catalogue/optional_requirements_test.go
deleted file mode 100644
index 0b6f8083..00000000
--- a/internal/catalogue/optional_requirements_test.go
+++ /dev/null
@@ -1,301 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A requirement a module can run without (novox/hq ADR 0330, issue 166). The shape of the issue:
-// grafana runs without a data source and requires `influxdb-api` softly; a mesh without influxdb
-// could not assign grafana at all, and one with influxdb in its catalogue would have had it installed
-// for grafana.
-
-func optionalShelf() map[string]Manifest {
-	grafana := Manifest{Module: "grafana", Version: "1", Requires: []string{"influxdb-api", "shell"},
-		OptionalRequires: map[string]bool{"influxdb-api": true, "shell": true}}
-	return shelf(
-		Manifest{Module: "influxdb", Version: "1", Provides: FromAnywhere("influxdb-api")},
-		Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")},
-		grafana,
-		// What wants the same names hard, for the cases where one consumer's optional is another's hard.
-		Manifest{Module: "telegraf", Version: "1", Requires: []string{"influxdb-api"}},
-		Manifest{Module: "editor", Version: "1", Requires: []string{"shell"}},
-		Manifest{Module: "suite", Version: "1", Requires: []string{"editor"}},
-	)
-}
-
-func TestARequirementIsHardUnlessMarkedOptional(t *testing.T) {
-	m := mustParse(t, `{"module":"grafana","version":"1",
-		"requires":["route",{"name":"influxdb-api","optional":true},{"name":"oidc-client"}]}`)
-	if strings.Join(m.Requires, " ") != "route influxdb-api oidc-client" {
-		t.Fatalf("the requirements read as %v", m.Requires)
-	}
-	if m.IsOptional("route") || m.IsOptional("oidc-client") {
-		t.Error("a requirement without `optional` read as optional; hard is the default (ADR 0330 §1)")
-	}
-	if !m.IsOptional("influxdb-api") {
-		t.Error("a requirement marked optional read as hard")
-	}
-	// And written back as it was read, so a manifest through the store keeps its form.
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var again Manifest
-	if err := json.Unmarshal(raw, &again); err != nil {
-		t.Fatal(err)
-	}
-	if !again.IsOptional("influxdb-api") || again.IsOptional("route") || len(again.Requires) != 3 {
-		t.Fatalf("written and read back, it says %v optional %v (%s)", again.Requires, again.OptionalRequires, raw)
-	}
-	if strings.Contains(string(raw), `"name":`) {
-		t.Errorf("a requirement was stored in the long form: %s", raw)
-	}
-}
-
-// The stored form reads on a controller older than optional requirements (review of mesh-controller
-// #281). Inventory.Catalogue stops at the first manifest it cannot read, so a long-form entry inside
-// `requires` would have stopped every plan after a rollback. Stored, `requires` is plain names, as main's
-// manifest type reads it, and which are optional sits beside it in a key such a controller sets aside.
-func TestTheStoredFormReadsWhereRequiresIsAListOfNames(t *testing.T) {
-	m := mustParse(t, `{"module":"grafana","version":"1",
-		"requires":["route",{"name":"influxdb-api","optional":true}]}`)
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// main's field, exactly: `Requires []string`.
-	var older struct {
-		Requires []string `json:"requires"`
-	}
-	if err := json.Unmarshal(raw, &older); err != nil {
-		t.Fatalf("a controller reading requires as names cannot read the stored form: %v\n%s", err, raw)
-	}
-	if strings.Join(older.Requires, " ") != "route influxdb-api" {
-		t.Fatalf("it reads the requirements as %v", older.Requires)
-	}
-	var keys map[string]json.RawMessage
-	if err := json.Unmarshal(raw, &keys); err != nil {
-		t.Fatal(err)
-	}
-	if string(keys[OptionalRequiresKey]) != `["influxdb-api"]` {
-		t.Fatalf("which are optional is stored as %s", keys[OptionalRequiresKey])
-	}
-	// And this controller reads the stored form back the same, leniently and strictly.
-	var back Manifest
-	if err := json.Unmarshal(raw, &back); err != nil {
-		t.Fatal(err)
-	}
-	strict, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, got := range []Manifest{back, strict} {
-		if !got.IsOptional("influxdb-api") || got.IsOptional("route") || len(got.Requires) != 2 {
-			t.Fatalf("read back as %v optional %v", got.Requires, got.OptionalRequires)
-		}
-	}
-	// A stored list naming something the module does not require is refused.
-	if _, err := ParseManifest([]byte(`{"module":"x","version":"1","requires":["route"],"optional-requires":["mqtt-topic"]}`)); err == nil {
-		t.Error("an optional requirement the module does not require passed the check")
-	}
-}
-
-func TestARequirementsLongFormRefusesWhatItDoesNotKnow(t *testing.T) {
-	for _, raw := range []string{
-		`{"module":"x","version":"1","requires":[{"name":"influxdb-api","optinal":true}]}`,
-		`{"module":"x","version":"1","requires":[{"optional":true}]}`,
-	} {
-		if _, err := ParseManifest([]byte(raw)); err == nil {
-			t.Errorf("accepted %s", raw)
-		}
-	}
-}
-
-func TestAnOptionalRequirementWithNoProviderIsAbsentAndNothingIsInstalled(t *testing.T) {
-	// Exactly one catalogue module could answer each — the case where a hard requirement installs it.
-	// Brokered (influxdb-api, from anywhere) and on this machine (shell); both passes.
-	for _, world := range []World{{}, {Unchecked: true}} {
-		got, err := Resolve(optionalShelf(), []string{"grafana"}, reachable(), world)
-		if err != nil {
-			t.Fatalf("an optional requirement with no provider refused the assignment: %v", err)
-		}
-		if have := strings.Join(names(got), " "); have != "grafana" {
-			t.Fatalf("assigning grafana put %s on the machine; nothing is installed for an optional requirement (ADR 0330 §3)", have)
-		}
-		if world.Unchecked {
-			continue
-		}
-		want := []Absent{{Consumer: "grafana", Requirement: "influxdb-api"}, {Consumer: "grafana", Requirement: "shell"}}
-		if len(got.Absent) != 2 || got.Absent[0] != want[0] || got.Absent[1] != want[1] {
-			t.Fatalf("absent: %+v, want %+v", got.Absent, want)
-		}
-		if len(got.Needs) != 0 {
-			t.Fatalf("an absent requirement was given a binding: %+v", got.Needs)
-		}
-	}
-}
-
-func TestAnOptionalRequirementWithAProviderBindsAsAHardOne(t *testing.T) {
-	world := World{Offered: map[string][]Provider{"influxdb-api": {
-		{Node: "anchor", At: "anchor.internal", Module: "influxdb", Serves: map[string]any{"port": 8086}}}}}
-	got, err := Resolve(optionalShelf(), []string{"grafana", "zsh"}, reachable(), world)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := boundFrom(t, got, "grafana", "influxdb-api"); n.From != "anchor" || n.Module != "influxdb" {
-		t.Fatalf("bound to %s/%s", n.From, n.Module)
-	}
-	if len(got.Absent) != 0 {
-		t.Fatalf("a requirement with a provider was left absent: %+v", got.Absent)
-	}
-	// And the same assignment without the provider is absent: what binds it later is only the
-	// provider being assigned, with no act on grafana (ADR 0330 §7).
-	before, err := Resolve(optionalShelf(), []string{"grafana", "zsh"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(before.Absent) != 1 || before.Absent[0].Requirement != "influxdb-api" {
-		t.Fatalf("absent before the provider was assigned: %+v", before.Absent)
-	}
-}
-
-func TestOneConsumersOptionalRequirementIsAnothersHardOne(t *testing.T) {
-	// telegraf wants influxdb-api hard: with nothing offering it, the assignment is refused as
-	// before, naming what to assign — grafana's optional does not soften telegraf's.
-	_, err := Resolve(optionalShelf(), []string{"grafana", "telegraf"}, reachable(), World{})
-	if err == nil || !strings.Contains(err.Error(), "assign influxdb") {
-		t.Fatalf("a hard requirement with no provider was not refused naming the candidate: %v", err)
-	}
-	// And the refusal names telegraf, whose remedy it is, not grafana, which met the name first.
-	if !strings.Contains(err.Error(), "wanted by telegraf") {
-		t.Errorf("the refusal does not name the module that wants it hard: %v", err)
-	}
-	// And a module pulled in later (suite → editor) that wants the shell hard installs it, even
-	// though grafana, met first, wanted it only optionally — and grafana is then bound to it.
-	got, err := Resolve(optionalShelf(), []string{"grafana", "suite"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if have := strings.Join(names(got), " "); !strings.Contains(have, "zsh") {
-		t.Fatalf("a hard requirement met after an optional one was not installed: %s", have)
-	}
-	for _, a := range got.Absent {
-		if a.Requirement == "shell" {
-			t.Fatalf("the shell is installed and still listed absent: %+v", got.Absent)
-		}
-	}
-}
-
-func TestAHardRequirementWithNoProviderIsStillRefused(t *testing.T) {
-	_, err := Resolve(optionalShelf(), []string{"telegraf"}, reachable(), World{})
-	if err == nil || !strings.Contains(err.Error(), "influxdb") {
-		t.Fatalf("got %v", err)
-	}
-}
-
-func optionalModule(resources string) string {
-	return `{"module":"grafana","version":"1",
-		"requires":["route",{"name":"influxdb-api","optional":true}],
-		"secrets":{"influxdb-api":"/var/lib/grafana/influxdb-api"},
-		"resources":[` + resources + `]}`
-}
-
-func TestTheModuleCheckRefusesAnOptionalPlaceholderThatCouldRenderEmpty(t *testing.T) {
-	refused := map[string]string{
-		"a placeholder without a default": `{"id":"ds","type":"file","path":"/a","mode":"0644",
-			"content":"url: ${bound:influxdb-api:at}"}`,
-		"a secret outside an only-when-bound file": `{"id":"s","type":"file","path":"/a","mode":"0400",
-			"content":"${secret:influxdb-api}"}`,
-		"only-when-bound on a hard requirement": `{"id":"r","type":"file","path":"/a","mode":"0644",
-			"content":"x","only-when-bound":"route"}`,
-		"only-when-bound on something not required": `{"id":"r","type":"file","path":"/a","mode":"0644",
-			"content":"x","only-when-bound":"mqtt-topic"}`,
-		"only-when-bound on a directory": `{"id":"d","type":"directory","mode":"0700",
-			"only-when-bound":"influxdb-api"}`,
-		"a default on a hard requirement": `{"id":"r","type":"file","path":"/a","mode":"0644",
-			"content":"${bound:route:name|default:x}"}`,
-	}
-	for what, resource := range refused {
-		if _, err := ParseManifest([]byte(optionalModule(resource))); err == nil {
-			t.Errorf("%s passed the module check", what)
-		} else if what == "a placeholder without a default" && !strings.Contains(err.Error(), "|default:") {
-			t.Errorf("the refusal does not say how to write it: %v", err)
-		}
-	}
-	accepted := map[string]string{
-		"a placeholder with a default": `{"id":"ds","type":"file","path":"/a","mode":"0644",
-			"content":"url: ${bound:influxdb-api:at|default:none}"}`,
-		"a placeholder and a secret inside an only-when-bound file": `{"id":"ds","type":"file","path":"/a",
-			"mode":"0400","content":"url: ${bound:influxdb-api:at}\npassword: ${secret:influxdb-api}",
-			"only-when-bound":"influxdb-api"}`,
-	}
-	for what, resource := range accepted {
-		if _, err := ParseManifest([]byte(optionalModule(resource))); err != nil {
-			t.Errorf("%s was refused: %v", what, err)
-		}
-	}
-}
-
-func absentGrafana(t *testing.T, absent bool) Resolution {
-	t.Helper()
-	m := mustParse(t, optionalModule(`
-		{"id":"env","type":"file","path":"/var/lib/grafana/env","mode":"0644",
-		 "content":"INFLUX=${bound:influxdb-api:at|default:none}:${bound:influxdb-api:port|default:0}\n"},
-		{"id":"ds","type":"file","path":"/var/lib/grafana/ds.yaml","mode":"0400",
-		 "content":"url: ${bound:influxdb-api:at}\npassword: ${secret:influxdb-api}\n","only-when-bound":"influxdb-api"}`))
-	m.Requires = []string{"influxdb-api"}
-	m.Binds = map[string]string{"influxdb-api": "/var/lib/grafana/influxdb.json"}
-	r := Resolution{Node: "workstation", Modules: []Manifest{m}}
-	if absent {
-		r.Absent = []Absent{{Consumer: "grafana", Requirement: "influxdb-api"}}
-	} else {
-		r.Needs = []Needed{{Name: "influxdb-api", From: "anchor", At: "anchor.internal", For: "grafana",
-			Module: "influxdb", Sealed: "sealed-influx", Serves: map[string]any{"port": float64(8086)}}}
-	}
-	return r
-}
-
-func TestAnAbsentRequirementIsComposedWithItsDefaultsAndWithoutItsFiles(t *testing.T) {
-	out, err := absentGrafana(t, true).Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	env := fileNamed(out, "grafana.env")
-	if env == nil || env["content"] != "INFLUX=none:0\n" {
-		t.Fatalf("the defaults were not rendered: %v", env)
-	}
-	for _, id := range []string{"grafana.ds", "grafana." + SecretID("influxdb-api"), "grafana." + BoundID("influxdb-api")} {
-		if fileNamed(out, id) != nil {
-			t.Errorf("%s was delivered while influxdb-api is absent (ADR 0330 §5, §6)", id)
-		}
-	}
-	for _, r := range out {
-		if _, has := r[OnlyWhenBound]; has {
-			t.Errorf("%v carries %s to the node-engine, which knows no such field", r["id"], OnlyWhenBound)
-		}
-	}
-}
-
-func TestABoundOptionalRequirementIsComposedAsAHardOne(t *testing.T) {
-	out, err := absentGrafana(t, false).Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if env := fileNamed(out, "grafana.env"); env == nil || env["content"] != "INFLUX=anchor.internal:8086\n" {
-		t.Fatalf("the bound values were not rendered: %v", env)
-	}
-	ds := fileNamed(out, "grafana.ds")
-	if ds == nil {
-		t.Fatalf("the only-when-bound file was left out while bound: %v", out)
-	}
-	if _, has := ds[OnlyWhenBound]; has {
-		t.Errorf("the file carries %s to the node-engine", OnlyWhenBound)
-	}
-	for _, id := range []string{"grafana." + SecretID("influxdb-api"), "grafana." + BoundID("influxdb-api")} {
-		if fileNamed(out, id) == nil {
-			t.Errorf("%s was not delivered while bound", id)
-		}
-	}
-}
diff --git a/internal/catalogue/outside_not_given_test.go b/internal/catalogue/outside_not_given_test.go
deleted file mode 100644
index a63e3d8a..00000000
--- a/internal/catalogue/outside_not_given_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// An own secret issued outside the mesh that nobody gave (novox/hq issue 401, ADR 0228): the mesh makes no value for it,
-// so the composition places no file, a file of the module that names it says empty there, and nothing restarts on it.
-// Given, it is placed and filled like any own secret.
-
-func outsideManifest(t *testing.T) Manifest {
-	t.Helper()
-	m, err := ParseManifest([]byte(`{"module":"assistant","version":"1",
-	  "own-secrets":{
-	    "password":{"path":"/var/lib/assistant/password.secret","taken":"at-start"},
-	    "vendor-key":{"path":"/var/lib/assistant/vendor-key.secret","taken":"at-start","issued-by":"outside"}},
-	  "resources":[
-	    {"id":"env","type":"file","path":"/var/lib/assistant/env","mode":"0600",
-	     "content":"PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n"},
-	    {"id":"server","type":"container","name":"assistant","image":"assistant:1",
-	     "env-file":["/var/lib/assistant/env"],
-	     "volumes":["/var/lib/assistant/vendor-key.secret:/run/vendor-key:ro"],
-	     "secrets-in-environment":"reads its settings from the environment only"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-func resourceAt(out []map[string]any, path string) map[string]any {
-	for _, r := range out {
-		if r["path"] == path {
-			return r
-		}
-	}
-	return nil
-}
-
-func resourceNamed(out []map[string]any, name string) map[string]any {
-	for _, r := range out {
-		if r["name"] == name {
-			return r
-		}
-	}
-	return nil
-}
-
-func TestAnOutsideSecretNotGivenIsNoFileAndAFileNamingItSaysEmpty(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{"assistant": {"password": "sealed-password"}}})
-	if err != nil {
-		t.Fatalf("a module whose outside secret nobody gave did not compose: %v", err)
-	}
-	if got := resourceAt(out, "/var/lib/assistant/vendor-key.secret"); got != nil {
-		t.Fatalf("a secret nobody gave was placed: %v", got)
-	}
-	env := resourceAt(out, "/var/lib/assistant/env")
-	if env == nil {
-		t.Fatal("the module's own file is not composed")
-	}
-	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=\n" {
-		t.Fatalf("the file names the secret nobody gave as %q", content)
-	}
-	secrets, _ := env["secrets"].(map[string]any)
-	if len(secrets) != 1 || secrets["password"] != "sealed-password" {
-		t.Fatalf("the file is filled from %v", secrets)
-	}
-	server := resourceNamed(out, "assistant")
-	if on := strings.Join(stringsIn(server["restart-on"]), " "); strings.Contains(on, "vendor-key") {
-		t.Fatalf("the container restarts on a secret nobody gave: %q", on)
-	}
-}
-
-func TestAnOutsideSecretGivenIsPlacedAndFilled(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{"assistant": {
-		"password": "sealed-password", "vendor-key": "sealed-vendor-key"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	placed := resourceAt(out, "/var/lib/assistant/vendor-key.secret")
-	if placed == nil || placed["sealed"] != "sealed-vendor-key" {
-		t.Fatalf("the secret given is placed as %v", placed)
-	}
-	env := resourceAt(out, "/var/lib/assistant/env")
-	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n" {
-		t.Fatalf("the file was changed: %q", content)
-	}
-	if secrets, _ := env["secrets"].(map[string]any); secrets["vendor-key"] != "sealed-vendor-key" {
-		t.Fatalf("the file is filled from %v", secrets)
-	}
-	server := resourceNamed(out, "assistant")
-	if on := strings.Join(stringsIn(server["restart-on"]), " "); !strings.Contains(on, "assistant."+NeedID("vendor-key")) {
-		t.Fatalf("the container does not restart on the secret given: %q", on)
-	}
-}
-
-// A secret the mesh makes is still refused when it was not made: only an outside one is left out.
-func TestAnOwnSecretTheMeshMakesIsStillRefusedWhenNotMade(t *testing.T) {
-	r := Resolution{Node: "server", Modules: []Manifest{outsideManifest(t)}}
-	_, err := r.Declaration(Rendering{})
-	if nm, ok := err.(*NotMadeError); !ok || nm.Name != "password" {
-		t.Fatalf("a secret the mesh makes, not made: %v", err)
-	}
-}
diff --git a/internal/catalogue/own_name_test.go b/internal/catalogue/own_name_test.go
deleted file mode 100644
index f77ac899..00000000
--- a/internal/catalogue/own_name_test.go
+++ /dev/null
@@ -1,130 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A module that must know its own address — a login redirect, a canonical URL, an issuer — had it
-// written into its manifest as a literal (novox/hq 04-ISSUES/122): a domain in a definition, wrong on
-// every other machine. It is told instead, from the same composition the provider receives.
-
-// selfAware contributes a labelled route, binds the requirement, and writes its own name into a file.
-func selfAware(label string) Manifest {
-	m := labelled("board", label, 8080)
-	m.Requires = []string{"reverse-proxy"}
-	m.Binds = map[string]string{"reverse-proxy": "/var/lib/board/route.json"}
-	m.Resources = []map[string]any{
-		{"id": "conf", "type": "file", "path": "/var/lib/board/app.conf",
-			"content": "root = https://${bound:reverse-proxy:name}/\ninternal = ${bound:reverse-proxy:internal-name}\n"},
-	}
-	return m
-}
-
-// servingProxy is proxy() as the catalogue's route providers are declared: the provision scoped to
-// the mesh, serving nothing a consumer must know (route-adapter, route-proxy: `"serves": {"route": {}}`).
-func servingProxy() Manifest {
-	p := proxy()
-	p.Provides = []Offer{{Name: "reverse-proxy", Scope: ScopeMesh}}
-	p.Serves = map[string]map[string]any{"reverse-proxy": {}}
-	return p
-}
-
-// nodeProxy is the same provider scoped to its node, whose answer on the same machine comes from
-// `here` rather than from the mesh's needs — the other path a binding is written by.
-func nodeProxy() Manifest {
-	p := proxy()
-	p.Serves = map[string]map[string]any{"reverse-proxy": {"scheme": "http"}}
-	return p
-}
-
-// onBoth is a node with a public domain and a private-network address, so both names compose.
-func onBoth(domain string) Node {
-	n := withDomain(domain)
-	n.At = "anchor.internal"
-	return n
-}
-
-func fileAt(t *testing.T, out []map[string]any, path string) string {
-	t.Helper()
-	for _, r := range out {
-		if r["path"] == path {
-			return r["content"].(string)
-		}
-	}
-	t.Fatalf("nothing was declared at %s", path)
-	return ""
-}
-
-func TestAModuleIsToldTheNameItsProviderServes(t *testing.T) {
-	got, err := Resolve(shelf(servingProxy(), selfAware("git")), []string{"traefik", "board"},
-		onBoth("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out := mustDeclare(t, got)
-	served := received(t, out)[0].Values
-
-	var binding map[string]any
-	if err := json.Unmarshal([]byte(fileAt(t, out, "/var/lib/board/route.json")), &binding); err != nil {
-		t.Fatal(err)
-	}
-	if binding["name"] != served["name"] || binding["name"] != "git.example.tld" {
-		t.Fatalf("the module was told %v, the provider serves %v", binding["name"], served["name"])
-	}
-	if binding["internal-name"] != served["internal-name"] || binding["internal-name"] == nil {
-		t.Fatalf("internal name: module told %v, provider serves %v",
-			binding["internal-name"], served["internal-name"])
-	}
-
-	conf := fileAt(t, out, "/var/lib/board/app.conf")
-	want := "root = https://git.example.tld/\ninternal = " + served["internal-name"].(string) + "\n"
-	if conf != want {
-		t.Fatalf("the file was rendered as\n%s\nwant\n%s", conf, want)
-	}
-}
-
-func TestTheNameAModuleIsToldFollowsTheNodesDomain(t *testing.T) {
-	// The whole point: the same definition, two machines, two names — nothing edited.
-	for _, domain := range []string{"example.tld", "other.example"} {
-		got, err := Resolve(shelf(servingProxy(), selfAware("git")), []string{"traefik", "board"},
-			onBoth(domain), World{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		conf := fileAt(t, mustDeclare(t, got), "/var/lib/board/app.conf")
-		if !strings.HasPrefix(conf, "root = https://git."+domain+"/") {
-			t.Fatalf("on %s the module wrote %q", domain, conf)
-		}
-	}
-}
-
-func TestAModuleWithNoPublicNameIsNotToldOne(t *testing.T) {
-	// No public domain on the node: nothing composed, so no `name` — and a file asking for one is
-	// refused rather than rendered with a placeholder or an empty host.
-	m := selfAware("git")
-	m.Resources[0]["content"] = "root = https://${bound:reverse-proxy:name}/\n"
-	got, err := Resolve(shelf(servingProxy(), m), []string{"traefik", "board"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := got.Declaration(Rendering{}); err == nil ||
-		!strings.Contains(err.Error(), `"name"`) {
-		t.Fatalf("a file asking for a name that was never composed was not refused: %v", err)
-	}
-}
-
-func TestAModuleIsToldItsNameByANodeScopedProviderToo(t *testing.T) {
-	m := selfAware("git")
-	m.Resources[0]["content"] = "root = https://${bound:reverse-proxy:name}/\n"
-	got, err := Resolve(shelf(nodeProxy(), m), []string{"board"},
-		withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	conf := fileAt(t, mustDeclare(t, got), "/var/lib/board/app.conf")
-	if !strings.HasPrefix(conf, "root = https://git.example.tld/") {
-		t.Fatalf("a same-machine, node-scoped answer did not tell the module its name: %q", conf)
-	}
-}
diff --git a/internal/catalogue/own_secret_owner_test.go b/internal/catalogue/own_secret_owner_test.go
deleted file mode 100644
index fba354a0..00000000
--- a/internal/catalogue/own_secret_owner_test.go
+++ /dev/null
@@ -1,116 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// An own secret (or a family) may declare `owner` (novox/hq ADR 0436 §1): the account the files holding it
-// belong to on the machine, when that account is not the module's secrets-owner default. The fixture is
-// mesh-mail's future manifest shape (ADR 0436 §7): a process account `mesh-mail-send` the module makes, and its
-// own-secret family `mail-credential-*` owned by it.
-
-// mailSenderManifest is the fixture every mail-sender issue builds on: the real parts of mesh-mail's manifest
-// taken from mesh-catalog/modules/mesh-mail/module.json, extended as ADR 0436 §7-§8 describe, with `own` naming
-// the account that owns the family's files.
-func mailSenderManifest(t *testing.T, own string) Manifest {
-	t.Helper()
-	ownSecrets := `"mail-credential-*":{"path":"/var/lib/mesh-mail/mail-credential-*.secret","issued-by":"outside"`
-	if own != "" {
-		ownSecrets += `,"owner":"` + own + `"`
-	}
-	ownSecrets += `}`
-	m, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","secrets-owner":"mesh-mail","own-secrets":{` +
-		ownSecrets + `},"resources":[{"id":"account","type":"user","name":"mesh-mail-send"}]}`))
-	if err != nil {
-		t.Fatalf("a manifest with own=%q was refused: %v", own, err)
-	}
-	return m
-}
-
-// 1170/AC1: a family owned by the module's own account lands at 0600, owned by that account — and a module's
-// other own secrets (no per-secret owner declared) keep secrets-owner, unchanged.
-func TestAnOwnSecretsOwnerIsGivenToItsFiles(t *testing.T) {
-	m := mailSenderManifest(t, "mesh-mail-send")
-	m.OwnSecrets["smtp-relay-key"] = OwnSecret{Path: "/var/lib/mesh-mail/smtp-relay-key", Taken: TakenAtStart}
-	r := Resolution{Node: "novox", Modules: []Manifest{m}}
-	out, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"mesh-mail": {"mail-credential-smtp": "sealed-credential", "smtp-relay-key": "sealed-relay"}},
-	})
-	if err != nil {
-		t.Fatalf("composing the declaration: %v", err)
-	}
-	var family, plain map[string]any
-	for _, res := range out {
-		if res["type"] != "file" {
-			continue
-		}
-		switch res["path"] {
-		case "/var/lib/mesh-mail/mail-credential-smtp.secret":
-			family = res
-		case "/var/lib/mesh-mail/smtp-relay-key":
-			plain = res
-		}
-	}
-	if family == nil {
-		t.Fatalf("the family member was not composed at all: %v", out)
-	}
-	if got := family["owner"]; got != "mesh-mail-send" {
-		t.Fatalf("the family member's owner: %v; want mesh-mail-send", got)
-	}
-	// review round 1, finding 7: asserted, not merely logged. ownedBy never sets "mode", so a sealed secret
-	// file carries none here either — the host applies 0600 to every one regardless (novox/hq ADR 0086) —
-	// and the owner clause must not have added one of its own that could override that.
-	if _, has := family["mode"]; has {
-		t.Fatalf("the family member carries its own mode %v; the owner clause must not set one, so the "+
-			"host's 0600 for every sealed secret file stands", family["mode"])
-	}
-	if plain == nil {
-		t.Fatalf("the module's other own secret was not composed at all: %v", out)
-	}
-	if got := plain["owner"]; got != "mesh-mail" {
-		t.Fatalf("a secret with no per-secret owner kept %v; want the module's secrets-owner %q", got, "mesh-mail")
-	}
-}
-
-// 1170/AC2: an owner naming an account the module does not make, root, or the operator account's placeholder is
-// refused, naming the secret and the account.
-func TestAnOwnSecretsOwnerIsRefusedWhenItIsNotAnAccountTheModuleMakes(t *testing.T) {
-	for name, c := range map[string]struct{ owner, says string }{
-		"root":                    {"root", "root"},
-		"the operator account":    {"${machine:account}", "operator account"},
-		"an account not declared": {"not-made", "not-made"},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","own-secrets":{` +
-			`"mail-credential-*":{"path":"/var/lib/mesh-mail/mail-credential-*.secret","issued-by":"outside","owner":"` +
-			c.owner + `"}},"resources":[{"id":"account","type":"user","name":"mesh-mail-send"}]}`))
-		if err == nil || !strings.Contains(err.Error(), "mail-credential-*") || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal naming the secret and %q", name, err, c.says)
-		}
-	}
-}
-
-// 1170/AC3: a manifest with no owner on any own secret composes exactly as it did before this clause existed:
-// every secret file belongs to the module's secrets-owner (or nothing, when that is absent too).
-func TestNoOwnerOnAnySecretComposesAsMainDoes(t *testing.T) {
-	m := mailSenderManifest(t, "")
-	r := Resolution{Node: "novox", Modules: []Manifest{m}}
-	out, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"mesh-mail": {"mail-credential-smtp": "sealed-credential"}},
-	})
-	if err != nil {
-		t.Fatalf("composing the declaration: %v", err)
-	}
-	var found bool
-	for _, res := range out {
-		if res["type"] == "file" && res["path"] == "/var/lib/mesh-mail/mail-credential-smtp.secret" {
-			found = true
-			if got := res["owner"]; got != "mesh-mail" {
-				t.Fatalf("with no per-secret owner declared, the file's owner: %v; want secrets-owner %q", got, "mesh-mail")
-			}
-		}
-	}
-	if !found {
-		t.Fatalf("the family member was not composed at all: %v", out)
-	}
-}
diff --git a/internal/catalogue/own_secret_prompt_test.go b/internal/catalogue/own_secret_prompt_test.go
deleted file mode 100644
index f0d65750..00000000
--- a/internal/catalogue/own_secret_prompt_test.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// An own secret (or a family) may declare `prompt`, one line naming what it is for a desk's prompt in place of
-// its bare name (novox/hq issue 789): reviewed in the module's pull request, and the controller validates it in
-// the module check.
-func TestAnOwnSecretsPromptParsesAndIsWrittenBack(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","own-secrets":{
-		"mail-credential-*":{"path":"/var/lib/mesh-mail/mail-credential-*.secret","issued-by":"outside",
-			"prompt":"the password of the mail account {member}"},
-		"smtp-relay-key":{"path":"/var/lib/mesh-mail/smtp-relay-key","taken":"at-start",
-			"prompt":"the key for the outbound relay"}}}`))
-	if err != nil {
-		t.Fatalf("a manifest with a well-formed prompt was refused: %v", err)
-	}
-	if got := m.OwnSecrets["mail-credential-*"].Prompt; got != "the password of the mail account {member}" {
-		t.Fatalf("the family's prompt: %q", got)
-	}
-	if got := m.OwnSecrets["smtp-relay-key"].Prompt; got != "the key for the outbound relay" {
-		t.Fatalf("the plain secret's prompt: %q", got)
-	}
-	// Written back the way it was read, so a registered manifest keeps its bytes.
-	out, err := json.Marshal(m.OwnSecrets)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var again OwnSecrets
-	if err := json.Unmarshal(out, &again); err != nil {
-		t.Fatal(err)
-	}
-	if again["mail-credential-*"].Prompt != "the password of the mail account {member}" ||
-		again["smtp-relay-key"].Prompt != "the key for the outbound relay" {
-		t.Fatalf("the round trip lost the prompt: %s", out)
-	}
-}
-
-// No prompt declared is fine: the desk asks by name alone, as it does today.
-func TestAnOwnSecretWithNoPromptIsFine(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"telegram","version":"1","own-secrets":{
-		"telegram-token":{"path":"/var/lib/telegram/telegram-token","issued-by":"outside"}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.OwnSecrets["telegram-token"].Prompt != "" {
-		t.Fatalf("an undeclared prompt: %q", m.OwnSecrets["telegram-token"].Prompt)
-	}
-	out, err := json.Marshal(m.OwnSecrets)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(out), "prompt") {
-		t.Fatalf("an empty prompt was written: %s", out)
-	}
-}
-
-// PromptMax counts characters, not bytes: a prompt of 100 multi-byte characters is well within it even
-// though it holds well over 120 bytes (novox/hq issue 789).
-func TestAPromptOfMultiByteCharactersIsCountedByCharacter(t *testing.T) {
-	prompt := strings.Repeat("é", 100)
-	if n := len(prompt); n <= 120 {
-		t.Fatalf("the test prompt is %d bytes, not over 120 as intended", n)
-	}
-	_, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","own-secrets":{
-		"smtp-relay-key":{"path":"/var/lib/mesh-mail/smtp-relay-key","taken":"at-start",
-			"prompt":` + jsonString(prompt) + `}}}`))
-	if err != nil {
-		t.Fatalf("a 100-character prompt was refused: %v", err)
-	}
-}
-
-// {member} is replaced only for a family's member: a single secret's prompt may not hold it (novox/hq issue 789).
-func TestAPromptHoldingMemberOnASingleSecretIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","own-secrets":{
-		"smtp-relay-key":{"path":"/var/lib/mesh-mail/smtp-relay-key","taken":"at-start",
-			"prompt":"For {member}"}}}`))
-	if err == nil || !strings.Contains(err.Error(), "{member} is replaced only for a family's member") {
-		t.Fatalf("a single secret's prompt holding {member}: %v; want a refusal saying so", err)
-	}
-}
-
-// A prompt that is not one short line naming only {member} is refused by the module check (novox/hq issue 789).
-func TestAMalformedPromptIsRefused(t *testing.T) {
-	for name, c := range map[string]struct{ prompt, says string }{
-		"a newline": {"the password of\nthe mail account {member}", "one line"},
-		"over 120 characters": {"the password of the mail account {member}, which this mesh needs to log in to " +
-			"send and receive mail for the operator's account on this machine today", "120 characters"},
-		"a placeholder other than {member}": {"the password of the mail account {name}", "{member}"},
-		"two placeholders, one unknown":     {"the {kind} secret of the mail account {member}", "{member}"},
-	} {
-		_, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","own-secrets":{
-			"mail-credential-*":{"path":"/var/lib/mesh-mail/mail-credential-*.secret","issued-by":"outside",
-				"prompt":` + jsonString(c.prompt) + `}}}`))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal saying %q", name, err, c.says)
-		}
-	}
-}
-
-// jsonString quotes a Go string the way encoding/json would, for building a literal into a test's manifest JSON.
-func jsonString(s string) string {
-	out, err := json.Marshal(s)
-	if err != nil {
-		panic(err)
-	}
-	return string(out)
-}
diff --git a/internal/catalogue/own_secret_taken_test.go b/internal/catalogue/own_secret_taken_test.go
deleted file mode 100644
index 4ad016cc..00000000
--- a/internal/catalogue/own_secret_taken_test.go
+++ /dev/null
@@ -1,93 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// An own secret says how the module takes it (novox/hq ADR 0114, issue 180): a path alone says
-// nothing of it, an object says `at-start` or `applied`, and the bytes the mesh holds are the bytes
-// it was given either way.
-func TestAnOwnSecretSaysHowItIsTaken(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"idp","version":"1","own-secrets":{
-		"broker":"/var/lib/mesh/idp/broker",
-		"admin":{"path":"/var/lib/idp/admin.secret","taken":"applied"},
-		"session":{"path":"/var/lib/idp/session.secret","taken":"at-start"}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.OwnSecrets["broker"] != (OwnSecret{Path: "/var/lib/mesh/idp/broker"}) {
-		t.Fatalf("a path alone is a path and nothing more: %+v", m.OwnSecrets["broker"])
-	}
-	if m.OwnSecrets["admin"].Taken != TakenApplied || m.OwnSecrets["session"].Taken != TakenAtStart {
-		t.Fatalf("the word was not kept: %+v", m.OwnSecrets)
-	}
-	// Written back the way it was read, so a registered manifest keeps its bytes.
-	out, err := json.Marshal(m.OwnSecrets)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var again OwnSecrets
-	if err := json.Unmarshal(out, &again); err != nil {
-		t.Fatal(err)
-	}
-	if len(again) != 3 || again["admin"].Taken != TakenApplied || again["broker"].Taken != "" {
-		t.Fatalf("the round trip changed the secrets: %s", out)
-	}
-	if !strings.Contains(string(out), `"broker":"/var/lib/mesh/idp/broker"`) {
-		t.Fatalf("a path alone is written back as a path: %s", out)
-	}
-}
-
-func TestAnOwnSecretTakenSomeOtherWayIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"idp","version":"1","own-secrets":{
-		"admin":{"path":"/var/lib/idp/admin.secret","taken":"sometimes"}}}`))
-	if err == nil || !strings.Contains(err.Error(), `taken "sometimes"`) {
-		t.Fatalf("an unknown word for how a secret is taken was accepted: %v", err)
-	}
-	_, err = ParseManifest([]byte(`{"module":"idp","version":"1","own-secrets":{
-		"admin":{"path":"/var/lib/idp/admin.secret","rotate":"yes"}}}`))
-	if err == nil {
-		t.Fatal("an unknown field on an own secret was accepted")
-	}
-}
-
-// A secret an outside party issues says so (novox/hq ADR 0228), is written back as it was read, and
-// is the one at-start secret the mesh may not make; any other word for who issued it is refused.
-func TestAnOwnSecretSaysWhenAnOutsidePartyIssuesIt(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"letta","version":"1","own-secrets":{
-		"server-password":{"path":"/var/lib/letta/server-password","taken":"at-start"},
-		"openai-api-key":{"path":"/var/lib/letta/openai-api-key","taken":"at-start","issued-by":"outside"},
-		"telegram-token":{"path":"/var/lib/letta/telegram-token","issued-by":"outside"},
-		"logflare":{"path":"/var/lib/letta/logflare","taken":"applied"},
-		"broker":"/var/lib/mesh/letta/broker"}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for name, may := range map[string]bool{"server-password": true, "openai-api-key": false,
-		"telegram-token": false, "logflare": false, "broker": false} {
-		if got := m.OwnSecrets[name].MeshMayMake(); got != may {
-			t.Errorf("%s: the mesh may make it = %v, want %v", name, got, may)
-		}
-	}
-	out, err := json.Marshal(m.OwnSecrets)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var again OwnSecrets
-	if err := json.Unmarshal(out, &again); err != nil {
-		t.Fatal(err)
-	}
-	if again["openai-api-key"] != m.OwnSecrets["openai-api-key"] || again["telegram-token"] != m.OwnSecrets["telegram-token"] {
-		t.Fatalf("the round trip lost who issued it: %s", out)
-	}
-	if strings.Contains(string(out), `"taken":""`) {
-		t.Fatalf("a secret that says only who issued it gained an empty taken: %s", out)
-	}
-	_, err = ParseManifest([]byte(`{"module":"letta","version":"1","own-secrets":{
-		"openai-api-key":{"path":"/var/lib/letta/openai-api-key","issued-by":"openai"}}}`))
-	if err == nil || !strings.Contains(err.Error(), `issued by "openai"`) {
-		t.Fatalf("an unknown word for who issued a secret was accepted: %v", err)
-	}
-}
diff --git a/internal/catalogue/pin_names_module_test.go b/internal/catalogue/pin_names_module_test.go
deleted file mode 100644
index 8191e5a4..00000000
--- a/internal/catalogue/pin_names_module_test.go
+++ /dev/null
@@ -1,115 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Two modules on one node both provide acme-ca — public-acme (Let's Encrypt) and step-ca (the
-// mesh's own authority) on novox — and a route-proxy elsewhere must get the public one (novox/hq
-// #258). A pin names the module as well as the node, so that it can say which.
-
-func issuerShelf() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "public-acme", Version: "1", Provides: FromAnywhere("acme-ca"),
-			Serves: map[string]map[string]any{"acme-ca": {"at": "acme-v02.api.letsencrypt.org"}}},
-		Manifest{Module: "step-ca", Version: "1", Provides: FromAnywhere("acme-ca"),
-			Serves: map[string]map[string]any{"acme-ca": {"at": "novox.internal"}}},
-		Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}},
-	)
-}
-
-func twoIssuersOnOneNode() map[string][]Provider {
-	return map[string][]Provider{"acme-ca": {
-		{Node: "novox", At: "novox.internal", Module: "public-acme", Serves: map[string]any{"at": "acme-v02.api.letsencrypt.org"}},
-		{Node: "novox", At: "novox.internal", Module: "step-ca", Serves: map[string]any{"at": "novox.internal"}},
-	}}
-}
-
-func TestTwoProvidersOnOneNodeAreRefusedWithBothNamed(t *testing.T) {
-	// The refusal must name the pair, because a node alone cannot tell them apart.
-	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(),
-		World{Offered: twoIssuersOnOneNode()})
-	if err == nil {
-		t.Fatal("two providers on one node were resolved by picking")
-	}
-	for _, want := range []string{"novox/public-acme", "novox/step-ca", "<node> <module>"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal does not say %q: %v", want, err)
-		}
-	}
-}
-
-func TestAPinNamesTheModule(t *testing.T) {
-	got, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(),
-		World{Offered: twoIssuersOnOneNode(),
-			Pinned: map[string]Chosen{"acme-ca": {Node: "novox", Module: "public-acme"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 || got.Needs[0].From != "novox" || got.Needs[0].Serves["at"] != "acme-v02.api.letsencrypt.org" {
-		t.Fatalf("the named module was not the one taken: %+v", got.Needs)
-	}
-}
-
-func TestARecordNamingOnlyTheNodeIsRefusedWhenThatNodeAnswersTwice(t *testing.T) {
-	// A pin from before the module was asked for. It once took the last one listed — a coin flip.
-	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(),
-		World{Offered: twoIssuersOnOneNode(), Pinned: map[string]Chosen{"acme-ca": {Node: "novox"}}})
-	if err == nil {
-		t.Fatal("a node that answers twice was resolved by picking")
-	}
-	if !strings.Contains(err.Error(), "provides it 2 times") || !strings.Contains(err.Error(), "pin workstation acme-ca novox <module>") {
-		t.Fatalf("the refusal does not ask for the module: %v", err)
-	}
-}
-
-func TestAPinNamingAModuleThatDoesNotProvideItIsRefused(t *testing.T) {
-	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(),
-		World{Offered: twoIssuersOnOneNode(), Pinned: map[string]Chosen{"acme-ca": {Node: "novox", Module: "gitea"}}})
-	if err == nil || !strings.Contains(err.Error(), "novox/gitea does not provide it") {
-		t.Fatalf("a module that does not provide it was not refused by name: %v", err)
-	}
-}
-
-func TestTwoProvidersBesideTheConsumerAreRefusedUntilOneIsNamed(t *testing.T) {
-	// The same ambiguity on the consumer's own machine. This was settled by a map walk — random,
-	// per plan — which is how novox's own proxy got its issuer.
-	_, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(), World{})
-	if err == nil {
-		t.Fatal("two providers beside the consumer were resolved by picking")
-	}
-	if !strings.Contains(err.Error(), "workstation provides \"acme-ca\" 2 times") || !strings.Contains(err.Error(), "public-acme, step-ca") {
-		t.Fatalf("the refusal does not list them: %v", err)
-	}
-}
-
-func TestAPinSettlesTwoProvidersBesideTheConsumer(t *testing.T) {
-	got, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(),
-		World{Pinned: map[string]Chosen{"acme-ca": {Node: "workstation", Module: "public-acme"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var found bool
-	for _, n := range got.Needs {
-		if n.Name == "acme-ca" {
-			found = true
-			if n.Serves["at"] != "acme-v02.api.letsencrypt.org" {
-				t.Fatalf("the named module was not the one taken: %+v", n)
-			}
-		}
-	}
-	if !found {
-		t.Fatalf("no need for acme-ca was created: %+v", got.Needs)
-	}
-}
-
-func TestTheFirstPassDoesNotRefuseTwoProvidersBesideTheConsumer(t *testing.T) {
-	// The first pass answers only what a node offers. Refused there, the node vanishes from every
-	// other node's world — and the whole mesh loses its vault for an ambiguity one machine has to
-	// settle. The second pass is where it is refused, and the test above proves it is.
-	if _, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(),
-		World{Unchecked: true}); err != nil {
-		t.Fatalf("the first pass refused what only the second may: %v", err)
-	}
-}
diff --git a/internal/catalogue/placed_paths_test.go b/internal/catalogue/placed_paths_test.go
deleted file mode 100644
index 779c1512..00000000
--- a/internal/catalogue/placed_paths_test.go
+++ /dev/null
@@ -1,180 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// TestPlacedDirectoriesKeepTheirPaths is the check novox/hq issue 119 asks for before a definition
-// stops naming where its data lives: a converted manifest, resolved on a node with the default root,
-// names exactly the paths the manifest before it named. Data that a service is using must not move
-// because a definition stopped saying where it was.
-//
-// Two checkouts: MESH_CATALOGUE_BEFORE, the catalogue as it was, and MESH_CATALOGUE, as it is now.
-// Every module in both is resolved with the controller's own rule (dirsFor, dirFill) and compared
-// whole — not only the directories, but every string a directory's id was written into. Both
-// sides are resolved, so a manifest converted in two steps (issue 119, then issue 174) is judged
-// against the paths it named, not the text it used to name them with.
-func TestPlacedDirectoriesKeepTheirPaths(t *testing.T) {
-	before, after := os.Getenv("MESH_CATALOGUE_BEFORE"), os.Getenv("MESH_CATALOGUE")
-	if before == "" || after == "" {
-		t.Skip("set MESH_CATALOGUE_BEFORE and MESH_CATALOGUE to two catalogue checkouts to run this")
-	}
-	found, _ := filepath.Glob(filepath.Join(after, "modules", "*", "module.json"))
-	compared := 0
-	for _, path := range found {
-		module := filepath.Base(filepath.Dir(path))
-		old, err := os.ReadFile(filepath.Join(before, "modules", module, "module.json"))
-		if err != nil {
-			continue // new since; nothing to keep
-		}
-		now, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if string(old) == string(now) {
-			continue
-		}
-		m, err := ParseManifest(now)
-		if err != nil {
-			t.Errorf("%s: %v", module, err)
-			continue
-		}
-		earlier, err := ParseManifest(old)
-		if err != nil {
-			t.Errorf("%s before: %v", module, err)
-			continue
-		}
-		var was, is any
-		if err := json.Unmarshal(old, &was); err != nil {
-			t.Fatal(err)
-		}
-		if err := json.Unmarshal(now, &is); err != nil {
-			t.Fatal(err)
-		}
-		// Both sides resolved: the manifest before may itself already place some directories
-		// (issue 119's conversion), and what must not move is the path a machine sees.
-		was = resolvedTree(was, dirsFor(earlier, Rendering{}), module, t)
-		resolved := resolvedTree(is, dirsFor(m, Rendering{}), module, t)
-		// An access named by id resolves to the path the definition still carries as its default
-		// (issue 153) — the same rule as a placed directory: an assignment that says nothing moves
-		// nothing.
-		was = accessesResolved(was, earlier)
-		resolved = accessesResolved(resolved, m)
-		if !reflect.DeepEqual(was, resolved) {
-			wasJSON, _ := json.MarshalIndent(was, "", "  ")
-			isJSON, _ := json.MarshalIndent(resolved, "", "  ")
-			t.Errorf("%s: resolved on the default root, the converted manifest is not the one before it\n--- before\n%s\n--- resolved now\n%s",
-				module, firstDifference(string(wasJSON), string(isJSON)), "")
-		}
-		compared++
-	}
-	t.Logf("%d converted manifest(s) resolve to the paths they named before", compared)
-}
-
-// resolvedTree is the manifest as a machine would see it: every ${dir:…} filled, a pathless
-// directory given the path it resolves to, and the placement word removed.
-func resolvedTree(node any, dirs map[string]string, module string, t *testing.T) any {
-	switch v := node.(type) {
-	case map[string]any:
-		out := map[string]any{}
-		for k, child := range v {
-			if k == "place" {
-				continue
-			}
-			out[k] = resolvedTree(child, dirs, module, t)
-		}
-		if out["type"] == "directory" {
-			if _, has := out["path"]; !has {
-				if id, ok := out["id"].(string); ok {
-					out["path"] = dirs[id]
-				}
-			}
-		}
-		return out
-	case []any:
-		out := make([]any, len(v))
-		for i, child := range v {
-			out[i] = resolvedTree(child, dirs, module, t)
-		}
-		return out
-	case string:
-		filled, err := dirFill(v, dirs, module)
-		if err != nil {
-			t.Error(err)
-		}
-		return filled
-	}
-	return node
-}
-
-func firstDifference(a, b string) string {
-	al, bl := strings.Split(a, "\n"), strings.Split(b, "\n")
-	for i := range al {
-		if i >= len(bl) || al[i] != bl[i] {
-			from := i - 2
-			if from < 0 {
-				from = 0
-			}
-			to := i + 3
-			if to > len(al) {
-				to = len(al)
-			}
-			bt := i + 3
-			if bt > len(bl) {
-				bt = len(bl)
-			}
-			return "before:\n" + strings.Join(al[from:to], "\n") + "\nnow:\n" + strings.Join(bl[from:bt], "\n")
-		}
-	}
-	return "(the difference is beyond the shorter document)"
-}
-
-// accessesResolved fills every ${access:<id>} with the default path the definition carries for that
-// access, and drops the id, so a manifest that names its accesses is compared by the paths a machine
-// with no placement receives.
-func accessesResolved(node any, m Manifest) any {
-	defaults := map[string]string{}
-	for _, a := range m.Accesses {
-		if a.ID != "" && a.Path != "" {
-			defaults[a.ID] = a.Path
-		}
-	}
-	var walk func(any) any
-	walk = func(n any) any {
-		switch v := n.(type) {
-		case map[string]any:
-			out := map[string]any{}
-			for k, child := range v {
-				if k == "id" {
-					if _, isAccess := v["mode"]; isAccess && v["type"] == nil {
-						if _, hasPath := v["path"]; hasPath {
-							continue
-						}
-					}
-				}
-				out[k] = walk(child)
-			}
-			return out
-		case []any:
-			out := make([]any, len(v))
-			for i, child := range v {
-				out[i] = walk(child)
-			}
-			return out
-		case string:
-			return accessRef.ReplaceAllStringFunc(v, func(ref string) string {
-				if p, ok := defaults[accessRef.FindStringSubmatch(ref)[1]]; ok {
-					return p
-				}
-				return ref
-			})
-		}
-		return n
-	}
-	return walk(node)
-}
diff --git a/internal/catalogue/placement_test.go b/internal/catalogue/placement_test.go
deleted file mode 100644
index 1b19d70a..00000000
--- a/internal/catalogue/placement_test.go
+++ /dev/null
@@ -1,282 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The case novox/hq issue 153 records: an adopted machine keeps its data where the predecessor put
-// it — a library on its own pool that must never move, a configuration on a second disk owned by
-// whoever the predecessor ran as. A definition may name none of that (ADR 0112); the assignment
-// says it, by the ids the definition declared, and the machine receives concrete paths as always.
-func placeable() Manifest {
-	m := mod("arr", nil, nil, nil)
-	m.Resources = []map[string]any{
-		{"id": "state", "type": "directory", "place": ".", "mode": "0700"},
-		{"id": "config", "type": "directory", "mode": "0755", "owner": "1000:1000"},
-		{"id": "server", "type": "container", "name": "arr", "image": "arr:1",
-			"volumes": []any{"${dir:config}:/config", "${access:series}:/series", "${access:spool}:/downloads:ro"},
-			"env":     map[string]any{"SPOOL": "${access:spool}"}},
-	}
-	m.Accesses = []Access{{ID: "series", Mode: AccessReadWrite}, {ID: "spool"}}
-	return m
-}
-
-func placedBy(values map[string]any) Rendering {
-	return Rendering{Settings: SettingsBy{"arr": {LayerOf("node anchor", values)}}}
-}
-
-func TestAnAssignmentPlacesDirectoriesAndAccesses(t *testing.T) {
-	got, err := Resolve(shelf(placeable()), []string{"arr"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(placedBy(map[string]any{
-		PlacesSetting: map[string]any{
-			"config": map[string]any{"path": "/services/arr/config/", "owner": "1001:2000"},
-		},
-		AccessesSetting: map[string]any{
-			"series": "/storage/media/series",
-			"spool":  "/storage/downloads",
-		},
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	seen := map[string]map[string]any{}
-	for _, r := range out {
-		seen[r["id"].(string)] = r
-	}
-	config := seen["arr.config"]
-	if config["path"] != "/services/arr/config" || config["owner"] != "1001:2000" {
-		t.Fatalf("the placed directory is %v %v; want the assignment's path and owner", config["path"], config["owner"])
-	}
-	if seen["arr.state"]["path"] != "/var/lib/arr" {
-		t.Fatalf("an unplaced directory left the default layout: %v", seen["arr.state"]["path"])
-	}
-	var accesses []string
-	for _, r := range out {
-		if r["type"] == "access" {
-			accesses = append(accesses, r["path"].(string)+" "+r["mode"].(string))
-		}
-	}
-	if strings.Join(accesses, ",") != "/storage/media/series read-write,/storage/downloads read" {
-		t.Fatalf("the accesses reached the machine as %v", accesses)
-	}
-	server := seen["arr.server"]
-	mounts := server["volumes"].([]any)
-	if mounts[0] != "/services/arr/config:/config" || mounts[1] != "/storage/media/series:/series" ||
-		mounts[2] != "/storage/downloads:/downloads:ro" {
-		t.Fatalf("the mounts were not filled with the placed paths: %v", mounts)
-	}
-	if server["env"].(map[string]any)["SPOOL"] != "/storage/downloads" {
-		t.Fatalf("the environment was not filled: %v", server["env"])
-	}
-}
-
-// An access declared by id and placed by nobody resolves to nowhere, and that is refused with the
-// setting to write — not mounted as the literal, not skipped. The refusal costs the module its
-// place in the declaration, not the machine its declaration (novox/hq ADR 0163, rule 6).
-func TestAnUnplacedAccessIsRefusedByName(t *testing.T) {
-	got, err := Resolve(shelf(placeable()), []string{"arr"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	with := placedBy(map[string]any{
-		AccessesSetting: map[string]any{"series": "/storage/media/series"},
-	})
-	composed, err := got.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	why := composed.LeftOut["arr"]
-	if why == "" || !strings.Contains(why, `"spool"`) || !strings.Contains(why, AccessesSetting) {
-		t.Fatalf("an access nobody placed was not refused by name: %v", composed.LeftOut)
-	}
-	if _, declared := byID(composed.Resources)["arr.server"]; declared {
-		t.Fatal("the module with the unplaced access was declared anyway")
-	}
-}
-
-// Validated like endpoints: an id the module does not declare reaches nothing, and the refusal
-// says what it does declare; a relative path and a non-numeric owner are refused too.
-func TestPlacementsAreValidated(t *testing.T) {
-	m := placeable()
-	layers := func(values map[string]any) []Layer { return placedBy(values).Settings["arr"] }
-
-	_, err := Places(m, layers(map[string]any{PlacesSetting: map[string]any{"data": "/mnt/data"}}))
-	if err == nil || !strings.Contains(err.Error(), "does not declare") || !strings.Contains(err.Error(), `"config"`) {
-		t.Fatalf("placing an undeclared directory was accepted: %v", err)
-	}
-	_, err = Places(m, layers(map[string]any{PlacesSetting: map[string]any{"config": "services/arr"}}))
-	if err == nil || !strings.Contains(err.Error(), "absolute") {
-		t.Fatalf("a relative placement was accepted: %v", err)
-	}
-	_, err = Places(m, layers(map[string]any{PlacesSetting: map[string]any{
-		"config": map[string]any{"path": "/services/arr", "owner": "media"}}}))
-	if err == nil || !strings.Contains(err.Error(), "uid:gid") {
-		t.Fatalf("a non-numeric owner was accepted: %v", err)
-	}
-	_, err = AccessPlaces(m, layers(map[string]any{AccessesSetting: map[string]any{"movies": "/storage/media/movies"}}))
-	if err == nil || !strings.Contains(err.Error(), "does not declare") || !strings.Contains(err.Error(), `"series"`) {
-		t.Fatalf("placing an undeclared access was accepted: %v", err)
-	}
-	_, err = AccessPlaces(m, layers(map[string]any{AccessesSetting: map[string]any{"series": "media/series"}}))
-	if err == nil || !strings.Contains(err.Error(), "absolute") {
-		t.Fatalf("a relative access was accepted: %v", err)
-	}
-	// And the two keys are never stray: they are validated here, not merged into a file.
-	if stray := UnusedSettings(m, layers(map[string]any{
-		PlacesSetting:   map[string]any{"config": "/services/arr/config"},
-		AccessesSetting: map[string]any{"series": "/storage/media/series"},
-	})); len(stray) != 0 {
-		t.Fatalf("the placement keys were reported as unused: %v", stray)
-	}
-}
-
-// A definition that carries a path still works, as the default the assignment may replace — and
-// the assignment's placement wins where both say.
-func TestADefinitionsPathIsTheDefaultTheAssignmentReplaces(t *testing.T) {
-	m := placeable()
-	m.Accesses = []Access{{ID: "series", Path: "/services/media/series", Mode: AccessReadWrite}, {ID: "spool", Path: "/services/media/downloads"}}
-	got, err := Resolve(shelf(m), []string{"arr"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(placedBy(map[string]any{
-		PlacesSetting:   map[string]any{"config": "/services/arr/config"},
-		AccessesSetting: map[string]any{"series": "/storage/media/series"},
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var paths []string
-	for _, r := range out {
-		if r["type"] == "access" {
-			paths = append(paths, r["path"].(string))
-		}
-	}
-	if strings.Join(paths, ",") != "/storage/media/series,/services/media/downloads" {
-		t.Fatalf("placed one, defaulted the other: got %v", paths)
-	}
-}
-
-// A reference to an access the definition does not declare is refused where the author is.
-func TestAnUnknownAccessReferenceIsRefusedAtParse(t *testing.T) {
-	_, err := ParseManifest([]byte(`{
-	  "module": "arr", "version": "1",
-	  "accesses": [{"id": "series", "mode": "read-write"}],
-	  "resources": [
-	    {"id": "state", "type": "directory", "place": ".", "mode": "0700"},
-	    {"id": "server", "type": "container", "name": "arr", "image": "arr:1",
-	     "volumes": ["${access:movies}:/movies"]}
-	  ]}`))
-	if err == nil || !strings.Contains(err.Error(), "${access:movies}") {
-		t.Fatalf("a reference to an undeclared access was accepted: %v", err)
-	}
-	_, err = ParseManifest([]byte(`{"module": "arr", "version": "1", "accesses": [{"mode": "read"}]}`))
-	if err == nil || !strings.Contains(err.Error(), "neither an id nor a path") {
-		t.Fatalf("an access with no id and no path was accepted: %v", err)
-	}
-}
-
-// **Placement is read from the placement, never from a layer's values** (novox/hq ADR 0348 clause 11, issue
-// 651). A `places` or `accesses` among the config values places nothing; the same in Placement does. A
-// mergeable file of today's form still takes every key of the layer as it is said, placement too, so it
-// composes as it did while placement was kept in the layer.
-func TestPlacementIsReadFromThePlacementOnly(t *testing.T) {
-	m := placeable()
-	said := map[string]any{
-		PlacesSetting:   map[string]any{"config": "/services/arr/config"},
-		AccessesSetting: map[string]any{"series": "/storage/media/series", "spool": "/storage/downloads"},
-		"log":           "warn",
-	}
-	among := []Layer{{From: "anchor", Values: said}}
-	if placed, err := Places(m, among); err != nil || placed != nil {
-		t.Fatalf("a place among the config values placed %v (%v)", placed, err)
-	}
-	if _, _, err := accessesFor(m, among); err == nil {
-		t.Fatal("an access among the config values placed it")
-	}
-	beside := []Layer{LayerOf("anchor", said)}
-	if beside[0].Values["log"] != "warn" || beside[0].Values[PlacesSetting] != nil || beside[0].Placement[PlacesSetting] == nil {
-		t.Fatalf("LayerOf split %+v", beside[0])
-	}
-	if placed, err := Places(m, beside); err != nil || placed["config"].Path != "/services/arr/config" {
-		t.Fatalf("the placement did not place: %v (%v)", placed, err)
-	}
-
-	file := map[string]any{"id": "runtime", "type": "file", "path": "/x", "content": `{"a":1}`, "merge": "json"}
-	whole, err := ApplySettings(file, among)
-	if err != nil {
-		t.Fatal(err)
-	}
-	split, err := ApplySettings(file, beside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if whole["content"] != split["content"] || !strings.Contains(split["content"].(string), `"places"`) {
-		t.Fatalf("today's mergeable file composes %q, was %q", split["content"], whole["content"])
-	}
-}
-
-// **The four words of where an assignment is reached are placement too** (novox/hq ADR 0348 clause 11, issue 736).
-// `endpoints`, `expose`, `reach` and `ports` among a layer's config values say nothing to the filter, the ports or
-// the names; the same in Placement do, and LayerOf puts them there. A mergeable file of today's form still takes
-// every key of the layer as it is said, so it composes as it did while they were kept among the values.
-func TestTheFourWordsAreReadFromThePlacementOnly(t *testing.T) {
-	m := Manifest{Module: "forge", Version: "1",
-		Listens: []Listening{{Name: "web", Port: 3000, Protocol: "tcp", From: FromMesh}, {Name: "ssh", Port: 22, Protocol: "tcp", From: FromMesh},
-			{Name: "api", Port: 8086, Protocol: "tcp", From: FromMesh}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "image": "x", "ports": []any{"3000", "222:22", "8086"}}}}
-	said := map[string]any{
-		ExposeSetting:    map[string]any{"22": FromEverywhere},
-		PortsSetting:     map[string]any{"22": float64(2222)},
-		ReachSetting:     map[string]any{"3000": "internal"},
-		EndpointsSetting: map[string]any{"api": map[string]any{"label": "influx", "port": float64(18086), "reach": "public"}},
-		"log":            "warn",
-	}
-	among := []Layer{{From: "anchor", Values: said}}
-	if e, err := Exposure(m, among); err != nil || e != nil {
-		t.Fatalf("an expose among the config values exposed %v (%v)", e, err)
-	}
-	if g, err := GivenPorts(m, among); err != nil || g != nil {
-		t.Fatalf("a ports among the config values gave %v (%v)", g, err)
-	}
-	if r, err := Reaches(m, among); err != nil || r != nil {
-		t.Fatalf("a reach among the config values reached %v (%v)", r, err)
-	}
-	if b, err := Endpoints(m, among); err != nil || len(b) != 0 {
-		t.Fatalf("an endpoints among the config values configured %v (%v)", b, err)
-	}
-
-	beside := []Layer{LayerOf("anchor", said)}
-	if len(beside[0].Values) != 1 || beside[0].Values["log"] != "warn" || len(beside[0].Placement) != 4 {
-		t.Fatalf("LayerOf split %+v", beside[0])
-	}
-	if e, err := Exposure(m, beside); err != nil || e[22] != FromEverywhere {
-		t.Fatalf("the placement did not expose: %v (%v)", e, err)
-	}
-	if g, err := GivenPorts(m, beside); err != nil || g[22] != 2222 || g[8086] != 18086 {
-		t.Fatalf("the placement did not give the ports: %v (%v)", g, err)
-	}
-	if r, err := Reaches(m, beside); err != nil || r[3000] != "internal" || r[8086] != "public" {
-		t.Fatalf("the placement did not reach: %v (%v)", r, err)
-	}
-	if b, err := Endpoints(m, beside); err != nil || b["api"].Label != "influx" {
-		t.Fatalf("the placement did not configure the endpoint: %v (%v)", b, err)
-	}
-
-	file := map[string]any{"id": "runtime", "type": "file", "path": "/x", "content": `{"a":1}`, "merge": "json"}
-	whole, err := ApplySettings(file, among)
-	if err != nil {
-		t.Fatal(err)
-	}
-	split, err := ApplySettings(file, beside)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if whole["content"] != split["content"] || !strings.Contains(split["content"].(string), `"endpoints"`) {
-		t.Fatalf("today's mergeable file composes %q, was %q", split["content"], whole["content"])
-	}
-}
diff --git a/internal/catalogue/port_into_test.go b/internal/catalogue/port_into_test.go
deleted file mode 100644
index 1e13cb56..00000000
--- a/internal/catalogue/port_into_test.go
+++ /dev/null
@@ -1,170 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// **A process binds the port the mesh gave it, not the one it wrote down.**
-//
-// A container never needed this: the mesh rewrites its `ports` into assigned:wanted, so the
-// software binds the number it always bound and the machine publishes another. A process runs on
-// the machine with nothing to rewrite, so without a way to ask, every process binds the number in
-// its own configuration and two modules declaring the same one collide — which is the whole
-// problem ADR 0038 exists to prevent, reintroduced by the resource kind that most needs it.
-func TestAModuleIsToldWhichPortItWasGiven(t *testing.T) {
-	file := map[string]any{
-		"type": "file", "id": "settings",
-		"content": "LISTEN=${port:8080}\n",
-	}
-	listens := []Listening{{Port: 8080, From: FromMesh}}
-	with := Rendering{Ports: map[string]map[int]int{"showcase": {8080: 21000}}}
-
-	if err := portInto(file, "showcase", listens, with); err != nil {
-		t.Fatal(err)
-	}
-	if got := file["content"].(string); got != "LISTEN=21000\n" {
-		t.Fatalf("the module was not told its assigned port: %q", got)
-	}
-}
-
-// With nothing assigned yet, it is told the port it asked about — so a mesh that has not made an
-// assignment still composes something coherent rather than writing a zero.
-func TestWithNoAssignmentAModuleIsToldWhatItAskedFor(t *testing.T) {
-	file := map[string]any{"type": "file", "content": "LISTEN=${port:8080}\n"}
-	if err := portInto(file, "showcase", []Listening{{Port: 8080}}, Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-	if got := file["content"].(string); got != "LISTEN=8080\n" {
-		t.Fatalf("an unassigned port did not fall back to what was declared: %q", got)
-	}
-}
-
-// **Asking about a port it never declared is refused**, and the refusal says what it did declare.
-// The module is asking about something the mesh has no opinion on, and answering would be a guess
-// written into a configuration file as a port number.
-func TestAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
-	file := map[string]any{"type": "file", "content": "LISTEN=${port:9999}\n"}
-	err := portInto(file, "showcase", []Listening{{Port: 8080}}, Rendering{})
-	if err == nil {
-		t.Fatal("a module was told a port it never said it listens on")
-	}
-	if !strings.Contains(err.Error(), "8080") {
-		t.Fatalf("the refusal does not say what would have worked: %v", err)
-	}
-}
-
-// And a file mentioning no port is left exactly as it was.
-func TestAFileWithNoPortIsUntouched(t *testing.T) {
-	file := map[string]any{"type": "file", "content": "GREETING=hello\n"}
-	if err := portInto(file, "showcase", nil, Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-	if got := file["content"].(string); got != "GREETING=hello\n" {
-		t.Fatalf("a file with no port was changed: %q", got)
-	}
-}
-
-// **A container that dials the machine is told the same thing, in its environment.**
-//
-// The forge's own sidecar reaches the forge over the machine's loopback (novox/hq 04-ISSUES/088).
-// The `assigned:wanted` mapping that lets the forge itself go on binding 3000 does nothing for the
-// caller: the caller dials the machine, so it must be given the machine's number — here one the
-// node was given rather than one the mesh assigned, which is the case that makes the literal wrong
-// even on a mesh that never allocates (ADR 0100).
-func TestAContainerIsToldWhichPortItWasGiven(t *testing.T) {
-	sidecar := map[string]any{
-		"type": "container", "id": "runtime", "name": "mesh-gitea",
-		"env": map[string]any{
-			"MESH_GITEA_URL":  "http://127.0.0.1:${port:3000}",
-			"MESH_ADMIN_USER": "mesh-admin",
-		},
-	}
-	listens := []Listening{{Port: 3000, From: FromMesh}}
-	with := Rendering{Given: map[string]map[int]int{"gitea": {3000: 2999}}}
-
-	if err := portInto(sidecar, "gitea", listens, with); err != nil {
-		t.Fatal(err)
-	}
-	env := sidecar["env"].(map[string]any)
-	if env["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
-		t.Fatalf("the sidecar dials %v, not the port this machine puts the forge on",
-			env["MESH_GITEA_URL"])
-	}
-	if env["MESH_ADMIN_USER"] != "mesh-admin" {
-		t.Fatalf("filling one value changed another: %v", env)
-	}
-}
-
-// **And the manifest it came out of is left alone.**
-//
-// An `env` map is the catalogue's, shared by every node running the module, and the resource
-// around it is a shallow copy. Filled in place, the first node composed would write its own port
-// into the catalogue and every node composed after it would be told that one — a fault that is
-// invisible in a single composition and wrong in every mesh with two machines.
-func TestFillingAContainersEnvironmentLeavesTheManifestAlone(t *testing.T) {
-	env := map[string]any{"MESH_GITEA_URL": "http://127.0.0.1:${port:3000}"}
-	manifest := map[string]any{"type": "container", "id": "runtime", "name": "mesh-gitea", "env": env}
-
-	for _, at := range []int{2999, 3100} {
-		copied := map[string]any{}
-		for k, v := range manifest {
-			copied[k] = v
-		}
-		with := Rendering{Given: map[string]map[int]int{"gitea": {3000: at}}}
-		if err := portInto(copied, "gitea", []Listening{{Port: 3000}}, with); err != nil {
-			t.Fatal(err)
-		}
-		want := "http://127.0.0.1:" + strconv.Itoa(at)
-		if got := copied["env"].(map[string]any)["MESH_GITEA_URL"]; got != want {
-			t.Fatalf("the second node was told %v, not %v — the first composition wrote its own "+
-				"port into the catalogue", got, want)
-		}
-	}
-	if env["MESH_GITEA_URL"] != "http://127.0.0.1:${port:3000}" {
-		t.Fatalf("the module's own manifest was edited: %v", env)
-	}
-}
-
-// Asking in an environment about a port it never declared is refused exactly as a file's is, and
-// the refusal names the container and the variable — there is no line number to go on.
-func TestAContainerAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
-	sidecar := map[string]any{
-		"type": "container", "id": "runtime", "name": "mesh-gitea",
-		"env": map[string]any{"MESH_GITEA_URL": "http://127.0.0.1:${port:9999}"},
-	}
-	err := portInto(sidecar, "gitea", []Listening{{Port: 3000}}, Rendering{})
-	if err == nil {
-		t.Fatal("a container was told a port its module never said it listens on")
-	}
-	for _, said := range []string{"mesh-gitea", "MESH_GITEA_URL", "3000"} {
-		if !strings.Contains(err.Error(), said) {
-			t.Errorf("the refusal does not say %q: %v", said, err)
-		}
-	}
-}
-
-// And a container naming no port keeps the environment it was written with — the same map, so
-// nothing is copied and no other node's composition is disturbed.
-func TestAContainerWithNoPortPlaceholderKeepsItsEnvironment(t *testing.T) {
-	env := map[string]any{"MESH_GITEA_URL": "http://gitea:3000", "PORT": 3000}
-	sidecar := map[string]any{"type": "container", "name": "mesh-gitea", "env": env}
-	if err := portInto(sidecar, "gitea", []Listening{{Port: 3000}}, Rendering{
-		Given: map[string]map[int]int{"gitea": {3000: 2999}},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	// A sibling reached over the runtime's own network is reached on the port INSIDE it, which the
-	// module does control: a literal there is right, and moving it would break the one address the
-	// mapping does not touch.
-	if got := sidecar["env"].(map[string]any)["MESH_GITEA_URL"]; got != "http://gitea:3000" {
-		t.Fatalf("an address on the runtime's own network was moved to the machine's port: %v", got)
-	}
-	// The same map, not a copy of it: a container that asks for nothing is left alone, and
-	// comparing the contents would say yes even to a rebuilt map.
-	if reflect.ValueOf(sidecar["env"]).Pointer() != reflect.ValueOf(env).Pointer() {
-		t.Fatalf("a container that asked for nothing had its environment rebuilt: %v", sidecar["env"])
-	}
-}
diff --git a/internal/catalogue/predefined_test.go b/internal/catalogue/predefined_test.go
deleted file mode 100644
index 015a8e58..00000000
--- a/internal/catalogue/predefined_test.go
+++ /dev/null
@@ -1,175 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// The list of predefined keys (novox/hq ADR 0348 §7, design 57 package K2, issue 661): read strictly, and every
-// manifest naming a key judged against the list of the tree it is read in.
-
-// theFirstKeys is the catalogue's first list: font-size and agent-managed-settings.
-const theFirstKeys = `{
-  "font-size": {"type": "number", "description": "the size text is shown in, in points", "minimum": 6, "maximum": 72},
-  "agent-managed-settings": {"type": "object", "description": "the managed settings of every agent session, a JSON object", "trusted": true}
-}`
-
-func TestTheFirstListIsRead(t *testing.T) {
-	list, err := ParsePredefined([]byte(theFirstKeys))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := strings.Join(list.Keys(), ","); got != "agent-managed-settings,font-size" {
-		t.Fatalf("keys %s", got)
-	}
-	if k := list["font-size"]; k.Type != ConfigNumber || *k.Minimum != 6 || *k.Maximum != 72 || k.Trusted {
-		t.Fatalf("font-size read as %+v", k)
-	}
-	if k := list["agent-managed-settings"]; k.Type != ConfigObject || !k.Trusted {
-		t.Fatalf("agent-managed-settings read as %+v", k)
-	}
-	// One list is one text, however it was written.
-	a, _ := list.Canonical()
-	again, _ := ParsePredefined(a)
-	b, _ := again.Canonical()
-	if string(a) != string(b) {
-		t.Fatalf("canonical text moved:\n%s\n%s", a, b)
-	}
-}
-
-func TestAListIsRefusedWholeForAnyWrongKey(t *testing.T) {
-	for _, c := range []struct{ file, says string }{
-		{`[]`, "not a JSON object of keys"},
-		{`null`, "not a JSON object of keys"},
-		{`{"font-size": {"type": "number", "description": "points", "default": 10}}`, `unknown field "default"`},
-		{`{"font-size": {"description": "points"}}`, "no type"},
-		{`{"font-size": {"type": "decimal", "description": "points"}}`, `type "decimal"`},
-		{`{"font-size": {"type": "number"}}`, "no description"},
-		{`{"accent": {"type": "object", "description": "colours"}}`, "not trusted"},
-		{`{"font-size": {"type": "number", "description": "points", "minimum": 9, "maximum": 6}}`, "above its maximum"},
-		{`{"accent": {"type": "string", "description": "a name", "pattern": "("}}`, "not a regular expression"},
-		{`{"accent": {"type": "boolean", "description": "on or off", "minimum": 1}}`, "minimum or maximum is for a number"},
-		{`{"Font Size": {"type": "number", "description": "points"}}`, "not a usable key"},
-		{`{"places": {"type": "string", "description": "where"}}`, "placement"},
-		{`{"puid": {"type": "number", "description": "an id"}}`, "placement"},
-	} {
-		if _, err := ParsePredefined([]byte(c.file)); err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: wanted a refusal saying %q, got %v", c.file, c.says, err)
-		}
-	}
-}
-
-// fallingBackTo is inConfigForm with its font size falling back to a predefined key.
-func fallingBackTo(t *testing.T, key string) []byte {
-	t.Helper()
-	m := inConfigForm()
-	declaration(m, "font-size")["predefined"] = key
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-// A manifest naming font-size registers against the list; one naming a key not on it, or of another type, is
-// refused — judged against the list given, whatever the mesh published.
-func TestAManifestIsJudgedAgainstTheListOfItsTree(t *testing.T) {
-	withPredefined(t, nil)
-	list, err := ParsePredefined([]byte(theFirstKeys))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := ParseManifestWith(fallingBackTo(t, "font-size"), list); err != nil {
-		t.Fatalf("a value falling back to font-size is refused: %v", err)
-	}
-	if _, err := ParseManifestWith(fallingBackTo(t, "font-scale"), list); err == nil ||
-		!strings.Contains(err.Error(), `"font-scale", which is not on the list`) {
-		t.Fatalf("a key not on the list: %v", err)
-	}
-	m := inConfigForm()
-	declaration(m, "theme")["predefined"] = "font-size"
-	raw, _ := json.Marshal(m)
-	if _, err := ParseManifestWith(raw, list); err == nil || !strings.Contains(err.Error(), "which is a number") {
-		t.Fatalf("a key of another type: %v", err)
-	}
-	// Where no tree is read, the published list judges: none published refuses.
-	if _, err := ParseManifest(fallingBackTo(t, "font-size")); err == nil || !strings.Contains(err.Error(), "is not present") {
-		t.Fatalf("judged against no list: %v", err)
-	}
-	withPredefined(t, list)
-	if _, err := ParseManifest(fallingBackTo(t, "font-size")); err != nil {
-		t.Fatalf("judged against the published list: %v", err)
-	}
-}
-
-// A template's text filled from the tree keeps the list the manifest was judged against: read again, it is not
-// judged against the published one.
-func TestTemplatesFilledKeepTheListTheManifestWasJudgedAgainst(t *testing.T) {
-	withPredefined(t, nil)
-	list, _ := ParsePredefined([]byte(theFirstKeys))
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, DefaultTemplatesDir), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, DefaultTemplatesDir, "rc"), []byte("font = ${config:font-size}\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	m := inConfigForm()
-	declaration(m, "font-size")["predefined"] = "font-size"
-	r := resourceOf(m, "configuration")
-	delete(r, "content")
-	r["template"] = DefaultTemplatesDir + "/rc"
-	m["build"] = map[string]any{"artifacts": []any{map[string]any{"name": "files", "kind": "archive", "from": "files"}}}
-	declaration(m, "width")["runtime"] = true
-	declaration(m, "sender")["runtime"] = true
-	raw, _ := json.Marshal(m)
-	parsed, err := ParseManifestWith(raw, list)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := WithTemplatesFrom(parsed, dir); err != nil {
-		t.Fatalf("filled from the tree, it was judged against another list: %v", err)
-	}
-}
-
-// module check reads the list at the root of the repository above the manifest; no repository, no list.
-func TestTheListIsFoundAtTheRepositoryRootAboveAManifest(t *testing.T) {
-	root := t.TempDir()
-	module := filepath.Join(root, "modules", "dunst")
-	if err := os.MkdirAll(module, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if list, err := PredefinedAbove(module); err != nil || list != nil {
-		t.Fatalf("outside a repository: %v %v", list, err)
-	}
-	if err := os.Mkdir(filepath.Join(root, ".git"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if list, err := PredefinedAbove(module); err != nil || list != nil {
-		t.Fatalf("a repository without the file: %v %v", list, err)
-	}
-	if err := os.WriteFile(filepath.Join(root, PredefinedFile), []byte(theFirstKeys), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	list, err := PredefinedAbove(module)
-	if err != nil || len(list) != 2 {
-		t.Fatalf("the list above: %v %v", list, err)
-	}
-	if err := os.WriteFile(filepath.Join(root, PredefinedFile), []byte(`{"font-size": {}}`), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := PredefinedAbove(module); err == nil {
-		t.Fatal("a wrong list above was read")
-	}
-	if err := os.Remove(filepath.Join(root, PredefinedFile)); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink("/etc/hostname", filepath.Join(root, PredefinedFile)); err == nil {
-		if _, err := PredefinedAbove(module); err == nil || !strings.Contains(err.Error(), "not a plain file") {
-			t.Fatalf("a link read as the list: %v", err)
-		}
-	}
-}
diff --git a/internal/catalogue/prepares_test.go b/internal/catalogue/prepares_test.go
deleted file mode 100644
index eaae43bd..00000000
--- a/internal/catalogue/prepares_test.go
+++ /dev/null
@@ -1,141 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// A module version prepares its state before it runs (novox/hq ADR 0135).
-//
-// What the mesh derives is the module's own resource, run once with one word, placed immediately in
-// front of the thing it prepares for. What matters in these tests is that the derivation is a copy
-// rather than a second description: the failure it replaces was a hand-written step repeating six
-// fields of the resource it preceded, each free to drift from it.
-
-func aPreparingModule() Manifest {
-	return Manifest{
-		Module:   "gitea",
-		Prepares: true,
-		Resources: []map[string]any{
-			{"id": "state", "type": "directory", "path": "/var/lib/gitea", "mode": "0700"},
-			{"id": "server", "type": "container", "name": "mesh-gitea-server",
-				"image": "gitea/gitea@" + digest, "ports": []any{"3000:3000"}},
-			{"id": "runtime", "type": "container", "name": "mesh-gitea",
-				"image": ArtifactStoreScheme + "gitea/runtime@" + digest, "network": "host",
-				"env":     map[string]any{"MESH_GITEA_STATE_DIR": "/run/state"},
-				"volumes": []any{"/var/lib/gitea:/run/state:ro"},
-				"ports":   []any{"9000:9000"}},
-		},
-	}
-}
-
-func declaredFor(t *testing.T, m Manifest) []map[string]any {
-	t.Helper()
-	// The manifest as the mesh holds it: a build resolved the module's own artifact into the
-	// reference it recorded, which is also how the composition knows whose code a resource runs.
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(
-		Rendering{ArtifactStore: "anchor.internal:5100"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-func idsOf(resources []map[string]any) []string {
-	var ids []string
-	for _, r := range resources {
-		ids = append(ids, fmt.Sprint(r["id"]))
-	}
-	return ids
-}
-
-// The step runs the module's own code, and comes immediately before it — not before the upstream
-// server the module packages, which may be the very thing the state lives in.
-func TestThePreparationRunsTheModulesOwnCodeAndComesRightBeforeIt(t *testing.T) {
-	out := declaredFor(t, aPreparingModule())
-	ids := idsOf(out)
-	at := -1
-	for i, id := range ids {
-		if id == "gitea.runtime-prepare" {
-			at = i
-		}
-	}
-	if at < 0 {
-		t.Fatalf("nothing prepares this module's state: %v", ids)
-	}
-	// A module's name may contain a dot, so a resource's module is everything before the last one —
-	// which the derived id must not add to, or a machine reads the wrong owner from it.
-	if strings.Count("gitea.runtime-prepare", ".") != 1 {
-		t.Fatal("the derived id adds a dot, so what owns it cannot be read from it")
-	}
-	if ids[at+1] != "gitea.runtime" {
-		t.Fatalf("the preparation is not immediately before the module's own code: %v", ids)
-	}
-	for _, id := range ids[:at] {
-		if id == "gitea.runtime" {
-			t.Fatalf("the module's own code runs before its state is prepared: %v", ids)
-		}
-	}
-}
-
-// It is given exactly what the module's own code is given. Asserted field by field against the
-// resource it was derived from, because writing it twice is the fault this replaces.
-func TestThePreparationIsGivenWhatTheModuleIsGiven(t *testing.T) {
-	out := declaredFor(t, aPreparingModule())
-	declared := byID(out)
-	step, workload := declared["gitea.runtime-prepare"], declared["gitea.runtime"]
-	if step == nil || workload == nil {
-		t.Fatalf("expected both, got %v", idsOf(out))
-	}
-	for _, field := range []string{"image", "network", "env", "volumes", "type"} {
-		if fmt.Sprint(step[field]) != fmt.Sprint(workload[field]) {
-			t.Errorf("the preparation's %s is %v and the module's is %v", field, step[field], workload[field])
-		}
-	}
-	if once, _ := step["run-once"].(bool); !once {
-		t.Error("the preparation is not a step, so nothing waits for it and nothing is gated by it")
-	}
-	if fmt.Sprint(step["args"]) != fmt.Sprint([]any{PreparationArgument}) {
-		t.Errorf("the preparation is asked for as %v", step["args"])
-	}
-	if fmt.Sprint(step["name"]) == fmt.Sprint(workload["name"]) {
-		t.Error("the preparation and the workload have one name, so one removes the other")
-	}
-	// A published port cannot be bound twice, and the version being replaced is still running.
-	if _, published := step["ports"]; published {
-		t.Errorf("the preparation publishes a port the running version holds: %v", step["ports"])
-	}
-}
-
-// A module that says nothing about preparing gets nothing, which is most modules.
-func TestAModuleThatPreparesNothingGetsNoStep(t *testing.T) {
-	m := aPreparingModule()
-	m.Prepares = false
-	for _, id := range idsOf(declaredFor(t, m)) {
-		if id == "gitea.runtime-prepare" {
-			t.Fatal("a module that prepares nothing was given a preparation")
-		}
-	}
-}
-
-// A module whose own code the mesh cannot find has nothing to ask, and saying so where the manifest
-// is read beats a declaration that quietly prepares nothing.
-func TestAModuleThatPreparesAndRunsNoneOfItsOwnCodeIsRefused(t *testing.T) {
-	m := Manifest{
-		Module:   "gitea",
-		Prepares: true,
-		Resources: []map[string]any{
-			// Only the upstream server it packages: nothing here runs gitea's own code.
-			{"id": "server", "type": "container", "name": "mesh-gitea-server", "image": "gitea/gitea@" + digest},
-		},
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := ParseManifest(raw); err == nil {
-		t.Fatal("a module that prepares its state with nothing of its own to run was accepted")
-	}
-}
diff --git a/internal/catalogue/print_rehearsal_test.go b/internal/catalogue/print_rehearsal_test.go
deleted file mode 100644
index d2aa7eff..00000000
--- a/internal/catalogue/print_rehearsal_test.go
+++ /dev/null
@@ -1,16 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"testing"
-)
-
-func TestPrintRehearsalRuleset(t *testing.T) {
-	if os.Getenv("PRINT_RULESET") == "" {
-		t.Skip("set PRINT_RULESET")
-	}
-	rules := mustFilter(t, Resolution{Modules: []Manifest{
-		{Module: "pub", Listens: []Listening{{Port: 8099, From: FromMesh, Why: "the thing it serves"}}},
-	}}, nil)
-	t.Log("\n" + AsNftables(rules, []string{"192.0.2.20"}, true, nil, nil, "mesh0"))
-}
diff --git a/internal/catalogue/process_bus_test.go b/internal/catalogue/process_bus_test.go
deleted file mode 100644
index 5551ec17..00000000
--- a/internal/catalogue/process_bus_test.go
+++ /dev/null
@@ -1,191 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A process resource may declare `bus` (novox/hq ADR 0436 §1): what it emits, the module's own work-queue
-// streams it consumes, the module's own state it reads and writes, whether it reads the router's records of
-// this module's own asks, and the tools and seat verbs it calls. The fixture is mesh-mail's future manifest
-// shape (ADR 0436 §7, §8), copied from mesh-catalog/modules/mesh-mail/module.json and extended as settled by
-// the lead: process id "send" is the manifest's own `id` (internal/catalogue/runtime.go:72-74 is the model for
-// a process id); the account file uses the controller's real JSON tags (modules.go:1041-1056 issueWith).
-func mailSenderProcessManifest(t *testing.T, bus string) string {
-	t.Helper()
-	process := `{"id":"send","type":"process","run":["./mesh-mail","send"],"user":"mesh-mail-send"`
-	if bus != "" {
-		process += `,"bus":` + bus
-	}
-	process += `}`
-	// The stream itself is plain here, not retention work-queue: 1179 checks only that a process names a
-	// stream the module owns, never its retention — that rule is 1178's (WorkQueueStreamProblems), and is
-	// tested against its own fixture there (work_queue_consumer_test.go) so this one stays accepted whether
-	// or not a process currently names "mail-sends" in bus.queues.
-	return `{"module":"mesh-mail","version":"1","emits":["mail.send.sent","mail.send.failed"],` +
-		`"state":["sends"],"streams":[{"name":"mail-sends","events":["mail.send.approved"],"max-age-days":1,` +
-		`"max-mib":64}],"resources":[{"id":"account","type":"user","name":"mesh-mail-send"},` + process + `]}`
-}
-
-const mailSenderBus = `{"emits":["mail.send.sent","mail.send.failed"],"queues":["mail-sends"],` +
-	`"state":["sends"],"asks":true,"invokes":["seat:operator-channel.tell"]}`
-
-// 1179/AC1: a well-formed bus on a process whose account the module makes is accepted, and the catalogue
-// gives it whole to the grant composition (ProcessBuses, which 1180 reads).
-func TestAProcessDeclaresItsBusAndIsAccepted(t *testing.T) {
-	m, err := ParseManifest([]byte(mailSenderProcessManifest(t, mailSenderBus)))
-	if err != nil {
-		t.Fatalf("a well-formed process bus was refused: %v", err)
-	}
-	buses := m.ProcessBuses()
-	b, ok := buses["send"]
-	if !ok {
-		t.Fatalf("the process's bus was not given to the grant composition: %+v", buses)
-	}
-	if !strSliceEqual(b.Emits, []string{"mail.send.sent", "mail.send.failed"}) ||
-		!strSliceEqual(b.Queues, []string{"mail-sends"}) || !strSliceEqual(b.State, []string{"sends"}) ||
-		!b.Asks || !strSliceEqual(b.Invokes, []string{"seat:operator-channel.tell"}) {
-		t.Fatalf("the bus read as %+v", b)
-	}
-}
-
-func strSliceEqual(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for i := range a {
-		if a[i] != b[i] {
-			return false
-		}
-	}
-	return true
-}
-
-// 1179/AC2: a bus on a process with no user, user root, or the operator account is refused naming the
-// process and the account rule.
-func TestAProcessBusAccountMustBeTheModulesOwn(t *testing.T) {
-	for name, c := range map[string]struct{ user, says string }{
-		"no user":              {"", "send"},
-		"user root":            {"root", "root"},
-		"the operator account": {"${machine:account}", "operator"},
-	} {
-		raw := `{"module":"mesh-mail","version":"1","emits":["mail.send.sent"],"state":["sends"],` +
-			`"streams":[{"name":"mail-sends","events":["mail.send.approved"],"retention":"work-queue",` +
-			`"max-deliveries":5}],"resources":[{"id":"account","type":"user","name":"mesh-mail-send"},` +
-			`{"id":"send","type":"process","run":["./mesh-mail","send"]`
-		if c.user != "" {
-			raw += `,"user":"` + c.user + `"`
-		}
-		raw += `,"bus":{"emits":["mail.send.sent"]}}]}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), "send") || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal naming the process and %q", name, err, c.says)
-		}
-	}
-}
-
-// 1179/AC3: a bus naming a stream, state or event the module does not declare as its own is refused naming
-// it.
-func TestAProcessBusNamesOnlyTheModulesOwn(t *testing.T) {
-	for name, c := range map[string]struct{ bus, says string }{
-		"another module's event": {`{"emits":["billing.paid"]}`, "billing.paid"},
-		"another module's queue": {`{"queues":["other-queue"]}`, "other-queue"},
-		"another module's state": {`{"state":["other-state"]}`, "other-state"},
-	} {
-		_, err := ParseManifest([]byte(mailSenderProcessManifest(t, c.bus)))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal naming %q", name, err, c.says)
-		}
-	}
-}
-
-// 1179/AC4: a bus declaring serves, holds, claims or a seat is refused naming the key; a bus with invokes of
-// a tool or a seat verb is accepted.
-func TestAProcessBusNeverServesOrHoldsASeat(t *testing.T) {
-	for name, c := range map[string]struct{ bus, says string }{
-		"serves": {`{"emits":["mail.send.sent"],"serves":["send"]}`, "serves"},
-		"holds":  {`{"emits":["mail.send.sent"],"holds":["mail-sender"]}`, "holds"},
-		"claims": {`{"emits":["mail.send.sent"],"claims":["mail-sender"]}`, "claims"},
-		"seat":   {`{"emits":["mail.send.sent"],"seat":"mail-sender"}`, "seat"},
-	} {
-		_, err := ParseManifest([]byte(mailSenderProcessManifest(t, c.bus)))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal naming %q", name, err, c.says)
-		}
-	}
-	accepted := `{"emits":["mail.send.sent","mail.send.failed"],"invokes":["seat:operator-channel.tell","mail.status"]}`
-	if _, err := ParseManifest([]byte(mailSenderProcessManifest(t, accepted))); err != nil {
-		t.Fatalf("a bus invoking a tool and a seat verb was refused: %v", err)
-	}
-}
-
-// 1179/AC5: a process declaring bus is composed with no bus key on the wire, and is otherwise byte for byte
-// what main composes for the same process without bus.
-func TestAProcessesBusNeverReachesTheWire(t *testing.T) {
-	withBus, err := ParseManifest([]byte(mailSenderProcessManifest(t, mailSenderBus)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	withoutBus, err := ParseManifest([]byte(mailSenderProcessManifest(t, "")))
-	if err != nil {
-		t.Fatal(err)
-	}
-	with := Rendering{Needed: map[string]map[string]string{}}
-	outWith, err := Resolution{Node: "novox", Modules: []Manifest{withBus}}.Declaration(with)
-	if err != nil {
-		t.Fatalf("composing with bus: %v", err)
-	}
-	outWithout, err := Resolution{Node: "novox", Modules: []Manifest{withoutBus}}.Declaration(with)
-	if err != nil {
-		t.Fatalf("composing without bus: %v", err)
-	}
-	var withProcess, withoutProcess map[string]any
-	for _, r := range outWith {
-		if r["id"] == "mesh-mail.send" {
-			withProcess = r
-		}
-	}
-	for _, r := range outWithout {
-		if r["id"] == "mesh-mail.send" {
-			withoutProcess = r
-		}
-	}
-	if withProcess == nil || withoutProcess == nil {
-		t.Fatalf("the process was not composed at all: with=%v without=%v", withProcess, withoutProcess)
-	}
-	if _, has := withProcess["bus"]; has {
-		t.Fatalf("the process resource carried a bus key onto the wire: %v", withProcess)
-	}
-	delete(withProcess, "bus")
-	if !mapsEqual(withProcess, withoutProcess) {
-		t.Fatalf("with bus declared, the process composed differently: %+v\nwant: %+v", withProcess, withoutProcess)
-	}
-}
-
-func mapsEqual(a, b map[string]any) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for k, v := range a {
-		bv, ok := b[k]
-		if !ok {
-			return false
-		}
-		if av, ok := v.([]any); ok {
-			bbv, ok := bv.([]any)
-			if !ok || len(av) != len(bbv) {
-				return false
-			}
-			for i := range av {
-				if av[i] != bbv[i] {
-					return false
-				}
-			}
-			continue
-		}
-		if v != bv {
-			return false
-		}
-	}
-	return true
-}
diff --git a/internal/catalogue/process_env_test.go b/internal/catalogue/process_env_test.go
deleted file mode 100644
index bbf03472..00000000
--- a/internal/catalogue/process_env_test.go
+++ /dev/null
@@ -1,80 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// **A process's environment is composed as a container's is** (novox/hq to-be 38 WP4c).
-//
-// A module's code moving out of its container becomes a process on the machine, and what its
-// container's environment asked for — the port this machine gave the module, the place it put the
-// module's directory — it still has to be told. Filled for a container and not for a process, the
-// literal `${port:8080}` reached the process as its environment and was read as a port; the modules
-// that moved first wrote their run-once steps an env file instead.
-func processModule(env map[string]any) Manifest {
-	return Manifest{
-		Module:  "showcase",
-		Listens: []Listening{{Port: 8080, From: FromMesh}},
-		Resources: []map[string]any{
-			{"id": "data", "type": "directory", "mode": "0700"},
-			{"id": "setup", "type": "process", "name": "showcase-setup", "run-once": true,
-				"run": []any{"/usr/bin/showcase", "setup"}, "env": env},
-		},
-	}
-}
-
-func TestAProcessIsToldItsPortAndItsPlaceInItsEnvironment(t *testing.T) {
-	env := map[string]any{
-		"SHOWCASE_URL":  "http://127.0.0.1:${port:8080}",
-		"SHOWCASE_DATA": "${dir:data}/objects",
-		"SHOWCASE_DB":   "127.0.0.1:${seat:mesh-store:5432}",
-		"GREETING":      "hello",
-	}
-	out, err := Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}.Declaration(Rendering{
-		Ports: map[string]map[int]int{"showcase": {8080: 21000}},
-		Seats: map[string]map[int]int{"mesh-store": {5432: 6852}},
-	})
-	if err != nil {
-		t.Fatalf("a process asking for its port and its place does not compose: %v", err)
-	}
-	setup := fileNamed(out, "showcase.setup")
-	if setup == nil {
-		t.Fatalf("the process is not in the declaration: %v", out)
-	}
-	got, _ := setup["env"].(map[string]any)
-	for key, want := range map[string]string{
-		"SHOWCASE_URL":  "http://127.0.0.1:21000",
-		"SHOWCASE_DATA": "/var/lib/showcase/data/objects",
-		"SHOWCASE_DB":   "127.0.0.1:6852",
-		"GREETING":      "hello",
-	} {
-		if got[key] != want {
-			t.Errorf("the process is told %s=%v, want %q", key, got[key], want)
-		}
-	}
-	if env["SHOWCASE_URL"] != "http://127.0.0.1:${port:8080}" {
-		t.Fatalf("composing for one machine edited the module's own manifest: %v", env)
-	}
-}
-
-// An unknown reference in a process's environment is refused as a container's is, naming the
-// process and the variable — left alone, it would reach the machine as a literal.
-func TestAProcessAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
-	env := map[string]any{"SHOWCASE_URL": "http://127.0.0.1:${port:9999}"}
-	_, err := Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}.Declaration(Rendering{})
-	if err == nil {
-		t.Fatal("a process was told a port its module never said it listens on")
-	}
-	for _, said := range []string{"showcase-setup", "SHOWCASE_URL", "${port:9999}", "8080"} {
-		if !strings.Contains(err.Error(), said) {
-			t.Errorf("the refusal does not say %q: %v", said, err)
-		}
-	}
-
-	env = map[string]any{"SHOWCASE_DATA": "${dir:date}/objects"}
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{processModule(env)}}).Declaration(Rendering{}); err == nil ||
-		!strings.Contains(err.Error(), "${dir:date}") {
-		t.Fatalf("a process naming no directory of its module was not refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/provided_test.go b/internal/catalogue/provided_test.go
deleted file mode 100644
index a4f9413b..00000000
--- a/internal/catalogue/provided_test.go
+++ /dev/null
@@ -1,144 +0,0 @@
-package catalogue_test
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-	"github.com/novox/mesh-controller/internal/overlay"
-)
-
-// The manifests the control plane actually ships, resolved.
-//
-// Written because the earlier tests built their own manifests and passed while the real one was
-// missing a claim — a whole mechanism could have been absent from what ships and every test would
-// still have been green.
-
-func provided(t *testing.T) map[string]catalogue.Manifest {
-	t.Helper()
-	out := map[string]catalogue.Manifest{}
-	for _, raw := range []map[string]any{
-		overlay.Manifest(),
-	} {
-		b, err := json.Marshal(raw)
-		if err != nil {
-			t.Fatal(err)
-		}
-		m, err := catalogue.ParseManifest(b)
-		if err != nil {
-			t.Fatalf("a manifest this control plane ships is not valid: %v", err)
-		}
-		out[m.Module] = m
-	}
-	return out
-}
-
-func TestTheShippedPrivateNetworkResolvesOnItsOwn(t *testing.T) {
-	// **Assigned directly** (novox/hq ADR 0226): the `networking` bundle that required it is
-	// retired, so the private network's own module is what a machine is given, and it must need
-	// nothing the control plane does not ship beside it.
-	got, err := catalogue.Resolve(provided(t), []string{overlay.Name}, catalogue.Node{Name: "workstation", Site: "house"}, catalogue.World{})
-	if err != nil {
-		t.Fatalf("assigning %s does not work out of the box: %v", overlay.Name, err)
-	}
-	if len(got.Modules) != 1 || got.Modules[0].Module != overlay.Name {
-		t.Fatalf("assigning %s brought %v", overlay.Name, got.Modules)
-	}
-
-	// **The network writes no names** (novox/hq ADR 0199): /etc/hosts is the hosts seat holder's
-	// file, and the mesh's resolver answers the machines' names. No fact of the network's module
-	// may name that file.
-	for _, m := range got.Modules {
-		for name, f := range m.Facts {
-			if f.Path == "/etc/hosts" {
-				t.Fatalf("the network's provider still writes /etc/hosts, as its %q fact", name)
-			}
-		}
-	}
-}
-
-func TestTheControlPlaneShipsNoNetworkingBundle(t *testing.T) {
-	// ADR 0226: one module for the one private network. A bundle shipped beside it again would be
-	// a second name every machine carries for the same thing.
-	shipped := provided(t)
-	if len(shipped) != 1 {
-		t.Fatalf("the control plane ships %d modules, want only %s", len(shipped), overlay.Name)
-	}
-	if _, ok := shipped["networking"]; ok {
-		t.Fatal("the retired networking bundle is shipped again")
-	}
-}
-
-func TestARefusalForWantOfThePrivateNetworkNamesItsModule(t *testing.T) {
-	// The hint in a refusal is a string in the resolver rather than an import of this package. It
-	// named `networking` until ADR 0226; a hint naming a module nobody ships sends a person to
-	// assign something that does not exist.
-	shelf := map[string]catalogue.Manifest{
-		"app":      {Module: "app", Version: "1", Requires: []string{"postgres-database"}},
-		"postgres": {Module: "postgres", Version: "1", Provides: catalogue.FromAnywhere("postgres-database")},
-	}
-	_, err := catalogue.Resolve(shelf, []string{"app"}, catalogue.Node{Name: "workstation"},
-		catalogue.World{Offered: map[string][]catalogue.Provider{
-			"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
-	if err == nil {
-		t.Fatal("an app off the private network was pointed at a database on it")
-	}
-	if !strings.Contains(err.Error(), "assign "+overlay.Name) {
-		t.Fatalf("the refusal does not name the private network's module %s: %v", overlay.Name, err)
-	}
-}
-
-func TestAnotherVPNIsChosenByAssigningItInstead(t *testing.T) {
-	// What the bundle was for, kept without it: a machine given another VPN answers
-	// private-network from that VPN, and WireGuard is not dragged in by anything.
-	shipped := provided(t)
-	shelf := withTailscale(shipped)
-	shelf["needs-network"] = catalogue.Manifest{Module: "needs-network", Version: "1",
-		Requires: []string{overlay.Requirement}}
-	got, err := catalogue.Resolve(shelf, []string{"needs-network", "tailscale"},
-		catalogue.Node{Name: "workstation", Site: "house"}, catalogue.World{})
-	if err != nil {
-		t.Fatalf("choosing another VPN was refused: %v", err)
-	}
-	for _, m := range got.Modules {
-		if m.Module == overlay.Name {
-			t.Fatalf("the other VPN was chosen and WireGuard came anyway: %v", got.Modules)
-		}
-	}
-}
-
-func TestTwoVPNsAssignedTogetherStillCollide(t *testing.T) {
-	// The claim still guards the case it was always for: both assigned EXPLICITLY, which is a
-	// machine with two private networks and a coin toss about which one a peer reaches it on.
-	shipped := provided(t)
-	_, err := catalogue.Resolve(
-		withTailscale(shipped),
-		[]string{overlay.Name, "tailscale"},
-		catalogue.Node{Name: "workstation", Site: "house"}, catalogue.World{})
-	if err == nil {
-		t.Fatal("a machine was given two private networks and nobody was told")
-	}
-	if !strings.Contains(err.Error(), overlay.TheNetwork) {
-		t.Fatalf("the refusal does not say what collided: %v", err)
-	}
-}
-
-// The names-need-addressing test went with the names module: names are a fact now, and a machine
-// the mesh cannot place is simply left out of the file (facts_test.go) — which is the same
-// protection, enforced where the file is written rather than by a provision refusing.
-
-func withTailscale(shelf map[string]catalogue.Manifest) map[string]catalogue.Manifest {
-	out := map[string]catalogue.Manifest{}
-	for k, v := range shelf {
-		out[k] = v
-	}
-	// Deliberately without name-resolution of its own, which is the case that used to install
-	// both VPNs: the names then needed the mesh's addressing, and only WireGuard has it.
-	out["tailscale"] = catalogue.Manifest{
-		Module: "tailscale", Version: "1",
-		Provides: catalogue.Offers(overlay.Requirement),
-		Claims:   []catalogue.Claim{{Name: overlay.TheNetwork, Scope: catalogue.ScopeNode}},
-	}
-	return out
-}
diff --git a/internal/catalogue/published_ports_test.go b/internal/catalogue/published_ports_test.go
deleted file mode 100644
index 48036d24..00000000
--- a/internal/catalogue/published_ports_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// A container publishes only a port its module declares (novox/hq issue 227).
-//
-// **The short form is a question the mesh answers.** `"80"` means *publish what the software
-// calls 80*, and the mesh fills in the machine's half from the port it assigned
-// ([ADR 0038](0038)). It can only assign one for a port the module declared in `listens` — so a
-// container publishing a number that appears nowhere in `listens` gets no assignment, and
-// `publishedOn` falls back to the number as written. It escapes to the machine.
-//
-// That is how the photo module asked for port 80 on the control node, where the reverse proxy
-// holds it: it declared its web endpoint at 4001, published a bare 80, and the container never
-// started. Four other modules publish 80 quite safely — because they declare 80, so the mesh
-// gives them a machine port for it. The difference is the declaration, not the number.
-//
-// A mapping written the long way is a module pinning both halves on purpose and is left alone.
-func TestEveryPublishedPortIsOneItsModuleDeclares(t *testing.T) {
-	root := catalogueRoot(t)
-	entries, err := os.ReadDir(filepath.Join(root, "modules"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var escaped []string
-	for _, entry := range entries {
-		if !entry.IsDir() {
-			continue
-		}
-		raw, err := os.ReadFile(filepath.Join(root, "modules", entry.Name(), "module.json"))
-		if err != nil {
-			continue
-		}
-		m, err := ParseManifest(raw)
-		if err != nil {
-			// Whether every manifest parses is TestEveryCatalogueManifestParses's question.
-			continue
-		}
-		declared := map[int]bool{}
-		for _, l := range m.Listens {
-			declared[l.Port] = true
-		}
-		for _, r := range m.Resources {
-			if fmt.Sprint(r["type"]) != "container" {
-				continue
-			}
-			listed, _ := r["ports"].([]any)
-			for _, p := range listed {
-				written := strings.Split(fmt.Sprint(p), "/")[0]
-				if strings.Contains(written, ":") {
-					continue // pinned by hand, both halves, on purpose
-				}
-				port, err := strconv.Atoi(strings.TrimSpace(written))
-				if err != nil || declared[port] {
-					continue
-				}
-				escaped = append(escaped, fmt.Sprintf(
-					"%s's %v publishes %d, and %s declares no such port — the mesh has nothing "+
-						"to assign, so %d reaches the machine as written",
-					m.Module, r["id"], port, m.Module, port))
-			}
-		}
-	}
-	if len(escaped) > 0 {
-		t.Fatalf("a container may publish only a port its module declares:\n  - %s",
-			strings.Join(escaped, "\n  - "))
-	}
-}
diff --git a/internal/catalogue/reach_test.go b/internal/catalogue/reach_test.go
deleted file mode 100644
index 66b620c4..00000000
--- a/internal/catalogue/reach_test.go
+++ /dev/null
@@ -1,206 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// a web module with one routed endpoint, the shape almost every routed module in the catalogue has.
-func aRoutedWeb() Manifest {
-	return Manifest{
-		Module:  "web",
-		Listens: []Listening{{Port: 3000, From: FromMesh}},
-		Contributes: map[string]map[string]any{
-			"route": {"label": "app", "port": 3000},
-		},
-	}
-}
-
-func reachSet(reach string) SettingsBy {
-	return SettingsBy{"web": {{From: "node anchor",
-		Placement: map[string]any{ReachSetting: map[string]any{"3000": reach}}}}}
-}
-
-// namesFor renders the contribution a routed module makes and returns the two names it carries.
-func namesFor(t *testing.T, m Manifest, settings SettingsBy) (public, internal string) {
-	t.Helper()
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	given, err := r.contributions(settings, nil, nil)
-	if err != nil {
-		t.Fatalf("contributions: %v", err)
-	}
-	for _, c := range given["route"] {
-		p, _ := c.Values["name"].(string)
-		i, _ := c.Values["internal-name"].(string)
-		return p, i
-	}
-	t.Fatal("the module contributed no route")
-	return "", ""
-}
-
-// **Nothing said composes both names, exactly as before.** This is the assertion that keeps every
-// mesh already running identical until an assignment speaks, and it is the one that would break first
-// if reach were read where it should not be.
-func TestAnEndpointWithNoReachKeepsBothNames(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), nil)
-	if public != "app.example.test" || internal != "app.anchor.internal" {
-		t.Fatalf("names are %q and %q, want both composed as before", public, internal)
-	}
-}
-
-// An internal endpoint has an internal name and no public one — so the proxy serves it inside, and
-// the public authority is never asked for a name nobody wanted. This is what "must not be public"
-// could not say before.
-func TestAnInternalEndpointHasNoPublicName(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachInternal))
-	if public != "" {
-		t.Fatalf("an internal endpoint composed the public name %q", public)
-	}
-	if internal != "app.anchor.internal" {
-		t.Fatalf("internal name is %q, want app.anchor.internal", internal)
-	}
-}
-
-// And the mirror: a public endpoint gets the public name and not the internal one, so the mesh's own
-// authority is not asked to certify a name the service is not reached by.
-func TestAPublicEndpointHasNoInternalName(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachPublic))
-	if internal != "" {
-		t.Fatalf("a public endpoint composed the internal name %q", internal)
-	}
-	if public != "app.example.test" {
-		t.Fatalf("public name is %q, want app.example.test", public)
-	}
-}
-
-func TestBothComposesBothNames(t *testing.T) {
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachBoth))
-	if public == "" || internal == "" {
-		t.Fatalf("both should compose both names, got %q and %q", public, internal)
-	}
-}
-
-// **The filter reads the same value — for an endpoint the proxy does not serve.**
-//
-// A routed endpoint's port is how the proxy reaches it and nothing else (ADR 0045): a public service
-// listens from the mesh, only the proxy reaches it, and it is exposed by name. So on a routed
-// endpoint the reach asks for a name and the port keeps what the manifest said.
-func TestAnUnroutedEndpointsPortFollowsItsReach(t *testing.T) {
-	// The same module with its route taken away: now the port is the only way in, so reach governs it.
-	bare := aRoutedWeb()
-	bare.Contributes = nil
-
-	for _, c := range []struct{ reach, want string }{
-		{ReachInternal, FromMesh},
-		{ReachPublic, FromEverywhere},
-		{ReachBoth, FromEverywhere},
-		{ReachMachine, FromMachine},
-	} {
-		r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
-		rules, err := r.Rules(Rendering{Settings: reachSet(c.reach)})
-		if err != nil {
-			t.Fatalf("%s: rules: %v", c.reach, err)
-		}
-		found := false
-		for _, rule := range rules {
-			if rule.Port == 3000 {
-				found = true
-				if rule.From != c.want {
-					t.Fatalf("reach %q made the filter say %q, want %q", c.reach, rule.From, c.want)
-				}
-			}
-		}
-		if !found {
-			t.Fatalf("reach %q produced no rule for the port", c.reach)
-		}
-	}
-}
-
-// **A public name does not open the machine's port**, which is the case that found this.
-//
-// A module whose routed name must be public and whose machine-side port must not be had no way to say
-// so while one value drove both. Under one value it could not be expressed; the port would reopen.
-func TestAPublicNameLeavesARoutedPortAsTheManifestSaid(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{aRoutedWeb()},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	rules, err := r.Rules(Rendering{Settings: reachSet(ReachPublic)})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, rule := range rules {
-		if rule.Port == 3000 && rule.From != FromMesh {
-			t.Fatalf("a public reach opened a routed port to %q; the proxy is how it is reached",
-				rule.From)
-		}
-	}
-	// And the name it asked for is there, so the reach was not simply ignored.
-	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachPublic))
-	if public != "app.example.test" || internal != "" {
-		t.Fatalf("names are %q and %q, want the public one only", public, internal)
-	}
-}
-
-// A reach for a port the module does not listen on reaches nothing, and is refused where it is
-// written rather than accepted and ignored.
-func TestAReachForAPortTheModuleDoesNotListenOnIsRefused(t *testing.T) {
-	_, err := Reaches(aRoutedWeb(), []Layer{{From: "node anchor",
-		Placement: map[string]any{ReachSetting: map[string]any{"9999": ReachInternal}}}})
-	if err == nil || !strings.Contains(err.Error(), "reaches nothing") {
-		t.Fatalf("a reach naming an undeclared port was accepted: %v", err)
-	}
-}
-
-// A value that is not a reach is refused, and the refusal names the four so a reader is one edit from
-// right. "mesh" is the tempting wrong answer, because that is the filter's word for nearly the same
-// thing.
-func TestAValueThatIsNotAReachIsRefused(t *testing.T) {
-	for _, wrong := range []string{"mesh", "anywhere", "private", "true"} {
-		_, err := Reaches(aRoutedWeb(), []Layer{{From: "node anchor",
-			Placement: map[string]any{ReachSetting: map[string]any{"3000": wrong}}}})
-		if err == nil || !strings.Contains(err.Error(), "a reach is") {
-			t.Fatalf("%q was accepted as a reach: %v", wrong, err)
-		}
-	}
-}
-
-// **A port that says both reach and expose is refused.** They say the same thing in different words,
-// and accepting both would have the filter follow one while the names followed the other — the
-// disagreement ADR 0138 exists to remove, reintroduced by the migration away from the older word.
-func TestReachAndExposeForOnePortAreRefused(t *testing.T) {
-	_, err := Reaches(aRoutedWeb(), []Layer{{From: "node anchor", Placement: map[string]any{
-		ReachSetting:  map[string]any{"3000": ReachInternal},
-		ExposeSetting: map[string]any{"3000": FromEverywhere},
-	}}})
-	if err == nil || !strings.Contains(err.Error(), "same thing in different") {
-		t.Fatalf("a port set both ways was accepted: %v", err)
-	}
-}
-
-// A path-level refusal carries no port: it is a rule about a name, not an endpoint, and it inherits
-// whatever that name turned out to be. Narrowing the endpoint must not silently drop it.
-func TestARuleWithNoPortIsLeftAlone(t *testing.T) {
-	m := aRoutedWeb()
-	m.ContributesMany = map[string]map[string]map[string]any{
-		"route": {"refused": {"label": "app", "path": "/internal", "deny": true}},
-	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{m},
-		PublicDomain: "example.test", At: "anchor.internal"}
-	given, err := r.contributions(reachSet(ReachInternal), nil, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var sawDeny bool
-	for _, c := range given["route"] {
-		if deny, _ := c.Values["deny"].(bool); deny {
-			sawDeny = true
-			// It keeps both, because it named no endpoint to be narrowed by.
-			if c.Values["name"] == nil || c.Values["internal-name"] == nil {
-				t.Fatalf("the path rule lost a name it shadows: %v", c.Values)
-			}
-		}
-	}
-	if !sawDeny {
-		t.Fatal("the path rule was dropped")
-	}
-}
diff --git a/internal/catalogue/reads_test.go b/internal/catalogue/reads_test.go
deleted file mode 100644
index 69f314f3..00000000
--- a/internal/catalogue/reads_test.go
+++ /dev/null
@@ -1,137 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0310 §1, §2: node-reads is a node seat, and its verbs say the commands they replace, so
-// mesh_search finds them by `cat`, `grep` and `getent passwd` (ADR 0245 §3).
-func TestNodeReadsIsANodeSeatWhoseVerbsSayWhatTheyReplace(t *testing.T) {
-	s, ok := SeatNamed(ReadsSeat)
-	if !ok {
-		t.Fatalf("the mesh defines no seat %s", ReadsSeat)
-	}
-	if s.Scope != ScopeNode || s.Delivers != "" || !strings.Contains(s.Decision, "0310") {
-		t.Errorf("%s: scope %q, delivers %q, decision %q", ReadsSeat, s.Scope, s.Delivers, s.Decision)
-	}
-	replaced := map[string]string{}
-	for _, v := range s.Serves {
-		if v.Optional {
-			t.Errorf("%s.%s is optional: a new seat's holder serves every verb", ReadsSeat, v.Name)
-		}
-		if len(v.Replaces) == 0 {
-			t.Errorf("%s.%s says nothing it replaces", ReadsSeat, v.Name)
-		}
-		for _, c := range v.Replaces {
-			replaced[c] = v.Name
-		}
-	}
-	for command, verb := range map[string]string{"cat": "read", "grep": "search", "getent passwd": "account",
-		"getent group": "account", "id": "account", "stat": "stat", "readlink": "readlink", "ls": "list"} {
-		if replaced[command] != verb {
-			t.Errorf("%q is replaced by %q, want %s.%s", command, replaced[command], ReadsSeat, verb)
-		}
-	}
-}
-
-// novox/hq ADR 0310 §3: a holder of node-reads reads as an account of its own; one the machine's runtime would
-// carry — as the operator's account — is refused at parse.
-func TestAHolderOfNodeReadsWithoutAnAccountOfItsOwnIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module": "reads", "version": "1",
-		"claims": [{"name": "node-reads", "scope": "node"}]}`))
-	if err == nil || !strings.Contains(err.Error(), "runs-as") || !strings.Contains(err.Error(), "0310") {
-		t.Errorf("a holder of node-reads without runs-as was not refused for it: %v", err)
-	}
-	if p := ReadsHolderProblems(Manifest{Module: "reads", RunsAs: "mesh-reads",
-		Claims: []Claim{{Name: ReadsSeat}}}); len(p) != 0 {
-		t.Errorf("a holder running as its own account was refused: %v", p)
-	}
-}
-
-// novox/hq ADR 0310 §5: the holder is told, by the composition, where its node keeps a secret — the directory
-// of every module's own secret, every credential file and grant directory, the vault's directories and the
-// place the operator-sealed secrets are kept — and no other module is told.
-func TestTheHolderOfNodeReadsIsToldWhereItsNodeKeepsASecret(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"},
-			"reads": {"broker": "own"}, "desk": {"broker": "own"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	reads := aToolsModule(t, "reads", "tools/index.js")
-	reads.RunsAs, reads.SecretsOwner = "mesh-reads", "mesh-reads"
-	reads.Claims = []Claim{{Name: ReadsSeat}}
-	reads.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/mesh-reads/broker"}}
-	desk := aToolsModule(t, "desk", "tools/index.js")
-	desk.RunsAs, desk.SecretsOwner = "desk", "desk"
-	desk.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/desk/broker"}}
-	// The vault as the catalogue declares it: its directories have no path of their own, and the node places them.
-	vault, err := placedManifest(catalogueResolved(t, "mesh-vault", Built{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "mesh-vault/code/blobs/" + bundleDigest, Digest: bundleDigest}), with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	app := Manifest{Module: "app", Version: "1", Secrets: map[string]string{"postgres-database": "/etc/app/db.secret"},
-		OwnSecrets: OwnSecrets{"token": {Path: "/home/ops/.config/app/token"}}}
-	r := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{reads, desk, vault, app, goRuntime}}
-	owns, err := r.ownRuntimes(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var given map[string]map[string]string
-	for _, p := range owns {
-		if p["id"] == "reads."+OwnRuntimeID() {
-			if err := json.Unmarshal([]byte(p["env"].(map[string]string)[RuntimeToolEnv]), &given); err != nil {
-				t.Fatal(err)
-			}
-		}
-		if p["id"] == "desk."+OwnRuntimeID() && strings.Contains(p["env"].(map[string]string)[RuntimeToolEnv], ReadsSecretPlaces) {
-			t.Error("a module not holding node-reads is told the node's secret places")
-		}
-	}
-	var places []string
-	if err := json.Unmarshal([]byte(given["reads"][ReadsSecretPlaces]), &places); err != nil {
-		t.Fatalf("the holder is not told its node's secret places: %v (%v)", err, given)
-	}
-	want := []string{"/etc/app/db.secret", "/home/ops/.config/app", "/var/lib/desk", "/var/lib/mesh-reads",
-		"/var/lib/mesh-vault", "/var/lib/mesh/" + RuntimeModule}
-	if strings.Join(places, " ") != strings.Join(want, " ") {
-		t.Errorf("secret places:\n got %v\nwant %v", places, want)
-	}
-}
-
-// The review of #257: a secret place the controller cannot resolve fails the composition, naming the module,
-// rather than leaving the list one place shorter.
-func TestASecretPlaceThatCannotBeResolvedFailsTheComposition(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "app", Version: "1", Keeps: "${dir:keep}/sealed"},
-	}}
-	if _, err := r.secretPlaces(Rendering{}); err == nil || !strings.Contains(err.Error(), "app") {
-		t.Errorf("an unresolved place was dropped: %v", err)
-	}
-	r.Modules[0].Keeps = "relative/place"
-	if _, err := r.secretPlaces(Rendering{}); err == nil {
-		t.Error("a relative place was dropped")
-	}
-}
-
-// ADR 0310 §3: the account that reads is in no group beside its own; one put in a group is refused.
-func TestTheReadsAccountIsInNoGroup(t *testing.T) {
-	m := Manifest{Module: "reads", RunsAs: "mesh-reads", Claims: []Claim{{Name: ReadsSeat}},
-		Resources: []map[string]any{{"id": "account", "type": "user", "name": "mesh-reads", "groups": []any{"docker"}}}}
-	if p := ReadsHolderProblems(m); len(p) != 1 || !strings.Contains(p[0], "docker") {
-		t.Errorf("an account in docker was not refused: %v", p)
-	}
-	m.Resources[0]["groups"] = []any{}
-	if p := ReadsHolderProblems(m); len(p) != 0 {
-		t.Errorf("an account in no group was refused: %v", p)
-	}
-}
diff --git a/internal/catalogue/received_on_the_bus_test.go b/internal/catalogue/received_on_the_bus_test.go
deleted file mode 100644
index 185b10bc..00000000
--- a/internal/catalogue/received_on_the_bus_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"reflect"
-	"testing"
-)
-
-// What a provider receives is composed once, and issued twice: as its received file, and in its
-// membership on the bus (novox/hq ADR 0167). The two are the same list, so a proxy reading the bus
-// and one reading the file serve the same routes — including the port the machine published, which
-// is the same-node fix the file already carries.
-func TestWhatAProviderReceivesIsTheSameOnTheBusAsInItsFile(t *testing.T) {
-	gitea := Manifest{
-		Module: "gitea", Version: "1",
-		Listens:     []Listening{{Port: 3000, Protocol: "tcp", From: FromMesh}},
-		Contributes: map[string]map[string]any{"route": {"label": "git", "port": 3000}},
-		Resources: []map[string]any{{
-			"id": "server", "type": "container", "name": "gitea", "ports": []any{"3000"},
-		}},
-	}
-	r, err := Resolve(shelf(gitea, routeProxy(), stepCA()),
-		[]string{"gitea", "route-proxy", "step-ca"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	composed, err := r.Compose(Rendering{Ports: map[string]map[int]int{"gitea": {3000: 20000}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	file := fileNamed(composed.Resources, "route-proxy.received-route")
-	if file == nil {
-		t.Fatal("the proxy was given no routes file")
-	}
-	var written struct {
-		Given []Contribution `json:"given"`
-	}
-	if err := json.Unmarshal([]byte(file["content"].(string)), &written); err != nil {
-		t.Fatal(err)
-	}
-	issued, said := composed.Received["route-proxy"]["route"]
-	if !said {
-		t.Fatalf("nothing is issued for the proxy to receive on the bus: %v", composed.Received)
-	}
-	// Compared as JSON, which is what both are once they leave the controller.
-	a, _ := json.Marshal(written.Given)
-	b, _ := json.Marshal(issued)
-	var fromFile, fromBus any
-	_ = json.Unmarshal(a, &fromFile)
-	_ = json.Unmarshal(b, &fromBus)
-	if !reflect.DeepEqual(fromFile, fromBus) {
-		t.Errorf("the bus and the file disagree about the routes:\nfile %s\nbus  %s", a, b)
-	}
-	if len(issued) != 1 {
-		t.Fatalf("expected one route on the bus, got %v", issued)
-	}
-	if port, ok := asPort(issued[0].Values["port"]); !ok || port != 20000 {
-		t.Errorf("the bus carries a port nothing listens on: %v", issued[0].Values["port"])
-	}
-
-	// A module that receives nothing is issued nothing to receive.
-	if _, any := composed.Received["gitea"]; any {
-		t.Errorf("a module that receives nothing was issued something: %v", composed.Received["gitea"])
-	}
-}
diff --git a/internal/catalogue/reflects_renamed_test.go b/internal/catalogue/reflects_renamed_test.go
deleted file mode 100644
index e5bee0bd..00000000
--- a/internal/catalogue/reflects_renamed_test.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestReflectsRenamedReadsBothShapes(t *testing.T) {
-	// The list arrives as []any when the resource was parsed from JSON, and as []string when it
-	// was composed in code — the overlay's registry trust is the second kind. A shape that was
-	// skipped would leave the reference unprefixed, pointing at nothing, and the service would
-	// never restart while every check passed (novox/hq issues 042/048, the run-8 diagnosis).
-	parsed := reflectsRenamed("mesh-wireguard", []any{"registry-trust"})
-	if !reflect.DeepEqual(parsed, []any{"mesh-wireguard.registry-trust"}) {
-		t.Fatalf("parsed shape: %v", parsed)
-	}
-	composed := reflectsRenamed("mesh-wireguard", []string{"registry-trust"})
-	if !reflect.DeepEqual(composed, []any{"mesh-wireguard.registry-trust"}) {
-		t.Fatalf("composed shape: %v", composed)
-	}
-
-	// A name already under a module keeps it: that is how a service reflects a file another
-	// module put on the machine.
-	kept := reflectsRenamed("resolver", []string{"mesh-wireguard.fact-node-names", "own-config"})
-	if !reflect.DeepEqual(kept, []any{"mesh-wireguard.fact-node-names", "resolver.own-config"}) {
-		t.Fatalf("dotted name was not kept: %v", kept)
-	}
-
-	if got := reflectsRenamed("any", nil); got != nil {
-		t.Fatalf("no list should rename to nothing, got %v", got)
-	}
-}
diff --git a/internal/catalogue/replaces_test.go b/internal/catalogue/replaces_test.go
deleted file mode 100644
index 4b343205..00000000
--- a/internal/catalogue/replaces_test.go
+++ /dev/null
@@ -1,119 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The verbs an agent works around most say what they replace (novox/hq ADR 0245): the journal, a
-// restart, a unit's status, the hosts file — each the command the agent would otherwise type over ssh.
-func TestTheVerbsWorkedAroundSayWhatTheyReplace(t *testing.T) {
-	want := map[string]string{
-		ServiceManagerSeat + ".journal": "journalctl",
-		ServiceManagerSeat + ".restart": "systemctl restart",
-		ServiceManagerSeat + ".status":  "systemctl status",
-		"node-hostname.add":             "edit /etc/hosts",
-		ControllerSeatName + ".node":    "hostnamectl",
-	}
-	for _, s := range DefaultSeats() {
-		for _, v := range s.Serves {
-			cmd, ok := want[s.Name+"."+v.Name]
-			if !ok {
-				continue
-			}
-			delete(want, s.Name+"."+v.Name)
-			found := false
-			for _, r := range v.Replaces {
-				found = found || r == cmd
-			}
-			if !found {
-				t.Errorf("%s.%s does not say it replaces %q: %v", s.Name, v.Name, cmd, v.Replaces)
-			}
-		}
-	}
-	for verb := range want {
-		t.Errorf("%s is not a verb of the compiled seats", verb)
-	}
-}
-
-// Every command a seat's verb replaces is one short line, said once — what the guard and the search match.
-func TestEveryReplacedCommandIsOneShortLine(t *testing.T) {
-	for _, s := range DefaultSeats() {
-		for _, v := range s.Serves {
-			seen := map[string]bool{}
-			for _, r := range v.Replaces {
-				if strings.TrimSpace(r) == "" || strings.ContainsAny(r, "\n\r") || len(r) > MaxReplaced || seen[r] {
-					t.Errorf("%s.%s replaces %q, which is not one short line said once", s.Name, v.Name, r)
-				}
-				seen[r] = true
-			}
-		}
-	}
-}
-
-// A verb's definition in a manifest may say what it replaces, like the mesh's own.
-func TestAVerbDefinitionCarriesWhatItReplaces(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"till","version":"1","tools":["refund"],` +
-		`"seats":[{"name":"shop-till","serves":[{"name":"refund","replaces":["psql -c refund"]}]}],` +
-		`"claims":[{"name":"shop-till","scope":"mesh"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := m.DefinesSeats[0].Serves[0].Replaces; len(got) != 1 || got[0] != "psql -c refund" {
-		t.Fatalf("replaces not read: %v", got)
-	}
-}
-
-// A module says what its own tools replace, and only for a tool it declares.
-func TestAModuleSaysWhatItsOwnToolsReplace(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"docker","version":"1","tools":["docker_logs","docker_list"],` +
-		`"replaces":{"docker_logs":["docker logs"],"docker_list":["docker ps"]}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.Replaces["docker_logs"][0] != "docker logs" || m.Replaces["docker_list"][0] != "docker ps" {
-		t.Fatalf("replaces not read: %v", m.Replaces)
-	}
-	for _, c := range []struct{ manifest, says string }{
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_lgos":["docker logs"]}}`,
-			"declares no such tool"},
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_logs":[]}}`, "replaces nothing"},
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_logs":[" "]}}`, "empty command"},
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_logs":["docker logs\nrm -rf /"]}}`,
-			"more than one line"},
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_logs":["docker logs","docker logs"]}}`,
-			"twice"},
-		{`{"module":"docker","version":"1","tools":["docker_logs"],"replaces":{"docker_logs":["` + strings.Repeat("x", MaxReplaced+1) + `"]}}`,
-			"longer than"},
-	} {
-		if _, err := ParseManifest([]byte(c.manifest)); err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: want a refusal saying %q, got %v", c.manifest, c.says, err)
-		}
-	}
-}
-
-// A seat row the store seeded before `replaces` existed carries none; the working set takes the compiled
-// one, so the `tools` answer says it on a mesh whose rows exist.
-func TestASeededRowTakesWhatItsVerbsReplaceFromTheCompiledSeat(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	var row Seat
-	for _, s := range DefaultSeats() {
-		if s.Name == ServiceManagerSeat {
-			row = s
-		}
-	}
-	stored := make([]Verb, len(row.Serves))
-	for i, v := range row.Serves {
-		v.Replaces = nil
-		stored[i] = v
-	}
-	row.Serves = stored
-	UseSeats([]Seat{row})
-	got, _ := SeatNamed(ServiceManagerSeat)
-	for _, v := range got.Serves {
-		if v.Name == "journal" && (len(v.Replaces) == 0 || v.Replaces[0] != "journalctl") {
-			t.Fatalf("the seeded journal verb says it replaces %v", v.Replaces)
-		}
-	}
-}
diff --git a/internal/catalogue/replay166_test.go b/internal/catalogue/replay166_test.go
deleted file mode 100644
index 7611666b..00000000
--- a/internal/catalogue/replay166_test.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Replay of novox/hq issue 166: every soft dependency had become a hard requirement. grafana runs without a
-// data source, yet a manifest could not say so: a mesh without influxdb could not register a grafana that
-// said its influxdb-api was optional, and with influxdb only in the catalogue, assigning grafana installed
-// influxdb for it. Written only with what the catalogue had before its fix (mesh-controller #281):
-// ParseManifest, Resolve, and the resolve tests' shelf, reachable machine and names, so it is laid over the
-// commit before.
-func TestReplay166(t *testing.T) {
-	grafana, err := ParseManifest([]byte(`{"module":"grafana","version":"1",
-		"requires":[{"name":"influxdb-api","optional":true}]}`))
-	if err != nil {
-		t.Fatalf("a manifest cannot say grafana runs without influxdb-api: %v", err)
-	}
-	catalogue := shelf(
-		Manifest{Module: "influxdb", Version: "1", Provides: FromAnywhere("influxdb-api")},
-		grafana,
-	)
-	// Nothing in the mesh runs influxdb; it is only in the catalogue.
-	got, err := Resolve(catalogue, []string{"grafana"}, reachable(), World{})
-	if err != nil {
-		t.Fatalf("grafana could not be assigned on a mesh without influxdb: %v", err)
-	}
-	if have := strings.Join(names(got), " "); have != "grafana" {
-		t.Fatalf("assigning grafana put %s on the machine; nothing is installed for an optional requirement", have)
-	}
-	if len(got.Needs) != 0 {
-		t.Fatalf("grafana was given a binding with nothing providing it: %+v", got.Needs)
-	}
-	// And once influxdb runs somewhere, grafana binds to it as before.
-	got, err = Resolve(catalogue, []string{"grafana"}, reachable(), World{Offered: map[string][]Provider{
-		"influxdb-api": {{Node: "anchor", At: "anchor.internal", Module: "influxdb"}}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 || got.Needs[0].From != "anchor" || got.Needs[0].For != "grafana" {
-		t.Fatalf("grafana did not bind to influxdb on anchor: %+v", got.Needs)
-	}
-}
diff --git a/internal/catalogue/replay279_test.go b/internal/catalogue/replay279_test.go
deleted file mode 100644
index c350a4b2..00000000
--- a/internal/catalogue/replay279_test.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package catalogue
-
-import "testing"
-
-// Replay of novox/hq issue 279 (2026-10-06): the media managers' recycle-bin folders were declared owned by
-// a literal user and group, and on a machine whose puid and pgid settings named another account the apps
-// refused them as not writable. A directory's owner could not follow the account its module runs as. Written
-// only with what the catalogue had before its fix (mesh-controller #260): Compose, LeftOut, a setting layer,
-// and the adoption tests' anchor, so it is laid over the commit before.
-func TestReplay279(t *testing.T) {
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, Manifest{Module: "sonarr",
-		Resources: []map[string]any{
-			{"id": "recycle-bin", "type": "directory", "path": "/srv/sonarr/recycle", "mode": "0755",
-				"owner": "${setting:puid}:${setting:pgid}"},
-			{"id": "identity", "type": "file", "path": "/srv/sonarr/identity.env", "mode": "0644",
-				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\n"},
-		},
-	})
-	with := anchorRendering(false)
-	with.Settings["sonarr"] = []Layer{{From: "node anchor", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatalf("the machine did not compose: %v", err)
-	}
-	if why, left := composed.LeftOut["sonarr"]; left {
-		t.Fatalf("the module was left out: %s", why)
-	}
-	got, ok := byID(composed.Resources)["sonarr.recycle-bin"]
-	if !ok {
-		t.Fatal("the recycle bin was not declared")
-	}
-	if got["owner"] != "1001:2000" {
-		t.Fatalf("the recycle bin reaches the node-engine owned by %v, not the account the module runs as (1001:2000)", got["owner"])
-	}
-}
diff --git a/internal/catalogue/replay412_test.go b/internal/catalogue/replay412_test.go
deleted file mode 100644
index 178667d1..00000000
--- a/internal/catalogue/replay412_test.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Replay of novox/hq issue 412 (2026-10-10): which module owns /etc/hosts was enforced only after the fact,
-// when two modules on one machine declared it; a module that did not claim node-hostname could declare
-// /etc/hosts, and a module could claim node-hostname declaring none of its paths, and nothing refused either.
-// Written only with what the catalogue had before its fix (mesh-controller #267): CatalogueProblems, Shelf,
-// SeatNamed and CanHold, so it is laid over the commit before.
-func TestReplay412(t *testing.T) {
-	stranger := Manifest{Module: "stranger", Version: "1", Resources: []map[string]any{
-		{"id": "hosts", "type": "file", "path": "/etc/hosts", "into": "block", "content": "10.0.0.1 x\n"}}}
-	got := strings.Join(CatalogueProblems(Shelf{"stranger": stranger}), "; ")
-	if !strings.Contains(got, "node-hostname") {
-		t.Errorf("a module declaring /etc/hosts without claiming node-hostname was not refused: %q", got)
-	}
-
-	seat, ok := SeatNamed("node-hostname")
-	if !ok {
-		t.Fatal("no node-hostname seat")
-	}
-	holder := Manifest{Module: "names", Version: "1", Claims: []Claim{{Name: "node-hostname", Scope: ScopeNode,
-		Serves: []string{"entries", "add", "remove"}}}}
-	err := CanHold(holder, seat)
-	if err == nil {
-		t.Fatal("a holder of node-hostname declaring neither /etc/hosts nor /etc/hostname was accepted")
-	}
-	for _, want := range []string{"/etc/hosts", "/etc/hostname"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
diff --git a/internal/catalogue/replays_test.go b/internal/catalogue/replays_test.go
deleted file mode 100644
index 3439da3e..00000000
--- a/internal/catalogue/replays_test.go
+++ /dev/null
@@ -1,36 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"testing"
-)
-
-// **R298 — a seat's new verb lands in either repository first** (novox/hq issue 298). On 2026-10-07 the
-// delivery seat gained `checks`: the seat is defined here and held by a module in the catalogue, and
-// neither could merge first — a controller promising the verb refused the holder that did not serve it
-// yet, and a holder serving it was refused by the controller that did not promise it. The outcome
-// asserted: the holder as it was, and the holder serving `checks` too, both hold the delivery seat.
-//
-// Written only with what the catalogue package had before the fix (SeatNamed, VerbNames, CanHold), so the
-// prover can lay it over that commit.
-func TestReplay298ADeliverySeatHolderHoldsBeforeAndAfterItServesChecks(t *testing.T) {
-	seat, ok := SeatNamed(DeliverySeat)
-	if !ok {
-		t.Fatal("the delivery seat is not in the set")
-	}
-	var before []string
-	for _, v := range VerbNames(seat.Serves) {
-		if v != "checks" {
-			before = append(before, v)
-		}
-	}
-	holder := func(serves []string) Manifest {
-		return Manifest{Module: "mesh-delivery", Claims: []Claim{{Name: DeliverySeat, Scope: ScopeMesh, Serves: serves}}}
-	}
-	if err := CanHold(holder(before), seat); err != nil {
-		t.Fatalf("the holder as the catalogue had it, before it serves checks, is refused: %v", err)
-	}
-	if err := CanHold(holder(append(slices.Clone(before), "checks")), seat); err != nil {
-		t.Fatalf("the holder serving checks is refused — the catalogue cannot merge first: %v", err)
-	}
-}
diff --git a/internal/catalogue/resolve_keeps_references_test.go b/internal/catalogue/resolve_keeps_references_test.go
deleted file mode 100644
index 24eb07c2..00000000
--- a/internal/catalogue/resolve_keeps_references_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A resolved manifest keeps a built artifact's reference in the store-relative form, never the
-// address the builder reached the store by (novox/hq ADR 0155): on 2026-10-02 the first bundle
-// resolved on the mesh carried the store's host in bundles[0].source and registration refused it
-// as naming an installation. Archive resources are the same kind of reference and get the same.
-func TestAResolvedReferenceIsKeptNotRouted(t *testing.T) {
-	m, err := ParseManifest([]byte(`{
-	  "module": "sample", "version": "1",
-	  "tools": ["one"],
-	  "build": {"artifacts": [
-	    {"name": "code", "kind": "bundle", "language": "typescript", "entrypoints": ["tools/index.js"]},
-	    {"name": "files", "kind": "archive", "from": "files"}
-	  ]},
-	  "resources": [{"id": "packed", "type": "archive", "path": "/opt/sample", "artifact": "files"}]
-	}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest := "sha256:" + strings.Repeat("ab", 32)
-	resolved, err := m.Resolve([]Built{
-		{Name: "code", Kind: ArtifactBundle, Reference: "http://store.example:5100/v2/sample/code/blobs/" + digest, Digest: digest},
-		{Name: "files", Kind: ArtifactArchive, Reference: "http://store.example:5100/v2/sample/files/blobs/" + digest, Digest: digest},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := resolved.Bundles[0].Source, ArtifactStoreScheme+"sample/code/blobs/"+digest; got != want {
-		t.Errorf("bundle source %q, want the kept form %q", got, want)
-	}
-	if got, want := resolved.Resources[0]["source"], ArtifactStoreScheme+"sample/files/blobs/"+digest; got != want {
-		t.Errorf("archive source %q, want the kept form %q", got, want)
-	}
-	if problems := InstallationProblems(resolved); len(problems) != 0 {
-		t.Errorf("a resolved manifest names an installation: %v", problems)
-	}
-}
diff --git a/internal/catalogue/resolve_loopback_test.go b/internal/catalogue/resolve_loopback_test.go
deleted file mode 100644
index d9ca22cc..00000000
--- a/internal/catalogue/resolve_loopback_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package catalogue
-
-import "testing"
-
-// A MESH-SCOPED provider on the consumer's own node must deliver a usable address too.
-//
-// The sibling case — a node-scoped provider minting no credential — has had this fallback and a
-// test for it for some time. This branch did not, and the difference is invisible until something
-// puts the address into a string: the mesh's own artifact store is mesh-scoped and lives on the
-// same machine as the builder that pushes to it, so the builder's environment was written as
-// `MESH_REGISTRY=:5000`. Nothing refused it. The runtime did, several steps later, with
-// `":5000/mesh-tools/build" is not a valid repository/tag` — a message about a tag, for a fault in
-// how a binding was resolved.
-//
-// A machine off the private network still reaches itself.
-func TestAMeshScopedProviderOnThisNodeStillCarriesAnAddress(t *testing.T) {
-	provider := Manifest{Module: "registry",
-		Provides: []Offer{{Name: "artifact-store", Scope: ScopeMesh}},
-		Serves: map[string]map[string]any{
-			"artifact-store": {"port": 5000}}}
-	consumer := Manifest{Module: "builder", Requires: []string{"artifact-store"}}
-
-	// No `At`: a mesh with no private network raised, which is every mesh before somebody places
-	// its nodes on one — including the moment just after it is installed.
-	got, err := Resolve(
-		map[string]Manifest{"registry": provider, "builder": consumer},
-		[]string{"builder", "registry"},
-		Node{Name: "anchor"},
-		World{})
-	if err != nil {
-		t.Fatalf("a mesh-scoped provision answered on this very node was refused: %v", err)
-	}
-
-	var found *Needed
-	for i := range got.Needs {
-		if got.Needs[i].Name == "artifact-store" && got.Needs[i].For == "builder" {
-			found = &got.Needs[i]
-		}
-	}
-	if found == nil {
-		t.Fatalf("the store was not delivered to the builder at all: %+v", got.Needs)
-	}
-	if found.At == "" {
-		t.Fatalf("the binding carries no address, so anything composing a host from it gets none: %+v", found)
-	}
-	if found.At != "127.0.0.1" {
-		t.Fatalf("off the private network the address must fall back to loopback, got %q", found.At)
-	}
-	if got, want := plainly(found.Serves["port"]), "5000"; got != want {
-		t.Fatalf("the port was not delivered: got %q want %q", got, want)
-	}
-}
diff --git a/internal/catalogue/resolve_test.go b/internal/catalogue/resolve_test.go
deleted file mode 100644
index 54b1e100..00000000
--- a/internal/catalogue/resolve_test.go
+++ /dev/null
@@ -1,509 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func mod(name string, provides, requires, capabilities []string, claims ...Claim) Manifest {
-	return Manifest{Module: name, Provides: Offers(provides...), Requires: requires,
-		Capabilities: capabilities, Claims: claims}
-}
-
-func shelf(ms ...Manifest) map[string]Manifest {
-	out := map[string]Manifest{}
-	for _, m := range ms {
-		out[m.Module] = m
-	}
-	return out
-}
-
-func workstation() Node {
-	return Node{Name: "workstation", Site: "house",
-		Capabilities: map[string]bool{"seat": true, "container-runtime": true}}
-}
-
-func names(r Resolution) []string {
-	var out []string
-	for _, m := range r.Modules {
-		out = append(out, m.Module)
-	}
-	return out
-}
-
-func TestARequirementWithOneAnswerIsTakenSilently(t *testing.T) {
-	// `install i3` should bring in xorg without asking anybody anything, because there was no
-	// choice to make. This is what keeps the refusing rule from being tiresome.
-	got, err := Resolve(shelf(
-		mod("i3", nil, []string{"xorg"}, []string{"seat"}),
-		mod("xorg", []string{"display-server"}, nil, []string{"seat"}, Claim{Name: "the-seat"}),
-	), []string{"i3"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Modules) != 2 {
-		t.Fatalf("resolved %v; i3 should have brought xorg with it", names(got))
-	}
-	if got.Because["xorg"] == "assigned" {
-		t.Error("xorg is recorded as assigned; it was required")
-	}
-}
-
-func TestARequirementWithSeveralAnswersIsRefusedAndNamed(t *testing.T) {
-	// The mesh does not pick. A default would be a choice made for somebody who finds out later,
-	// and naming the candidates is the whole remedy.
-	_, err := Resolve(shelf(
-		mod("editor", nil, []string{"shell"}, nil),
-		mod("bash", []string{"shell"}, nil, nil),
-		mod("zsh", []string{"shell"}, nil, nil),
-		mod("fish", []string{"shell"}, nil, nil),
-	), []string{"editor"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("a requirement with three answers was resolved without asking")
-	}
-	for _, want := range []string{"bash", "fish", "zsh", "choose one"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not mention %q: %v", want, err)
-		}
-	}
-}
-
-func TestARequirementWithNoAnswerIsRefused(t *testing.T) {
-	_, err := Resolve(shelf(mod("i3", nil, []string{"xorg"}, nil)), []string{"i3"}, workstation(), World{})
-
-	if err == nil || !strings.Contains(err.Error(), "nothing provides") {
-		t.Fatalf("a requirement nothing satisfies gave %v", err)
-	}
-}
-
-func TestSeveralModulesMayProvideTheSameThingAndCoexist(t *testing.T) {
-	// Shells. Nothing is claimed, so any number may be assigned — which is the case that made
-	// "flavor" look necessary and turns out to need nothing at all.
-	got, err := Resolve(shelf(
-		mod("bash", []string{"shell"}, nil, nil),
-		mod("zsh", []string{"shell"}, nil, nil),
-		mod("fish", []string{"shell"}, nil, nil),
-	), []string{"bash", "zsh", "fish"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatalf("three shells could not coexist: %v", err)
-	}
-	if len(got.Modules) != 3 {
-		t.Errorf("resolved %v", names(got))
-	}
-}
-
-func TestTwoModulesClaimingOneThingAreRefused(t *testing.T) {
-	// xorg and wayland. Neither knows the other exists — the refusal comes from both claiming
-	// the seat, which is what lets a third display server be added without editing either.
-	_, err := Resolve(shelf(
-		mod("xorg", []string{"display-server"}, nil, nil, Claim{Name: "the-seat"}),
-		mod("wayland", []string{"display-server"}, nil, nil, Claim{Name: "the-seat"}),
-	), []string{"xorg", "wayland"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("two modules claiming the seat were both assigned")
-	}
-	if !strings.Contains(err.Error(), "the-seat") || !strings.Contains(err.Error(), "per node") {
-		t.Errorf("the refusal does not say what was claimed or how widely: %v", err)
-	}
-}
-
-func TestAThirdModuleNeedsNoChangeToTheOthers(t *testing.T) {
-	// The property claims exist for. A third display server says what it claims and nothing else
-	// in the catalogue is touched — where pairwise exclusion would need xorg and wayland edited
-	// to know about it, and the edits would grow as the square of the count.
-	catalogue := shelf(
-		mod("xorg", []string{"display-server"}, nil, nil, Claim{Name: "the-seat"}),
-		mod("wayland", []string{"display-server"}, nil, nil, Claim{Name: "the-seat"}),
-		mod("mir", []string{"display-server"}, nil, nil, Claim{Name: "the-seat"}),
-	)
-	for _, pair := range [][]string{{"xorg", "mir"}, {"wayland", "mir"}} {
-		if _, err := Resolve(catalogue, pair, workstation(), World{}); err == nil {
-			t.Errorf("%v were both assigned", pair)
-		}
-	}
-	if _, err := Resolve(catalogue, []string{"mir"}, workstation(), World{}); err != nil {
-		t.Errorf("the newcomer alone was refused: %v", err)
-	}
-}
-
-func TestADirectlyAssignedModuleTheMachineCannotHostIsReportedNotRefused(t *testing.T) {
-	// A person put a display server on a seatless machine. The remedy differs from a missing module
-	// and the message has to say which — nothing can be installed to give a server a seat. But it is
-	// one module on the wrong machine, not a reason the whole node fails to resolve: it is kept out
-	// of what the node runs and reported as un-applied, so the healthy modules beside it still
-	// converge.
-	server := Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
-	got, err := Resolve(shelf(mod("xorg", nil, nil, []string{"seat"}, Claim{Name: "the-seat"})), []string{"xorg"}, server, World{})
-
-	if err != nil {
-		t.Fatalf("one un-hostable assignment refused the whole node: %v", err)
-	}
-	if len(got.Modules) != 0 {
-		t.Errorf("xorg was declared on a machine that cannot run it: %v", names(got))
-	}
-	if len(got.Unhostable) != 1 || got.Unhostable[0].Module != "xorg" {
-		t.Fatalf("xorg was not reported as un-applied: %+v", got.Unhostable)
-	}
-	if len(got.Unhostable[0].Missing) != 1 || got.Unhostable[0].Missing[0] != "seat" {
-		t.Errorf("the missing capability was not named: %+v", got.Unhostable[0])
-	}
-	if !strings.Contains(WrongMachine("xorg", "seat", "server"), "wrong machine") {
-		t.Errorf("the report reads like a missing module")
-	}
-}
-
-func TestAnUnhostableModuleSomethingRequiresRefusesTheNode(t *testing.T) {
-	// The other side of the distinction. A module the machine cannot host that is *required* by
-	// something running here makes the set incoherent: the requiring module cannot have its
-	// requirement met on this machine, so it is refused rather than quietly declared without it.
-	server := Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
-	_, err := Resolve(shelf(
-		mod("desktop", nil, []string{"display-server"}, nil),
-		mod("xorg", []string{"display-server"}, nil, []string{"seat"}),
-	), []string{"desktop"}, server, World{})
-
-	if err == nil {
-		t.Fatal("a node requiring a module the machine cannot host was resolved")
-	}
-	if !strings.Contains(err.Error(), "wrong machine") {
-		t.Errorf("the refusal reads like a missing module: %v", err)
-	}
-}
-
-func TestOneUnhostableAssignmentDoesNotTakeDownTheHealthyModules(t *testing.T) {
-	// The bug the whole-mesh dry-run found: fail2ban declares a capability the host lacks, and its
-	// one un-hostable assignment refused the entire node's resolution — so a push refused to send
-	// the healthy modules beside it too. The healthy modules must still resolve and converge; the
-	// un-hostable one is reported as un-applied, neither silently dropped nor fatal to the rest.
-	server := Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
-	got, err := Resolve(shelf(
-		mod("web", nil, nil, nil),
-		mod("cache", nil, nil, nil),
-		mod("cron", nil, nil, nil),
-		// The one on the wrong machine: it needs a firewall the machine's profile does not report.
-		mod("fail2ban", nil, nil, []string{"firewall"}),
-	), []string{"web", "cache", "cron", "fail2ban"}, server, World{})
-
-	if err != nil {
-		t.Fatalf("one un-hostable assignment refused the whole node: %v", err)
-	}
-	// The healthy three resolved.
-	if got := names(got); len(got) != 3 {
-		t.Fatalf("the healthy modules did not all resolve: %v", got)
-	}
-	for _, m := range got.Modules {
-		if m.Module == "fail2ban" {
-			t.Error("fail2ban was declared on a machine that cannot run it")
-		}
-	}
-	// The un-hostable one is reported, not silently dropped.
-	if len(got.Unhostable) != 1 || got.Unhostable[0].Module != "fail2ban" {
-		t.Fatalf("fail2ban was not reported as un-applied: %+v", got.Unhostable)
-	}
-	if len(got.Unhostable[0].Missing) != 1 || got.Unhostable[0].Missing[0] != "firewall" {
-		t.Errorf("the missing capability was not named: %+v", got.Unhostable[0])
-	}
-}
-
-func TestAMeshWideClaimIsHeldByOneNode(t *testing.T) {
-	// The hub, said as a claim rather than hard-coded. Another node already holds it, so this one
-	// cannot.
-	_, err := Resolve(shelf(mod("hub", nil, nil, nil, Claim{Name: "the-hub", Scope: ScopeMesh})),
-		[]string{"hub"}, workstation(),
-		World{Held: []Held{{Claim: "the-hub", Scope: ScopeMesh, Node: "anchor", Module: "hub"}}})
-	if err == nil {
-		t.Fatal("two nodes both hold a mesh-wide claim")
-	}
-	if !strings.Contains(err.Error(), "anchor") || !strings.Contains(err.Error(), "one per mesh") {
-		t.Errorf("the refusal does not say who holds it: %v", err)
-	}
-}
-
-func TestAFoundationModuleCannotBeRaisedOnASecondNode(t *testing.T) {
-	// novox/hq 04-ISSUES/056. The store and broker are adopted in place on the control-node; each
-	// foundation module claims a mesh-scoped seat named after its server — the same mechanism that
-	// keeps one controller — so a second `assign` to another node is refused rather than silently
-	// raising a second postgres or broker that holds none of the first's data.
-	for _, tc := range []struct{ module, seat string }{
-		{"postgres", "mesh-store"},
-		{"lavinmq", "mesh-broker"},
-		{"mesh-controller", "mesh-controller"},
-	} {
-		_, err := Resolve(
-			shelf(mod(tc.module, nil, nil, nil, Claim{Name: tc.seat, Scope: ScopeMesh})),
-			[]string{tc.module}, workstation(),
-			World{Held: []Held{{Claim: tc.seat, Scope: ScopeMesh, Node: "anchor", Module: tc.module}}})
-		if err == nil {
-			t.Fatalf("%s was raised on a second node though %s is a mesh-wide seat", tc.module, tc.seat)
-		}
-		if !strings.Contains(err.Error(), "one per mesh") {
-			t.Errorf("%s: the refusal does not say it is one per mesh: %v", tc.module, err)
-		}
-	}
-}
-
-func TestASiteClaimOnlyCollidesWithinThatSite(t *testing.T) {
-	// A DHCP server per segment. Two of them is a fault at one site and perfectly ordinary
-	// across two, and treating site as mesh would forbid the ordinary case.
-	catalogue := shelf(mod("dhcp", nil, nil, nil, Claim{Name: "dhcp", Scope: ScopeSite}))
-
-	elsewhere := []Held{{Claim: "dhcp", Scope: ScopeSite, Node: "other", Module: "dhcp", Site: "house"}}
-	if _, err := Resolve(catalogue, []string{"dhcp"}, workstation(), World{Held: elsewhere}); err == nil {
-		t.Error("two DHCP servers at one site were allowed")
-	}
-
-	faraway := []Held{{Claim: "dhcp", Scope: ScopeSite, Node: "other", Module: "dhcp", Site: "office"}}
-	if _, err := Resolve(catalogue, []string{"dhcp"}, workstation(), World{Held: faraway}); err != nil {
-		t.Errorf("a DHCP server at another site was treated as a collision: %v", err)
-	}
-}
-
-func TestTwoModulesWritingOneFileAreRefusedWithoutAnyClaim(t *testing.T) {
-	// This conflict costs no manifest field: the mesh already holds every resource of every
-	// module, so two declaring one path are visible without either knowing the other exists.
-	a := mod("a", nil, nil, nil)
-	a.Resources = []map[string]any{{"id": "conf", "type": "file", "path": "/etc/thing.conf"}}
-	b := mod("b", nil, nil, nil)
-	b.Resources = []map[string]any{{"id": "conf", "type": "file", "path": "/etc/thing.conf"}}
-
-	_, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), World{})
-	if err == nil {
-		t.Fatal("two modules writing the same file were both assigned")
-	}
-	if !strings.Contains(err.Error(), "/etc/thing.conf") {
-		t.Errorf("the refusal does not name the file: %v", err)
-	}
-}
-
-func TestResourceIdentitiesCarryTheirModule(t *testing.T) {
-	// Two modules may reasonably both call something "config". Without the prefix the second
-	// would silently replace the first, and the node would apply one of them and report success.
-	a := mod("a", nil, nil, nil)
-	a.Resources = []map[string]any{{"id": "config", "type": "file", "path": "/etc/a"}}
-	b := mod("b", nil, nil, nil)
-	b.Resources = []map[string]any{{"id": "config", "type": "file", "path": "/etc/b"}}
-
-	got, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	seen := map[string]bool{}
-	for _, r := range mustDeclare(t, got) {
-		id := r["id"].(string)
-		if seen[id] {
-			t.Errorf("two resources share the identity %q", id)
-		}
-		seen[id] = true
-	}
-	if !seen["a.config"] || !seen["b.config"] {
-		t.Errorf("identities are not qualified by module: %v", seen)
-	}
-}
-
-func TestWhatAServiceReflectsIsQualifiedToo(t *testing.T) {
-	// Otherwise it names a resource that no longer exists under that identity, and the service
-	// quietly stops being restarted when its own configuration changes.
-	m := mod("thing", nil, nil, nil)
-	m.Resources = []map[string]any{
-		{"id": "conf", "type": "file", "path": "/etc/thing.conf"},
-		{"id": "svc", "type": "service", "unit": "thing.service", "state": "running",
-			"restart-on": []any{"conf"}},
-	}
-	got, err := Resolve(shelf(m), []string{"thing"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range mustDeclare(t, got) {
-		if r["id"] == "thing.svc" {
-			if got := fmt.Sprint(r["restart-on"]); got != "[thing.conf]" {
-				t.Errorf("a service reflects %s, which is not a resource in the declaration", got)
-			}
-			return
-		}
-	}
-	t.Error("the service is missing from the declaration")
-}
-
-func TestEveryReasonIsGivenAtOnce(t *testing.T) {
-	// Somebody resolving these fixes them in one pass or in three. Every reason that genuinely
-	// refuses the set is collected, rather than only the first: a claim two modules both take, a
-	// requirement nothing answers, and a requirement several answer without anybody choosing.
-	_, err := Resolve(shelf(
-		mod("xorg", nil, nil, nil, Claim{Name: "the-seat"}),
-		mod("wayland", nil, nil, nil, Claim{Name: "the-seat"}),
-		mod("i3", nil, []string{"compositor"}, nil),
-		mod("editor", nil, []string{"shell"}, nil),
-		mod("bash", []string{"shell"}, nil, nil),
-		mod("zsh", []string{"shell"}, nil, nil),
-	), []string{"xorg", "wayland", "i3", "editor"}, workstation(), World{})
-
-	if err == nil {
-		t.Fatal("expected refusals")
-	}
-	if strings.Count(err.Error(), "\n  - ") < 3 {
-		t.Errorf("only some problems were reported:\n%v", err)
-	}
-}
-
-func TestACycleStopsRatherThanRunsAway(t *testing.T) {
-	// Two modules requiring each other is a mistake somebody makes, and it must produce an answer
-	// rather than a stack overflow.
-	got, err := Resolve(shelf(
-		mod("a", nil, []string{"b"}, nil),
-		mod("b", nil, []string{"a"}, nil),
-	), []string{"a"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Modules) != 2 {
-		t.Errorf("a cycle resolved to %v", names(got))
-	}
-}
-
-func TestChoosingOneSatisfiesTheRequirement(t *testing.T) {
-	// The other half of refusing. "Choose one and assign it" has to actually work, or the remedy
-	// names three modules and then ignores the one you pick — which is how this read the first
-	// time it was used on a real mesh.
-	got, err := Resolve(shelf(
-		mod("editor", nil, []string{"shell"}, nil),
-		mod("bash", []string{"shell"}, nil, nil),
-		mod("zsh", []string{"shell"}, nil, nil),
-		mod("fish", []string{"shell"}, nil, nil),
-	), []string{"editor", "zsh"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatalf("choosing a shell did not satisfy the requirement for one: %v", err)
-	}
-	if len(got.Modules) != 2 {
-		t.Errorf("resolved %v; only the chosen shell should have come in", names(got))
-	}
-}
-
-func TestChoosingSeveralIsStillFine(t *testing.T) {
-	// And the choice is not exclusive. Nothing is claimed, so a person may have all three and
-	// the requirement is answered by whichever they picked.
-	got, err := Resolve(shelf(
-		mod("editor", nil, []string{"shell"}, nil),
-		mod("bash", []string{"shell"}, nil, nil),
-		mod("zsh", []string{"shell"}, nil, nil),
-		mod("fish", []string{"shell"}, nil, nil),
-	), []string{"editor", "zsh", "bash", "fish"}, workstation(), World{})
-
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Modules) != 4 {
-		t.Errorf("resolved %v", names(got))
-	}
-}
-
-func TestARequirementNamingAModuleMeansThatModule(t *testing.T) {
-	// i3 requires xorg and means xorg, not "anything calling itself a display server". Otherwise
-	// assigning wayland would silently satisfy i3 and the machine would come up with a window
-	// manager talking to nothing.
-	_, err := Resolve(shelf(
-		mod("i3", nil, []string{"xorg"}, nil),
-		mod("xorg", []string{"display-server"}, nil, nil),
-		mod("wayland", []string{"display-server", "xorg"}, nil, nil),
-	), []string{"i3", "wayland"}, workstation(), World{})
-
-	// wayland claiming to provide "xorg" is a manifest saying something untrue; what matters is
-	// that a real xorg module still wins when it exists, and that the answer is not silent.
-	if err != nil && !strings.Contains(err.Error(), "xorg") {
-		t.Errorf("unexpected refusal: %v", err)
-	}
-}
-
-func mustDeclare(t *testing.T, r Resolution) []map[string]any {
-	t.Helper()
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-// A requirement answered on the same machine is still a requirement (novox/hq 04-ISSUES/021).
-//
-// **The machine stops being a trust boundary once both ends are containers.** A consumer reaches
-// its provider over TCP from its own container, and the database asks for a password exactly as it
-// would from another machine. Before this, two such modules resolved cleanly with zero needs: no
-// credential was made, the consumer's secret file was never written, and whatever read it failed
-// somewhere else entirely.
-//
-// It went unnoticed because everything proven until then was cross-machine, which is the
-// interesting case for a mesh and the rare one in practice.
-func TestSomethingAnsweredOnThisMachineIsStillANeed(t *testing.T) {
-	provider := Manifest{
-		Module: "postgres", Version: "1",
-		Provides: FromAnywhere("postgres-database"),
-		Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
-		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
-	}
-	consumer := Manifest{
-		Module: "keycloak", Version: "1",
-		Requires: []string{"postgres-database"},
-		Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/database.env"},
-	}
-	got, err := Resolve(shelf(provider, consumer), []string{"postgres", "keycloak"},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 {
-		t.Fatalf("%d need(s); a consumer of a brokered provision needs a credential wherever "+
-			"the provider is", len(got.Needs))
-	}
-	if got.Needs[0].From != "anchor" {
-		t.Errorf("the need names %q as the provider, and it is this machine", got.Needs[0].From)
-	}
-	// And it carries what the provider says a consumer must know, which a local provider never
-	// contributes through the world.
-	if got.Needs[0].Serves["port"] != 5432 {
-		t.Errorf("the need carries %v, and the provider serves port 5432", got.Needs[0].Serves)
-	}
-}
-
-// A name nothing grants is unchanged: answered here means answered, and nothing more is owed.
-func TestSomethingOrdinaryAnsweredHereNeedsNothing(t *testing.T) {
-	got, err := Resolve(shelf(
-		mod("zsh", []string{"shell"}, nil, nil),
-		mod("editor-user", nil, []string{"shell"}, nil),
-	), []string{"zsh", "editor-user"},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 0 {
-		t.Fatalf("a shell answered on this machine produced %d need(s)", len(got.Needs))
-	}
-}
-
-func TestTheControllersOwnManifestClaimsItsSeat(t *testing.T) {
-	// The seat test above fabricates manifests, so deleting the claim from the real module.json
-	// would fail nothing (novox/hq issue 059's review). This binds the one manifest this
-	// repository owns: the controller claims the mesh-scoped seat named after its server
-	// (ADR 0079), or the one-controller property is convention again.
-	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
-	if err != nil {
-		t.Fatalf("the controller's own manifest is unreadable: %v", err)
-	}
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the controller's own manifest does not parse: %v", err)
-	}
-	for _, c := range m.Claims {
-		if c.Name == "mesh-controller" && c.At() == ScopeMesh {
-			return
-		}
-	}
-	t.Fatalf("module.json no longer claims the mesh-scoped mesh-controller seat: %+v", m.Claims)
-}
diff --git a/internal/catalogue/resolved_path_test.go b/internal/catalogue/resolved_path_test.go
deleted file mode 100644
index 55b5519e..00000000
--- a/internal/catalogue/resolved_path_test.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package catalogue
-
-// A definition's directories and files are judged at their resolved paths when the definition is (novox/hq issue
-// 496). mesh-catalog #205 gave docker's `state` directory `"place": "."`, which resolves to <root>/docker —
-// /var/lib/docker, every container's filesystem. The merge gate composed every machine and passed it; only the
-// node-engine refused it, at apply, and failed the walk. ParseManifest is what `module check`, registration and the
-// merge gate's reading of a changed repository all run, so a refusal here is a refusal at each of them.
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestADirectoryPlacedInDockersDataIsRefusedWhereTheDefinitionIsJudged(t *testing.T) {
-	// The #205 shape, as it was merged.
-	_, err := ParseManifest([]byte(`{"module": "docker", "version": "1",
-		"resources": [{"id": "state", "type": "directory", "place": "."}]}`))
-	if err == nil {
-		t.Fatal("a directory resolving to /var/lib/docker was accepted; the node-engine refuses it at apply")
-	}
-	for _, said := range []string{"docker", `"state"`, "/var/lib/docker", "issue 496"} {
-		if !strings.Contains(err.Error(), said) {
-			t.Errorf("the refusal names the module, the resource, the path and why; %q is missing from %q", said, err)
-		}
-	}
-}
-
-func TestTheMeshsPlaceForDockerIsAccepted(t *testing.T) {
-	// The fix #205 needed: the mesh's own directory for the module, <root>/mesh/docker.
-	m, err := ParseManifest([]byte(`{"module": "docker", "version": "1", "resources": [
-		{"id": "state", "type": "directory", "place": "mesh"},
-		{"id": "marker", "type": "file", "path": "${dir:state}/applied", "content": "x"}]}`))
-	if err != nil {
-		t.Fatalf("place %q is in the mesh's tree, where the mesh writes for every module: %v", "mesh", err)
-	}
-	if got := dirsFor(m, Rendering{}); got["state"] != "/var/lib/mesh/docker" {
-		t.Fatalf("got %v", got)
-	}
-}
-
-// The node-engine's rules, for directories and — as the engine judges them since novox/hq issue 495 — files.
-func TestADefinitionIsRefusedWhereTheNodeEngineRefusesItsPaths(t *testing.T) {
-	refused := map[string]string{
-		"a stated directory in docker's data": `{"module": "sidecar", "version": "1", "resources": [
-			{"id": "volumes", "type": "directory", "path": "/var/lib/docker/volumes/x"}]}`,
-		"a file in containerd's data": `{"module": "images", "version": "1", "resources": [
-			{"id": "f", "type": "file", "path": "/var/lib/containerd/x", "content": "x"}]}`,
-		"a file beneath a placed directory that climbs out of it": `{"module": "docker", "version": "1", "resources": [
-			{"id": "state", "type": "directory", "place": "mesh"},
-			{"id": "f", "type": "file", "path": "${dir:state}/../../containers/x", "content": "x"}]}`,
-		"a file in /boot": `{"module": "grub", "version": "1", "resources": [
-			{"id": "cfg", "type": "file", "path": "/boot/grub/custom.cfg", "content": "x"}]}`,
-		"a directory that is the mesh's whole tree": `{"module": "mesh", "version": "1", "resources": [
-			{"id": "all", "type": "directory", "place": "."}]}`,
-		"a directory that holds /etc": `{"module": "x", "version": "1", "resources": [
-			{"id": "d", "type": "directory", "path": "/"}]}`,
-		"a directory in the node-engine's own tree, by another module": `{"module": "intruder", "version": "1",
-			"resources": [{"id": "d", "type": "directory", "path": "/var/lib/mesh-host/x"}]}`,
-	}
-	for name, raw := range refused {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "issue 496") {
-			t.Errorf("%s: accepted, or refused for another reason: %v", name, err)
-		}
-	}
-
-	// What the engine applies, the mesh's own modules' paths among them (read from every machine's live plan):
-	// the machine's configuration, run directories, programs below /usr/local, the node-engine's own trees by its
-	// own module, an account's keys, a module's own root, and — not on the engine's lists, so not refused here —
-	// below /lib and at /storage, /data, /services and /var/lock.
-	accepted := map[string]string{
-		"a unit in /etc": `{"module": "power", "version": "1", "resources": [
-			{"id": "d", "type": "directory", "path": "/etc/systemd/system/x.service.d"},
-			{"id": "u", "type": "file", "path": "/etc/systemd/system/x.service.d/a.conf", "content": "x"}]}`,
-		"a run directory": `{"module": "fail2ban", "version": "1", "resources": [
-			{"id": "run-dir", "type": "directory", "path": "/var/run/fail2ban"}]}`,
-		"a program in /usr/local/bin": `{"module": "claude-code", "version": "1", "resources": [
-			{"id": "start", "type": "file", "path": "/usr/local/bin/claude-agent", "content": "x"}]}`,
-		"the node-engine's launcher and state, by the node-engine": `{"module": "mesh-host", "version": "1", "resources": [
-			{"id": "launcher", "type": "file", "path": "/usr/lib/nox-mesh-host/launch", "content": "x"},
-			{"id": "state", "type": "directory", "path": "/var/lib/mesh-host"}]}`,
-		"an account's .ssh": `{"module": "ssh-client", "version": "1", "resources": [
-			{"id": "ssh-dir", "type": "directory", "path": "/home/someone/.ssh"},
-			{"id": "config", "type": "file", "path": "/home/someone/.ssh/config", "content": "x"}]}`,
-		"a module's own root": `{"module": "mailu", "version": "1", "resources": [
-			{"id": "state", "type": "directory", "place": "."}]}`,
-		"a file below /lib": `{"module": "udev", "version": "1", "resources": [
-			{"id": "rule", "type": "file", "path": "/lib/udev/rules.d/99-x.rules", "content": "x"}]}`,
-		"directories at /storage, /data, /services and /var/lock": `{"module": "roots", "version": "1", "resources": [
-			{"id": "a", "type": "directory", "path": "/storage"}, {"id": "b", "type": "directory", "path": "/data"},
-			{"id": "c", "type": "directory", "path": "/services"}, {"id": "d", "type": "directory", "path": "/var/lock"}]}`,
-	}
-	for name, raw := range accepted {
-		if _, err := ParseManifest([]byte(raw)); err != nil {
-			t.Errorf("%s: refused: %v", name, err)
-		}
-	}
-}
-
-func TestAPathThroughAnAccessIsJudgedWithTheAccessFilledIn(t *testing.T) {
-	// A file's path may name an access; the access's default path is the definition's, so it is judged with it.
-	_, err := ParseManifest([]byte(`{"module": "backup", "version": "1",
-		"accesses": [{"id": "images", "path": "/var/lib/docker/volumes"}],
-		"resources": [{"id": "marker", "type": "file", "path": "${access:images}/marker", "content": "x"}]}`))
-	if err == nil || !strings.Contains(err.Error(), "/var/lib/docker/volumes/marker") ||
-		!strings.Contains(err.Error(), "issue 496") {
-		t.Fatalf("a file reaching Docker's data through an access's default path was accepted: %v", err)
-	}
-	// An access the definition gives no path is placed by a setting, which Places and AccessPlaces judge, and on
-	// the machine by the node-engine: nothing here to resolve it against, so nothing is refused for it.
-	if _, err := ParseManifest([]byte(`{"module": "backup", "version": "1",
-		"accesses": [{"id": "images"}],
-		"resources": [{"id": "marker", "type": "file", "path": "${access:images}/marker", "content": "x"}]}`)); err != nil {
-		t.Fatalf("an access placed only by a setting cannot be judged at the definition: %v", err)
-	}
-}
-
-func TestComposingAMachineIsNeverStoppedByOneModulesPath(t *testing.T) {
-	// A module registered from outside the catalogue never passes the gate. Refusing its path while a machine's
-	// declaration is composed would fail the whole declaration and freeze every module on that machine; the
-	// node-engine fails only the one resource. So composition leaves it to the engine.
-	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
-		{"id": "state", "type": "directory", "place": "."},
-	}}
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{m}}).Declaration(Rendering{}); err != nil {
-		t.Fatalf("the machine's declaration failed for one module's path: %v", err)
-	}
-}
diff --git a/internal/catalogue/resolver_file_is_the_uplinks_test.go b/internal/catalogue/resolver_file_is_the_uplinks_test.go
deleted file mode 100644
index dc2de447..00000000
--- a/internal/catalogue/resolver_file_is_the_uplinks_test.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"testing"
-)
-
-// novox/hq ADR 0223 part 2: /etc/resolv.conf belongs to the module holding node-uplink. The seat that
-// wrote it, node-resolver-config, and ADR 0220's dependency of it on the uplink retire: one owner for
-// the file, and it is the program that would otherwise rewrite it.
-
-func TestTheResolverConfigSeatIsGone(t *testing.T) {
-	if _, known := SeatNamed("node-resolver-config"); known {
-		t.Error("node-resolver-config is still in the mesh's set; the uplink's holder writes the resolver file")
-	}
-	// An uplink's holder needs no seat beside it for the file: it is its own.
-	if got := DependsOn(nil, mod("networkmanager", nil, nil, nil, Claim{Name: "node-uplink"})); len(got) != 0 {
-		t.Errorf("an uplink holder with nothing declared depends on %v", got)
-	}
-}
-
-// The catalogue as it is: nothing claims the retired seat, and every manager the mesh knows holds the
-// uplink and writes the resolver file; beside them only a holder of node-resolver does (ADR 0247).
-func TestTheCataloguesUplinksWriteTheResolverFileAndNothingElseDoes(t *testing.T) {
-	cat := map[string]Manifest{}
-	for _, m := range theCatalogue(t) {
-		cat[m.Module] = m
-	}
-	if got := PossibleHolders(cat, "node-uplink"); !reflect.DeepEqual(got, uplinks) {
-		t.Errorf("node-uplink can be held by %v, not %v", got, uplinks)
-	}
-	for name, m := range cat {
-		for _, c := range m.Claims {
-			if c.Name == "node-resolver-config" {
-				t.Errorf("%s still claims node-resolver-config", name)
-			}
-		}
-		_, writes := m.Facts["resolvers"]
-		isUplink := false
-		for _, u := range uplinks {
-			isUplink = isUplink || u == name
-		}
-		for _, f := range m.Facts {
-			// Or the machine's own resolver's, where it is held (novox/hq ADR 0247): the uplink's holder
-			// steps back from the file there, and nowhere else.
-			if f.Path == "/etc/resolv.conf" && !isUplink && !holdsSeat(m, ResolverSeat) {
-				t.Errorf("%s writes /etc/resolv.conf and holds neither the uplink nor the machine's resolver", name)
-			}
-		}
-		for _, r := range m.Resources {
-			if r["path"] == "/etc/resolv.conf" {
-				t.Errorf("%s declares /etc/resolv.conf as a file of its own", name)
-			}
-		}
-		if isUplink && !writes {
-			t.Errorf("%s holds the uplink and does not write the resolver file", name)
-		}
-	}
-}
diff --git a/internal/catalogue/resolver_manifests_test.go b/internal/catalogue/resolver_manifests_test.go
deleted file mode 100644
index c3dfadd6..00000000
--- a/internal/catalogue/resolver_manifests_test.go
+++ /dev/null
@@ -1,327 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// The catalogue's resolver modules as they are, parsed by the real parser and composed as a
-// machine would receive them (hal dnsmasq-app conversion, novox/hq 08-connectivity).
-//
-// The predecessor's resolver answered every name on a machine: the mesh's own itself, the rest
-// forwarded to two fixed upstreams, with the machine's resolv.conf naming it alone and the
-// container runtime pointed at its private-network address. These hold the mesh's modules to the
-// same arrangement, and to the two things a resolver here must never do — read resolv.conf for
-// its upstreams, or take an address systemd-resolved holds.
-
-// resolverShelf is the resolver, an uplink module that writes what the machine asks (novox/hq ADR
-// 0223), and the container runtime beside something that answers `mesh-addressing`.
-// The networking module that really does is composed in the controller and cannot be imported
-// here, so a stand-in offers the same word; what is under test is the manifests, not the network.
-func resolverShelf(t *testing.T) map[string]Manifest {
-	t.Helper()
-	shelf := map[string]Manifest{
-		"net": {Module: "net", Version: "1", Provides: []Offer{{Name: "mesh-addressing"}}},
-	}
-	for _, name := range []string{"dnsmasq", "systemd-networkd", "docker"} {
-		shelf[name] = catalogueManifest(t, name)
-	}
-	return shelf
-}
-
-// twoMachines is what the control plane hands a rendering: internal names and their addresses.
-var twoMachines = map[string]string{"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2"}
-
-// Its configuration forwards to the upstreams the predecessor's module shipped, and gets them from
-// nowhere else: `no-resolv` is what makes the documented loop — the resolver finding its own
-// address in resolv.conf and becoming its own upstream — impossible.
-func TestTheResolverForwardsToFixedUpstreamsAndNeverReadsResolvConf(t *testing.T) {
-	m := catalogueManifest(t, "dnsmasq")
-	var config string
-	for _, r := range m.Resources {
-		if r["id"] == "config" {
-			config, _ = r["content"].(string)
-		}
-	}
-	if config == "" {
-		t.Fatal("the resolver has no configuration file")
-	}
-	for _, want := range []string{
-		"\nno-resolv\n", "\nserver=1.1.1.1\n", "\nserver=8.8.8.8\n",
-		// The private address and loopback, never a LAN's (novox/hq ADR 0194): a device that is not a
-		// member cannot reach what the mesh's names point at.
-		"\nlisten-address=127.0.0.1\n", "\nlisten-address=${machine:address}\n",
-
-		// No hosts file and no operator's files: the mesh's resolver answers every node (ADR 0199).
-		"\nno-hosts\n",
-		"\nconf-file=" + m.Facts["zones"].Path + "\n",
-		"\ndomain-needed\n", "\nbogus-priv\n",
-		"\nconf-file=" + m.Facts["node-zones"].Path + "\n",
-	} {
-		if !strings.Contains(config, want) {
-			t.Errorf("the resolver's configuration lacks %q:\n%s", strings.TrimSpace(want), config)
-		}
-	}
-	// Bound to each address once, at start, and never by bind-dynamic (novox/hq issue 348): bind-dynamic
-	// re-reads the machine's addresses on every change of any link and closes each listener that reading
-	// did not find, and a reading made while the container runtime tears down a bridge's virtual links
-	// fails, so the private address was left unbound for twenty minutes, the daemon running and silent.
-	// The catalogue's main binds once since mesh-catalog PR 161 (105cc7c0).
-	if !strings.Contains(config, "\nbind-interfaces\n") {
-		t.Errorf("the resolver's configuration does not bind its addresses once (bind-interfaces):\n%s", config)
-	}
-	if strings.Contains(config, "\nbind-dynamic\n") {
-		t.Errorf("the resolver's configuration says bind-dynamic, which closes its listeners when a bridge is "+
-			"torn down (novox/hq issue 348):\n%s", config)
-	}
-	// By address and never by interface: dnsmasq admits a query by the interface it arrives on
-	// when told one, and a container's query to the private address arrives on the runtime's
-	// bridge — `interface=mesh0` dropped every such query, silently (novox/hq issue 110).
-	for _, line := range strings.Split(config, "\n") {
-		if strings.HasPrefix(line, "interface=") {
-			t.Errorf("the resolver answers by interface, so a container's query on a bridge is dropped: %s", line)
-		}
-	}
-	// Not .53 or .54, which systemd-resolved holds; and not .55 any more, which was a convention
-	// beside the one every machine already followed — the predecessor's resolv.conf says .1.
-	for _, taken := range []string{"127.0.0.53", "127.0.0.54", "127.0.0.55"} {
-		if strings.Contains(config, "listen-address="+taken) {
-			t.Errorf("the resolver listens on %s", taken)
-		}
-	}
-	// Never a directory or a file the operator keeps: a line written for one machine's programs would
-	// become an answer for every node (ADR 0199).
-	for _, never := range []string{"conf-dir=", "addn-hosts=", "listen-address=${setting:"} {
-		if strings.Contains(config, never) {
-			t.Errorf("the mesh's resolver still reads or listens on %q", never)
-		}
-	}
-	// And the file that decides what the machine asks names every one of the mesh's resolvers, by
-	// address, from the seat's holders, and no public one (ADR 0223): a resolver library that asks
-	// every listed server at once takes the first reply, and a public "no such name" for a mesh name
-	// won it. Written by every uplink module, since the uplink's holder owns the file.
-	for _, uplink := range uplinks {
-		fact, ok := catalogueManifest(t, uplink).Facts["resolvers"]
-		if !ok || fact.Path != "/etc/resolv.conf" {
-			t.Fatalf("%s's resolver file is not rendered from the roster: %+v", uplink, fact)
-		}
-		if !strings.Contains(fact.Template, `{{range index .Holders "mesh-dns-resolver"}}nameserver {{.Address}}`) {
-			t.Errorf("%s's resolv.conf does not list every holder of the mesh's resolver:\n%s", uplink, fact.Template)
-		}
-		for _, line := range strings.Split(fact.Template, "\n") {
-			if strings.HasPrefix(line, "nameserver ") && !strings.Contains(line, "{{") {
-				t.Errorf("%s's resolv.conf names a resolver of its own beside the mesh's: %s", uplink, line)
-			}
-		}
-		if !strings.Contains(fact.Template, "options timeout:1 attempts:2 edns0\n") {
-			t.Errorf("%s: a silent resolver is not passed over after one short wait:\n%s", uplink, fact.Template)
-		}
-	}
-}
-
-// The resolver and what points the machine at it compose on one machine, and what arrives is the
-// mesh's account of every machine as a wildcard, the suffix kept local, the daemon restarting on
-// that file, the machine pointed at the resolver by address, and the runtime given no resolver of
-// its own but kept running across a restart (ADR 0196).
-func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
-	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "systemd-networkd", "docker"},
-		Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
-			"package-manager": true, "service-manager": true, "privileged": true,
-			"uplink-systemd-networkd": true}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(strings.Join(named(got), " "), "net") {
-		t.Fatalf("the resolver's data is the mesh's addresses, and nothing answering them was taken: %v", named(got))
-	}
-	out, err := got.Declaration(Rendering{
-		// Names is every name the mesh serves; Machines is the subset that is a node (novox/hq
-		// issue 111) — the resolver's zones read only the second, and in this scenario the two
-		// happen to be the same map, since nothing routed is part of it.
-		Names: twoMachines, Machines: twoMachines, Suffix: "internal",
-		Zones:    []ZoneAt{{Zone: "incus", Address: "10.42.0.2", Port: 5353}},
-		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
-		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	ids := byID(out)
-	zones := ids["dnsmasq.fact-node-zones"]
-	if zones == nil || zones["path"] != "/etc/mesh-resolver/nodes.conf" {
-		t.Fatalf("the resolver was not given the machines where its configuration reads them: %v", zones)
-	}
-	content, _ := zones["content"].(string)
-	for _, want := range []string{
-		"local=/internal/", "address=/anchor.internal/10.42.0.1", "address=/laptop.internal/10.42.0.2",
-	} {
-		if !strings.Contains(content, want) {
-			t.Errorf("the machines file lacks %q:\n%s", want, content)
-		}
-	}
-
-	service := ids["dnsmasq.service"]
-	if service == nil {
-		t.Fatal("no resolver service composed")
-	}
-	reflects := map[string]bool{}
-	for _, id := range service["restart-on"].([]any) {
-		reflects[id.(string)] = true
-	}
-	if !reflects["dnsmasq.config"] || !reflects["dnsmasq.fact-node-zones"] || !reflects["dnsmasq.fact-zones"] {
-		t.Errorf("the daemon does not restart on its configuration, the machines and the zones: %v", service["restart-on"])
-	}
-	if z, _ := ids["dnsmasq.fact-zones"]["content"].(string); !strings.Contains(z, "server=/incus/10.42.0.2#5353\n") {
-		t.Errorf("the resolver was not told to forward the zone to its answerer:\n%s", z)
-	}
-
-	// The runtime's own file, written into (novox/hq ADR 0102) with one key, by the runtime's own
-	// module — a module does not write another software's configuration (issue 190): a restart keeps
-	// every container running. No `dns` — a container copies its machine's resolvers (ADR 0196), and
-	// neither the resolver nor what decides how the machine resolves writes the runtime's file.
-	if ids["dnsmasq.runtime-dns"] != nil {
-		t.Errorf("the resolver still writes the runtime's dns: %v", ids["dnsmasq.runtime-dns"])
-	}
-	for id := range ids {
-		if strings.HasPrefix(id, "systemd-networkd.runtime") {
-			t.Errorf("what the machine asks still writes the runtime's file: %s", id)
-		}
-	}
-	runtime := ids["docker.daemon"]
-	if runtime == nil || runtime["path"] != "/etc/docker/daemon.json" || runtime["into"] != "json" {
-		t.Fatalf("live-restore is not written into the runtime's file: %v", runtime)
-	}
-	var keys map[string]any
-	if err := json.Unmarshal([]byte(runtime["content"].(string)), &keys); err != nil {
-		t.Fatalf("the runtime's keys are not JSON: %v", err)
-	}
-	// What the runtime is given is what its own module declares, and nothing a layer or another module
-	// adds. This used to say "live-restore and nothing else", to hold the line ADR 0196 drew when `dns`
-	// left the file; since the docker module gained log rotation as a preference (mesh-catalog #205 and
-	// #217, novox/hq issue 452) that frozen copy failed every check (novox/hq issue 498). So the keys are
-	// judged against the module's own daemon.json instead: live-restore is given, `dns` never is, and no
-	// key the module does not declare appears.
-	if keys["live-restore"] != true {
-		t.Errorf("the runtime is given %v; a restart must keep every container running (live-restore)", keys)
-	}
-	if _, ok := keys["dns"]; ok {
-		t.Errorf("the runtime is given a resolver of its own, %v; a container copies its machine's (ADR 0196)", keys["dns"])
-	}
-	declared := daemonKeysDeclared(t)
-	for key := range keys {
-		if !declared[key] {
-			t.Errorf("the runtime is given %q, which the docker module does not declare: %v", key, keys)
-		}
-	}
-	// The log rotation preference, at its defaults, wherever the module declares it. The copy captured in
-	// testdata/beside predates it, so outside a merge check it is not there to judge.
-	if declared["log-driver"] {
-		opts, _ := keys["log-opts"].(map[string]any)
-		if keys["log-driver"] != "json-file" || opts["max-size"] != "100m" || opts["max-file"] != "10" {
-			t.Errorf("the runtime is given %v; its containers' logs are cut at 100m and ten are kept (novox/hq issue 452)", keys)
-		}
-	}
-	// The runtime is reloaded when that file changes, and never restarted: a restart stops every
-	// container on the machine (ADR 0102), and a reload is what turns live-restore on.
-	var reloaded bool
-	for _, r := range out {
-		if r["type"] != "service" || r["unit"] != "docker.service" {
-			continue
-		}
-		if _, restarts := r["restart-on"]; restarts {
-			t.Errorf("the runtime is ordered restarted, which stops every container (ADR 0102): %v", r)
-		}
-		for _, on := range asStrings(r["reload-on"]) {
-			if on == "docker.daemon" {
-				reloaded = true
-			}
-		}
-	}
-	if !reloaded {
-		t.Errorf("the runtime is not reloaded when its file changes, so live-restore never takes effect")
-	}
-
-	resolv := ids["systemd-networkd.fact-resolvers"]
-	if resolv == nil || !strings.Contains(resolv["content"].(string), "\nnameserver 10.42.0.1\noptions ") {
-		t.Fatalf("the machine is not pointed at the resolver by address, and only at it: %v", resolv)
-	}
-}
-
-// Two modules deciding what a machine asks are refused on one machine, as before — now that the file
-// is the uplink's (novox/hq ADR 0223), by two things: a machine runs one network manager, and no other
-// module may write the resolver file beside the uplink's, as a file or as a rendered fact.
-func TestTwoThingsDecidingWhatAMachineAsksAreRefused(t *testing.T) {
-	shelf := resolverShelf(t)
-	shelf["networkmanager"] = catalogueManifest(t, "networkmanager")
-	node := Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
-		"package-manager": true, "service-manager": true,
-		"uplink-systemd-networkd": true, "uplink-networkmanager": true}}
-	_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "networkmanager"}, node, World{})
-	if err == nil || !strings.Contains(err.Error(), "node-uplink") {
-		t.Fatalf("two network managers were both assigned to one machine: %v", err)
-	}
-
-	// The second is made up: what is under test is that the resolver file has one owner, so any
-	// module asking the mesh to render it — or declaring it — will do.
-	for name, m := range map[string]Manifest{
-		"a-rendered-one": {Module: "a-rendered-one", Version: "1",
-			Facts: map[string]RosterFile{"mine": {Path: "/etc/resolv.conf", Template: "nameserver 10.42.0.1\n"}}},
-		"a-declared-one": {Module: "a-declared-one", Version: "1", Resources: []map[string]any{
-			{"id": "mine", "type": "file", "path": "/etc/resolv.conf", "content": "nameserver 10.42.0.1\n"}}},
-	} {
-		shelf := resolverShelf(t)
-		shelf[name] = m
-		_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", name}, node, World{})
-		if err == nil || !strings.Contains(err.Error(), "/etc/resolv.conf") {
-			t.Errorf("%s wrote the resolver file beside the uplink's: %v", name, err)
-		}
-	}
-}
-
-// A machine that is not on the private network has no address for the runtime to be pointed at.
-// Refused where the module and the machine are both named, rather than a placeholder written into
-// the runtime's file and read as an address.
-func TestTheResolverOnAMachineOffTheNetworkIsRefused(t *testing.T) {
-	got, err := Resolve(resolverShelf(t), []string{"dnsmasq"}, Node{Name: "anchor"}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Left out of the declaration and said, rather than composed listening nowhere: a module that
-	// cannot compose on a machine is kept as it is there, with the reason (hq ADR 0163).
-	composed, err := got.Compose(Rendering{Names: twoMachines, Suffix: "internal",
-		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-		Settings: SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}}})
-	if err == nil && !strings.Contains(composed.LeftOut["dnsmasq"], "${machine:address}") {
-		t.Fatalf("a machine off the network was composed a resolver, or left out for another reason: %v",
-			composed.LeftOut)
-	}
-	if err != nil && !strings.Contains(err.Error(), "${machine:address}") {
-		t.Fatalf("a machine off the network was refused for another reason: %v", err)
-	}
-}
-
-// daemonKeysDeclared is the top-level keys of the docker module's own daemon.json, read from its
-// manifest: what the runtime may be given (novox/hq issue 498). A placeholder sits inside a JSON
-// string there, so the content parses as it is.
-func daemonKeysDeclared(t *testing.T) map[string]bool {
-	t.Helper()
-	for _, r := range catalogueManifest(t, "docker").Resources {
-		if r["id"] != "daemon" {
-			continue
-		}
-		var keys map[string]any
-		if err := json.Unmarshal([]byte(r["content"].(string)), &keys); err != nil {
-			t.Fatalf("the docker module's daemon.json is not JSON: %v", err)
-		}
-		declared := map[string]bool{}
-		for key := range keys {
-			declared[key] = true
-		}
-		return declared
-	}
-	t.Fatal("the docker module declares no daemon.json")
-	return nil
-}
diff --git a/internal/catalogue/retirement_event_test.go b/internal/catalogue/retirement_event_test.go
deleted file mode 100644
index ec029784..00000000
--- a/internal/catalogue/retirement_event_test.go
+++ /dev/null
@@ -1,22 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"testing"
-)
-
-// Every provider may say what becomes of a consumer the mesh stopped asking for (novox/hq ADR 0230),
-// whatever its manifest lists — as it may say a consumer it keeps failing (ADR 0224) — and a module
-// that receives nothing may not.
-func TestEveryProviderMaySayWhatItRetires(t *testing.T) {
-	provider := Manifest{Module: "pg", Receives: map[string]string{"postgres-database": "/x/mesh.json"},
-		Emits: []string{"database.provisioned"}}
-	for _, e := range []string{ProvisionerFailing, ProvisionerRecovered, ProvisionerRetirement, "database.provisioned"} {
-		if !slices.Contains(provider.EmitsAll(), e) {
-			t.Errorf("a provider may not emit %s: %v", e, provider.EmitsAll())
-		}
-	}
-	if slices.Contains(Manifest{Module: "app", Emits: []string{"x"}}.EmitsAll(), ProvisionerRetirement) {
-		t.Error("a module that provides nothing may say what it retires")
-	}
-}
diff --git a/internal/catalogue/roster_test.go b/internal/catalogue/roster_test.go
deleted file mode 100644
index f2780604..00000000
--- a/internal/catalogue/roster_test.go
+++ /dev/null
@@ -1,281 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Keyed by the internal name, as the control plane hands them (issue 079). bart has no address —
-// the ordinary state between adding a machine and it joining.
-var threeMachines = map[string]string{"homer.internal": "10.42.0.1", "marge.internal": "10.42.0.2", "bart.internal": ""}
-
-// A module says where it wants a roster file and in what format, and is given the rendered file.
-func TestAModuleIsGivenTheFileItAskedFor(t *testing.T) {
-	m := Manifest{Module: "resolver", Facts: map[string]RosterFile{
-		"zones": {Path: "/etc/mesh/zones.conf", Template: "{{range .Machines}}address=/{{.FQDN}}/{{.Address}}\n{{end}}"},
-	}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, threeMachines, threeMachines, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(given) != 1 {
-		t.Fatalf("expected one file, got %d", len(given))
-	}
-	if given[0]["path"] != "/etc/mesh/zones.conf" || given[0]["type"] != "file" {
-		t.Fatalf("not written where it was asked for: %v", given[0])
-	}
-	// The id is fact-<name>, which is what a restart-on names when the roster changes.
-	if given[0]["id"] != "fact-zones" {
-		t.Fatalf("the file's id is not fact-<name>, so a restart-on cannot find it: %v", given[0]["id"])
-	}
-	if !strings.Contains(given[0]["content"].(string), "address=/homer.internal/10.42.0.1") {
-		t.Fatalf("the file does not hold the fact: %v", given[0]["content"])
-	}
-}
-
-// **A shared fact is written into a region of the machine's file, not over it** (novox/hq issue
-// 128). A hosts file is the machine's — its localhost, the operator's lines, other tools' blocks —
-// so the mesh owns only a marked region (`into: block`); a resolver's zones file is the mesh's
-// whole, and carries no `into`.
-func TestASharedFactIsWrittenIntoARegion(t *testing.T) {
-	roster := map[string]string{"homer.internal": "10.42.0.1"}
-	m := Manifest{Module: "net", Facts: map[string]RosterFile{
-		"node-names": {Path: "/etc/hosts", Template: "{{range .Names}}{{.FQDN}}\n{{end}}", Shared: true},
-		"node-zones": {Path: "/etc/zones", Template: "{{range .Machines}}{{.FQDN}}\n{{end}}"},
-	}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, roster, roster, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]map[string]any{}
-	for _, f := range given {
-		by[f["path"].(string)] = f
-	}
-	if by["/etc/hosts"]["into"] != "block" {
-		t.Fatalf("a shared fact is not written into a region, so the mesh writes the file whole: %v", by["/etc/hosts"])
-	}
-	if _, has := by["/etc/zones"]["into"]; has {
-		t.Fatalf("an unshared fact was written into a region, so the mesh does not own its own file whole: %v", by["/etc/zones"])
-	}
-}
-
-// **The format is the module's — the mesh renders whatever template it gives.** The same roster
-// through two templates is two entirely different files, and the control plane reads neither.
-func TestTheFormatIsTheModulesOwn(t *testing.T) {
-	roster := map[string]string{"homer.internal": "10.42.0.1"}
-	hostsish := Manifest{Module: "a", Facts: map[string]RosterFile{
-		"f": {Path: "/f", Template: "{{range .Names}}{{.Address}}\t{{.Name}}\n{{end}}"}}}
-	sshish := Manifest{Module: "b", Facts: map[string]RosterFile{
-		"f": {Path: "/f", Template: "{{range .Names}}Host {{.Name}}\n  HostName {{.FQDN}}\n{{end}}"}}}
-
-	h, err := FactsInto(hostsish, Resolution{Node: "homer"}, roster, roster, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	s, err := FactsInto(sshish, Resolution{Node: "homer"}, roster, roster, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if h[0]["content"] != "10.42.0.1\thomer\n" {
-		t.Fatalf("the hosts-shaped template did not render its format: %q", h[0]["content"])
-	}
-	if s[0]["content"] != "Host homer\n  HostName homer.internal\n" {
-		t.Fatalf("the ssh-shaped template did not render its format: %q", s[0]["content"])
-	}
-}
-
-// **A template that will not parse is refused here, not on a machine.** A daemon that starts, reads
-// a file the mesh could not render, and answers nothing is a much worse way to find out.
-func TestABrokenTemplateIsRefusedHere(t *testing.T) {
-	m := Manifest{Module: "resolver", Facts: map[string]RosterFile{
-		"zones": {Path: "/etc/zones", Template: "{{range .Machines}}oops"}}}
-	_, err := FactsInto(m, Resolution{}, nil, nil, nil, "")
-	if err == nil {
-		t.Fatal("a template that does not parse was accepted, so the machine gets an empty file")
-	}
-	if !strings.Contains(err.Error(), "resolver") || !strings.Contains(err.Error(), "zones") {
-		t.Fatalf("the refusal does not say whose template, or which: %v", err)
-	}
-}
-
-// A template reading something the mesh does not compute is refused, not rendered empty. The roster
-// is a closed shape; asking it for the weather fails where the manifest is.
-func TestATemplateReadingWhatTheMeshDoesNotHaveIsRefused(t *testing.T) {
-	m := Manifest{Module: "resolver", Facts: map[string]RosterFile{
-		"zones": {Path: "/etc/zones", Template: "{{.Weather}}"}}}
-	if _, err := FactsInto(m, Resolution{}, nil, nil, nil, ""); err == nil {
-		t.Fatal("a template read a field nobody computes and rendered anyway, silently")
-	}
-}
-
-// A relative path is refused, or a module decides where the mesh writes on a machine.
-func TestAFactMustBeAskedForAtAnAbsolutePath(t *testing.T) {
-	m := Manifest{Module: "resolver", Facts: map[string]RosterFile{
-		"hosts": {Path: "etc/hosts", Template: "x"}}}
-	if _, err := FactsInto(m, Resolution{}, nil, nil, nil, ""); err == nil {
-		t.Fatal("a relative path was accepted")
-	}
-}
-
-// A machine the mesh has a record for and cannot place is left out of the roster.
-//
-// **Not an oversight — the alternative is worse.** A name written with no address resolves to
-// nothing, and a connection to that hangs. Leaving it out fails at once and says the name is
-// unknown, which is a thing somebody can act on.
-func TestAMachineWithNoAddressIsNotInTheRoster(t *testing.T) {
-	m := Manifest{Module: "a", Facts: map[string]RosterFile{
-		"f": {Path: "/f", Template: "{{range .Machines}}{{.Name}}\n{{end}}"}}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, threeMachines, threeMachines, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(given[0]["content"].(string), "bart") {
-		t.Fatalf("a machine with no address was in the roster, so its name resolves to nothing:\n%s", given[0]["content"])
-	}
-}
-
-// **The names the control plane hands a resolution are already internal names** — `homer.internal`,
-// the same map every container gets as its hosts. A roster entry's FQDN is that name, not it with
-// the suffix appended a second time; either key gives the same entries.
-func TestNamesAreNotSuffixedTwice(t *testing.T) {
-	internal := map[string]string{"homer.internal": "10.42.0.1"}
-	bare := map[string]string{"homer": "10.42.0.1"}
-	tmpl := RosterFile{Path: "/f", Template: "{{range .Machines}}{{.FQDN}} {{.Name}}\n{{end}}"}
-
-	fromInternal, err := FactsInto(Manifest{Module: "a", Facts: map[string]RosterFile{"f": tmpl}}, Resolution{Node: "homer"}, internal, internal, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	fromBare, err := FactsInto(Manifest{Module: "a", Facts: map[string]RosterFile{"f": tmpl}}, Resolution{Node: "homer"}, bare, bare, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fromInternal[0]["content"] != fromBare[0]["content"] {
-		t.Fatalf("the roster differs by how the names were keyed:\n%q\n%q", fromInternal[0]["content"], fromBare[0]["content"])
-	}
-	got := fromInternal[0]["content"].(string)
-	if strings.Contains(got, "internal.internal") || !strings.Contains(got, "homer.internal homer") {
-		t.Fatalf("the entry carries a doubled suffix or the wrong bare name:\n%s", got)
-	}
-}
-
-// The suffix the control plane composed the names with is the one a template sees — an operator who
-// chose another does not get `.internal`. `.Suffix` is the bare form, and FQDNs carry it.
-func TestTheSuffixIsCarriedAsComposed(t *testing.T) {
-	names := map[string]string{"homer.lan": "10.42.0.1"}
-	m := Manifest{Module: "a", Facts: map[string]RosterFile{
-		"f": {Path: "/f", Template: "local=/{{.Suffix}}/\n{{range .Machines}}{{.FQDN}}\n{{end}}"}}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, names, names, nil, "lan")
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := given[0]["content"].(string)
-	if !strings.Contains(got, "local=/lan/") || strings.Contains(got, "internal") {
-		t.Fatalf("the operator's suffix was not carried, so its names would be wrong:\n%s", got)
-	}
-	if !strings.Contains(got, "homer.lan") {
-		t.Fatalf("the FQDN does not carry the operator's suffix:\n%s", got)
-	}
-}
-
-// novox/hq 04-ISSUES/111: a template is given both sets and chooses. `.Names` is every name the mesh
-// serves — the machines and the names it was told to route; `.Machines` is only the machines. A
-// container's hosts wants every name so a routed name resolves to the machine serving it; a resolver
-// told the suffix is its own wants only the machines, or a routed name written there with the suffix
-// is a name nobody will ever ask for, standing beside the machines and looking as real.
-func TestATemplateChoosesMachinesOrEveryName(t *testing.T) {
-	machines := map[string]string{"homer.internal": "10.42.0.1", "marge.internal": "10.42.0.2"}
-	every := map[string]string{
-		"homer.internal": "10.42.0.1", "marge.internal": "10.42.0.2",
-		"drive.example.test": "10.42.0.1", "git.example.test": "10.42.0.2",
-	}
-	m := Manifest{Module: "resolver", Facts: map[string]RosterFile{
-		"zones": {Path: "/etc/zones", Template: "{{range .Machines}}{{.FQDN}}\n{{end}}"},
-		"hosts": {Path: "/etc/hosts", Template: "{{range .Names}}{{.FQDN}}\n{{end}}"},
-	}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, every, machines, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]string{}
-	for _, f := range given {
-		by[f["path"].(string)] = f["content"].(string)
-	}
-
-	zones := by["/etc/zones"]
-	for _, served := range []string{"drive.example.test", "git.example.test"} {
-		if strings.Contains(zones, served) {
-			t.Fatalf("a template over .Machines saw %q, a name the mesh serves rather than a machine:\n%s", served, zones)
-		}
-	}
-	if !strings.Contains(zones, "homer.internal") {
-		t.Fatalf("a template over .Machines did not see the machines:\n%s", zones)
-	}
-
-	hosts := by["/etc/hosts"]
-	for _, name := range []string{"homer.internal", "drive.example.test", "git.example.test"} {
-		if !strings.Contains(hosts, name) {
-			t.Fatalf("a template over .Names did not see %q, so a container would not resolve it:\n%s", name, hosts)
-		}
-	}
-}
-
-// A home fact is placed under the operator account's home and chowned to it, and its template sees
-// each node's account (novox/hq to-be 29) — the ssh-client config is the case.
-func TestAHomeFactIsPlacedUnderTheAccountsHomeAndOwnedByIt(t *testing.T) {
-	names := map[string]string{"homer.internal": "10.42.0.1", "marge.internal": "10.42.0.2"}
-	accounts := map[string]string{"homer": "jo", "marge": "jo"}
-	m := Manifest{Module: "ssh-client", Facts: map[string]RosterFile{
-		"ssh-config": {Path: ".ssh/config.d/mesh", Home: true,
-			Template: "{{range .Names}}Host {{.Name}}\n  HostName {{.FQDN}}\n  User {{.Account}}\n{{end}}"}}}
-	given, err := FactsInto(m, Resolution{Node: "homer", Account: "jo"}, names, names, accounts, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	f := given[0]
-	if f["path"] != "/home/jo/.ssh/config.d/mesh" {
-		t.Fatalf("the home fact was not placed under the account's home: %v", f["path"])
-	}
-	if f["owner"] != "jo" {
-		t.Fatalf("the home fact is not owned by the account: %v", f["owner"])
-	}
-	if !strings.Contains(f["content"].(string), "Host marge\n  HostName marge.internal\n  User jo") {
-		t.Fatalf("the config does not name the peer's account:\n%s", f["content"])
-	}
-}
-
-// A machine with no operator account gets no home fact — it cannot be placed, so it is left out
-// rather than written to nowhere.
-func TestAHomeFactIsSkippedWhereThereIsNoAccount(t *testing.T) {
-	names := map[string]string{"homer.internal": "10.42.0.1"}
-	m := Manifest{Module: "ssh-client", Facts: map[string]RosterFile{
-		"ssh-config": {Path: ".ssh/config", Home: true, Template: "x"}}}
-	given, err := FactsInto(m, Resolution{Node: "homer"}, names, names, nil, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(given) != 0 {
-		t.Fatalf("a home fact was placed on a machine with no operator account: %v", given)
-	}
-}
-
-// A routed name is already a full name under a public domain and has no mesh form. Appending the
-// suffix to it made `git.example.tld.internal` — carried by every machine's hosts file, served by
-// nothing, and refused by the proxy at the handshake (novox/hq issue 157). It is published as
-// itself, and only a machine has a bare name beside its full one.
-func TestARoutedNameIsPublishedAsItselfAndNotSuffixed(t *testing.T) {
-	names := map[string]string{"homer.internal": "10.42.0.1", "git.example.tld": "10.42.0.1"}
-	tmpl := RosterFile{Path: "/f", Template: "{{range .Names}}{{.FQDN}} {{.Name}}\n{{end}}"}
-	out, err := FactsInto(Manifest{Module: "a", Facts: map[string]RosterFile{"f": tmpl}},
-		Resolution{Node: "homer"}, names, map[string]string{"homer.internal": "10.42.0.1"}, nil, "internal")
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := out[0]["content"].(string)
-	if strings.Contains(got, "tld.internal") {
-		t.Fatalf("the routed name was given a suffixed alias that nothing serves:\n%s", got)
-	}
-	if !strings.Contains(got, "git.example.tld git.example.tld\n") || !strings.Contains(got, "homer.internal homer\n") {
-		t.Fatalf("the roster does not carry the routed name as itself beside the machine's two forms:\n%s", got)
-	}
-}
diff --git a/internal/catalogue/routing_test.go b/internal/catalogue/routing_test.go
deleted file mode 100644
index bb6a115f..00000000
--- a/internal/catalogue/routing_test.go
+++ /dev/null
@@ -1,256 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0066 — public routing is name-agnostic.
-//
-// A route contribution carries a label (the subdomain the operator chose); the node carries its
-// public domain; the mesh composes <label>.<public-domain> and interprets neither half. The
-// checks here are the ADR's own: the same catalogue resolves against two domains by changing one
-// node setting and nothing else, and a legacy full-name contribution passes through untouched so
-// the catalogue can migrate module by module.
-
-// labelled is a module that asks to be published under a subdomain rather than a full hostname.
-func labelled(module, label string, port int) Manifest {
-	return Manifest{Module: module, Version: "1",
-		Contributes: map[string]map[string]any{
-			"reverse-proxy": {"label": label, "port": port},
-		}}
-}
-
-// withDomain is a workstation that composes its routed names under one public domain.
-func withDomain(domain string) Node {
-	n := workstation()
-	n.PublicDomain = domain
-	return n
-}
-
-func TestALabelComposesWithTheNodesPublicDomain(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if len(given) != 1 {
-		t.Fatalf("the proxy was told about %d of 1: %v", len(given), given)
-	}
-	if given[0].Values["name"] != "git.example.tld" {
-		t.Fatalf("the label did not compose with the domain: %v", given[0].Values)
-	}
-	// The port the module gave is still there — composing the name must not drop what the proxy
-	// needs to reach the workload.
-	if given[0].Values["port"] != float64(8080) {
-		t.Fatalf("composing the name dropped the port: %v", given[0].Values)
-	}
-}
-
-func TestTheApexLabelComposesToTheBareDomain(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), labelled("board", "@", 4000)),
-		[]string{"board"}, withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if len(given) != 1 {
-		t.Fatalf("the proxy was told about %d of 1: %v", len(given), given)
-	}
-	// `@` is the zone-file apex: served at the bare public domain, no subdomain, no leading dot.
-	if given[0].Values["name"] != "example.tld" {
-		t.Fatalf("the apex label did not compose to the bare domain: %v", given[0].Values)
-	}
-}
-
-func TestOneNodeSettingMovesTheCatalogueBetweenDomains(t *testing.T) {
-	// The ADR's name-agnostic check: the same catalogue resolves against two different public
-	// domains by changing one node setting and nothing else.
-	one, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	two, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, withDomain("other.example"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	first := received(t, mustDeclare(t, one))[0].Values
-	second := received(t, mustDeclare(t, two))[0].Values
-
-	if first["name"] != "git.example.tld" || second["name"] != "git.other.example" {
-		t.Fatalf("the name did not track the domain: %v then %v", first["name"], second["name"])
-	}
-	// And nothing else moved: same label, same port. The domain is the one fact that changed.
-	if first["label"] != second["label"] || first["label"] != "git" {
-		t.Fatalf("the label changed with the domain: %v then %v", first["label"], second["label"])
-	}
-	if first["port"] != second["port"] {
-		t.Fatalf("the port changed with the domain: %v then %v", first["port"], second["port"])
-	}
-}
-
-func TestALegacyFullNameContributionPassesThroughUnchanged(t *testing.T) {
-	// Backward compatibility: a contribution that still carries a full `name` and no `label` is
-	// granted that name as-is, even on a node that has a public domain. This is what lets the
-	// catalogue migrate one module at a time while the running mesh keeps working.
-	legacy := Manifest{Module: "board", Version: "1",
-		Contributes: map[string]map[string]any{
-			"reverse-proxy": {"name": "git.pinned.example", "port": 8080},
-		}}
-	got, err := Resolve(shelf(proxy(), legacy), []string{"board"}, withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if given[0].Values["name"] != "git.pinned.example" {
-		t.Fatalf("a full name was rewritten: %v", given[0].Values)
-	}
-	if _, grewLabel := given[0].Values["label"]; grewLabel {
-		t.Fatalf("a legacy contribution grew a label: %v", given[0].Values)
-	}
-}
-
-func TestALabelWithNoPublicDomainComposesNothing(t *testing.T) {
-	// A routed module on a node with no public domain has nothing to join its label to. It composes
-	// no name — which reads downstream exactly as a route that named no host, the same as before
-	// this existed — rather than an fabricated `git.` with a dangling dot.
-	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if _, named := given[0].Values["name"]; named {
-		t.Fatalf("a name was composed with no domain to compose it from: %v", given[0].Values)
-	}
-	if given[0].Values["label"] != "git" {
-		t.Fatalf("the label was lost: %v", given[0].Values)
-	}
-}
-
-// withPrivateAddress is a workstation on the private network, at the given internal name — the
-// same fact a route's own consumers already receive as `${bound:...:at}`.
-func withPrivateAddress(at string) Node {
-	n := workstation()
-	n.At = at
-	return n
-}
-
-func TestALabelComposesWithTheNodesPrivateAddressToo(t *testing.T) {
-	// A predecessor proxy answered a route on both a public and a private-network hostname for the
-	// same convenience the mesh restores here: reaching a service over the VPN without a public TLS
-	// round trip. Composed independently of the public name, from the node's own `At`.
-	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, withPrivateAddress("anchor.internal"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if given[0].Values["internal-name"] != "git.anchor.internal" {
-		t.Fatalf("the label did not compose with the private address: %v", given[0].Values)
-	}
-}
-
-func TestThePublicAndInternalNamesComposeIndependently(t *testing.T) {
-	// A node with both a public domain and a private address gets both names from one label; a
-	// node with only one of the two gets only the matching one — neither composition depends on
-	// the other being possible.
-	both := withPrivateAddress("anchor.internal")
-	both.PublicDomain = "example.tld"
-	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, both, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if given[0].Values["name"] != "git.example.tld" {
-		t.Fatalf("the public name did not compose alongside the internal one: %v", given[0].Values)
-	}
-	if given[0].Values["internal-name"] != "git.anchor.internal" {
-		t.Fatalf("the internal name did not compose alongside the public one: %v", given[0].Values)
-	}
-
-	publicOnly, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
-		[]string{"board"}, withDomain("example.tld"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	givenPublicOnly := received(t, mustDeclare(t, publicOnly))
-	if _, has := givenPublicOnly[0].Values["internal-name"]; has {
-		t.Fatalf("an internal name was composed with no private address to compose it from: %v",
-			givenPublicOnly[0].Values)
-	}
-}
-
-func TestTheApexLabelComposesToTheBarePrivateAddress(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), labelled("board", "@", 4000)),
-		[]string{"board"}, withPrivateAddress("anchor.internal"), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if given[0].Values["internal-name"] != "anchor.internal" {
-		t.Fatalf("the apex label did not compose to the bare private address: %v", given[0].Values)
-	}
-}
-
-// novox/hq ADR 0066 propagate, by ADR 0148's means: a granted route name is published into the
-// machine's roster mapped to the node that serves it, beside the `<node>.internal` names, and the
-// machine's resolver answers it to every container. Nothing is written into the container itself —
-// a routed name that moved would otherwise be wrong inside every container until each was recreated.
-func TestARoutedNameResolvesToTheServingNode(t *testing.T) {
-	names := map[string]string{
-		"anchor.internal": "10.42.0.1",
-		"git.example.tld": "10.42.0.1",
-	}
-	got := containersOf(t, Resolution{Node: "anchor", Modules: []Manifest{{
-		Module: "app",
-		Resources: []map[string]any{{"id": "web", "type": "container", "name": "web",
-			"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)}},
-	}}}, Rendering{Names: names})
-	if len(got) != 1 {
-		t.Fatalf("expected one container, got %d", len(got))
-	}
-	if given := namesOf(got[0]); len(given) != 0 {
-		t.Fatalf("the routed name was copied into the container, where it would go stale: %v", given)
-	}
-	var sawRoute bool
-	for _, e := range entriesFrom(names, nil, "internal") {
-		if e.Name == "git.example.tld" && e.Address == "10.42.0.1" {
-			sawRoute = true
-		}
-	}
-	if !sawRoute {
-		t.Fatalf("the routed name is not in the roster the machine's resolver answers from")
-	}
-}
-
-// novox/hq issue 139, ADR 0151: `<label>.<node>.internal` is answered by every machine's resolver as
-// "anything under that node's name goes to that node", so the node in a route's internal name must
-// be the one whose proxy answers it. Composed under the consumer's own name, a route served from
-// another machine got an internal name that resolved to a machine with nothing listening, while the
-// public name — published at the serving node's address — worked.
-func TestARoutesInternalNameIsComposedUnderTheNodeThatServesIt(t *testing.T) {
-	hub := proxy()
-	hub.Provides = FromAnywhere("reverse-proxy")
-	got, err := Resolve(shelf(hub, labelled("board", "git", 8080)), []string{"board"},
-		withPrivateAddress("laptop.internal"), World{Offered: map[string][]Provider{
-			"reverse-proxy": {{Node: "anchor", At: "anchor.internal", Module: "traefik"}},
-		}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// Gathered the way the control plane gathers a consumer's contribution for a provider on
-	// another machine.
-	values, asks, err := got.ContributionsFrom("reverse-proxy", "board", nil)
-	if err != nil || !asks {
-		t.Fatalf("the route was not contributed: %v %v", asks, err)
-	}
-	if values["internal-name"] != "git.anchor.internal" {
-		t.Fatalf("the internal name does not say where the request arrives: %v", values)
-	}
-}
diff --git a/internal/catalogue/runonce_test.go b/internal/catalogue/runonce_test.go
deleted file mode 100644
index 9b17a582..00000000
--- a/internal/catalogue/runonce_test.go
+++ /dev/null
@@ -1,92 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A run-once container is a step the host runs to completion (novox/hq ADR 0052). The control
-// plane's part is small and exact: carry the field to the host unchanged, keep the step ahead of
-// the container it gates in author order, and refuse a malformed run-once near its cause rather
-// than on the machine. These tests defend that.
-
-// indexOfID returns the position of the resource with the given (module-prefixed) id, or -1.
-func indexOfID(out []map[string]any, id string) int {
-	for i, r := range out {
-		if r["id"] == id {
-			return i
-		}
-	}
-	return -1
-}
-
-func TestARunOnceContainerRendersBeforeTheContainerItGates(t *testing.T) {
-	// The gate is declaration order, not a resolved dependency: the step is written before the
-	// container that needs it, and the host applies in order and stops at a step that did not
-	// complete. So the control plane must carry run-once through untouched and must not reorder the
-	// two containers.
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	r := Resolution{Node: "laptop", Modules: []Manifest{{
-		Module: "mosquitto",
-		Resources: []map[string]any{
-			{"id": "seed", "type": "container", "name": "seed",
-				"image": "registry.example/runtime" + digest, "run-once": true},
-			{"id": "server", "type": "container", "name": "broker",
-				"image": "registry.example/broker" + digest},
-		},
-	}}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	seed := indexOfID(out, "mosquitto.seed")
-	server := indexOfID(out, "mosquitto.server")
-	if seed == -1 || server == -1 {
-		t.Fatalf("a container was lost in rendering: seed=%d server=%d", seed, server)
-	}
-	if seed >= server {
-		t.Errorf("the run-once step rendered after the container it gates (seed=%d server=%d)", seed, server)
-	}
-	if once, _ := out[seed]["run-once"].(bool); !once {
-		t.Errorf("run-once did not reach the host declaration: %+v", out[seed])
-	}
-	if _, present := out[server]["run-once"]; present {
-		t.Errorf("run-once leaked onto the container that is not a step: %+v", out[server])
-	}
-}
-
-func TestARunOnceMustBeABoolean(t *testing.T) {
-	// A value that is not true or false is refused here, not sent to a machine that would then have
-	// to guess what a string means.
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	bad := []byte(`{"module":"m","resources":[
-	  {"id":"seed","type":"container","name":"seed","image":"registry.example/x` + digest + `","run-once":"yes"}
-	]}`)
-	if _, err := ParseManifest(bad); err == nil {
-		t.Error("a run-once that is not a boolean was accepted")
-	} else if !strings.Contains(err.Error(), "run-once") {
-		t.Errorf("refused for the wrong reason: %v", err)
-	}
-
-	good := []byte(`{"module":"m","resources":[
-	  {"id":"seed","type":"container","name":"seed","image":"registry.example/x` + digest + `","run-once":true}
-	]}`)
-	if _, err := ParseManifest(good); err != nil {
-		t.Errorf("a valid run-once container was refused: %v", err)
-	}
-}
-
-func TestARunOnceStepMayNameWhatItReads(t *testing.T) {
-	// For a step, restart-on means *run again* when what it reads changed: a gate that fetches a
-	// provider's root names the binding file it reads, so a provider that moved is fetched again
-	// (novox/hq ADR 0099). Accepted here, and the host's digest does the rest.
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	good := []byte(`{"module":"m","resources":[
-	  {"id":"conf","type":"file","path":"/x","content":"y"},
-	  {"id":"seed","type":"container","name":"seed","image":"registry.example/x` + digest + `","run-once":true,"restart-on":["conf"]}
-	]}`)
-	if _, err := ParseManifest(good); err != nil {
-		t.Errorf("a run-once step naming what it reads was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/runtime_gate_test.go b/internal/catalogue/runtime_gate_test.go
deleted file mode 100644
index d023a35b..00000000
--- a/internal/catalogue/runtime_gate_test.go
+++ /dev/null
@@ -1,88 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The packet-filter manifest as it was the day the runtime was decided (novox/hq ADR 0175): tools,
-// served from a container built on the tool runtime's image, with NET_ADMIN so the container could
-// reach the filter. The exact pattern to-be 38 WP4 moves it off, and the one the gate refuses.
-const thePacketFilterAsItWas = `{
-  "module": "nftables",
-  "version": "1",
-  "capabilities": ["firewall", "container-runtime"],
-  "claims": [{"name": "node-packet-filter", "scope": "node", "serves": ["rules", "reload", "remove"]}],
-  "filtering": {"into": "/etc/nftables.conf"},
-  "resources": [
-    {"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-    {"id": "package", "type": "package", "package": "nftables"},
-    {"id": "unit", "type": "file", "path": "/etc/systemd/system/mesh-filter.service",
-     "content": "[Unit]\nDescription=The mesh's packet filter\n[Service]\nType=oneshot\nExecStart=nft -f /etc/nftables.conf\n", "mode": "0644"},
-    {"id": "load", "type": "service", "unit": "mesh-filter.service", "state": "running", "boot": "enabled",
-     "restart-on": ["unit"], "reload-on": ["filtering"]},
-    {"id": "runtime", "type": "container", "name": "mesh-nftables", "network": "host",
-     "capabilities": ["NET_ADMIN"],
-     "volumes": ["${dir:mesh-state}/broker:/run/secrets/broker:ro", "/etc/nftables.conf:/etc/nftables.conf:ro"],
-     "env": {"MESH_BROKER_FILE": "/run/secrets/broker", "MESH_FILTER_FILE": "/etc/nftables.conf"},
-     "artifact": "runtime"}
-  ],
-  "tools": ["firewall_rules"],
-  "own-secrets": {"broker": "${dir:mesh-state}/broker"},
-  "build": {
-    "on": [
-      {"arg": "BUILD_BASE", "module": "mesh-tools", "artifact": "build"},
-      {"arg": "RUNTIME_BASE", "module": "mesh-tools", "artifact": "runtime"}
-    ],
-    "artifacts": [{"name": "runtime", "kind": "image", "from": "Dockerfile"}]
-  }
-}`
-
-func TestAToolContainerOnTheRuntimeImageIsNamedForWhatItIs(t *testing.T) {
-	m, err := ParseManifest([]byte(thePacketFilterAsItWas))
-	if err != nil {
-		t.Fatal(err)
-	}
-	// From the repository: the manifest says what it builds on.
-	why := ToolContainerOnTheRuntime(m, nil)
-	if why == "" {
-		t.Fatal("the packet filter's tool container was not recognised from its build")
-	}
-	for _, word := range []string{"nftables", "mesh-tools", "runtime", "ADR 0175", "bundle"} {
-		if !strings.Contains(why, word) {
-			t.Errorf("the refusal does not say %q: %s", word, why)
-		}
-	}
-
-	// Built: the manifest carries no build, and what it stood on says the same.
-	built, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactImage,
-		Reference: ArtifactStoreScheme + "nftables/runtime@" + digest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	stoodOn := []string{"anchor.internal:5100/mesh-tools/build@" + digest, "anchor.internal:5100/mesh-tools/runtime@" + digest}
-	if ToolContainerOnTheRuntime(built, stoodOn) == "" {
-		t.Error("the packet filter's tool container was not recognised from what its build stood on")
-	}
-	if ToolContainerOnTheRuntime(built, nil) != "" {
-		t.Error("a built manifest with no record of its base was judged to be on the runtime")
-	}
-
-	// Each of the three alone is an ordinary module.
-	bundle := m
-	bundle.Resources = m.Resources[:len(m.Resources)-1]
-	if ToolContainerOnTheRuntime(bundle, nil) != "" {
-		t.Error("a module with tools and no container is the pattern the runtime serves, and was refused")
-	}
-	service := m
-	service.Tools = nil
-	if ToolContainerOnTheRuntime(service, nil) != "" {
-		t.Error("a service built against the SDK, declaring no tools, was refused")
-	}
-	elsewhere := m
-	elsewhere.Build = &Build{On: []BuildsOn{{Arg: "NODE_BASE", Image: "node@" + digest}},
-		Artifacts: m.Build.Artifacts}
-	if ToolContainerOnTheRuntime(elsewhere, nil) != "" {
-		t.Error("a tool container on a public base was refused as though it were on the runtime's")
-	}
-}
diff --git a/internal/catalogue/runtime_health_test.go b/internal/catalogue/runtime_health_test.go
deleted file mode 100644
index a701b9af..00000000
--- a/internal/catalogue/runtime_health_test.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-host/validate"
-)
-
-// novox/hq ADR 0366: a module that runs as its own account declares its runtime's health under one manifest
-// key, `runtime-health`, in the form a resource's `health` takes; the controller puts it on the process it
-// writes for that runtime, and a tool check there stands beside the node-engine's judgement that the runtime
-// is alive. A module that runs as no account of its own is refused the key.
-
-// ownAccountManifest is a module of its own account with nothing long-running but its own runtime, given
-// runtime-health (or none, when health is nil), and running as no account when runsAs is false.
-func ownAccountManifest(t *testing.T, runsAs bool, health any) []byte {
-	t.Helper()
-	m := map[string]any{"module": "keeper", "tools": []any{"keeper_status", "keeper_health"},
-		"own-secrets": map[string]any{"broker": map[string]any{"path": "/var/lib/keeper/broker"}},
-		"resources":   []any{map[string]any{"id": "account", "type": "user", "name": "keeper"}}}
-	if runsAs {
-		m["runs-as"], m["secrets-owner"] = "keeper", "keeper"
-	}
-	if health != nil {
-		m["runtime-health"] = health
-	}
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return raw
-}
-
-func TestAModuleOfItsOwnAccountDeclaresItsRuntimesHealthByItsOwnTool(t *testing.T) {
-	m, err := ParseManifest(ownAccountManifest(t, true, map[string]any{"kind": "tool", "tool": "keeper_health"}))
-	if err != nil {
-		t.Fatalf("a tool check on its own runtime was refused: %v", err)
-	}
-	if got := HealthChecks(m); len(got) != 1 || got[0] != "keeper.keeper_health" {
-		t.Errorf("the engine is granted %v, want keeper.keeper_health", got)
-	}
-	if r, has := OwnRuntimeHealth(m); !has || r["id"] != "keeper."+OwnRuntimeID() {
-		t.Errorf("its runtime's health reads as %v %v", r, has)
-	}
-}
-
-func TestRuntimeHealthIsRefusedWithoutAnAccountOfItsOwn(t *testing.T) {
-	_, err := ParseManifest(ownAccountManifest(t, false, map[string]any{"kind": "tool", "tool": "keeper_health"}))
-	if err == nil || !strings.Contains(err.Error(), "runtime-health") || !strings.Contains(err.Error(), "runs-as") {
-		t.Errorf("runtime-health without runs-as: %v", err)
-	}
-}
-
-func TestARuntimeHealthIsHeldToTheHealthRules(t *testing.T) {
-	for _, c := range []struct {
-		health any
-		says   string
-	}{
-		{map[string]any{"kind": "tool", "tool": "keeper_restart"}, "does not serve"},
-		{map[string]any{"kind": "tool", "tool": "keeper_health", "interval": "2s"}, "no more often"},
-		{map[string]any{"kind": "exec", "command": "true"}, "only a container"},
-		{map[string]any{"kind": "tool", "tool": "keeper_health", "port": 80}, "names a port"},
-		{"tool", "is an object"},
-	} {
-		_, err := ParseManifest(ownAccountManifest(t, true, c.health))
-		if err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%v: %v, want it refused saying %q", c.health, err, c.says)
-		}
-	}
-}
-
-// The runtime-health is composed onto <module>.own-runtime, in the words the node-engine takes; to an engine
-// that does not read health it is not sent, as for every resource.
-func TestARuntimeHealthIsComposedOntoTheModulesOwnRuntime(t *testing.T) {
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	keeper := aToolsModule(t, "keeper", "tools/index.js")
-	keeper.Tools = []string{"keeper_health"}
-	keeper.RunsAs, keeper.SecretsOwner = "keeper", "keeper"
-	keeper.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/keeper/broker"}}
-	keeper.RuntimeHealth = map[string]any{"kind": "tool", "tool": "keeper_health", "interval": "60s", "timeout": "10s",
-		"looks": 2.0}
-	for _, reads := range []bool{true, false} {
-		with := Rendering{ArtifactStore: "anchor.internal:5101", ReadsHealth: reads,
-			Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed"}, "keeper": {"broker": "own"}}}
-		out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{keeper, goRuntime}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		own := fileNamed(out, "keeper."+OwnRuntimeID())
-		if own == nil {
-			t.Fatalf("no own runtime: %v", ids(out))
-		}
-		h, has := own[HealthField].(map[string]any)
-		if !reads {
-			if has {
-				t.Errorf("health sent to an engine that does not read it: %v", h)
-			}
-			continue
-		}
-		if !has || h["kind"] != "tool" || h["tool"] != "keeper_health" || h["interval"] != "1m0s" ||
-			h["timeout"] != "10s" || h["looks"] != 2 || h["grace"] != "1m0s" {
-			t.Errorf("its own runtime's health: %v", own[HealthField])
-		}
-		if machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID()); machine[HealthField] != nil {
-			t.Errorf("the machine's runtime was given the module's health: %v", machine[HealthField])
-		}
-		body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": out})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if problems := validate.Declaration(body); len(problems) > 0 {
-			t.Errorf("composed into something the node-engine refuses: %v", problems)
-		}
-	}
-	// The catalogue's own manifest is not written into.
-	if _, ok := keeper.RuntimeHealth.(map[string]any)["grace"]; ok {
-		t.Error("composing wrote the defaults into the catalogue's manifest")
-	}
-}
diff --git a/internal/catalogue/runtime_test.go b/internal/catalogue/runtime_test.go
deleted file mode 100644
index 16c02b40..00000000
--- a/internal/catalogue/runtime_test.go
+++ /dev/null
@@ -1,587 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// The node's tool runtime (novox/hq ADR 0175, to-be 38): where the runtime module is assigned, a
-// machine is sent every assigned module's tools bundle as an archive, and the runtime's own process
-// loading them. Where it is not, the machine is sent exactly what it was sent before.
-
-var bundleDigest = "sha256:" + strings.Repeat("b", 64)
-
-// aToolsModule is a module whose tools come as a compiled bundle and nothing else — the shape every
-// module takes once its tool container goes (to-be 38 WP4).
-func aToolsModule(t *testing.T, name string, entrypoints ...string) Manifest {
-	t.Helper()
-	m := Manifest{Module: name, Version: "1", Tools: []string{"status"},
-		Build: &Build{Artifacts: []Artifact{
-			{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: entrypoints},
-		}}}
-	resolved, err := m.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + name + "/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-// theRuntime is the runtime module as the catalogue holds it: its own bundle, run rather than
-// loaded, and its broker secret to receive the node's credential in.
-func theRuntime(t *testing.T) Manifest {
-	t.Helper()
-	m := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"src/main.js"}}}}}
-	resolved, err := m.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return resolved
-}
-
-func TestABuildsBundlesAreCarriedOnTheResolvedManifest(t *testing.T) {
-	m := aToolsModule(t, "nftables", "tools/index.js")
-	if len(m.Bundles) != 1 {
-		t.Fatalf("the resolved manifest carries %d bundle(s), not the one the build made", len(m.Bundles))
-	}
-	b := m.Bundles[0]
-	if b.Name != "tools" || b.Digest != bundleDigest || b.Language != "typescript" ||
-		b.Source != ArtifactStoreScheme+"nftables/tools/blobs/"+bundleDigest ||
-		len(b.Entrypoints) != 1 || b.Entrypoints[0] != "tools/index.js" {
-		t.Errorf("the bundle is carried as %+v", b)
-	}
-	// A repository manifest may not write what the build derives.
-	raw := `{"module":"x","version":"1","build":{"artifacts":[{"name":"t","kind":"bundle","language":"typescript"}]},` +
-		`"bundles":[{"name":"t","source":"s","digest":"` + bundleDigest + `"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "bundles") {
-		t.Errorf("a manifest stating its build's output by hand was accepted: %v", err)
-	}
-}
-
-func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
-	store := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	nftables := aToolsModule(t, "nftables", "tools/index.js")
-	zsh := aToolsModule(t, "zsh", "tools/index.js", "tools/more.js")
-
-	t.Run("with the runtime, one archive per tools bundle", func(t *testing.T) {
-		r := Resolution{Node: "anchor", Modules: []Manifest{nftables, zsh, theRuntime(t)}}
-		out, err := r.Declaration(store)
-		if err != nil {
-			t.Fatal(err)
-		}
-		archive := fileNamed(out, "nftables."+BundleID("tools"))
-		if archive == nil {
-			t.Fatalf("nftables' tools bundle was not delivered: %v", ids(out))
-		}
-		if archive["type"] != "archive" || archive["digest"] != bundleDigest ||
-			archive["path"] != BundleRoot+"/nftables/tools" {
-			t.Errorf("delivered as %v", archive)
-		}
-		if archive["source"] != "http://anchor.internal:5101/v2/nftables/tools/blobs/"+bundleDigest {
-			t.Errorf("fetched from %v, not through the store as this network reaches it", archive["source"])
-		}
-		if fileNamed(out, "zsh."+BundleID("tools")) == nil {
-			t.Errorf("zsh's tools bundle was not delivered: %v", ids(out))
-		}
-		// The runtime's own bundle is run, not loaded: its process delivers it, not an archive.
-		if fileNamed(out, RuntimeModule+"."+BundleID("runtime")) != nil {
-			t.Error("the runtime's own bundle was delivered as an archive beside its process")
-		}
-	})
-
-	t.Run("without the runtime, nothing changes", func(t *testing.T) {
-		r := Resolution{Node: "anchor", Modules: []Manifest{nftables, zsh}}
-		out, err := r.Declaration(store)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, id := range ids(out) {
-			if strings.Contains(id, BundleID("")) {
-				t.Errorf("%s was delivered to a machine running no runtime to load it", id)
-			}
-		}
-	})
-}
-
-func ids(out []map[string]any) []string {
-	var names []string
-	for _, r := range out {
-		names = append(names, r["id"].(string))
-	}
-	return names
-}
-
-// One process per machine runs the runtime from its own bundle, told what it serves and from where,
-// where its credential is, and who the operator is — restarted when any of that changes.
-func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	nftables := aToolsModule(t, "nftables", "tools/index.js")
-	// A bundle carrying a daemon beside its tools says which files the runtime loads.
-	showcase := Manifest{Module: "showcase", Version: "1", Tools: []string{"greet"},
-		Build: &Build{Artifacts: []Artifact{{Name: "code", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"daemon/index.js", "tools/index.js"}, Loads: []string{"tools/index.js"}}}}}
-	showcase, err := showcase.Resolve([]Built{{Name: "code", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "showcase/code/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	r := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{nftables, showcase, theRuntime(t)}}
-	out, err := r.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if process == nil {
-		t.Fatalf("no runtime process was composed: %v", ids(out))
-	}
-	if process["type"] != "process" || process["name"] != RuntimeModule || process["digest"] != bundleDigest ||
-		process["source"] != "http://anchor.internal:5101/v2/"+RuntimeModule+"/runtime/blobs/"+bundleDigest {
-		t.Errorf("the runtime's process is %v", process)
-	}
-	if fmt.Sprint(process["run"]) != "[node src/main.js]" {
-		t.Errorf("the runtime is run as %v; its bundle's one entrypoint, by its language's interpreter", process["run"])
-	}
-	env := process["env"].(map[string]string)
-	if env[RuntimeToolModules] != "nftables="+BundleRoot+"/nftables/tools/tools/index.js,"+
-		"showcase="+BundleRoot+"/showcase/code/tools/index.js" {
-		t.Errorf("the runtime is told to serve %q: every loaded file, by module, and nothing a bundle runs", env[RuntimeToolModules])
-	}
-	if env[RuntimeBrokerFile] != "/var/lib/mesh/"+RuntimeModule+"/broker" {
-		t.Errorf("the runtime reads its credential at %q, not where the module's own secret is placed", env[RuntimeBrokerFile])
-	}
-	if env[RuntimeOperatorAccount] != "ops" || env[RuntimeOperatorHome] != "/home/ops" || process["user"] != "ops" {
-		t.Errorf("the operator is not handed to the runtime: %v as %v", env, process["user"])
-	}
-	// The credential the process reads belongs to the account it runs as, or it could not read it
-	// (to-be 38 WP3); other modules' secrets are left as their manifests say.
-	if credential := fileNamed(out, RuntimeModule+"."+NeedID("broker")); credential == nil || credential["owner"] != "ops" {
-		t.Errorf("the runtime's credential is not the account's to read: %v", credential)
-	}
-	restarts := fmt.Sprint(process["restart-on"])
-	for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), RuntimeModule + "." + NeedID("broker")} {
-		if !strings.Contains(restarts, want) {
-			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
-		}
-	}
-	// After every bundle and the credential, so both exist before it starts.
-	names := ids(out)
-	if names[len(names)-1] != RuntimeModule+"."+RuntimeProcessID() {
-		t.Errorf("the runtime's process is not last: %v", names)
-	}
-
-	t.Run("a machine with no account runs it as root without the operator words", func(t *testing.T) {
-		out, err := Resolution{Node: "anchor", Modules: []Manifest{nftables, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-		env := process["env"].(map[string]string)
-		if _, set := env[RuntimeOperatorAccount]; set {
-			t.Error("an operator account was named on a machine that has none")
-		}
-		if _, set := process["user"]; set {
-			t.Error("a user was set on a machine with no account")
-		}
-		if credential := fileNamed(out, RuntimeModule+"."+NeedID("broker")); credential == nil || credential["owner"] != nil {
-			t.Errorf("the runtime's credential was given an owner on a machine with no account: %v", credential)
-		}
-	})
-
-	t.Run("a runtime module built wrong is refused by name", func(t *testing.T) {
-		two := Manifest{Module: RuntimeModule, Version: "1", OwnSecrets: OwnSecrets{"broker": {Path: "/b"}},
-			Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "typescript",
-				Entrypoints: []string{"a.js", "b.js"}}}}}
-		resolved, err := two.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-			Reference: ArtifactStoreScheme + "x/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, err = Resolution{Node: "anchor", Modules: []Manifest{resolved}}.Declaration(with)
-		if err == nil || !strings.Contains(err.Error(), "entrypoint") {
-			t.Errorf("a runtime bundle with two entrypoints was composed: %v", err)
-		}
-	})
-}
-
-// novox/hq ADR 0192: a tools bundle says what it is given; the composer resolves it per machine as
-// a container's environment, hands it to the runtime as the module's words, and makes what the
-// words name readable by the account the runtime runs as.
-func TestABundleIsGivenItsWordsResolvedForThisMachine(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{
-			RuntimeModule: {"broker": "sealed-credential"},
-			"dash":        {"token": "sealed-token"},
-		}}
-	dash := Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
-		Listens:    []Listening{{Name: "web", Port: 3000, Protocol: "tcp"}},
-		OwnSecrets: OwnSecrets{"token": {Path: "${dir:mesh-state}/token"}},
-		Resources: []map[string]any{
-			{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-			{"id": "config", "type": "file", "path": "${dir:mesh-state}/config.json", "mode": "0600", "content": "{}\n"},
-			{"id": "unrelated", "type": "file", "path": "/etc/dash.conf", "content": "x\n"},
-		},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"tools/index.js"},
-			Env: map[string]string{
-				"DASH_CONFIG_FILE": "${dir:mesh-state}/config.json",
-				"DASH_TOKEN_FILE":  "${dir:mesh-state}/token",
-				"DASH_URL":         "http://127.0.0.1:${port:3000}",
-				"DASH_ADMIN":       "mesh-admin",
-			}}}}}
-	if problems := dash.Build.problems(dash.Module); len(problems) > 0 {
-		t.Fatalf("a bundle's words written with ${dir:…} and ${port:…} were refused: %v", problems)
-	}
-	dash, err := dash.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	other := aToolsModule(t, "nftables", "tools/index.js")
-
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{dash, other, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	dir := fileNamed(out, "dash.mesh-state")
-	if dir == nil {
-		t.Fatalf("no directory: %v", ids(out))
-	}
-	at := fmt.Sprint(dir["path"])
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	env := process["env"].(map[string]string)
-	var given map[string]map[string]string
-	if err := json.Unmarshal([]byte(env[RuntimeToolEnv]), &given); err != nil {
-		t.Fatalf("the runtime's %s is not JSON: %q", RuntimeToolEnv, env[RuntimeToolEnv])
-	}
-	want := map[string]string{
-		"DASH_CONFIG_FILE": at + "/config.json",
-		"DASH_TOKEN_FILE":  at + "/token",
-		"DASH_URL":         "http://127.0.0.1:3000",
-		"DASH_ADMIN":       "mesh-admin",
-	}
-	if fmt.Sprint(given["dash"]) != fmt.Sprint(want) {
-		t.Errorf("dash is given %v, want %v", given["dash"], want)
-	}
-	if _, has := given["nftables"]; has {
-		t.Errorf("a module that declares no words was given some: %v", given)
-	}
-	// What the words name is the account's to read; nothing else of the module's is touched.
-	for _, id := range []string{"dash.mesh-state", "dash.config", "dash." + NeedID("token")} {
-		if r := fileNamed(out, id); r == nil || r["owner"] != "ops" {
-			t.Errorf("%s is not the account's to read: %v", id, r)
-		}
-	}
-	if r := fileNamed(out, "dash.unrelated"); r == nil || r["owner"] != nil {
-		t.Errorf("a file no word names was given an owner: %v", r)
-	}
-	// A file a word names restarts the runtime when it changes, as it restarted the tool container.
-	restarts := fmt.Sprint(process["restart-on"])
-	for _, want := range []string{"dash.config", "dash." + NeedID("token")} {
-		if !strings.Contains(restarts, want) {
-			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
-		}
-	}
-	if strings.Contains(restarts, "dash.unrelated") || strings.Contains(restarts, "dash.mesh-state") {
-		t.Errorf("the runtime restarts for something no word names as a file: %s", restarts)
-	}
-
-	t.Run("on a machine with no account the runtime is root and nothing is re-owned", func(t *testing.T) {
-		out, err := Resolution{Node: "anchor", Modules: []Manifest{dash, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if r := fileNamed(out, "dash.config"); r["owner"] != nil {
-			t.Errorf("re-owned with no account: %v", r)
-		}
-	})
-
-	t.Run("a change to a module's words changes the runtime's process", func(t *testing.T) {
-		changed := dash
-		changed.Bundles = append([]Bundle(nil), dash.Bundles...)
-		changed.Bundles[0].Env = map[string]string{"DASH_ADMIN": "somebody-else"}
-		out2, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{changed, theRuntime(t)}}.Declaration(with)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if fmt.Sprint(fileNamed(out2, RuntimeModule+"."+RuntimeProcessID())["env"]) == fmt.Sprint(env) {
-			t.Error("the runtime's process is the same after a module's words changed, so it would not restart")
-		}
-	})
-}
-
-func TestABundlesWordsAreRefusedWhenTheyAreNotPathsOrConstants(t *testing.T) {
-	m := Manifest{Module: "dash", Version: "1", Build: &Build{Artifacts: []Artifact{
-		{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: []string{"tools/index.js"},
-			Env: map[string]string{"DASH_TOKEN": "${secret:token}", RuntimeBrokerFile: "/x", "DASH_PEER": "${bound:db:url}"}},
-		{Name: "runtime", Kind: ArtifactImage, From: "Dockerfile", Env: map[string]string{"X": "y"}},
-	}}}
-	said := strings.Join(m.Build.problems(m.Module), "\n")
-	for _, want := range []string{
-		`"tools" gives DASH_TOKEN the value "${secret:token}"`,
-		`"tools" gives DASH_PEER the value "${bound:db:url}"`,
-		`"tools" gives itself ` + RuntimeBrokerFile,
-		`"runtime" is a "image" and says what it is given`,
-	} {
-		if !strings.Contains(said, want) {
-			t.Errorf("not refused: %s\nsaid:\n%s", want, said)
-		}
-	}
-}
-
-// novox/hq ADR 0193: the runtime is told the launcher a build wrote, and the entrypoint itself for a
-// build from before launchers — so the move needs no flag day.
-func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	launched := Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "typescript",
-			Entrypoints: []string{"tools/index.js"}}}}}
-	launched, err := launched.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest,
-		Launchers: map[string]string{"tools/index.js": "tools/index.serve.mjs"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	older := aToolsModule(t, "nftables", "tools/index.js")
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{launched, older, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	env := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
-	want := "dash=" + BundleRoot + "/dash/tools/tools/index.serve.mjs,nftables=" + BundleRoot + "/nftables/tools/tools/index.js"
-	if env[RuntimeToolModules] != want {
-		t.Errorf("the runtime is told %q, want %q", env[RuntimeToolModules], want)
-	}
-}
-
-// novox/hq ADR 0193: a runtime compiled to a binary runs itself from its own unpacked bundle.
-func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	process := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if fmt.Sprint(process["run"]) != "[./node-tools]" {
-		t.Errorf("a Go runtime is run as %v, want its own binary", process["run"])
-	}
-	env := process["env"].(map[string]string)
-	if env[RuntimeToolModules] == "" || process["user"] != "ops" {
-		t.Errorf("the Go runtime is not told what to serve or whose it is: %v %v", env, process["user"])
-	}
-}
-
-// novox/hq 04-ISSUES/216: a bundle nothing loads, runs or unpacks is refused at registration; saying
-// `loads`, listing `tools`, or a resource naming it admits it.
-func TestABundleNothingDeliversIsRefused(t *testing.T) {
-	base := func() Manifest {
-		return Manifest{Module: "baserow", Version: "1", Build: &Build{Artifacts: []Artifact{
-			{Name: "tools", Kind: ArtifactBundle, Language: "typescript", Entrypoints: []string{"tools/index.js"}}}}}
-	}
-	if p := undeliveredBundles(base()); len(p) != 1 || !strings.Contains(p[0], "never reach a machine") {
-		t.Fatalf("a bundle nothing delivers was admitted: %v", p)
-	}
-	loads := base()
-	loads.Build.Artifacts[0].Loads = []string{"tools/index.js"}
-	tools := base()
-	tools.Tools = []string{"baserow_list_rows"}
-	run := base()
-	run.Resources = []map[string]any{{"id": "daemon", "type": "process", "artifact": "tools", "run": []any{"node", "tools/index.js"}}}
-	runtime := base()
-	runtime.Module = RuntimeModule
-	for name, m := range map[string]Manifest{"loads": loads, "tools": tools, "a process": run, "the runtime": runtime} {
-		if p := undeliveredBundles(m); len(p) != 0 {
-			t.Errorf("a bundle delivered by %s was refused: %v", name, p)
-		}
-	}
-}
-
-// novox/hq ADR 0193: a Go tools bundle is served — its binary is what the runtime starts, delivered
-// like any tools bundle, named to the runtime where a TypeScript bundle names its launcher.
-func TestAGoToolsBundleIsServedByItsBinary(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}}
-	lamp := Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
-		Build: &Build{Artifacts: []Artifact{{Name: "tools", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/lamp-tools"}}}}
-	if p := lamp.Build.problems("lamp"); len(p) != 0 {
-		t.Fatalf("a Go tools bundle was refused: %v", p)
-	}
-	lamp, err := lamp.Resolve([]Built{{Name: "tools", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "lamp/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fmt.Sprint(lamp.Bundles[0].Loads) != "[lamp-tools]" {
-		t.Fatalf("the runtime loads %v from a Go bundle, want its binary", lamp.Bundles[0].Loads)
-	}
-	out, err := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{lamp, theRuntime(t)}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if fileNamed(out, "lamp."+BundleID("tools")) == nil {
-		t.Errorf("the Go bundle is not delivered: %v", ids(out))
-	}
-	env := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
-	if env[RuntimeToolModules] != "lamp="+BundlePath("lamp", "tools")+"/lamp-tools" {
-		t.Errorf("the runtime is told %q, want the binary", env[RuntimeToolModules])
-	}
-
-	// An artifact may say it explicitly; naming anything but the binary is refused.
-	said := Manifest{Module: "lamp", Version: "1", Build: &Build{Artifacts: []Artifact{{Name: "tools",
-		Kind: ArtifactBundle, Language: "go", System: "arch", Binary: "lamp", Loads: []string{"lamp"}}}}}
-	if p := said.Build.problems("lamp"); len(p) != 0 {
-		t.Errorf("loads naming the binary was refused: %v", p)
-	}
-	said.Build.Artifacts[0].Loads = []string{"tools/index.js"}
-	if p := said.Build.problems("lamp"); len(p) == 0 {
-		t.Error("a Go bundle loading a file it does not contain was admitted")
-	}
-}
-
-// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
-// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
-// which runs as the operator's account and is given none of its words.
-func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	telegram := aToolsModule(t, "telegram", "tools/index.js")
-	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
-	telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
-	out, err := Resolution{Node: "anchor", Account: "ops",
-		Modules: []Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	machine := fileNamed(out, RuntimeModule+"."+RuntimeProcessID())
-	if served := machine["env"].(map[string]string)[RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
-		t.Errorf("the machine's runtime serves %q", served)
-	}
-	own := fileNamed(out, "telegram."+OwnRuntimeID())
-	if own == nil {
-		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
-	}
-	env := own["env"].(map[string]string)
-	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
-		env[RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
-		env[RuntimeToolModules] != "telegram="+BundleRoot+"/telegram/tools/tools/index.js" {
-		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
-	}
-	if _, told := env[RuntimeOperatorAccount]; told {
-		t.Error("a runtime of a module's own account is told the operator's account")
-	}
-	// Without the machine's runtime to run it from, it is refused in words.
-	if _, err := (Resolution{Node: "anchor", Modules: []Manifest{telegram}}).ownRuntimes(with); err == nil {
-		t.Error("a module of its own account composed without a runtime program")
-	}
-}
-
-// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
-// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
-func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, account := range []string{"ops", "agent"} {
-		telegram := aToolsModule(t, "telegram", "tools/index.js")
-		telegram.RunsAs, telegram.SecretsOwner = account, account
-		telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
-		_, err := Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
-			Modules: []Manifest{telegram, goRuntime}}.ownRuntimes(with)
-		if err == nil || !strings.Contains(err.Error(), account) {
-			t.Errorf("telegram running as %s was composed: %v", account, err)
-		}
-	}
-}
-
-// Issue 723: the vault runs as its own account, so what the mesh writes for it — the export it keeps, the grant
-// files it holds for its consumers, and what its words name — belongs to that account, never the operator's.
-func TestWhatAModuleOfItsOwnAccountReadsIsItsAccounts(t *testing.T) {
-	with := Rendering{ArtifactStore: "anchor.internal:5101",
-		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
-		Kept:   &KeptExport{Export: 1, OperatorKey: "k"},
-		Grants: []Grant{{Provision: "secret", Consumer: "anchor", From: "telegram",
-			Values: map[string]any{"name": "telegram"}}}}
-	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
-		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
-			System: "arch", From: "cmd/node-tools"}}}}
-	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	vault := aToolsModule(t, "vault", "tools/index.js")
-	vault.RunsAs, vault.SecretsOwner = "vault", "vault"
-	vault.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/vault/broker"}}
-	vault.Keeps = "/var/lib/vault/root"
-	vault.Grants = map[string]string{"secret": "/var/lib/vault/grants"}
-	vault.Receives = map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}
-	vault.Bundles[0].Env = map[string]string{"MESH_RECEIVES": "/var/lib/vault/grants/mesh.json"}
-	out, err2 := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{vault, goRuntime}}.Declaration(with)
-	if err = err2; err != nil {
-		t.Fatal(err)
-	}
-	seen := 0
-	for _, r := range out {
-		path := fmt.Sprint(r["path"])
-		if !strings.HasPrefix(path, "/var/lib/vault/") || r["type"] != "file" {
-			continue
-		}
-		seen++
-		if r["owner"] != "vault" {
-			t.Errorf("%s (%v) belongs to %v, not the vault's own account", path, r["id"], r["owner"])
-		}
-	}
-	if seen < 4 {
-		t.Errorf("only %d of the vault's files were composed: %v", seen, ids(out))
-	}
-	// Carried by the machine's runtime instead, nothing of it changes: the operator's account reads them.
-	carried := vault
-	carried.RunsAs, carried.SecretsOwner = "", ""
-	out, err = Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{carried, goRuntime}}.Declaration(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if path := fmt.Sprint(r["path"]); strings.HasPrefix(path, "/var/lib/vault/") && r["owner"] == "vault" {
-			t.Errorf("%s belongs to the vault's account though it runs as none", path)
-		}
-	}
-}
diff --git a/internal/catalogue/schedule_test.go b/internal/catalogue/schedule_test.go
deleted file mode 100644
index 289fb232..00000000
--- a/internal/catalogue/schedule_test.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A scheduled container is the recurring twin of run-once (novox/hq ADR 0053). The control plane's
-// part is small and exact: carry the field to the host unchanged, and refuse a malformed schedule —
-// or the contradictory pair run-once + schedule — near its author rather than on the machine. These
-// tests defend that.
-
-func TestAScheduledContainerRendersWithTheCronField(t *testing.T) {
-	// The resolver carries `schedule` into the rendered host declaration untouched, exactly as it
-	// carries run-once — a container's keys are copied through, so the host receives the field as
-	// written.
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	r := Resolution{Node: "laptop", Modules: []Manifest{{
-		Module: "kometa",
-		Resources: []map[string]any{
-			{"id": "sync", "type": "container", "name": "sync",
-				"image": "registry.example/runtime" + digest, "schedule": "0 3 * * *"},
-		},
-	}}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	sync := indexOfID(out, "kometa.sync")
-	if sync == -1 {
-		t.Fatal("the scheduled container was lost in rendering")
-	}
-	if got, _ := out[sync]["schedule"].(string); got != "0 3 * * *" {
-		t.Errorf("schedule did not reach the host declaration: %+v", out[sync])
-	}
-}
-
-func TestAMalformedScheduleIsRefused(t *testing.T) {
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	bad := []byte(`{"module":"m","resources":[
-	  {"id":"sync","type":"container","name":"sync","image":"registry.example/x` + digest + `","schedule":"every night"}
-	]}`)
-	if _, err := ParseManifest(bad); err == nil {
-		t.Error("a malformed schedule was accepted")
-	} else if !strings.Contains(err.Error(), "cron") {
-		t.Errorf("refused for the wrong reason: %v", err)
-	}
-
-	// A schedule out of range is refused for the same reason, near its author.
-	outOfRange := []byte(`{"module":"m","resources":[
-	  {"id":"sync","type":"container","name":"sync","image":"registry.example/x` + digest + `","schedule":"0 25 * * *"}
-	]}`)
-	if _, err := ParseManifest(outOfRange); err == nil {
-		t.Error("a schedule with an hour out of range was accepted")
-	}
-
-	good := []byte(`{"module":"m","resources":[
-	  {"id":"sync","type":"container","name":"sync","image":"registry.example/x` + digest + `","schedule":"*/15 * * * *"}
-	]}`)
-	if _, err := ParseManifest(good); err != nil {
-		t.Errorf("a valid scheduled container was refused: %v", err)
-	}
-}
-
-func TestAScheduleThatIsNotAStringIsRefused(t *testing.T) {
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	bad := []byte(`{"module":"m","resources":[
-	  {"id":"sync","type":"container","name":"sync","image":"registry.example/x` + digest + `","schedule":true}
-	]}`)
-	if _, err := ParseManifest(bad); err == nil {
-		t.Error("a schedule that is not a string was accepted")
-	} else if !strings.Contains(err.Error(), "schedule") {
-		t.Errorf("refused for the wrong reason: %v", err)
-	}
-}
-
-func TestAContainerCannotBeBothRunOnceAndScheduled(t *testing.T) {
-	// A container runs once and gates, or on a cadence, or stays up — never two (novox/hq ADR 0053).
-	digest := "@sha256:" + strings.Repeat("a", 64)
-	bad := []byte(`{"module":"m","resources":[
-	  {"id":"sync","type":"container","name":"sync","image":"registry.example/x` + digest + `","run-once":true,"schedule":"0 3 * * *"}
-	]}`)
-	if _, err := ParseManifest(bad); err == nil {
-		t.Error("a container that was both run-once and scheduled was accepted")
-	} else if !strings.Contains(err.Error(), "both run-once and schedule") {
-		t.Errorf("refused for the wrong reason: %v", err)
-	}
-}
diff --git a/internal/catalogue/seat_answers_before_local_test.go b/internal/catalogue/seat_answers_before_local_test.go
deleted file mode 100644
index 6aef0a97..00000000
--- a/internal/catalogue/seat_answers_before_local_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package catalogue
-
-import "testing"
-
-// A mesh-wide provision whose seat is held on another machine is answered by that holder, even on a
-// machine that runs a provider of its own (novox/hq issue 258). Every machine ran its own resolver
-// while the mesh moved to one; each bound its resolver configuration to itself, with the mesh's
-// resolver held elsewhere and pinned.
-func resolverMesh() map[string]Manifest {
-	return map[string]Manifest{
-		"resolver": {Module: "resolver", Version: "1",
-			Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
-			Claims:   []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}},
-		"asker": {Module: "asker", Version: "1", Requires: []string{"wildcard-resolution"}},
-	}
-}
-
-func resolverWorld(held string, pin *Chosen) World {
-	w := World{
-		Offered: map[string][]Provider{"wildcard-resolution": {
-			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
-			{Node: "laptop", At: "laptop.internal", Module: "resolver"},
-		}},
-	}
-	// Held is who holds it across the mesh; Holdings is the same holder on record, which lets this
-	// machine's own claimant stand beside it (ADR 0131).
-	w.Held = []Held{{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: held, Module: "resolver"}}
-	w.Holdings = w.Held
-	if pin != nil {
-		w.Pinned = map[string]Chosen{"wildcard-resolution": *pin}
-	}
-	return w
-}
-
-func answeredFrom(t *testing.T, world World) string {
-	t.Helper()
-	laptop := Node{Name: "laptop", At: "laptop.internal"}
-	got, err := Resolve(resolverMesh(), []string{"resolver", "asker"}, laptop, world)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range got.Needs {
-		if n.Name == "wildcard-resolution" {
-			return n.From
-		}
-	}
-	t.Fatalf("no binding for wildcard-resolution: %+v", got.Needs)
-	return ""
-}
-
-func TestTheSeatsHolderElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
-	if from := answeredFrom(t, resolverWorld("anchor", nil)); from != "anchor" {
-		t.Fatalf("bound to %s; the seat is held on anchor", from)
-	}
-}
-
-func TestAPinElsewhereAnswersBeforeThisMachinesOwnProvider(t *testing.T) {
-	if from := answeredFrom(t, resolverWorld("laptop", &Chosen{Node: "anchor", Module: "resolver"})); from != "anchor" {
-		t.Fatalf("bound to %s; this machine was pinned to anchor", from)
-	}
-}
-
-func TestTheHolderOnThisMachineStillAnswersHere(t *testing.T) {
-	if from := answeredFrom(t, resolverWorld("laptop", nil)); from != "laptop" {
-		t.Fatalf("bound to %s; the seat is held here", from)
-	}
-}
diff --git a/internal/catalogue/seat_contributions_test.go b/internal/catalogue/seat_contributions_test.go
deleted file mode 100644
index ad6d31e2..00000000
--- a/internal/catalogue/seat_contributions_test.go
+++ /dev/null
@@ -1,117 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0212: a seat says what it receives, its holder places it, and a contribution
-// depends on the seat.
-
-func hotkeysHolder() Manifest {
-	return Manifest{Module: "triggerhappy", Claims: []Claim{{Name: HotkeysSeat}}, Resources: []map[string]any{
-		{"id": "triggers", "type": "file", "path": "/etc/triggerhappy/triggers.d/mesh.conf",
-			"content": "# the mesh's triggers\n${contribution:node-hotkeys:trigger}"},
-	}}
-}
-
-func TestAContributionReachesTheHoldersFileInModuleOrderNamedByModule(t *testing.T) {
-	laptop := Manifest{Module: "laptop", Contributions: []SeatContribution{
-		{Seat: HotkeysSeat, Kind: "trigger", Content: "KEY_PROG1 1 play ${machine:account-home}"},
-		{Seat: HotkeysSeat, Kind: "trigger", Content: "KEY_F21 1 touchpad\n"},
-	}}
-	another := Manifest{Module: "another", Contributions: []SeatContribution{
-		{Seat: HotkeysSeat, Kind: "trigger", Content: "KEY_MUTE 1 mute ${shell:zsh:first}"},
-	}}
-	unrelated := Manifest{Module: "bar", Contributions: []SeatContribution{
-		{Seat: DisplaySessionSeat, Kind: "config", Content: "bar { }"},
-	}}
-	r := Resolution{Node: "laptop", Account: "op", Modules: []Manifest{hotkeysHolder(), laptop, another, unrelated}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var file map[string]any
-	for _, res := range out {
-		if res["id"] == "triggerhappy.triggers" {
-			file = res
-		}
-	}
-	if file == nil {
-		t.Fatalf("the holder's file was not composed: %v", out)
-	}
-	// Module order; each module named once; text never read, so neither ${machine:…} nor ${shell:…}
-	// inside a contribution is filled.
-	want := "# the mesh's triggers\n" +
-		"# another\nKEY_MUTE 1 mute ${shell:zsh:first}\n" +
-		"# laptop\nKEY_PROG1 1 play ${machine:account-home}\nKEY_F21 1 touchpad\n"
-	if got := file["content"]; got != want {
-		t.Fatalf("the holder's file is\n%s\nnot\n%s", got, want)
-	}
-}
-
-func TestNoContributionPlacesNothing(t *testing.T) {
-	r := Resolution{Node: "laptop", Account: "op", Modules: []Manifest{hotkeysHolder()}}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, res := range out {
-		if res["id"] == "triggerhappy.triggers" && res["content"] != "# the mesh's triggers\n" {
-			t.Fatalf("an empty kind left %q", res["content"])
-		}
-	}
-}
-
-func TestAContributionToASeatThatDoesNotReceiveItIsRefused(t *testing.T) {
-	cases := map[string]string{
-		`{"seat":"node-hotkeys","kind":"config","content":"x"}`:          "it receives trigger",
-		`{"seat":"node-nothing","kind":"trigger","content":"x"}`:         "the mesh does not define",
-		`{"seat":"node-hotkeys","kind":"trigger","content":"   "}`:       "has no content",
-		`{"seat":"node-display-session","kind":"trigger","content":"x"}`: "it receives config",
-	}
-	for c, want := range cases {
-		raw := `{"module":"laptop","contributions":[` + c + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: accepted, or refused without %q: %v", c, want, err)
-		}
-	}
-}
-
-func TestAContributionPlaceholderOutsideTheHolderIsRefused(t *testing.T) {
-	raw := `{"module":"laptop","resources":[{"id":"t","type":"file","path":"/etc/t","content":"${contribution:node-hotkeys:trigger}"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "laptop does not claim node-hotkeys") {
-		t.Errorf("a placeholder outside the holder was accepted: %v", err)
-	}
-	raw = `{"module":"triggerhappy","claims":[{"name":"node-hotkeys"}],"resources":[{"id":"t","type":"file","path":"/etc/t","content":"${contribution:node-hotkeys:keys}"}]}`
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "it receives trigger") {
-		t.Errorf("a placeholder for a kind the seat does not receive was accepted: %v", err)
-	}
-}
-
-func TestAContributionDependsOnItsSeat(t *testing.T) {
-	m := Manifest{Module: "laptop", Contributions: []SeatContribution{
-		{Seat: HotkeysSeat, Kind: "trigger", Content: "x"},
-		{Seat: DisplaySessionSeat, Kind: "config", Content: "y"},
-	}}
-	if got, want := DependsOn(nil, m), []string{DisplaySessionSeat, HotkeysSeat}; !reflect.DeepEqual(got, want) {
-		t.Errorf("depends on %v, want %v", got, want)
-	}
-	catalogue := map[string]Manifest{"laptop": m, "triggerhappy": hotkeysHolder()}
-	if _, err := AssignRefusal(catalogue, "laptop", nil, []string{"laptop"}); err == nil ||
-		!strings.Contains(err.Error(), HotkeysSeat) {
-		t.Errorf("a contributor without the holder was accepted: %v", err)
-	}
-}
-
-func TestTheHotkeysSeatIsTheMeshsAndReceivesTriggers(t *testing.T) {
-	s, ok := SeatNamed(HotkeysSeat)
-	if !ok || s.Scope != ScopeNode || len(s.Receives) != 1 || s.Receives[0].Kind != "trigger" {
-		t.Fatalf("%+v %v", s, ok)
-	}
-	d, _ := SeatNamed(DisplaySessionSeat)
-	if len(d.Receives) != 1 || d.Receives[0].Kind != "config" {
-		t.Fatalf("the display session receives %+v", d.Receives)
-	}
-}
diff --git a/internal/catalogue/seat_data_test.go b/internal/catalogue/seat_data_test.go
deleted file mode 100644
index 3d2313e9..00000000
--- a/internal/catalogue/seat_data_test.go
+++ /dev/null
@@ -1,426 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0255: a seat may receive a kind as data in its own shape, which the holder
-// renders with its template; the holder places every combination of the shape's placing fields once;
-// a contribution may be placed only where the machine reports a capability; and an offered kind makes
-// no dependency on its seat.
-
-const barTemplate = `{{if eq .shows "battery"}}[[block]]
-block = "battery"
-{{with .options}}{{with .device}}device = {{quote .}}
-{{end}}{{end}}{{else if eq .shows "command"}}[[block]]
-block = "custom"
-command = {{quote .options.command}}
-interval = {{.options.interval}}
-{{else if eq .shows "state"}}[[block]]
-block = "custom"
-command = {{quote (printf "show %s %s" .options.state (or .options.key .machine))}}
-{{end}}`
-
-func barHolder() Manifest {
-	place := func(bar string) string {
-		return "own-first\n${contribution:node-bar:block:bar=" + bar + ",place=resources}" +
-			"own-middle\n${contribution:node-bar:block:bar=" + bar + ",place=status}own-last\n"
-	}
-	return Manifest{Module: "a-bar", Claims: []Claim{{Name: BarSeat, Renders: map[string]string{BarKindBlock: barTemplate}}},
-		Resources: []map[string]any{
-			{"id": "bottom", "type": "file", "path": "/b", "content": place("bottom")},
-			{"id": "top", "type": "file", "path": "/t", "content": place("top")},
-		}}
-}
-
-func block(data string) SeatContribution {
-	var d map[string]any
-	if err := json.Unmarshal([]byte(data), &d); err != nil {
-		panic(err)
-	}
-	return SeatContribution{Seat: BarSeat, Kind: BarKindBlock, Data: d}
-}
-
-func composedFile(t *testing.T, r Resolution, id string) string {
-	t.Helper()
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, res := range out {
-		if res["id"] == id {
-			return res["content"].(string)
-		}
-	}
-	t.Fatalf("%s was not composed", id)
-	return ""
-}
-
-func TestABlockIsRenderedByTheHolderInItsPlaceAndOrderNamedByModule(t *testing.T) {
-	power := Manifest{Module: "power", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","shows":"battery"}`),
-		block(`{"bar":"bottom","place":"status","order":20,"shows":"command","options":{"command":"draw \"now\"","interval":5}}`),
-	}}
-	other := Manifest{Module: "another", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","order":70,"shows":"battery","options":{"device":"BAT1"}}`),
-		block(`{"bar":"top","place":"resources","shows":"command","options":{"command":"up","interval":60}}`),
-	}}
-	r := Resolution{Node: "laptop", Account: "op", Modules: []Manifest{barHolder(), power, other}}
-
-	// Ordered by order (20, 50, 70), then module order; each piece under its module's name; the
-	// command quoted so its own quotes cannot end the line.
-	want := "own-first\nown-middle\n" +
-		"# power\n[[block]]\nblock = \"custom\"\ncommand = \"draw \\\"now\\\"\"\ninterval = 5\n" +
-		"# power\n[[block]]\nblock = \"battery\"\n" +
-		"# another\n[[block]]\nblock = \"battery\"\ndevice = \"BAT1\"\n" +
-		"own-last\n"
-	if got := composedFile(t, r, "a-bar.bottom"); got != want {
-		t.Fatalf("the bottom bar is\n%s\nnot\n%s", got, want)
-	}
-	want = "own-first\n# another\n[[block]]\nblock = \"custom\"\ncommand = \"up\"\ninterval = 60\nown-middle\nown-last\n"
-	if got := composedFile(t, r, "a-bar.top"); got != want {
-		t.Fatalf("the top bar is\n%s\nnot\n%s", got, want)
-	}
-}
-
-func TestAContributionIfACapabilityIsPlacedOnlyWhereTheMachineReportsIt(t *testing.T) {
-	c := block(`{"bar":"bottom","place":"status","shows":"battery"}`)
-	c.IfCapability = "battery"
-	power := Manifest{Module: "power", Contributions: []SeatContribution{c}}
-	for _, c := range []struct {
-		caps map[string]bool
-		has  bool
-	}{{map[string]bool{"battery": true}, true}, {map[string]bool{"seat": true}, false}, {nil, false}} {
-		r := Resolution{Node: "n", Account: "op", Capabilities: c.caps, Modules: []Manifest{barHolder(), power}}
-		if bar := composedFile(t, r, "a-bar.bottom"); strings.Contains(bar, `block = "battery"`) != c.has {
-			t.Errorf("with %v: the battery placed is not %v:\n%s", c.caps, c.has, bar)
-		}
-	}
-}
-
-func TestIfACapabilityNamesOneTheNodeEngineDetectsOnAnOfferedKindOnly(t *testing.T) {
-	cases := map[string]string{
-		// A name nothing detects would leave the piece out on every machine.
-		`{"seat":"node-bar","kind":"block","if-capability":"batery","data":{"bar":"top","place":"status","shows":"battery"}}`: "which no machine reports",
-		// A kind the holder depends on is never left out for want of something.
-		`{"seat":"node-hotkeys","kind":"trigger","if-capability":"battery","content":"KEY_BATTERY 1 x"}`: "only a kind the seat offers",
-		`{"seat":"node-backup","kind":"backup","if-capability":"seat","content":"path /x"}`:              "only a kind the seat offers",
-	}
-	for c, want := range cases {
-		raw := `{"module":"power","contributions":[` + c + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: accepted, or refused without %q: %v", c, want, err)
-		}
-	}
-	for _, name := range []string{"battery", "power-meter", "seat"} {
-		if !oneOf(KnownCapabilities, name) {
-			t.Errorf("%s is not a known capability", name)
-		}
-	}
-}
-
-func TestResolveCarriesTheMachinesCapabilities(t *testing.T) {
-	node := workstation()
-	node.Capabilities["battery"] = true
-	r, err := Resolve(shelf(Manifest{Module: "a"}), []string{"a"}, node, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !r.Capabilities["battery"] || !r.Capabilities["seat"] {
-		t.Fatalf("the resolution carries %v, not the node's %v", r.Capabilities, node.Capabilities)
-	}
-}
-
-func TestAPieceTheHolderCannotRenderIsLeftOutAndNamedNotTheMachine(t *testing.T) {
-	// A shows the shape gained after the holder's template was written: built here, past the check.
-	power := Manifest{Module: "power", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","shows":"gpu"}`),
-		block(`{"bar":"bottom","place":"status","shows":"battery"}`),
-	}}
-	r := Resolution{Node: "n", Account: "op", Modules: []Manifest{barHolder(), power}}
-	c, err := r.Compose(Rendering{})
-	if err != nil {
-		t.Fatalf("one piece failed the whole machine: %v", err)
-	}
-	if len(c.Unplaced) != 1 || !strings.Contains(c.Unplaced[0], "power's node-bar:block") ||
-		!strings.Contains(c.Unplaced[0], "shows=gpu") || !strings.Contains(c.Unplaced[0], "renders nothing") {
-		t.Fatalf("unplaced: %v", c.Unplaced)
-	}
-	for _, res := range c.Resources {
-		if res["id"] == "a-bar.bottom" && !strings.Contains(res["content"].(string), `block = "battery"`) {
-			t.Fatalf("the piece beside it was lost too: %s", res["content"])
-		}
-	}
-}
-
-// A moved bar is rendered by the provisioner's client, not by the controller, so the rule that its template renders
-// every example of the shape is no longer judged here (issue 915, which also covers placementProblems not reading the
-// collected form). What the controller still owns is that the bar's files place the blocks at all: a moved bar's
-// carry the collected placement, and one that stopped placing them fails here rather than being skipped (issue 432).
-func TestTheCataloguesBarPlacesBlocksAndItsShapeCoversEveryShow(t *testing.T) {
-	holder := catalogueManifest(t, "i3status-rust")
-	s, _ := SeatNamed(BarSeat)
-	if holder.Moved {
-		placed := "${collected:contribution:" + BarSeat + ":" + BarKindBlock + ":"
-		found := false
-		for _, res := range holder.Resources {
-			if content, _ := res["content"].(string); strings.Contains(content, placed) {
-				found = true
-			}
-		}
-		if !found {
-			t.Fatalf("the catalogue's moved bar places no blocks: none of its files carries %s…}", placed)
-		}
-	} else {
-		if !placesKind(holder, s, BarKindBlock) {
-			// It places them since the catalogue's bar took the seat; a skip here hid a bar that stopped
-			// (novox/hq issue 432).
-			t.Fatal("the catalogue's bar places no blocks, so none of the shape's examples would render")
-		}
-		tmpl, err := holderTemplate(holder, s, BarKindBlock)
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, ex := range s.Receives[0].Shape.Examples {
-			out, err := renderPiece(tmpl, "example", "a-machine", ex)
-			if err != nil || !strings.Contains(out, "[[block]]") {
-				t.Errorf("the catalogue's bar renders %v as %q: %v", ex, out, err)
-			}
-		}
-	}
-	for shows := range barShows {
-		covered := false
-		for _, ex := range s.Receives[0].Shape.Examples {
-			covered = covered || ex["shows"] == shows
-		}
-		if !covered {
-			t.Errorf("the shape has no example that shows %s, so no holder is made to render it", shows)
-		}
-	}
-}
-
-func TestQuoteIsATomlBasicStringOfTheSameText(t *testing.T) {
-	for _, in := range []string{`plain`, `say "hi" \ there`, "tab\tnew\nline", "del\x7fend", "nul\x00 esc\x1b", "<&> é ☃"} {
-		q, err := quote(in)
-		if err != nil {
-			t.Fatal(err)
-		}
-		got, err := tomlBasicString(q)
-		if err != nil || got != in {
-			t.Errorf("quote(%q) = %s, which TOML reads as %q: %v", in, q, got, err)
-		}
-	}
-}
-
-// tomlBasicString reads one TOML basic string, as the TOML specification (1.0, "String") defines it:
-// any character but a quote, a backslash and the control characters U+0000–U+0008, U+000A–U+001F
-// and U+007F, which are written as escapes.
-func tomlBasicString(s string) (string, error) {
-	if len(s) < 2 || s[0] != '"' || s[len(s)-1] != '"' {
-		return "", fmt.Errorf("not quoted")
-	}
-	var b strings.Builder
-	rs := []rune(s[1 : len(s)-1])
-	for i := 0; i < len(rs); i++ {
-		r := rs[i]
-		switch {
-		case r == '"':
-			return "", fmt.Errorf("a bare quote at %d", i)
-		case r == 0x7f || (r < 0x20 && r != '\t'):
-			return "", fmt.Errorf("a bare control character %U at %d", r, i)
-		case r != '\\':
-			b.WriteRune(r)
-			continue
-		}
-		i++
-		if i >= len(rs) {
-			return "", fmt.Errorf("an escape at the end")
-		}
-		switch rs[i] {
-		case 'b':
-			b.WriteRune('\b')
-		case 't':
-			b.WriteRune('\t')
-		case 'n':
-			b.WriteRune('\n')
-		case 'f':
-			b.WriteRune('\f')
-		case 'r':
-			b.WriteRune('\r')
-		case '"':
-			b.WriteRune('"')
-		case '\\':
-			b.WriteRune('\\')
-		case 'u', 'U':
-			n := 4
-			if rs[i] == 'U' {
-				n = 8
-			}
-			if i+n > len(rs)-1 {
-				return "", fmt.Errorf("a short \\u escape")
-			}
-			v, err := strconv.ParseUint(string(rs[i+1:i+1+n]), 16, 32)
-			if err != nil {
-				return "", err
-			}
-			b.WriteRune(rune(v))
-			i += n
-		default:
-			return "", fmt.Errorf("the escape \\%c is not TOML's", rs[i])
-		}
-	}
-	return b.String(), nil
-}
-
-func TestABlockOutsideTheShapeIsRefused(t *testing.T) {
-	cases := map[string]string{
-		`{"seat":"node-bar","kind":"block","content":"[[block]]"}`:                                                                          "has no data",
-		`{"seat":"node-bar","kind":"block","content":"x","data":{"bar":"top","place":"status","shows":"battery"}}`:                          "has content",
-		`{"seat":"node-hotkeys","kind":"trigger","data":{"a":"b"}}`:                                                                         "receives trigger as text",
-		`{"seat":"node-bar","kind":"block","data":{"bar":"left","place":"status","shows":"battery"}}`:                                       `bar "left"`,
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"middle","shows":"battery"}}`:                                        `place "middle"`,
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"gpu"}}`:                                            "shows one of battery, command",
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"battery","colour":"red"}}`:                         `no field "colour"`,
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"battery","order":100}}`:                            "whole number from 0 to 99",
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"command"}}`:                                        "needs the option command",
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"battery","options":{"x":"y"}}}`:                    `no option "x"`,
-		`{"seat":"node-bar","kind":"block","data":{"bar":"top","place":"status","shows":"command","options":{"command":"c","interval":0}}}`: "seconds",
-		`{"seat":"node-bar","kind":"block","if-capability":"Has Battery","data":{"bar":"top","place":"status","shows":"battery"}}`:          "not a capability",
-	}
-	for c, want := range cases {
-		raw := `{"module":"power","contributions":[` + c + `]}`
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: accepted, or refused without %q: %v", c, want, err)
-		}
-	}
-	ok := `{"module":"power","contributions":[{"seat":"node-bar","kind":"block","if-capability":"battery",` +
-		`"data":{"bar":"bottom","place":"status","order":10,"shows":"command","options":{"command":"c","interval":5}}}]}`
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Errorf("a block in the shape was refused: %v", err)
-	}
-}
-
-func TestAHolderPlacesEveryCombinationOnceWithATemplateThatRendersEveryExample(t *testing.T) {
-	holder := func(template string, contents ...string) string {
-		var res []string
-		for i, c := range contents {
-			b, _ := json.Marshal(c)
-			res = append(res, `{"id":"f`+string(rune('a'+i))+`","type":"file","path":"/f`+string(rune('a'+i))+`","content":`+string(b)+`}`)
-		}
-		tb, _ := json.Marshal(template)
-		renders := ""
-		if template != "" {
-			renders = `,"renders":{"block":` + string(tb) + `}`
-		}
-		return `{"module":"a-bar","claims":[{"name":"node-bar"` + renders + `}],"resources":[` + strings.Join(res, ",") + `]}`
-	}
-	all := "${contribution:node-bar:block:bar=bottom,place=resources}${contribution:node-bar:block:bar=bottom,place=status}" +
-		"${contribution:node-bar:block:bar=top,place=resources}${contribution:node-bar:block:bar=top,place=status}"
-	cases := map[string]string{
-		holder(barTemplate, "${contribution:node-bar:block:bar=bottom}"):        "never places node-bar:block for bar=top,place=resources",
-		holder(barTemplate, all, "${contribution:node-bar:block:place=status}"): "for bar=bottom,place=status 2 times",
-		holder("", all): "gives no template",
-		holder(`{{if eq .shows "battery"}}b{{end}}`, all):                    "renders nothing",
-		holder(`{{.nothing}}`, all):                                          "renders nothing",
-		holder(`{{if}`, all):                                                 "does not parse",
-		holder(barTemplate, "${contribution:node-bar:block:bar=left}"+all):   "bar is one of bottom, top",
-		holder(barTemplate, "${contribution:node-bar:block:colour=red}"+all): "placed by bar, place",
-		holder(barTemplate, "${contribution:node-hotkeys:trigger:bar=top}"):  "does not claim node-hotkeys",
-	}
-	for raw, want := range cases {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s:\naccepted, or refused without %q: %v", raw, want, err)
-		}
-	}
-	for _, raw := range []string{holder(barTemplate, all), holder(barTemplate, "${contribution:node-bar:block}"),
-		// A holder that places no block at all is older than the kind, and is not refused for it.
-		holder("", "no blocks here")} {
-		if _, err := ParseManifest([]byte(raw)); err != nil {
-			t.Errorf("%s: refused: %v", raw, err)
-		}
-	}
-}
-
-func TestAnOfferedBlockMakesNoDependencyOnTheBar(t *testing.T) {
-	power := Manifest{Module: "power", Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","shows":"battery"}`),
-		{Seat: HotkeysSeat, Kind: "trigger", Content: "x"},
-	}}
-	for _, seat := range DependsOn(nil, power) {
-		if seat == BarSeat {
-			t.Fatalf("a block made the power module depend on the bar: %v", DependsOn(nil, power))
-		}
-	}
-	// And on a machine with no bar it is placed nowhere, and nothing fails.
-	r := Resolution{Node: "server", Account: "op", Capabilities: map[string]bool{"battery": true},
-		Modules: []Manifest{hotkeysHolder(), power}}
-	if _, err := r.Declaration(Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestTheBarReceivesBlocksAsData(t *testing.T) {
-	s, _ := SeatNamed(BarSeat)
-	if len(s.Receives) != 1 || s.Receives[0].Kind != BarKindBlock || s.Receives[0].Shape == nil || !s.Receives[0].Offered {
-		t.Fatalf("node-bar receives %+v", s.Receives)
-	}
-	for _, ex := range s.Receives[0].Shape.Examples {
-		if p := barBlockProblems(ex); len(p) > 0 {
-			t.Errorf("the shape's own example %v is refused: %v", ex, p)
-		}
-	}
-}
-
-func TestAStateBlockIsRenderedForThisMachineAndTheHolderIsGrantedToReadIt(t *testing.T) {
-	power := Manifest{Module: "power", State: []StateDeclaration{{Name: "draw"}}, Contributions: []SeatContribution{
-		block(`{"bar":"bottom","place":"status","shows":"state","options":{"state":"power.draw"}}`),
-	}}
-	r := Resolution{Node: "laptop", Account: "op", Modules: []Manifest{barHolder(), power}}
-	if bar := composedFile(t, r, "a-bar.bottom"); !strings.Contains(bar, `command = "show power.draw laptop"`) {
-		t.Fatalf("the block does not read this machine's key:\n%s", bar)
-	}
-	if got := ReadsGranted(barHolder(), []Manifest{barHolder(), power}, "laptop"); len(got) != 1 ||
-		got[0] != (StateRead{Read: "power.draw", Key: "laptop"}) {
-		t.Fatalf("the holder is granted %v", got)
-	}
-	// Only the holder, and only for what the modules on its machine offer.
-	if got := ReadsGranted(power, []Manifest{barHolder(), power}, "laptop"); len(got) != 0 {
-		t.Fatalf("a contributor is granted %v", got)
-	}
-	if got := ReadsGranted(barHolder(), []Manifest{barHolder()}, "laptop"); len(got) != 0 {
-		t.Fatalf("a holder alone is granted %v", got)
-	}
-}
-
-func TestAModuleOffersItsOwnStateOnly(t *testing.T) {
-	block := `{"seat":"node-bar","kind":"block","data":{"bar":"bottom","place":"status","shows":"state","options":{"state":"%s"}}}`
-	cases := map[string]string{
-		`{"module":"power","state":["draw"],"contributions":[` + fmt.Sprintf(block, "other.draw") + `]}`: "which power does not keep",
-		`{"module":"power","contributions":[` + fmt.Sprintf(block, "power.draw") + `]}`:                  "which power does not keep",
-		`{"module":"power","state":["draw"],"contributions":[` + fmt.Sprintf(block, "draw") + `]}`:       "does not name a module",
-	}
-	for raw, want := range cases {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: accepted, or refused without %q: %v", raw, want, err)
-		}
-	}
-	ok := `{"module":"power","state":["draw"],"contributions":[` + fmt.Sprintf(block, "power.draw") + `]}`
-	if _, err := ParseManifest([]byte(ok)); err != nil {
-		t.Errorf("its own state was refused: %v", err)
-	}
-}
-
-func TestPerMachineStateIsDeclaredAndKeptInItsLongForm(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"power","state":[{"name":"draw","ttl-seconds":30,"per-machine":true}]}`))
-	if err != nil || len(m.State) != 1 || !m.State[0].PerMachine {
-		t.Fatalf("%+v %v", m.State, err)
-	}
-	raw, _ := json.Marshal(StateDeclaration{Name: "draw", PerMachine: true})
-	if string(raw) != `{"name":"draw","per-machine":true}` {
-		t.Fatalf("%s", raw)
-	}
-}
diff --git a/internal/catalogue/seat_dependencies_test.go b/internal/catalogue/seat_dependencies_test.go
deleted file mode 100644
index 7c717d63..00000000
--- a/internal/catalogue/seat_dependencies_test.go
+++ /dev/null
@@ -1,277 +0,0 @@
-package catalogue
-
-import (
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0207: a module depends on the node seats that apply its resources.
-
-func res(kind, id string) map[string]any {
-	r := map[string]any{"id": id, "type": kind}
-	switch kind {
-	case "service":
-		r["unit"] = id + ".service"
-	case "package":
-		r["package"] = id
-	case "container":
-		r["image"] = id
-	case "file":
-		r["path"] = "/etc/" + id
-	}
-	return r
-}
-
-func withResources(m Manifest, rs ...map[string]any) Manifest {
-	m.Resources = rs
-	return m
-}
-
-// The three holders as to-be 42 names them, each declaring what it really does: systemd's own
-// package needs the package manager, pacman's timer needs the service manager, docker's package and
-// service need both.
-func coreThree() []Manifest {
-	return []Manifest{
-		withResources(mod("systemd", nil, nil, nil, Claim{Name: ServiceManagerSeat}), res("package", "systemd")),
-		withResources(mod("pacman", nil, nil, nil, Claim{Name: PackageManagerSeat}), res("service", "pacman-refresh")),
-		withResources(mod("docker", nil, nil, nil, Claim{Name: ContainerRuntimeSeat}),
-			res("package", "docker"), res("service", "docker")),
-	}
-}
-
-func TestADependencyIsDerivedFromEachResourceTypeThatAppliesThroughASeat(t *testing.T) {
-	cases := map[string][]string{
-		"service":   {ServiceManagerSeat},
-		"package":   {PackageManagerSeat},
-		"container": {ContainerRuntimeSeat},
-		// The host's own acts, or the mesh's: nothing in between holds a role for them.
-		"file": nil, "directory": nil, "process": nil, "archive": nil, "user": nil,
-		"action": nil, "network": nil, "access": nil,
-	}
-	for kind, want := range cases {
-		got := DependsOn(nil, withResources(mod("m", nil, nil, nil), res(kind, "x")))
-		if len(got) == 0 {
-			got = nil
-		}
-		if !reflect.DeepEqual(got, want) {
-			t.Errorf("a %s resource depends on %v, want %v", kind, got, want)
-		}
-	}
-	all := DependsOn(nil, withResources(mod("m", nil, nil, nil),
-		res("container", "a"), res("service", "b"), res("package", "c"), res("package", "d")))
-	if want := []string{ContainerRuntimeSeat, PackageManagerSeat, ServiceManagerSeat}; !reflect.DeepEqual(all, want) {
-		t.Errorf("a module of every kind depends on %v, want each seat once: %v", all, want)
-	}
-}
-
-func TestTheSeatsThatApplyResourcesAreTheMeshsOwnAtNodeScope(t *testing.T) {
-	for _, name := range []string{ServiceManagerSeat, PackageManagerSeat, ContainerRuntimeSeat} {
-		s, ok := SeatNamed(name)
-		if !ok {
-			t.Fatalf("%s is not in the mesh's set", name)
-		}
-		if s.Scope != ScopeNode {
-			t.Errorf("%s is held per %s, want per node", name, s.Scope)
-		}
-	}
-	// No verbs yet for either new seat: ADR 0207 seeds the package manager without a protocol, and
-	// the runtime's verbs wait for ADR 0166's acceptance.
-	for _, name := range []string{PackageManagerSeat, ContainerRuntimeSeat} {
-		if s, _ := SeatNamed(name); len(s.Serves)+len(s.Accepts)+len(s.Emits) > 0 {
-			t.Errorf("%s carries a protocol; ADR 0207 seeds it with none", name)
-		}
-	}
-}
-
-func TestANodeWhoseAssignmentsHoldTheSeatsResolvesWithNothingUnheld(t *testing.T) {
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"), res("service", "web-timer"))
-	cat := shelf(append(coreThree(), web)...)
-	got, err := Resolve(cat, []string{"systemd", "pacman", "docker", "web"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("a node holding all three seats reports %v", got.Unheld)
-	}
-	if _, err := AssignRefusal(cat, "workstation", []string{"systemd", "pacman", "docker"}, []string{"web"}); err != nil {
-		t.Errorf("assigning beside the three holders was refused: %v", err)
-	}
-}
-
-func TestAnAssignmentMissingAHolderIsRefusedNamingTheSeatAndItsPossibleHolders(t *testing.T) {
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"), res("service", "web-timer"))
-	cat := shelf(append(coreThree(), web)...)
-	_, err := AssignRefusal(cat, "workstation", []string{"systemd", "pacman"}, []string{"web"})
-	var refusal *Refusal
-	if !errors.As(err, &refusal) {
-		t.Fatalf("web assigned to a node without a container runtime was not refused: %v", err)
-	}
-	msg := err.Error()
-	for _, want := range []string{"web on workstation depends on " + ContainerRuntimeSeat, "docker", "ADR 0207"} {
-		if !strings.Contains(msg, want) {
-			t.Errorf("the refusal does not say %q:\n%s", want, msg)
-		}
-	}
-	// What the node does hold is not named as missing.
-	if strings.Contains(msg, "depends on "+ServiceManagerSeat) {
-		t.Errorf("the refusal names a seat systemd already holds:\n%s", msg)
-	}
-}
-
-func TestADependencyNoCatalogueModuleCanMeetIsSaidNeverRefused(t *testing.T) {
-	// No runtime module in the catalogue: refusing would stop every container's assignment until one
-	// is written, with no remedy to name — so it is said, with the switch on as with it off.
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(web)
-	for _, on := range []bool{false, true} {
-		enforceSeatDependencies = on
-		said, err := AssignRefusal(cat, "workstation", nil, []string{"web"})
-		if err != nil {
-			t.Fatalf("switch %v: a dependency nothing could meet was refused: %v", on, err)
-		}
-		if len(said) != 1 || !strings.Contains(said[0], "no module in the catalogue claims it yet") {
-			t.Errorf("switch %v: the assignment does not say what it depends on: %v", on, said)
-		}
-		if _, err := Resolve(cat, []string{"web"}, workstation(), World{}); err != nil {
-			t.Errorf("switch %v: a dependency nothing could meet refused the node: %v", on, err)
-		}
-	}
-	enforceSeatDependencies = true
-}
-
-func TestTheHoldersMutualDependenceResolvesWhenAssignedTogether(t *testing.T) {
-	cat := shelf(coreThree()...)
-	// Alone, each needs the other.
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"systemd"}); err == nil ||
-		!strings.Contains(err.Error(), "pacman") {
-		t.Errorf("systemd alone was not refused naming pacman: %v", err)
-	}
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"pacman"}); err == nil ||
-		!strings.Contains(err.Error(), "systemd") {
-		t.Errorf("pacman alone was not refused naming systemd: %v", err)
-	}
-	// Together, in one act, they meet each other — and docker meets its own seat.
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"systemd", "pacman", "docker"}); err != nil {
-		t.Errorf("the three holders assigned together were refused: %v", err)
-	}
-	got, err := Resolve(cat, []string{"systemd", "pacman"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("systemd and pacman together report %v", got.Unheld)
-	}
-}
-
-func TestStatusIsToldOfAnUnmetDependencyAndTheNodeStillResolves(t *testing.T) {
-	// Before the switch (the state the mesh ran in until every node held the three seats).
-	enforceSeatDependencies = false
-	defer func() { enforceSeatDependencies = true }()
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(append(coreThree(), web)...)
-	got, err := Resolve(cat, []string{"web"}, workstation(), World{})
-	if err != nil {
-		t.Fatalf("an unmet dependency refused the node before the switch: %v", err)
-	}
-	want := []Unheld{{Node: "workstation", Module: "web", Seat: ContainerRuntimeSeat, Holders: []string{"docker"}}}
-	if !reflect.DeepEqual(got.Unheld, want) {
-		t.Errorf("reported %+v, want %+v", got.Unheld, want)
-	}
-}
-
-func TestWithTheSwitchFlippedAnUnmetDependencyRefusesTheNode(t *testing.T) {
-	enforceSeatDependencies = true
-	defer func() { enforceSeatDependencies = true }()
-	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
-	cat := shelf(append(coreThree(), web)...)
-	_, err := Resolve(cat, []string{"web"}, workstation(), World{})
-	if err == nil || !strings.Contains(err.Error(), ContainerRuntimeSeat) || !strings.Contains(err.Error(), "docker") {
-		t.Fatalf("with the switch on, an unmet dependency gave %v", err)
-	}
-	// Never in the first pass, whose refusals take a machine off the network instead.
-	if _, err := Resolve(cat, []string{"web"}, workstation(), World{Unchecked: true}); err != nil {
-		t.Errorf("the first pass refused an unmet dependency: %v", err)
-	}
-}
-
-func TestTheFoundationsDeclarationsAreNotJudged(t *testing.T) {
-	// The private network, as the controller computes it: its tools' package and its service are
-	// the mesh's, written per node, and so are never a module's dependency.
-	network := withResources(mod("mesh-wireguard", []string{"private-network"}, nil, nil),
-		res("package", "wireguard-tools"), res("service", "overlay-up"))
-	network.Computed = "mesh-wireguard"
-	// The host, whatever it declares.
-	host := withResources(mod("mesh-host", nil, nil, nil), res("file", "launcher"), res("service", "nox-mesh-host"))
-	cat := shelf(append(coreThree(), network, host)...)
-
-	for _, m := range []Manifest{network, host} {
-		if d := DependsOn(cat, m); len(d) != 0 {
-			t.Errorf("%s, the foundation's, depends on %v", m.Module, d)
-		}
-	}
-	got, err := Resolve(cat, []string{"mesh-wireguard", "mesh-host"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Unheld) != 0 {
-		t.Errorf("the foundation on a node with no holders reports %v", got.Unheld)
-	}
-	if _, err := AssignRefusal(cat, "workstation", nil, []string{"mesh-wireguard", "mesh-host"}); err != nil {
-		t.Errorf("assigning the foundation was refused: %v", err)
-	}
-}
-
-// A module-declared seat's needs are judged exactly as a compiled seat's once were (novox/hq ADR
-// 0220, ADR 0378 §8): "mail" declares the node seat "mail-notifier" needing node-notifier, the
-// mesh's own (desktop notifications); "notifier" claims mail-notifier; "dunst" claims node-notifier,
-// as it does in the real catalogue.
-func mailNotifierAndDunst() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "mail", DefinesSeats: []SeatDeclaration{{
-			Name: "mail-notifier", Scope: ScopeNode, Needs: []string{NotifierSeat},
-		}}},
-		mod("notifier", nil, nil, nil, Claim{Name: "mail-notifier"}),
-		mod("dunst", nil, nil, nil, Claim{Name: NotifierSeat}),
-	)
-}
-
-func TestAModuleDeclaredSeatsNeedsAreJudgedLikeACompiledSeatsOnceWere(t *testing.T) {
-	cat := mailNotifierAndDunst()
-	_, err := AssignRefusal(cat, "workstation", nil, []string{"notifier"})
-	var refusal *Refusal
-	if !errors.As(err, &refusal) || !strings.Contains(err.Error(), "node-notifier") {
-		t.Fatalf("notifier assigned without dunst was not refused naming node-notifier: %v", err)
-	}
-	if _, err := AssignRefusal(cat, "workstation", []string{"dunst"}, []string{"notifier"}); err != nil {
-		t.Errorf("notifier beside dunst was refused: %v", err)
-	}
-	if err := UnassignRefusal(cat, "workstation", []string{"dunst", "notifier"}, []string{"dunst"}); err == nil ||
-		!strings.Contains(err.Error(), "node-notifier") {
-		t.Errorf("taking dunst from under notifier was not refused: %v", err)
-	}
-}
-
-func TestUnassigningTheLastHolderWhileDependentsRemainIsRefused(t *testing.T) {
-	sshd := withResources(mod("sshd", nil, nil, nil), res("service", "sshd"))
-	cat := shelf(append(coreThree(), sshd)...)
-	on := []string{"systemd", "pacman", "docker", "sshd"}
-
-	err := UnassignRefusal(cat, "workstation", on, []string{"systemd"})
-	if err == nil {
-		t.Fatal("the last service manager came off a node still running services")
-	}
-	for _, want := range []string{ServiceManagerSeat, "sshd", "pacman", "docker"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %q:\n%v", want, err)
-		}
-	}
-	// A dependent comes off freely, and the holders with everything depending on them in one act.
-	if err := UnassignRefusal(cat, "workstation", on, []string{"sshd"}); err != nil {
-		t.Errorf("a dependent's unassignment was refused: %v", err)
-	}
-	if err := UnassignRefusal(cat, "workstation", on, on); err != nil {
-		t.Errorf("unassigning everything together was refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/seat_into_test.go b/internal/catalogue/seat_into_test.go
deleted file mode 100644
index 05aae7c6..00000000
--- a/internal/catalogue/seat_into_test.go
+++ /dev/null
@@ -1,294 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-)
-
-// The control plane's own addresses follow the node's ports (novox/hq 04-ISSUES/102).
-
-func TestASeatPlaceholderAnswersWhereThisMachinePutTheHolder(t *testing.T) {
-	control := map[string]any{
-		"type": "container", "id": "server", "name": "mesh-controller",
-		"env": map[string]any{
-			"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
-			"MESH_BROKER_ADDRESS_PORT":  "${seat:mesh-broker:5671}",
-			"MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
-		},
-	}
-	with := Rendering{Seats: map[string]map[int]int{
-		"mesh-store": {5432: 6852}, "mesh-broker": {5672: 5679, 5671: 5671},
-	}}
-	if err := seatInto(control, "mesh-controller", with); err != nil {
-		t.Fatal(err)
-	}
-	env := control["env"].(map[string]any)
-	for key, want := range map[string]string{
-		"MESH_STORE_INVENTORY_PORT": "6852",
-		"MESH_BROKER_ADDRESS_PORT":  "5671",
-		"MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
-	} {
-		if env[key] != want {
-			t.Errorf("%s = %v, want %q", key, env[key], want)
-		}
-	}
-}
-
-// A seat nothing on this machine holds — or one whose holder the mesh has given no port — answers
-// with nothing, so the port genesis wrote into the connection string stands. Not the software's
-// own port: on a node given a port at genesis before the store's module exists, that would
-// override the right number with the catalogue's.
-func TestASeatTheMeshCannotPlaceAnswersWithNothing(t *testing.T) {
-	control := map[string]any{
-		"type": "container", "id": "server", "name": "mesh-controller",
-		"env": map[string]any{"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}"},
-	}
-	if err := seatInto(control, "mesh-controller", Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-	if got := control["env"].(map[string]any)["MESH_STORE_INVENTORY_PORT"]; got != "" {
-		t.Fatalf("with nothing known, the seat answered %q", got)
-	}
-	file := map[string]any{"type": "file", "content": "port=${seat:mesh-store:5432}\n"}
-	if err := seatInto(file, "x", Rendering{Seats: map[string]map[int]int{"mesh-store": {5433: 1}}}); err != nil {
-		t.Fatal(err)
-	}
-	if got := file["content"]; got != "port=\n" {
-		t.Fatalf("a port the holder does not publish answered %q", got)
-	}
-}
-
-func TestASeatPlaceholderNamingNoPortIsRefused(t *testing.T) {
-	file := map[string]any{"type": "file", "content": "${seat:mesh-store:99999}"}
-	if err := seatInto(file, "x", Rendering{}); err == nil {
-		t.Fatal("99999 was accepted as a port")
-	}
-}
-
-func TestFillingASeatLeavesTheManifestAlone(t *testing.T) {
-	env := map[string]any{"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}"}
-	manifest := map[string]any{"type": "container", "id": "server", "env": env}
-	for _, at := range []int{6852, 5432} {
-		copied := map[string]any{}
-		for k, v := range manifest {
-			copied[k] = v
-		}
-		with := Rendering{Seats: map[string]map[int]int{"mesh-store": {5432: at}}}
-		if err := seatInto(copied, "mesh-controller", with); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if env["MESH_STORE_INVENTORY_PORT"] != "${seat:mesh-store:5432}" {
-		t.Fatalf("the module's own manifest was edited: %v", env)
-	}
-}
-
-// **The control plane's own manifest, composed through the whole path.**
-//
-// The store was given 6852 and the broker's plain port 5679 (the control-node's migration, novox/hq
-// 04-ISSUES/102). The control plane's own connections are sealed at genesis with the ports genesis
-// wrote; what its container is told beside them is where this machine put the store and the
-// broker now, read from the node's settings exactly as every consumer's binding is.
-func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
-	raw, err := os.ReadFile("../../module.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the control plane's own manifest does not parse:\n%v", err)
-	}
-	// The manifest itself names them now; withSeatPorts is a no-op on it, and this holds it so.
-	for _, r := range m.Resources {
-		if r["type"] != "process" {
-			continue
-		}
-		env, _ := r["env"].(map[string]any)
-		for key, want := range SeatPorts {
-			if env[key] != want {
-				t.Errorf("module.json says %s=%v, not %q", key, env[key], want)
-			}
-		}
-	}
-	m = withSeatPorts(m)
-	control, err := m.Resolve([]Built{{
-		Name: "controller", Kind: ArtifactBundle,
-		Reference: ArtifactStoreScheme + "mesh-controller/controller@sha256:" + strings.Repeat("c", 64),
-		Digest:    "sha256:" + strings.Repeat("c", 64),
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := Resolution{Node: "anchor", Modules: []Manifest{control}}
-	needed := map[string]map[string]string{"mesh-controller": {}}
-	for name := range m.OwnSecrets {
-		needed["mesh-controller"][name] = "sealed-" + name
-	}
-	out, err := r.Declaration(Rendering{
-		Needed:        needed,
-		ArtifactStore: "anchor.internal:5100",
-		Seats: map[string]map[int]int{
-			"mesh-store":  {5432: 6852},
-			"mesh-broker": {5671: 5671, 5672: 5679, 15672: 15673},
-		},
-	})
-	if err != nil {
-		t.Fatalf("the control plane does not compose: %v", err)
-	}
-	server := fileNamed(out, "mesh-controller.controller")
-	if server == nil {
-		t.Fatalf("the control plane's process is not in the declaration: %v", out)
-	}
-	env, _ := server["env"].(map[string]any)
-	for key, want := range map[string]string{
-		"MESH_STORE_INVENTORY_PORT":   "6852",
-		"MESH_STORE_IDENTITY_PORT":    "6852",
-		"MESH_STORE_LICENCES_PORT":    "6852",
-		"MESH_BROKER_MANAGEMENT_PORT": "15673",
-		"MESH_BROKER_ADDRESS_PORT":    "5671",
-	} {
-		if env[key] != want {
-			t.Errorf("the control plane is told %s=%v; the node put it on %s", key, env[key], want)
-		}
-	}
-	if got := server["source"]; got != "anchor.internal:5100/mesh-controller/controller@sha256:"+strings.Repeat("c", 64) {
-		t.Errorf("the control plane's own bundle is fetched from %v, not routed through the store", got)
-	}
-
-	// And on a mesh where the foundation is where genesis raised it, nothing is added.
-	out, err = r.Declaration(Rendering{Needed: needed, ArtifactStore: "anchor.internal:5100"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	env, _ = fileNamed(out, "mesh-controller.controller")["env"].(map[string]any)
-	if env["MESH_STORE_INVENTORY_PORT"] != "" {
-		t.Errorf("with no settings, the control plane is told %v", env)
-	}
-}
-
-// SeatPorts is what the control plane's manifest says beside each sealed connection: the port
-// this machine put the seat's holder at (novox/hq 04-ISSUES/102).
-var SeatPorts = map[string]string{
-	"MESH_STORE_INVENTORY_PORT":   "${seat:mesh-store:5432}",
-	"MESH_STORE_IDENTITY_PORT":    "${seat:mesh-store:5432}",
-	"MESH_STORE_LICENCES_PORT":    "${seat:mesh-store:5432}",
-	"MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
-	"MESH_BROKER_ADDRESS_PORT":    "${seat:mesh-broker:5671}",
-}
-
-// withSeatPorts is the control plane's manifest with SeatPorts in its container's environment.
-//
-// **The manifest lands one commit after the code that fills it**, deliberately: a control plane
-// still running the previous build passes `${seat:…}` through unfilled, and the manifest may only
-// name the placeholder once every control plane that could compose it knows it. So the test does
-// not depend on module.json carrying these yet, and is a no-op once it does.
-func withSeatPorts(m Manifest) Manifest {
-	out := m
-	out.Resources = nil
-	for _, r := range m.Resources {
-		if r["type"] != "container" && r["type"] != "process" {
-			out.Resources = append(out.Resources, r)
-			continue
-		}
-		copied := map[string]any{}
-		for k, v := range r {
-			copied[k] = v
-		}
-		env := map[string]any{}
-		if had, ok := r["env"].(map[string]any); ok {
-			for k, v := range had {
-				env[k] = v
-			}
-		}
-		for k, v := range SeatPorts {
-			if _, said := env[k]; !said {
-				env[k] = v
-			}
-		}
-		copied["env"] = env
-		out.Resources = append(out.Resources, copied)
-	}
-	return out
-}
-
-// Where this machine reaches a mesh seat's holder (novox/hq ADR 0222, issue 190): the container
-// runtime's module tells the runtime to trust the mesh's registry without binding the store.
-
-func runtimeTrust() map[string]any {
-	return map[string]any{
-		"type": "file", "id": "daemon", "path": "/etc/docker/daemon.json", "into": "json",
-		"content": `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n",
-	}
-}
-
-func TestASeatsReachIsWhereThisMachineReachesItsHolder(t *testing.T) {
-	file := runtimeTrust()
-	with := Rendering{SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"}}
-	if err := seatInto(file, "docker", with); err != nil {
-		t.Fatal(err)
-	}
-	want := `{"live-restore": true, "insecure-registries": ["anchor.internal:5100"]}` + "\n"
-	if file["content"] != want {
-		t.Fatalf("content = %q, want %q", file["content"], want)
-	}
-
-	process := map[string]any{"type": "process", "name": "p",
-		"env": map[string]any{"REGISTRY": "${seat:mesh-artifact-store:reach}"}}
-	if err := seatInto(process, "x", with); err != nil {
-		t.Fatal(err)
-	}
-	if got := process["env"].(map[string]any)["REGISTRY"]; got != "anchor.internal:5100" {
-		t.Fatalf("an environment value was filled with %q", got)
-	}
-}
-
-// With no holder reachable, the runtime is not told to trust "": the member is dropped, and the
-// list with it when nothing else is in it.
-func TestAnUnansweredReachAddsNothingToAList(t *testing.T) {
-	file := runtimeTrust()
-	if err := seatInto(file, "docker", Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-	if got := file["content"]; got != `{"live-restore":true}`+"\n" {
-		t.Fatalf("with no store reachable, the runtime's keys are %q", got)
-	}
-
-	kept := map[string]any{"type": "file", "into": "json",
-		"content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}", "192.0.2.7:5000"]}`}
-	if err := seatInto(kept, "docker", Rendering{}); err != nil {
-		t.Fatal(err)
-	}
-	if got := kept["content"]; got != `{"insecure-registries":["192.0.2.7:5000"]}`+"\n" {
-		t.Fatalf("a list's other members were not kept: %q", got)
-	}
-}
-
-func TestAReachTheMeshDoesNotAnswerIsRefused(t *testing.T) {
-	file := map[string]any{"type": "file", "content": "${seat:mesh-store:reach}"}
-	err := seatInto(file, "x", Rendering{SeatReach: map[string]string{"mesh-store": "anchor.internal:5432"}})
-	if err == nil || !strings.Contains(err.Error(), "mesh-artifact-store") {
-		t.Fatalf("a reach the mesh does not answer was not refused by name: %v", err)
-	}
-}
-
-// Through the whole composition, as the container runtime's module declares it.
-func TestTheRuntimesTrustIsComposedFromTheSeatsReach(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{{
-		Module: "docker", Resources: []map[string]any{runtimeTrust()},
-	}}}
-	out, err := r.Declaration(Rendering{
-		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := fileNamed(out, "docker.daemon")
-	if file == nil {
-		t.Fatalf("no file in %v", out)
-	}
-	if got := file["content"]; !strings.Contains(fmt.Sprint(got), `["anchor.internal:5100"]`) {
-		t.Fatalf("the runtime's file says %q", got)
-	}
-}
diff --git a/internal/catalogue/seat_pass_test.go b/internal/catalogue/seat_pass_test.go
deleted file mode 100644
index d1bc8e06..00000000
--- a/internal/catalogue/seat_pass_test.go
+++ /dev/null
@@ -1,81 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// **A seat held once whose holder on record is assigned nowhere passes to its only claimant** (novox/hq ADR
-// 0449 §4, issue 1317).
-
-func onRecord(node, module string) []Held {
-	return []Held{{Claim: "mesh-broker", Scope: ScopeMesh, Node: node, Module: module}}
-}
-
-// 1317/AC1
-func TestASeatWhoseHolderIsAssignedNowhereIsPassedToItsOnlyClaimant(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"),
-		[]Assignment{{Node: "novox", Manifest: newBroker()}})
-	if len(said) != 0 || len(passes) != 1 {
-		t.Fatalf("the only claimant was not given the seat: passes=%v said=%v", passes, said)
-	}
-	p := passes[0]
-	if p.Seat.Name != "mesh-broker" || p.From.Module != "old-broker" || p.From.Node != "novox" ||
-		p.To.Module != "new-broker" || p.To.Node != "novox" {
-		t.Fatalf("the pass does not name the seat, the former holder and the new one: %+v", p)
-	}
-}
-
-// 1317/AC2
-func TestWithTwoClaimantsAndTheHolderGoneNothingIsPassedAndTheRefusalNamesBoth(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	passes, said := SeatsToPassOn(onRecord("novox", "gone"), []Assignment{
-		{Node: "novox", Manifest: newBroker()}, {Node: "ace", Manifest: oldBroker()}})
-	if len(passes) != 0 || len(said) != 1 {
-		t.Fatalf("two claimants: passes=%v said=%v", passes, said)
-	}
-	for _, want := range []string{"old-broker", "new-broker", "seat mesh-broker --to"} {
-		if !strings.Contains(said[0], want) {
-			t.Fatalf("the refusal does not say %q: %s", want, said[0])
-		}
-	}
-}
-
-// 1317/AC3
-func TestAHolderStillAssignedSomewhereChangesNothing(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	// Assigned on another machine than the record names: still assigned somewhere.
-	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"), []Assignment{
-		{Node: "ace", Manifest: oldBroker()}, {Node: "novox", Manifest: newBroker()}})
-	if len(passes) != 0 || len(said) != 0 {
-		t.Fatalf("a holder still assigned lost its seat: passes=%v said=%v", passes, said)
-	}
-}
-
-// 1317/AC4
-func TestWithNoClaimantTheRecordStays(t *testing.T) {
-	busSeatDelivering(t, "mesh-bus")
-	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"), []Assignment{
-		{Node: "novox", Manifest: Manifest{Module: "other"}}})
-	if len(passes) != 0 || len(said) != 0 {
-		t.Fatalf("with no claimant: passes=%v said=%v", passes, said)
-	}
-	// A claimant that cannot hold the seat (it does not provide what the seat delivers) is no claimant.
-	bad := Manifest{Module: "no-bus", Claims: []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
-	passes, said = SeatsToPassOn(onRecord("novox", "old-broker"), []Assignment{{Node: "novox", Manifest: bad}})
-	if len(passes) != 0 || len(said) != 0 {
-		t.Fatalf("a module that cannot hold the seat was passed it: passes=%v said=%v", passes, said)
-	}
-}
-
-// A replicated seat is never passed: its holders are added by an act (ADR 0223).
-func TestAReplicatedSeatIsNeverPassed(t *testing.T) {
-	record := []Held{{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "novox", Module: "gone"}}
-	resolver := Manifest{Module: "resolver", Provides: []Offer{{Name: "wildcard-resolution", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-dns-resolver", Scope: ScopeMesh}}}
-	passes, _ := SeatsToPassOn(record, []Assignment{{Node: "novox", Manifest: resolver}})
-	if len(passes) != 0 {
-		t.Fatalf("a replicated seat was passed: %v", passes)
-	}
-}
diff --git a/internal/catalogue/seat_paths_test.go b/internal/catalogue/seat_paths_test.go
deleted file mode 100644
index a6f5df50..00000000
--- a/internal/catalogue/seat_paths_test.go
+++ /dev/null
@@ -1,311 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0287 (issue 412): a seat names the paths its holder owns, a claim without them is
-// refused, and only a claimant declares a seat's path.
-
-// The starting set, exactly: node-hostname names /etc/hosts and /etc/hostname, node-uplink the resolver
-// file stepping back for node-resolver, node-resolver the resolver file, and every other seat names none.
-func TestTheSeatsThatNamePathsAreTheStartingSet(t *testing.T) {
-	want := map[string]string{
-		"node-hostname": "/etc/hosts /etc/hostname",
-		"node-uplink":   "/etc/resolv.conf>node-resolver",
-		ResolverSeat:    "/etc/resolv.conf",
-	}
-	for _, s := range DefaultSeats() {
-		var got []string
-		for _, p := range s.Paths {
-			if p.StepsBackFor != "" {
-				got = append(got, p.Path+">"+p.StepsBackFor)
-			} else {
-				got = append(got, p.Path)
-			}
-		}
-		if strings.Join(got, " ") != want[s.Name] {
-			t.Errorf("%s names %v; ADR 0287 gives it %q", s.Name, got, want[s.Name])
-		}
-	}
-}
-
-// The compiled set keeps the rules: node seats only, absolute and literal, one seat per path without
-// stepping back, and a stepping back that cannot cycle.
-func TestTheCompiledSeatPathsKeepTheRules(t *testing.T) {
-	if p := SeatPathProblems(DefaultSeats()); len(p) != 0 {
-		t.Fatalf("the compiled set breaks ADR 0287: %v", p)
-	}
-	for _, c := range []struct {
-		why  string
-		set  []Seat
-		want string
-	}{
-		{"a mesh seat naming a path", []Seat{{Name: "mesh-x", Scope: ScopeMesh, Paths: []SeatPath{{Path: "/etc/x"}}}},
-			"only a node seat names paths"},
-		{"a placeholder", []Seat{{Name: "node-x", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/${setting:x}"}}}},
-			"placeholder"},
-		{"a relative path", []Seat{{Name: "node-x", Scope: ScopeNode, Paths: []SeatPath{{Path: "etc/x"}}}},
-			"not a clean absolute path"},
-		{"two owners", []Seat{
-			{Name: "node-a", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/x"}}},
-			{Name: "node-b", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/x"}}}}, "no two seats name one path"},
-		{"a cycle", []Seat{
-			{Name: "node-a", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/x", StepsBackFor: "node-b"}}},
-			{Name: "node-b", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/x", StepsBackFor: "node-a"}}}},
-			"does not own that path itself"},
-		{"stepping back for nobody", []Seat{
-			{Name: "node-a", Scope: ScopeNode, Paths: []SeatPath{{Path: "/etc/x", StepsBackFor: "node-z"}}}},
-			"not a node seat"},
-	} {
-		if got := strings.Join(SeatPathProblems(c.set), "; "); !strings.Contains(got, c.want) {
-			t.Errorf("%s: %q does not say %q", c.why, got, c.want)
-		}
-	}
-}
-
-// What the store's rows carry is never the paths: a row read back keeps the compiled ones.
-func TestTheSeatPathsSurviveTheStoresRows(t *testing.T) {
-	before := seats
-	t.Cleanup(func() { seats = before })
-	UseSeats([]Seat{{Name: "node-hostname", Scope: ScopeNode}})
-	s, _ := SeatNamed("node-hostname")
-	if len(s.Paths) != 2 {
-		t.Fatalf("node-hostname read back from its row names %v", s.Paths)
-	}
-}
-
-func hostnameSeat(t *testing.T) Seat {
-	t.Helper()
-	s, ok := SeatNamed("node-hostname")
-	if !ok {
-		t.Fatal("no node-hostname seat")
-	}
-	return s
-}
-
-func hostnameHolder(resources ...map[string]any) Manifest {
-	return Manifest{Module: "names", Version: "1", Claims: []Claim{{Name: "node-hostname", Scope: ScopeNode,
-		Serves: []string{"entries", "add", "remove"}}}, Resources: resources}
-}
-
-// A holder declares every path its seat names, as a resource or as a file the mesh renders for it, or
-// CanHold refuses it naming the seat and each missing path — the judgement registration and handover share.
-func TestAClaimWithoutTheSeatsPathsIsRefused(t *testing.T) {
-	seat := hostnameSeat(t)
-	hosts := map[string]any{"id": "hosts", "type": "file", "path": "/etc/hosts", "content": "x"}
-	name := map[string]any{"id": "name", "type": "file", "path": "/etc/hostname", "content": "x"}
-
-	if err := CanHold(hostnameHolder(hosts, name), seat); err != nil {
-		t.Errorf("a holder declaring both paths as resources was refused: %v", err)
-	}
-	rendered := hostnameHolder(hosts)
-	rendered.Facts = map[string]RosterFile{"name": {Path: "/etc/hostname", Template: "{{.Node}}\n"}}
-	if err := CanHold(rendered, seat); err != nil {
-		t.Errorf("a holder declaring a path as a file the mesh renders was refused: %v", err)
-	}
-	err := CanHold(hostnameHolder(), seat)
-	if err == nil {
-		t.Fatal("a holder declaring neither path was accepted")
-	}
-	for _, want := range []string{"node-hostname", "/etc/hosts", "/etc/hostname", "ADR 0287"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %s: %v", want, err)
-		}
-	}
-	// A file under the operator's home is placed per account: it is not the machine's path.
-	home := hostnameHolder(hosts)
-	home.Facts = map[string]RosterFile{"name": {Path: "/etc/hostname", Home: true, Template: "x"}}
-	if err := CanHold(home, seat); err == nil {
-		t.Error("a file in the operator's home counted as the machine's /etc/hostname")
-	}
-	// At registration, the same refusal.
-	if got := strings.Join(CatalogueProblems(Shelf{"names": hostnameHolder(hosts)}), "; "); !strings.Contains(got,
-		"does not declare /etc/hostname") {
-		t.Errorf("registration let a holder without /etc/hostname through: %q", got)
-	}
-}
-
-// Only a claimant declares a seat's path: a module claiming no seat that names /etc/hosts and declaring
-// it is refused at registration naming the seat; the uplink's holder and the resolver's both declaring
-// the resolver file are each a claimant of a seat naming it. Reading a seat's path is access, and allowed.
-func TestOnlyAClaimantDeclaresASeatsPath(t *testing.T) {
-	stranger := Manifest{Module: "stranger", Version: "1", Resources: []map[string]any{
-		{"id": "hosts", "type": "file", "path": "/etc/hosts", "into": "block", "content": "10.0.0.1 x\n"}}}
-	got := strings.Join(CatalogueProblems(Shelf{"stranger": stranger}), "; ")
-	if !strings.Contains(got, `stranger declares the path "/etc/hosts", which the seat node-hostname names`) {
-		t.Errorf("a module declaring /etc/hosts without claiming node-hostname was not refused: %q", got)
-	}
-	// However the path is spelled (novox/hq issue 412 review).
-	unclean := Manifest{Module: "unclean", Version: "1", Resources: []map[string]any{
-		{"id": "hosts", "type": "file", "path": "/etc/../etc/hosts", "content": "10.0.0.1 x\n"}}}
-	if got := strings.Join(CatalogueProblems(Shelf{"unclean": unclean}), "; "); !strings.Contains(got, "node-hostname") {
-		t.Errorf("/etc/../etc/hosts from a module not claiming node-hostname was not refused: %q", got)
-	}
-	reader := Manifest{Module: "reader", Version: "1", Accesses: []Access{{ID: "hosts", Path: "/etc/hosts"}}}
-	if got := CatalogueProblems(Shelf{"reader": reader}); len(got) != 0 {
-		t.Errorf("reading /etc/hosts was refused: %v", got)
-	}
-	uplink := Manifest{Module: "uplink", Version: "1", Claims: []Claim{{Name: "node-uplink", Scope: ScopeNode}},
-		Facts: map[string]RosterFile{"resolvers": {Path: ResolverFile, Template: "nameserver 10.42.0.1\n"}}}
-	resolver := localResolver()
-	resolver.Claims[0].Serves = []string{"routes", "route", "unroute"}
-	if got := CatalogueProblems(Shelf{"uplink": uplink, resolver.Module: resolver}); len(got) != 0 {
-		t.Errorf("the uplink's holder and the resolver's declaring the resolver file were refused: %v", got)
-	}
-}
-
-// A module's own seat names paths under the same rules: a node seat only, literal, and none another seat
-// names — the second declaration loses. Its holder declares them, as a mesh seat's does.
-func TestAModulesOwnSeatNamesPathsUnderTheSameRules(t *testing.T) {
-	meshScoped := Manifest{Module: "a", Version: "1", DefinesSeats: []SeatDeclaration{
-		{Name: "a-seat", Paths: []string{"/etc/a"}}}}
-	if got := strings.Join(declaredSeatProblems(meshScoped), "; "); !strings.Contains(got, "only a node seat names paths") {
-		t.Errorf("a module's mesh seat naming a path was accepted: %q", got)
-	}
-	placeholder := Manifest{Module: "a", Version: "1", DefinesSeats: []SeatDeclaration{
-		{Name: "a-seat", Scope: ScopeNode, Paths: []string{"${dir:state}/a"}}}}
-	if got := strings.Join(declaredSeatProblems(placeholder), "; "); !strings.Contains(got, "placeholder") {
-		t.Errorf("a module's seat naming a path with a placeholder was accepted: %q", got)
-	}
-
-	taken := Manifest{Module: "b", Version: "1", DefinesSeats: []SeatDeclaration{
-		{Name: "b-seat", Scope: ScopeNode, Paths: []string{"/etc/hosts"}}}}
-	if got := strings.Join(CatalogueProblems(Shelf{"b": taken}), "; "); !strings.Contains(got,
-		`b declares the seat b-seat naming the path "/etc/hosts", which node-hostname already names`) {
-		t.Errorf("a module's seat naming /etc/hosts was accepted: %q", got)
-	}
-
-	own := Manifest{Module: "c", Version: "1",
-		DefinesSeats: []SeatDeclaration{{Name: "c-seat", Scope: ScopeNode, Paths: []string{"/etc/c.conf"}}},
-		Claims:       []Claim{{Name: "c-seat", Scope: ScopeNode}}}
-	if got := strings.Join(CatalogueProblems(Shelf{"c": own}), "; "); !strings.Contains(got,
-		"c claims c-seat but does not declare /etc/c.conf") {
-		t.Errorf("a holder of a module's seat without its path was accepted: %q", got)
-	}
-	own.Resources = []map[string]any{{"id": "conf", "type": "file", "path": "/etc/c.conf", "content": "x"}}
-	if got := CatalogueProblems(Shelf{"c": own}); len(got) != 0 {
-		t.Errorf("a holder declaring its own seat's path was refused: %v", got)
-	}
-	other := Manifest{Module: "d", Version: "1", Resources: []map[string]any{
-		{"id": "conf", "type": "file", "path": "/etc/c.conf", "content": "x"}}}
-	if got := strings.Join(CatalogueProblems(Shelf{"c": own, "d": other}), "; "); !strings.Contains(got,
-		`d declares the path "/etc/c.conf", which the seat c-seat names`) {
-		t.Errorf("a module not claiming c-seat declared its path: %q", got)
-	}
-}
-
-type writesHosts struct{}
-
-func (writesHosts) Resources(string) ([]map[string]any, bool, error) {
-	return []map[string]any{{"id": "hosts", "type": "file", "path": "/etc/hosts", "into": "block",
-		"content": "10.42.0.1 anchor\n"}}, true, nil
-}
-
-// The controller is bound too: what it generates for a machine on a seat's path is refused at composition.
-func TestAGeneratedResourceOnASeatsPathIsRefused(t *testing.T) {
-	r := Resolution{Node: "workstation", Modules: []Manifest{
-		{Module: "mesh-names", Computed: "mesh-names"},
-	}}
-	_, err := r.Declaration(Rendering{Generators: map[string]Generator{"mesh-names": writesHosts{}}})
-	if err == nil {
-		t.Fatal("a generated resource on /etc/hosts was composed")
-	}
-	for _, want := range []string{"mesh-names", "/etc/hosts", "node-hostname"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("the refusal does not name %s: %v", want, err)
-		}
-	}
-}
-
-// Who owns a seat's path on a machine: the seat naming it and its holder there, with the stepping back
-// applied — the resolver's holder where node-resolver is held, else the uplink's.
-func TestPathOwnersApplyTheSteppingBack(t *testing.T) {
-	held := []Held{
-		{Claim: "node-uplink", Scope: ScopeNode, Node: "laptop", Module: "networkmanager"},
-		{Claim: ResolverSeat, Scope: ScopeNode, Node: "laptop", Module: "systemd-resolved"},
-		{Claim: "node-uplink", Scope: ScopeNode, Node: "server", Module: "systemd-networkd"},
-		{Claim: "node-hostname", Scope: ScopeNode, Node: "server", Module: "hostname"},
-	}
-	var got []string
-	for _, o := range PathOwners(Seats(), held) {
-		got = append(got, o.Path+" "+o.Node+" "+o.Seat+" "+o.Module)
-	}
-	want := []string{
-		"/etc/hostname server node-hostname hostname",
-		"/etc/hosts server node-hostname hostname",
-		"/etc/resolv.conf laptop node-resolver systemd-resolved",
-		"/etc/resolv.conf server node-uplink systemd-networkd",
-	}
-	if strings.Join(got, "\n") != strings.Join(want, "\n") {
-		t.Errorf("the owners are\n%s\nnot\n%s", strings.Join(got, "\n"), strings.Join(want, "\n"))
-	}
-}
-
-// The stepping back comes from the seat, and is of a rendered file only: an uplink holder declaring the
-// resolver file as a resource beside a node-resolver holder is two writers of one path, refused when the
-// machine is resolved — never composed twice — as before the seat named its paths.
-func TestAnUplinkDeclaringTheResolverFileAsAResourceIsRefusedBesideTheResolver(t *testing.T) {
-	shelf := resolverShelf(t)
-	uplink := shelf["systemd-networkd"]
-	uplink.Facts = nil
-	uplink.Resources = append(append([]map[string]any(nil), uplink.Resources...),
-		map[string]any{"id": "resolvers", "type": "file", "path": ResolverFile, "content": "nameserver 10.42.0.1\n"})
-	shelf["systemd-networkd"] = uplink
-	shelf["local-resolver"] = localResolver()
-	_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "local-resolver"}, splitDNSLaptop(), World{})
-	if err == nil || !strings.Contains(err.Error(), `both declare the path "/etc/resolv.conf"`) {
-		t.Fatalf("an uplink declaring the resolver file as a resource beside the resolver was not refused: %v", err)
-	}
-	// Its rendered file steps back, by the seat's definition, and nothing else of it does.
-	rendered := Manifest{Module: "uplink", Version: "1", Claims: []Claim{{Name: "node-uplink"}},
-		Facts: map[string]RosterFile{"resolvers": {Path: "/etc//resolv.conf", Template: "x"},
-			"other": {Path: "/etc/uplink.conf", Template: "x"}}}
-	got := stepsBack(rendered, []Manifest{rendered, localResolver()})
-	if len(got.Facts) != 1 || got.Facts["other"].Path == "" {
-		t.Errorf("the uplink's holder renders %v beside the resolver", got.Facts)
-	}
-}
-
-// A path is compared as the machine writes it: cleaned. Each spelling of /etc/hosts is /etc/hosts.
-func TestAnUncleanSpellingOfASeatsPathIsTheSeatsPath(t *testing.T) {
-	for _, spelled := range []string{"/etc//hosts", "/etc/./hosts", "/etc/../etc/hosts", "/etc/hosts/"} {
-		stranger := Manifest{Module: "stranger", Version: "1", Resources: []map[string]any{
-			{"id": "hosts", "type": "file", "path": spelled, "content": "10.0.0.1 x\n"}}}
-		if got := strings.Join(CatalogueProblems(Shelf{"stranger": stranger}), "; "); !strings.Contains(got,
-			`stranger declares the path "/etc/hosts", which the seat node-hostname names`) {
-			t.Errorf("%s from a module not claiming node-hostname was not refused: %q", spelled, got)
-		}
-		holder := hostnameHolder(map[string]any{"id": "hosts", "type": "file", "path": spelled, "content": "x"},
-			map[string]any{"id": "name", "type": "file", "path": "/etc/hostname", "content": "x"})
-		if err := CanHold(holder, hostnameSeat(t)); err != nil {
-			t.Errorf("a holder declaring %s was refused: %v", spelled, err)
-		}
-	}
-}
-
-// A seat names a role's own path, never the root or a top-level directory.
-func TestASeatNamesNoRootOrTopLevelDirectory(t *testing.T) {
-	for _, p := range []string{"/", "/etc"} {
-		m := Manifest{Module: "a", Version: "1", DefinesSeats: []SeatDeclaration{
-			{Name: "a-seat", Scope: ScopeNode, Paths: []string{p}}}}
-		if got := strings.Join(declaredSeatProblems(m), "; "); !strings.Contains(got, "top-level directory") {
-			t.Errorf("a module's seat naming %s was accepted: %q", p, got)
-		}
-	}
-}
-
-// The catalogue as it is passes: no holder of a seat naming a path is missing one, and nobody else
-// declares one.
-func TestTheCataloguePassesTheSeatPathRules(t *testing.T) {
-	shelf := Shelf{}
-	for _, m := range theCatalogue(t) {
-		shelf[m.Module] = m
-	}
-	for _, p := range CatalogueProblems(shelf) {
-		if strings.Contains(p, "ADR 0287") {
-			t.Errorf("the catalogue breaks ADR 0287: %s", p)
-		}
-	}
-}
diff --git a/internal/catalogue/seats_declared_test.go b/internal/catalogue/seats_declared_test.go
deleted file mode 100644
index 33b3ba6c..00000000
--- a/internal/catalogue/seats_declared_test.go
+++ /dev/null
@@ -1,209 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-func problemsFor(t *testing.T, shelf Shelf) string {
-	t.Helper()
-	return strings.Join(CatalogueProblems(shelf), "; ")
-}
-
-func telegram() Manifest {
-	return Manifest{Module: "telegram", Tools: []string{"status"}, DefinesSeats: []SeatDeclaration{{
-		Name: "telegram-sender", Scope: ScopeMesh,
-		Accepts: []string{"send"}, Emits: []string{"delivered", "failed"}, Serves: []Verb{{Name: "status"}},
-	}}, Claims: []Claim{{Name: "telegram-sender", Scope: ScopeMesh}}}
-}
-
-// The whole point: a module contributes a capability without the mesh being changed.
-func TestAModuleDeclaresItsOwnSeatAndHoldsIt(t *testing.T) {
-	shop := Manifest{Module: "shop", Uses: []string{"telegram-sender"}}
-	if got := problemsFor(t, Shelf{"telegram": telegram(), "shop": shop}); got != "" {
-		t.Fatalf("a declared seat and its caller were refused: %s", got)
-	}
-}
-
-// The prefix is the reservation rule, so there is no list to maintain and none to drift.
-func TestAModuleCannotDeclareAMeshSeat(t *testing.T) {
-	for _, n := range []string{"mesh-broker", "mesh-anything", "mesh-store"} {
-		m := Manifest{Module: "impostor", DefinesSeats: []SeatDeclaration{{Name: n, Accepts: []string{"x"}}}}
-		got := strings.Join(declaredSeatProblems(m), "; ")
-		if !strings.Contains(got, "reserved to the mesh") {
-			t.Fatalf("%q was accepted as a module's seat: %q", n, got)
-		}
-	}
-}
-
-// A seat name meaning two protocols is the failure nobody could diagnose afterwards.
-func TestTwoModulesCannotDeclareTheSameSeat(t *testing.T) {
-	other := Manifest{Module: "aardvark", DefinesSeats: []SeatDeclaration{{
-		Name: "telegram-sender", Scope: ScopeMesh, Accepts: []string{"something-else"}}}}
-	got := problemsFor(t, Shelf{"telegram": telegram(), "aardvark": other})
-	if !strings.Contains(got, "already declares") {
-		t.Fatalf("both declarations stood: %s", got)
-	}
-	// The first declarer keeps it; only the second is refused.
-	if strings.Count(got, "already declares") != 1 {
-		t.Fatalf("expected exactly one refusal: %s", got)
-	}
-}
-
-// Where ADR 0110's guarantee lands under a derived set: a typo is refused, not resolved to
-// nothing at runtime.
-func TestUsingASeatNobodyDeclaresIsRefused(t *testing.T) {
-	shop := Manifest{Module: "shop", Uses: []string{"telegram-sendr"}}
-	got := problemsFor(t, Shelf{"telegram": telegram(), "shop": shop})
-	if !strings.Contains(got, "telegram-sendr") || !strings.Contains(got, "no module declares") {
-		t.Fatalf("a misspelled seat was accepted: %s", got)
-	}
-}
-
-// A holder that does not answer what the seat promises is a caller's timeout, found here instead.
-func TestAHolderMustServeWhatItsSeatPromises(t *testing.T) {
-	m := telegram()
-	m.Tools = nil // declares the seat, serves none of it
-	got := problemsFor(t, Shelf{"telegram": m})
-	if !strings.Contains(got, "does not serve status") {
-		t.Fatalf("a holder was accepted that answers nothing its seat promises: %s", got)
-	}
-}
-
-// The claim may say what it serves for the role instead, when the module's own tools are not the
-// seat's verbs (ADR 0160).
-func TestAClaimMayNameWhatItServesForTheSeat(t *testing.T) {
-	m := telegram()
-	m.Tools = []string{"telegram_send"}
-	m.Claims = append([]Claim(nil), m.Claims...)
-	for i := range m.Claims {
-		if m.Claims[i].Name == "telegram-sender" {
-			m.Claims[i].Serves = []string{"status"}
-		}
-	}
-	if got := problemsFor(t, Shelf{"telegram": m}); strings.Contains(got, "does not serve") {
-		t.Fatalf("a claim naming the seat's verb was refused: %s", got)
-	}
-}
-
-// A seat with no protocol is a marker: which module is this node's showcase, or its packet filter.
-// Most node-scoped seats are markers, so refusing one would refuse the majority of the set.
-func TestASeatWithoutAProtocolIsAMarkerNotAMistake(t *testing.T) {
-	m := Manifest{Module: "vague", DefinesSeats: []SeatDeclaration{{Name: "something", Scope: ScopeNode}}}
-	if got := strings.Join(declaredSeatProblems(m), "; "); got != "" {
-		t.Fatalf("a marker seat was refused: %s", got)
-	}
-}
-
-// A claim at the wrong scope is a different seat than the one declared.
-func TestAClaimMustMatchTheDeclaredScope(t *testing.T) {
-	m := telegram()
-	m.Claims = []Claim{{Name: "telegram-sender", Scope: ScopeNode}}
-	got := problemsFor(t, Shelf{"telegram": m})
-	if !strings.Contains(got, "scope") {
-		t.Fatalf("a claim at the wrong scope was accepted: %s", got)
-	}
-}
-
-// The mesh's own seats still work, and are not shadowed by the derived half.
-func TestTheMeshsOwnSeatsAreStillClaimable(t *testing.T) {
-	// It delivers the bus, so its holder provides the bus — the rule this check now enforces.
-	m := Manifest{Module: "nats",
-		Provides: []Offer{{Name: "mesh-bus", Scope: ScopeMesh}},
-		Claims:   []Claim{{Name: "mesh-broker", Scope: ScopeMesh}}}
-	if got := problemsFor(t, Shelf{"nats": m}); got != "" {
-		t.Fatalf("a mesh seat was refused by the derived check: %s", got)
-	}
-}
-
-// Only a node seat may carry needs (novox/hq ADR 0378 §8): a per-mesh seat's holder is not on any
-// one node to depend on anything beside it there.
-func TestOnlyANodeSeatMayCarryNeeds(t *testing.T) {
-	m := Manifest{Module: "mail", DefinesSeats: []SeatDeclaration{{
-		Name: "mail-notifier", Scope: ScopeMesh, Needs: []string{"node-notifier"}}}}
-	got := strings.Join(declaredSeatProblems(m), "; ")
-	if !strings.Contains(got, "needing") || !strings.Contains(got, "node seat") {
-		t.Fatalf("a mesh-scope seat's needs were accepted: %q", got)
-	}
-}
-
-// A seat needing itself names nothing (novox/hq ADR 0378 §8).
-func TestASeatCannotNeedItself(t *testing.T) {
-	m := Manifest{Module: "mail", DefinesSeats: []SeatDeclaration{{
-		Name: "mail-notifier", Scope: ScopeNode, Needs: []string{"mail-notifier"}}}}
-	got := strings.Join(declaredSeatProblems(m), "; ")
-	if !strings.Contains(got, "needing itself") {
-		t.Fatalf("a seat needing itself was accepted: %q", got)
-	}
-}
-
-// A need naming nothing node-scope — undeclared, or declared at another scope — is the whole
-// catalogue's to say (novox/hq ADR 0378 §8).
-func TestANeedMustNameANodeSeatSomewhereInTheCatalogue(t *testing.T) {
-	mail := Manifest{Module: "mail", DefinesSeats: []SeatDeclaration{{
-		Name: "mail-notifier", Scope: ScopeNode, Needs: []string{"desk-beeper"}}}}
-
-	// Nobody declares desk-beeper at all.
-	got := problemsFor(t, Shelf{"mail": mail})
-	if !strings.Contains(got, "desk-beeper") || !strings.Contains(got, "no module declares") {
-		t.Fatalf("needing an undeclared seat was accepted: %q", got)
-	}
-
-	// Declared, but at mesh scope: still not a node seat to hold beside it.
-	notNode := Manifest{Module: "dunst", DefinesSeats: []SeatDeclaration{{Name: "desk-beeper", Scope: ScopeMesh}}}
-	got = problemsFor(t, Shelf{"mail": mail, "dunst": notNode})
-	if !strings.Contains(got, "desk-beeper") || !strings.Contains(got, "not a node seat") {
-		t.Fatalf("needing a mesh-scope seat was accepted: %q", got)
-	}
-
-	// Declared at node scope: accepted.
-	dunst := Manifest{Module: "dunst", DefinesSeats: []SeatDeclaration{{Name: "desk-beeper", Scope: ScopeNode}}}
-	if got := problemsFor(t, Shelf{"mail": mail, "dunst": dunst}); got != "" {
-		t.Fatalf("needing a node seat another module declares was refused: %q", got)
-	}
-}
-
-// A refusal that reorders itself between runs is a refusal nobody can diff.
-func TestTheProblemsAreStable(t *testing.T) {
-	shelf := Shelf{"telegram": telegram(), "shop": {Module: "shop", Uses: []string{"nope"}},
-		"other": {Module: "other", Uses: []string{"also-nope"}}}
-	first, second := problemsFor(t, shelf), problemsFor(t, shelf)
-	if first != second {
-		t.Fatalf("unstable:\n%s\n%s", first, second)
-	}
-}
-
-// **A build machine has no store, so it may not judge a seat.** The set is data the control plane
-// owns (novox/hq ADR 0122), and `ParseManifest` runs on the build machine too, against whatever set
-// that binary was compiled with. When the two disagreed, a valid holder of the bus seat was refused
-// mid-rollout — the compiled row said the seat delivered one provision, the store's row said
-// another, and the build failed on the copy rather than the truth. The parser judges the manifest;
-// the seat set judges the claim, where it is loaded.
-func TestTheParserDoesNotJudgeWhatOnlyTheStoreKnows(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-
-	// A store whose bus seat delivers something this module does provide.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
-	raw := []byte(`{"module":"a-bus","version":"1",` +
-		`"provides":[{"name":"mesh-bus","scope":"mesh"}],` +
-		`"claims":[{"name":"mesh-broker","scope":"mesh"}]}`)
-
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the parser refused a claim only the seat set can judge: %v", err)
-	}
-	if got := CatalogueProblems(Shelf{m.Module: m}); len(got) != 0 {
-		t.Fatalf("a holder that provides what the store says the seat delivers was refused: %v", got)
-	}
-
-	// And with the store saying the seat delivers something else, registration is what refuses it.
-	UseSeats([]Seat{{Name: "mesh-broker", Scope: ScopeMesh, Delivers: "other-bus", Decision: "test"}})
-	if _, err := ParseManifest(raw); err != nil {
-		t.Fatalf("the parser judged it the second time: %v", err)
-	}
-	got := strings.Join(CatalogueProblems(Shelf{m.Module: m}), "; ")
-	if !strings.Contains(got, `does not provide "other-bus"`) {
-		t.Fatalf("registration did not refuse a holder that cannot answer for the seat: %q", got)
-	}
-}
diff --git a/internal/catalogue/seats_test.go b/internal/catalogue/seats_test.go
deleted file mode 100644
index beceaabb..00000000
--- a/internal/catalogue/seats_test.go
+++ /dev/null
@@ -1,340 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// Defends novox/hq ADR 0110: a seat is a module assignment from a closed set.
-
-// The set is closed, and changing it is a decision.
-//
-// **The count is asserted, and every entry names the record that made it a seat**, so the next
-// person changing the set finds the argument rather than a number to edit — the pattern the host's
-// vocabulary test follows. If this fails because a seat was added, the fix is a record in novox/hq
-// and a row in to-be 26, not a new number here.
-func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
-	// A seat a later record extends names both, "novox/hq ADR 0166, ADR 0207": the one that defined
-	// it and the one that seeded it.
-	record := regexp.MustCompile(`^novox/hq ADR \d{4}(, ADR \d{4})*$`)
-	seen := map[string]bool{}
-	delivered := map[string]string{}
-	for _, s := range Seats() {
-		if seen[s.Name] {
-			t.Errorf("%s is in the set twice", s.Name)
-		}
-		seen[s.Name] = true
-		if !record.MatchString(s.Decision) {
-			t.Errorf("%s names %q as its decision; every seat names the record that made it one",
-				s.Name, s.Decision)
-		}
-		switch s.Scope {
-		case ScopeNode, ScopeSite, ScopeMesh:
-		default:
-			t.Errorf("%s is held per %q, which is not a scope", s.Name, s.Scope)
-		}
-		if s.Delivers != "" {
-			// Two seats answering for one provision would put the question "which one?" back,
-			// which is the question a seat exists to answer.
-			if other, twice := delivered[s.Delivers]; twice {
-				t.Errorf("%s and %s both deliver %q", other, s.Name, s.Delivers)
-			}
-			delivered[s.Delivers] = s.Name
-		}
-	}
-	// Forty-five with node-files (novox/hq ADR 0394); forty-four again once node-reads goes.
-	// Forty-four with node-provisioner (novox/hq ADR 0349 clause 3); forty-three with mesh-provisioner (novox/hq ADR 0349 clause 3); forty-two with mesh-config (novox/hq ADR 0348 §9); forty-one with node-reads (novox/hq ADR 0310); forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
-	// into node-uplink (novox/hq ADR 0223); thirty-seven
-	// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
-	// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
-	// thirty-six with mesh-dns-resolver (novox/hq ADR 0194) and node-hosts-file (ADR 0199, now
-	// node-hostname); thirty-four
-	// with node-hotkeys (ADR 0212); thirty-three with node-power (ADR 0211); thirty-two since the
-	// graphical session's eleven (ADR 0208); twenty-one with node-package-manager and
-	// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
-	// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
-	// mesh-build-machine row goes, when no registered manifest claims it.
-	if len(Seats()) != 45 {
-		t.Errorf("the mesh defines %d seats rather than 45; the set is closed, so a change here is "+
-			"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
-	}
-}
-
-// novox/hq ADR 0117: a machine's uplink is a seat, held per machine, and delivers nothing.
-//
-// **Nothing, because nothing may be required of it.** A holder only keeps its network manager from
-// contradicting the mesh; a requirement resolving to it would make the manager the mesh's answer
-// for something, and the manager's link is the one thing the mesh must never be able to break.
-func TestTheUplinkIsANodeSeatThatDeliversNothing(t *testing.T) {
-	seat, known := SeatNamed("node-uplink")
-	if !known {
-		t.Fatalf("the uplink is not a seat; the seats are: %s", seatNames())
-	}
-	if seat.Scope != ScopeNode || seat.Delivers != "" || seat.Decision != "novox/hq ADR 0117" {
-		t.Fatalf("the uplink is %+v, not a node seat delivering nothing by ADR 0117", seat)
-	}
-	// And a manager's module can hold it without providing anything.
-	raw := []byte(`{"module":"networkmanager","version":"1","claims":[{"name":"node-uplink","scope":"node"}]}`)
-	if _, err := ParseManifest(raw); err != nil {
-		t.Fatalf("a network manager's module could not hold the uplink: %v", err)
-	}
-}
-
-func claimed(claims string) []byte {
-	return []byte(`{"module":"thing","version":"1","provides":[{"name":"npm-package-registry","scope":"mesh"}],"claims":` + claims + `}`)
-}
-
-// **The refusal moved, it did not go** (novox/hq ADR 0118, superseding 0110). A module may now
-// declare its own seats, so whether a claimed seat exists is a fact about the *catalogue* and not
-// about the manifest in front of the parser: a claim on a seat another registered module declares
-// is perfectly good, and the parser cannot tell the two cases apart. So the parser accepts it and
-// registration refuses it — the same guarantee, at the same moment work would otherwise start,
-// from a set nobody maintains by hand.
-func TestAClaimOnASeatNobodyDeclaresIsRefusedAtRegistration(t *testing.T) {
-	m, err := ParseManifest(claimed(`[{"name":"the-anything","scope":"node"}]`))
-	if err != nil {
-		t.Fatalf("the parser judged a claim it cannot judge alone: %v", err)
-	}
-
-	problems := CatalogueProblems(Shelf{m.Module: m})
-	if len(problems) == 0 {
-		t.Fatal("a module invented a seat by claiming it, and registration allowed it")
-	}
-	joined := strings.Join(problems, "; ")
-	if !strings.Contains(joined, "the-anything") || !strings.Contains(joined, "no module declares") {
-		t.Fatalf("the refusal does not say the seat is nobody's: %v", problems)
-	}
-}
-
-// And the same claim is fine once something declares that seat, which is the case the parser
-// could not have distinguished.
-func TestAClaimOnASeatAnotherModuleDeclaresIsAccepted(t *testing.T) {
-	claimant, err := ParseManifest(claimed(`[{"name":"the-anything","scope":"node"}]`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	declarer := Manifest{Module: "someone", DefinesSeats: []SeatDeclaration{
-		{Name: "the-anything", Scope: ScopeNode, Accepts: []string{"work"}},
-	}}
-	if problems := CatalogueProblems(Shelf{claimant.Module: claimant, "someone": declarer}); len(problems) != 0 {
-		t.Fatalf("a claim on a declared seat was refused: %v", problems)
-	}
-}
-
-// A module may define its own seat and claim it — the mesh enforces exclusivity without knowing
-// what it means (novox/hq ADR 0121). But it may not define one in the mesh's own namespace.
-func TestAModuleDefinesAndClaimsItsOwnSeat(t *testing.T) {
-	ok := []byte(`{"module":"showcase","version":"1","seats":[{"name":"the-showcase","scope":"node"}],` +
-		`"claims":[{"name":"the-showcase","scope":"node"}]}`)
-	if _, err := ParseManifest(ok); err != nil {
-		t.Fatalf("a module could not define and claim its own seat: %v", err)
-	}
-	// Claiming a name nobody defines is still refused — but **at registration, not here**: with
-	// seats declared by modules, a claim on a seat *another* module declares is good, and the
-	// parser cannot tell that from an invented name. See
-	// TestAClaimOnASeatNobodyDeclaresIsRefusedAtRegistration.
-	claimant, err := ParseManifest(claimed(`[{"name":"the-anything","scope":"node"}]`))
-	if err != nil {
-		t.Fatalf("the parser judged a claim it cannot judge alone: %v", err)
-	}
-	if len(CatalogueProblems(Shelf{claimant.Module: claimant})) == 0 {
-		t.Fatal("a module claimed a seat nobody defines")
-	}
-	// A module may not carve its seat out of the mesh's own namespace.
-	bad := []byte(`{"module":"x","version":"1","seats":[{"name":"node-mine","scope":"node"}],` +
-		`"claims":[{"name":"node-mine","scope":"node"}]}`)
-	if _, err := ParseManifest(bad); err == nil || !strings.Contains(err.Error(), "own namespace") {
-		t.Fatalf("a module defined a seat in the mesh's namespace and was not refused: %v", err)
-	}
-}
-
-// **At registration, not in the parser** (novox/hq ADR 0122): a seat's scope is a property of the
-// set, the set is the store's, and the parser also runs on a build machine that has no store.
-func TestASeatClaimedAtAnotherScopeIsRefused(t *testing.T) {
-	m, err := ParseManifest(claimed(`[{"name":"npm-package-registry","scope":"node"}]`))
-	if err != nil {
-		t.Fatalf("the parser judged a scope it reads from data it may not have: %v", err)
-	}
-	got := strings.Join(CatalogueProblems(Shelf{m.Module: m}), "; ")
-	if !strings.Contains(got, "mesh seat") {
-		t.Fatalf("the refusal does not say which scope the seat is: %q", got)
-	}
-}
-
-func TestADeliveringSeatIsOnlyHeldByAModuleThatProvides(t *testing.T) {
-	// Holding it makes the module the mesh's answer for the provision. A module that cannot answer
-	// would be the answer anyway, and every consumer would be sent to it.
-	// And refused at registration, where the seat set is the store's: what a seat delivers is
-	// data, so a compiled copy of it may not be what refuses a build (novox/hq ADR 0122).
-	raw := []byte(`{"module":"thing","version":"1","claims":[{"name":"git","scope":"mesh"}]}`)
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the parser judged what a seat delivers: %v", err)
-	}
-	got := strings.Join(CatalogueProblems(Shelf{m.Module: m}), "; ")
-	if !strings.Contains(got, `does not provide "git"`) {
-		t.Fatalf("the refusal does not say what is missing: %q", got)
-	}
-}
-
-func TestAClaimThatIsMalformedIsRefusedOnceForThat(t *testing.T) {
-	// Not a second time for being unknown: one mistake, one line.
-	_, err := ParseManifest(claimed(`[{"name":"Not A Name","scope":"node"}]`))
-	if err == nil {
-		t.Fatal("a malformed claim was accepted")
-	}
-	if strings.Contains(err.Error(), "not a seat") {
-		t.Fatalf("a malformed claim was also called unknown: %v", err)
-	}
-}
-
-// Every module in use claims a seat in the set, so closing it refuses nothing that runs.
-//
-// Read from the catalogue (internal/beside) and from this repository's own manifest, the two places a
-// manifest lives (ADR 0069). The private-network module's manifest is composed in code, and its claim
-// is checked where it is composed.
-func TestEveryManifestInUseClaimsASeatTheMeshDefines(t *testing.T) {
-	paths, _ := filepath.Glob(filepath.Join(beside.Catalogue(t), "*", "module.json"))
-	if len(paths) == 0 {
-		t.Fatal("no manifests in the catalogue, so this proved nothing")
-	}
-	paths = append(paths, "../../module.json")
-	var checked int
-	for _, path := range paths {
-		raw, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatal(err)
-		}
-		// Leniently, so a manifest refused for something unrelated is not reported as a seat
-		// problem, and the seat check below is the only thing this test holds a module to.
-		var m Manifest
-		if err := json.Unmarshal(raw, &m); err != nil {
-			t.Fatalf("%s: %v", path, err)
-		}
-		for _, problem := range claimProblems(m) {
-			t.Errorf("%s: %s", path, problem)
-		}
-		checked += len(m.Claims)
-	}
-	if checked == 0 {
-		t.Fatal("no claims were checked, so this proved nothing")
-	}
-}
-
-// The holder of a seat answers among several providers.
-
-func registryShelf() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "gitea", Version: "1", Provides: FromAnywhere("npm-package-registry"),
-			Claims: []Claim{{Name: "npm-package-registry", Scope: ScopeMesh}}},
-		Manifest{Module: "verdaccio", Version: "1", Provides: FromAnywhere("npm-package-registry")},
-		Manifest{Module: "builder", Version: "1", Requires: []string{"npm-package-registry"}},
-	)
-}
-
-func twoRegistries() map[string][]Provider {
-	return map[string][]Provider{"npm-package-registry": {
-		{Node: "anchor", At: "anchor.internal", Module: "gitea"},
-		{Node: "archive", At: "archive.internal", Module: "verdaccio"},
-	}}
-}
-
-func giteaHoldsTheSeat() []Held {
-	return []Held{{Claim: "npm-package-registry", Scope: ScopeMesh, Node: "anchor", Module: "gitea"}}
-}
-
-func TestTheSeatsHolderAnswersWhenSeveralProvide(t *testing.T) {
-	// The whole point: a second registry beside the holder harms nothing, and nobody pins.
-	got, err := Resolve(registryShelf(), []string{"builder"}, reachable(),
-		World{Offered: twoRegistries(), Held: giteaHoldsTheSeat()})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 || got.Needs[0].From != "anchor" {
-		t.Fatalf("the seat's holder did not answer: %v", got.Needs)
-	}
-}
-
-func TestAPinStillWinsOverTheSeat(t *testing.T) {
-	// A consumer coupled to one provider's contents has said so, and the seat does not overrule it.
-	got, err := Resolve(registryShelf(), []string{"builder"}, reachable(),
-		World{Offered: twoRegistries(), Held: giteaHoldsTheSeat(),
-			Pinned: map[string]Chosen{"npm-package-registry": {Node: "archive", Module: "verdaccio"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 1 || got.Needs[0].From != "archive" {
-		t.Fatalf("the pin was overruled by the seat: %v", got.Needs)
-	}
-}
-
-func TestWithTheSeatUnheldSeveralProvidersAreStillRefused(t *testing.T) {
-	// No seat held is no choice made, and ADR 0009's rule stands: never guessed.
-	_, err := Resolve(registryShelf(), []string{"builder"}, reachable(),
-		World{Offered: twoRegistries()})
-	if err == nil {
-		t.Fatal("one of two registries was picked with nobody holding the seat")
-	}
-	if !strings.Contains(err.Error(), "pin") {
-		t.Fatalf("the refusal does not say how to choose: %v", err)
-	}
-}
-
-func TestTheHolderIsTheModuleNotTheMachine(t *testing.T) {
-	// Two modules on one machine could provide the same thing; only the one holding the seat
-	// answers. A holder matched by node alone would send consumers to whichever came first.
-	providers := []Provider{
-		{Node: "anchor", At: "anchor.internal", Module: "verdaccio"},
-		{Node: "anchor", At: "anchor.internal", Module: "gitea"},
-	}
-	holder, held := HolderAmong("npm-package-registry", providers, giteaHoldsTheSeat())
-	if !held || holder.Module != "gitea" {
-		t.Fatalf("the holder was not told apart from a neighbour: %+v", holder)
-	}
-}
-
-// The working set is loaded from the store, and an empty load never erases it (novox/hq ADR 0122).
-func TestUseSeatsReplacesTheSetButNeverEmptiesIt(t *testing.T) {
-	before := Seats()
-	defer UseSeats(DefaultSeats()) // restore for other tests, whatever this leaves it as
-
-	// An empty load (store not seeded, or unreadable) leaves the compiled defaults in force.
-	UseSeats(nil)
-	if len(Seats()) != len(before) {
-		t.Fatalf("an empty load changed the set from %d to %d seats", len(before), len(Seats()))
-	}
-	// A non-empty load replaces it — this is how a rename in the store reaches the lookups.
-	UseSeats([]Seat{{Name: "node-firewall", Scope: ScopeNode, Decision: "novox/hq ADR 0122"}})
-	if _, known := SeatNamed("node-firewall"); !known {
-		t.Fatal("the loaded set did not replace the working set")
-	}
-	if len(Seats()) != 1 {
-		t.Fatalf("the working set is %d seats, not the one that was loaded", len(Seats()))
-	}
-}
-
-// A former name resolves to the seat it was renamed from (novox/hq ADR 0122), so a manifest's claim
-// and a held record naming the old name break nothing after a rename.
-func TestAFormerNameResolvesAfterARename(t *testing.T) {
-	defer func() { UseSeats(DefaultSeats()); UseAliases(nil) }()
-	UseSeats([]Seat{{Name: "git", Scope: ScopeMesh, Delivers: "git", Decision: "novox/hq ADR 0121"}})
-	UseAliases(map[string]string{"git": "git"})
-
-	// The old name resolves to the renamed seat.
-	if s, ok := SeatNamed("git"); !ok || s.Name != "git" {
-		t.Fatalf("the former name did not resolve to the renamed seat: %+v ok=%v", s, ok)
-	}
-	// And a holder recorded under the old name is still found for the provision the seat delivers.
-	providers := []Provider{{Node: "anchor", At: "anchor.internal", Module: "gitea"}}
-	held := []Held{{Claim: "git", Scope: ScopeMesh, Node: "anchor", Module: "gitea"}}
-	holder, found := HolderAmong("git", providers, held)
-	if !found || holder.Module != "gitea" {
-		t.Fatalf("the holder recorded under the former name was not matched: %+v found=%v", holder, found)
-	}
-}
diff --git a/internal/catalogue/secret_family_test.go b/internal/catalogue/secret_family_test.go
deleted file mode 100644
index 506456da..00000000
--- a/internal/catalogue/secret_family_test.go
+++ /dev/null
@@ -1,100 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A secret family (novox/hq ADR 0283): one own secret per part the settings name, issued outside the mesh, each
-// given by its full name, never made by the mesh.
-
-func familyManifest(t *testing.T, ownSecrets string) (Manifest, error) {
-	t.Helper()
-	return ParseManifest([]byte(`{"module":"mounts","version":"1","own-secrets":{` + ownSecrets + `}}`))
-}
-
-func TestAFamilyIsDeclaredIssuedOutsideWithOneStar(t *testing.T) {
-	m, err := familyManifest(t, `"smb-password-*":{"path":"/var/lib/mounts/smb-password-*.secret","issued-by":"outside"}`)
-	if err != nil {
-		t.Fatalf("a well-formed family was refused: %v", err)
-	}
-	if got := m.OwnSecrets.Families(); len(got) != 1 || got[0] != "smb-password-*" {
-		t.Fatalf("families: %v", got)
-	}
-	if len(m.OwnSecrets.Plain()) != 0 {
-		t.Fatalf("a family counted as a secret declared by name: %v", m.OwnSecrets.Plain())
-	}
-}
-
-func TestAMalformedFamilyIsRefused(t *testing.T) {
-	for name, c := range map[string]struct{ own, says string }{
-		"made by the mesh": {`"smb-password-*":{"path":"/s/smb-password-*.secret","taken":"at-start"}`, "issued-by"},
-		"no star in its path": {`"smb-password-*":{"path":"/s/smb-password.secret","issued-by":"outside"}`,
-			"exactly one *"},
-		"two stars in its path": {`"smb-password-*":{"path":"/s/*/smb-password-*.secret","issued-by":"outside"}`,
-			"exactly one *"},
-		"a star inside a name": {`"smb*password":{"path":"/s/x","issued-by":"outside"}`, "only ends a family"},
-		"a name that is also a member": {`"smb-password-*":{"path":"/s/p-*","issued-by":"outside"},
-			"smb-password-games":{"path":"/s/games","issued-by":"outside"}`, "also a member"},
-	} {
-		if _, err := familyManifest(t, c.own); err == nil || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal saying %q", name, err, c.says)
-		}
-	}
-}
-
-func TestAMemberIsFoundByItsFullNameAndLandsWhereTheStarIs(t *testing.T) {
-	o := OwnSecrets{
-		"smb-password-*":     {Path: "/s/smb-password-*.secret", IssuedBy: IssuedOutside},
-		"smb-password-big-*": {Path: "/big/*.secret", IssuedBy: IssuedOutside},
-		"token":              {Path: "/s/token", IssuedBy: IssuedOutside},
-	}
-	s, family, ok := o.Lookup("smb-password-games")
-	if !ok || family != "smb-password-*" || s.Path != "/s/smb-password-games.secret" || s.IssuedBy != IssuedOutside {
-		t.Fatalf("a member: %+v %q %v", s, family, ok)
-	}
-	if s, family, ok := o.Lookup("smb-password-big-one"); !ok || family != "smb-password-big-*" || s.Path != "/big/one.secret" {
-		t.Fatalf("the longest family that fits: %+v %q %v", s, family, ok)
-	}
-	if s, family, ok := o.Lookup("token"); !ok || family != "" || s.Path != "/s/token" {
-		t.Fatalf("a secret declared by name: %+v %q %v", s, family, ok)
-	}
-	for _, name := range []string{"smb-password-*", "smb-password-", "smb-password-../etc", "smb-password-a/b",
-		"smb-password-a.b", "smb-password-Games", "smb-password--x", "other"} {
-		if _, _, ok := o.Lookup(name); ok {
-			t.Errorf("%q was found as a secret", name)
-		}
-	}
-}
-
-// A member given is one file at its path; one not given is nothing, and the machine still composes — the mesh never
-// makes a member.
-func TestAMemberGivenIsPlacedAndOneNotGivenIsNothing(t *testing.T) {
-	m, err := familyManifest(t, `"smb-password-*":{"path":"/var/lib/mounts/smb-password-*.secret","issued-by":"outside"}`)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := Resolution{Node: "workstation", Modules: []Manifest{m}}
-	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{"mounts": {"smb-password-games": "sealed"}}})
-	if err != nil {
-		t.Fatalf("a module with one member given did not compose: %v", err)
-	}
-	var paths []string
-	for _, res := range out {
-		if res["sealed"] != nil {
-			paths = append(paths, res["path"].(string))
-		}
-	}
-	if len(paths) != 1 || paths[0] != "/var/lib/mounts/smb-password-games.secret" {
-		t.Fatalf("placed: %v", paths)
-	}
-	out, err = r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("a module with no member given did not compose: %v", err)
-	}
-	for _, res := range out {
-		if res["sealed"] != nil {
-			t.Fatalf("a member nobody gave was placed: %v", res)
-		}
-	}
-}
diff --git a/internal/catalogue/secret_restart_test.go b/internal/catalogue/secret_restart_test.go
deleted file mode 100644
index 560eb52d..00000000
--- a/internal/catalogue/secret_restart_test.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package catalogue
-
-import (
-	"reflect"
-	"strings"
-	"testing"
-)
-
-// What reads one of a module's own secrets is restarted when the secret changes (novox/hq issue 203,
-// issue 206): the build machine kept an hour-old credential open because its manifest restarted it
-// on its environment file alone. Composed, so a manifest need not say it; a scheduled process is
-// left alone, because the host refuses a restart-on for one and it reads the file afresh each run.
-func TestAContainerReadingAnOwnSecretIsRestartedWhenItChanges(t *testing.T) {
-	m := Manifest{Module: "agent", Version: "1",
-		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/agent/broker"}},
-		Resources: []map[string]any{
-			{"id": "mesh-state", "type": "directory", "path": "/var/lib/mesh/agent", "mode": "0700"},
-			{"id": "settings", "type": "file", "path": "/var/lib/mesh/agent/agent.env", "mode": "0600", "content": "A=1\n"},
-			{"id": "server", "type": "container", "name": "agent", "network": "host",
-				"image":      "registry.example/agent@sha256:" + strings.Repeat("a", 64),
-				"volumes":    []any{"/var/lib/mesh/agent:/run/mesh:ro", "/var/lib/mesh/agent/broker:/run/mesh/broker:ro"},
-				"env-file":   []any{"/var/lib/mesh/agent/agent.env"},
-				"restart-on": []any{"settings"}},
-			{"id": "nightly", "type": "container", "name": "agent-nightly", "schedule": "0 3 * * *",
-				"image":   "registry.example/agent@sha256:" + strings.Repeat("a", 64),
-				"volumes": []any{"/var/lib/mesh/agent/broker:/run/mesh/broker:ro"}},
-			{"id": "other", "type": "container", "name": "agent-other",
-				"image": "registry.example/agent@sha256:" + strings.Repeat("a", 64)},
-		}}
-	got, err := Resolve(shelf(m), []string{m.Module},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{"container-runtime": true}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{"agent": {"broker": "SEALED"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]map[string]any{}
-	for _, r := range out {
-		by[r["id"].(string)] = r
-	}
-	if want := []any{"agent.settings", "agent.needs-broker"}; !reflect.DeepEqual(by["agent.server"]["restart-on"], want) {
-		t.Fatalf("the server reads the credential and is not restarted on it: %v", by["agent.server"]["restart-on"])
-	}
-	if _, has := by["agent.nightly"]["restart-on"]; has {
-		t.Fatalf("a scheduled container was given a restart-on, which the host refuses: %v", by["agent.nightly"]["restart-on"])
-	}
-	if _, has := by["agent.other"]["restart-on"]; has {
-		t.Fatalf("a container that reads no secret was given one to restart on: %v", by["agent.other"]["restart-on"])
-	}
-}
-
-// A member of a secret family is an own secret too (novox/hq issue 405, ADR 0283 decision 6): a container that
-// reads a member given is restarted when it changes, as for a secret declared by name. A member not given is no
-// file, so nothing is restarted on it.
-func TestAContainerReadingAFamilyMemberIsRestartedWhenItChanges(t *testing.T) {
-	m := Manifest{Module: "mounts", Version: "1",
-		OwnSecrets: OwnSecrets{"smb-password-*": {Path: "/var/lib/mesh/mounts/smb-password-*.secret", IssuedBy: IssuedOutside}},
-		Resources: []map[string]any{
-			{"id": "games", "type": "container", "name": "mounts-games", "network": "host",
-				"image":   "registry.example/mounts@sha256:" + strings.Repeat("a", 64),
-				"volumes": []any{"/var/lib/mesh/mounts/smb-password-games.secret:/run/password:ro"}},
-			{"id": "library", "type": "container", "name": "mounts-library", "network": "host",
-				"image":   "registry.example/mounts@sha256:" + strings.Repeat("a", 64),
-				"volumes": []any{"/var/lib/mesh/mounts/smb-password-library.secret:/run/password:ro"}},
-		}}
-	got, err := Resolve(shelf(m), []string{m.Module},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{"container-runtime": true}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{"mounts": {"smb-password-games": "SEALED"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]map[string]any{}
-	for _, r := range out {
-		by[r["id"].(string)] = r
-	}
-	if want := []any{"mounts.needs-smb-password-games"}; !reflect.DeepEqual(by["mounts.games"]["restart-on"], want) {
-		t.Fatalf("a container reading a member given is not restarted on it: %v", by["mounts.games"]["restart-on"])
-	}
-	if _, placed := by["mounts.needs-smb-password-games"]; !placed {
-		t.Fatalf("the member given is not placed, so a restart-on names nothing: %v", out)
-	}
-	if _, has := by["mounts.library"]["restart-on"]; has {
-		t.Fatalf("a container reading a member not given was given a restart-on naming nothing: %v", by["mounts.library"]["restart-on"])
-	}
-}
diff --git a/internal/catalogue/secrets_in_environment_test.go b/internal/catalogue/secrets_in_environment_test.go
deleted file mode 100644
index 39ee9978..00000000
--- a/internal/catalogue/secrets_in_environment_test.go
+++ /dev/null
@@ -1,103 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-func aModuleWithAnEnvFileSecret(exception string) Manifest {
-	container := map[string]any{
-		"id": "server", "type": "container", "name": "app", "image": "app@sha256:" + strings.Repeat("a", 64),
-		"env-file": []any{"/var/lib/app/server.env"},
-	}
-	if exception != "" {
-		container[SecretsInEnvironment] = exception
-	}
-	return Manifest{
-		Module: "app", Version: "1",
-		OwnSecrets: OwnSecrets{"token": {Path: "/var/lib/app/token.secret"}},
-		Resources: []map[string]any{
-			{"id": "env", "type": "file", "path": "/var/lib/app/server.env", "mode": "0600",
-				"content": "APP_TOKEN=${secret:token}\n"},
-			container,
-		},
-	}
-}
-
-func declare(t *testing.T, m Manifest) ([]map[string]any, error) {
-	t.Helper()
-	got, err := Resolve(shelf(m), []string{m.Module},
-		Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return got.Declaration(Rendering{Needed: map[string]map[string]string{"app": {"token": "SEALED"}}})
-}
-
-// A container that reads a file carrying a secret as its environment is refused, unless it says
-// why — and then the reason stays in the catalogue and never reaches the machine.
-func TestASecretInAnEnvFileIsRefusedUnlessDeclared(t *testing.T) {
-	_, err := declare(t, aModuleWithAnEnvFileSecret(""))
-	if err == nil || !strings.Contains(err.Error(), "04-ISSUES/041") {
-		t.Fatalf("an env-file carrying a secret was declared without a word: %v", err)
-	}
-
-	out, err := declare(t, aModuleWithAnEnvFileSecret("the image reads its configuration from the environment only"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, r := range out {
-		if _, leaked := r[SecretsInEnvironment]; leaked {
-			t.Fatalf("the catalogue's reason was sent to the machine: %v", r)
-		}
-	}
-}
-
-// A secret placeholder inside a container's env is refused outright: nothing fills it there.
-func TestASecretInEnvIsAlwaysRefused(t *testing.T) {
-	m := aModuleWithAnEnvFileSecret("said")
-	m.Resources[1]["env"] = map[string]any{"APP_TOKEN": "${secret:token}"}
-	if _, err := declare(t, m); err == nil || !strings.Contains(err.Error(), "never filled into an environment variable") {
-		t.Fatalf("a secret in env was accepted: %v", err)
-	}
-}
-
-// A file with no secret in it is an ordinary env-file and needs no word.
-func TestAnEnvFileWithoutASecretNeedsNothing(t *testing.T) {
-	m := aModuleWithAnEnvFileSecret("")
-	m.Resources[0]["content"] = "APP_MODE=production\n"
-	if _, err := declare(t, m); err != nil {
-		t.Fatal(err)
-	}
-}
-
-// A module whose process is not root names who its secret files belong to, and every secret file
-// the composer writes for it carries that owner — the mounted file is readable where it is used.
-func TestSecretFilesCarryTheOwnerTheModuleNamed(t *testing.T) {
-	m := aModuleWithAnEnvFileSecret("said")
-	m.SecretsOwner = "65534:65534"
-	out, err := declare(t, m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var seen bool
-	for _, r := range out {
-		if r["path"] != "/var/lib/app/token.secret" {
-			continue
-		}
-		seen = true
-		if r["owner"] != "65534:65534" {
-			t.Errorf("the secret file is owned by %v", r["owner"])
-		}
-	}
-	if !seen {
-		t.Fatal("no secret file in the declaration")
-	}
-	m.SecretsOwner = ""
-	out, _ = declare(t, m)
-	for _, r := range out {
-		if r["path"] == "/var/lib/app/token.secret" && r["owner"] != nil {
-			t.Errorf("an owner was invented: %v", r["owner"])
-		}
-	}
-}
diff --git a/internal/catalogue/secrets_into_files_test.go b/internal/catalogue/secrets_into_files_test.go
deleted file mode 100644
index 1a92a7eb..00000000
--- a/internal/catalogue/secrets_into_files_test.go
+++ /dev/null
@@ -1,242 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Driven through Declaration, never through the helper.
-//
-// Three times in this repository a test asserted on a helper while the code that called it was
-// wrong, and each time an injected fault stayed silent because nothing on the path was under test.
-// What has to be true is that a declaration leaving the control plane carries the values, so that
-// is what these ask.
-
-func fileNamed(out []map[string]any, id string) map[string]any {
-	for _, r := range out {
-		if r["id"] == id {
-			return r
-		}
-	}
-	return nil
-}
-
-// A module's own credential, put into a file it wrote.
-func TestAFileGetsTheSecretItsContentAsksFor(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{{
-		Module:     "gitea",
-		OwnSecrets: OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
-		Resources: []map[string]any{{
-			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
-			"content": "[security]\nSECRET_KEY = ${secret:admin}\n",
-		}},
-	}}}
-	out, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := fileNamed(out, "gitea.conf")
-	if file == nil {
-		t.Fatalf("no file in %v", out)
-	}
-	got, _ := file["secrets"].(map[string]any)
-	if got["admin"] != "sealed-admin" {
-		t.Errorf("the file was sent without its secret: %v", file)
-	}
-	// The hole is still a hole on the wire. The mesh does not fill it in; the host does, on the
-	// machine, which is the only place both halves exist.
-	if !strings.Contains(file["content"].(string), "${secret:admin}") {
-		t.Errorf("the mesh substituted it itself: %v", file["content"])
-	}
-}
-
-// The gap this exists for: a granted credential arrives as a bare password, and the program that
-// needs it reads KEY=value.
-func TestAGrantedCredentialCanBeShapedIntoAnEnvFile(t *testing.T) {
-	r := Resolution{
-		Node: "anchor",
-		Modules: []Manifest{{
-			Module:   "keycloak",
-			Requires: []string{"postgres-database"},
-			Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
-			Resources: []map[string]any{{
-				"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
-				"content": "KC_DB_USERNAME=keycloak\nKC_DB_PASSWORD=${secret:postgres-database}\n",
-				"mode":    "0600",
-			}},
-		}},
-		Needs: []Needed{{Name: "postgres-database", For: "keycloak", From: "anchor", Sealed: "sealed-db"}},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := fileNamed(out, "keycloak.dbenv")
-	got, _ := file["secrets"].(map[string]any)
-	if got["postgres-database"] != "sealed-db" {
-		t.Errorf("the credential never reached the file it was needed in: %v", file)
-	}
-}
-
-// Two modules on one node requiring the same provision each get THEIR OWN credential in a
-// ${secret:…} file — not whichever need happened to come last. This is the placeholder-path twin of
-// the guard novox/hq 04-ISSUES/022 put on the secrets:-map path; without it, a node with baserow and
-// letta both consuming postgres gave baserow letta's password and authentication failed.
-func TestTwoConsumersOfOneProvisionEachGetTheirOwnInAPlaceholderFile(t *testing.T) {
-	r := Resolution{
-		Node: "anchor",
-		Modules: []Manifest{
-			{
-				Module:   "keycloak",
-				Requires: []string{"postgres-database"},
-				Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
-				Resources: []map[string]any{{
-					"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
-					"content": "PW=${secret:postgres-database}\n", "mode": "0600",
-				}},
-			},
-			{
-				Module:   "grafana",
-				Requires: []string{"postgres-database"},
-				Secrets:  map[string]string{"postgres-database": "/var/lib/grafana/db.secret"},
-				Resources: []map[string]any{{
-					"id": "dbenv", "type": "file", "path": "/var/lib/grafana/database.env",
-					"content": "PW=${secret:postgres-database}\n", "mode": "0600",
-				}},
-			},
-		},
-		Needs: []Needed{
-			{Name: "postgres-database", For: "keycloak", From: "anchor", Sealed: "sealed-kc"},
-			{Name: "postgres-database", For: "grafana", From: "anchor", Sealed: "sealed-gf"},
-		},
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	kc, _ := fileNamed(out, "keycloak.dbenv")["secrets"].(map[string]any)
-	if kc["postgres-database"] != "sealed-kc" {
-		t.Errorf("keycloak got the wrong credential (someone else's password): %v", kc)
-	}
-	gf, _ := fileNamed(out, "grafana.dbenv")["secrets"].(map[string]any)
-	if gf["postgres-database"] != "sealed-gf" {
-		t.Errorf("grafana got the wrong credential (someone else's password): %v", gf)
-	}
-}
-
-// A name nothing declared is a typo, and it is refused here rather than on the machine.
-func TestAFileNamingASecretTheModuleDoesNotHaveIsRefused(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{{
-		Module:     "gitea",
-		OwnSecrets: OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
-		Resources: []map[string]any{{
-			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
-			"content": "SECRET_KEY = ${secret:adnim}\n",
-		}},
-	}}}
-	_, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
-	})
-	if err == nil {
-		t.Fatal("a file asked for a secret that does not exist and the mesh sent it anyway")
-	}
-	// It says what could have been meant, because the answer is nearly always one of two names.
-	if !strings.Contains(err.Error(), `"admin"`) {
-		t.Errorf("the refusal does not say what it could have named: %v", err)
-	}
-}
-
-// One module may not read another's credential by guessing its name.
-func TestAFileCannotNameAnotherModulesSecret(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{
-		{Module: "postgres", OwnSecrets: OwnSecrets{"superuser": {Path: "/var/lib/postgres/su.env"}}},
-		{Module: "gitea", Resources: []map[string]any{{
-			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
-			"content": "PASSWORD=${secret:superuser}\n",
-		}}},
-	}}
-	_, err := r.Declaration(Rendering{Needed: map[string]map[string]string{
-		"postgres": {"superuser": "sealed-su"},
-	}})
-	if err == nil {
-		t.Fatal("gitea read postgres's credential by naming it")
-	}
-}
-
-// A token inside a JSON document, where a setting put the placeholder there.
-//
-// **The case this whole shape was argued from**: a desktop client that reads its token from an
-// attribute inside a JSON file in a home directory, not from an environment variable. The module
-// ships an empty document, a setting says which attribute, and the credential never passes
-// through the mesh in the open.
-func TestASettingThatCarriesAPlaceholderIsStillFilled(t *testing.T) {
-	r := Resolution{Node: "workstation", Modules: []Manifest{{
-		Module:     "chat",
-		OwnSecrets: OwnSecrets{"api-token": {Path: "/home/operator/.config/chat/token"}},
-		Resources: []map[string]any{{
-			"id": "settings", "type": "file", "merge": "json",
-			"path": "/home/operator/.config/chat/settings.json", "content": "{}",
-		}},
-	}}}
-	out, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"chat": {"api-token": "sealed-token"}},
-		Settings: SettingsBy{"chat": {{From: "node", Values: map[string]any{
-			"chat.atlassian.token": "${secret:api-token}",
-		}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	file := fileNamed(out, "chat.settings")
-	got, _ := file["secrets"].(map[string]any)
-	if got["api-token"] != "sealed-token" {
-		t.Errorf("a placeholder a setting put there was never filled: %v", file)
-	}
-	// Filling secrets runs after settings for exactly this reason: before the merge, the content
-	// is "{}" and asks for nothing at all.
-	if !strings.Contains(file["content"].(string), "${secret:api-token}") {
-		t.Errorf("the hole did not survive to the machine: %v", file["content"])
-	}
-}
-
-// An own secret and a requirement of the same name would make ${secret:x} mean either.
-func TestANameMeaningTwoThingsIsRefused(t *testing.T) {
-	r := Resolution{
-		Node: "anchor",
-		Modules: []Manifest{{
-			Module:     "thing",
-			OwnSecrets: OwnSecrets{"store": {Path: "/var/lib/thing/own.env"}},
-			Secrets:    map[string]string{"store": "/var/lib/thing/granted.env"},
-		}},
-		Needs: []Needed{{Name: "store", From: "anchor", Sealed: "sealed-granted"}},
-	}
-	_, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"thing": {"store": "sealed-own"}},
-	})
-	if err == nil || !strings.Contains(err.Error(), "rename") {
-		t.Errorf("one name meant two credentials and nothing said so: %v", err)
-	}
-}
-
-// A file with no placeholder is not given a secrets map. The host refuses a secret its content
-// never asks for, so an empty map added helpfully would break every file that has none.
-func TestAFileWithNoPlaceholderIsLeftAlone(t *testing.T) {
-	r := Resolution{Node: "anchor", Modules: []Manifest{{
-		Module:     "gitea",
-		OwnSecrets: OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
-		Resources: []map[string]any{{
-			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini", "content": "RUN_MODE=prod\n",
-		}},
-	}}}
-	out, err := r.Declaration(Rendering{
-		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, given := fileNamed(out, "gitea.conf")["secrets"]; given {
-		t.Error("a file that asks for nothing was given a secrets map, which the host refuses")
-	}
-}
diff --git a/internal/catalogue/served_by_setting_test.go b/internal/catalogue/served_by_setting_test.go
deleted file mode 100644
index 681038d6..00000000
--- a/internal/catalogue/served_by_setting_test.go
+++ /dev/null
@@ -1,194 +0,0 @@
-package catalogue
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-)
-
-// influxdb and grafana as the catalogue declares them, cut to what composes the data source on a
-// machine like ace (novox/hq issue 696): what influxdb serves for influxdb-api and its mergeable
-// runtime configuration, and grafana's binding, data source file and credential.
-const grafanaLikeTheCatalogue = `{
-  "module": "grafana", "version": "1",
-  "requires": [{"name": "influxdb-api", "optional": true}],
-  "contributes": {"influxdb-api": {"access": "read"}},
-  "binds": {"influxdb-api": "${dir:state}/influxdb.json"},
-  "secrets": {"influxdb-api": "${dir:mesh-state}/influxdb-api"},
-  "resources": [
-    {"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-    {"id": "state", "type": "directory", "mode": "0700", "place": "."},
-    {"id": "influxdb-datasources", "type": "directory", "mode": "0755", "owner": "472:0"},
-    {"id": "influxdb-datasource", "type": "file", "path": "${dir:influxdb-datasources}/mesh-influxdb.yaml", "mode": "0644",
-     "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}\n    user: ${bound:influxdb-api:as}\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: ${bound:influxdb-api:bucket}\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
-     "only-when-bound": "influxdb-api"}
-  ]
-}`
-
-// influxdbServing is influxdb as the catalogue declared it before issue 696 (literal served org and
-// bucket) or after (served from its settings, today's literals as their defaults).
-func influxdbServing(after bool) string {
-	served := `"org": "mesh", "bucket": "default"`
-	settings, takes := ``, ``
-	if after {
-		served = `"org": "${setting:org}", "bucket": "${setting:bucket}"`
-		settings = `"settings": {
-      "org": {"kind": "preference", "default": "mesh", "why": "the org influxdb makes at its first start"},
-      "bucket": {"kind": "preference", "default": "default", "why": "the bucket influxdb makes at its first start"}},`
-		takes = `, "takes-settings": ["bucket", "org", "url"], "trusted": true`
-	}
-	return `{
-  "module": "influxdb", "version": "1",
-  "provides": [{"name": "influxdb-api", "scope": "mesh", "identity": {"in": "an InfluxDB v1 authorization"}}],
-  "listens": [{"name": "api", "port": 8086, "protocol": "tcp", "from": "mesh", "why": "queries and writes"}],
-  ` + settings + `
-  "serves": {"influxdb-api": {"scheme": "http", "port": 8086, ` + served + `}},
-  "resources": [
-    {"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
-    {"id": "runtime-config", "type": "file", "path": "${dir:mesh-state}/config.json", "mode": "0600",
-     "content": "{}\n", "merge": "json"` + takes + `}
-  ]
-}`
-}
-
-// composedLikeAce is every resource of grafana and influxdb as one machine composes them, by id, with
-// influxdb's settings layer on it.
-func composedLikeAce(t *testing.T, influxdb string, layers []Layer) map[string]string {
-	t.Helper()
-	var ms []Manifest
-	for _, raw := range []string{influxdb, grafanaLikeTheCatalogue} {
-		m, err := ParseManifest([]byte(raw))
-		if err != nil {
-			t.Fatal(err)
-		}
-		ms = append(ms, m)
-	}
-	r, err := Resolve(shelf(ms...), []string{"influxdb", "grafana"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{Settings: SettingsBy{"influxdb": layers},
-		Needed: map[string]map[string]string{}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := map[string]string{}
-	for _, res := range out {
-		id, _ := res["id"].(string)
-		if !strings.HasPrefix(id, "grafana.") && !strings.HasPrefix(id, "influxdb.") {
-			continue
-		}
-		b, err := json.Marshal(res)
-		if err != nil {
-			t.Fatal(err)
-		}
-		got[id] = string(b)
-	}
-	return got
-}
-
-// aceLikeLayer is a layer like influxdb's on ace: its own org and bucket (made up here), and the
-// endpoint block the mesh reads itself.
-func aceLikeLayer() []Layer {
-	return []Layer{{From: "ace", Values: map[string]any{
-		"org": "made-up-org", "bucket": "made-up-bucket",
-		"endpoints": map[string]any{"api": map[string]any{"label": "influx", "port": float64(8086), "reach": "internal"}},
-	}}}
-}
-
-// grafana composes byte for byte as it did before issue 696, on a machine like ace and on one
-// without a layer, now that influxdb serves its org and bucket from its settings and no layer
-// replaces a served key. The golden files are grafana's resources as the integration branch's
-// controller composed them at 71362c1 (Settle still overriding), with influxdb serving the literals.
-func TestGrafanaComposesTheSameOnceInfluxdbServesItsSettings(t *testing.T) {
-	for name, layers := range map[string][]Layer{"ace": aceLikeLayer(), "unlayered": nil} {
-		raw, err := os.ReadFile("testdata/influxdb-served-by-setting/grafana-" + name + ".json")
-		if err != nil {
-			t.Fatal(err)
-		}
-		var want map[string]json.RawMessage
-		if err := json.Unmarshal(raw, &want); err != nil {
-			t.Fatal(err)
-		}
-		got := composedLikeAce(t, influxdbServing(true), layers)
-		seen := 0
-		for id, v := range got {
-			if !strings.HasPrefix(id, "grafana.") {
-				continue
-			}
-			seen++
-			w, ok := want[id]
-			if !ok {
-				t.Errorf("%s: %s composes and did not before", name, id)
-				continue
-			}
-			var compact bytes.Buffer
-			if err := json.Compact(&compact, w); err != nil {
-				t.Fatal(err)
-			}
-			if compact.String() != v {
-				t.Errorf("%s: %s changed:\n got %s\nwant %s", name, id, v, compact.String())
-			}
-		}
-		if seen != len(want) {
-			t.Errorf("%s: %d of grafana's %d resources compose", name, seen, len(want))
-		}
-	}
-}
-
-// What a provider serves is its definition's, filled from settings only where it asks with
-// ${setting:<key>} (novox/hq issue 696, ADR 0348 clause 11): a layer that sets a key the provider
-// serves as a literal replaces nothing, and a key it does not serve is never added.
-func TestALayerNoLongerReplacesAServedKey(t *testing.T) {
-	served, err := Settle(map[string]any{"host": "mail", "port": 25},
-		[]Layer{{From: "the mesh", Values: map[string]any{"host": "post", "sitename": "Mail"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if served["host"] != "mail" {
-		t.Errorf("a layer replaced the served host: %v", served)
-	}
-	if _, leaked := served["sitename"]; leaked {
-		t.Errorf("a setting for a file reached the consumers: %v", served)
-	}
-
-	// And a layer setting it is said to reach nothing, rather than taken for a change.
-	m := Manifest{Module: "mail", Serves: map[string]map[string]any{"smtp": {"host": "mail"}}}
-	if unused := UnusedSettings(m, []Layer{{From: "the mesh", Values: map[string]any{"host": "post"}}}); len(unused) != 1 {
-		t.Errorf("a layer setting a literal served key was not said to reach nothing: %v", unused)
-	}
-
-	// influxdb as it was before issue 696, serving literals, under a layer like ace's: the layer no
-	// longer reaches grafana — which is why the catalogue moves influxdb first.
-	got := composedLikeAce(t, influxdbServing(false), aceLikeLayer())
-	for _, id := range []string{"grafana.influxdb-datasource", "grafana.bound-influxdb-api"} {
-		if strings.Contains(got[id], "made-up") {
-			t.Errorf("%s still carries the layer's value over a literal served key: %s", id, got[id])
-		}
-	}
-	if !strings.Contains(got["grafana.influxdb-datasource"], `dbName: default\n`) {
-		t.Errorf("the data source does not name the served literal: %s", got["grafana.influxdb-datasource"])
-	}
-}
-
-// influxdb's own runtime configuration takes the keys it names: org and bucket from a layer like
-// ace's, and not the endpoint block the mesh reads itself, which today's form wrote there too.
-func TestInfluxdbsConfigTakesItsOrgAndBucket(t *testing.T) {
-	got := composedLikeAce(t, influxdbServing(true), aceLikeLayer())["influxdb.runtime-config"]
-	var r map[string]any
-	if err := json.Unmarshal([]byte(got), &r); err != nil {
-		t.Fatal(err)
-	}
-	if want := "{\n  \"bucket\": \"made-up-bucket\",\n  \"org\": \"made-up-org\"\n}\n"; r["content"] != want {
-		t.Errorf("config.json: got %q, want %q", r["content"], want)
-	}
-	got = composedLikeAce(t, influxdbServing(true), nil)["influxdb.runtime-config"]
-	if err := json.Unmarshal([]byte(got), &r); err != nil {
-		t.Fatal(err)
-	}
-	if r["content"] != "{}\n" {
-		t.Errorf("a default reached the mergeable file: %q", r["content"])
-	}
-}
diff --git a/internal/catalogue/served_own_names_test.go b/internal/catalogue/served_own_names_test.go
deleted file mode 100644
index db00dcc3..00000000
--- a/internal/catalogue/served_own_names_test.go
+++ /dev/null
@@ -1,168 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0346, issue 624: the forge's package registry writes every tarball at its public name,
-// and the lab, its consumer, must trust that name and no other. The name is the mesh's own composition
-// of the forge's route, which the forge's files read as ${bound:route:name-web}; a consumer can now be
-// served it.
-
-const aRegistryForge = `{"module":"forge","version":"1","requires":["route"],
-  "provides":[{"name":"npm-package-registry","scope":"mesh"}],
-  "contributes":{"route":{"web":{"label":"git","port":3000}}},
-  "serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
-    "public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`
-
-func aForgeManifest(t *testing.T) Manifest {
-	t.Helper()
-	m, err := ParseManifest([]byte(aRegistryForge))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return m
-}
-
-func TestAProviderServesItsOwnComposedName(t *testing.T) {
-	m := aForgeManifest(t)
-	r := Resolution{Node: "home", PublicDomain: "example.org"}
-	got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got["public-root"] != "https://git.example.org/api/packages/novox/npm/" || len(said) != 0 {
-		t.Fatalf("the public root is the route's composed name: %v, said %v", got, said)
-	}
-	if got["npm-path"] != "/api/packages/novox/npm/" || got["port"] != float64(3000) {
-		t.Fatalf("the rest is served as it was: %v", got)
-	}
-	if m.Serves["npm-package-registry"]["public-root"] != "https://${bound:route:name-web}/api/packages/novox/npm/" {
-		t.Fatal("the manifest's own map was rewritten")
-	}
-}
-
-func TestANameTheMachineDoesNotComposeLeavesTheKeyOutAndSaysSo(t *testing.T) {
-	m := aForgeManifest(t)
-	r := Resolution{Node: "home"} // no public domain
-	got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, there := got["public-root"]; there {
-		t.Fatalf("a name not composed is left out, never written as the placeholder or empty: %v", got)
-	}
-	if got["npm-path"] == nil {
-		t.Fatalf("only the key that names it is left out: %v", got)
-	}
-	if len(said) != 1 || !strings.Contains(said[0], `forge serves npm-package-registry without "public-root"`) ||
-		!strings.Contains(said[0], "home composes no such name") {
-		t.Fatalf("said: %v", said)
-	}
-	if lines := (Resolution{Node: "home", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 1 {
-		t.Fatalf("the plan on the provider's machine says it: %v", lines)
-	}
-	if lines := (Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 0 {
-		t.Fatalf("nothing to say when the name is composed: %v", lines)
-	}
-}
-
-// On the provider's own machine the consumer is served the same name (ADR 0346 §2).
-func TestAConsumerBesideTheProviderIsServedItsName(t *testing.T) {
-	m := aForgeManifest(t)
-	consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
-		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
-	node := workstation()
-	node.PublicDomain = "example.org"
-	got, err := Resolve(shelf(minimalRouteProxy(), m, consumer), []string{"route-proxy", "forge", "lab"}, node, World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	served, answered, err := got.servedOnThisMachine("npm-package-registry", Rendering{})
-	if err != nil || !answered {
-		t.Fatalf("answered %v: %v", answered, err)
-	}
-	if served["public-root"] != "https://git.example.org/api/packages/novox/npm/" {
-		t.Fatalf("served beside the provider: %v", served)
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var binding string
-	for _, r := range out {
-		if r["path"] == "/var/lib/lab/package-registry.json" {
-			binding, _ = r["content"].(string)
-		}
-	}
-	if !strings.Contains(binding, `"public-root": "https://git.example.org/api/packages/novox/npm/"`) &&
-		!strings.Contains(binding, `"public-root":"https://git.example.org/api/packages/novox/npm/"`) {
-		t.Fatalf("the consumer's binding carries the name:\n%s", binding)
-	}
-	if strings.Contains(binding, "${bound:") {
-		t.Fatalf("a placeholder reached the consumer:\n%s", binding)
-	}
-}
-
-// From another machine, the provider's served values carry what that machine composed, and a key it
-// left out is said on the consumer's need (ADR 0346 §2, §3).
-func TestAConsumerElsewhereIsToldWhatTheProviderLeftOut(t *testing.T) {
-	consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
-		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
-	node := workstation()
-	node.At = "workstation.internal"
-	world := World{Offered: map[string][]Provider{"npm-package-registry": {{Node: "home", At: "home.internal",
-		Module: "forge", Serves: map[string]any{"port": 3000},
-		LeftOut: []string{`forge serves npm-package-registry without "public-root"`}}}}}
-	got, err := Resolve(shelf(aForgeManifest(t), consumer), []string{"lab"}, node, world)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range got.Needs {
-		if n.Name == "npm-package-registry" {
-			if len(n.LeftOut) != 1 {
-				t.Fatalf("the need carries what was left out: %+v", n)
-			}
-			return
-		}
-	}
-	t.Fatalf("no need: %+v", got.Needs)
-}
-
-func TestAServedNameIsCheckedWhenTheDefinitionIsRead(t *testing.T) {
-	for bad, want := range map[string]string{
-		`"public-root":"https://${bound:route:name-api}/x"`:           "what forge is called through route is name, internal-name, name-web, internal-name-web",
-		`"public-root":"https://${bound:postgres-database:name}/x"`:   `forge contributes to "route"`,
-		`"public-root":"https://${bound:route:name-web|default:x}/x"`: "takes no default",
-		`"public-root":"https://${bound:route:at}/x"`:                 "what forge is called through route",
-	} {
-		raw := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`, bad, 1)
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("%s: want a refusal saying %q, got %v", bad, want, err)
-		}
-	}
-	nested := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`,
-		`"roots":["https://${bound:route:name-web}/x"]`, 1)
-	if _, err := ParseManifest([]byte(nested)); err == nil || !strings.Contains(err.Error(), "inside a list or an object") {
-		t.Errorf("a nested own name is refused, not served as the placeholder: %v", err)
-	}
-	if _, err := ParseManifest([]byte(aRegistryForge)); err != nil {
-		t.Fatalf("its own name is accepted: %v", err)
-	}
-}
-
-// The provider's contributions file carries no own name on a consumer's entry (ADR 0346 §4): only what
-// is derived for that consumer is there (ADR 0202 §5), and the provider reads its own names in its files.
-func TestAProvidersOwnNameIsNotOnItsConsumersEntry(t *testing.T) {
-	m := aForgeManifest(t)
-	r := Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}
-	derived, err := r.derivedFor("npm-package-registry", "lab_home", "lab", "", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if derived != nil {
-		t.Fatalf("a consumer's entry carries only what was derived for it: %v", derived)
-	}
-}
diff --git a/internal/catalogue/setting_defaults_test.go b/internal/catalogue/setting_defaults_test.go
deleted file mode 100644
index d5e50dad..00000000
--- a/internal/catalogue/setting_defaults_test.go
+++ /dev/null
@@ -1,450 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A preference has a default in the definition; the mesh's layer, then the node's, override it; a key
-// with a default is not stray; and a value that is the operator's still has none (novox/hq ADR 0262).
-
-func notifier() Manifest {
-	return Manifest{Module: "notifier",
-		Settings: map[string]SettingDeclaration{
-			"font-size": {Kind: KindPreference, Default: float64(10), Why: "readable at a scale of one"},
-			"width":     {Kind: KindPreference, Default: float64(250), Why: "fits a title of forty characters"},
-		},
-		Resources: []map[string]any{{"id": "configuration", "type": "file", "path": "/x/notifierrc",
-			"content": "font = Inter ${setting:font-size}\nwidth = ${setting:width}\n"}},
-	}
-}
-
-func parsed(t *testing.T, m Manifest) error {
-	t.Helper()
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, err = ParseManifest(raw)
-	return err
-}
-
-func TestAnUnsetPreferenceTakesItsDefault(t *testing.T) {
-	m := notifier()
-	for _, layers := range [][]Layer{nil, {{From: MeshWideLayer, Values: map[string]any{}}}} {
-		file := map[string]any{}
-		for k, v := range m.Resources[0] {
-			file[k] = v
-		}
-		if err := settingInto(file, WithDefaults(m, layers), m.Module); err != nil {
-			t.Fatal(err)
-		}
-		if file["content"] != "font = Inter 10\nwidth = 250\n" {
-			t.Fatalf("filled as %q", file["content"])
-		}
-	}
-	if err := JudgeSettings(m, nil, false); err != nil {
-		t.Fatalf("a module whose every key has a default does not compose with no layer: %v", err)
-	}
-}
-
-func TestTheNodeOverTheMeshOverTheDefault(t *testing.T) {
-	m := notifier()
-	layers := []Layer{
-		{From: MeshWideLayer, Values: map[string]any{"width": float64(300)}},
-		{From: "laptop", Values: map[string]any{"font-size": float64(13), "width": float64(340)}},
-	}
-	file := map[string]any{"type": "file", "content": m.Resources[0]["content"]}
-	if err := settingInto(file, WithDefaults(m, layers), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if file["content"] != "font = Inter 13\nwidth = 340\n" {
-		t.Fatalf("filled as %q", file["content"])
-	}
-	file = map[string]any{"type": "file", "content": m.Resources[0]["content"]}
-	if err := settingInto(file, WithDefaults(m, layers[:1]), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if file["content"] != "font = Inter 10\nwidth = 300\n" {
-		t.Fatalf("the mesh's layer over the default filled as %q", file["content"])
-	}
-}
-
-// Composed for a machine, the way a push writes it: the default reaches the file, and the node's
-// layer overrides it.
-func TestAComposedMachineGetsTheDefaultAndTheNodesValue(t *testing.T) {
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, notifier())
-	with := anchorRendering(false)
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if why, left := composed.LeftOut["notifier"]; left {
-		t.Fatalf("the notifier was left out: %s", why)
-	}
-	if c := byID(composed.Resources)["notifier.configuration"]["content"]; c != "font = Inter 10\nwidth = 250\n" {
-		t.Fatalf("composed with no layer as %q", c)
-	}
-	with.Settings["notifier"] = []Layer{{From: "anchor", Values: map[string]any{"font-size": float64(13)}}}
-	if composed, err = r.Compose(with); err != nil {
-		t.Fatal(err)
-	}
-	if c := byID(composed.Resources)["notifier.configuration"]["content"]; c != "font = Inter 13\nwidth = 250\n" {
-		t.Fatalf("composed with the node's font size as %q", c)
-	}
-}
-
-// Setting a key the module gives a default is not refused as reaching nothing: it overrides the
-// default, which is how a running module gains a setting with no gap between.
-func TestAKeyWithADefaultIsNotStray(t *testing.T) {
-	m := notifier()
-	m.Resources[0]["content"] = "font = Inter ${setting:font-size}\nwidth = ${setting:width}\n"
-	stray := UnusedSettings(m, []Layer{{From: "laptop", Values: map[string]any{"font-size": float64(13), "colour": "red"}}})
-	joined := strings.Join(stray, "; ")
-	if strings.Contains(joined, `"font-size"`) || !strings.Contains(joined, `"colour"`) {
-		t.Fatalf("stray: %s", joined)
-	}
-}
-
-// A default fills ${setting:…} only: it never becomes a key of a mergeable file (issue 168).
-func TestADefaultIsNotMergedIntoAJSONFile(t *testing.T) {
-	m := notifier()
-	m.Resources = append(m.Resources, map[string]any{"id": "other", "type": "file", "path": "/x/other.json",
-		"merge": MergeJSON, "content": `{"keep": 1}`})
-	out, err := ApplySettings(m.Resources[1], WithDefaults(m, nil))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(out["content"].(string), "font-size") {
-		t.Fatalf("a default reached a mergeable file: %s", out["content"])
-	}
-}
-
-// A value that is the operator's has no default: no layer setting it is refused by name, as before.
-func TestAnOperatorsValueWithoutADefaultIsStillRefused(t *testing.T) {
-	m := notifier()
-	m.Resources[0]["content"] = "font = Inter ${setting:font-size}\nwidth = ${setting:width}\nfrom = ${setting:domain}\n"
-	err := JudgeSettings(m, nil, false)
-	if err == nil || !strings.Contains(err.Error(), "${setting:domain}") {
-		t.Fatalf("judged %v", err)
-	}
-	if strings.Contains(err.Error(), "font-size") {
-		t.Fatalf("a default was named as set today: %v", err)
-	}
-}
-
-func TestTheParserTakesAPreferenceAndRefusesTheRest(t *testing.T) {
-	if err := parsed(t, notifier()); err != nil {
-		t.Fatalf("a preference with a default was refused: %v", err)
-	}
-	for _, c := range []struct {
-		name   string
-		key    string
-		d      SettingDeclaration
-		refuse string
-	}{
-		{"no kind", "font-size", SettingDeclaration{Default: float64(10), Why: "x"}, `only a "preference" has a default`},
-		{"another kind", "font-size", SettingDeclaration{Kind: "operator", Default: float64(10), Why: "x"}, `only a "preference"`},
-		{"no default", "font-size", SettingDeclaration{Kind: KindPreference, Why: "x"}, "no default"},
-		{"an empty default", "font-size", SettingDeclaration{Kind: KindPreference, Default: " ", Why: "x"}, "an empty default"},
-		{"an object", "font-size", SettingDeclaration{Kind: KindPreference, Default: map[string]any{"a": 1.0}, Why: "x"}, "a string, a number or a boolean"},
-		{"no why", "font-size", SettingDeclaration{Kind: KindPreference, Default: float64(10)}, "no why"},
-		{"the operator's", "mail-domain", SettingDeclaration{Kind: KindPreference, Default: "example.tld", Why: "x"}, "is the operator's value"},
-		{"a secret", "api-token", SettingDeclaration{Kind: KindPreference, Default: "x", Why: "x"}, "is the operator's value"},
-		{"the mesh's word", PortsSetting, SettingDeclaration{Kind: KindPreference, Default: float64(1), Why: "x"}, "the mesh reads"},
-		{"read by nothing", "height", SettingDeclaration{Kind: KindPreference, Default: float64(300), Why: "x"}, "reaches nothing"},
-	} {
-		m := notifier()
-		m.Resources[0]["content"] = m.Resources[0]["content"].(string) + "x = ${setting:" + c.key + "}\n"
-		if c.name == "read by nothing" {
-			m.Resources[0]["content"] = "font = Inter ${setting:font-size}\nwidth = ${setting:width}\n"
-		}
-		m.Settings[c.key] = c.d
-		err := parsed(t, m)
-		if err == nil || !strings.Contains(err.Error(), c.refuse) {
-			t.Errorf("%s: parsed %v, want %q", c.name, err, c.refuse)
-		}
-	}
-}
-
-func TestEveryValueSaysWhereItCameFrom(t *testing.T) {
-	m := notifier()
-	m.Resources[0]["content"] = m.Resources[0]["content"].(string) + "x = ${setting:position}\n"
-	got := Effective(m, []Layer{
-		{From: MeshWideLayer, Values: map[string]any{"width": float64(300), "position": "top-right"}},
-		{From: "laptop", Values: map[string]any{"font-size": float64(13)}},
-	})
-	want := map[string]string{"font-size": "laptop", "position": MeshWideLayer, "width": MeshWideLayer}
-	if len(got) != 3 {
-		t.Fatalf("effective: %+v", got)
-	}
-	for _, s := range got {
-		if s.From != want[s.Key] {
-			t.Errorf("%s from %q, want %q", s.Key, s.From, want[s.Key])
-		}
-	}
-	if got[0].Key != "font-size" || got[0].Value != float64(13) || got[0].Default != float64(10) {
-		t.Fatalf("font-size: %+v", got[0])
-	}
-	only := Effective(m, nil)
-	if only[0].From != DefaultLayer || only[0].Value != float64(10) {
-		t.Fatalf("with no layer: %+v", only)
-	}
-}
-
-// A node may be called `default`. Its layer is a node's like any other: it overrides the module's
-// default, it merges into a mergeable file, and it is named among what is set.
-func TestANodeCalledDefaultIsANodesLayer(t *testing.T) {
-	m := notifier()
-	node := []Layer{{From: DefaultLayer, Values: map[string]any{"font-size": float64(13)}}}
-	file := map[string]any{"type": "file", "content": m.Resources[0]["content"]}
-	if err := settingInto(file, WithDefaults(m, node), m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if file["content"] != "font = Inter 13\nwidth = 250\n" {
-		t.Fatalf("the node called default was dropped: %q", file["content"])
-	}
-	out, err := ApplySettings(map[string]any{"id": "j", "type": "file", "merge": MergeJSON, "content": `{}`}, node)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(out["content"].(string), `"font-size": 13`) {
-		t.Fatalf("the node called default did not merge: %s", out["content"])
-	}
-	if got := Effective(m, node); got[0].FromDefault || got[0].Value != float64(13) {
-		t.Fatalf("the node's value read as the default: %+v", got[0])
-	}
-}
-
-// The operator's own value is told by what a key's name is about: its last word, or its last two as
-// a known compound; a plural as its singular; and never a number or a switch.
-func TestAKeyIsTheOperatorsByWhatItIsAbout(t *testing.T) {
-	for _, key := range []string{"max-tokens", "show-hostname", "ghost-opacity", "users-per-page", "mailbox-size",
-		"font-size", "width", "keyboard-delay", "ipv6-preferred", "client-width", "user-agent", "url-timeout",
-		"site-title", "cert-renewal-days", "name", "font-name", "allow-resize", "use-gpu", "disable-sender-check",
-		"max-recipients", "gateway-timeout", "sender-delay", "upstream-resolvers", "mirror-countries",
-		"pool-region", "proxy-timeout", "listen-backlog", "peer-keepalive", "admin-theme", "log-file",
-		"cache-path"} {
-		if w := operatorsWord(key); w != "" {
-			t.Errorf("%s read as the operator's (%s)", key, w)
-		}
-	}
-	for key, word := range map[string]string{"mail-domain": "domain", "api-key": "key", "admin-password": "password",
-		"oauth-client-id": "client-id", "db-dsn": "dsn", "public-ip": "ip", "puid": "puid", "dns-zone": "zone",
-		"webhook": "webhook", "notify_phone": "phone", "cors.origin": "origin", "smtp-pass": "pass",
-		"backup-passphrase": "passphrase", "data-owner": "owner", "fqdn": "fqdn", "tenant": "tenant", "host": "host",
-		"allowed-hosts": "host", "admin-emails": "email", "tokens": "token", "hostname": "hostname",
-		"apikey": "apikey", "servername": "servername", "tls-cert": "cert", "site": "site", "timezone": "timezone",
-		"bearer": "bearer", "bind-ipv4": "ipv4", "listen-ipv6": "ipv6", "site-name": "site-name",
-		"server-name": "server-name", "public-name": "public-name", "smtp-relay": "smtp-relay",
-		"host-name": "host-name", "user-name": "user-name", "domain-name": "domain-name",
-		"nameserver": "nameserver", "upstream-nameservers": "nameserver", "dns-server": "dns-server",
-		"dns-servers": "dns-server", "default-gateway": "gateway", "lan-subnet": "subnet", "sender": "sender",
-		"notify-recipients": "recipient", "contact": "contact", "tls-certificate": "certificate",
-		"allow-from": "allow-from", "deny-from": "deny-from", "allow-hosts": "host", "use-host": "host",
-		"trusted": "trusted", "allow-list": "allow-list", "ip-whitelist": "whitelist", "peer": "peer",
-		"wireguard-peers": "peer", "bind": "bind", "listen": "listen", "upstream": "upstream", "http-proxy": "proxy",
-		"trusted-proxies": "proxy", "admin": "admin", "notify-admin": "admin", "wake-mac": "mac",
-		"password-file": "password-file", "key-file": "key-file", "token-path": "token-path",
-		"secret-file": "secret-file", "cert-path": "cert-path"} {
-		if w := operatorsWord(key); w != word {
-			t.Errorf("%s: read %q, want %q", key, w, word)
-		}
-	}
-}
-
-// A default is a value the mesh writes, so the installation check reads it, even under a setting
-// called `description` or `why`; a setting's own why is prose and is not read.
-func TestTheInstallationCheckReadsADefault(t *testing.T) {
-	m := notifier()
-	m.Settings["relay"] = SettingDeclaration{Kind: KindPreference, Default: "relay.acme.be", Why: "as at relay.acme.be"}
-	m.Settings["description"] = SettingDeclaration{Kind: KindPreference, Default: "notes.acme.be", Why: "x"}
-	problems := strings.Join(InstallationProblems(m), "; ")
-	for _, want := range []string{"relay.acme.be at settings.relay.default", "notes.acme.be at settings.description.default"} {
-		if !strings.Contains(problems, want) {
-			t.Errorf("not reported: %q in %s", want, problems)
-		}
-	}
-	if strings.Contains(problems, "settings.relay.why") {
-		t.Errorf("a why was read as a value: %s", problems)
-	}
-}
-
-// A default fills ${setting:…} in what a module contributes and serves, and never replaces a value a
-// contribution states itself.
-func TestADefaultFillsAContributionAndAServedFactButNotALiteral(t *testing.T) {
-	m := notifier()
-	m.Settings["site-title"] = SettingDeclaration{Kind: KindPreference, Default: "Notes", Why: "x"}
-	contribution := map[string]any{"title": "${setting:site-title}", "width": "fixed", "port": float64(8080)}
-	got, err := overridden(contribution, WithDefaults(m, nil), "a contribution")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got["title"] != "Notes" || got["width"] != "fixed" {
-		t.Fatalf("contribution: %v", got)
-	}
-	got, err = overridden(contribution, WithDefaults(m, []Layer{{From: "laptop", Values: map[string]any{"width": "wide"}}}), "a contribution")
-	if err != nil || got["width"] != "wide" {
-		t.Fatalf("a node's value did not override a contribution's own key: %v %v", got, err)
-	}
-	served, err := Settle(map[string]any{"name": "${setting:site-title}"}, WithDefaults(m, nil))
-	if err != nil || served["name"] != "Notes" {
-		t.Fatalf("served: %v %v", served, err)
-	}
-	if _, err := Settle(map[string]any{"name": "${setting:site-title}"}, nil); err == nil {
-		t.Fatal("a served fact without the defaults was filled")
-	}
-}
-
-// A stored manifest with a key this controller does not know, at the top or inside any block, is read
-// and its module is left out of every declaration by name; the rest of the catalogue is read; the module
-// check refuses it. One case per block whose decoder wraps the decoder's words in its own.
-func TestAStoredManifestWithAnUnknownKeyIsLeftOutAndRegistrationRefusesIt(t *testing.T) {
-	for where, raw := range map[string]string{
-		"the top":             `{"module": "later", "version": "2", "a-field-from-later": {"x": 1}}`,
-		"a state":             `{"module": "later", "version": "2", "state": [{"name": "s", "a-field-from-later": 1}]}`,
-		"a provided name":     `{"module": "later", "version": "2", "provides": [{"name": "p", "a-field-from-later": 1}]}`,
-		"an offer's identity": `{"module": "later", "version": "2", "provides": [{"name": "p", "identity": {"in": "x", "a-field-from-later": 1}}]}`,
-		"a backup":            `{"module": "later", "version": "2", "data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable", "backup": {"dump": "x", "into": "y", "a-field-from-later": 1}}]}}`,
-		"an own secret":       `{"module": "later", "version": "2", "own-secrets": {"s": {"path": "/x", "a-field-from-later": 1}}}`,
-		"a seat's verb":       `{"module": "later", "version": "2", "seats": [{"name": "later-seat", "serves": [{"name": "v", "a-field-from-later": 1}]}]}`,
-	} {
-		var m Manifest
-		if err := json.Unmarshal([]byte(raw), &m); err != nil {
-			t.Errorf("%s: the stored manifest was not read: %v", where, err)
-			continue
-		}
-		if m.Module != "later" || m.Version != "2" || !strings.Contains(m.UnknownField(), `"a-field-from-later"`) {
-			t.Errorf("%s: read as %q %q, unknown %q", where, m.Module, m.Version, m.UnknownField())
-			continue
-		}
-		if where != "the top" && !strings.Contains(m.UnknownField(), ": json: unknown field") {
-			t.Errorf("%s: the block's decoder did not say it: %q", where, m.UnknownField())
-		}
-		left := Resolution{Node: "laptop", Modules: []Manifest{m, notifier()}}.LeftOut(nil, false)
-		if why := left["later"]; !strings.Contains(why, "uses a field this controller does not know") ||
-			!strings.Contains(why, "a-field-from-later") {
-			t.Errorf("%s: not left out by name: %v", where, left)
-		}
-		if _, notifierLeft := left["notifier"]; notifierLeft {
-			t.Errorf("%s: another module was left out with it: %v", where, left)
-		}
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "a-field-from-later") {
-			t.Errorf("%s: the module check took it: %v", where, err)
-		}
-	}
-	var known Manifest
-	if err := json.Unmarshal([]byte(`{"module": "now", "state": [{"name": "s"}]}`), &known); err != nil || known.UnknownField() != "" {
-		t.Fatalf("a known manifest: %v %q", err, known.UnknownField())
-	}
-	// A malformed manifest is still refused: only an unknown key is read past.
-	var bad Manifest
-	if err := json.Unmarshal([]byte(`{"module": "bad", "state": [{"name": 3}]}`), &bad); err == nil {
-		t.Fatal("a malformed stored manifest was read")
-	}
-}
-
-// A module left out for a key this controller does not know, inside an entry, is read past that key
-// alone: it still provides what it provides, its other entries are whole, and a key of the same name
-// that another entry knows is kept (novox/hq ADR 0262).
-func TestALeftOutModuleStillProvidesWhatItProvides(t *testing.T) {
-	var m Manifest
-	raw := `{"module": "later", "version": "2",
-		"provides": [{"name": "db", "scope": "mesh"}, {"name": "cache", "a-field-from-later": 1}],
-		"state": [{"name": "s", "history": 3}],
-		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable", "backup": {"dump": "x", "into": "d", "class": "later"}}]},
-		"resources": [{"id": "d", "type": "directory", "mode": "0700"}]}`
-	if err := json.Unmarshal([]byte(raw), &m); err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Provides) != 2 || m.Provides[0].Name != "db" || m.Provides[1].Name != "cache" {
-		t.Fatalf("provides: %+v", m.Provides)
-	}
-	if len(m.State) != 1 || m.State[0].History != 3 {
-		t.Fatalf("state: %+v", m.State)
-	}
-	if m.Data == nil || len(m.Data.Own) != 1 || m.Data.Own[0].Class != "valuable" {
-		t.Fatalf("data: the item's own class was taken for the backup's unknown one: %+v", m.Data)
-	}
-	for _, want := range []string{"provides[1].a-field-from-later", "data.own[0].backup.class"} {
-		if !strings.Contains(m.UnknownField(), want) {
-			t.Errorf("unknown %q does not say it read without %s", m.UnknownField(), want)
-		}
-	}
-	if !strings.Contains(UnknownFieldReason(m), "left out") {
-		t.Fatal(UnknownFieldReason(m))
-	}
-}
-
-// A left-out module's data is still copied: the backup holder on its machine keeps its lines while every
-// other thing of it is left out.
-func TestALeftOutModulesDataIsStillBackedUp(t *testing.T) {
-	var later Manifest
-	if err := json.Unmarshal([]byte(`{"module": "later", "version": "2", "a-field-from-later": 1,
-		"resources": [{"id": "d", "type": "directory", "mode": "0700"}, {"id": "rc", "type": "file", "path": "/etc/later.conf", "content": "x\n"}],
-		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable"}]}}`), &later); err != nil {
-		t.Fatal(err)
-	}
-	holder := Manifest{Module: "backups", Version: "1",
-		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
-			"content": "${contribution:" + BackupSeat + ":backup}"}}}
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, holder, later)
-	composed, err := r.Compose(anchorRendering(false))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, left := composed.LeftOut["later"]; !left {
-		t.Fatalf("not left out: %v", composed.LeftOut)
-	}
-	got := byID(composed.Resources)
-	if _, declared := got["later.rc"]; declared {
-		t.Fatal("the left-out module's file is still declared")
-	}
-	list, _ := got["backups.list"]["content"].(string)
-	if !strings.Contains(list, "# later") || !strings.Contains(list, "path /var/lib/later/d") {
-		t.Fatalf("the left-out module's data is no longer backed up:\n%s", list)
-	}
-}
-
-// A left-out module's backup lines are best effort: a line that cannot be placed — an access nobody
-// placed, a placement setting that does not read — is said among what could not be placed, and the
-// machine is declared (novox/hq ADR 0262).
-func TestALeftOutModulesUnplaceableBackupLineCostsOnlyThatLine(t *testing.T) {
-	holder := Manifest{Module: "backups", Version: "1",
-		Claims: []Claim{{Name: BackupSeat, Scope: ScopeNode}},
-		Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
-			"content": "${contribution:" + BackupSeat + ":backup}"}}}
-	media := Manifest{Module: "media", Version: "1",
-		Accesses: []Access{{ID: "library", Mode: "read"}},
-		Data:     &Data{Own: []DataItem{{ID: "library", Path: "${access:library}", Class: "valuable"}}}}
-	placedBadly := Manifest{Module: "notes", Version: "1",
-		Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/srv/notes", "mode": "0700"}},
-		Data:      &Data{Own: []DataItem{{ID: "d", Path: "${dir:d}", Class: "valuable"}}}}
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, holder, media, placedBadly)
-	with := anchorRendering(false)
-	with.Settings["notes"] = []Layer{LayerOf("anchor", map[string]any{PlacesSetting: "not a map"})}
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatalf("an unplaceable line of a left-out module failed the machine: %v", err)
-	}
-	for _, m := range []string{"media", "notes"} {
-		if _, left := composed.LeftOut[m]; !left {
-			t.Errorf("%s is not left out: %v", m, composed.LeftOut)
-		}
-	}
-	unplaced := strings.Join(composed.Unplaced, "\n")
-	for _, want := range []string{"media's backup for node-backup", "notes's backup for node-backup", "placement setting does not read"} {
-		if !strings.Contains(unplaced, want) {
-			t.Errorf("not said among what could not be placed: %q in\n%s", want, unplaced)
-		}
-	}
-	list, _ := byID(composed.Resources)["backups.list"]["content"].(string)
-	if strings.Contains(list, "/srv/notes") || strings.Contains(list, "${") {
-		t.Fatalf("a line was placed from the definition's default or unfilled:\n%s", list)
-	}
-}
diff --git a/internal/catalogue/setting_in_owner_test.go b/internal/catalogue/setting_in_owner_test.go
deleted file mode 100644
index 6e8f3598..00000000
--- a/internal/catalogue/setting_in_owner_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A declared directory may be owned by the account its module runs as (novox/hq issue 279): a media
-// manager runs as the puid and pgid its assignment sets per node, and a folder it must write was owned
-// by the manifest's literal, so the app refused it on a machine whose identity was not the image's.
-
-func recycler() Manifest {
-	return Manifest{Module: "sonarr",
-		Resources: []map[string]any{
-			{"id": "recycle-bin", "type": "directory", "path": "/srv/sonarr/recycle", "mode": "0755",
-				"owner": "${setting:puid}:${setting:pgid}"},
-			{"id": "identity", "type": "file", "path": "/srv/sonarr/identity.env", "mode": "0644",
-				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\n"},
-		},
-	}
-}
-
-func copied(r map[string]any) map[string]any {
-	out := map[string]any{}
-	for k, v := range r {
-		out[k] = v
-	}
-	return out
-}
-
-// The node's identity reaches the directory's owner, the node's layer over the mesh's, a number given
-// as a string or as a JSON number alike.
-func TestASettingOwnsADirectory(t *testing.T) {
-	m := recycler()
-	layers := []Layer{
-		{From: "the mesh", Values: map[string]any{"puid": "1000", "pgid": "1000"}},
-		{From: "this node", Values: map[string]any{"puid": float64(1001), "pgid": "2000"}},
-	}
-	r := copied(m.Resources[0])
-	if err := settingInto(r, layers, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if r["owner"] != "1001:2000" {
-		t.Fatalf("owned by %q, not 1001:2000", r["owner"])
-	}
-	user := copied(m.Resources[0])
-	user["owner"] = "${setting:puid}"
-	if err := settingInto(user, layers, m.Module); err != nil || user["owner"] != "1001" {
-		t.Fatalf("user alone: %v, %v", user["owner"], err)
-	}
-}
-
-// Composed for a machine, the way a push writes it: the directory reaches the node-engine owned by the
-// number the node's settings name, never by the placeholder.
-func TestAComposedMachineGetsTheOwnerTheSettingNames(t *testing.T) {
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, recycler())
-	with := anchorRendering(false)
-	with.Settings["sonarr"] = []Layer{{From: "anchor", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if why, left := composed.LeftOut["sonarr"]; left {
-		t.Fatalf("left out: %s", why)
-	}
-	got := byID(composed.Resources)["sonarr.recycle-bin"]
-	if got["owner"] != "1001:2000" {
-		t.Fatalf("composed owned by %v, not 1001:2000", got["owner"])
-	}
-}
-
-// Only a whole number owns a directory: an account's name, text, a sign, a fraction or a value past the
-// kernel's ids is refused by name, and the directory is left as it was. So is a key nothing sets.
-func TestAnOwnerSettingThatIsNoNumberIsRefused(t *testing.T) {
-	m := recycler()
-	for _, bad := range []any{"abc", "root", "", "-1", "+5", "1000:1000", "10 00", "1000\nx", float64(1.5),
-		float64(-3), "4294967295", "99999999999", true} {
-		r := copied(m.Resources[0])
-		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"puid": bad, "pgid": "1000"}}}, m.Module)
-		if err == nil || !strings.Contains(err.Error(), `"puid"`) || !strings.Contains(err.Error(), "whole number") {
-			t.Errorf("%v: %v", bad, err)
-		}
-		if r["owner"] != m.Resources[0]["owner"] {
-			t.Errorf("%v: the owner was changed on refusal: %v", bad, r["owner"])
-		}
-	}
-	r := copied(m.Resources[0])
-	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:puid}") {
-		t.Errorf("nothing set: %v", err)
-	}
-	if err := JudgeSettings(m, []Layer{{From: "ace", Values: map[string]any{"puid": "media", "pgid": "1000"}}}, false); err == nil ||
-		!strings.Contains(err.Error(), "whole number") {
-		t.Errorf("a stored name is not refused when judged: %v", err)
-	}
-}
-
-// Where the manifest is read: an owner holding a setting is a whole placeholder or a whole number on
-// each side of the colon, and every key is one the module asks for elsewhere or declares a default for.
-func TestAnOwnerSettingIsJudgedWhereTheManifestIsRead(t *testing.T) {
-	ok := []string{"${setting:puid}:${setting:pgid}", "${setting:puid}", "${setting:puid}:1000", "1000:${setting:pgid}",
-		"1000:1000", "media:media"}
-	bad := []string{
-		"${setting:puid}x",
-		"x${setting:puid}",
-		"${setting:puid}:${setting:pgid}:1",
-		"${setting:puid}${setting:pgid}",
-		"media:${setting:pgid}",
-		"${setting:puid}:",
-		"${setting:other}:${setting:pgid}",
-	}
-	for _, owner := range append(ok, bad...) {
-		m := recycler()
-		m.Resources[0] = copied(m.Resources[0])
-		m.Resources[0]["owner"] = owner
-		err := parsed(t, m)
-		refused := err != nil && strings.Contains(err.Error(), "owner")
-		want := false
-		for _, b := range bad {
-			want = want || b == owner
-		}
-		if refused != want {
-			t.Errorf("%s: refused %v, want %v (%v)", owner, refused, want, err)
-		}
-	}
-	// A key with a default is declared, though nothing else asks for it.
-	m := recycler()
-	m.Resources = m.Resources[:1]
-	m.Resources[0] = copied(m.Resources[0])
-	m.Resources[0]["owner"] = "${setting:workers}"
-	m.Settings = map[string]SettingDeclaration{"workers": {Kind: KindPreference, Default: float64(4), Why: "a test"}}
-	if err := parsed(t, m); err != nil && strings.Contains(err.Error(), "owner") {
-		t.Errorf("a declared key was refused: %v", err)
-	}
-	// A file's owner takes no setting: the sweep says so.
-	f := recycler()
-	f.Resources[1] = copied(f.Resources[1])
-	f.Resources[1]["owner"] = "${setting:puid}"
-	if err := parsed(t, f); err == nil || !strings.Contains(err.Error(), "not filled in this field") {
-		t.Errorf("a file's owner setting passed: %v", err)
-	}
-}
-
-// A key a directory's owner asks for is a destination, so setting it is not called stray.
-func TestASettingAnOwnerAsksForIsNotStray(t *testing.T) {
-	m := recycler()
-	m.Resources = m.Resources[:1]
-	stray := strings.Join(UnusedSettings(m, []Layer{{From: "ace", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}), "; ")
-	if strings.Contains(stray, "puid") || strings.Contains(stray, "pgid") {
-		t.Errorf("called stray: %s", stray)
-	}
-}
-
-// An owner is written as the number parsed: "0001" and "00" reach the node-engine as 1 and 0, never as text.
-// Uid 0 is allowed, because a key an owner asks for is the terminal's alone.
-func TestAnOwnerSettingIsWrittenAsTheNumber(t *testing.T) {
-	m := recycler()
-	r := copied(m.Resources[0])
-	if err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"puid": "0001", "pgid": "00"}}}, m.Module); err != nil {
-		t.Fatal(err)
-	}
-	if r["owner"] != "1:0" {
-		t.Fatalf("owned by %q, not 1:0", r["owner"])
-	}
-}
-
-// Every key a directory's owner asks for is the controller's terminal's alone (novox/hq issue 279, issue 339):
-// root chowns the folder to it, so it is terminal-only whatever else asks for it — a file nothing trusts, a
-// default, or nothing at all.
-func TestAnOwnersKeyIsTheTerminals(t *testing.T) {
-	m := recycler()
-	m.Resources[1] = copied(m.Resources[1])
-	m.Resources[1]["trusted"] = false
-	m.Settings = map[string]SettingDeclaration{"pgid": {Kind: KindPreference, Default: "1000", Why: "a test"}}
-	keys := strings.Join(TerminalKeys(m), ",")
-	for _, k := range []string{"puid", "pgid"} {
-		if !strings.Contains(","+keys+",", ","+k+",") {
-			t.Errorf("%s is not the terminal's: %s", k, keys)
-		}
-	}
-}
-
-// A key asked only in a template is not refused while the manifest still names its templates (issue 817), and
-// is judged once they are filled: WithTemplatesFrom over a tree whose template does not ask for it refuses it.
-func TestAnOwnerSettingAskedOnlyInATemplateIsJudgedOnceFilled(t *testing.T) {
-	raw := `{"module":"sonarr","version":"1",
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[{"id":"recycle-bin","type":"directory","path":"/srv/sonarr/recycle","mode":"0755","owner":"${setting:puid}:${setting:pgid}"},
-               {"id":"identity","type":"file","path":"/srv/sonarr/identity.env","mode":"0644","template":"files/identity.env"}]}`
-	m, err := ParseManifest([]byte(raw))
-	if err != nil {
-		t.Fatalf("a templated manifest was refused: %v", err)
-	}
-	write := func(text string) string {
-		dir := t.TempDir()
-		if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(filepath.Join(dir, "files", "identity.env"), []byte(text), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		return dir
-	}
-	if _, err := WithTemplatesFrom(m, write("PUID=${setting:puid}\nPGID=${setting:pgid}\n")); err != nil {
-		t.Errorf("a template asking for both keys was refused: %v", err)
-	}
-	_, err = WithTemplatesFrom(m, write("NOTHING=1\n"))
-	if err == nil || !strings.Contains(err.Error(), "asks for \"puid\" nowhere else") {
-		t.Errorf("a template not asking for puid was not refused: %v", err)
-	}
-}
diff --git a/internal/catalogue/setting_in_unit_test.go b/internal/catalogue/setting_in_unit_test.go
deleted file mode 100644
index 77197b72..00000000
--- a/internal/catalogue/setting_in_unit_test.go
+++ /dev/null
@@ -1,159 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A setting may name the unit a service resource holds: a module that stops the distribution's own timer
-// for the pool the operator names cannot write the pool into its definition (novox/hq ADR 0112), and a
-// unit name with ${setting:…} left in it is a unit no machine has, so the apply fails far from its cause.
-
-func scrubber() Manifest {
-	return Manifest{Module: "zfs",
-		Settings: map[string]SettingDeclaration{
-			"scrub-cadence": {Kind: KindPreference, Default: "weekly", Why: "what the distribution's timer did"},
-		},
-		Resources: []map[string]any{
-			{"id": "distribution-weekly", "type": "service", "unit": "zfs-scrub-weekly@${setting:scrub-pool}.timer",
-				"state": "stopped", "boot": "disabled"},
-			{"id": "distribution-monthly", "type": "service", "unit": "zfs-scrub-monthly@${setting:scrub-pool}.timer",
-				"state": "stopped", "boot": "disabled"},
-			{"id": "scrub-config", "type": "file", "path": "/etc/zfs-tools/scrub.conf",
-				"content": "pool=${setting:scrub-pool}\ncadence=${setting:scrub-cadence}\n"},
-		},
-	}
-}
-
-func TestASettingNamesAServicesUnit(t *testing.T) {
-	m := scrubber()
-	layers := WithDefaults(m, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}})
-	for i, want := range []string{"zfs-scrub-weekly@storage.timer", "zfs-scrub-monthly@storage.timer"} {
-		r := map[string]any{}
-		for k, v := range m.Resources[i] {
-			r[k] = v
-		}
-		if err := settingInto(r, layers, m.Module); err != nil {
-			t.Fatal(err)
-		}
-		if r["unit"] != want {
-			t.Errorf("composed as %q, not %q", r["unit"], want)
-		}
-	}
-}
-
-// Composed for a machine, the way a push writes it: the operator's pool and cadence reach the units' names
-// and the file.
-func TestAComposedMachineGetsTheUnitTheSettingNames(t *testing.T) {
-	r := anAdoptedAnchor()
-	r.Modules = append(r.Modules, scrubber())
-	with := anchorRendering(false)
-	with.Settings["zfs"] = []Layer{{From: "anchor", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}}
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if why, left := composed.LeftOut["zfs"]; left {
-		t.Fatalf("left out: %s", why)
-	}
-	got := byID(composed.Resources)
-	for id, want := range map[string]string{"zfs.distribution-weekly": "zfs-scrub-weekly@storage.timer",
-		"zfs.distribution-monthly": "zfs-scrub-monthly@storage.timer"} {
-		if got[id]["unit"] != want {
-			t.Errorf("%s composed as %v, not %s", id, got[id]["unit"], want)
-		}
-		t.Logf("%s: %v", id, got[id]["unit"])
-	}
-	if c := got["zfs.scrub-config"]["content"]; c != "pool=storage\ncadence=monthly\n" {
-		t.Errorf("the file: %q", c)
-	}
-}
-
-// A value that would not make a unit's name is refused by name, never written: a space, a slash, a
-// newline that would begin a directive, or a second suffix.
-func TestASettingThatMakesNoUnitNameIsRefused(t *testing.T) {
-	m := scrubber()
-	for _, bad := range []string{"", "stor age", "a/b", "storage\nExecStart=/bin/sh", "a@b", "$(x)", "*", `a\\x2d`} {
-		r := map[string]any{}
-		for k, v := range m.Resources[0] {
-			r[k] = v
-		}
-		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
-		if err == nil || !strings.Contains(err.Error(), "scrub-pool") || !strings.Contains(err.Error(), "unit") {
-			t.Errorf("%q: %v", bad, err)
-		}
-		if r["unit"] != m.Resources[0]["unit"] {
-			t.Errorf("%q: the unit was changed on refusal: %v", bad, r["unit"])
-		}
-	}
-	r := map[string]any{}
-	for k, v := range m.Resources[0] {
-		r[k] = v
-	}
-	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:scrub-pool}") {
-		t.Errorf("nothing set: %v", err)
-	}
-}
-
-// A key a unit's name asks for is a destination, so setting it is not called stray, and judging the
-// settings sees it.
-func TestASettingAUnitAsksForIsNotStrayAndIsJudged(t *testing.T) {
-	m := scrubber()
-	stray := strings.Join(UnusedSettings(m, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": "storage"}}}), "; ")
-	if strings.Contains(stray, "scrub-pool") {
-		t.Errorf("called stray: %s", stray)
-	}
-	if err := JudgeSettings(m, nil, false); err == nil || !strings.Contains(err.Error(), "scrub-pool") {
-		t.Errorf("a unit's setting nothing sets is not refused when judged: %v", err)
-	}
-}
-
-// Third review: a setting may name only a template's instance — right after the `@`, before the final
-// suffix, and the whole instance — so a value can never make the unit another unit, nor another kind.
-// Refused where the manifest is read, near its author.
-func TestASettingInAUnitNameIsOnlyATemplatesInstance(t *testing.T) {
-	ok := []string{"zfs-scrub-weekly@${setting:scrub-pool}.timer", "getty@${setting:tty}.service"}
-	bad := []string{
-		"${setting:unit}",
-		"${setting:name}.timer",
-		"zfs-scrub-${setting:cadence}@storage.timer",
-		"zfs-scrub@${setting:pool}-x.timer",
-		"zfs-scrub@x-${setting:pool}.timer",
-		"zfs-scrub@${setting:pool}.${setting:kind}",
-		"zfs-scrub@${setting:pool}",
-		"zfs-scrub@${setting:a}${setting:b}.timer",
-	}
-	for _, unit := range append(ok, bad...) {
-		m := Manifest{Module: "zfs", Resources: []map[string]any{{"id": "t", "type": "service", "unit": unit, "state": "stopped"}}}
-		err := parsed(t, m)
-		refused := err != nil && strings.Contains(err.Error(), "instance")
-		want := false
-		for _, b := range bad {
-			want = want || b == unit
-		}
-		if refused != want {
-			t.Errorf("%s: refused %v, want %v (%v)", unit, refused, want, err)
-		}
-	}
-}
-
-func TestAnInstanceValueMayNotLeadWithADashNorBeLong(t *testing.T) {
-	m := scrubber()
-	for _, bad := range []string{"-storage", "--help", strings.Repeat("a", 65)} {
-		r := map[string]any{}
-		for k, v := range m.Resources[0] {
-			r[k] = v
-		}
-		err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
-		if err == nil || !strings.Contains(err.Error(), "scrub-pool") {
-			t.Errorf("%q: %v", bad, err)
-		}
-	}
-	r := map[string]any{}
-	for k, v := range m.Resources[0] {
-		r[k] = v
-	}
-	if err := settingInto(r, []Layer{{From: "ace", Values: map[string]any{"scrub-pool": strings.Repeat("a", 64)}}}, m.Module); err != nil {
-		t.Errorf("64 characters: %v", err)
-	}
-}
diff --git a/internal/catalogue/setting_into_test.go b/internal/catalogue/setting_into_test.go
deleted file mode 100644
index 4b6f6285..00000000
--- a/internal/catalogue/setting_into_test.go
+++ /dev/null
@@ -1,55 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// An operator's value reaches a file from the assignment's settings, the node's layer over the
-// mesh's (novox/hq ADR 0112, ADR 0155), and a value nothing set is refused by name.
-func TestASettingReachesAFileFromTheLayers(t *testing.T) {
-	file := map[string]any{"id": "env", "type": "file", "path": "/x/mail.env",
-		"content": "DOMAIN=${setting:domain}\nSITENAME=${setting:sitename}\nWORKERS=${setting:workers}\n"}
-	layers := []Layer{
-		{From: "the mesh", Values: map[string]any{"domain": "example.tld", "sitename": "Mesh", "workers": float64(4)}},
-		{From: "this node", Values: map[string]any{"sitename": "This one"}},
-	}
-	if err := settingInto(file, layers, "mail"); err != nil {
-		t.Fatal(err)
-	}
-	if file["content"] != "DOMAIN=example.tld\nSITENAME=This one\nWORKERS=4\n" {
-		t.Fatalf("filled as %q", file["content"])
-	}
-}
-
-func TestASettingNothingSetIsRefusedByName(t *testing.T) {
-	file := map[string]any{"id": "env", "type": "file", "content": "DOMAIN=${setting:domain}\n"}
-	err := settingInto(file, []Layer{{From: "the mesh", Values: map[string]any{"other": "x"}}}, "mail")
-	if err == nil {
-		t.Fatal("a setting nothing set was written as something")
-	}
-	for _, want := range []string{"${setting:domain}", "settings set mail", "set today: other"} {
-		if !strings.Contains(err.Error(), want) {
-			t.Fatalf("the refusal lacks %q: %v", want, err)
-		}
-	}
-	// Left as it was: the literal placeholder must never reach a machine.
-	if file["content"] != "DOMAIN=${setting:domain}\n" {
-		t.Fatalf("content was changed on refusal: %q", file["content"])
-	}
-}
-
-// A key a file asks for is a destination, so setting it is not called stray.
-func TestASettingAFileAsksForIsNotStray(t *testing.T) {
-	m := Manifest{Module: "mail", Resources: []map[string]any{
-		{"id": "env", "type": "file", "content": "DOMAIN=${setting:domain}\n"},
-	}}
-	layers := []Layer{{From: "the mesh", Values: map[string]any{"domain": "example.tld", "stray": "x"}}}
-	unused := strings.Join(UnusedSettings(m, layers), "; ")
-	if strings.Contains(unused, `"domain"`) {
-		t.Fatalf("a key a file asks for was called stray: %s", unused)
-	}
-	if !strings.Contains(unused, `"stray"`) {
-		t.Fatalf("a key nothing reads was not named: %s", unused)
-	}
-}
diff --git a/internal/catalogue/setting_takes_test.go b/internal/catalogue/setting_takes_test.go
deleted file mode 100644
index 3deb6a6c..00000000
--- a/internal/catalogue/setting_takes_test.go
+++ /dev/null
@@ -1,243 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// twoFiles is a module that owns two configurable files, which issue 168 said no module could:
-// every key of every layer reached both.
-func twoFiles(app, sidecar []any) Manifest {
-	appFile := map[string]any{"id": "app", "type": "file", "path": "/etc/app.json", "merge": MergeJSON,
-		"content": `{"server":{"port":8080},"search":{"safe":1}}`}
-	sideFile := map[string]any{"id": "sidecar", "type": "file", "path": "/etc/sidecar.json", "merge": MergeJSON,
-		"content": `{"url":"http://127.0.0.1:8080"}`}
-	if app != nil {
-		appFile[TakesSettingsField] = app
-	}
-	if sidecar != nil {
-		sideFile[TakesSettingsField] = sidecar
-	}
-	return Manifest{Module: "search", Resources: []map[string]any{
-		appFile, sideFile,
-		{"id": "env", "type": "file", "path": "/etc/search.env", "content": "SITE=${setting:site-name}\n"},
-	}}
-}
-
-func settledContent(t *testing.T, resource map[string]any, layers []Layer) map[string]any {
-	t.Helper()
-	out, err := ApplySettings(resource, layers)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, kept := out[TakesSettingsField]; kept {
-		t.Errorf("%v still carries %s; the host knows no such field", out["id"], TakesSettingsField)
-	}
-	var parsed map[string]any
-	if err := json.Unmarshal([]byte(out["content"].(string)), &parsed); err != nil {
-		t.Fatalf("%v is not JSON after settling: %v", out["id"], err)
-	}
-	return parsed
-}
-
-func TestEachMergeableFileTakesOnlyTheKeysItNames(t *testing.T) {
-	// novox/hq ADR 0326 §1, issue 168: two configurable files, each taking its own keys. A key for
-	// the other file, for a ${setting:…} elsewhere or for the mesh itself lands in neither.
-	m := twoFiles([]any{"server", "search"}, []any{"url"})
-	layers := []Layer{
-		{From: "the mesh", Values: map[string]any{
-			"server": map[string]any{"base_url": "https://search.example.tld/"},
-			"url":    "http://127.0.0.1:9090", "site-name": "Search",
-			"endpoints": map[string]any{"web": map[string]any{"reach": "public"}}}},
-		{From: "node-a", Values: map[string]any{"search": map[string]any{"safe": 0.0}}},
-	}
-
-	app := settledContent(t, m.Resources[0], layers)
-	for _, stray := range []string{"url", "site-name", "endpoints"} {
-		if _, in := app[stray]; in {
-			t.Errorf("app took %q, which it does not name: %v", stray, app)
-		}
-	}
-	server, _ := app["server"].(map[string]any)
-	if server["base_url"] != "https://search.example.tld/" || server["port"] != 8080.0 {
-		t.Errorf("app's server block is %v; the setting should merge into the file's own", server)
-	}
-	if search, _ := app["search"].(map[string]any); search["safe"] != 0.0 {
-		t.Errorf("app's search block is %v; the node's layer should win", search)
-	}
-
-	side := settledContent(t, m.Resources[1], layers)
-	if side["url"] != "http://127.0.0.1:9090" {
-		t.Errorf("sidecar's url is %v; it names url", side["url"])
-	}
-	if len(side) != 1 {
-		t.Errorf("sidecar took keys it does not name: %v", side)
-	}
-}
-
-func TestAnEmptyListTakesNoSetting(t *testing.T) {
-	// ADR 0164 §12: a file that names no setting takes none.
-	m := twoFiles([]any{"server"}, []any{})
-	side := settledContent(t, m.Resources[1], []Layer{{From: "the mesh", Values: map[string]any{
-		"server": map[string]any{"port": 1.0}, "url": "x"}}})
-	if len(side) != 1 || side["url"] != "http://127.0.0.1:8080" {
-		t.Errorf("a file taking none was changed: %v", side)
-	}
-}
-
-func TestAFileThatNamesNothingKeepsTodaysForm(t *testing.T) {
-	// ADR 0326 §3, ADR 0164 §15: a module none of whose files names keys is left as it was.
-	m := twoFiles(nil, nil)
-	app := settledContent(t, m.Resources[0], []Layer{{From: "the mesh", Values: map[string]any{"url": "x"}}})
-	if app["url"] != "x" {
-		t.Errorf("a silent file should still take every key until its module names them: %v", app)
-	}
-	if unused := UnusedSettings(m, []Layer{{From: "the mesh", Values: map[string]any{"anything": 1}}}); len(unused) != 0 {
-		t.Errorf("today's form has nothing stray, and said: %v", unused)
-	}
-}
-
-func TestAKeyNoFileNamesIsStray(t *testing.T) {
-	// ADR 0326 §5: once the files name their keys, a key none of them names — and nothing else
-	// takes — is stray, and is said with what each file takes.
-	m := twoFiles([]any{"server", "search"}, []any{"url"})
-	unused := UnusedSettings(m, []Layer{{From: "the mesh", Values: map[string]any{
-		"server": 1, "url": "x", "site-name": "Search", "ui": map[string]any{"theme": "dark"}}}})
-	if len(unused) != 1 || !strings.Contains(unused[0], `"ui"`) {
-		t.Fatalf("only ui reaches nothing; named: %v", unused)
-	}
-	if !strings.Contains(unused[0], "app takes server, search") || !strings.Contains(unused[0], "sidecar takes url") {
-		t.Errorf("the stray key's message does not say what each file takes: %s", unused[0])
-	}
-}
-
-func TestOneNamingFileMakesEveryMergeableFileName(t *testing.T) {
-	// ADR 0326 §2: a module with one naming and one silent mergeable file is refused, naming the
-	// silent one — the silent one would otherwise still take every key.
-	m := twoFiles([]any{"server"}, nil)
-	problems := TakenSettingsProblems(m)
-	if len(problems) != 1 || !strings.Contains(problems[0], "sidecar merges and names no takes-settings") {
-		t.Fatalf("problems: %v", problems)
-	}
-	if err := JudgeSettings(m, nil, false); err == nil || !strings.Contains(err.Error(), "sidecar") {
-		t.Errorf("composing it should refuse it too, and said: %v", err)
-	}
-	raw, err := json.Marshal(map[string]any{"module": m.Module, "version": "1", "resources": m.Resources})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := ParseManifest(raw); err == nil || !strings.Contains(err.Error(), "sidecar merges and names no") {
-		t.Errorf("the module check does not say it: %v", err)
-	}
-}
-
-func TestTakesSettingsIsRefusedWhereItCannotMeanAnything(t *testing.T) {
-	// ADR 0326 §4.
-	cases := map[string]struct {
-		resource map[string]any
-		says     string
-	}{
-		"on a file that does not merge": {
-			map[string]any{"id": "plain", "type": "file", "path": "/x", "content": "x",
-				TakesSettingsField: []any{"a"}},
-			"does not merge"},
-		"not a list": {
-			map[string]any{"id": "conf", "type": "file", "path": "/x", "merge": MergeJSON, "content": "{}",
-				TakesSettingsField: "server"},
-			"is a list of setting keys"},
-		"a mesh word": {
-			map[string]any{"id": "conf", "type": "file", "path": "/x", "merge": MergeJSON, "content": "{}",
-				TakesSettingsField: []any{"endpoints"}},
-			"the mesh reads"},
-		"a protected key": {
-			map[string]any{"id": "conf", "type": "file", "path": "/x", "merge": MergeJSON, "content": "{}",
-				"protected": []any{"secret"}, TakesSettingsField: []any{"secret"}},
-			"keeps it as protected"},
-		"named twice": {
-			map[string]any{"id": "conf", "type": "file", "path": "/x", "merge": MergeJSON, "content": "{}",
-				TakesSettingsField: []any{"a", "a"}},
-			"twice"},
-		"not a key": {
-			map[string]any{"id": "conf", "type": "file", "path": "/x", "merge": MergeJSON, "content": "{}",
-				TakesSettingsField: []any{"two words"}},
-			"not a usable setting key"},
-	}
-	for name, c := range cases {
-		problems := TakenSettingsProblems(Manifest{Module: "m", Resources: []map[string]any{c.resource}})
-		if !containsText(problems, c.says) {
-			t.Errorf("%s: want a problem saying %q, got %v", name, c.says, problems)
-		}
-	}
-	// And a file that does not merge is refused where it is settled, not handed to the host.
-	plain := map[string]any{"id": "plain", "type": "file", "path": "/x", "content": "x",
-		TakesSettingsField: []any{"a"}}
-	if _, err := ApplySettings(plain, nil); err == nil {
-		t.Error("a file that does not merge and names keys was settled")
-	}
-}
-
-func TestASoftwareSpelledKeyIsUsable(t *testing.T) {
-	// A file's keys are its software's: nodered's timeZone is not lower case and is still a key.
-	m := Manifest{Module: "flows", Resources: []map[string]any{{"id": "settings", "type": "file",
-		"path": "/x", "merge": MergeJSON, "content": "{}", TakesSettingsField: []any{"timeZone"}}}}
-	if problems := TakenSettingsProblems(m); len(problems) != 0 {
-		t.Errorf("timeZone was refused: %v", problems)
-	}
-}
-
-func containsText(list []string, text string) bool {
-	for _, s := range list {
-		if strings.Contains(s, text) {
-			return true
-		}
-	}
-	return false
-}
-
-func TestAModuleThatDeclaresASettingNamesItsFilesKeys(t *testing.T) {
-	// ADR 0326 §3, ADR 0164 §15, novox/hq issue 574: only a module that declares no settings keeps
-	// today's form. One that declares a preference and owns a silent mergeable file is refused where
-	// a definition is written — and read and composed where a stored one is read again, so a build kept
-	// from before the rule is still sent and still put back.
-	declaring := func(app, sidecar []any) Manifest {
-		m := twoFiles(app, sidecar)
-		m.Resources[2]["content"] = "WORKERS=${setting:workers}\n"
-		m.Settings = map[string]SettingDeclaration{"workers": {Kind: KindPreference, Default: 4.0, Why: "a number"}}
-		return m
-	}
-	m := declaring(nil, nil)
-	problems := WrittenSettingsProblems(m)
-	if len(problems) != 2 || !containsText(problems, "mergeable app names no takes-settings") ||
-		!containsText(problems, "mergeable sidecar names no takes-settings") {
-		t.Errorf("where it is written: %v", problems)
-	}
-	if problems := TakenSettingsProblems(m); len(problems) != 0 {
-		t.Errorf("what a stored definition is read by refuses it: %v", problems)
-	}
-	raw, err := json.Marshal(map[string]any{"module": m.Module, "version": "1", "resources": m.Resources,
-		"settings": map[string]any{"workers": map[string]any{"kind": KindPreference, "default": 4, "why": "a number"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	read, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("a stored build from before the rule is not read again: %v", err)
-	}
-	if err := JudgeSettings(read, nil, false); err != nil {
-		t.Errorf("a stored definition is composed as before, and was refused: %v", err)
-	}
-
-	if problems := WrittenSettingsProblems(declaring([]any{"server"}, []any{})); len(problems) != 0 {
-		t.Errorf("every mergeable file names its keys, and was refused: %v", problems)
-	}
-	if problems := WrittenSettingsProblems(twoFiles(nil, nil)); len(problems) != 0 {
-		t.Errorf("a module declaring no setting was refused: %v", problems)
-	}
-	// One naming file and one silent: §2 names the silent one, and §3 does not name it again.
-	mixed := declaring([]any{"server"}, nil)
-	if written, taken := WrittenSettingsProblems(mixed), TakenSettingsProblems(mixed); len(written) != 0 || len(taken) != 1 {
-		t.Errorf("the silent file is reported %d times by §3 and %d by §2; want once, by §2: %v %v",
-			len(written), len(taken), written, taken)
-	}
-}
diff --git a/internal/catalogue/settings_judge_test.go b/internal/catalogue/settings_judge_test.go
deleted file mode 100644
index 3dbee5e4..00000000
--- a/internal/catalogue/settings_judge_test.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A setting is judged where it is stored, and an impossible one costs a module, not a machine
-// (novox/hq ADR 0163, rule 6): the one judgement, used by SetSettings before storing and by
-// Compose when a definition has moved under a stored setting.
-func TestASettingThatCannotComposeIsRefusedByNameAndLeavesOnlyItsModuleOut(t *testing.T) {
-	web := Manifest{Module: "hello-web",
-		Listens: []Listening{{Port: 8080, From: FromEverywhere}},
-		Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
-			"ports": []any{"8080"}}}}
-	for _, c := range []struct {
-		name   string
-		layer  map[string]any
-		refuse string
-	}{
-		{"a port the module does not publish", map[string]any{PortsSetting: map[string]any{"9999": 10000}},
-			"hello-web gives port 9999 a machine port, and no container of its publishes 9999"},
-		{"a mesh-wide port", map[string]any{PortsSetting: map[string]any{"8080": 10000}},
-			"a port is a fact about one machine"},
-	} {
-		from := "anchor"
-		if c.name == "a mesh-wide port" {
-			from = MeshWideLayer
-		}
-		err := JudgeSettings(web, []Layer{LayerOf(from, c.layer)}, true)
-		if err == nil || !strings.Contains(err.Error(), c.refuse) {
-			t.Errorf("%s: judged %v, want %q", c.name, err, c.refuse)
-		}
-	}
-	if err := JudgeSettings(web, []Layer{{From: "anchor", Placement: map[string]any{PortsSetting: map[string]any{"8080": 10000}}}}, true); err != nil {
-		t.Fatalf("a port the module publishes was refused: %v", err)
-	}
-
-	// Composed, a module whose stored setting no longer works is left out by name; the rest of
-	// the machine is declared.
-	r := anAdoptedAnchor()
-	with := anchorRendering(false)
-	with.Settings = SettingsBy{"hello-web": {{From: "anchor", Placement: map[string]any{PortsSetting: map[string]any{"9999": 10000}}}}}
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	why, left := composed.LeftOut["hello-web"]
-	if !left || !strings.Contains(why, "no container of its publishes 9999") {
-		t.Fatalf("hello-web is not left out by name: %v", composed.LeftOut)
-	}
-	if len(composed.LeftOut) != 1 {
-		t.Fatalf("more than hello-web is left out: %v", composed.LeftOut)
-	}
-	got := byID(composed.Resources)
-	if _, declared := got["hello-web.server"]; declared {
-		t.Fatal("the left-out module's container is still declared")
-	}
-	if _, declared := got["distribution.store"]; !declared {
-		t.Fatal("the rest of the machine was not declared")
-	}
-	if left := r.LeftOut(with.Settings, false); len(left) != 1 || left["hello-web"] == "" {
-		t.Fatalf("the judgement a plan reads differs from what compose did: %v", left)
-	}
-}
-
-// A taken container keeps a found network by a per-machine setting (novox/hq ADR 0163, rule 4):
-// on an adopted machine only, for a container the module declares, and it reaches the container's
-// declaration as the networks it also joins.
-func TestAKeptNetworkReachesTheContainerOnAnAdoptedMachineOnly(t *testing.T) {
-	r := anAdoptedAnchor()
-	keep := SettingsBy{"hello-web": {LayerOf("anchor",
-		map[string]any{NetworksSetting: map[string]any{"server": []any{"predecessor_default"}}})}}
-
-	with := anchorRendering(true)
-	with.Settings = keep
-	composed, err := r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(composed.LeftOut) != 0 {
-		t.Fatalf("a kept network left a module out: %v", composed.LeftOut)
-	}
-	server := byID(composed.Resources)["hello-web.server"]
-	networks, _ := server["networks"].([]any)
-	if len(networks) != 1 || networks[0] != "predecessor_default" {
-		t.Fatalf("the container does not join the kept network: %v", server)
-	}
-	if _, has := byID(composed.Resources)["distribution.store"]["networks"]; has {
-		t.Fatal("another container joins a network nobody kept for it")
-	}
-
-	// Converged, the setting reaches nothing it was for, and the module is left out saying so.
-	with = anchorRendering(false)
-	with.Settings = keep
-	composed, err = r.Compose(with)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if why := composed.LeftOut["hello-web"]; !strings.Contains(why, "anchor is converged") {
-		t.Fatalf("a kept network on a converged machine: %v", composed.LeftOut)
-	}
-
-	web := r.Modules[4]
-	for _, c := range []struct {
-		name  string
-		layer Layer
-		want  string
-	}{
-		{"mesh-wide", LayerOf(MeshWideLayer, map[string]any{NetworksSetting: map[string]any{"server": []any{"x"}}}),
-			"a found network is a fact about one machine"},
-		{"an unknown container", LayerOf("anchor", map[string]any{NetworksSetting: map[string]any{"db": []any{"x"}}}),
-			`names the container "db", which it does not declare`},
-		{"not a list", LayerOf("anchor", map[string]any{NetworksSetting: map[string]any{"server": "x"}}),
-			"is a list of network names"},
-		{"not a network name", LayerOf("anchor", map[string]any{NetworksSetting: map[string]any{"server": []any{"a/b"}}}),
-			"which is not a network name"},
-	} {
-		_, err := KeptNetworks(web, []Layer{c.layer}, true)
-		if err == nil || !strings.Contains(err.Error(), c.want) {
-			t.Errorf("%s: %v, want %q", c.name, err, c.want)
-		}
-	}
-	if kept, err := KeptNetworks(web, nil, false); err != nil || kept != nil {
-		t.Fatalf("no setting: %v %v", kept, err)
-	}
-}
diff --git a/internal/catalogue/settings_test.go b/internal/catalogue/settings_test.go
deleted file mode 100644
index 2313d8be..00000000
--- a/internal/catalogue/settings_test.go
+++ /dev/null
@@ -1,246 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func file(content string, protected ...string) map[string]any {
-	r := map[string]any{"id": "conf", "type": "file", "path": "/etc/thing.json",
-		"merge": MergeJSON, "content": content}
-	if len(protected) > 0 {
-		var as []any
-		for _, p := range protected {
-			as = append(as, p)
-		}
-		r["protected"] = as
-	}
-	return r
-}
-
-func merged(t *testing.T, resource map[string]any, layers ...Layer) map[string]any {
-	t.Helper()
-	out, err := ApplySettings(resource, layers)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var parsed map[string]any
-	if err := json.Unmarshal([]byte(out["content"].(string)), &parsed); err != nil {
-		t.Fatalf("the merged file is not JSON: %v", err)
-	}
-	return parsed
-}
-
-func TestASettingBeatsTheModulesDefault(t *testing.T) {
-	// The whole rule. A setting is a statement about that key made deliberately; the default was
-	// only ever what to do in the absence of one. So there is nothing to resolve.
-	got := merged(t, file(`{"port":8080,"log":"info"}`),
-		Layer{From: "node", Values: map[string]any{"port": 9090.0}})
-
-	if got["port"] != 9090.0 {
-		t.Errorf("port is %v; the setting should have won", got["port"])
-	}
-	if got["log"] != "info" {
-		t.Errorf("log is %v; a key nobody set should keep the module's value", got["log"])
-	}
-}
-
-func TestUpstreamKeepsTheKeysNobodySet(t *testing.T) {
-	// The point of merging rather than replacing: the module can change its half freely and only
-	// the keys somebody actually cares about are pinned.
-	got := merged(t, file(`{"port":8080,"log":"info","workers":4}`),
-		Layer{From: "node", Values: map[string]any{"log": "debug"}})
-
-	if got["port"] != 8080.0 || got["workers"] != 4.0 {
-		t.Errorf("the module's other keys did not survive: %v", got)
-	}
-}
-
-func TestTheNodeBeatsTheMesh(t *testing.T) {
-	// Two layers, in order. A node that differs is expressed by differing, rather than by
-	// repeating everything the rest of the mesh already says.
-	got := merged(t, file(`{"log":"info"}`),
-		Layer{From: "mesh", Values: map[string]any{"log": "warn", "workers": 8.0}},
-		Layer{From: "node", Values: map[string]any{"log": "debug"}})
-
-	if got["log"] != "debug" {
-		t.Errorf("log is %v; the node's setting should have won", got["log"])
-	}
-	if got["workers"] != 8.0 {
-		t.Errorf("workers is %v; a mesh-wide setting the node did not touch should stand", got["workers"])
-	}
-}
-
-func TestNestedBlocksMergeRatherThanReplace(t *testing.T) {
-	// Setting one field of a block must not delete its siblings, or every setting would have to
-	// restate the whole block and would then pin all of it against upstream.
-	got := merged(t, file(`{"http":{"gzip":"off","timeout":30,"port":80}}`),
-		Layer{From: "node", Values: map[string]any{
-			"http": map[string]any{"gzip": "on"}}})
-
-	block := got["http"].(map[string]any)
-	if block["gzip"] != "on" {
-		t.Errorf("gzip is %v", block["gzip"])
-	}
-	if block["timeout"] != 30.0 || block["port"] != 80.0 {
-		t.Errorf("the block's other fields were lost: %v", block)
-	}
-}
-
-func TestAListIsReplacedWholeNotMerged(t *testing.T) {
-	// A list that merged element-wise could neither be shortened nor reordered, and there is no
-	// correct guess about which element is "the same one".
-	got := merged(t, file(`{"hosts":["a","b","c"]}`),
-		Layer{From: "node", Values: map[string]any{"hosts": []any{"x"}}})
-
-	hosts := got["hosts"].([]any)
-	if len(hosts) != 1 || hosts[0] != "x" {
-		t.Errorf("hosts is %v; a list is replaced whole", hosts)
-	}
-}
-
-func TestAProtectedKeyIsRefusedNotIgnored(t *testing.T) {
-	// A setting quietly dropped is somebody believing they changed something. Refusing says so
-	// while they are looking at it.
-	_, err := ApplySettings(file(`{"socket":"/run/thing.sock","log":"info"}`, "socket"),
-		[]Layer{{From: "node", Values: map[string]any{"socket": "/tmp/mine.sock"}}})
-	if err == nil {
-		t.Fatal("a protected key was overridden")
-	}
-	if !strings.Contains(err.Error(), "socket") || !strings.Contains(err.Error(), "not settable") {
-		t.Errorf("the refusal does not say which key or why: %v", err)
-	}
-}
-
-func TestSettingsAroundAProtectedKeyStillApply(t *testing.T) {
-	got := merged(t, file(`{"socket":"/run/thing.sock","log":"info"}`, "socket"),
-		Layer{From: "node", Values: map[string]any{"log": "debug"}})
-	if got["log"] != "debug" {
-		t.Errorf("log is %v", got["log"])
-	}
-}
-
-func TestTheSameSettingsAlwaysProduceTheSameBytes(t *testing.T) {
-	// A file whose lines move for no reason makes every reconcile look like a change, and a
-	// service reflecting it would restart for ever.
-	//
-	// Note what this defends: Go's JSON encoder sorts map keys, so the stability comes from the
-	// standard library and this passes with the merging removed. It is worth keeping as the thing
-	// that would catch a move to an encoder that does not sort — but it is not evidence about the
-	// code below it, and it was checked.
-	resource := file(`{"b":2,"a":1,"c":3}`)
-	layer := Layer{From: "node", Values: map[string]any{"z": 26.0, "a": 100.0}}
-
-	first, err := ApplySettings(resource, []Layer{layer})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for i := 0; i < 5; i++ {
-		again, err := ApplySettings(resource, []Layer{layer})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if again["content"] != first["content"] {
-			t.Fatal("the same settings produced different bytes")
-		}
-	}
-}
-
-func TestAFileThatDoesNotMergeIsLeftAlone(t *testing.T) {
-	plain := map[string]any{"id": "conf", "type": "file", "path": "/etc/thing",
-		"content": "not structured at all\n"}
-	out, err := ApplySettings(plain, []Layer{{From: "node", Values: map[string]any{"x": 1}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if out["content"] != "not structured at all\n" {
-		t.Errorf("a file with no merge rule was changed: %v", out["content"])
-	}
-}
-
-func TestSettingsThatReachNothingAreNamed(t *testing.T) {
-	// Somebody who misspells a module, or sets a key on one with nothing mergeable, has changed
-	// nothing — and would otherwise find out by the machine not behaving differently, which is
-	// the slowest way there is.
-	m := Manifest{Module: "thing", Resources: []map[string]any{
-		{"id": "conf", "type": "file", "path": "/etc/thing", "content": "plain"},
-	}}
-	unused := UnusedSettings(m, []Layer{{From: "node", Values: map[string]any{"port": 1}}})
-	if len(unused) != 1 || !strings.Contains(unused[0], "no file that merges it") {
-		t.Errorf("settings that reached nothing were not named: %v", unused)
-	}
-}
-
-func TestASettingLandsOnlyWhereSomethingDeclaresIt(t *testing.T) {
-	// novox/hq 04-ISSUES/173. A module that contributes a route and serves a provision takes a
-	// setting for a key either declares, and a setting for a key neither declares is stray — it
-	// would not reach the route or the served fact, so it must be said rather than dropped.
-	m := Manifest{Module: "mail",
-		Contributes: map[string]map[string]any{"reverse-proxy": {"host": "mail", "port": 8080}},
-		Serves:      map[string]map[string]any{"smtp": {"host": "mail", "port": 25}},
-		Resources: []map[string]any{
-			{"id": "env", "type": "file", "path": "/etc/mail.env", "content": "SITE=${setting:sitename}\n"},
-		}}
-	layers := []Layer{{From: "the mesh", Values: map[string]any{
-		"host": "post", "sitename": "Mail", "website": "https://www.example.tld"}}}
-	unused := UnusedSettings(m, layers)
-	if len(unused) != 1 || !strings.Contains(unused[0], `"website"`) {
-		t.Errorf("only website reaches nothing; named: %v", unused)
-	}
-}
-
-func TestContentThatIsNotJSONIsRefusedWhereSomebodyIsLooking(t *testing.T) {
-	// Rather than on the machine, at apply time, as a file the program cannot read.
-	_, err := ApplySettings(file(`this is not json`), nil)
-	if err == nil {
-		t.Fatal("a module claiming to merge as JSON shipped something else and was accepted")
-	}
-}
-
-func TestAServedValueMayBeTheOperators(t *testing.T) {
-	// A mail provider serves its domain and an identity provider its issuer; neither is the
-	// definition's to state (ADR 0155). Filled from the layers, refused by name when unset.
-	served, err := Settle(map[string]any{"port": 587, "domain": "${setting:domain}"},
-		[]Layer{{From: "the mesh", Values: map[string]any{"domain": "example.tld"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if served["domain"] != "example.tld" {
-		t.Errorf("the operator's value did not fill the served key: %v", served)
-	}
-	_, err = Settle(map[string]any{"domain": "${setting:domain}"}, nil)
-	if err == nil || !strings.Contains(err.Error(), `"domain"`) {
-		t.Errorf("a served value nothing sets must be refused by name; got %v", err)
-	}
-	m := Manifest{Module: "mail", Serves: map[string]map[string]any{"smtp": {"domain": "${setting:domain}"}}}
-	if unused := UnusedSettings(m, []Layer{{From: "the mesh", Values: map[string]any{"domain": "x"}}}); len(unused) != 0 {
-		t.Errorf("a setting a served fact asks for is not stray: %v", unused)
-	}
-}
-
-// No layer replaces a value the vault fills, at any depth (novox/hq issue 610): searxng's server.secret_key
-// sits under `server`, a key its file takes, and a layer reaching it was let through by a top-level-only check.
-func TestNoLayerReplacesAVaultSecretAtAnyDepth(t *testing.T) {
-	file := map[string]any{"id": "settings", "type": "file", "merge": MergeJSON,
-		"content": `{"server": {"secret_key": "${secret:secret}", "port": 8080}, "ui": {"theme": "simple"}, "token": "${secret:token}"}`}
-	layer := func(values map[string]any) []Layer { return []Layer{{From: "anchor", Values: values}} }
-
-	merged, err := ApplySettings(file, layer(map[string]any{"server": map[string]any{"port": float64(9000)}, "ui": map[string]any{"theme": "dark"}}))
-	if err != nil {
-		t.Fatalf("a key beside the secret was refused: %v", err)
-	}
-	if c := merged["content"].(string); !strings.Contains(c, `"secret_key": "${secret:secret}"`) || !strings.Contains(c, `"port": 9000`) {
-		t.Fatalf("the secret or the setting did not land as meant:\n%s", c)
-	}
-	for name, values := range map[string]map[string]any{
-		"the nested secret":        {"server": map[string]any{"secret_key": "chosen"}},
-		"the whole map holding it": {"server": "elsewhere"},
-		"a top-level secret":       {"token": "chosen"},
-		"the secret, emptied":      {"server": map[string]any{"secret_key": ""}},
-	} {
-		if _, err := ApplySettings(file, layer(values)); err == nil || !strings.Contains(err.Error(), "vault") {
-			t.Errorf("%s: %v, want a refusal naming the vault", name, err)
-		}
-	}
-}
diff --git a/internal/catalogue/several_contributions_test.go b/internal/catalogue/several_contributions_test.go
deleted file mode 100644
index b0fe8818..00000000
--- a/internal/catalogue/several_contributions_test.go
+++ /dev/null
@@ -1,167 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"testing"
-)
-
-// A module may answer one requirement more than once, the sibling of ADR 0094 for `contributes`
-// rather than `secrets`: an object store's data API and its console are two different public
-// names, not one. `contributes` maps a requirement to several sets of values under local names,
-// each reaching the provider as its own entry — the same "several from one" shape ADR 0094 gave
-// `secrets`, applied to the other half of an edge.
-
-const twoRoutes = `{"module":"minio","version":"1","requires":["route"],
-  "contributes":{"route":{"api":{"label":"files-api","port":9000},"console":{"label":"files","port":9001}}}}`
-
-func TestContributesReadsBothShapesAndWritesThemBack(t *testing.T) {
-	m, err := ParseManifest([]byte(twoRoutes))
-	if err != nil {
-		t.Fatal(err)
-	}
-	locals := m.ContributesMany["route"]
-	if len(locals) != 2 || locals["api"]["label"] != "files-api" || locals["console"]["port"] != float64(9001) {
-		t.Fatalf("two contributions under local names: %+v", locals)
-	}
-	plain, err := ParseManifest([]byte(`{"module":"board","version":"1","requires":["route"],
-	  "contributes":{"route":{"label":"board","port":8080}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := plain.Contributes["route"]; got["label"] != "board" || len(plain.ContributesMany) != 0 {
-		t.Fatalf("the plain shape is one contribution with no local names: %+v / %+v", got, plain.ContributesMany)
-	}
-	// Written back in the shape it was read, so a built manifest keeps its local names.
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	again, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("what was written does not read: %v\n%s", err, raw)
-	}
-	if len(again.ContributesMany["route"]) != 2 {
-		t.Fatalf("the local names did not survive a round trip:\n%s", raw)
-	}
-}
-
-func TestAContributionLocalNameMustBeUsable(t *testing.T) {
-	for _, bad := range []string{
-		// Not a usable name.
-		`{"module":"minio","version":"1","requires":["route"],
-		  "contributes":{"route":{"Not OK":{"label":"files","port":9000}}}}`,
-		// A local contribution with nothing in it.
-		`{"module":"minio","version":"1","requires":["route"],
-		  "contributes":{"route":{"api":{}}}}`,
-	} {
-		if _, err := ParseManifest([]byte(bad)); err == nil {
-			t.Errorf("accepted:\n%s", bad)
-		}
-	}
-}
-
-func minimalRouteProxy() Manifest {
-	return Manifest{Module: "route-proxy", Version: "1",
-		Provides: FromAnywhere("route"),
-		Receives: map[string]string{"route": "/var/lib/route-proxy/routes/mesh.json"},
-	}
-}
-
-func TestAModuleWithTwoRoutesGivesTheProviderTwoContributions(t *testing.T) {
-	minio, err := ParseManifest([]byte(twoRoutes))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := Resolve(shelf(minimalRouteProxy(), minio), []string{"route-proxy", "minio"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var given []Contribution
-	for _, r := range out {
-		if r["path"] != "/var/lib/route-proxy/routes/mesh.json" {
-			continue
-		}
-		var parsed struct {
-			Given []Contribution `json:"given"`
-		}
-		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
-			t.Fatal(err)
-		}
-		given = parsed.Given
-	}
-	if len(given) != 2 {
-		t.Fatalf("two named routes from one module are two contributions: %+v", given)
-	}
-	byPort := map[float64]string{}
-	for _, g := range given {
-		if g.From != "minio" {
-			t.Fatalf("both contributions are minio's: %+v", g)
-		}
-		port, _ := g.Values["port"].(float64)
-		label, _ := g.Values["label"].(string)
-		byPort[port] = label
-	}
-	if byPort[9000] != "files-api" || byPort[9001] != "files" {
-		t.Fatalf("the two routes did not both survive: %+v", given)
-	}
-}
-
-// A module with the ordinary, single-contribution shape resolves exactly as it did before —
-// ContributesMany being empty must change nothing about it.
-func TestASingleRouteStillResolvesTheOrdinaryWay(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := received(t, mustDeclare(t, got))
-	if len(given) != 1 || given[0].From != "board" {
-		t.Fatalf("the plain shape regressed: %+v", given)
-	}
-}
-
-// ContributionsFrom is what mints the ONE pair credential a requiring module is granted
-// (cmd/mesh-controller/plan.go's grantsFor) — a separate path from Declaration()'s raw file, and
-// the one the two-routes test above never exercised. Where a module contributes several times,
-// there is no single "the" value: settling to whichever sorts first would both misrepresent the
-// grant and collide with that same contribution's own entry from contributions(), which is
-// exactly the duplicate a live plan against minio surfaced (files-api appearing once with a
-// credential, once without, while files got neither).
-func TestContributionsFromHasNoSingleValueWhenAModuleContributesSeveralTimes(t *testing.T) {
-	minio, err := ParseManifest([]byte(twoRoutes))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got, err := Resolve(shelf(minimalRouteProxy(), minio), []string{"route-proxy", "minio"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	values, asks, err := got.ContributionsFrom("route", "minio", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !asks {
-		t.Fatal("minio still requires route, so it still asks")
-	}
-	if len(values) != 0 {
-		t.Fatalf("no single value represents two contributions, got %+v", values)
-	}
-}
-
-// The ordinary, single-contribution case is unchanged: exactly one match still settles to it.
-func TestContributionsFromReturnsTheOneValueForAnOrdinaryContribution(t *testing.T) {
-	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	values, asks, err := got.ContributionsFrom("reverse-proxy", "board", nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !asks || values["host"] != "board" {
-		t.Fatalf("the ordinary single contribution should still settle to its own value: %+v", values)
-	}
-}
diff --git a/internal/catalogue/several_secrets_test.go b/internal/catalogue/several_secrets_test.go
deleted file mode 100644
index e0748980..00000000
--- a/internal/catalogue/several_secrets_test.go
+++ /dev/null
@@ -1,205 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A module may need several values from one provider that gives one per pair (novox/hq
-// 04-ISSUES/069, ADR 0094): `secrets` maps a requirement to several files under local names, and
-// each local name is a pair credential of its own — its own need, its own file, its own holder.
-
-const twoSecrets = `{"module":"ca","version":"1","requires":["secret"],
-  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key","root-pass":"/var/lib/ca/root.pass"}},
-  "resources":[{"id":"state","type":"directory","path":"/var/lib/ca","mode":"0700"}]}`
-
-func TestSecretsReadBothShapesAndWriteThemBack(t *testing.T) {
-	m, err := ParseManifest([]byte(twoSecrets))
-	if err != nil {
-		t.Fatal(err)
-	}
-	files := m.SecretFiles("secret")
-	if len(files) != 2 || files[0].Local != "root-key" || files[1].Path != "/var/lib/ca/root.pass" {
-		t.Fatalf("two files under local names, in order: %+v", files)
-	}
-	plain, err := ParseManifest([]byte(`{"module":"app","version":"1","requires":["secret"],"secrets":{"secret":"/var/lib/app/secret"}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := plain.SecretFiles("secret"); len(got) != 1 || got[0].Local != "" || got[0].Path != "/var/lib/app/secret" {
-		t.Fatalf("the plain shape is one file with no local name: %+v", got)
-	}
-	// Written back in the shape it was read, so a built manifest keeps its local names.
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	again, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("what was written does not read: %v\n%s", err, raw)
-	}
-	if len(again.SecretFiles("secret")) != 2 {
-		t.Fatalf("the local names did not survive a round trip:\n%s", raw)
-	}
-}
-
-func TestALocalNameMayNotCollideWithWhatTheModuleAlreadyCallsSomething(t *testing.T) {
-	for _, bad := range []string{
-		// One of the module's own secrets.
-		`{"module":"ca","version":"1","requires":["secret"],"own-secrets":{"root-key":"/var/lib/ca/own"},
-		  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key"}}}`,
-		// Something it requires.
-		`{"module":"ca","version":"1","requires":["secret","postgres-database"],
-		  "secrets":{"secret":{"postgres-database":"/var/lib/ca/x"}}}`,
-		// Not a usable name.
-		`{"module":"ca","version":"1","requires":["secret"],"secrets":{"secret":{"Root Key":"/var/lib/ca/x"}}}`,
-		// A relative path.
-		`{"module":"ca","version":"1","requires":["secret"],"secrets":{"secret":{"root-key":"root.key"}}}`,
-	} {
-		if _, err := ParseManifest([]byte(bad)); err == nil {
-			t.Errorf("accepted:\n%s", bad)
-		}
-	}
-}
-
-func vaultAndCA() map[string]Manifest {
-	ca, _ := ParseManifest([]byte(twoSecrets))
-	vault := Manifest{Module: "mesh-vault", Version: "1", Provides: FromAnywhere("secret"),
-		Grants:   map[string]string{"secret": "/var/lib/vault/grants"},
-		Receives: map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}}
-	// A second consumer of the same provision that keeps ONE file, mentioned before the one that
-	// keeps two: the lab found the expansion done on the first module to mention the provision,
-	// and the second consumer given one credential and no file.
-	cache := Manifest{Module: "cache", Version: "1", Requires: []string{"secret"},
-		Secrets: map[string]string{"secret": "/var/lib/cache/secret"}}
-	return shelf(vault, cache, ca)
-}
-
-func TestEachLocalNameIsANeedAFileAndAHolderOfItsOwn(t *testing.T) {
-	got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "cache", "ca"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var locals, cacheLocals []string
-	for _, n := range got.Needs {
-		if n.Name == "secret" && n.For == "ca" {
-			locals = append(locals, n.Local)
-		}
-		if n.Name == "secret" && n.For == "cache" {
-			cacheLocals = append(cacheLocals, n.Local)
-		}
-	}
-	if strings.Join(locals, ",") != "root-key,root-pass" {
-		t.Fatalf("two secrets from one provider are two needs: %v", got.Needs)
-	}
-	if len(cacheLocals) != 1 || cacheLocals[0] != "" {
-		t.Fatalf("the one-file consumer keeps one need with no local name: %v", got.Needs)
-	}
-	for i := range got.Needs {
-		got.Needs[i].Sealed = "sealed-" + got.Needs[i].Local
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	seen := map[string]string{}
-	for _, r := range out {
-		if r["type"] == "file" && strings.HasPrefix(r["path"].(string), "/var/lib/ca/root.") {
-			seen[r["id"].(string)] = r["sealed"].(string)
-		}
-	}
-	if seen["ca."+SecretID("root-key")] != "sealed-root-key" || seen["ca."+SecretID("root-pass")] != "sealed-root-pass" {
-		t.Fatalf("each local name is its own file with its own credential: %v", seen)
-	}
-}
-
-func TestAProviderSeesEachLocalNameAsAHolderOfItsOwn(t *testing.T) {
-	r := Resolution{Modules: []Manifest{vaultAndCA()["mesh-vault"]}}
-	got, err := r.contributions(SettingsBy{}, []Grant{
-		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-key", Sealed: "x"},
-		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-pass", Sealed: "y"},
-	}, map[string]string{"secret": "/var/lib/vault/grants"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	given := got["secret"]
-	if len(given) != 2 {
-		t.Fatalf("two holders: %+v", given)
-	}
-	if given[0].As != "mesh_workstation_ca_root_key" && given[0].As != "mesh_workstation_ca_root-key" {
-		t.Fatalf("the holder is the consumer's identity with the local name after it: %q", given[0].As)
-	}
-	if given[0].Secret == given[1].Secret {
-		t.Fatalf("two holders share one file on the provider: %q", given[0].Secret)
-	}
-}
-
-// And on the provider's machine, two files with two ids — the lab's first run had the declaration
-// refused for two resources with one identity.
-func TestAProviderKeepsOneFilePerHolder(t *testing.T) {
-	got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "cache", "ca"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Grants: []Grant{
-		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-key", Sealed: "x"},
-		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-pass", Sealed: "y"},
-	}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	ids := map[string]string{}
-	for _, r := range out {
-		if id, _ := r["id"].(string); strings.Contains(id, "grant-secret") {
-			ids[id] = r["path"].(string)
-		}
-	}
-	if len(ids) != 2 {
-		t.Fatalf("two holders are two grant files: %v", ids)
-	}
-}
-
-// One file under a local name is still a local name (review C1): the need carries it, the file
-// is written, and ${secret:<name>} is filled.
-func TestOneLocalNameIsStillALocalName(t *testing.T) {
-	only, _ := ParseManifest([]byte(`{"module":"one","version":"1","requires":["secret"],
-	  "secrets":{"secret":{"only":"/var/lib/one/only"}}}`))
-	vault := vaultAndCA()["mesh-vault"]
-	got, err := Resolve(shelf(vault, only), []string{"mesh-vault", "one"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var found *Needed
-	for i, n := range got.Needs {
-		if n.For == "one" && n.Name == "secret" {
-			found = &got.Needs[i]
-		}
-	}
-	if found == nil || found.Local != "only" {
-		t.Fatalf("the one named file did not become a need under its name: %v", got.Needs)
-	}
-	found.Sealed = "sealed-only"
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var written bool
-	for _, r := range out {
-		if r["path"] == "/var/lib/one/only" && r["sealed"] == "sealed-only" {
-			written = true
-		}
-	}
-	if !written {
-		t.Fatal("the file under the one local name was not written")
-	}
-}
-
-// A local name names one credential: two requirements may not share it (review C2).
-func TestALocalNameIsUniqueAcrossRequirements(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"x","version":"1","requires":["secret","postgres-database"],
-	  "secrets":{"secret":{"x":"/var/lib/x/a"},"postgres-database":{"x":"/var/lib/x/b"}}}`))
-	if err == nil || !strings.Contains(err.Error(), "both under") {
-		t.Fatalf("two requirements under one local name were accepted: %v", err)
-	}
-}
diff --git a/internal/catalogue/shared_account_test.go b/internal/catalogue/shared_account_test.go
deleted file mode 100644
index aab013d0..00000000
--- a/internal/catalogue/shared_account_test.go
+++ /dev/null
@@ -1,73 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// One account, several modules: the shell's module sets its shell, the container runtime's adds it
-// to a group. Groups are only ever added by the host, so they are contributed; a shell or a home is
-// one value, owned by one module per node.
-
-func userResource(fields map[string]any) map[string]any {
-	r := map[string]any{"id": "operator", "type": "user", "name": "op"}
-	for k, v := range fields {
-		r[k] = v
-	}
-	return r
-}
-
-func TestAShellAndAGroupOnOneAccountFromTwoModulesResolve(t *testing.T) {
-	zsh := Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{"shell": "/usr/bin/zsh"})}}
-	docker := Manifest{Module: "docker", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"docker"}})}}
-	other := Manifest{Module: "media", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"video"}})}}
-	if problems := checkResources([]Manifest{zsh, docker, other}); len(problems) != 0 {
-		t.Fatalf("a shell and two modules' groups on one account were refused: %v", problems)
-	}
-	if _, err := Resolve(shelf(zsh, docker, other), []string{"zsh", "docker", "media"}, workstation(), World{}); err != nil {
-		t.Fatalf("the three did not resolve together: %v", err)
-	}
-}
-
-func TestTwoModulesSettingOneAccountsShellOrHomeAreRefused(t *testing.T) {
-	for _, field := range []string{"shell", "home"} {
-		a := Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{field: "/one"})}}
-		b := Manifest{Module: "fish", Resources: []map[string]any{userResource(map[string]any{field: "/two", "groups": []any{"x"}})}}
-		problems := checkResources([]Manifest{a, b})
-		want := `zsh and fish both set the ` + field + ` of the user "op"`
-		if len(problems) != 1 || !strings.Contains(problems[0], want) {
-			t.Errorf("two modules setting %s gave %v, want %q", field, problems, want)
-		}
-	}
-}
-
-// An account a module declares only to put in a group is applied where it is written, after the package
-// that makes the group (novox/hq ADR 0252); one that says how it logs in still goes first (issue 213).
-func TestAnAccountOnlyGivenGroupsKeepsItsWrittenPlace(t *testing.T) {
-	compose := func(raw string) []map[string]any {
-		t.Helper()
-		m, err := ParseManifest([]byte(raw))
-		if err != nil {
-			t.Fatal(err)
-		}
-		out, err := Resolution{Node: "workstation", Modules: []Manifest{m}}.Declaration(Rendering{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		return out
-	}
-	out := compose(`{"module": "lights", "version": "1", "resources": [
-	  {"id": "daemon", "type": "package", "package": "lights-daemon"},
-	  {"id": "account", "type": "user", "name": "op", "groups": ["lights"]}
-	]}`)
-	if pkg, acct := indexOf(out, "lights.daemon"), indexOf(out, "lights.account"); pkg < 0 || acct < pkg {
-		t.Fatalf("the account (%d) is not after the package that makes its group (%d): %v", acct, pkg, out)
-	}
-	out = compose(`{"module": "shell", "version": "1", "resources": [
-	  {"id": "package", "type": "package", "package": "zsh"},
-	  {"id": "login", "type": "user", "name": "op", "shell": "/usr/bin/zsh", "groups": ["wheel"]}
-	]}`)
-	if pkg, acct := indexOf(out, "shell.package"), indexOf(out, "shell.login"); acct < 0 || acct > pkg {
-		t.Fatalf("an account with a shell is no longer first (%d, package %d): %v", acct, pkg, out)
-	}
-}
diff --git a/internal/catalogue/shared_credential_test.go b/internal/catalogue/shared_credential_test.go
deleted file mode 100644
index 1965fd97..00000000
--- a/internal/catalogue/shared_credential_test.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A provider with one credential shares it (novox/hq ADR 0158): the offer names the own secret, the
-// secret says how it is taken, and a consumer's need carries the name so the plan mints its copy
-// from the provider's value.
-func TestAnOfferMayNameAnOwnSecretAsItsCredential(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"downloader","version":"1",
-		"own-secrets":{"password":{"path":"/var/lib/mesh/downloader/password","taken":"at-start"}},
-		"provides":[{"name":"downloader-api","credential":{"own":"password"}}],
-		"serves":{"downloader-api":{"port":8080,"username":"admin"}}}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if own, shared := m.SharedCredentialOf("downloader-api"); !shared || own != "password" {
-		t.Fatalf("the offer's credential was not read: %v %v", own, shared)
-	}
-	if got := m.ProvisionsSharing("password"); len(got) != 1 || got[0] != "downloader-api" {
-		t.Fatalf("the provisions sharing the secret: %v", got)
-	}
-
-	for want, raw := range map[string]string{
-		"declares no such secret": `{"module":"d","version":"1","provides":[{"name":"d-api","credential":{"own":"password"}}]}`,
-		"must say how the module takes it": `{"module":"d","version":"1","own-secrets":{"password":"/p"},
-			"provides":[{"name":"d-api","credential":{"own":"password"}}]}`,
-		"names no own secret": `{"module":"d","version":"1","provides":[{"name":"d-api","credential":{"own":""}}]}`,
-	} {
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
-			t.Errorf("expected a refusal saying %q, got %v", want, err)
-		}
-	}
-}
-
-func sharingShelf() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "downloader", Version: "1",
-			Provides:   []Offer{{Name: "downloader-api", Scope: ScopeMesh, Credential: &OfferCredential{Own: "password"}}},
-			OwnSecrets: OwnSecrets{"password": {Path: "/var/lib/mesh/downloader/password", Taken: TakenAtStart}},
-			Serves:     map[string]map[string]any{"downloader-api": {"port": 8080, "username": "admin"}}},
-		Manifest{Module: "manager", Version: "1", Requires: []string{"downloader-api"}},
-	)
-}
-
-func TestAConsumersNeedCarriesTheSharedSecretsName(t *testing.T) {
-	// On the same machine.
-	together, err := Resolve(sharingShelf(), []string{"downloader", "manager"}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	found := false
-	for _, n := range together.Needs {
-		if n.Name == "downloader-api" && n.For == "manager" {
-			found = true
-			if n.SharedOwn != "password" {
-				t.Fatalf("the need on one machine does not name the shared secret: %+v", n)
-			}
-		}
-	}
-	if !found {
-		t.Fatalf("the manager's need was not resolved: %+v", together.Needs)
-	}
-	// Across machines, the provider known by its module.
-	apart, err := Resolve(sharingShelf(), []string{"manager"}, onBoth("example.tld"), World{
-		Offered: map[string][]Provider{"downloader-api": {{Node: "home-server", At: "home-server.internal",
-			Module: "downloader", Serves: map[string]any{"port": 8080}}}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range apart.Needs {
-		if n.Name == "downloader-api" && n.SharedOwn != "password" {
-			t.Fatalf("the need across machines does not name the shared secret: %+v", n)
-		}
-	}
-}
diff --git a/internal/catalogue/shares_test.go b/internal/catalogue/shares_test.go
deleted file mode 100644
index 6fd5b05d..00000000
--- a/internal/catalogue/shares_test.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// Defends novox/hq ADR 0263: a machine's shares and the shares a machine mounts are two node seats, each
-// with its verbs required of every holder, each delivering nothing — `nfs-share` is provided at the mesh's
-// scope by the holder of node-nfs-server, and a node seat cannot answer for a provision at the mesh's.
-
-func TestTheSharesAndMountsAreNodeSeatsWithTheirVerbs(t *testing.T) {
-	for seat, want := range map[string]string{
-		NFSServerSeat: "exports clients test reload adopt",
-		MountsSeat:    "list test mount unmount adopt",
-	} {
-		s, ok := SeatNamed(seat)
-		if !ok {
-			t.Fatalf("%s is not in the mesh's set", seat)
-		}
-		if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0263" || s.Delivers != "" || s.Replicated {
-			t.Errorf("%s is %+v; a node seat under ADR 0263 that delivers nothing", seat, s)
-		}
-		var got []string
-		for _, v := range s.Serves {
-			got = append(got, v.Name)
-			if v.Optional {
-				t.Errorf("%s.%s is optional; its first holder serves it", seat, v.Name)
-			}
-			if v.Description == "" || v.Input["type"] != "object" || len(v.Replaces) == 0 {
-				t.Errorf("%s.%s has no description, no object schema or says it replaces nothing", seat, v.Name)
-			}
-		}
-		if strings.Join(got, " ") != want {
-			t.Errorf("%s serves %v, not %s", seat, got, want)
-		}
-	}
-}
-
-// Both acts that take over what a person wrote by hand are dry runs unless confirmed, and name the path.
-func TestTheAdoptVerbsAreDryRunsUnlessConfirmed(t *testing.T) {
-	for seat, key := range map[string]string{NFSServerSeat: "path", MountsSeat: "mountpoint"} {
-		s, _ := SeatNamed(seat)
-		for _, v := range s.Serves {
-			if v.Name != "adopt" {
-				continue
-			}
-			props, _ := v.Input["properties"].(map[string]any)
-			confirm, _ := props["confirm"].(map[string]any)
-			if confirm == nil || confirm["enum"] == nil {
-				t.Errorf("%s.adopt has no confirm switch: %v", seat, v.Input)
-			}
-			if req, _ := v.Input["required"].([]string); len(req) != 1 || req[0] != key {
-				t.Errorf("%s.adopt requires %v, not %q alone", seat, v.Input["required"], key)
-			}
-			if !strings.Contains(v.Description, "Without confirm, says what it would do and changes nothing") {
-				t.Errorf("%s.adopt does not say a call without confirm changes nothing: %s", seat, v.Description)
-			}
-		}
-	}
-}
-
-// A holder claiming the seat at a node with every verb holds it; one naming a verb the seat does not
-// promise, or leaving one out, is refused — as the catalogue's nfs-server and mounts modules claim them.
-func TestAHolderOfTheShareSeatsServesEveryVerbAndNothingElse(t *testing.T) {
-	cases := []struct {
-		seat, module string
-		verbs        []string
-	}{
-		{NFSServerSeat, "nfs-server", []string{"exports", "clients", "test", "reload", "adopt"}},
-		{MountsSeat, "mounts", []string{"list", "test", "mount", "unmount", "adopt"}},
-	}
-	for _, c := range cases {
-		seat, _ := SeatNamed(c.seat)
-		holder := Manifest{Module: c.module, Version: "1",
-			Claims: []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs}}}
-		if c.seat == NFSServerSeat {
-			holder.Provides = []Offer{{Name: "nfs-share", Scope: ScopeMesh}}
-		}
-		if err := CanHold(holder, seat); err != nil {
-			t.Errorf("%s serving every verb is refused: %v", c.module, err)
-		}
-		typo := holder
-		typo.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: append(append([]string{}, c.verbs...), "export")}}
-		if err := CanHold(typo, seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
-			t.Errorf("%s naming a verb the seat does not promise was accepted: %v", c.module, err)
-		}
-		short := holder
-		short.Claims = []Claim{{Name: c.seat, Scope: ScopeNode, Serves: c.verbs[:len(c.verbs)-1]}}
-		if err := CanHold(short, seat); err == nil || !strings.Contains(err.Error(), "adopt") {
-			t.Errorf("%s leaving adopt out was accepted: %v", c.module, err)
-		}
-		mesh := holder
-		mesh.Claims = []Claim{{Name: c.seat, Scope: ScopeMesh, Serves: c.verbs}}
-		if err := CanHold(mesh, seat); err == nil {
-			t.Errorf("%s claiming a node seat at the mesh's scope was accepted", c.module)
-		}
-	}
-}
-
-// What each verb replaces is what an agent would type over ssh to read or change a share by hand.
-func TestTheShareVerbsSayWhatTheyReplace(t *testing.T) {
-	want := map[string]string{
-		NFSServerSeat + ".exports": "exportfs -v",
-		NFSServerSeat + ".adopt":   "zfs set sharenfs=off",
-		MountsSeat + ".list":       "cat /etc/fstab",
-		MountsSeat + ".adopt":      "sed -i /etc/fstab",
-	}
-	for _, s := range DefaultSeats() {
-		for _, v := range s.Serves {
-			cmd, ok := want[s.Name+"."+v.Name]
-			if !ok {
-				continue
-			}
-			delete(want, s.Name+"."+v.Name)
-			found := false
-			for _, r := range v.Replaces {
-				found = found || r == cmd
-			}
-			if !found {
-				t.Errorf("%s.%s does not say it replaces %q: %v", s.Name, v.Name, cmd, v.Replaces)
-			}
-		}
-	}
-	for verb := range want {
-		t.Errorf("%s is not a verb of the compiled seats", verb)
-	}
-}
-
-// The confirm switch is the seat's string "true", as every verb's switch is, and its description says so:
-// a holder handed the boolean reading of "true to change it" would treat the string as a dry run.
-func TestTheConfirmSwitchIsTheStringTrue(t *testing.T) {
-	for _, seat := range []string{NFSServerSeat, MountsSeat} {
-		s, _ := SeatNamed(seat)
-		for _, v := range s.Serves {
-			props, _ := v.Input["properties"].(map[string]any)
-			confirm, _ := props["confirm"].(map[string]any)
-			if confirm == nil {
-				continue
-			}
-			if confirm["type"] != "string" {
-				t.Errorf("%s.%s confirm is %v, not the string switch", seat, v.Name, confirm["type"])
-			}
-			if d, _ := confirm["description"].(string); !strings.Contains(d, `"true"`) {
-				t.Errorf("%s.%s confirm does not name the string \"true\": %q", seat, v.Name, d)
-			}
-		}
-	}
-}
-
-// reload has the kernel read the export files; the module's process writes its file. The description
-// must not promise a write it does not do.
-func TestReloadSaysWhatItDoes(t *testing.T) {
-	s, _ := SeatNamed(NFSServerSeat)
-	for _, v := range s.Serves {
-		if v.Name == "reload" && (strings.Contains(v.Description, "Write this machine's export file") ||
-			!strings.Contains(v.Description, "exportfs")) {
-			t.Errorf("reload's description promises a write or does not name exportfs: %s", v.Description)
-		}
-	}
-}
-
-// A share is exported to each node the server grants it to and that asks for it, at that node's own
-// address (novox/hq ADR 0263 rule 5) — never to the private network's whole range. The verbs that
-// describe the export say so, and do not promise the range.
-func TestTheExportVerbsDescribePerNodeAddresses(t *testing.T) {
-	s, _ := SeatNamed(NFSServerSeat)
-	for _, v := range s.Serves {
-		if v.Name != "exports" && v.Name != "test" {
-			continue
-		}
-		if strings.Contains(v.Description, "private network's range") {
-			t.Errorf("%s still describes the export as the private network's range: %s", v.Name, v.Description)
-		}
-		if !strings.Contains(v.Description, "address") {
-			t.Errorf("%s does not say the export is to each node's address: %s", v.Name, v.Description)
-		}
-	}
-}
diff --git a/internal/catalogue/short_form_port_protocol_test.go b/internal/catalogue/short_form_port_protocol_test.go
deleted file mode 100644
index 625227e2..00000000
--- a/internal/catalogue/short_form_port_protocol_test.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package catalogue
-
-import (
-	"fmt"
-	"testing"
-)
-
-// A short-form port may name its protocol — "3478/udp" — and the mesh assigns the number exactly
-// as it does for "3478": the protocol rides along on the outside. Read as one token, the suffix made
-// the entry "not a port" and the runtime published it on a random machine port (found on ace: unifi's
-// STUN and discovery, while every TCP pin beside them held).
-func TestAShortFormPortKeepsItsProtocolAndGetsItsMachinePort(t *testing.T) {
-	container := map[string]any{"type": "container", "ports": []any{"3478/udp", "8443", "10001/udp"}}
-	with := Rendering{
-		Given: map[string]map[int]int{"unifi": {3478: 3478}},
-		Ports: map[string]map[int]int{"unifi": {8443: 20010, 10001: 20011}},
-	}
-	publishedOn(container, "unifi", with)
-	got := fmt.Sprint(container["ports"])
-	want := "[3478:3478/udp 20010:8443 20011:10001/udp]"
-	if got != want {
-		t.Fatalf("published %s, want %s", got, want)
-	}
-}
diff --git a/internal/catalogue/showcase_manifest_test.go b/internal/catalogue/showcase_manifest_test.go
deleted file mode 100644
index d6ecf331..00000000
--- a/internal/catalogue/showcase_manifest_test.go
+++ /dev/null
@@ -1,86 +0,0 @@
-package catalogue
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// **The showcase module is parsed by the real parser, in the real test suite.**
-//
-// A module that exercises every capability is only worth having if something checks it still does.
-// Written as a test rather than a script so it runs whenever anything about manifests changes —
-// which is exactly when a module using all of it would quietly stop being valid.
-func TestTheShowcaseModuleIsAValidManifest(t *testing.T) {
-	raw, err := os.ReadFile(filepath.Join(beside.Catalogue(t), "showcase", "module.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest(raw)
-	if err != nil {
-		t.Fatalf("the module that exercises everything does not parse:\n%v", err)
-	}
-
-	// Every resource kind a MODULE may use, actually in it.
-	//
-	// Two of the host's eleven are deliberately absent, and the reasons are worth keeping:
-	//
-	//   - `action` is refused to modules outright. The link may not carry a command to run (ADR
-	//     0005), so a module that needs something done ships a program that reads what the mesh
-	//     delivered and reconciles — which is what a run-once `process` is.
-	//   - `service` puts an EXISTING unit into a state and deliberately installs none, which is
-	//     right for software that ships its own unit. A module whose code the mesh built has no
-	//     such unit until the mesh writes one, and that is a `process`.
-	kinds := map[string]bool{}
-	for _, r := range m.Resources {
-		kind, _ := r["type"].(string)
-		kinds[kind] = true
-	}
-	for _, want := range []string{
-		"access", "archive", "container", "directory", "file", "network", "package",
-		"process", "user",
-	} {
-		if !kinds[want] {
-			t.Errorf("showcase no longer exercises %q", want)
-		}
-	}
-
-	// And all three ways a module's own code can run, which is the thing most easily lost.
-	var stays, once, scheduled bool
-	for _, r := range m.Resources {
-		if kind, _ := r["type"].(string); kind != "process" {
-			continue
-		}
-		switch {
-		case r["run-once"] == true:
-			once = true
-		case r["schedule"] != nil:
-			scheduled = true
-		default:
-			stays = true
-		}
-	}
-	if !stays || !once || !scheduled {
-		t.Errorf("showcase does not exercise all three process modes: stays=%v once=%v scheduled=%v",
-			stays, once, scheduled)
-	}
-
-	// And the artifact kinds, including the one that compiles.
-	var bundle, archive, upstream bool
-	for _, a := range m.Build.Artifacts {
-		switch a.Kind {
-		case ArtifactBundle:
-			bundle = true
-		case ArtifactArchive:
-			archive = true
-		case ArtifactUpstream:
-			upstream = true
-		}
-	}
-	if !bundle || !archive || !upstream {
-		t.Errorf("showcase does not exercise every artifact kind: bundle=%v archive=%v upstream=%v",
-			bundle, archive, upstream)
-	}
-}
diff --git a/internal/catalogue/ssh_client_test.go b/internal/catalogue/ssh_client_test.go
deleted file mode 100644
index 8981e319..00000000
--- a/internal/catalogue/ssh_client_test.go
+++ /dev/null
@@ -1,117 +0,0 @@
-package catalogue
-
-import (
-	"io/fs"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/beside"
-)
-
-// boundKeys are every key the files of a module ask of ${bound:forge-account:<key>}, read from the module's own
-// tree on the shelf, so the test offers what ssh-client asks however often it asks one more (issue 985).
-func boundKeys(t *testing.T, module, provision string) map[string]bool {
-	t.Helper()
-	ask := regexp.MustCompile(`\$\{bound:` + regexp.QuoteMeta(provision) + `:([A-Za-z0-9_.-]+)\}`)
-	keys := map[string]bool{}
-	root := filepath.Join(beside.Catalogue(t), module)
-	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
-		if err != nil || d.IsDir() || strings.HasSuffix(path, "_test.go") {
-			return err
-		}
-		body, err := os.ReadFile(path)
-		if err != nil {
-			return err
-		}
-		for _, m := range ask.FindAllStringSubmatch(string(body), -1) {
-			keys[m[1]] = true
-		}
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("reading what %s asks of %s: %v", module, provision, err)
-	}
-	return keys
-}
-
-// The ssh-client module, composed as a machine receives it (novox/hq to-be 29, research 027/03): a
-// region at the START of the operator's ~/.ssh/config that includes ~/.ssh/config.d/* — first,
-// because ssh takes the first value it finds for each option — and the mesh's Host blocks as the
-// whole of ~/.ssh/config.d/00-mesh, every other node with its account. ~/.ssh and ~/.ssh/config.d
-// are created 0700 and owned by the account; the operator's own config below the region is kept.
-func TestSSHClientOwnsTheOperatorsSSHConfig(t *testing.T) {
-	shelf := shelf(catalogueManifest(t, "ssh-client"), catalogueManifest(t, "gitea"))
-	// ssh-client requires forge-account since mesh-catalog #340 (novox/hq issue 955), answered by the forge's
-	// holder on another node; this test is about the operator's config, so the forge is offered from there
-	// (issue 985).
-	// Every key ssh-client's files ask is offered, read from them (boundKeys); a few have a realistic value.
-	serves := map[string]any{}
-	for key := range boundKeys(t, "ssh-client", "forge-account") {
-		serves[key] = "sample-" + key
-	}
-	for key, value := range map[string]any{"ssh_host": "marge.internal", "ssh_port": 222,
-		"known_host": "[marge.internal]:222 ssh-ed25519 AAAA", "ssh_base": "ssh://git@marge.internal:222/",
-		"https_base": "https://git.example.org/"} {
-		serves[key] = value
-	}
-	forge := World{Offered: map[string][]Provider{
-		"forge-account": {{Node: "marge", At: "marge.internal", Module: "gitea", Serves: serves}}}}
-	got, err := Resolve(shelf, []string{"ssh-client"},
-		Node{Name: "homer", At: "homer.internal", Account: "jo", AccountHome: "/home/jo"}, forge)
-	if err != nil {
-		t.Fatal(err)
-	}
-	names := map[string]string{"homer.internal": "10.10.0.1", "marge.internal": "10.10.0.2",
-		"bart.internal": "10.10.0.3"}
-	out, err := got.Declaration(Rendering{
-		Names: names, Machines: names,
-		Accounts: map[string]string{"homer": "jo", "marge": "jo", "bart": "op"},
-		Suffix:   "internal",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	by := map[string]map[string]any{}
-	for _, r := range out {
-		by[r["id"].(string)] = r
-	}
-
-	for id, path := range map[string]string{
-		"ssh-client.ssh-dir": "/home/jo/.ssh", "ssh-client.config-d": "/home/jo/.ssh/config.d"} {
-		dir := by[id]
-		if dir == nil || dir["type"] != "directory" || dir["path"] != path || dir["owner"] != "jo" || dir["mode"] != "0700" {
-			t.Fatalf("%s is not created 0700 owned by the account: %v", path, dir)
-		}
-	}
-
-	cfg := by["ssh-client.config"]
-	if cfg == nil || cfg["path"] != "/home/jo/.ssh/config" || cfg["owner"] != "jo" ||
-		cfg["into"] != "block" || cfg["at"] != "start" {
-		t.Fatalf("the mesh's region is not the first thing in the operator's ~/.ssh/config: %v", cfg)
-	}
-	if body := cfg["content"].(string); !strings.Contains(body, "\nInclude ~/.ssh/config.d/*\n") || strings.Contains(body, "\nHost ") {
-		t.Fatalf("the region does not just include config.d:\n%s", body)
-	}
-
-	var hosts map[string]any
-	for _, r := range out {
-		if r["path"] == "/home/jo/.ssh/config.d/00-mesh" {
-			hosts = r
-		}
-	}
-	if hosts == nil || hosts["type"] != "file" || hosts["into"] != nil {
-		t.Fatalf("the mesh's hosts are not the whole of ~/.ssh/config.d/00-mesh: %v", hosts)
-	}
-	body := hosts["content"].(string)
-	for _, want := range []string{"Host marge marge.internal", "Host bart bart.internal", "User jo", "User op"} {
-		if !strings.Contains(body, want) {
-			t.Fatalf("00-mesh does not say %q — every other node with its account:\n%s", want, body)
-		}
-	}
-	if strings.Contains(body, "Host homer ") {
-		t.Fatalf("00-mesh names the machine itself, not only its peers:\n%s", body)
-	}
-}
diff --git a/internal/catalogue/state_test.go b/internal/catalogue/state_test.go
deleted file mode 100644
index d4cf687c..00000000
--- a/internal/catalogue/state_test.go
+++ /dev/null
@@ -1,125 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-// A module declares the state it keeps and the state it reads (novox/hq ADR 0201), a bucket by its
-// bare name or with the owner's options.
-func TestAManifestMaySayWhatStateItKeepsAndReads(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"claude-code","version":"1",` +
-		`"state":["servers",{"name":"seen","history":5,"ttl-seconds":3600}],` +
-		`"reads":["licence-manager.bindings"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.State) != 2 || m.State[0].Name != "servers" || m.State[1].History != 5 || m.State[1].TTLSeconds != 3600 {
-		t.Fatalf("state not read: %+v", m.State)
-	}
-	if len(m.Reads) != 1 || m.Reads[0] != "licence-manager.bindings" {
-		t.Fatalf("reads not read: %v", m.Reads)
-	}
-	// Written back as it came in: the short form where nothing else is said.
-	out, _ := json.Marshal(m.State)
-	if string(out) != `["servers",{"name":"seen","history":5,"ttl-seconds":3600}]` {
-		t.Fatalf("written back as %s", out)
-	}
-}
-
-// A name the bus could not hold, or that would let two modules derive one bucket, is refused at
-// registration in the manifest's words.
-func TestAStateNameIsLocalAndOneToken(t *testing.T) {
-	for _, c := range []struct{ manifest, says string }{
-		{`{"module":"a","version":"1","state":["mesh.servers"]}`, `keeps state "mesh.servers": a state is named locally`},
-		{`{"module":"a","version":"1","state":["my_servers"]}`, `keeps state "my_servers"`},
-		{`{"module":"a","version":"1","state":["s","s"]}`, `keeps state "s" twice`},
-		{`{"module":"a","version":"1","state":[{"name":"s","history":65}]}`, `a key keeps between 1 and 64`},
-		{`{"module":"a.b","version":"1","state":["s"]}`, `no dot`},
-		{`{"module":"a","version":"1","reads":["bindings"]}`, `a read is <module>.<name>`},
-		{`{"module":"a","version":"1","reads":["a.s"]}`, `which is its own state`},
-		{`{"module":"a","version":"1","state":[{"name":"s","shared":true}]}`, `{name, history, ttl-seconds, per-machine, key-ttl}`},
-	} {
-		_, err := ParseManifest([]byte(c.manifest))
-		if err == nil {
-			t.Errorf("%s was accepted", c.manifest)
-			continue
-		}
-		if !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s refused for the wrong reason: %v", c.manifest, err)
-		}
-	}
-}
-
-// A read whose owner is present must name a state that owner keeps; an absent owner says nothing,
-// because a module may be installed before the one whose state it reads.
-func TestAReadNamesStateItsOwnerKeeps(t *testing.T) {
-	owner := Manifest{Module: "licence-manager", State: []StateDeclaration{{Name: "bindings"}}}
-	good := Manifest{Module: "claude-code", Reads: []string{"licence-manager.bindings", "absent.anything"}}
-	bad := Manifest{Module: "other", Reads: []string{"licence-manager.tokens"}}
-	if p := StateReadsNothingDeclares([]Manifest{owner, good}); len(p) != 0 {
-		t.Fatalf("a read of declared state was refused: %v", p)
-	}
-	p := StateReadsNothingDeclares([]Manifest{owner, bad})
-	if len(p) != 1 || !strings.Contains(p[0], `licence-manager keeps no state called "tokens"`) {
-		t.Fatalf("a read of state nobody keeps was not named: %v", p)
-	}
-}
-
-// **The controller's record mirrors are kept state** (design 54 §5, design 57 F3): a module may read
-// `mesh-controller.assignments` and `mesh-controller.declared-config` although the controller's manifest
-// declares no `state`; a read of anything else of the controller's is still named.
-func TestAReadOfTheControllersMirrorsIsAReadOfKeptState(t *testing.T) {
-	controller := Manifest{Module: ControllerSeatName}
-	reader := Manifest{Module: "mesh-config", Reads: []string{"mesh-controller.assignments", "mesh-controller.declared-config"}}
-	if p := StateReadsNothingDeclares([]Manifest{controller, reader}); len(p) != 0 {
-		t.Fatalf("a read of the controller's mirrors was refused: %v", p)
-	}
-	other := Manifest{Module: "other", Reads: []string{"mesh-controller.calls"}}
-	if p := StateReadsNothingDeclares([]Manifest{controller, other}); len(p) != 1 {
-		t.Fatalf("a read of the controller's own calls was not named: %v", p)
-	}
-}
-
-// **Across the whole catalogue**: every state name is local, and every read whose owner is present
-// names state that owner keeps.
-func TestEveryManifestsStateIsLocalAndEveryReadIsKept(t *testing.T) {
-	manifests := theCatalogue(t)
-	var problems []string
-	for _, m := range manifests {
-		problems = append(problems, StateProblems(m)...)
-	}
-	problems = append(problems, StateReadsNothingDeclares(manifests)...)
-	if len(problems) > 0 {
-		t.Fatalf("the catalogue's state is not what ADR 0201 says:\n  %s", strings.Join(problems, "\n  "))
-	}
-}
-
-// `module check` says it too: the cross-catalogue pass names a read nothing on the shelf keeps.
-func TestTheCataloguePassNamesAReadItsOwnerDoesNotKeep(t *testing.T) {
-	shelf := Shelf{
-		"licence-manager": {Module: "licence-manager", State: []StateDeclaration{{Name: "bindings"}}},
-		"claude-code":     {Module: "claude-code", Reads: []string{"licence-manager.tokens"}},
-	}
-	problems := CatalogueProblems(shelf)
-	if len(problems) != 1 || !strings.Contains(problems[0], `keeps no state called "tokens"`) {
-		t.Fatalf("the catalogue pass said %v", problems)
-	}
-}
-
-// 1154/AC1: a state entry may say key-ttl; it is read, written back, and a bare name or an entry without it reads as before.
-func TestAStateMayHaveKeysThatExpireOneByOne(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mesh-delivery-watchman","version":"1",` +
-		`"state":[{"name":"pulse","key-ttl":true},"stuck",{"name":"seen","history":5}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !m.State[0].KeyTTL || m.State[1].KeyTTL || m.State[2].KeyTTL {
-		t.Fatalf("key-ttl not read as said: %+v", m.State)
-	}
-	out, _ := json.Marshal(m.State)
-	if string(out) != `[{"name":"pulse","key-ttl":true},"stuck",{"name":"seen","history":5}]` {
-		t.Fatalf("written back as %s", out)
-	}
-}
diff --git a/internal/catalogue/stream_work_queue_test.go b/internal/catalogue/stream_work_queue_test.go
deleted file mode 100644
index 9f8ccf64..00000000
--- a/internal/catalogue/stream_work_queue_test.go
+++ /dev/null
@@ -1,71 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A module stream may declare retention: work-queue (novox/hq ADR 0436 §6): a message is removed once a
-// consumer acknowledges it, the bus refusing a new one rather than dropping what it holds. The fixture is
-// mesh-mail's future `mail-sends` stream (ADR 0436 §7, §8), copied from the module.json shape at
-// /home/jochen/projects/novox/mesh-catalog/modules/mesh-mail/module.json and extended with retention,
-// max-deliveries and duplicates as the ADR's clause 6 describes.
-const mailSendsStream = `[{"name":"mail-sends","events":["mail.send.approved"],"max-age-days":1,"max-mib":64,` +
-	`"retention":"work-queue","max-deliveries":5,"duplicates":24}]`
-
-// 1177/AC1: a well-formed work-queue stream is accepted and read back whole. Named by one process in
-// bus.queues (novox/hq ADR 0436 §6, checked by 1178's WorkQueueStreamProblems), so this stays accepted once
-// that rule exists.
-func TestAWorkQueueStreamIsDeclaredAndAccepted(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mesh-mail","version":"1","streams":` + mailSendsStream +
-		`,"resources":[{"id":"account","type":"user","name":"mesh-mail-send"},` +
-		`{"id":"send","type":"process","run":["./mesh-mail","send"],"user":"mesh-mail-send",` +
-		`"bus":{"queues":["mail-sends"]}}]}`))
-	if err != nil {
-		t.Fatalf("a well-formed work-queue stream was refused: %v", err)
-	}
-	s := m.Streams[0]
-	if s.Retention != StreamRetentionWorkQueue || s.MaxDeliveries != 5 || s.Duplicates != 24 ||
-		s.Days() != 1 || s.Cap() != 64 {
-		t.Fatalf("the stream read as %+v", s)
-	}
-}
-
-// 1177/AC2: a stream whose work-queue values are out of range, contradictory, or carries a grant is refused
-// naming the stream and the rule.
-func TestAWorkQueueStreamsValuesAreBounded(t *testing.T) {
-	for name, c := range map[string]struct{ streams, says string }{
-		"max-deliveries 0": {`[{"name":"mail-sends","events":["mail.send.approved"],"retention":"work-queue",` +
-			`"max-deliveries":0,"duplicates":24}]`, "between 1 and 10"},
-		"max-deliveries 11": {`[{"name":"mail-sends","events":["mail.send.approved"],"retention":"work-queue",` +
-			`"max-deliveries":11,"duplicates":24}]`, "between 1 and 10"},
-		"duplicates longer than its maximum age": {`[{"name":"mail-sends","events":["mail.send.approved"],` +
-			`"max-age-days":1,"retention":"work-queue","max-deliveries":5,"duplicates":25}]`, "longer than its maximum age"},
-		"an unknown retention": {`[{"name":"mail-sends","events":["mail.send.approved"],"retention":"sometimes"}]`,
-			"retention"},
-		"max-deliveries without retention work-queue": {`[{"name":"mail-sends","events":["mail.send.approved"],` +
-			`"max-deliveries":5}]`, "without retention"},
-		"duplicates without retention work-queue": {`[{"name":"mail-sends","events":["mail.send.approved"],` +
-			`"duplicates":24}]`, "without retention"},
-		"a work-queue stream carrying a grant": {`[{"name":"mail-sends","events":["mail.send.approved"],` +
-			`"retention":"work-queue","max-deliveries":5,` +
-			`"grant":{"config":"grants","events":"mail-sends.{key}.**"}}]`, "carrying a grant"},
-	} {
-		_, err := ParseManifest([]byte(mailManifest(t, c.streams, "")))
-		if err == nil || !strings.Contains(err.Error(), "mail-sends") || !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: %v; want a refusal naming the stream and %q", name, err, c.says)
-		}
-	}
-}
-
-// 1177/AC3: a stream with no retention composes as main does — limits retention, dropping its oldest — proven
-// at the broker, where the bus's retention policy is decided (internal/broker/modstreams_test.go).
-func TestAStreamWithNoRetentionReadsAsLimits(t *testing.T) {
-	m, err := ParseManifest([]byte(mailManifest(t, mailStream, "")))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := m.Streams[0].Retention; got != "" {
-		t.Fatalf("a stream declaring no retention read %q", got)
-	}
-}
diff --git a/internal/catalogue/streams_test.go b/internal/catalogue/streams_test.go
deleted file mode 100644
index a5971e3c..00000000
--- a/internal/catalogue/streams_test.go
+++ /dev/null
@@ -1,244 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"slices"
-	"strings"
-	"testing"
-)
-
-// mailManifest is a module owning a restricted stream, as mesh-mail declares it (novox/hq ADR 0363), with
-// the trusted mergeable file that takes its grants setting; extra is spliced in at the top.
-func mailManifest(t *testing.T, streams, extra string) string {
-	t.Helper()
-	return `{"module":"mesh-mail","version":"1",` + extra + `"streams":` + streams + `,` +
-		`"resources":[{"id":"state","type":"directory","mode":"0700","place":"."},` +
-		`{"id":"grants","trusted":true,"type":"file","path":"${dir:state}/grants.json","mode":"0600",` +
-		`"merge":"json","takes-settings":["grants"],"content":"{\"grants\": {}}"}]}`
-}
-
-const mailStream = `[{"name":"mail","events":["mail.*.message.added","mail.*.message.changed",` +
-	`"mail.*.message.removed"],"max-age-days":7,"grant":{"config":"grants","events":"mail.{key}.**"}}]`
-
-// A module declares a stream of its own (ADR 0363 §1): its events with a variable name (§3), its age and
-// size with defaults, and a grant by a trusted setting of its own (§4).
-func TestAModuleDeclaresAStreamOfItsOwn(t *testing.T) {
-	m, err := ParseManifest([]byte(mailManifest(t, mailStream, "")))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Streams) != 1 {
-		t.Fatalf("streams not read: %+v", m.Streams)
-	}
-	s := m.Streams[0]
-	if s.BusName() != "MAIL" || s.Days() != 7 || s.Cap() != StreamDefaultMiB || s.Grant == nil ||
-		s.Grant.Config != "grants" || s.Grant.Granted("mesh") != "mail.mesh.**" {
-		t.Fatalf("stream read as %+v", s)
-	}
-	if !s.Carries("mail.work.message.added") || s.Carries("mail.work.body") || !s.Carries("mail.*.message.removed") {
-		t.Fatal("the stream's patterns do not say what it carries")
-	}
-	plain, err := ParseManifest([]byte(`{"module":"feed","version":"1","streams":[{"name":"feed-items","events":["item.**"]}]}`))
-	if err != nil {
-		t.Fatalf("a stream without a grant was refused: %v", err)
-	}
-	if got := plain.Streams[0]; got.BusName() != "FEED_ITEMS" || got.Days() != StreamDefaultDays || got.Grant != nil {
-		t.Fatalf("defaults read as %+v", got)
-	}
-}
-
-// Registration refuses a stream the mesh could not hold or would leave ambiguous (ADR 0363 §1, §2, §4).
-func TestAStreamIsNamedBoundedAndGrantedByATrustedConfigValue(t *testing.T) {
-	grants := `"grant":{"config":"grants","events":"mail.{key}.**"}`
-	for _, c := range []struct{ manifest, says string }{
-		{mailManifest(t, `[{"name":"Mail","events":["mail.**"]}]`, ""), `a stream is named locally`},
-		{mailManifest(t, `[{"name":"mail.x","events":["mail.**"]}]`, ""), `a stream is named locally`},
-		{mailManifest(t, `[{"name":"events","events":["mail.**"]}]`, ""), `the mesh's own stream EVENTS`},
-		{mailManifest(t, `[{"name":"log-x","events":["mail.**"]}]`, ""), `starts with LOG_`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"]},{"name":"mail","events":["x.**"]}]`, ""), `twice`},
-		{mailManifest(t, `[{"name":"mail","events":[]}]`, ""), `with no events`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**.x"]}]`, ""), `nothing may follow it`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"max-age-days":31}]`, ""), `between 1 and 30`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"max-mib":9000}]`, ""), `between 1 and 8192`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"stream":"MAIL"}]`, ""), `{name, events`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"]}]`, `"emits":["mail.mesh.message.added"],`),
-			`which its stream "mail" carries`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"]},{"name":"more","events":["mail.x.*"]}]`, ""),
-			`both carry`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"grant":{"config":"tags","events":"mail.{key}.**"}}]`, ""),
-			`is not a trusted config value`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"grant":{"config":"grants","events":"mail.**"}}]`, ""),
-			`exactly once`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],"grant":{"config":"grants","events":"{key}.{key}"}}]`, ""),
-			`exactly once`},
-		{mailManifest(t, `[{"name":"mail","events":["mail.**"],`+grants+`,"why":1}]`, ""), `{name, events`},
-		{`{"module":"a.b","version":"1","streams":[{"name":"x","events":["x"]}]}`, `no dot`},
-	} {
-		_, err := ParseManifest([]byte(c.manifest))
-		if err == nil {
-			t.Errorf("%s was accepted", c.manifest)
-			continue
-		}
-		if !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s refused for the wrong reason: %v", c.manifest, err)
-		}
-	}
-}
-
-// A stream name has one owner across the catalogue (ADR 0363 §1).
-func TestTwoModulesCannotDeclareOneStream(t *testing.T) {
-	a := Manifest{Module: "a", Streams: []StreamDeclaration{{Name: "mail", Events: []string{"x"}}}}
-	b := Manifest{Module: "b", Streams: []StreamDeclaration{{Name: "mail", Events: []string{"y"}}}}
-	got := strings.Join(CatalogueProblems(Shelf{"a": a, "b": b}), "; ")
-	if !strings.Contains(got, "b declares the stream MAIL, which a already declares") {
-		t.Fatalf("a second owner of MAIL was not refused: %s", got)
-	}
-	if got := StreamNameProblems(Shelf{"a": a}); len(got) != 0 {
-		t.Fatalf("one owner refused: %v", got)
-	}
-}
-
-// The setting's value names who hears each key: a module wherever it runs, or on one machine (ADR 0363 §4).
-func TestARestrictingSettingNamesAModuleOrAModuleOnAMachine(t *testing.T) {
-	var value any
-	if err := json.Unmarshal([]byte(`{"mesh":["reader","person.jochen"],"work":["ace.reader"],"home":["other"],`+
-		`"Bad.Key":["reader"]}`), &value); err != nil {
-		t.Fatal(err)
-	}
-	if got := GrantedKeys(value, "reader", "ace"); !slices.Equal(got, []string{"mesh", "work"}) {
-		t.Fatalf("on ace reader is granted %v", got)
-	}
-	if got := GrantedKeys(value, "reader", "shanks"); !slices.Equal(got, []string{"mesh"}) {
-		t.Fatalf("on shanks reader is granted %v", got)
-	}
-	if got := GrantedKeys(`{"mesh":["reader"]}`, "reader", "ace"); !slices.Equal(got, []string{"mesh"}) {
-		t.Fatalf("a value held as its JSON text grants %v", got)
-	}
-	if got := GrantedKeys([]any{"reader"}, "reader", "ace"); len(got) != 0 {
-		t.Fatalf("a value of another shape granted %v", got)
-	}
-}
-
-// A consumer hears a restricted stream only where its consumes asks and the setting grants it, and only
-// by naming the emitter (ADR 0363 §5); what a stream carries whole leaves EVENTS.
-func TestAConsumerHearsOnlyWhatItAsksAndIsGranted(t *testing.T) {
-	provider, err := ParseManifest([]byte(mailManifest(t, mailStream, `"emits":["account.added"],`)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	shelf := map[string]Manifest{"mesh-mail": provider}
-	var value any
-	_ = json.Unmarshal([]byte(`{"mesh":["reader"],"work":["shanks.reader"]}`), &value)
-	values := func(module, setting string) []any {
-		if module == "mesh-mail" && setting == "grants" {
-			return []any{value}
-		}
-		return nil
-	}
-	reader := Manifest{Module: "reader", Consumes: []string{"mesh-mail.mail.**", "mesh-mail.account.added", "billing.paid"}}
-
-	parts, touches, onEvents := Hearing(reader, shelf, "ace", values)
-	if !touches || len(parts) != 1 || parts[0].Stream.BusName() != "MAIL" {
-		t.Fatalf("heard %+v", parts)
-	}
-	want := []string{"mail.mesh.message.added", "mail.mesh.message.changed", "mail.mesh.message.removed"}
-	if !slices.Equal(parts[0].Patterns, want) {
-		t.Fatalf("on ace reader hears %v, want %v", parts[0].Patterns, want)
-	}
-	if !slices.Equal(onEvents, []string{"mesh-mail.account.added", "billing.paid"}) {
-		t.Fatalf("left on EVENTS: %v", onEvents)
-	}
-	parts, _, _ = Hearing(reader, shelf, "shanks", values)
-	if len(parts) != 1 || len(parts[0].Patterns) != 6 {
-		t.Fatalf("on shanks reader hears %+v", parts)
-	}
-
-	narrow := Manifest{Module: "reader", Consumes: []string{"mesh-mail.mail.*.message.added"}}
-	parts, _, _ = Hearing(narrow, shelf, "ace", values)
-	if len(parts) != 1 || !slices.Equal(parts[0].Patterns, []string{"mail.mesh.message.added"}) {
-		t.Fatalf("a narrower consumes heard %+v", parts)
-	}
-
-	stranger := Manifest{Module: "stranger", Consumes: []string{"mesh-mail.mail.**"}}
-	parts, touches, onEvents = Hearing(stranger, shelf, "ace", values)
-	if len(parts) != 0 || !touches || len(onEvents) != 0 {
-		t.Fatalf("a module not granted heard %+v (touches %v, on EVENTS %v)", parts, touches, onEvents)
-	}
-	everything := Manifest{Module: "audit", Consumes: []string{"**", "*.mail.**"}}
-	parts, touches, _ = Hearing(everything, shelf, "ace", values)
-	if len(parts) != 0 || touches {
-		t.Fatalf("a wildcard emitter reached a module's stream: %+v", parts)
-	}
-	parts, _, _ = Hearing(reader, shelf, "ace", func(string, string) []any { return nil })
-	if len(parts) != 0 {
-		t.Fatalf("with no setting reader heard %+v", parts)
-	}
-}
-
-// A stream without a grant is heard by whoever asks, within its patterns.
-func TestAnUnrestrictedStreamIsHeardByWhoeverAsks(t *testing.T) {
-	feed := Manifest{Module: "feed", Streams: []StreamDeclaration{{Name: "items", Events: []string{"item.*.added", "item.*.gone"}}}}
-	reader := Manifest{Module: "reader", Consumes: []string{"feed.item.**", "feed.item.x.added"}}
-	parts, touches, onEvents := Hearing(reader, map[string]Manifest{"feed": feed}, "ace", nil)
-	if !touches || len(onEvents) != 0 || len(parts) != 1 ||
-		!slices.Equal(parts[0].Patterns, []string{"item.*.added", "item.*.gone"}) {
-		t.Fatalf("heard %+v, on EVENTS %v", parts, onEvents)
-	}
-}
-
-func TestNarrowingTwoPatterns(t *testing.T) {
-	for _, c := range []struct{ a, b, want string }{
-		{"mail.**", "mail.*.message.added", "mail.*.message.added"},
-		{"mail.*.message.added", "mail.mesh.**", "mail.mesh.message.added"},
-		{"a.*", "*.b", "a.b"},
-		{"**", "a.**", "a.**"},
-		{"a.b", "a.c", ""},
-		{"a", "a.**", ""},
-	} {
-		got, ok := narrow(c.a, c.b)
-		if (c.want == "") == ok || got != c.want {
-			t.Errorf("narrow(%s, %s) = %q, %v; want %q", c.a, c.b, got, ok, c.want)
-		}
-	}
-	if got := uncovered([]string{"a.**", "a.b", "a.b", "c"}); !slices.Equal(got, []string{"a.**", "c"}) {
-		t.Fatalf("uncovered: %v", got)
-	}
-}
-
-// **A module that hears a restricted stream runs as an account of its own** (ADR 0376 §2): registration refuses a
-// `consumes` naming a module and asking for events its restricted stream carries, unless the manifest declares
-// `runs-as`; a stream without a grant, an event the provider says on EVENTS, and a wildcard emitter stay as they
-// were, and a consumer whose provider is not on the shelf is judged once it is.
-func TestHearingARestrictedStreamNeedsAnAccountOfItsOwn(t *testing.T) {
-	provider, err := ParseManifest([]byte(mailManifest(t, mailStream, `"emits":["account.added"],`)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	feed := Manifest{Module: "feed", Streams: []StreamDeclaration{{Name: "items", Events: []string{"item.**"}}}}
-	carried := Manifest{Module: "reader", Consumes: []string{"mesh-mail.mail.*.message.added"}}
-	got := RestrictedHearingProblems(Shelf{"mesh-mail": provider, "reader": carried})
-	if len(got) != 1 || !strings.Contains(got[0], "reader consumes mesh-mail.mail.*.message.added") ||
-		!strings.Contains(got[0], "MAIL") || !strings.Contains(got[0], "runs-as") || !strings.Contains(got[0], "ADR 0376") {
-		t.Fatalf("a carried module hearing MAIL was not refused as it should be: %v", got)
-	}
-	if all := strings.Join(CatalogueProblems(Shelf{"mesh-mail": provider, "reader": carried}), "; "); !strings.Contains(all, got[0]) {
-		t.Fatalf("the catalogue's check does not refuse it: %s", all)
-	}
-	own := carried
-	own.RunsAs = "reader"
-	if got := RestrictedHearingProblems(Shelf{"mesh-mail": provider, "reader": own}); len(got) != 0 {
-		t.Fatalf("a module of its own account was refused: %v", got)
-	}
-	for _, m := range []Manifest{
-		{Module: "events", Consumes: []string{"mesh-mail.account.added"}},
-		{Module: "items", Consumes: []string{"feed.item.**"}},
-		{Module: "audit", Consumes: []string{"**", "*.mail.**"}},
-	} {
-		if got := RestrictedHearingProblems(Shelf{"mesh-mail": provider, "feed": feed, m.Module: m}); len(got) != 0 {
-			t.Errorf("%s was refused: %v", m.Module, got)
-		}
-	}
-	if got := RestrictedHearingProblems(Shelf{"reader": carried}); len(got) != 0 {
-		t.Fatalf("judged without its provider: %v", got)
-	}
-}
diff --git a/internal/catalogue/template_test.go b/internal/catalogue/template_test.go
deleted file mode 100644
index a439acb0..00000000
--- a/internal/catalogue/template_test.go
+++ /dev/null
@@ -1,323 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A file resource may name a template file in its module's repository (novox/hq ADR 0349 §2, design 57 package
-// T1, issue 654): the build packs files/ into an archive, and resolving the build reads each template's text back
-// into content, so the mesh holds, composes and sends exactly what it would for the same text inline.
-
-// The two forms of one module: its text inline, and its text in files/.
-const (
-	inlineTwin = `{"module":"tidy","version":"1",
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"conf","type":"directory","path":"${dir:conf}"},
-    {"id":"main","type":"file","path":"${dir:conf}/tidy.conf","mode":"0644","content":"` + mainText + `"},
-    {"id":"extra","type":"file","path":"${dir:conf}/extra.conf","content":"` + extraText + `"}]}`
-	templatedTwin = `{"module":"tidy","version":"1",
-  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"conf","type":"directory","path":"${dir:conf}"},
-    {"id":"main","type":"file","path":"${dir:conf}/tidy.conf","mode":"0644","template":"files/tidy.conf"},
-    {"id":"extra","type":"file","path":"${dir:conf}/extra.conf","template":"files/deeper/extra.conf"}]}`
-	mainText  = `# tidy\nroot = ${dir:conf}\nquoted = \"yes\" é\n`
-	extraText = `one\ntwo\n`
-)
-
-// templateTexts is what a build reads back from the packed files/ archive: by path inside it.
-func templateTexts(t *testing.T) map[string]string {
-	t.Helper()
-	var m struct{ Main, Extra string }
-	if err := json.Unmarshal([]byte(`{"Main":"`+mainText+`","Extra":"`+extraText+`"}`), &m); err != nil {
-		t.Fatal(err)
-	}
-	return map[string]string{"tidy.conf": m.Main, "deeper/extra.conf": m.Extra, "unused.conf": "not named"}
-}
-
-func builtFiles(texts map[string]string) []Built {
-	return []Built{{Name: "files", Kind: ArtifactArchive,
-		Reference: ArtifactStoreScheme + "tidy/files/blobs/sha256:" + strings.Repeat("c", 64),
-		Digest:    "sha256:" + strings.Repeat("c", 64), Texts: texts}}
-}
-
-// held is a manifest as registration holds it: resolved with what was built, then read again strictly.
-func held(t *testing.T, raw string, built []Built) Manifest {
-	t.Helper()
-	m, err := ParseManifest([]byte(raw))
-	if err != nil {
-		t.Fatal(err)
-	}
-	resolved, err := m.Resolve(built)
-	if err != nil {
-		t.Fatal(err)
-	}
-	again, err := json.Marshal(resolved)
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := ParseManifest(again)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problem := HeldTemplateProblem(out); problem != "" {
-		t.Fatal(problem)
-	}
-	return out
-}
-
-func composed(t *testing.T, m Manifest) string {
-	t.Helper()
-	got, err := Resolve(shelf(m), []string{m.Module}, workstation(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := json.Marshal(mustDeclare(t, got))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return string(out)
-}
-
-func TestATemplatedModuleComposesByteIdenticallyToItsInlineTwin(t *testing.T) {
-	inline := composed(t, held(t, inlineTwin, builtFiles(nil)))
-	templated := composed(t, held(t, templatedTwin, builtFiles(templateTexts(t))))
-	if inline != templated {
-		t.Fatalf("the two forms compose differently:\ninline:    %s\ntemplated: %s", inline, templated)
-	}
-	if !strings.Contains(templated, "quoted = \\\"yes\\\"") || strings.Contains(templated, `"template"`) {
-		t.Fatalf("the composition does not carry the template's text as content: %s", templated)
-	}
-}
-
-// What `module check`, the merge gate and `module add` judge: the text read from the tree beside the manifest.
-func TestATemplatedModuleReadFromItsTreeComposesByteIdenticallyToItsInlineTwin(t *testing.T) {
-	dir := t.TempDir()
-	for name, text := range templateTexts(t) {
-		full := filepath.Join(dir, "files", filepath.FromSlash(name))
-		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(full, []byte(text), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	filled, err := WithTemplatesFrom(m, dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if filled.Templated() {
-		t.Fatal("a manifest read from its tree still names a template")
-	}
-	resolved, err := filled.Resolve(builtFiles(nil))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := composed(t, resolved), composed(t, held(t, inlineTwin, builtFiles(nil))); got != want {
-		t.Fatalf("read from the tree, the module composes differently:\ninline:    %s\ntemplated: %s", want, got)
-	}
-}
-
-func TestAFileNamingBothATemplateAndContentIsRefused(t *testing.T) {
-	raw := strings.Replace(templatedTwin, `"template":"files/tidy.conf"`,
-		`"template":"files/tidy.conf","content":"x"`, 1)
-	_, err := ParseManifest([]byte(raw))
-	if err == nil || !strings.Contains(err.Error(), "main") || !strings.Contains(err.Error(), "never both") {
-		t.Fatalf("a file with both a template and content was not refused by name: %v", err)
-	}
-}
-
-func TestATemplateOutsideFilesIsRefusedByName(t *testing.T) {
-	for _, bad := range []string{"../tidy.conf", "/etc/tidy.conf", "files", "files/", "files/../tidy.conf",
-		"files/./tidy.conf", "other/tidy.conf", "tidy.conf", "files//tidy.conf", `files\\tidy.conf`} {
-		raw := strings.Replace(templatedTwin, `"files/tidy.conf"`, `"`+bad+`"`, 1)
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), "main") || !strings.Contains(err.Error(), "not a file under files/") {
-			t.Errorf("the template %q was not refused by name: %v", bad, err)
-		}
-	}
-}
-
-func TestATemplateOnAResourceThatIsNotAFileIsRefused(t *testing.T) {
-	raw := strings.Replace(templatedTwin, `{"id":"conf","type":"directory","path":"${dir:conf}"}`,
-		`{"id":"conf","type":"directory","path":"${dir:conf}","template":"files/tidy.conf"}`, 1)
-	_, err := ParseManifest([]byte(raw))
-	if err == nil || !strings.Contains(err.Error(), "conf is a directory and names a template") {
-		t.Fatalf("a directory naming a template was not refused: %v", err)
-	}
-}
-
-func TestATemplatedModuleWhoseBuildPacksNoFilesIsRefused(t *testing.T) {
-	for _, build := range []string{
-		``,
-		`"build":{"artifacts":[{"name":"look","kind":"archive","from":"theme"}]},`,
-		`"build":{"artifacts":[{"name":"a","kind":"archive","from":"files"},{"name":"b","kind":"archive","from":"./files/"}]},`,
-	} {
-		raw := strings.Replace(templatedTwin,
-			`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},`, build, 1)
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), "files/") {
-			t.Errorf("a templated module with the build %q was not refused: %v", build, err)
-		}
-	}
-}
-
-func TestAMissingTemplateIsRefusedByName(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	// In the tree beside the manifest.
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "files", "tidy.conf"), []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	_, err = WithTemplatesFrom(m, dir)
-	if err == nil || !strings.Contains(err.Error(), "extra") || !strings.Contains(err.Error(), "files/deeper/extra.conf") {
-		t.Fatalf("a template missing from the tree was not refused by name: %v", err)
-	}
-	// And in what the build read back from its archive.
-	texts := templateTexts(t)
-	delete(texts, "deeper/extra.conf")
-	_, err = m.Resolve(builtFiles(texts))
-	if err == nil || !strings.Contains(err.Error(), "extra") || !strings.Contains(err.Error(), "files/deeper/extra.conf") {
-		t.Fatalf("a template missing from the archive was not refused by name: %v", err)
-	}
-}
-
-func TestATemplateThatIsASymlinkIsRefused(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	dir := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(dir, "files", "deeper"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "elsewhere"), []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "files", "tidy.conf"), []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink(filepath.Join(dir, "elsewhere"), filepath.Join(dir, "files", "deeper", "extra.conf")); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := WithTemplatesFrom(m, dir); err == nil || !strings.Contains(err.Error(), "not a plain file") {
-		t.Fatalf("a template that is a symlink was not refused: %v", err)
-	}
-}
-
-func TestAResolveWithoutTheArchivesTextIsRefused(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := m.Resolve(builtFiles(nil)); err == nil || !strings.Contains(err.Error(), "files") {
-		t.Fatalf("a templated module resolved with no text read back from its archive: %v", err)
-	}
-}
-
-func TestATemplateThatIsNotUTF8IsRefused(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	texts := templateTexts(t)
-	texts["tidy.conf"] = "\xff\xfe"
-	if _, err := m.Resolve(builtFiles(texts)); err == nil || !strings.Contains(err.Error(), "UTF-8") {
-		t.Fatalf("a template that is not UTF-8 was resolved: %v", err)
-	}
-}
-
-// What registration refuses: a manifest to be held that still names a template — one resolved by a builder that
-// predates templates would otherwise compose files with no text.
-func TestAManifestStillNamingATemplateIsNotHeld(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problem := HeldTemplateProblem(m); !strings.Contains(problem, "main") || !strings.Contains(problem, "files/tidy.conf") {
-		t.Fatalf("a manifest naming a template would be held: %q", problem)
-	}
-	if problem := HeldTemplateProblem(held(t, inlineTwin, builtFiles(nil))); problem != "" {
-		t.Fatalf("an inline manifest is refused: %s", problem)
-	}
-}
-
-// A symlinked files/, or a symlinked directory under it, would read a file outside the tree: refused by name,
-// as is any symlink or special file under files/ that no template names, which the build's packing refuses.
-func TestASymlinkAnywhereUnderFilesIsRefusedByName(t *testing.T) {
-	m, err := ParseManifest([]byte(templatedTwin))
-	if err != nil {
-		t.Fatal(err)
-	}
-	outside := t.TempDir()
-	if err := os.MkdirAll(filepath.Join(outside, "deeper"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	for _, name := range []string{"tidy.conf", "deeper/extra.conf", "secret"} {
-		if err := os.WriteFile(filepath.Join(outside, filepath.FromSlash(name)), []byte("outside"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	write := func(t *testing.T, dir, name string) {
-		t.Helper()
-		full := filepath.Join(dir, filepath.FromSlash(name))
-		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(full, []byte("inside"), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	link := func(t *testing.T, target, at string) {
-		t.Helper()
-		if err := os.MkdirAll(filepath.Dir(at), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.Symlink(target, at); err != nil {
-			t.Fatal(err)
-		}
-	}
-	for _, c := range []struct {
-		name  string
-		make  func(t *testing.T, dir string)
-		names string
-	}{
-		{"files/ itself", func(t *testing.T, dir string) {
-			link(t, outside, filepath.Join(dir, "files"))
-		}, "files/ is a symlink"},
-		{"a directory under files/", func(t *testing.T, dir string) {
-			write(t, dir, "files/tidy.conf")
-			link(t, filepath.Join(outside, "deeper"), filepath.Join(dir, "files", "deeper"))
-		}, "files/deeper is a symlink"},
-		{"a file no template names", func(t *testing.T, dir string) {
-			write(t, dir, "files/tidy.conf")
-			write(t, dir, "files/deeper/extra.conf")
-			link(t, filepath.Join(outside, "secret"), filepath.Join(dir, "files", "unnamed"))
-		}, "files/unnamed is a symlink"},
-	} {
-		dir := t.TempDir()
-		c.make(t, dir)
-		_, err := WithTemplatesFrom(m, dir)
-		if err == nil || !strings.Contains(err.Error(), c.names) {
-			t.Errorf("a symlinked %s was not refused by name: %v", c.name, err)
-		}
-		if err != nil && strings.Contains(err.Error(), "outside") {
-			t.Errorf("a symlinked %s was read: %v", c.name, err)
-		}
-	}
-}
diff --git a/internal/catalogue/templates_dir_test.go b/internal/catalogue/templates_dir_test.go
deleted file mode 100644
index ad740b0d..00000000
--- a/internal/catalogue/templates_dir_test.go
+++ /dev/null
@@ -1,151 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// A module may name the directory its templates are kept in (`"templates": "<dir>"`, default files/; issue 731): a
-// module whose files/ is already an archive unpacked onto the machine keeps its templates in a directory of their
-// own, packed into an archive no resource names, so its unpacked files/ is exactly what it was.
-
-// The two forms of one module whose files/ is unpacked onto the machine: its text inline, and in templates/.
-const (
-	unpackingInline = `{"module":"tidy","version":"1",
-  "build":{"artifacts":[{"name":"scripts","kind":"archive","from":"files"}]},
-  "resources":[
-    {"id":"scripts","type":"archive","path":"/usr/local/lib/tidy","artifact":"scripts"},
-    {"id":"conf","type":"directory","path":"${dir:conf}"},
-    {"id":"main","type":"file","path":"/etc/tidy.conf","mode":"0644","content":"` + mainText + `"},
-    {"id":"extra","type":"file","path":"/etc/extra.conf","content":"` + extraText + `"}]}`
-	unpackingTemplated = `{"module":"tidy","version":"1",
-  "templates":"templates",
-  "build":{"artifacts":[{"name":"scripts","kind":"archive","from":"files"},
-    {"name":"templates","kind":"archive","from":"templates"}]},
-  "resources":[
-    {"id":"scripts","type":"archive","path":"/usr/local/lib/tidy","artifact":"scripts"},
-    {"id":"conf","type":"directory","path":"${dir:conf}"},
-    {"id":"main","type":"file","path":"/etc/tidy.conf","mode":"0644","template":"templates/tidy.conf"},
-    {"id":"extra","type":"file","path":"/etc/extra.conf","template":"templates/deeper/extra.conf"}]}`
-)
-
-func builtUnpacking(templates map[string]string) []Built {
-	built := []Built{{Name: "scripts", Kind: ArtifactArchive,
-		Reference: "https://store.invalid/scripts.tar.gz",
-		Digest:    "sha256:" + strings.Repeat("a", 64)}}
-	if templates != nil {
-		built = append(built, Built{Name: "templates", Kind: ArtifactArchive,
-			Reference: ArtifactStoreScheme + "tidy/templates/blobs/sha256:" + strings.Repeat("b", 64),
-			Digest:    "sha256:" + strings.Repeat("b", 64), Texts: templates})
-	}
-	return built
-}
-
-func TestAModuleWithItsOwnTemplatesDirectoryComposesByteIdenticallyToItsInlineTwin(t *testing.T) {
-	inline := composed(t, held(t, unpackingInline, builtUnpacking(nil)))
-	templated := composed(t, held(t, unpackingTemplated, builtUnpacking(templateTexts(t))))
-	if inline != templated {
-		t.Fatalf("the two forms compose differently:\ninline:    %s\ntemplated: %s", inline, templated)
-	}
-	// The unpacked archive is the files/ one, by its digest; the templates archive reaches no machine.
-	if !strings.Contains(templated, strings.Repeat("a", 64)) || strings.Contains(templated, strings.Repeat("b", 64)) {
-		t.Fatalf("the composition does not unpack files/ alone: %s", templated)
-	}
-}
-
-func TestTheManifestTheMeshHoldsNamesNoTemplatesDirectory(t *testing.T) {
-	m := held(t, unpackingTemplated, builtUnpacking(templateTexts(t)))
-	raw, err := json.Marshal(m)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(string(raw), `"templates"`) {
-		t.Fatalf("the held manifest still names its templates directory: %s", raw)
-	}
-}
-
-func TestAModuleWithItsOwnTemplatesDirectoryIsReadFromItsTree(t *testing.T) {
-	dir := t.TempDir()
-	for name, text := range templateTexts(t) {
-		full := filepath.Join(dir, "templates", filepath.FromSlash(name))
-		if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(full, []byte(text), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	// files/ holds what the machine unpacks, a symlink among it judged by nobody here: it is not the templates.
-	if err := os.MkdirAll(filepath.Join(dir, "files", "bin"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "files", "bin", "tidy"), []byte("#!/bin/sh\n"), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	m, err := ParseManifest([]byte(unpackingTemplated))
-	if err != nil {
-		t.Fatal(err)
-	}
-	filled, err := WithTemplatesFrom(m, dir)
-	if err != nil {
-		t.Fatal(err)
-	}
-	resolved, err := filled.Resolve(builtUnpacking(map[string]string{}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := composed(t, resolved), composed(t, held(t, unpackingInline, builtUnpacking(nil))); got != want {
-		t.Fatalf("read from the tree, the module composes differently:\ninline:    %s\ntemplated: %s", want, got)
-	}
-
-	// A symlink under the templates directory is refused by its path, as under files/.
-	if err := os.Symlink("/etc/hostname", filepath.Join(dir, "templates", "elsewhere")); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := WithTemplatesFrom(m, dir); err == nil || !strings.Contains(err.Error(), "templates/elsewhere is a symlink") {
-		t.Fatalf("a symlink under templates/ was not refused by its path: %v", err)
-	}
-}
-
-func TestATemplateOutsideTheNamedTemplatesDirectoryIsRefused(t *testing.T) {
-	raw := strings.Replace(unpackingTemplated, `"template":"templates/tidy.conf"`, `"template":"files/tidy.conf"`, 1)
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "files/tidy.conf") ||
-		!strings.Contains(err.Error(), "templates/") {
-		t.Fatalf("a template outside the named templates directory was not refused by name: %v", err)
-	}
-}
-
-func TestATemplatesDirectoryNoArchiveIsBuiltFromIsRefused(t *testing.T) {
-	raw := strings.Replace(unpackingTemplated, `,
-    {"name":"templates","kind":"archive","from":"templates"}`, "", 1)
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "no archive from templates/") {
-		t.Fatalf("a module whose build packs no archive from its templates directory was not refused: %v", err)
-	}
-}
-
-func TestATemplatesDirectoryOnAModuleNamingNoTemplateIsRefused(t *testing.T) {
-	raw := strings.Replace(unpackingInline, `"version":"1",`, `"version":"1","templates":"templates",`, 1)
-	if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "names no template") {
-		t.Fatalf("a templates directory read by nothing was not refused: %v", err)
-	}
-}
-
-func TestATemplatesDirectoryThatIsNotAPlainRelativeDirectoryIsRefused(t *testing.T) {
-	for _, dir := range []string{"/etc", "../other", "..", "templates/../files", "./templates", ".", "a\\b", "templates/"} {
-		raw := strings.Replace(unpackingTemplated, `"templates":"templates"`, `"templates":`+jsonString(dir), 1)
-		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), "templates directory") {
-			t.Errorf("the templates directory %q was not refused: %v", dir, err)
-		}
-	}
-}
-
-func TestATemplatesDirectoryNamedFilesIsTheDefault(t *testing.T) {
-	raw := strings.Replace(templatedTwin, `"version":"1",`, `"version":"1","templates":"files",`, 1)
-	if got, want := composed(t, held(t, raw, builtFiles(templateTexts(t)))),
-		composed(t, held(t, inlineTwin, builtFiles(nil))); got != want {
-		t.Fatalf("naming files/ as the templates directory composes differently:\n%s\n%s", got, want)
-	}
-}
diff --git a/internal/catalogue/terminal_settings_test.go b/internal/catalogue/terminal_settings_test.go
deleted file mode 100644
index d822a896..00000000
--- a/internal/catalogue/terminal_settings_test.go
+++ /dev/null
@@ -1,221 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// No placement and no access at the machine's own system or the mesh's state, however it is spelled (novox/hq
-// issue 339); a module's own place elsewhere is taken.
-func TestAPlacementOrAnAccessAtTheMachinesOwnIsRefused(t *testing.T) {
-	m := Manifest{Module: "notes", Resources: []map[string]any{{"id": "data", "type": "directory"}},
-		Accesses: []Access{{ID: "media"}}}
-	for _, path := range []string{"/", "/etc", "/etc/", "/etc/sudoers.d", "/usr/bin", "/root", "/var", "/var/lib",
-		"/home", "/home/", "/run", "/run/user/1000", "/var/lib/mesh/x", "/var/lib/mesh-host", "/var/lib/mesh-host/identity",
-		"/srv/../etc", "//etc", "/proc/1", "/sys", "/dev", "/boot/efi", "/bin", "/sbin", "/lib", "/lib64"} {
-		layers := []Layer{LayerOf("laptop", map[string]any{PlacesSetting: map[string]any{"data": path}})}
-		if _, err := Places(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
-			t.Errorf("a place at %s: %v", path, err)
-		}
-		layers = []Layer{LayerOf("laptop", map[string]any{AccessesSetting: map[string]any{"media": path}})}
-		if _, err := AccessPlaces(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
-			t.Errorf("an access at %s: %v", path, err)
-		}
-	}
-	for _, path := range []string{"/srv/notes", "/mnt/plex/data", "/storage/media", "/services/media/movies",
-		"/var/lib/notes/data", "/home/restic/repo", "/var/lib/mesh-store"} {
-		layers := []Layer{LayerOf("laptop", map[string]any{PlacesSetting: map[string]any{"data": path}})}
-		if got, err := Places(m, layers); err != nil || got["data"].Path != path {
-			t.Errorf("a place at %s: %v %v", path, got, err)
-		}
-		layers = []Layer{LayerOf("laptop", map[string]any{AccessesSetting: map[string]any{"media": path}})}
-		if got, err := AccessPlaces(m, layers); err != nil || got["media"] != path {
-			t.Errorf("an access at %s: %v %v", path, got, err)
-		}
-	}
-}
-
-// A line break, a carriage return or a NUL in any string of any setting is refused, at any depth, keys too —
-// where a layer is judged, which is both where it is kept and where it is composed (novox/hq issue 339).
-func TestASettingHoldsOneLine(t *testing.T) {
-	m := Manifest{Module: "mailu"}
-	for _, v := range []any{"a\nDEBUG=1", "a\rb", "a\x00b", []any{"ok", "x\ny"},
-		map[string]any{"k": []any{"ok", map[string]any{"deep": "x\ny"}}}, map[string]any{"k\nx": "v"}} {
-		if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
-			!strings.Contains(err.Error(), "line break") {
-			t.Errorf("%q: %v", v, err)
-		}
-	}
-	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v\nPATH": "x"}}}, false); err == nil {
-		t.Error("a line break in a key was taken")
-	}
-	if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": "one line", "n": 3.0,
-		"l": []any{"a", "b"}}}}, false); err != nil {
-		t.Errorf("one line each: %v", err)
-	}
-}
-
-// Lines are allowed in one setting only: step-ca's `root`, as certificates that encoding/pem decodes and
-// x509.ParseCertificate parses (novox/hq issue 339). Any other module or key, another label, or a block that is
-// not a certificate is refused like any other line break.
-func TestOnlyTheAuthoritysRootMayHoldLines(t *testing.T) {
-	ca := Manifest{Module: "step-ca"}
-	judge := func(m Manifest, key, v string) error {
-		return JudgeSettings(m, []Layer{{From: "anchor", Values: map[string]any{key: v}}}, false)
-	}
-	for _, ok := range []string{servedRoot, servedRoot + servedRoot, strings.TrimSuffix(servedRoot, "\n")} {
-		if err := judge(ca, "root", ok); err != nil {
-			t.Errorf("the authority's root: %v", err)
-		}
-	}
-	body := strings.TrimSuffix(strings.TrimPrefix(servedRoot, "-----BEGIN CERTIFICATE-----\n"), "-----END CERTIFICATE-----\n")
-	for name, bad := range map[string]string{
-		"a line after it":        servedRoot + "PATH=/tmp\n",
-		"a line before it":       "PATH=\n" + servedRoot,
-		"another label":          "-----BEGIN PRIVATE KEY-----\n" + body + "-----END PRIVATE KEY-----\n",
-		"headers":                "-----BEGIN CERTIFICATE-----\nProc-Type: 4,ENCRYPTED\n\n" + body + "-----END CERTIFICATE-----\n",
-		"base64 that is no cert": "-----BEGIN CERTIFICATE-----\nMIIBeDCCAR2gAwIBAgIQfake000000000000000000000000\n-----END CERTIFICATE-----\n",
-		"carriage returns":       strings.ReplaceAll(servedRoot, "\n", "\r\n"),
-	} {
-		if err := judge(ca, "root", bad); err == nil {
-			t.Errorf("%s was taken", name)
-		}
-	}
-	if err := judge(ca, "other", servedRoot); err == nil {
-		t.Error("a certificate in another key of the authority was taken")
-	}
-	if err := judge(Manifest{Module: "mailu"}, "root", servedRoot); err == nil {
-		t.Error("a certificate in another module's setting was taken")
-	}
-	if err := JudgeSettings(ca, []Layer{{From: "anchor", Values: map[string]any{"root": []any{servedRoot}}}}, false); err == nil {
-		t.Error("a certificate below the top of the setting was taken")
-	}
-}
-
-// Every character a reader takes as the end of a line is refused, not only \n and \r: vertical tab, form feed,
-// NEL and the Unicode line and paragraph separators (novox/hq issue 339).
-func TestEveryLineEndIsRefused(t *testing.T) {
-	m := Manifest{Module: "mailu"}
-	for _, v := range []string{"a\vb", "a\fb", "a\u0085b", "a\u2028b", "a\u2029b"} {
-		if err := JudgeSettings(m, []Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
-			!strings.Contains(err.Error(), "line break") {
-			t.Errorf("%q: %v", v, err)
-		}
-	}
-}
-
-// The review's additions: the spool, the container runtimes' data, /opt, and any home's .ssh.
-func TestTheRuntimesDataAndAnyHomesSSHAreTheMachinesOwn(t *testing.T) {
-	m := Manifest{Module: "notes", Resources: []map[string]any{{"id": "data", "type": "directory"}},
-		Accesses: []Access{{ID: "media"}}}
-	for _, path := range []string{"/var/spool", "/var/spool/cron", "/var/lib/docker", "/var/lib/docker/volumes",
-		"/var/lib/containers/storage", "/var/lib/containerd", "/var/lib/containerd/io.containerd.snapshotter.v1", "/opt", "/opt/app", "/home/alice/.ssh", "/home/alice/.ssh/keys",
-		"/srv/backup/.ssh", "/root/.ssh"} {
-		layers := []Layer{LayerOf("laptop", map[string]any{PlacesSetting: map[string]any{"data": path}})}
-		if _, err := Places(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
-			t.Errorf("a place at %s: %v", path, err)
-		}
-		layers = []Layer{LayerOf("laptop", map[string]any{AccessesSetting: map[string]any{"media": path}})}
-		if _, err := AccessPlaces(m, layers); err == nil || !strings.Contains(err.Error(), "issue 339") {
-			t.Errorf("an access at %s: %v", path, err)
-		}
-	}
-	for _, path := range []string{"/var/lib/dockerish", "/home/alice/ssh", "/home/alice/.sshd-notes", "/storage/media"} {
-		layers := []Layer{LayerOf("laptop", map[string]any{PlacesSetting: map[string]any{"data": path}})}
-		if _, err := Places(m, layers); err != nil {
-			t.Errorf("a place at %s: %v", path, err)
-		}
-	}
-}
-
-// What a provider serves its consumers is the terminal's (novox/hq issue 339): any key under its `serves`, and any
-// setting a served value asks for, is set at the terminal alone — a verb that could change a port could point every
-// consumer at a listener of the caller's own. So is any setting a file marked `trusted` asks for.
-func TestTerminalKeysAreDerived(t *testing.T) {
-	postgres := Manifest{Module: "postgres", Serves: map[string]map[string]any{"postgres-database": {"port": 5432.0}}}
-	keycloak := Manifest{Module: "keycloak", Serves: map[string]map[string]any{"oidc-client": {
-		"issuer": "${setting:issuer}", "token-path": "/protocol/openid-connect/token"}}}
-	power := Manifest{Module: "power", Resources: []map[string]any{
-		{"id": "logind", "type": "file", "path": "/etc/systemd/logind.conf.d/power.conf", "trusted": true,
-			"content": "HandleLidSwitch=${setting:handle-lid-switch}\n"},
-		{"id": "note", "type": "file", "path": "/var/lib/power/note", "trusted": false, "content": "${setting:greeting}\n"},
-		// Unmarked counts as trusted (fail closed): only `"trusted": false` lets a verb change what a file asks for.
-		{"id": "unmarked", "type": "file", "path": "/etc/power/unmarked", "content": "${setting:unmarked}\n"}}}
-	agent := Manifest{Module: "claude-code", Resources: []map[string]any{{"id": "settings", "type": "file",
-		"path": "/var/lib/agent/settings.json", "merge": MergeJSON,
-		"content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {},\n  \"managed_settings\": {}\n}\n"}}}
-	for _, c := range []struct {
-		m    Manifest
-		want string
-	}{
-		{postgres, "places,accesses,port"},
-		{keycloak, "places,accesses,issuer,token-path"},
-		{power, "places,accesses,handle-lid-switch,unmarked"},
-		{Manifest{Module: "plain"}, "places,accesses"},
-		// A mergeable file asks for every key its own content names (novox/hq issue 340): the agent's module keeps
-		// what every Claude Code session on a node obeys in one.
-		{agent, "places,accesses,managed_settings,mcp_servers,role"},
-		{Manifest{Module: "notifier", Resources: []map[string]any{{"id": "look", "type": "file", "path": "/var/lib/n/look.json",
-			"merge": MergeJSON, "trusted": false, "content": `{"font": 13}`}}}, "places,accesses"},
-		{Manifest{Module: "empty", Resources: []map[string]any{{"id": "config", "type": "file", "path": "/var/lib/e/c.json",
-			"merge": MergeJSON, "content": `{}`}}}, "places,accesses"},
-	} {
-		if got := strings.Join(TerminalKeys(c.m), ","); got != c.want {
-			t.Errorf("%s: %s; want %s", c.m.Module, got, c.want)
-		}
-	}
-}
-
-// A module whose mergeable files name the keys they take (ADR 0326) has no whole layer at the terminal: a
-// trusted file's named keys are terminal keys, and a file nothing trusts leaves its keys to the verb (novox/hq
-// ADR 0329 §5, issue 586: betterbird's tags beside its trusted accounts, identities, calendars, address books
-// and filters). A module whose files name no keys keeps the whole layer at the terminal (issue 340).
-func TestOnlyANamedKeyOfATrustedFileIsTheTerminals(t *testing.T) {
-	betterbird := Manifest{Module: "betterbird", Resources: []map[string]any{
-		{"id": "prefs", "type": "file", "path": "/home/p/prefs.json", "merge": MergeJSON, "trusted": true,
-			TakesSettingsField: []any{"prefs"}, "content": `{"prefs": {}}`},
-		{"id": "accounts", "type": "file", "path": "/home/p/accounts.json", "merge": MergeJSON, "trusted": true,
-			TakesSettingsField: []any{"accounts"}, "content": `{"accounts": {}}`},
-		{"id": "configuration", "type": "file", "path": "/home/p/configuration.json", "merge": MergeJSON,
-			TakesSettingsField: []any{"identities", "calendars", "address-books", "filters"}, "content": `{}`},
-		{"id": "tags", "type": "file", "path": "/home/p/tags.json", "merge": MergeJSON, "trusted": false,
-			TakesSettingsField: []any{"tags"}, "content": `{"tags": {}}`}}}
-	if got := TrustedMergeable(betterbird); len(got) != 0 {
-		t.Fatalf("files that name their keys put no whole layer at the terminal: %v", got)
-	}
-	if got := strings.Join(TerminalKeys(betterbird), ","); got != "places,accesses,accounts,address-books,calendars,filters,identities,prefs" {
-		t.Fatalf("the named keys of the trusted files, unmarked counting as trusted, and not tags: %s", got)
-	}
-	silent := Manifest{Module: "keycloak", Resources: []map[string]any{{"id": "runtime", "type": "file",
-		"path": "/var/lib/kc/runtime.json", "merge": MergeJSON, "content": `{}`}}}
-	if got := TrustedMergeable(silent); len(got) != 1 {
-		t.Fatalf("a file that names no keys still takes any key, so its module's layer stays the terminal's: %v", got)
-	}
-}
-
-// A file that asks for a setting says whether what it asks is trusted (novox/hq issue 339): `trusted` is a
-// boolean, on a file alone, and a file asking for a setting without it is named.
-func TestAFileSaysWhetherItsSettingsAreTrusted(t *testing.T) {
-	m := Manifest{Module: "power", Resources: []map[string]any{
-		{"id": "said", "type": "file", "path": "/etc/a", "trusted": true, "content": "${setting:a}"},
-		{"id": "unsaid", "type": "file", "path": "/etc/b", "content": "${setting:b}"},
-		{"id": "no-setting", "type": "file", "path": "/etc/c", "content": "plain"}}}
-	if got := strings.Join(UnsaidTrust(m), ","); got != "unsaid" {
-		t.Errorf("unsaid: %s; want unsaid", got)
-	}
-	// A mergeable file that names keys asks for them, so it is named too; one that names none asks for nothing.
-	merged := Manifest{Module: "agent", Resources: []map[string]any{
-		{"id": "settings", "type": "file", "path": "/a", "merge": MergeJSON, "content": `{"managed_settings": {}}`},
-		{"id": "blank", "type": "file", "path": "/b", "merge": MergeJSON, "content": `{}`}}}
-	if got := strings.Join(UnsaidTrust(merged), ","); got != "settings" {
-		t.Errorf("unsaid: %s; want settings", got)
-	}
-	for _, bad := range []map[string]any{
-		{"id": "x", "type": "file", "path": "/etc/x", "trusted": "yes", "content": "${setting:a}"},
-		{"id": "y", "type": "directory", "trusted": true},
-	} {
-		if problems := TrustProblems(Manifest{Module: "power", Resources: []map[string]any{bad}}); len(problems) == 0 {
-			t.Errorf("%v was taken", bad)
-		}
-	}
-}
diff --git a/internal/catalogue/testdata/bars/bar-battery b/internal/catalogue/testdata/bars/bar-battery
deleted file mode 100644
index d2386bab..00000000
--- a/internal/catalogue/testdata/bars/bar-battery
+++ /dev/null
@@ -1,9 +0,0 @@
-[[block]]
-block = "battery"
-format = "$icon $percentage{ $time|}"
-charging_format = "$icon $percentage{ $time|}"
-not_charging_format = "$icon $percentage"
-full_format = "$icon $percentage"
-empty_format = "$icon $percentage"
-missing_format = ""
-
diff --git a/internal/catalogue/testdata/bars/bar-power-draw b/internal/catalogue/testdata/bars/bar-power-draw
deleted file mode 100644
index 3d0d3380..00000000
--- a/internal/catalogue/testdata/bars/bar-power-draw
+++ /dev/null
@@ -1,6 +0,0 @@
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-value power.draw ${machine:name}"
-interval = 5
-hide_when_empty = true
-
diff --git a/internal/catalogue/testdata/bars/battery.bottom-bar.toml b/internal/catalogue/testdata/bars/battery.bottom-bar.toml
deleted file mode 100644
index d5ec4c7c..00000000
--- a/internal/catalogue/testdata/bars/battery.bottom-bar.toml
+++ /dev/null
@@ -1,119 +0,0 @@
-# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
-# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
-# person's devices left out: a block that depends on the hardware is contributed by the module that
-# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
-# here works the same on any machine.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "tea_timer"
-format = "$icon{ $minutes:$seconds|}"
-done_cmd = "notify-send 'Timer finished'"
-
-# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
-# count through a network gap and shows an error only after ten failed checks in a row. Click: the
-# list, in the launcher's menu.
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-updates 10"
-json = true
-interval = 1800
-[[block.click]]
-button = "left"
-cmd = "checkupdates | dmenu -l 20 -p Updates"
-
-[[block]]
-block = "cpu"
-
-[[block]]
-block = "disk_space"
-path = "/"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "disk_space"
-path = "/home"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "memory"
-# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
-# module judges by. Counting the cache as used read near full on a machine with room to spare.
-format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
-format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
-
-# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
-# what they show by this module's template, and only on a machine that has what they show.
-
-[[block]]
-block = "docker"
-interval = 2
-format = "$icon $running/$total"
-
-[[block]]
-block = "sound"
-[[block.click]]
-button = "left"
-cmd = "pavucontrol"
-
-# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
-# power draw, where the machine has them.
-# power
-[[block]]
-block = "battery"
-format = "$icon $percentage{ $time|}"
-charging_format = "$icon $percentage{ $time|}"
-not_charging_format = "$icon $percentage"
-full_format = "$icon $percentage"
-empty_format = "$icon $percentage"
-missing_format = ""
-
-
-# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
-[[block]]
-block = "weather"
-format = "$icon  $weather_verbose ($location) $temp"
-autolocate = true
-autolocate_interval = 600
-[block.service]
-name = "metno"
-
-[[block]]
-block = "notify"
-driver = "dunst"
-format = " $icon {($notification_count.eng(w:1))|}"
-
-[[block]]
-block = "time"
-interval = 1
-format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/catalogue/testdata/bars/battery.top-bar.toml b/internal/catalogue/testdata/bars/battery.top-bar.toml
deleted file mode 100644
index 33f1a3b9..00000000
--- a/internal/catalogue/testdata/bars/battery.top-bar.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
-# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "focused_window"
-[block.format]
-full = " $title.str(max_w:50) |"
-short = " $title.str(max_w:100) |"
-
-[[block]]
-block = "uptime"
-interval = 60
-
-# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
-# so that one that does is never dropped.
-
diff --git a/internal/catalogue/testdata/bars/both.bottom-bar.toml b/internal/catalogue/testdata/bars/both.bottom-bar.toml
deleted file mode 100644
index ad3a4e65..00000000
--- a/internal/catalogue/testdata/bars/both.bottom-bar.toml
+++ /dev/null
@@ -1,126 +0,0 @@
-# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
-# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
-# person's devices left out: a block that depends on the hardware is contributed by the module that
-# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
-# here works the same on any machine.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "tea_timer"
-format = "$icon{ $minutes:$seconds|}"
-done_cmd = "notify-send 'Timer finished'"
-
-# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
-# count through a network gap and shows an error only after ten failed checks in a row. Click: the
-# list, in the launcher's menu.
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-updates 10"
-json = true
-interval = 1800
-[[block.click]]
-button = "left"
-cmd = "checkupdates | dmenu -l 20 -p Updates"
-
-[[block]]
-block = "cpu"
-
-[[block]]
-block = "disk_space"
-path = "/"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "disk_space"
-path = "/home"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "memory"
-# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
-# module judges by. Counting the cache as used read near full on a machine with room to spare.
-format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
-format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
-
-# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
-# what they show by this module's template, and only on a machine that has what they show.
-
-[[block]]
-block = "docker"
-interval = 2
-format = "$icon $running/$total"
-
-[[block]]
-block = "sound"
-[[block.click]]
-button = "left"
-cmd = "pavucontrol"
-
-# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
-# power draw, where the machine has them.
-# power
-[[block]]
-block = "battery"
-format = "$icon $percentage{ $time|}"
-charging_format = "$icon $percentage{ $time|}"
-not_charging_format = "$icon $percentage"
-full_format = "$icon $percentage"
-empty_format = "$icon $percentage"
-missing_format = ""
-
-# power
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-value power.draw workstation"
-interval = 5
-hide_when_empty = true
-
-
-# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
-[[block]]
-block = "weather"
-format = "$icon  $weather_verbose ($location) $temp"
-autolocate = true
-autolocate_interval = 600
-[block.service]
-name = "metno"
-
-[[block]]
-block = "notify"
-driver = "dunst"
-format = " $icon {($notification_count.eng(w:1))|}"
-
-[[block]]
-block = "time"
-interval = 1
-format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/catalogue/testdata/bars/both.top-bar.toml b/internal/catalogue/testdata/bars/both.top-bar.toml
deleted file mode 100644
index 33f1a3b9..00000000
--- a/internal/catalogue/testdata/bars/both.top-bar.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
-# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "focused_window"
-[block.format]
-full = " $title.str(max_w:50) |"
-short = " $title.str(max_w:100) |"
-
-[[block]]
-block = "uptime"
-interval = 60
-
-# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
-# so that one that does is never dropped.
-
diff --git a/internal/catalogue/testdata/bars/bottom-bar.toml b/internal/catalogue/testdata/bars/bottom-bar.toml
deleted file mode 100644
index 12e6805f..00000000
--- a/internal/catalogue/testdata/bars/bottom-bar.toml
+++ /dev/null
@@ -1,109 +0,0 @@
-# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
-# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
-# person's devices left out: a block that depends on the hardware is contributed by the module that
-# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
-# here works the same on any machine.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "tea_timer"
-format = "$icon{ $minutes:$seconds|}"
-done_cmd = "notify-send 'Timer finished'"
-
-# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
-# count through a network gap and shows an error only after ten failed checks in a row. Click: the
-# list, in the launcher's menu.
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-updates 10"
-json = true
-interval = 1800
-[[block.click]]
-button = "left"
-cmd = "checkupdates | dmenu -l 20 -p Updates"
-
-[[block]]
-block = "cpu"
-
-[[block]]
-block = "disk_space"
-path = "/"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "disk_space"
-path = "/home"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "memory"
-# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
-# module judges by. Counting the cache as used read near full on a machine with room to spare.
-format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
-format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
-
-# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
-# what they show by this module's template, and only on a machine that has what they show.
-${collected:contribution:node-bar:block:bar=bottom,place=resources}
-[[block]]
-block = "docker"
-interval = 2
-format = "$icon $running/$total"
-
-[[block]]
-block = "sound"
-[[block.click]]
-button = "left"
-cmd = "pavucontrol"
-
-# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
-# power draw, where the machine has them.
-${collected:contribution:node-bar:block:bar=bottom,place=status}
-# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
-[[block]]
-block = "weather"
-format = "$icon  $weather_verbose ($location) $temp"
-autolocate = true
-autolocate_interval = 600
-[block.service]
-name = "metno"
-
-[[block]]
-block = "notify"
-driver = "dunst"
-format = " $icon {($notification_count.eng(w:1))|}"
-
-[[block]]
-block = "time"
-interval = 1
-format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/catalogue/testdata/bars/none.bottom-bar.toml b/internal/catalogue/testdata/bars/none.bottom-bar.toml
deleted file mode 100644
index 59dc87a1..00000000
--- a/internal/catalogue/testdata/bars/none.bottom-bar.toml
+++ /dev/null
@@ -1,109 +0,0 @@
-# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
-# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
-# person's devices left out: a block that depends on the hardware is contributed by the module that
-# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
-# here works the same on any machine.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "tea_timer"
-format = "$icon{ $minutes:$seconds|}"
-done_cmd = "notify-send 'Timer finished'"
-
-# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
-# count through a network gap and shows an error only after ten failed checks in a row. Click: the
-# list, in the launcher's menu.
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-updates 10"
-json = true
-interval = 1800
-[[block.click]]
-button = "left"
-cmd = "checkupdates | dmenu -l 20 -p Updates"
-
-[[block]]
-block = "cpu"
-
-[[block]]
-block = "disk_space"
-path = "/"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "disk_space"
-path = "/home"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "memory"
-# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
-# module judges by. Counting the cache as used read near full on a machine with room to spare.
-format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
-format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
-
-# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
-# what they show by this module's template, and only on a machine that has what they show.
-
-[[block]]
-block = "docker"
-interval = 2
-format = "$icon $running/$total"
-
-[[block]]
-block = "sound"
-[[block.click]]
-button = "left"
-cmd = "pavucontrol"
-
-# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
-# power draw, where the machine has them.
-
-# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
-[[block]]
-block = "weather"
-format = "$icon  $weather_verbose ($location) $temp"
-autolocate = true
-autolocate_interval = 600
-[block.service]
-name = "metno"
-
-[[block]]
-block = "notify"
-driver = "dunst"
-format = " $icon {($notification_count.eng(w:1))|}"
-
-[[block]]
-block = "time"
-interval = 1
-format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/catalogue/testdata/bars/none.top-bar.toml b/internal/catalogue/testdata/bars/none.top-bar.toml
deleted file mode 100644
index 33f1a3b9..00000000
--- a/internal/catalogue/testdata/bars/none.top-bar.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
-# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "focused_window"
-[block.format]
-full = " $title.str(max_w:50) |"
-short = " $title.str(max_w:100) |"
-
-[[block]]
-block = "uptime"
-interval = 60
-
-# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
-# so that one that does is never dropped.
-
diff --git a/internal/catalogue/testdata/bars/power-meter.bottom-bar.toml b/internal/catalogue/testdata/bars/power-meter.bottom-bar.toml
deleted file mode 100644
index ae6c2ce2..00000000
--- a/internal/catalogue/testdata/bars/power-meter.bottom-bar.toml
+++ /dev/null
@@ -1,116 +0,0 @@
-# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
-# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
-# person's devices left out: a block that depends on the hardware is contributed by the module that
-# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
-# here works the same on any machine.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "tea_timer"
-format = "$icon{ $minutes:$seconds|}"
-done_cmd = "notify-send 'Timer finished'"
-
-# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
-# count through a network gap and shows an error only after ten failed checks in a row. Click: the
-# list, in the launcher's menu.
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-updates 10"
-json = true
-interval = 1800
-[[block.click]]
-button = "left"
-cmd = "checkupdates | dmenu -l 20 -p Updates"
-
-[[block]]
-block = "cpu"
-
-[[block]]
-block = "disk_space"
-path = "/"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "disk_space"
-path = "/home"
-info_type = "used"
-alert_unit = "GB"
-interval = 20
-warning = 850
-alert = 920
-format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
-
-[[block]]
-block = "memory"
-# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
-# module judges by. Counting the cache as used read near full on a machine with room to spare.
-format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
-format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
-
-# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
-# what they show by this module's template, and only on a machine that has what they show.
-
-[[block]]
-block = "docker"
-interval = 2
-format = "$icon $running/$total"
-
-[[block]]
-block = "sound"
-[[block.click]]
-button = "left"
-cmd = "pavucontrol"
-
-# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
-# power draw, where the machine has them.
-# power
-[[block]]
-block = "custom"
-command = "~/.local/bin/i3status-value power.draw workstation"
-interval = 5
-hide_when_empty = true
-
-
-# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
-[[block]]
-block = "weather"
-format = "$icon  $weather_verbose ($location) $temp"
-autolocate = true
-autolocate_interval = 600
-[block.service]
-name = "metno"
-
-[[block]]
-block = "notify"
-driver = "dunst"
-format = " $icon {($notification_count.eng(w:1))|}"
-
-[[block]]
-block = "time"
-interval = 1
-format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/catalogue/testdata/bars/power-meter.top-bar.toml b/internal/catalogue/testdata/bars/power-meter.top-bar.toml
deleted file mode 100644
index 33f1a3b9..00000000
--- a/internal/catalogue/testdata/bars/power-meter.top-bar.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
-# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "focused_window"
-[block.format]
-full = " $title.str(max_w:50) |"
-short = " $title.str(max_w:100) |"
-
-[[block]]
-block = "uptime"
-interval = 60
-
-# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
-# so that one that does is never dropped.
-
diff --git a/internal/catalogue/testdata/bars/top-bar.toml b/internal/catalogue/testdata/bars/top-bar.toml
deleted file mode 100644
index be198e8a..00000000
--- a/internal/catalogue/testdata/bars/top-bar.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
-# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
-icons_format = "{icon}"
-
-[theme]
-theme = "plain"
-[theme.overrides]
-idle_bg = "#000000"
-idle_fg = "#f1f1f1"
-info_bg = "#000000"
-info_fg = "#f1f1f1"
-good_bg = "#000000"
-good_fg = "#859900"
-warning_bg = "#000000"
-warning_fg = "#de5200"
-critical_bg = "#000000"
-critical_fg = "#ff0000"
-separator = " | "
-separator_fg = "#ffffff"
-separator_bg = "#000000"
-
-[icons]
-icons = "custom-icons"
-
-[[block]]
-block = "focused_window"
-[block.format]
-full = " $title.str(max_w:50) |"
-short = " $title.str(max_w:100) |"
-
-[[block]]
-block = "uptime"
-interval = 60
-
-# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
-# so that one that does is never dropped.
-${collected:contribution:node-bar:block:bar=top,place=resources}${collected:contribution:node-bar:block:bar=top,place=status}
diff --git a/internal/catalogue/testdata/environment/all.posix b/internal/catalogue/testdata/environment/all.posix
deleted file mode 100644
index aa61849d..00000000
--- a/internal/catalogue/testdata/environment/all.posix
+++ /dev/null
@@ -1,26 +0,0 @@
-# adwaita
-export GTK2_RC_FILES='/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc'
-export GTK_THEME='Adwaita:dark'
-export QT_QPA_PLATFORMTHEME='qt6ct'
-export QT_SELECT='6'
-export QT_STYLE_OVERRIDE='Fusion'
-export XCURSOR_SIZE='24'
-export XCURSOR_THEME='Adwaita'
-# clipmenu
-export CM_HISTLENGTH='15'
-export CM_MAX_CLIPS='500'
-export CM_SELECTIONS='clipboard'
-# i3
-export XDG_CURRENT_DESKTOP='i3'
-export XDG_SESSION_DESKTOP='i3'
-# xterm
-export TERMINAL='xterm'
-# zsh
-export EDITOR='vim'
-export VISUAL='vim'
-export XDG_CONFIG_HOME='/home/op/.config'
-# zsh
-case ":${PATH}:" in *':/home/op/scripts/bin:'*) ;; *) PATH='/home/op/scripts/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/scripts:'*) ;; *) PATH='/home/op/scripts'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
-export PATH
diff --git a/internal/catalogue/testdata/environment/all.systemd b/internal/catalogue/testdata/environment/all.systemd
deleted file mode 100644
index 70e7709a..00000000
--- a/internal/catalogue/testdata/environment/all.systemd
+++ /dev/null
@@ -1,23 +0,0 @@
-# adwaita
-GTK2_RC_FILES=/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc
-GTK_THEME=Adwaita:dark
-QT_QPA_PLATFORMTHEME=qt6ct
-QT_SELECT=6
-QT_STYLE_OVERRIDE=Fusion
-XCURSOR_SIZE=24
-XCURSOR_THEME=Adwaita
-# clipmenu
-CM_HISTLENGTH=15
-CM_MAX_CLIPS=500
-CM_SELECTIONS=clipboard
-# i3
-XDG_CURRENT_DESKTOP=i3
-XDG_SESSION_DESKTOP=i3
-# xterm
-TERMINAL=xterm
-# zsh
-EDITOR=vim
-VISUAL=vim
-XDG_CONFIG_HOME=/home/op/.config
-# zsh
-PATH=/home/op/.local/bin:/home/op/scripts:/home/op/scripts/bin${PATH:+:$PATH}
diff --git a/internal/catalogue/testdata/environment/zsh.posix b/internal/catalogue/testdata/environment/zsh.posix
deleted file mode 100644
index 905c1574..00000000
--- a/internal/catalogue/testdata/environment/zsh.posix
+++ /dev/null
@@ -1,9 +0,0 @@
-# zsh
-export EDITOR='vim'
-export VISUAL='vim'
-export XDG_CONFIG_HOME='/home/op/.config'
-# zsh
-case ":${PATH}:" in *':/home/op/scripts/bin:'*) ;; *) PATH='/home/op/scripts/bin'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/scripts:'*) ;; *) PATH='/home/op/scripts'"${PATH:+:${PATH}}" ;; esac
-case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
-export PATH
diff --git a/internal/catalogue/testdata/environment/zsh.systemd b/internal/catalogue/testdata/environment/zsh.systemd
deleted file mode 100644
index 2a28ce0a..00000000
--- a/internal/catalogue/testdata/environment/zsh.systemd
+++ /dev/null
@@ -1,6 +0,0 @@
-# zsh
-EDITOR=vim
-VISUAL=vim
-XDG_CONFIG_HOME=/home/op/.config
-# zsh
-PATH=/home/op/.local/bin:/home/op/scripts:/home/op/scripts/bin${PATH:+:$PATH}
diff --git a/internal/catalogue/testdata/influxdb-served-by-setting/grafana-ace.json b/internal/catalogue/testdata/influxdb-served-by-setting/grafana-ace.json
deleted file mode 100644
index d9e60b8a..00000000
--- a/internal/catalogue/testdata/influxdb-served-by-setting/grafana-ace.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "grafana.bound-influxdb-api": {
-    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"made-up-bucket\",\n    \"org\": \"made-up-org\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
-    "id": "grafana.bound-influxdb-api",
-    "mode": "0644",
-    "path": "/var/lib/grafana/influxdb.json",
-    "type": "file"
-  },
-  "grafana.influxdb-datasource": {
-    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: made-up-bucket\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
-    "id": "grafana.influxdb-datasource",
-    "mode": "0644",
-    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
-    "type": "file"
-  },
-  "grafana.influxdb-datasources": {
-    "id": "grafana.influxdb-datasources",
-    "mode": "0755",
-    "owner": "472:0",
-    "path": "/var/lib/grafana/influxdb-datasources",
-    "type": "directory"
-  },
-  "grafana.mesh-state": {
-    "id": "grafana.mesh-state",
-    "mode": "0700",
-    "path": "/var/lib/mesh/grafana",
-    "type": "directory"
-  },
-  "grafana.state": {
-    "id": "grafana.state",
-    "mode": "0700",
-    "path": "/var/lib/grafana",
-    "type": "directory"
-  }
-}
diff --git a/internal/catalogue/testdata/influxdb-served-by-setting/grafana-unlayered.json b/internal/catalogue/testdata/influxdb-served-by-setting/grafana-unlayered.json
deleted file mode 100644
index a0ee7989..00000000
--- a/internal/catalogue/testdata/influxdb-served-by-setting/grafana-unlayered.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "grafana.bound-influxdb-api": {
-    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"default\",\n    \"org\": \"mesh\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
-    "id": "grafana.bound-influxdb-api",
-    "mode": "0644",
-    "path": "/var/lib/grafana/influxdb.json",
-    "type": "file"
-  },
-  "grafana.influxdb-datasource": {
-    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: default\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
-    "id": "grafana.influxdb-datasource",
-    "mode": "0644",
-    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
-    "type": "file"
-  },
-  "grafana.influxdb-datasources": {
-    "id": "grafana.influxdb-datasources",
-    "mode": "0755",
-    "owner": "472:0",
-    "path": "/var/lib/grafana/influxdb-datasources",
-    "type": "directory"
-  },
-  "grafana.mesh-state": {
-    "id": "grafana.mesh-state",
-    "mode": "0700",
-    "path": "/var/lib/mesh/grafana",
-    "type": "directory"
-  },
-  "grafana.state": {
-    "id": "grafana.state",
-    "mode": "0700",
-    "path": "/var/lib/grafana",
-    "type": "directory"
-  }
-}
diff --git a/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger b/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger
deleted file mode 100644
index 5e4d165c..00000000
--- a/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger
+++ /dev/null
@@ -1,10 +0,0 @@
-# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
-# and the touchpad key. Each runs this module's own script, as the operator's account.
-KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
-KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
-KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
-KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal b/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal
deleted file mode 100644
index af60a9d9..00000000
--- a/internal/catalogue/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal
+++ /dev/null
@@ -1,7 +0,0 @@
-# The touchpad's settings again after waking, in the operator's session: X applies the module's
-# input class when the device appears, and this covers a wake that does not initialise it again.
-# Runs as root from the power module; the reset itself runs as the session's owner.
-sleep 2
-owner=$(ps -o user= -C i3 | head -n 1)
-[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
-true
diff --git a/internal/catalogue/testdata/l2-moved/items/claude-code.shell-zsh-normal b/internal/catalogue/testdata/l2-moved/items/claude-code.shell-zsh-normal
deleted file mode 100644
index b90b85f9..00000000
--- a/internal/catalogue/testdata/l2-moved/items/claude-code.shell-zsh-normal
+++ /dev/null
@@ -1,12 +0,0 @@
-# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
-# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
-# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
-# the real claude: exec, sudo and its sh see no alias.
-if [[ -r /etc/claude-code/agent-account ]]; then
-	() {
-		local agent=$(</etc/claude-code/agent-account)
-		if [[ -n $agent && $agent != $USERNAME ]]; then
-			alias claude=claude-agent
-		fi
-	}
-fi
diff --git a/internal/catalogue/testdata/l2-moved/items/mesh-cli.shell-zsh-normal b/internal/catalogue/testdata/l2-moved/items/mesh-cli.shell-zsh-normal
deleted file mode 100644
index 117f2a5a..00000000
--- a/internal/catalogue/testdata/l2-moved/items/mesh-cli.shell-zsh-normal
+++ /dev/null
@@ -1,3 +0,0 @@
-# The operator's command (module mesh-cli, novox/hq ADR 0272): nox is mesh-cli, in interactive zsh only.
-# A script, sudo and a document meant to work everywhere say mesh-cli.
-alias nox=mesh-cli
diff --git a/internal/catalogue/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal b/internal/catalogue/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal
deleted file mode 100644
index ba4fc1d6..00000000
--- a/internal/catalogue/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal
+++ /dev/null
@@ -1,3 +0,0 @@
-# The prompt: powerlevel10k v1.20.0, pinned in this module (novox/hq ADR 0205), and its configuration.
-[[ ! -f ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme
-[[ ! -f ~/.config/powerlevel10k/p10k.zsh ]] || source ~/.config/powerlevel10k/p10k.zsh
diff --git a/internal/catalogue/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal b/internal/catalogue/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal
deleted file mode 100644
index 8179334a..00000000
--- a/internal/catalogue/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal
+++ /dev/null
@@ -1,2 +0,0 @@
-# Suggestions from history as you type, from the distribution's package.
-[[ ! -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
diff --git a/internal/catalogue/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last b/internal/catalogue/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last
deleted file mode 100644
index bf9d5b19..00000000
--- a/internal/catalogue/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last
+++ /dev/null
@@ -1,3 +0,0 @@
-# Syntax highlighting of the command line, from the distribution's package. Last, as upstream asks:
-# it wraps every widget defined before it.
-[[ ! -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
diff --git a/internal/catalogue/testdata/l2-moved/templates/power b/internal/catalogue/testdata/l2-moved/templates/power
deleted file mode 100644
index 2655c226..00000000
--- a/internal/catalogue/testdata/l2-moved/templates/power
+++ /dev/null
@@ -1,4 +0,0 @@
-# What every module on this machine runs at the moment after-wake, as the mesh placed it (module power,
-# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
-# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
-${shell:after-wake:first}${shell:after-wake:normal}${shell:after-wake:last}
\ No newline at end of file
diff --git a/internal/catalogue/testdata/l2-moved/templates/triggerhappy b/internal/catalogue/testdata/l2-moved/templates/triggerhappy
deleted file mode 100644
index 45766339..00000000
--- a/internal/catalogue/testdata/l2-moved/templates/triggerhappy
+++ /dev/null
@@ -1,4 +0,0 @@
-# The machine's hotkeys, written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on
-# every push: a key is added by the module it belongs to, as a contribution to node-hotkeys.
-# A line is: the key, its state (1 pressed, 2 held, 0 released), the command.
-${contribution:node-hotkeys:trigger}
\ No newline at end of file
diff --git a/internal/catalogue/testdata/l2-moved/templates/zsh b/internal/catalogue/testdata/l2-moved/templates/zsh
deleted file mode 100644
index 0e868f59..00000000
--- a/internal/catalogue/testdata/l2-moved/templates/zsh
+++ /dev/null
@@ -1,60 +0,0 @@
-# The mesh's block (module zsh, novox/hq ADR 0204): the defaults every machine shares, and the code
-# other modules contribute in three slots. It is replaced at every push. Everything below it is
-# yours, kept as you wrote it, and runs after it, so your lines win.
-${shell:zsh:first}
-# History, kept across sessions and shared between open shells. Without these zsh saves none:
-# SAVEHIST defaults to 0 (novox/hq to-be 41, found on review 2026-10-04).
-HISTFILE="$HOME/.zsh_history"
-HISTSIZE=100000
-SAVEHIST=100000
-setopt EXTENDED_HISTORY SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE HIST_REDUCE_BLANKS
-
-# The completion system. Nothing initialised it, so only zsh's basic completion ran. Its cache
-# goes under ~/.cache rather than beside ~/.zshrc.
-[[ -d "$HOME/.cache/zsh" ]] || mkdir -p "$HOME/.cache/zsh"
-autoload -Uz compinit && compinit -d "$HOME/.cache/zsh/zcompdump"
-zstyle ':completion:*' menu select
-
-# Terminal title: host, directory, git branch
-function set_terminal_title() {
-  local git_branch=""
-  if git rev-parse --is-inside-work-tree &>/dev/null; then
-    git_branch=" ($(git branch --show-current 2>/dev/null))"
-  fi
-  print -Pn "\e]2;%m: %~${git_branch}\a"
-}
-precmd_functions+=(set_terminal_title)
-
-# Keybindings
-bindkey  "^[[H"   beginning-of-line   # Home
-bindkey  "^[OH"   beginning-of-line   # Home
-bindkey  "^A"   beginning-of-line     # Ctrl + A
-bindkey  "^[[F"   end-of-line         # End
-bindkey  "^[OF"   end-of-line         # End
-bindkey  "^E"   end-of-line           # Ctrl + E
-bindkey  "^[[3~"  delete-char         # Del
-
-# Colour support of ls and friends
-if [ -x /usr/bin/dircolors ]; then
-  test -r $HOME/.dircolors && eval "$(dircolors -b $HOME/.dircolors)" || eval "$(dircolors -b)"
-  alias ls='ls --color=auto'
-  alias dir='dir --color=auto'
-  alias vdir='vdir --color=auto'
-  alias grep='grep --color=auto'
-  alias fgrep='fgrep --color=auto'
-  alias egrep='egrep --color=auto'
-fi
-alias ll='ls -alhF'
-alias la='ls -Ah'
-alias l='ls -CFh'
-
-# A throwaway container, and what takes the space under a directory
-alias drun='docker run -it --rm'
-disksize() {
-  du -h --max-depth=1 "${1:-.}" | sort -h
-}
-sudo-disksize() {
-  sudo du -h --max-depth=1 "${1:-.}" | sort -h
-}
-
-${shell:zsh:normal}${shell:zsh:last}
diff --git a/internal/catalogue/testdata/l2-moved/want/power b/internal/catalogue/testdata/l2-moved/want/power
deleted file mode 100644
index 736d28bd..00000000
--- a/internal/catalogue/testdata/l2-moved/want/power
+++ /dev/null
@@ -1,11 +0,0 @@
-# What every module on this machine runs at the moment after-wake, as the mesh placed it (module power,
-# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
-# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
-# asus-zephyrus-g14
-# The touchpad's settings again after waking, in the operator's session: X applies the module's
-# input class when the device appears, and this covers a wake that does not initialise it again.
-# Runs as root from the power module; the reset itself runs as the session's owner.
-sleep 2
-owner=$(ps -o user= -C i3 | head -n 1)
-[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
-true
diff --git a/internal/catalogue/testdata/l2-moved/want/triggerhappy b/internal/catalogue/testdata/l2-moved/want/triggerhappy
deleted file mode 100644
index 369ede9b..00000000
--- a/internal/catalogue/testdata/l2-moved/want/triggerhappy
+++ /dev/null
@@ -1,14 +0,0 @@
-# The machine's hotkeys, written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on
-# every push: a key is added by the module it belongs to, as a contribution to node-hotkeys.
-# A line is: the key, its state (1 pressed, 2 held, 0 released), the command.
-# asus-zephyrus-g14
-# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
-# and the touchpad key. Each runs this module's own script, as the operator's account.
-KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
-KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
-KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
-KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
-KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
-KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/internal/catalogue/testdata/l2-moved/want/zsh b/internal/catalogue/testdata/l2-moved/want/zsh
deleted file mode 100644
index f9e16a25..00000000
--- a/internal/catalogue/testdata/l2-moved/want/zsh
+++ /dev/null
@@ -1,88 +0,0 @@
-# The mesh's block (module zsh, novox/hq ADR 0204): the defaults every machine shares, and the code
-# other modules contribute in three slots. It is replaced at every push. Everything below it is
-# yours, kept as you wrote it, and runs after it, so your lines win.
-
-# History, kept across sessions and shared between open shells. Without these zsh saves none:
-# SAVEHIST defaults to 0 (novox/hq to-be 41, found on review 2026-10-04).
-HISTFILE="$HOME/.zsh_history"
-HISTSIZE=100000
-SAVEHIST=100000
-setopt EXTENDED_HISTORY SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE HIST_REDUCE_BLANKS
-
-# The completion system. Nothing initialised it, so only zsh's basic completion ran. Its cache
-# goes under ~/.cache rather than beside ~/.zshrc.
-[[ -d "$HOME/.cache/zsh" ]] || mkdir -p "$HOME/.cache/zsh"
-autoload -Uz compinit && compinit -d "$HOME/.cache/zsh/zcompdump"
-zstyle ':completion:*' menu select
-
-# Terminal title: host, directory, git branch
-function set_terminal_title() {
-  local git_branch=""
-  if git rev-parse --is-inside-work-tree &>/dev/null; then
-    git_branch=" ($(git branch --show-current 2>/dev/null))"
-  fi
-  print -Pn "\e]2;%m: %~${git_branch}\a"
-}
-precmd_functions+=(set_terminal_title)
-
-# Keybindings
-bindkey  "^[[H"   beginning-of-line   # Home
-bindkey  "^[OH"   beginning-of-line   # Home
-bindkey  "^A"   beginning-of-line     # Ctrl + A
-bindkey  "^[[F"   end-of-line         # End
-bindkey  "^[OF"   end-of-line         # End
-bindkey  "^E"   end-of-line           # Ctrl + E
-bindkey  "^[[3~"  delete-char         # Del
-
-# Colour support of ls and friends
-if [ -x /usr/bin/dircolors ]; then
-  test -r $HOME/.dircolors && eval "$(dircolors -b $HOME/.dircolors)" || eval "$(dircolors -b)"
-  alias ls='ls --color=auto'
-  alias dir='dir --color=auto'
-  alias vdir='vdir --color=auto'
-  alias grep='grep --color=auto'
-  alias fgrep='fgrep --color=auto'
-  alias egrep='egrep --color=auto'
-fi
-alias ll='ls -alhF'
-alias la='ls -Ah'
-alias l='ls -CFh'
-
-# A throwaway container, and what takes the space under a directory
-alias drun='docker run -it --rm'
-disksize() {
-  du -h --max-depth=1 "${1:-.}" | sort -h
-}
-sudo-disksize() {
-  sudo du -h --max-depth=1 "${1:-.}" | sort -h
-}
-
-# claude-code
-# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
-# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
-# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
-# the real claude: exec, sudo and its sh see no alias.
-if [[ -r /etc/claude-code/agent-account ]]; then
-	() {
-		local agent=$(</etc/claude-code/agent-account)
-		if [[ -n $agent && $agent != $USERNAME ]]; then
-			alias claude=claude-agent
-		fi
-	}
-fi
-# mesh-cli
-# The operator's command (module mesh-cli, novox/hq ADR 0272): nox is mesh-cli, in interactive zsh only.
-# A script, sudo and a document meant to work everywhere say mesh-cli.
-alias nox=mesh-cli
-# powerlevel10k
-# The prompt: powerlevel10k v1.20.0, pinned in this module (novox/hq ADR 0205), and its configuration.
-[[ ! -f ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme
-[[ ! -f ~/.config/powerlevel10k/p10k.zsh ]] || source ~/.config/powerlevel10k/p10k.zsh
-# zsh-autosuggestions
-# Suggestions from history as you type, from the distribution's package.
-[[ ! -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
-# zsh-syntax-highlighting
-# Syntax highlighting of the command line, from the distribution's package. Last, as upstream asks:
-# it wraps every widget defined before it.
-[[ ! -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
-
diff --git a/internal/catalogue/the_bus_is_never_public_test.go b/internal/catalogue/the_bus_is_never_public_test.go
deleted file mode 100644
index 84371ca4..00000000
--- a/internal/catalogue/the_bus_is_never_public_test.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package catalogue
-
-import (
-	"regexp"
-	"testing"
-)
-
-// The bus is never public (novox/hq ADR 0169). Its port is what the bus module declares, the mesh,
-// and the control plane adds no opening of its own: a machine joins through the tunnel, so the
-// broker's host is filtered like any other. Before this, the broker port was a foundation port and
-// rendered from anywhere beside its from-the-mesh rule.
-func TestTheBusPortIsReachedFromTheMeshAlone(t *testing.T) {
-	rules := []Rule{{Port: 4222, Protocol: "tcp", From: FromMesh, Because: []string{"nats"},
-		Why: []string{"the mesh bus"}}}
-	out := AsNftables(rules, []string{"10.10.0.1", "10.10.0.2"}, true, nil, []string{"eth0"}, "mesh0")
-
-	if !regexp.MustCompile(`ip saddr \{ 10\.10\.0\.1, 10\.10\.0\.2 \} tcp dport 4222 accept`).MatchString(out) {
-		t.Fatalf("the bus is not reachable from the mesh:\n%s", out)
-	}
-	if regexp.MustCompile(`(?m)^\s*tcp dport 4222 accept`).MatchString(out) {
-		t.Fatalf("the bus is reachable from anywhere:\n%s", out)
-	}
-}
diff --git a/internal/catalogue/two_consumers_test.go b/internal/catalogue/two_consumers_test.go
deleted file mode 100644
index f989781c..00000000
--- a/internal/catalogue/two_consumers_test.go
+++ /dev/null
@@ -1,143 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A node runs several modules that all want one database (novox/hq 04-ISSUES/022).
-//
-// **The ordinary arrangement, and it could not be planned at all.** The walk that resolves a node
-// is a work-list over names, so a requirement three modules shared was visited once and produced
-// one need — carrying whichever module mentioned it first. Everything downstream inherited that:
-// one credential, keyed by machine, named after a machine by the provisioner.
-//
-// The symptom had two halves and only one was loud. The provider refused, naming the modules and
-// saying they would share one credential, which reads as a decision. The consumer did not: it
-// resolved cleanly, wrote one module's credential file, and left the other two absent — a service
-// that starts and cannot authenticate, with nothing anywhere saying why. That is the shape of 021
-// again, on a different axis.
-
-func threeConsumers() map[string]Manifest {
-	return shelf(
-		Manifest{Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database")},
-		Manifest{Module: "gitea", Version: "1", Requires: []string{"postgres-database"},
-			Contributes: map[string]map[string]any{"postgres-database": {"name": "gitea"}},
-			Secrets:     map[string]string{"postgres-database": "/var/lib/gitea/db.secret"}},
-		Manifest{Module: "keycloak", Version: "1", Requires: []string{"postgres-database"},
-			Contributes: map[string]map[string]any{"postgres-database": {"name": "keycloak"}},
-			Secrets:     map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"}},
-		Manifest{Module: "umami", Version: "1", Requires: []string{"postgres-database"},
-			Contributes: map[string]map[string]any{"postgres-database": {"name": "umami"}},
-			Secrets:     map[string]string{"postgres-database": "/var/lib/umami/db.secret"}},
-	)
-}
-
-func TestEveryConsumerOnANodeGetsItsOwnCredential(t *testing.T) {
-	got, err := Resolve(threeConsumers(), []string{"gitea", "keycloak", "umami"},
-		reachable(), World{Offered: onNetwork("anchor")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Needs) != 3 {
-		t.Fatalf("three modules want a database and the node has %d need(s): %v",
-			len(got.Needs), got.Needs)
-	}
-	for _, want := range []string{"gitea", "keycloak", "umami"} {
-		var found bool
-		for _, n := range got.Needs {
-			if n.For == want {
-				found = true
-			}
-		}
-		if !found {
-			t.Errorf("%s wants a database and no credential is made for it", want)
-		}
-	}
-}
-
-// Each consumer's own credential reaches its own file. Matching on the provision alone, every
-// consumer took whichever need was last — a module handed somebody else's password, which is a
-// valid credential and therefore fails in a way that looks like a configuration error.
-func TestEachConsumerGetsItsOwnCredentialAndNotAnothersFile(t *testing.T) {
-	got, err := Resolve(threeConsumers(), []string{"gitea", "keycloak", "umami"},
-		reachable(), World{Offered: onNetwork("anchor")})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for i := range got.Needs {
-		got.Needs[i].Sealed = "sealed-for-" + got.Needs[i].For
-	}
-	out, err := got.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, want := range []string{"gitea", "keycloak", "umami"} {
-		var seen bool
-		for _, r := range out {
-			if r["path"] != "/var/lib/"+want+"/db.secret" {
-				continue
-			}
-			seen = true
-			if r["sealed"] != "sealed-for-"+want {
-				t.Errorf("%s was given %v, which belongs to something else", want, r["sealed"])
-			}
-		}
-		if !seen {
-			t.Errorf("%s resolved and its credential file was never written", want)
-		}
-	}
-}
-
-// The provider is told about all three, separately, and names each grant after the module.
-func TestAProviderIsToldAboutEveryConsumerOnOneMachine(t *testing.T) {
-	provider, err := Resolve(shelf(Manifest{
-		Module: "postgres", Version: "1", Provides: FromAnywhere("postgres-database"),
-		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
-		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
-	}), []string{"postgres"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var grants []Grant
-	for _, who := range []string{"gitea", "keycloak", "umami"} {
-		grants = append(grants, Grant{
-			Provision: "postgres-database", Consumer: "anchor", From: who,
-			Values: map[string]any{"name": who}, Sealed: "sealed-for-" + who})
-	}
-	out, err := provider.Declaration(Rendering{Grants: grants})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, who := range []string{"gitea", "keycloak", "umami"} {
-		path := "/var/lib/postgres/grants/anchor." + who + ".secret"
-		var found bool
-		for _, r := range out {
-			if r["path"] == path {
-				found = true
-				if r["sealed"] != "sealed-for-"+who {
-					t.Errorf("%s's grant holds %v", who, r["sealed"])
-				}
-			}
-		}
-		if !found {
-			t.Errorf("the provider was never told to create a login for %s", who)
-		}
-	}
-
-	// And all three appear in the readable manifest, so the provisioner sees three consumers
-	// where there are three. Named after one machine, they were one path and the last won.
-	for _, r := range out {
-		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
-			continue
-		}
-		body := r["content"].(string)
-		for _, who := range []string{"gitea", "keycloak", "umami"} {
-			if !strings.Contains(body, `"`+who+`"`) {
-				t.Errorf("the provider's manifest never mentions %s: %s", who, body)
-			}
-		}
-	}
-}
diff --git a/internal/catalogue/two_resolvers_test.go b/internal/catalogue/two_resolvers_test.go
deleted file mode 100644
index f68bb953..00000000
--- a/internal/catalogue/two_resolvers_test.go
+++ /dev/null
@@ -1,271 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// The mesh has two resolvers (novox/hq ADR 0223): `mesh-dns-resolver` is replicated, held on the
-// anchor and on the home server, each answering the same names; every machine's resolver file lists
-// every holder — its own first when it is one — and no public resolver. ADR 0196 listed the mesh's
-// resolver then a public one, and musl asks both at once and takes the first reply: from the home
-// server the public "no such name" for the anchor's mesh name won, every time, in every Alpine build.
-// The file is written by the module holding the machine's uplink (ADR 0223 part 2).
-
-// resolverMachines is the anchor and the home server holding the resolver, and a laptop holding nothing.
-var resolverMachines = map[string]string{
-	"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2", "home.internal": "10.42.0.3"}
-
-// bothResolvers is the two holders on record, as `seat mesh-dns-resolver --add` leaves them.
-var bothResolvers = []Held{
-	{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "anchor", Module: "dnsmasq"},
-	{Claim: "mesh-dns-resolver", Scope: ScopeMesh, Node: "home", Module: "dnsmasq"},
-}
-
-// uplinks is every module in the catalogue holding node-uplink, and so writing the machine's resolver
-// file (novox/hq ADR 0223 part 2): the program that would otherwise rewrite it is the one that writes it.
-// dhcpcd's left the catalogue with ADR 0226, held by no machine.
-var uplinks = []string{"networkmanager", "systemd-networkd"}
-
-// managing is a machine as each uplink module needs it: able to install, run a service and run the
-// manager that module is for.
-func managing(node string) Node {
-	caps := map[string]bool{"package-manager": true, "service-manager": true}
-	for _, u := range uplinks {
-		caps["uplink-"+u] = true
-	}
-	return Node{Name: node, At: node + ".internal", Capabilities: caps}
-}
-
-// twoResolverShelf is the resolver, the uplink modules that write what a machine asks, and a stand-in
-// answering `mesh-addressing`.
-func twoResolverShelf(t *testing.T) map[string]Manifest {
-	t.Helper()
-	out := map[string]Manifest{
-		"net":     {Module: "net", Version: "1", Provides: []Offer{{Name: "mesh-addressing"}}},
-		"dnsmasq": catalogueManifest(t, "dnsmasq"),
-	}
-	for _, u := range uplinks {
-		out[u] = catalogueManifest(t, u)
-	}
-	return out
-}
-
-// worldWithout is the rest of the mesh as a plan for one machine sees it: every other holder's claim
-// and offer, and both holders on record.
-func worldWithout(node string) World {
-	w := World{Holdings: bothResolvers, Offered: map[string][]Provider{}}
-	for _, h := range bothResolvers {
-		if h.Node == node {
-			continue
-		}
-		w.Held = append(w.Held, h)
-		w.Offered["wildcard-resolution"] = append(w.Offered["wildcard-resolution"],
-			Provider{Node: h.Node, At: h.Node + ".internal", Module: h.Module})
-	}
-	return w
-}
-
-// resolvConfOn resolves and composes one machine and answers with the nameservers its resolver file
-// lists, in order, and the file. The file is the uplink's — `uplink` is one of the assigned modules —
-// and nothing else on the machine declares that path.
-func resolvConfOn(t *testing.T, node, uplink string, assigned []string) ([]string, string) {
-	t.Helper()
-	got, err := Resolve(twoResolverShelf(t), assigned, managing(node), worldWithout(node))
-	if err != nil {
-		t.Fatalf("%s with %s does not resolve with two resolvers on record: %v", node, uplink, err)
-	}
-	out, err := got.Declaration(Rendering{
-		Names: resolverMachines, Machines: resolverMachines, Suffix: "internal",
-		Holders: map[string]map[string]string{"mesh-dns-resolver": {
-			"anchor.internal": "10.42.0.1", "home.internal": "10.42.0.3"}},
-		Needed: map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
-	})
-	if err != nil {
-		t.Fatalf("%s with %s does not compose: %v", node, uplink, err)
-	}
-	var file map[string]any
-	for _, r := range out {
-		if r["path"] != "/etc/resolv.conf" {
-			continue
-		}
-		if file != nil {
-			t.Fatalf("%s declares /etc/resolv.conf twice: %v and %v", node, file["id"], r["id"])
-		}
-		file = r
-	}
-	if file == nil || file["id"] != uplink+".fact-resolvers" {
-		t.Fatalf("%s's resolver file is not %s's: %v", node, uplink, file)
-	}
-	content, _ := file["content"].(string)
-	var servers []string
-	for _, line := range strings.Split(content, "\n") {
-		if strings.HasPrefix(line, "nameserver ") {
-			servers = append(servers, strings.TrimPrefix(line, "nameserver "))
-		}
-	}
-	return servers, content
-}
-
-// Per uplink module: each writes a resolver file listing both holders, the machine's own first on a
-// holder, and only the holders on a machine that is none.
-func TestEveryUplinkListsBothResolversItsOwnFirst(t *testing.T) {
-	for _, uplink := range uplinks {
-		for node, want := range map[string][]string{
-			"anchor": {"10.42.0.1", "10.42.0.3"},
-			"home":   {"10.42.0.3", "10.42.0.1"},
-			"laptop": {"10.42.0.1", "10.42.0.3"},
-		} {
-			assigned := []string{uplink}
-			if node != "laptop" {
-				assigned = append(assigned, "dnsmasq")
-			}
-			servers, content := resolvConfOn(t, node, uplink, assigned)
-			if strings.Join(servers, " ") != strings.Join(want, " ") {
-				t.Errorf("%s on %s lists %v; want %v\n%s", uplink, node, servers, want, content)
-			}
-			for _, public := range []string{"1.1.1.1", "8.8.8.8", "9.9.9.9"} {
-				if strings.Contains(content, public) {
-					t.Errorf("%s on %s lists a public resolver beside the mesh's (ADR 0223):\n%s", uplink, node, content)
-				}
-			}
-			if !strings.HasSuffix(content, "\noptions timeout:1 attempts:2 edns0\n") {
-				t.Errorf("%s on %s does not end with two short attempts:\n%s", uplink, node, content)
-			}
-		}
-	}
-}
-
-// One file, whichever manager the machine runs: the three modules carry the same template, so a
-// machine changing its manager changes nothing in what it asks, and a fix made to one is made to all.
-func TestEveryUplinkWritesTheSameResolverFile(t *testing.T) {
-	var first, firstOf string
-	for _, uplink := range uplinks {
-		fact, ok := catalogueManifest(t, uplink).Facts["resolvers"]
-		if !ok || fact.Path != "/etc/resolv.conf" || fact.Shared || fact.Home {
-			t.Fatalf("%s does not write the machine's resolver file whole: %+v", uplink, fact)
-		}
-		if first == "" {
-			first, firstOf = fact.Template, uplink
-			continue
-		}
-		if fact.Template != first {
-			t.Errorf("%s's resolver file differs from %s's; the three are kept identical", uplink, firstOf)
-		}
-	}
-}
-
-// The requirement stays with what writes the file (ADR 0223 part 1): a machine is refused when nothing
-// in the mesh resolves, rather than given a file listing nothing.
-func TestEveryUplinkRequiresTheMeshsResolver(t *testing.T) {
-	for _, uplink := range uplinks {
-		found := false
-		for _, r := range catalogueManifest(t, uplink).Requires {
-			found = found || r == "wildcard-resolution"
-		}
-		if !found {
-			t.Errorf("%s writes the resolver file and does not require wildcard-resolution", uplink)
-		}
-	}
-	_, err := Resolve(twoResolverShelf(t), []string{"networkmanager"}, managing("laptop"), World{})
-	if err == nil || !strings.Contains(err.Error(), "wildcard-resolution") {
-		t.Errorf("an uplink was composed on a mesh with no resolver: %v", err)
-	}
-}
-
-// A holder answers its own requirement, even though the other holder sorts first (issue 258 kept).
-func TestAHolderAnswersItsOwnRequirement(t *testing.T) {
-	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq", "networkmanager"},
-		managing("home"), worldWithout("home"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, n := range got.Needs {
-		if n.Name == "wildcard-resolution" && n.From != "home" {
-			t.Errorf("the home server's uplink is bound to %s; it holds the seat itself", n.From)
-		}
-	}
-}
-
-// A seat held once is still held once: a second claimant on another machine is refused while
-// nothing is on record, and a store recording two holders of it is refused, naming the seat.
-func TestASingleHolderMeshSeatStillRefusesASecondHolder(t *testing.T) {
-	store := shelf(mod("postgres", nil, nil, nil, Claim{Name: "mesh-store", Scope: ScopeMesh}))
-	other := Held{Claim: "mesh-store", Scope: ScopeMesh, Node: "anchor", Module: "postgres"}
-	if _, err := Resolve(store, []string{"postgres"}, workstation(), World{Held: []Held{other}}); err == nil ||
-		!strings.Contains(err.Error(), "one per mesh") {
-		t.Errorf("a second claimant of a seat held once was not refused: %v", err)
-	}
-	here := Held{Claim: "mesh-store", Scope: ScopeMesh, Node: workstation().Name, Module: "postgres"}
-	_, err := Resolve(store, []string{"postgres"}, workstation(),
-		World{Held: []Held{other}, Holdings: []Held{other, here}})
-	if err == nil || !strings.Contains(err.Error(), "on record as held by 2") {
-		t.Errorf("two holders on record for a seat held once were not refused: %v", err)
-	}
-}
-
-// Replicated is not "whoever is assigned": two claimants with nothing on record are refused, as for
-// any mesh seat, and each holder is added by an act.
-func TestTwoUnrecordedClaimantsOfTheReplicatedSeatAreRefused(t *testing.T) {
-	w := worldWithout("home")
-	w.Holdings = nil
-	_, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, Node{Name: "home", At: "home.internal"}, w)
-	if err == nil || !strings.Contains(err.Error(), "seat mesh-dns-resolver --to") {
-		t.Errorf("a second resolver with nothing on record was not refused, naming the handover: %v", err)
-	}
-}
-
-// Only the mesh's resolver is replicated: a seat being replicated is a decision, recorded.
-func TestOnlyTheResolverIsReplicated(t *testing.T) {
-	for _, s := range Seats() {
-		if s.Replicated != (s.Name == "mesh-dns-resolver") {
-			t.Errorf("%s replicated = %v; only mesh-dns-resolver is (ADR 0223)", s.Name, s.Replicated)
-		}
-	}
-	UseSeats([]Seat{{Name: "mesh-dns-resolver", Scope: ScopeMesh, Delivers: "wildcard-resolution"}})
-	defer UseSeats(DefaultSeats())
-	if s, _ := SeatNamed("mesh-dns-resolver"); !s.Replicated {
-		t.Error("loading the set from the store, which has no column for it, lost the resolver's replication")
-	}
-}
-
-// Every consumer is bound to the same holder whatever order the mesh resolved its machines in.
-func TestTheFirstHolderIsTheFirstProvider(t *testing.T) {
-	providers := []Provider{{Node: "anchor", Module: "dnsmasq"}, {Node: "home", Module: "dnsmasq"}}
-	for _, held := range [][]Held{bothResolvers, {bothResolvers[1], bothResolvers[0]}} {
-		if p, ok := HolderAmong("wildcard-resolution", providers, held); !ok || p.Node != "anchor" {
-			t.Errorf("held in order %v answered %v", held, p)
-		}
-	}
-}
-
-// One host record per machine, beside its wildcard (novox/hq issue 262): a name with a host record
-// says it exists and has no IPv6 address, where the wildcard alone said there is no such name, and
-// musl reads that as final.
-func TestTheResolverHasOneHostRecordPerMachine(t *testing.T) {
-	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, Node{Name: "anchor", At: "anchor.internal"},
-		World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := got.Declaration(Rendering{Names: resolverMachines, Machines: resolverMachines, Suffix: "internal",
-		Needed: map[string]map[string]string{"dnsmasq": {"broker": "sealed"}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	content, _ := byID(out)["dnsmasq.fact-node-zones"]["content"].(string)
-	records := map[string]int{}
-	for _, line := range strings.Split(content, "\n") {
-		if strings.HasPrefix(line, "host-record=") {
-			records[strings.TrimPrefix(line, "host-record=")]++
-		}
-	}
-	for name, at := range resolverMachines {
-		if records[name+","+at] != 1 {
-			t.Errorf("%s has %d host records at %s, and has one:\n%s", name, records[name+","+at], at, content)
-		}
-	}
-	if len(records) != len(resolverMachines) {
-		t.Errorf("%d host records for %d machines:\n%s", len(records), len(resolverMachines), content)
-	}
-}
diff --git a/internal/catalogue/unconsumed_placeholder_test.go b/internal/catalogue/unconsumed_placeholder_test.go
deleted file mode 100644
index c82df102..00000000
--- a/internal/catalogue/unconsumed_placeholder_test.go
+++ /dev/null
@@ -1,159 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq issue 231 — a misspelled placeholder is written out as text.
-//
-// The four placeholders of the issue, in one file: two misspelled namespaces, a setting key no
-// definition could declare, and the shell's own syntax. The first three are refused by name, at the
-// catalogue check and at composition; the fourth reaches the file as written.
-const (
-	misspelledShell   = "${shel:zsh:first}"
-	undeclaredSetting = "${setting:Undeclared}"
-	misspelledMachine = "${machnie:address}"
-	shellsOwn         = "${XDG_CACHE_HOME:-x}"
-	// The shell's operators after a word the mesh also uses, in any case: the shell's, and passed.
-	shellsOperators = "${PORT:-8080} ${SHELL:-/bin/sh} ${SECRET:?unset} ${dir:-/tmp}"
-)
-
-// The catalogue check — the strict parse registration runs too — refuses each by name, with the
-// module and the field it stands in, and says nothing about the shell's own syntax.
-func TestAMisspelledPlaceholderIsRefusedAtTheCheck(t *testing.T) {
-	raw := `{"module":"speller","version":"1","resources":[{"id":"rc","type":"file","path":"/etc/speller.rc",` +
-		`"content":"a=` + misspelledShell + `\nb=` + undeclaredSetting + `\nc=` + misspelledMachine +
-		`\nd=` + shellsOwn + `\n"}]}`
-	_, err := ParseManifest([]byte(raw))
-	if err == nil {
-		t.Fatal("a file holding three placeholders no pass consumes was accepted")
-	}
-	for _, token := range []string{misspelledShell, undeclaredSetting, misspelledMachine} {
-		if !strings.Contains(err.Error(), "speller's resource rc holds "+token+" in its content") {
-			t.Errorf("the refusal does not name %s with its module and field: %v", token, err)
-		}
-	}
-	if strings.Contains(err.Error(), "XDG_CACHE_HOME") {
-		t.Errorf("the shell's own syntax was refused: %v", err)
-	}
-
-	// A namespace the mesh knows, misspelt in any way its own pattern does not take, and the same
-	// namespace in a field its pass does not read: refused at the check as at composition.
-	for _, c := range []struct{ resource, token, field string }{
-		{`{"id":"rc","type":"file","path":"/etc/rc","content":"${Machine:address}"}`, "${Machine:address}", "content"},
-		{`{"id":"rc","type":"file","path":"/etc/rc","content":"${machine:.address}"}`, "${machine:.address}", "content"},
-		{`{"id":"rc","type":"file","path":"/etc/rc","content":"${machine: address}"}`, "${machine: address}", "content"},
-		{`{"id":"rc","type":"file","path":"/etc/rc","content":"${Dir:x}"}`, "${Dir:x}", "content"},
-		{`{"id":"rc","type":"file","path":"/etc/rc","content":"a=${machine:address\nb=1"}`, "${machine:address", "content"},
-		{`{"id":"rc","type":"process","name":"speller","env":{"NAME":"${machine:name}"}}`, "${machine:name}", "env.NAME"},
-	} {
-		raw := `{"module":"speller","version":"1","resources":[` + c.resource + `]}`
-		_, err := ParseManifest([]byte(raw))
-		if err == nil || !strings.Contains(err.Error(), "speller's resource rc holds "+c.token+" in its "+c.field) {
-			t.Errorf("%s in its %s was accepted at the check, or not named: %v", c.token, c.field, err)
-		}
-	}
-
-	// And the shell's syntax alone, beside placeholders every pass knows, is accepted — as is the
-	// shape a lower-case shell variable takes with an operator after its colon.
-	raw = `{"module":"speller","version":"1","resources":[{"id":"rc","type":"file","path":"${machine:account-home}/.rc",` +
-		`"content":"` + shellsOwn + ` ${(%):-%n} ${1:-.} ${count:-} ${trial:+ on trial} ${machine:address} ` +
-		shellsOperators + `\n"},` +
-		`{"id":"server","type":"container","name":"server","env":{"PORT":"${PORT:-80}"}}]}`
-	if _, err := ParseManifest([]byte(raw)); err != nil {
-		t.Fatalf("the shell's own syntax was refused: %v", err)
-	}
-}
-
-// Composition refuses the same placeholders in the same words — a manifest the store already holds
-// was never parsed by this binary — and a namespace the mesh knows, written in a field its pass does
-// not read, is refused there too, because it would reach the machine as the same literal text.
-func TestAMisspelledPlaceholderIsRefusedAtComposition(t *testing.T) {
-	for _, c := range []struct {
-		field string
-		r     map[string]any
-		token string
-	}{
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "a=" + misspelledShell + "\n"}, misspelledShell},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "b=" + undeclaredSetting + "\n"}, undeclaredSetting},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "c=" + misspelledMachine + "\n"}, misspelledMachine},
-		{"env.NAME", map[string]any{"id": "rc", "type": "process", "name": "speller", "env": map[string]any{"NAME": "${machine:name}"}}, "${machine:name}"},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${Machine:address}"}, "${Machine:address}"},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${machine:.address}"}, "${machine:.address}"},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${machine: address}"}, "${machine: address}"},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${Dir:x}"}, "${Dir:x}"},
-		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "a=${machine:address\nb=1"}, "${machine:address"},
-	} {
-		m := Manifest{Module: "speller", Version: "1", Resources: []map[string]any{c.r}}
-		r := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}
-		_, err := r.Declaration(Rendering{})
-		if err == nil || !strings.Contains(err.Error(), "speller's resource rc holds "+c.token+" in its "+c.field) {
-			t.Errorf("%s in its %s was composed rather than refused by name: %v", c.token, c.field, err)
-		}
-	}
-
-	m := Manifest{Module: "speller", Version: "1", Resources: []map[string]any{
-		{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "d=" + shellsOwn + " " + shellsOperators + "\n"},
-		{"id": "server", "type": "process", "name": "server", "env": map[string]any{"PORT": "${PORT:-80}"}},
-	}}
-	out, err := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("the shell's own syntax was refused: %v", err)
-	}
-	if got := contentOf(t, out, "speller.rc"); got != "d="+shellsOwn+" "+shellsOperators+"\n" {
-		t.Fatalf("the shell's own syntax did not pass through as written: %q", got)
-	}
-}
-
-// contentOf is the content of the composed resource with this id, failing when it was not composed.
-func contentOf(t *testing.T, out []map[string]any, id string) string {
-	t.Helper()
-	for _, res := range out {
-		if res["id"] == id {
-			return plainly(res["content"])
-		}
-	}
-	t.Fatalf("%s was not composed: %v", id, out)
-	return ""
-}
-
-// What a value puts into a file is its software's text, not the definition's, and is never swept
-// (review of mesh-controller #211): an operator's setting holding `${labels:instance}` filled through
-// ${setting:…}, and a JSON setting `${level:upper}` merged into a mergeable file, reach the machine as
-// set — software that templates its own configuration (Log4j's `${env:…}`, Spring's `${timeout:30}`)
-// is configured exactly this way.
-func TestAValueHoldingAPlaceholderShapeComposesUnchanged(t *testing.T) {
-	m := Manifest{Module: "templater", Version: "1", Resources: []map[string]any{
-		{"id": "conf", "type": "file", "path": "/etc/templater.conf", "content": "template=${setting:template}\n"},
-		{"id": "json", "type": "file", "path": "/etc/templater.json", "merge": MergeJSON, "content": `{"fmt":"plain"}`},
-	}}
-	settings := SettingsBy{"templater": {{From: "the operator", Values: map[string]any{
-		"template": "${labels:instance}", "fmt": "${level:upper}",
-	}}}}
-	out, err := Resolution{Node: "workstation", Account: "op", Modules: []Manifest{m}}.Declaration(Rendering{Settings: settings})
-	if err != nil {
-		t.Fatalf("a value holding a placeholder's shape was refused as the definition's: %v", err)
-	}
-	if got := contentOf(t, out, "templater.conf"); got != "template=${labels:instance}\n" {
-		t.Errorf("the setting did not reach the file as set: %q", got)
-	}
-	if got := contentOf(t, out, "templater.json"); !strings.Contains(got, `${level:upper}`) {
-		t.Errorf("the merged setting did not reach the file as set: %q", got)
-	}
-}
-
-// Contributed shell code is the shell's, and no pass reads it (novox/hq ADR 0204): zsh's own
-// `${path:t}` is namespace-shaped, and reaches the holder's file untouched.
-func TestContributedShellCodeIsNotSwept(t *testing.T) {
-	modules := []Manifest{zshHolder(), {Module: "modifier", Shell: []ShellCode{
-		{For: "zsh", Slot: "normal", Code: "echo ${path:t} ${shel:zsh:first}"},
-	}}}
-	out, err := Resolution{Node: "workstation", Account: "op", Modules: modules}.Declaration(Rendering{})
-	if err != nil {
-		t.Fatalf("contributed shell code was swept: %v", err)
-	}
-	if got := contentOf(t, out, "zsh.zshrc"); !strings.Contains(got, "echo ${path:t} ${shel:zsh:first}") {
-		t.Fatalf("the contributed code did not reach the holder's file as written: %q", got)
-	}
-}
diff --git a/internal/catalogue/unhealthy_test.go b/internal/catalogue/unhealthy_test.go
deleted file mode 100644
index c6c9b888..00000000
--- a/internal/catalogue/unhealthy_test.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A module may declare its unhealthy urgent, with why; the module check refuses it without why and with any
-// severity but urgent or warning (novox/hq ADR 0355).
-
-func TestAnUnhealthyDeclaredUrgentIsUrgent(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"mail","version":"1",` +
-		`"unhealthy":{"severity":"urgent","why":"mail is refused or stuck for everyone with a mailbox"}}`))
-	if err != nil {
-		t.Fatalf("a manifest declaring its unhealthy urgent with why was refused: %v", err)
-	}
-	if !m.UnhealthyIsUrgent() {
-		t.Errorf("a manifest declaring its unhealthy urgent reads as not urgent: %+v", m.Unhealthy)
-	}
-}
-
-func TestAManifestWithoutUnhealthyIsNotUrgent(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"notes","version":"1"}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if m.UnhealthyIsUrgent() {
-		t.Errorf("a manifest saying nothing of its unhealthy reads as urgent")
-	}
-	warning := Manifest{Module: "notes", Unhealthy: &UnhealthyPolicy{Severity: UnhealthyWarning, Why: "notes wait"}}
-	if warning.UnhealthyIsUrgent() || len(warning.unhealthyProblems()) != 0 {
-		t.Errorf("a warning said with why reads as urgent or is refused: %v", warning.unhealthyProblems())
-	}
-}
-
-func TestAnUnhealthyWithoutWhyIsRefused(t *testing.T) {
-	for _, why := range []string{"", "   "} {
-		if problems := (Manifest{Module: "mail", Unhealthy: &UnhealthyPolicy{Severity: UnhealthyUrgent, Why: why}}).unhealthyProblems(); len(problems) == 0 {
-			t.Errorf("urgent with why %q was accepted", why)
-		}
-	}
-	if _, err := ParseManifest([]byte(`{"module":"mail","version":"1","unhealthy":{"severity":"urgent"}}`)); err == nil ||
-		!strings.Contains(err.Error(), "unhealthy says why") {
-		t.Errorf("a manifest declaring its unhealthy urgent without why parsed: %v", err)
-	}
-}
-
-func TestAnUnhealthySeverityOtherThanUrgentOrWarningIsRefused(t *testing.T) {
-	if _, err := ParseManifest([]byte(`{"module":"mail","version":"1","unhealthy":{"severity":"loud","why":"mail stops"}}`)); err == nil ||
-		!strings.Contains(err.Error(), `not "loud"`) {
-		t.Errorf("a manifest declaring its unhealthy loud parsed: %v", err)
-	}
-}
diff --git a/internal/catalogue/upgrade_test.go b/internal/catalogue/upgrade_test.go
deleted file mode 100644
index 6e41a73b..00000000
--- a/internal/catalogue/upgrade_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A module rolls out by default; it records where it says so with why, where it keeps irreplaceable
-// data, and always where it is the bus (novox/hq ADR 0236).
-func TestWhereAModulesUpgradePolicyComesFrom(t *testing.T) {
-	cases := []struct {
-		name         string
-		m            Manifest
-		policy, from string
-	}{
-		{"default", Manifest{Module: "app"}, PolicyRoll, FromDefault},
-		{"says record", Manifest{Module: "db", Upgrade: &UpgradePolicy{Policy: PolicyRecord, Why: "a restart costs"}},
-			PolicyRecord, FromModule},
-		{"says together", Manifest{Module: "dns", Upgrade: &UpgradePolicy{Policy: PolicyTogether, Why: "one zone"}},
-			PolicyTogether, FromModule},
-		{"irreplaceable data", Manifest{Module: "media", Data: &Data{Own: []DataItem{{ID: "library", Class: ClassIrreplaceable}}}},
-			PolicyRecord, FromData},
-		{"valuable data rolls", Manifest{Module: "notes", Data: &Data{Own: []DataItem{{ID: "db", Class: ClassValuable}}}},
-			PolicyRoll, FromDefault},
-		{"irreplaceable but says roll", Manifest{Module: "photos", Upgrade: &UpgradePolicy{Policy: PolicyRoll},
-			Data: &Data{Own: []DataItem{{ID: "originals", Class: ClassIrreplaceable}}}}, PolicyRoll, FromModule},
-		{"the bus, whatever it says", Manifest{Module: "nats", Provides: []Offer{{Name: "mesh-bus"}},
-			Upgrade: &UpgradePolicy{Policy: PolicyRoll}}, PolicyRecord, FromBus},
-	}
-	for _, c := range cases {
-		policy, from, _ := DerivedUpgrade(c.m)
-		if policy != c.policy || from != c.from {
-			t.Errorf("%s: %s from %s, want %s from %s", c.name, policy, from, c.policy, c.from)
-		}
-	}
-}
-
-// A policy other than roll says why, and an unknown one is refused.
-func TestAnUpgradePolicySaysWhy(t *testing.T) {
-	for _, u := range []UpgradePolicy{{Policy: PolicyRecord}, {Policy: PolicyTogether}, {Policy: "sometimes", Why: "x"}} {
-		if problems := (Manifest{Module: "m", Upgrade: &u}).upgradeProblems(); len(problems) == 0 {
-			t.Errorf("%+v was accepted", u)
-		}
-	}
-	if problems := (Manifest{Module: "m", Upgrade: &UpgradePolicy{Policy: PolicyRecord, Why: "a restart costs"}}).upgradeProblems(); len(problems) != 0 {
-		t.Errorf("a record with why was refused: %v", problems)
-	}
-	if _, err := ParseManifest([]byte(`{"module":"m","upgrade":{"policy":"record"}}`)); err == nil ||
-		!strings.Contains(err.Error(), "says why") {
-		t.Errorf("a manifest recording without why parsed: %v", err)
-	}
-}
diff --git a/internal/catalogue/uplink_verbs_test.go b/internal/catalogue/uplink_verbs_test.go
deleted file mode 100644
index b2f6caf7..00000000
--- a/internal/catalogue/uplink_verbs_test.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package catalogue
-
-import (
-	"slices"
-	"strings"
-	"testing"
-)
-
-// The node-uplink seat's verbs (novox/hq ADR 0241): promised and routed, optional — not yet a condition of
-// holding — so the holders of today still hold it, a holder may name them, and nothing it does not promise;
-// and still optional once the store's row is read back (optionalAsCompiled).
-
-func uplinkSeat(t *testing.T) Seat {
-	t.Helper()
-	for _, s := range Seats() {
-		if s.Name == "node-uplink" {
-			return s
-		}
-	}
-	t.Fatal("no node-uplink seat")
-	return Seat{}
-}
-
-func TestTheUplinkSeatPromisesItsVerbsAndRequiresNoneYet(t *testing.T) {
-	seat := uplinkSeat(t)
-	var names []string
-	for _, v := range seat.Serves {
-		names = append(names, v.Name)
-		if !v.Optional {
-			t.Errorf("%s is required already", v.Name)
-		}
-	}
-	if !slices.Equal(names, []string{"resolvers", "links"}) {
-		t.Fatalf("node-uplink promises %v", names)
-	}
-	// The resolver file is the seat's path (novox/hq ADR 0287), which every holder of today renders.
-	today := Manifest{Module: "networkmanager", Version: "1", Claims: []Claim{{Name: "node-uplink", Scope: ScopeNode}},
-		Facts: map[string]RosterFile{"resolvers": {Path: ResolverFile, Template: "x"}}}
-	if err := CanHold(today, seat); err != nil {
-		t.Fatalf("a holder that serves no verb yet is refused: %v", err)
-	}
-	serving := today
-	serving.Claims = []Claim{{Name: "node-uplink", Scope: ScopeNode, Serves: []string{"resolvers", "links"}}}
-	if err := CanHold(serving, seat); err != nil {
-		t.Fatalf("a holder serving both is refused: %v", err)
-	}
-	typo := today
-	typo.Claims = []Claim{{Name: "node-uplink", Scope: ScopeNode, Serves: []string{"resolver"}}}
-	if err := CanHold(typo, seat); err == nil || !strings.Contains(err.Error(), "does not promise") {
-		t.Fatalf("a verb the seat does not promise was accepted: %v", err)
-	}
-}
-
-func TestTheUplinkVerbsReadBackFromTheRowStayOptional(t *testing.T) {
-	before := seats
-	t.Cleanup(func() { seats = before })
-	// The row as seeding stores it: both verbs, the mark not a column.
-	UseSeats([]Seat{{Name: "node-uplink", Scope: ScopeNode, Serves: []Verb{{Name: "resolvers"}, {Name: "links"}}}})
-	seat := uplinkSeat(t)
-	holder := Manifest{Module: "systemd-networkd", Version: "1", Claims: []Claim{{Name: "node-uplink", Scope: ScopeNode}},
-		Facts: map[string]RosterFile{"resolvers": {Path: ResolverFile, Template: "x"}}}
-	if err := CanHold(holder, seat); err != nil {
-		t.Fatalf("read back from the row, the verbs are required: %v", err)
-	}
-}
diff --git a/internal/catalogue/upstream_file_test.go b/internal/catalogue/upstream_file_test.go
deleted file mode 100644
index ca3016df..00000000
--- a/internal/catalogue/upstream_file_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// An archive pinned by URL and sha256 (novox/hq ADR 0316 §2, §6): the vendor's file, mirrored by the build
-// seat, never a copy in the repository.
-
-const pinnedSum = "38dd24890a66b4cf9a45bc24e15192e00c26b929e1bb8df7974c16a4539129e2"
-
-func upstreamManifest(artifact string) string {
-	return `{"module":"a","version":"1","build":{"artifacts":[` + artifact + `]}}`
-}
-
-func TestAnArchivePinnedByURLAndSha256IsAccepted(t *testing.T) {
-	for _, a := range []string{
-		`{"name":"archive","kind":"archive","url":"https://vendor.example.org/release-1.tar.xz","sha256":"` + pinnedSum +
-			`","version":"1.0","within":"release"}`,
-		`{"name":"addon","kind":"archive","url":"https://vendor.example.org/addon.xpi","sha256":"` + pinnedSum +
-			`","version":"1.5.6.1","file":"addon.xpi"}`,
-	} {
-		if _, err := ParseManifest([]byte(upstreamManifest(a))); err != nil {
-			t.Errorf("%s was refused: %v", a, err)
-		}
-	}
-}
-
-func TestAnUpstreamFileThatIsNotPinnedIsRefused(t *testing.T) {
-	cases := map[string]string{
-		// No digest: what the address serves changes under the mesh.
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/r.tar.xz","version":"1"}`:                "without a pinned sha256",
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/r.tar.xz","sha256":"ABC","version":"1"}`: "without a pinned sha256",
-		// No version: a person reading the pin cannot tell which release.
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum + `"}`: "says no version",
-		// Not https.
-		`{"name":"x","kind":"archive","url":"http://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum + `","version":"1"}`: "over https",
-		// Both a directory of the repository and a URL.
-		`{"name":"x","kind":"archive","from":"files","url":"https://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum +
-			`","version":"1"}`: "one or the other",
-		// A pin without a URL.
-		`{"name":"x","kind":"archive","from":"files","sha256":"` + pinnedSum + `"}`: "no url",
-		// Only an archive is mirrored from a file.
-		`{"name":"x","kind":"image","from":"Dockerfile","url":"https://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum +
-			`","version":"1"}`: "only an archive",
-		// A file name that is a path, a directory within that leaves the archive, and both at once.
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/a.xpi","sha256":"` + pinnedSum +
-			`","version":"1","file":"../a.xpi"}`: "not a plain relative file name",
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum +
-			`","version":"1","within":"../up"}`: "not a plain relative directory",
-		`{"name":"x","kind":"archive","url":"https://vendor.invalid/r.tar.xz","sha256":"` + pinnedSum +
-			`","version":"1","within":"r","file":"r.tar.xz"}`: "a file is kept whole",
-	}
-	for artifact, want := range cases {
-		_, err := ParseManifest([]byte(upstreamManifest(artifact)))
-		if err == nil {
-			t.Errorf("%s was accepted", artifact)
-			continue
-		}
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("%s was refused for another reason than %q: %v", artifact, want, err)
-		}
-	}
-}
-
-func TestAnUpstreamFilesVendorIsNamedOnPurposeAndAnInstallationsIsRefused(t *testing.T) {
-	// The vendor's host is judged like any name, and passes through names-on-purpose; a version of four dotted
-	// numbers is not an address, and a name in it is still judged.
-	m, err := ParseManifest([]byte(upstreamManifest(`{"name":"owl","kind":"archive","url":"https://vendor.be/owl/owl.xpi","sha256":"` +
-		pinnedSum + `","version":"1.5.6.1","file":"owl.xpi","names-on-purpose":{"vendor.be":"Owl's vendor publishes it there"}}`)))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if problems := InstallationProblems(m); len(problems) != 0 {
-		t.Fatalf("the declared vendor and the version were taken for an installation: %v", problems)
-	}
-	m.Build.Artifacts[0].NamesOnPurpose = nil
-	if problems := InstallationProblems(m); len(problems) != 1 || !strings.Contains(problems[0], "vendor.be") {
-		t.Fatalf("an undeclared vendor host is judged: %v", problems)
-	}
-	m.Build.Artifacts[0].Version = "git.novox.be 10.0.0.1"
-	if problems := InstallationProblems(m); len(problems) != 2 {
-		t.Fatalf("a name in the version is judged: %v", problems)
-	}
-	m.Build.Artifacts[0].URL, m.Build.Artifacts[0].Version = "https://mail.novox.be/owl.xpi", "1"
-	if problems := InstallationProblems(m); len(problems) != 1 || !strings.Contains(problems[0], "mail.novox.be") {
-		t.Fatalf("an installation's host in the url is judged: %v", problems)
-	}
-}
-
-func TestAnUpstreamFileFromAnAddressOrAReservedNameIsRefused(t *testing.T) {
-	for _, u := range []string{"https://git.novox.internal/r.tar.xz", "https://10.1.2.3/r.tar.xz",
-		"https://203.0.113.9/r.tar.xz", "https://[2001:db8::1]/r.tar.xz", "https://nas.lan/r.tar.xz", "https://vendor/r.tar.xz"} {
-		_, err := ParseManifest([]byte(upstreamManifest(`{"name":"x","kind":"archive","url":"` + u + `","sha256":"` +
-			pinnedSum + `","version":"1"}`)))
-		if err == nil || !strings.Contains(err.Error(), "published under a public name") {
-			t.Errorf("%s: %v", u, err)
-		}
-	}
-}
diff --git a/internal/catalogue/vault_seat_test.go b/internal/catalogue/vault_seat_test.go
deleted file mode 100644
index ed7c3c1d..00000000
--- a/internal/catalogue/vault_seat_test.go
+++ /dev/null
@@ -1,171 +0,0 @@
-package catalogue
-
-import "testing"
-
-// The vault's provision is one the controller itself dereferences — every minted credential is
-// sealed with it — so it is delivered by a seat of the mesh's own, and a second provider is a second
-// claimant refused by name rather than a candidate for a pin (novox/hq ADR 0161, issue 106).
-func TestTheVaultsSeatDeliversSecret(t *testing.T) {
-	seat, known := SeatNamed("mesh-vault")
-	if !known {
-		t.Fatal("mesh-vault is not in the mesh's own set")
-	}
-	if seat.Scope != ScopeMesh || seat.Delivers != "secret" {
-		t.Fatalf("mesh-vault is %s-scoped and delivers %q; one per mesh, delivering secret", seat.Scope, seat.Delivers)
-	}
-	vault := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh}}}
-	if err := CanHold(vault, seat); err != nil {
-		t.Fatalf("the vault, claiming its seat and providing secret, was refused: %v", err)
-	}
-	another := Manifest{Module: "other-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}}}
-	if err := CanHold(another, seat); err == nil {
-		t.Fatal("a provider of secret that does not claim the seat was allowed to hold it")
-	}
-}
-
-// The vault answers `get` on request and reply (novox/hq ADR 0349 §11, issue 674): the seat promises the
-// verb, so a holder serving it is accepted — and, optional while the vault that runs is the TypeScript one,
-// so is a holder that does not yet.
-func TestTheVaultsSeatPromisesGet(t *testing.T) {
-	seat, _ := SeatNamed("mesh-vault")
-	var get *Verb
-	for i := range seat.Serves {
-		if seat.Serves[i].Name == "get" {
-			get = &seat.Serves[i]
-		}
-	}
-	if get == nil {
-		t.Fatal("the vault's seat does not promise get")
-	}
-	for _, arg := range []string{"name", "public_key"} {
-		if props, _ := get.Input["properties"].(map[string]any); props[arg] == nil {
-			t.Errorf("get takes no %s", arg)
-		}
-	}
-	serving := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh, Serves: []string{"get"}}}}
-	if err := CanHold(serving, seat); err != nil {
-		t.Fatalf("the vault serving get was refused: %v", err)
-	}
-	notYet := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh}}}
-	if err := CanHold(notYet, seat); err != nil {
-		t.Fatalf("the vault that does not serve get yet was refused: %v", err)
-	}
-}
-
-// The vault takes values in and rotates them (novox/hq ADR 0349 clauses 8 to 10, issue 675): the seat promises
-// accept, secret-ask, issued and rotate, each with the arguments of its steps; a holder serving them is accepted,
-// and, optional while the vault that runs does not, so is one that does not yet.
-func TestTheVaultsSeatPromisesItsIntakeVerbs(t *testing.T) {
-	seat, _ := SeatNamed("mesh-vault")
-	want := map[string][]string{
-		"accept":     {"node", "module", "name", "provider", "provision", "by", "call", "sealed"},
-		"secret-ask": {"node", "module", "name", "desk", "asked_by", "outcome", "call", "sealed"},
-		"issued":     {"provision", "provider", "module", "call", "sealed", "holders"},
-		"rotate":     {"node", "module", "name", "provider", "provision", "by"},
-	}
-	for name, args := range want {
-		var verb *Verb
-		for i := range seat.Serves {
-			if seat.Serves[i].Name == name {
-				verb = &seat.Serves[i]
-			}
-		}
-		if verb == nil {
-			t.Errorf("the vault's seat does not promise %s", name)
-			continue
-		}
-		if !verb.Optional {
-			t.Errorf("%s is not optional while the vault that runs does not serve it", name)
-		}
-		props, _ := verb.Input["properties"].(map[string]any)
-		for _, arg := range args {
-			if props[arg] == nil {
-				t.Errorf("%s takes no %s", name, arg)
-			}
-		}
-		if props["value"] != nil {
-			t.Errorf("%s takes a value in the clear", name)
-		}
-	}
-	// The holders `issued` names (issue 749) are a list of {node, module}.
-	for _, verb := range seat.Serves {
-		if verb.Name != "issued" {
-			continue
-		}
-		props, _ := verb.Input["properties"].(map[string]any)
-		holders, _ := props["holders"].(map[string]any)
-		items, _ := holders["items"].(map[string]any)
-		each, _ := items["properties"].(map[string]any)
-		if holders["type"] != "array" || each["node"] == nil || each["module"] == nil {
-			t.Errorf("issued's holders are %v", holders)
-		}
-	}
-	serving := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh,
-			Serves: []string{"get", "accept", "secret-ask", "issued", "rotate"}}}}
-	if err := CanHold(serving, seat); err != nil {
-		t.Fatalf("the vault serving its verbs was refused: %v", err)
-	}
-}
-
-// The move of the controller's secrets into the vault (design 57's V3, issue 676): the seat promises move-in, which a
-// machine's node-engine asks in two steps with the row, its origin and generation, then the value sealed to the
-// call's key and a key to read back to; and move-asks, the controller's record of asks copied as it is. Optional
-// while the vault that runs does not serve them; never a value in the clear.
-func TestTheVaultsSeatPromisesTheMove(t *testing.T) {
-	seat, _ := SeatNamed("mesh-vault")
-	want := map[string][]string{
-		"move-in": {"node", "module", "name", "provider", "provision", "consumer", "consumer_module", "local", "origin",
-			"generation", "made_at", "call", "sealed", "read_back_to"},
-		"move-asks": {"asks"},
-	}
-	for name, args := range want {
-		var verb *Verb
-		for i := range seat.Serves {
-			if seat.Serves[i].Name == name {
-				verb = &seat.Serves[i]
-			}
-		}
-		if verb == nil {
-			t.Errorf("the vault's seat does not promise %s", name)
-			continue
-		}
-		if !verb.Optional {
-			t.Errorf("%s is not optional while the vault that runs does not serve it", name)
-		}
-		props, _ := verb.Input["properties"].(map[string]any)
-		for _, arg := range args {
-			if props[arg] == nil {
-				t.Errorf("%s takes no %s", name, arg)
-			}
-		}
-		if props["value"] != nil {
-			t.Errorf("%s takes a value in the clear", name)
-		}
-	}
-	serving := Manifest{Module: "mesh-vault", Provides: []Offer{{Name: "secret", Scope: ScopeMesh}},
-		Claims: []Claim{{Name: "mesh-vault", Scope: ScopeMesh,
-			Serves: []string{"get", "accept", "secret-ask", "issued", "rotate", "move-in", "move-asks"}}}}
-	if err := CanHold(serving, seat); err != nil {
-		t.Fatalf("the vault serving the move was refused: %v", err)
-	}
-}
-
-// Issue 786: the vault's seat promises node-key, optional while the vault that runs does not serve it.
-func TestTheVaultsSeatPromisesNodeKey(t *testing.T) {
-	seat, _ := SeatNamed("mesh-vault")
-	for _, v := range seat.Serves {
-		if v.Name != "node-key" {
-			continue
-		}
-		props, _ := v.Input["properties"].(map[string]any)
-		if !v.Optional || props["key"] == nil {
-			t.Errorf("node-key: optional %v, key %v", v.Optional, props["key"])
-		}
-		return
-	}
-	t.Error("the vault's seat does not promise node-key")
-}
diff --git a/internal/catalogue/verbs_test.go b/internal/catalogue/verbs_test.go
deleted file mode 100644
index cda55cad..00000000
--- a/internal/catalogue/verbs_test.go
+++ /dev/null
@@ -1,72 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A served verb is written as a bare name or in full, and both read into one type (novox/hq ADR 0132).
-func TestAServedVerbIsANameOrADefinition(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"till","version":"1","tools":["price","refund"],` +
-		`"seats":[{"name":"shop-till","serves":["price",{"name":"refund","description":"give it back",` +
-		`"input":{"type":"object","properties":{"order":{"type":"string"}}}}]}],` +
-		`"claims":[{"name":"shop-till","scope":"mesh"}]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	got := m.DefinesSeats[0].Serves
-	if len(got) != 2 || got[0].Name != "price" || got[1].Name != "refund" || got[1].Description != "give it back" {
-		t.Fatalf("verbs not read: %+v", got)
-	}
-	if got[1].Input["type"] != "object" {
-		t.Fatalf("the schema did not travel with the verb: %+v", got[1].Input)
-	}
-}
-
-// A misspelt key inside a verb's definition is refused, like one anywhere else in the manifest.
-func TestAVerbWithAnUnknownKeyIsRefused(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"till","version":"1",` +
-		`"seats":[{"name":"shop-till","serves":[{"name":"price","descripton":"typo"}]}]}`))
-	if err == nil || !strings.Contains(err.Error(), "descripton") {
-		t.Fatalf("a verb with a misspelt key was accepted: %v", err)
-	}
-}
-
-// Holding a mesh seat that serves verbs requires serving them, and the refusal names the verbs.
-func TestHoldingAMeshSeatRequiresServingItsVerbs(t *testing.T) {
-	was := Seats()
-	t.Cleanup(func() { UseSeats(was) })
-	UseSeats([]Seat{{Name: "mesh-controller", Scope: ScopeMesh, Decision: "test",
-		Serves: []Verb{{Name: "status"}, {Name: "push"}}}})
-	seat, _ := SeatNamed("mesh-controller")
-
-	partial := Manifest{Module: "a-controller", Tools: []string{"status"},
-		Claims: []Claim{{Name: "mesh-controller", Scope: ScopeMesh}}}
-	err := CanHold(partial, seat)
-	if err == nil || !strings.Contains(err.Error(), "does not serve push") {
-		t.Fatalf("a holder missing a verb was not refused by name: %v", err)
-	}
-	whole := Manifest{Module: "a-controller", Tools: []string{"status", "push"},
-		Claims: []Claim{{Name: "mesh-controller", Scope: ScopeMesh}}}
-	if err := CanHold(whole, seat); err != nil {
-		t.Fatalf("a holder serving every verb was refused: %v", err)
-	}
-}
-
-// The mesh's own verbs are declared in full: an agent cannot call a name without a schema.
-func TestEveryControllerVerbIsDescribedWithASchema(t *testing.T) {
-	seen := map[string]bool{}
-	for _, v := range ControllerVerbs {
-		if v.Description == "" || v.Input == nil || v.Input["type"] != "object" {
-			t.Errorf("%s: no description or no object schema", v.Name)
-		}
-		if seen[v.Name] {
-			t.Errorf("%s declared twice", v.Name)
-		}
-		seen[v.Name] = true
-	}
-	seat, _ := SeatNamed(ControllerSeatName)
-	if len(seat.Serves) != len(ControllerVerbs) {
-		t.Fatalf("the compiled mesh-controller seat serves %d verbs, the table has %d", len(seat.Serves), len(ControllerVerbs))
-	}
-}
diff --git a/internal/catalogue/version_in_a_path_test.go b/internal/catalogue/version_in_a_path_test.go
deleted file mode 100644
index 2c2e4d44..00000000
--- a/internal/catalogue/version_in_a_path_test.go
+++ /dev/null
@@ -1,122 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A component is unpacked into a directory named for its version, so it can read its own version from
-// its path (novox/hq ADR 0141, 0142). Until this, nothing could compose that path: an archive named a
-// fixed one and nothing interpolated the build into it, so nothing could ask for
-// `…/versions/<version>/` and every machine took a hand-placed fallback (04-ISSUES/142).
-
-const aDigest = "sha256:ad62528c47c7b4a71cf814473f5de52a061348ce9521f707b0171a10fa6b247f"
-
-func TestAnArchivePathCanNameTheBuildsOwnVersion(t *testing.T) {
-	m := Manifest{
-		Module: "mesh-host",
-		Build:  &Build{Artifacts: []Artifact{{Name: "host-arch", Kind: ArtifactBundle, Language: "go", System: "arch"}}},
-		Resources: []map[string]any{{
-			"id": "next", "type": "archive", "artifact": "host-arch",
-			"path": "/usr/lib/nox-mesh-host/versions/${version}",
-		}},
-	}
-	got, err := m.Resolve([]Built{{Name: "host-arch", Kind: ArtifactBundle,
-		Reference: "artifact-store://mesh-host/host-arch", Digest: aDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	path, _ := got.Resources[0]["path"].(string)
-	if strings.Contains(path, "${version}") {
-		t.Fatalf("the version was not resolved: %q", path)
-	}
-	if path != "/usr/lib/nox-mesh-host/versions/ad62528c47c7" {
-		t.Fatalf("the path resolved to %q", path)
-	}
-	// The artifact key goes, as it does for every resolved resource: it is a build-time word and the
-	// host has never heard of it.
-	if _, still := got.Resources[0]["artifact"]; still {
-		t.Fatal("the artifact key survived resolution")
-	}
-}
-
-func TestTheVersionIsTheDigestSoAnUnchangedBuildKeepsItsPath(t *testing.T) {
-	// The alternative is the commit, and two builds of one commit are meant to be the same bytes —
-	// every toolchain here is -trimpath for that reason. A commit-named path would move for an
-	// identical binary and recreate everything reading it.
-	first := versionOf(aDigest)
-	again := versionOf(aDigest)
-	if first != again || first == "" {
-		t.Fatalf("the same bytes produced %q and %q", first, again)
-	}
-	if other := versionOf("sha256:" + strings.Repeat("b", 64)); other == first {
-		t.Fatal("different bytes produced the same version")
-	}
-	// A path is read by people and quoted by shells.
-	if strings.ContainsAny(first, ":/ ") {
-		t.Fatalf("the version is not safe in a path: %q", first)
-	}
-}
-
-func TestAnImageIsRefusedAVersionedPlace(t *testing.T) {
-	// An image is not unpacked, so it has no directory to be named for its version. Left as literal
-	// text it would reach a machine and be created as a directory called ${version}.
-	m := Manifest{
-		Module: "something",
-		Build:  &Build{Artifacts: []Artifact{{Name: "server", Kind: ArtifactImage, From: "Dockerfile"}}},
-		Resources: []map[string]any{{
-			"id": "where", "type": "directory", "artifact": "server",
-			"path": "/var/lib/something/${version}",
-		}},
-	}
-	_, err := m.Resolve([]Built{{Name: "server", Kind: ArtifactImage, Reference: "registry/x@" + aDigest}})
-	if err == nil {
-		t.Fatal("an image was given a versioned place")
-	}
-	if !strings.Contains(err.Error(), "not unpacked") {
-		t.Fatalf("the refusal does not say why: %v", err)
-	}
-}
-
-func TestAResourceWithoutAVersionReferenceIsUntouched(t *testing.T) {
-	m := Manifest{
-		Module: "mesh-host",
-		Build:  &Build{Artifacts: []Artifact{{Name: "host-arch", Kind: ArtifactBundle, Language: "go", System: "arch"}}},
-		Resources: []map[string]any{{
-			"id": "next", "type": "archive", "artifact": "host-arch", "path": "/usr/lib/fixed",
-		}},
-	}
-	got, err := m.Resolve([]Built{{Name: "host-arch", Kind: ArtifactBundle,
-		Reference: "artifact-store://mesh-host/host-arch", Digest: aDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if path, _ := got.Resources[0]["path"].(string); path != "/usr/lib/fixed" {
-		t.Fatalf("a path naming no version became %q", path)
-	}
-}
-
-// A process's env can name the build's own version too (novox/hq issue 352): the controller is told which
-// build it is, and records what that build reads of the store's schema under it.
-func TestAProcessEnvCanNameTheBuildsOwnVersion(t *testing.T) {
-	m := Manifest{
-		Module: "mesh-controller",
-		Build:  &Build{Artifacts: []Artifact{{Name: "controller", Kind: ArtifactBundle, Language: "go", System: "arch"}}},
-		Resources: []map[string]any{{
-			"id": "controller", "type": "process", "artifact": "controller", "run": []any{"./mesh-controller", "serve"},
-			"env": map[string]any{"MESH_CONTROLLER_VERSION": "${version}", "OTHER": "kept"},
-		}},
-	}
-	got, err := m.Resolve([]Built{{Name: "controller", Kind: ArtifactBundle,
-		Reference: "artifact-store://mesh-controller/controller", Digest: aDigest}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	env, _ := got.Resources[0]["env"].(map[string]any)
-	if env["MESH_CONTROLLER_VERSION"] != "ad62528c47c7" || env["OTHER"] != "kept" {
-		t.Fatalf("the env resolved to %v", env)
-	}
-	if run, _ := got.Resources[0]["run"].([]any); len(run) != 2 {
-		t.Fatalf("the run was changed: %v", run)
-	}
-}
diff --git a/internal/catalogue/waits_test.go b/internal/catalogue/waits_test.go
deleted file mode 100644
index adf2080f..00000000
--- a/internal/catalogue/waits_test.go
+++ /dev/null
@@ -1,43 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// novox/hq ADR 0367 §2: the tool runner's module names, one by one, the event families a session may wait on.
-func TestTheToolRunnerMayNameTheEventsASessionWaitsOn(t *testing.T) {
-	m, err := ParseManifest([]byte(`{"module":"node-tools","version":"1",` +
-		`"waits":["mesh-knowledge.reviewed","operator-channel.decided.claude-code"]}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(m.Waits) != 2 || m.Waits[1] != "operator-channel.decided.claude-code" {
-		t.Fatalf("waits not read: %v", m.Waits)
-	}
-}
-
-// A family is named one by one, never by a wildcard, and only by the tool runner's module (ADR 0367 §2, §6):
-// each refusal is said in the manifest's words, at parse, rather than at the composition of the bus's users.
-func TestAWaitIsRefusedUnlessItNamesOneFamilyOfTheToolRunner(t *testing.T) {
-	for manifest, want := range map[string]string{
-		`{"module":"shop","version":"1","waits":["mesh-knowledge.reviewed"]}`:         "only node-tools",
-		`{"module":"node-tools","version":"1","waits":["mesh-knowledge.*"]}`:          "never a wildcard",
-		`{"module":"node-tools","version":"1","waits":["**"]}`:                        "never a wildcard",
-		`{"module":"node-tools","version":"1","waits":["mesh-knowledge.>"]}`:          "never a wildcard",
-		`{"module":"node-tools","version":"1","waits":["*.reviewed"]}`:                "never a wildcard",
-		`{"module":"node-tools","version":"1","waits":["reviewed"]}`:                  "does not name an emitter and an event",
-		`{"module":"node-tools","version":"1","waits":["mesh-knowledge..reviewed"]}`:  "does not name an emitter and an event",
-		`{"module":"node-tools","version":"1","waits":["Mesh-Knowledge.reviewed x"]}`: "does not name an emitter and an event",
-		`{"module":"node-tools","version":"1","waits":["a.b","a.b"]}`:                 "twice",
-	} {
-		_, err := ParseManifest([]byte(manifest))
-		if err == nil {
-			t.Errorf("accepted: %s", manifest)
-			continue
-		}
-		if !strings.Contains(err.Error(), want) {
-			t.Errorf("%s refused for the wrong reason (want %q): %v", manifest, want, err)
-		}
-	}
-}
diff --git a/internal/catalogue/while_stopped_test.go b/internal/catalogue/while_stopped_test.go
deleted file mode 100644
index bec7a059..00000000
--- a/internal/catalogue/while_stopped_test.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package catalogue
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-// A scheduled step may hold its module's own containers still while it runs (novox/hq ADR 0189).
-//
-// The host judges what it receives — whether each id is a container on that machine. What the
-// definition is the only place to see is judged here, near whoever wrote it.
-
-func aStoreManifest(step map[string]any) []byte {
-	m := map[string]any{
-		"module": "distribution", "version": "1",
-		"resources": []any{
-			map[string]any{"id": "store", "type": "container", "name": "mesh-registry",
-				"image": "registry@sha256:" + strings.Repeat("a", 64)},
-			step,
-		},
-	}
-	raw, _ := json.Marshal(m)
-	return raw
-}
-
-func TestAMaintenanceWindowOnItsOwnModulesContainerIsAccepted(t *testing.T) {
-	raw := aStoreManifest(map[string]any{
-		"id": "collect", "type": "container", "name": "mesh-registry-collect",
-		"image":    "registry@sha256:" + strings.Repeat("a", 64),
-		"schedule": "30 3 * * *", "while-stopped": []any{"store"},
-	})
-	if _, err := ParseManifest(raw); err != nil {
-		t.Fatalf("a step holding its own module's container still was refused: %v", err)
-	}
-}
-
-func TestAMaintenanceWindowIsRefusedWhereTheDefinitionShowsItCannotMean(t *testing.T) {
-	for _, c := range []struct {
-		name string
-		step map[string]any
-		says string
-	}{
-		{
-			"on a step with no schedule",
-			map[string]any{"id": "collect", "type": "container", "name": "c",
-				"image":         "registry@sha256:" + strings.Repeat("a", 64),
-				"while-stopped": []any{"store"}},
-			"gates what is declared after it",
-		},
-		{
-			"on a run-once step, which already has order",
-			map[string]any{"id": "collect", "type": "container", "name": "c",
-				"image":    "registry@sha256:" + strings.Repeat("a", 64),
-				"run-once": true, "while-stopped": []any{"store"}},
-			"A maintenance window is for a recurring step",
-		},
-		{
-			"naming a container this module does not declare",
-			map[string]any{"id": "collect", "type": "container", "name": "c",
-				"image":    "registry@sha256:" + strings.Repeat("a", 64),
-				"schedule": "30 3 * * *", "while-stopped": []any{"the-broker"}},
-			"could quiesce a neighbour could stop the mesh",
-		},
-		{
-			"naming itself",
-			map[string]any{"id": "collect", "type": "container", "name": "c",
-				"image":    "registry@sha256:" + strings.Repeat("a", 64),
-				"schedule": "30 3 * * *", "while-stopped": []any{"collect"}},
-			"naming itself",
-		},
-		{
-			"written as something that is not a list",
-			map[string]any{"id": "collect", "type": "container", "name": "c",
-				"image":    "registry@sha256:" + strings.Repeat("a", 64),
-				"schedule": "30 3 * * *", "while-stopped": "store"},
-			"a list of this module's container ids",
-		},
-	} {
-		_, err := ParseManifest(aStoreManifest(c.step))
-		if err == nil {
-			t.Errorf("%s was accepted", c.name)
-			continue
-		}
-		if !strings.Contains(err.Error(), c.says) {
-			t.Errorf("%s: the refusal does not say %q:\n%v", c.name, c.says, err)
-		}
-	}
-}
-
-// A composed declaration names the step's held containers the way the machine knows them.
-//
-// **The gap that let a bug through to the control node.** The manifest says `while-stopped:
-// ["store"]`, because a module names its own resources locally; the declaration a machine
-// receives calls that container `distribution.store`, because every resource is composed under
-// its module. `restart-on` and `reload-on` are rewritten for exactly this reason, and
-// `while-stopped` was not — so the host found no container by that id and refused the whole
-// declaration, every push, until it was fixed.
-//
-// It passed every test on both sides: the controller's tests read manifests, the host's read
-// hand-written declarations with bare ids. Only composing one and judging the result catches it.
-func TestAComposedWindowNamesTheContainerAsTheMachineKnowsIt(t *testing.T) {
-	store := Manifest{
-		Module: "distribution", Version: "1",
-		Provides: FromAnywhere("artifact-store"),
-		Listens:  []Listening{{Port: 5000, Protocol: "tcp", From: FromMesh}},
-		Serves:   map[string]map[string]any{"artifact-store": {"port": 5000}},
-		Resources: []map[string]any{
-			{"id": "store", "type": "container", "name": "mesh-registry",
-				"image": "registry@sha256:" + strings.Repeat("a", 64), "ports": []any{"5000"}},
-			{"id": "collect", "type": "container", "name": "mesh-registry-collect",
-				"image":    "registry@sha256:" + strings.Repeat("a", 64),
-				"schedule": "30 3 * * *", WhileStopped: []any{"store"}},
-		},
-	}
-	r, err := Resolve(shelf(store), []string{"distribution"}, reachable(), World{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	out, err := r.Declaration(Rendering{})
-	if err != nil {
-		t.Fatal(err)
-	}
-	collect := fileNamed(out, "distribution.collect")
-	if collect == nil {
-		for _, res := range out {
-			if res["id"] == "distribution.collect" {
-				collect = res
-			}
-		}
-	}
-	if collect == nil {
-		t.Fatalf("the step was not composed at all: %v", out)
-	}
-	held, _ := collect[WhileStopped].([]any)
-	if len(held) != 1 {
-		t.Fatalf("the composed step holds %v still; want one container", collect[WhileStopped])
-	}
-	if got := fmt.Sprint(held[0]); got != "distribution.store" {
-		t.Fatalf("the composed step says it holds %q still, and the machine's container is "+
-			"called %q — the host refuses a declaration naming a container it does not have, "+
-			"whole, so the machine would take nothing at all", got, "distribution.store")
-	}
-}
diff --git a/internal/catalogue/work_queue_consumer_test.go b/internal/catalogue/work_queue_consumer_test.go
deleted file mode 100644
index 4f98b6f1..00000000
--- a/internal/catalogue/work_queue_consumer_test.go
+++ /dev/null
@@ -1,75 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A work-queue stream is read by exactly one process of its own module (novox/hq ADR 0436 §6): named once
-// in a process's bus.queues, and never asked for by another module's consumes.
-
-// mailSenderManifestWithQueue is the mesh-mail fixture (ADR 0436 §7, §8) with its process's bus.queues set
-// as given, so each 1178/AC2 case can vary just that.
-func mailSenderManifestWithQueue(queues string) Manifest {
-	return Manifest{
-		Module: "mesh-mail", Version: "1", Emits: []string{"mail.send.sent", "mail.send.failed"},
-		State: []StateDeclaration{{Name: "sends"}},
-		Streams: []StreamDeclaration{{Name: "mail-sends", Events: []string{"mail.send.approved"},
-			Retention: StreamRetentionWorkQueue, MaxDeliveries: 5}},
-		Resources: []map[string]any{
-			{"id": "account", "type": "user", "name": "mesh-mail-send"},
-			{"id": "send", "type": "process", "run": []any{"./mesh-mail", "send"}, "user": "mesh-mail-send",
-				"bus": map[string]any{"emits": []any{"mail.send.sent", "mail.send.failed"}, "queues": queueList(queues)}},
-		},
-	}
-}
-
-func queueList(q string) []any {
-	if q == "" {
-		return nil
-	}
-	out := []any{}
-	for _, s := range strings.Split(q, ",") {
-		out = append(out, s)
-	}
-	return out
-}
-
-// 1178/AC2 (named): a work-queue stream no process names is refused.
-func TestAWorkQueueStreamNoProcessNamesIsRefused(t *testing.T) {
-	m := mailSenderManifestWithQueue("")
-	got := strings.Join(WorkQueueStreamProblems(m), "; ")
-	if !strings.Contains(got, "mail-sends") || !strings.Contains(got, "no process names it") {
-		t.Fatalf("an unnamed work-queue stream: %q", got)
-	}
-}
-
-// 1178/AC2 (named twice): a work-queue stream two processes name is refused.
-func TestAWorkQueueStreamTwoProcessesNameIsRefused(t *testing.T) {
-	m := mailSenderManifestWithQueue("mail-sends")
-	m.Resources = append(m.Resources, map[string]any{"id": "resend", "type": "process",
-		"run": []any{"./mesh-mail", "send"}, "user": "mesh-mail-send",
-		"bus": map[string]any{"emits": []any{"mail.send.sent"}, "queues": []any{"mail-sends"}}})
-	got := strings.Join(WorkQueueStreamProblems(m), "; ")
-	if !strings.Contains(got, "mail-sends") || !strings.Contains(got, "2 processes name") {
-		t.Fatalf("a work-queue stream two processes name: %q", got)
-	}
-}
-
-// 1178/AC2 (named once): a work-queue stream exactly one process names is accepted.
-func TestAWorkQueueStreamOneProcessNamesIsAccepted(t *testing.T) {
-	m := mailSenderManifestWithQueue("mail-sends")
-	if got := WorkQueueStreamProblems(m); len(got) != 0 {
-		t.Fatalf("a work-queue stream one process names was refused: %v", got)
-	}
-}
-
-// 1178/AC2 (another module's consumes): a work-queue stream another module's consumes asks for is refused.
-func TestAWorkQueueStreamAnotherModulesConsumesIsRefused(t *testing.T) {
-	sender := mailSenderManifestWithQueue("mail-sends")
-	reader := Manifest{Module: "reader", Version: "1", Consumes: []string{"mesh-mail.mail.send.approved"}}
-	got := strings.Join(WorkQueueConsumedElsewhereProblems(Shelf{"mesh-mail": sender, "reader": reader}), "; ")
-	if !strings.Contains(got, "reader") || !strings.Contains(got, "MAIL_SENDS") {
-		t.Fatalf("another module's consumes of a work-queue stream: %q", got)
-	}
-}
diff --git a/internal/catalogue/zones_test.go b/internal/catalogue/zones_test.go
deleted file mode 100644
index 515c0cb9..00000000
--- a/internal/catalogue/zones_test.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package catalogue
-
-import (
-	"strings"
-	"testing"
-)
-
-// A zone names the listen that answers it, or there is nothing to forward to (novox/hq ADR 0199).
-func TestAZoneMustNameOneOfTheModulesListens(t *testing.T) {
-	_, err := ParseManifest([]byte(`{"module":"lab","version":"1",
-		"listens":[{"name":"dns","port":5353,"protocol":"udp","from":"mesh","why":"the lab's names"}],
-		"zone":{"name":"${setting:zone}","listen":"web"}}`))
-	if err == nil || !strings.Contains(err.Error(), `has no listen of that name`) {
-		t.Fatalf("a zone answered by a listen the module does not have was accepted: %v", err)
-	}
-	if _, err := ParseManifest([]byte(`{"module":"lab","version":"1",
-		"listens":[{"name":"dns","port":5353,"protocol":"udp","from":"mesh","why":"the lab's names"}],
-		"zone":{"name":"${setting:zone}","listen":"dns"}}`)); err != nil {
-		t.Fatalf("a well-formed zone was refused: %v", err)
-	}
-}
-
-// The zone is the operator's (a setting) and the port is where this machine publishes the listen —
-// neither is the definition's to state.
-func TestAZoneIsPlacedFromTheNodesSettingAndPublishedPort(t *testing.T) {
-	m := Manifest{Module: "lab", Zone: &Zone{Name: "${setting:zone}", Listen: "dns"},
-		Listens: []Listening{{Name: "dns", Port: 5353, From: FromMesh}}}
-	z, err := ZoneOn(m, []Layer{{From: "node", Values: map[string]any{"zone": "Incus."}}},
-		map[int]int{5353: 15353}, "workstation", "10.77.0.3")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if z.Zone != "incus" || z.Address != "10.77.0.3" || z.Port != 15353 || z.Node != "workstation" {
-		t.Fatalf("the zone was placed as %+v", *z)
-	}
-	if _, err := ZoneOn(m, nil, nil, "workstation", "10.77.0.3"); err == nil {
-		t.Fatal("a zone nobody named was placed")
-	}
-}
-
-// One module answers a zone, and none may shadow the mesh's names or a public domain.
-func TestTheMeshRefusesAZoneTwiceOrOneThatShadows(t *testing.T) {
-	one := ZoneAt{Zone: "incus", Node: "workstation", Module: "lab", Address: "10.77.0.3", Port: 53}
-	if p := ZonesProblems([]ZoneAt{one}, "internal", []string{"example.tld"}); len(p) != 0 {
-		t.Fatalf("one ordinary zone was refused: %v", p)
-	}
-	twice := one
-	twice.Node, twice.Module = "laptop", "other"
-	cases := map[string][]ZoneAt{
-		"declared by":       {one, twice},
-		"mesh's own suffix": {{Zone: "lab.internal", Node: "a", Module: "m"}},
-		"public domain":     {{Zone: "dev.example.tld", Node: "a", Module: "m"}},
-	}
-	for want, zones := range cases {
-		p := strings.Join(ZonesProblems(zones, "internal", []string{"example.tld"}), "\n")
-		if !strings.Contains(p, want) {
-			t.Errorf("not refused for %q: %q", want, p)
-		}
-	}
-}
-
-// The resolver's template sees every zone with where it is answered, in zone order.
-func TestTheResolversTemplateRangesTheZones(t *testing.T) {
-	m := Manifest{Module: "dnsmasq", Facts: map[string]RosterFile{"zones": {
-		Path:     "/etc/mesh-resolver/zones.conf",
-		Template: "{{range .Zones}}server=/{{.Zone}}/{{.Address}}#{{.Port}}\n{{end}}",
-	}}}
-	out, err := FactsWithZonesInto(m, Resolution{Node: "anchor"}, nil, nil, nil, "", []ZoneAt{
-		{Zone: "zeta", Address: "10.77.0.2", Port: 53},
-		{Zone: "incus", Address: "10.77.0.3", Port: 15353},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := out[0]["content"]; got != "server=/incus/10.77.0.3#15353\nserver=/zeta/10.77.0.2#53\n" {
-		t.Fatalf("the resolver was told %q", got)
-	}
-}
diff --git a/internal/facts/facts_test.go b/internal/facts/facts_test.go
deleted file mode 100644
index bef99593..00000000
--- a/internal/facts/facts_test.go
+++ /dev/null
@@ -1,189 +0,0 @@
-package facts
-
-import (
-	"fmt"
-	"net"
-	"regexp"
-	"strings"
-	"testing"
-	"time"
-)
-
-// A pseudonym keeps what a limit meets — the length, and letters where letters were — and nothing else.
-func TestAPseudonymKeepsTheLengthAndShapeAndIsStable(t *testing.T) {
-	for _, name := range []string{"ace", "g14", "novox", "shanks", "home-server", "a"} {
-		p := Pseudonym("machine", name)
-		if len(p) != len(name) {
-			t.Errorf("%s became %s: %d characters for %d", name, p, len(p), len(name))
-		}
-		if p == name {
-			t.Errorf("%s was kept as itself", name)
-		}
-		if p != Pseudonym("machine", name) {
-			t.Errorf("%s is not stable", name)
-		}
-		for i := range name {
-			isLetter := func(c byte) bool { return c >= 'a' && c <= 'z' }
-			isDigit := func(c byte) bool { return c >= '0' && c <= '9' }
-			if isLetter(name[i]) != isLetter(p[i]) || isDigit(name[i]) != isDigit(p[i]) {
-				t.Errorf("%s became %s: the shape moved at %d", name, p, i)
-			}
-		}
-	}
-	if Pseudonym("machine", "ace") == Pseudonym("site", "ace") {
-		t.Error("a site and a machine of one name share a pseudonym, so a snapshot says they are one thing")
-	}
-}
-
-// Nothing of the installation survives the scrubber: names, domains, accounts, addresses, mail, secrets.
-func TestTheScrubberLeavesNothingOfTheInstallation(t *testing.T) {
-	s := NewScrubber()
-	machine := s.Machine("homeserver")
-	s.Account("jochens")
-	domain := s.Domain("zurag.be")
-	if len(domain) != len("zurag.be") || !strings.HasSuffix(domain, ".be") || domain == "zurag.be" {
-		t.Errorf("the domain became %q", domain)
-	}
-	in := map[string]any{
-		"hub":        "homeserver",
-		"listen":     "10.42.0.7:51820",
-		"upstream":   []any{"192.168.1.135", "fd00::1"},
-		"site":       "https://grafana.zurag.be/login",
-		"admin":      "jschoubben@gmail.com",
-		"home":       "/home/jochens/.ssh",
-		"api_key":    "sk-live-abcdef",
-		"nested":     map[string]any{"password": "hunter2", "port": float64(5432)},
-		"opaque":     "a8F3kQ9zL2mX7vB4nC6dE1rT5yU0iO8pA3sD",
-		"dsn":        "postgres://app:s3cr3tpass@db.internal:5432/app",
-		"pem":        "-----BEGIN PRIVATE KEY-----\nMIIB",
-		"plain":      "a-long-plain-module-directory-name",
-		"digest":     "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
-		"version":    "2.11.17",
-		"homeserver": true,
-	}
-	out := s.Values(in)
-	flat := flatten(out)
-	for _, leaked := range []string{"homeserver\"", "10.42.0.7", "192.168.1.135", "fd00::1", "zurag", "jschoubben",
-		"gmail", "jochens", "sk-live", "hunter2", "a8F3kQ9zL2mX7vB4nC6dE1rT5yU0iO8pA3sD", "s3cr3tpass", "MIIB"} {
-		if strings.Contains(flat, leaked) {
-			t.Errorf("%q survived the scrubber:\n%s", leaked, flat)
-		}
-	}
-	if out["hub"] != machine {
-		t.Errorf("a machine named in a setting became %v, not its pseudonym %s", out["hub"], machine)
-	}
-	for _, kept := range []string{"a-long-plain-module-directory-name", "2.11.17", "sha256:44136fa3", "5432"} {
-		if !strings.Contains(flat, kept) {
-			t.Errorf("%q was scrubbed, and it is not the installation's:\n%s", kept, flat)
-		}
-	}
-	// Every address left is a documentation address.
-	for _, a := range regexp.MustCompile(`[0-9a-f:.]{7,}`).FindAllString(flat, -1) {
-		ip := net.ParseIP(strings.Trim(a, ".:"))
-		if ip == nil {
-			continue
-		}
-		doc := false
-		for _, cidr := range []string{"192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24", "2001:db8::/32"} {
-			_, n, _ := net.ParseCIDR(cidr)
-			doc = doc || n.Contains(ip)
-		}
-		if !doc {
-			t.Errorf("%s is not a documentation address", a)
-		}
-	}
-	// The same address is always the same stand-in.
-	if s.Text("10.42.0.7") != s.Text("at 10.42.0.7")[3:] {
-		t.Error("one address became two stand-ins")
-	}
-}
-
-func flatten(v any) string {
-	var b strings.Builder
-	var walk func(any)
-	walk = func(v any) {
-		switch t := v.(type) {
-		case map[string]any:
-			for k, e := range t {
-				b.WriteString(k + "\"=")
-				walk(e)
-				b.WriteString("\n")
-			}
-		case []any:
-			for _, e := range t {
-				walk(e)
-				b.WriteString(",")
-			}
-		case string:
-			b.WriteString(t + "\"")
-		default:
-			b.WriteString(fmt.Sprint(t))
-		}
-	}
-	walk(v)
-	return b.String()
-}
-
-// Two snapshots of one mesh, taken apart, are one content.
-func TestASnapshotOfAnUnchangedMeshIsTheSameContentAnotherDay(t *testing.T) {
-	f := Facts{Format: Format, Taken: time.Now(), Machines: []Machine{{Name: "b"}, {Name: "a"}}}
-	g := f
-	g.Taken = f.Taken.Add(24 * time.Hour)
-	g.Machines = []Machine{{Name: "a"}, {Name: "b"}}
-	a, err := f.Content()
-	if err != nil {
-		t.Fatal(err)
-	}
-	b, _ := g.Content()
-	if a != b {
-		t.Error("the same mesh a day later reads as a change")
-	}
-	g.Machines = append(g.Machines, Machine{Name: "c"})
-	if c, _ := g.Content(); c == a {
-		t.Error("a machine added reads as no change")
-	}
-}
-
-// A reader refuses a snapshot it cannot read whole.
-func TestANewerSnapshotIsRefusedNotHalfRead(t *testing.T) {
-	if _, err := Decode([]byte(`{"facts": 99}`)); err == nil || !strings.Contains(err.Error(), "newer controller") {
-		t.Errorf("a newer format read as %v", err)
-	}
-	if _, err := Decode([]byte(`{"machines": []}`)); err == nil {
-		t.Error("a document with no format read as a snapshot")
-	}
-	f, err := Decode([]byte(`{"facts": 1, "machines": [{"name": "abc", "length": 3}, {"name": "defgh", "length": 5}]}`))
-	if err != nil || f.Longest() != 5 {
-		t.Errorf("read %+v, %v", f, err)
-	}
-}
-
-// A path that reads as a key is withheld, and keeps a path's shape: an access or a place must be an
-// absolute path, and a bare word left a machine the mesh composes refused where a check raised it.
-func TestAWithheldPathStaysAPath(t *testing.T) {
-	s := NewScrubber()
-	if got := s.Text("/storage/media/Formula1-Season-2026"); got != "/"+Withheld {
-		t.Errorf("a path reading as a key became %q", got)
-	}
-	if got := s.Text("/storage/media/movies"); got != "/storage/media/movies" {
-		t.Errorf("a plain path became %q", got)
-	}
-	if got := s.Text("Hunter2Hunter2Hunter2Hunter2xx"); got != Withheld {
-		t.Errorf("a key became %q", got)
-	}
-}
-
-// **Issue 288**: a repository was kept as the URL it was cloned from, the forge's address with it.
-func TestARepositoryIsNamedWithoutTheForge(t *testing.T) {
-	for in, want := range map[string]string{
-		"http://forge.internal:3000/owner/repo.git": "owner/repo",
-		"ssh://git@forge.internal:222/owner/repo":   "owner/repo",
-		"git@forge.internal:owner/repo.git":         "owner/repo",
-		"owner/repo":                                "owner/repo",
-		"":                                          "",
-	} {
-		if got := RepositoryName(in); got != want {
-			t.Errorf("%q is named %q, not %q", in, got, want)
-		}
-	}
-}
diff --git a/internal/identity/read_kept.go b/internal/identity/read_kept.go
new file mode 100644
index 00000000..a2d477b5
--- /dev/null
+++ b/internal/identity/read_kept.go
@@ -0,0 +1,47 @@
+package identity
+
+import (
+	"context"
+	"crypto/ed25519"
+	"encoding/base64"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// The reads of what Certify and EstablishAuthority would keep, without keeping anything (design 47 R4b, issue 1383): the
+// controller's adapter from its stores to mesh-sdk's composition input fills the certificate and the authority it holds, and
+// a machine whose certificate is not held yet is composed with a stand-in until the next send issues it.
+
+// KnownAuthority is the mesh's public certificate when it has an authority, and false when none was established yet. It
+// establishes nothing.
+func (i *Identity) KnownAuthority(ctx context.Context) (string, bool, error) {
+	held, err := i.authority(ctx)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	return held.Certificate, true, nil
+}
+
+// KeptCertificate is the certificate Certify would answer without signing, for a node's internal name and serving key: the
+// one kept for the key while it is for that name, binds that key and has life left. False when Certify would sign a fresh
+// one. It writes nothing.
+func (i *Identity) KeptCertificate(ctx context.Context, name, servingKey string) (string, bool, error) {
+	public, err := base64.StdEncoding.DecodeString(servingKey)
+	if err != nil || len(public) != ed25519.PublicKeySize {
+		return "", false, nil
+	}
+	var kept *string
+	err = i.store.Pool().QueryRow(ctx,
+		`select certificate from node_key where serving_key = $1 and revoked is null`, servingKey).Scan(&kept)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return "", false, err
+	}
+	if kept != nil && stillStands(*kept, name, public) {
+		return *kept, true, nil
+	}
+	return "", false, nil
+}
diff --git a/internal/inventory/artifacts_test.go b/internal/inventory/artifacts_test.go
index 3160866e..01a7ce3a 100644
--- a/internal/inventory/artifacts_test.go
+++ b/internal/inventory/artifacts_test.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // **Every artifact made has one state, and a kept one says why** (novox/hq ADR 0251): what the
diff --git a/internal/inventory/asks_lab_test.go b/internal/inventory/asks_lab_test.go
index a96a9a73..8f9b1e0b 100644
--- a/internal/inventory/asks_lab_test.go
+++ b/internal/inventory/asks_lab_test.go
@@ -28,8 +28,8 @@ import (
 	"github.com/nats-io/nats.go"
 	"golang.org/x/crypto/bcrypt"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // labMachine is the one machine of the lab's bus.
diff --git a/internal/inventory/bindings.go b/internal/inventory/bindings.go
index 75507ea1..85625be9 100644
--- a/internal/inventory/bindings.go
+++ b/internal/inventory/bindings.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A binding to data (novox/hq ADR 0232): where each consumer of a provision that keeps its data was
diff --git a/internal/inventory/bindings_test.go b/internal/inventory/bindings_test.go
index 9e1e778f..efb2f9cf 100644
--- a/internal/inventory/bindings_test.go
+++ b/internal/inventory/bindings_test.go
@@ -5,7 +5,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // Where a consumer of data was bound is kept, and a move keeps where it was (novox/hq ADR 0232).
diff --git a/internal/inventory/buildinput_test.go b/internal/inventory/buildinput_test.go
index 6bb6e971..ad9c2ac1 100644
--- a/internal/inventory/buildinput_test.go
+++ b/internal/inventory/buildinput_test.go
@@ -3,7 +3,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The image every module is compiled on top of is built and never run.
diff --git a/internal/inventory/busrecords.go b/internal/inventory/busrecords.go
index c68fddda..a3fdd616 100644
--- a/internal/inventory/busrecords.go
+++ b/internal/inventory/busrecords.go
@@ -6,8 +6,8 @@ import (
 	"slices"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // What the bus's user list is derived from, read out of the mesh's records.
diff --git a/internal/inventory/busrecords_integration_test.go b/internal/inventory/busrecords_integration_test.go
index 02fad1cf..80110c9e 100644
--- a/internal/inventory/busrecords_integration_test.go
+++ b/internal/inventory/busrecords_integration_test.go
@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"golang.org/x/crypto/bcrypt"
 )
 
diff --git a/internal/inventory/busrecords_test.go b/internal/inventory/busrecords_test.go
index 3dd19b98..4800b0ed 100644
--- a/internal/inventory/busrecords_test.go
+++ b/internal/inventory/busrecords_test.go
@@ -4,8 +4,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // Reading the bus's user list out of the mesh's records, against a real store.
diff --git a/internal/inventory/catalogue.go b/internal/inventory/catalogue.go
index adc40bd3..c4aa198a 100644
--- a/internal/inventory/catalogue.go
+++ b/internal/inventory/catalogue.go
@@ -12,8 +12,8 @@ import (
 	"sync"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/jackc/pgx/v5"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // noted is each stored manifest's unknown key already said, so a catalogue read on every plan says it once.
diff --git a/internal/inventory/catalogue_test.go b/internal/inventory/catalogue_test.go
index 24566a2b..c5988185 100644
--- a/internal/inventory/catalogue_test.go
+++ b/internal/inventory/catalogue_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func manifest(name string, provides, requires []string) catalogue.Manifest {
diff --git a/internal/inventory/chain_drop_test.go b/internal/inventory/chain_drop_test.go
index 23914b94..238f7760 100644
--- a/internal/inventory/chain_drop_test.go
+++ b/internal/inventory/chain_drop_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/store"
 )
 
diff --git a/internal/inventory/chain_store_test.go b/internal/inventory/chain_store_test.go
index 11d8d68c..6661dfba 100644
--- a/internal/inventory/chain_store_test.go
+++ b/internal/inventory/chain_store_test.go
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/chain"
 )
 
diff --git a/internal/inventory/collection.go b/internal/inventory/collection.go
index ebb011c4..cd927045 100644
--- a/internal/inventory/collection.go
+++ b/internal/inventory/collection.go
@@ -5,7 +5,7 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What the artifact store keeps, and what it may let go (novox/hq ADR 0189, issue 108).
diff --git a/internal/inventory/collection_test.go b/internal/inventory/collection_test.go
index b608facf..eeb5ce65 100644
--- a/internal/inventory/collection_test.go
+++ b/internal/inventory/collection_test.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What the store keeps, and what it may let go (novox/hq ADR 0189, issue 108).
diff --git a/internal/inventory/config_move.go b/internal/inventory/config_move.go
index 06bebf98..cfdd8a2c 100644
--- a/internal/inventory/config_move.go
+++ b/internal/inventory/config_move.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // **The settings layers move into mesh-config** (novox/hq ADR 0348 §9 and its consequences, design 57 K5, issue
diff --git a/internal/inventory/config_move_test.go b/internal/inventory/config_move_test.go
index a4912522..a55a4c62 100644
--- a/internal/inventory/config_move_test.go
+++ b/internal/inventory/config_move_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // configured is a module in the config form: one value a mergeable file takes, and a directory to place.
diff --git a/internal/inventory/data.go b/internal/inventory/data.go
index 944ed3b8..836bf468 100644
--- a/internal/inventory/data.go
+++ b/internal/inventory/data.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The data a module declares, as the mesh found it on each machine (novox/hq ADR 0233).
diff --git a/internal/inventory/dependencies.go b/internal/inventory/dependencies.go
index 678575bb..4d398fe6 100644
--- a/internal/inventory/dependencies.go
+++ b/internal/inventory/dependencies.go
@@ -5,8 +5,8 @@ import (
 	"sort"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/builder"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The kinds of edge in the catalogue's one dependency relation (novox/hq ADR 0162).
diff --git a/internal/inventory/dependencies_test.go b/internal/inventory/dependencies_test.go
index 566e99f5..239b4545 100644
--- a/internal/inventory/dependencies_test.go
+++ b/internal/inventory/dependencies_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The catalogue's one dependency relation (novox/hq ADR 0162): four kinds of edge from one call.
diff --git a/internal/inventory/forget_test.go b/internal/inventory/forget_test.go
index ff79f139..d0019fc2 100644
--- a/internal/inventory/forget_test.go
+++ b/internal/inventory/forget_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // What removing a module takes with it, and what re-registering one does not.
diff --git a/internal/inventory/gate.go b/internal/inventory/gate.go
index 08cc9439..f83e09c7 100644
--- a/internal/inventory/gate.go
+++ b/internal/inventory/gate.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The gate's verdicts (novox/hq ADR 0236, to-be 45 §8): what a build did on its first machine, and,
diff --git a/internal/inventory/givable_test.go b/internal/inventory/givable_test.go
index 308ed1cf..238be44e 100644
--- a/internal/inventory/givable_test.go
+++ b/internal/inventory/givable_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // `give` takes only a value nobody but a person has (the review of 2026-10-09, M4): never the module's bus
diff --git a/internal/inventory/given_test.go b/internal/inventory/given_test.go
index ade0433a..ff234271 100644
--- a/internal/inventory/given_test.go
+++ b/internal/inventory/given_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/chain"
 )
 
diff --git a/internal/inventory/heldhere_test.go b/internal/inventory/heldhere_test.go
index 831208c7..fe812c12 100644
--- a/internal/inventory/heldhere_test.go
+++ b/internal/inventory/heldhere_test.go
@@ -3,8 +3,8 @@ package inventory
 import (
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // novox/hq issue 218: a seat held once for the mesh is granted and issued only to the holder on record;
diff --git a/internal/inventory/holdings_test.go b/internal/inventory/holdings_test.go
index e129c141..8d7dcd52 100644
--- a/internal/inventory/holdings_test.go
+++ b/internal/inventory/holdings_test.go
@@ -6,7 +6,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A seat's holder is a row, changed as one act (novox/hq ADR 0131). What these pin is the shape of
diff --git a/internal/inventory/issued_test.go b/internal/inventory/issued_test.go
index 65c40254..7f890160 100644
--- a/internal/inventory/issued_test.go
+++ b/internal/inventory/issued_test.go
@@ -5,7 +5,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A value a provider's software issued is sealed to every pair that holds the provision from that provider, under
diff --git a/internal/inventory/mirrored_test.go b/internal/inventory/mirrored_test.go
index 9f56d9b7..a61214d0 100644
--- a/internal/inventory/mirrored_test.go
+++ b/internal/inventory/mirrored_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A base a build copies into the store is recorded where it is copied, and kept while a kept build stood
diff --git a/internal/inventory/older_build_test.go b/internal/inventory/older_build_test.go
index 5c3f861f..eab509ef 100644
--- a/internal/inventory/older_build_test.go
+++ b/internal/inventory/older_build_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq 04-ISSUES/219: two builds of one module in flight together, the one asked first heard
diff --git a/internal/inventory/operator.go b/internal/inventory/operator.go
index 52b6723e..42395bc8 100644
--- a/internal/inventory/operator.go
+++ b/internal/inventory/operator.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
 
diff --git a/internal/inventory/operator_test.go b/internal/inventory/operator_test.go
index 9b1a9b13..cd376900 100644
--- a/internal/inventory/operator_test.go
+++ b/internal/inventory/operator_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
 
diff --git a/internal/inventory/outside.go b/internal/inventory/outside.go
index e45a7b17..f814003c 100644
--- a/internal/inventory/outside.go
+++ b/internal/inventory/outside.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
 
diff --git a/internal/inventory/outside_test.go b/internal/inventory/outside_test.go
index 70019a76..82989645 100644
--- a/internal/inventory/outside_test.go
+++ b/internal/inventory/outside_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // outsideProvision registers a provider offering tv-api with a credential issued outside the mesh (novox/hq ADR
diff --git a/internal/inventory/placement_move.go b/internal/inventory/placement_move.go
index 8070e7bc..5056077c 100644
--- a/internal/inventory/placement_move.go
+++ b/internal/inventory/placement_move.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"sort"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // **The move of placement** (novox/hq ADR 0348 clause 11, issue 736; design 57: the moves of data run after the
diff --git a/internal/inventory/placement_test.go b/internal/inventory/placement_test.go
index 0acda5c2..fde5f1fc 100644
--- a/internal/inventory/placement_test.go
+++ b/internal/inventory/placement_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // placedLibrary is a module with each kind of placement: a directory to place, two accesses, a container that
diff --git a/internal/inventory/placement_words_test.go b/internal/inventory/placement_words_test.go
index e3a8ee7f..4a9e3e4b 100644
--- a/internal/inventory/placement_words_test.go
+++ b/internal/inventory/placement_words_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // reachedForge is a module every one of the four words reaches: two endpoints, both published, one with a
diff --git a/internal/inventory/ports_test.go b/internal/inventory/ports_test.go
index eab01635..dd690eaf 100644
--- a/internal/inventory/ports_test.go
+++ b/internal/inventory/ports_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func aNodeWithModules(t *testing.T, modules ...string) (*Inventory, string) {
diff --git a/internal/inventory/predefined.go b/internal/inventory/predefined.go
index 03fc588e..17a8b199 100644
--- a/internal/inventory/predefined.go
+++ b/internal/inventory/predefined.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The list of predefined keys the mesh publishes (novox/hq ADR 0348 §7, design 57 package K2): the newest trunk
diff --git a/internal/inventory/predefined_test.go b/internal/inventory/predefined_test.go
index 14d4fa5e..0a50ed6d 100644
--- a/internal/inventory/predefined_test.go
+++ b/internal/inventory/predefined_test.go
@@ -5,7 +5,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The list of predefined keys the controller keeps (novox/hq ADR 0348 §7 and its check "a newer trunk build's
diff --git a/internal/inventory/provisioning.go b/internal/inventory/provisioning.go
index f3340e58..09d58bfd 100644
--- a/internal/inventory/provisioning.go
+++ b/internal/inventory/provisioning.go
@@ -11,8 +11,8 @@ import (
 	"sort"
 	"strings"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The provisioner's plan of a module on a node (novox/hq ADR 0349 clause 4, design 57 P5, issue 671): what a node's
diff --git a/internal/inventory/provisioning_test.go b/internal/inventory/provisioning_test.go
index a8704131..5df700ae 100644
--- a/internal/inventory/provisioning_test.go
+++ b/internal/inventory/provisioning_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // APlan is a whole plan, as design 57 P6 composes one for a module handed to the provisioner.
diff --git a/internal/inventory/read_state.go b/internal/inventory/read_state.go
new file mode 100644
index 00000000..7b7591be
--- /dev/null
+++ b/internal/inventory/read_state.go
@@ -0,0 +1,253 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/novox/mesh-controller/internal/secrets"
+)
+
+// The reads of what a composition would make or hold, in one place and writing nothing (design 47 R4b, issue 1383): the
+// controller's adapter from its stores to mesh-sdk's composition input asks them once for the whole mesh, where the
+// composition's own reads (SecretFor, SharedSecretFor, ModuleSecretIfIssued, GivenOwnSecret) ask for one pair or one
+// secret and make what is not held.
+
+// OwnSecretRow is one own secret held on a machine (a module_secret row): who made it (`made`, or `accepted` for a
+// value a person gave), the sealing key it is sealed to, and the value sealed to that key.
+type OwnSecretRow struct {
+	Node, Module, Name, Origin, SealedTo, Sealed string
+}
+
+// OwnSecretRows is every own secret held on every machine, by machine, module and name. It writes nothing.
+func (i *Inventory) OwnSecretRows(ctx context.Context) ([]OwnSecretRow, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select n.name, m.module, m.name, m.origin, m.node_key, m.sealed
+		   from module_secret m join node n on n.id = m.node
+		  order by n.name, m.module, m.name`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []OwnSecretRow
+	for rows.Next() {
+		var r OwnSecretRow
+		if err := rows.Scan(&r.Node, &r.Module, &r.Name, &r.Origin, &r.SealedTo, &r.Sealed); err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
+// PairState is how one pair credential stands, as the composition's reads of it would find it (what SecretFor,
+// SharedSecretFor and GivenPairSecret answer), without making anything.
+type PairState struct {
+	// State is one of the Pair constants.
+	State string
+	// Sealed is the consumer's copy as it is sealed to the consumer's key, for a held credential.
+	Sealed string
+	// Why is the controller's words for a credential not given or refused.
+	Why string
+}
+
+// The states of a pair credential.
+const (
+	// PairHeld is a credential held, sealed to the keys both ends have now.
+	PairHeld = "held"
+	// PairWouldMake is a credential the next send makes.
+	PairWouldMake = "would-make"
+	// PairNotGiven is a credential only a person gives (novox/hq ADR 0337), which nobody gave under the keys the ends have now.
+	PairNotGiven = "not-given"
+	// PairRefused is a credential the next send would be refused when it made it, for the reason Why gives.
+	PairRefused = "refused"
+)
+
+// PairCredentialKind says which of the controller's reads a pair is answered by.
+type PairCredentialKind int
+
+const (
+	// PairPlain is a credential made for the pair (SecretFor).
+	PairPlain PairCredentialKind = iota
+	// PairShared is the provider's one credential sealed to the consumer too (SharedSecretFor; Own names the provider's own secret).
+	PairShared
+	// PairOutside is a credential only a person gives (GivenPairSecret).
+	PairOutside
+)
+
+// PairCredential is one pair credential, by the ends it joins.
+type PairCredential struct {
+	Kind                                                            PairCredentialKind
+	Name, Consumer, ConsumerModule, Provider, ProviderModule, Local string
+	// Own is, for a shared credential, the provider's own secret it is.
+	Own string
+}
+
+// PairCredentialState says how a pair credential stands now, by the rules the next send applies and without applying
+// them: nothing is inserted, remade or sealed. A credential the send would make is PairWouldMake, unless the send would be
+// refused (a machine with no sealing key, a value given and sealed to a key one end no longer has), which is PairRefused
+// in the send's own words.
+func (i *Inventory) PairCredentialState(ctx context.Context, p PairCredential) (PairState, error) {
+	switch p.Kind {
+	case PairOutside:
+		return i.outsideState(ctx, p)
+	case PairShared:
+		return i.sharedState(ctx, p)
+	}
+	return i.plainState(ctx, p)
+}
+
+func (i *Inventory) outsideState(ctx context.Context, p PairCredential) (PairState, error) {
+	got, err := i.GivenPairSecret(ctx, p.Name, p.Consumer, p.ConsumerModule, p.Provider, p.ProviderModule, p.Local)
+	var notGiven *NotGivenError
+	switch {
+	case errors.As(err, &notGiven):
+		return PairState{State: PairNotGiven, Why: notGiven.Why}, nil
+	case err != nil:
+		return PairState{}, err
+	}
+	return PairState{State: PairHeld, Sealed: got.ForConsumer}, nil
+}
+
+func (i *Inventory) plainState(ctx context.Context, p PairCredential) (PairState, error) {
+	consumerKey, err := i.SealingKeyOf(ctx, p.Consumer)
+	if err != nil {
+		return PairState{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, p.Provider)
+	if err != nil {
+		return PairState{}, err
+	}
+	consumerNode, err := i.NodeByName(ctx, p.Consumer)
+	if err != nil {
+		return PairState{}, err
+	}
+	providerNode, err := i.NodeByName(ctx, p.Provider)
+	if err != nil {
+		return PairState{}, err
+	}
+	var held Secret
+	err = i.store.Pool().QueryRow(ctx,
+		`select for_consumer, for_provider, consumer_key, provider_key, origin from secret
+		 where name = $1 and consumer = $2 and consumer_module = $3 and provider = $4 and local = $5`,
+		p.Name, consumerNode.ID, p.ConsumerModule, providerNode.ID, p.Local).
+		Scan(&held.ForConsumer, &held.ForProvider, &held.ConsumerKey, &held.ProviderKey, &held.Origin)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return PairState{}, err
+	}
+	if err == nil && held.ConsumerKey == consumerKey && held.ProviderKey == providerKey {
+		return PairState{State: PairHeld, Sealed: held.ForConsumer}, nil
+	}
+	if err == nil && held.Origin == OriginAccepted {
+		return PairState{State: PairRefused, Why: fmt.Sprintf(
+			"%s's %q credential from %s was accepted from a person, and a sealing key at one end "+
+				"has changed since. The mesh cannot re-seal a value it does not hold: accept it "+
+				"again with `secret accept %s %s %s --provider %s%s`",
+			p.ConsumerModule, p.Name, p.Provider, p.Consumer, p.ConsumerModule, p.Name, p.Provider, localFlag(p.Local))}, nil
+	}
+	// What making one would meet: the operator's key and the two sealing keys, by the same call that seals them.
+	operator, err := i.OperatorKey(ctx)
+	if err != nil {
+		return PairState{}, err
+	}
+	if _, _, merr := secrets.MakeWithOperator(consumerKey, providerKey, operator); merr != nil {
+		return PairState{State: PairRefused, Why: merr.Error()}, nil
+	}
+	return PairState{State: PairWouldMake}, nil
+}
+
+func (i *Inventory) sharedState(ctx context.Context, p PairCredential) (PairState, error) {
+	consumerKey, err := i.SealingKeyOf(ctx, p.Consumer)
+	if err != nil {
+		return PairState{}, err
+	}
+	consumerNode, err := i.NodeByName(ctx, p.Consumer)
+	if err != nil {
+		return PairState{}, err
+	}
+	providerNode, err := i.NodeByName(ctx, p.Provider)
+	if err != nil {
+		return PairState{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, p.Provider)
+	if err != nil {
+		return PairState{}, err
+	}
+	if consumerKey == "" || providerKey == "" {
+		return PairState{State: PairRefused, Why: fmt.Sprintf("%s and %s both need a sealing key before %s can be shared",
+			p.Consumer, p.Provider, p.Name)}, nil
+	}
+	var ownGeneration, ownOrigin, ownKey *string
+	err = i.store.Pool().QueryRow(ctx,
+		`select generation, origin, node_key from module_secret where node = $1 and module = $2 and name = $3`,
+		providerNode.ID, p.ProviderModule, p.Own).Scan(&ownGeneration, &ownOrigin, &ownKey)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return PairState{}, err
+	}
+	var held Secret
+	var pairGeneration *string
+	err = i.store.Pool().QueryRow(ctx,
+		`select for_consumer, for_provider, consumer_key, provider_key, origin, generation from secret
+		 where name = $1 and consumer = $2 and consumer_module = $3 and provider = $4 and local = $5`,
+		p.Name, consumerNode.ID, p.ConsumerModule, providerNode.ID, p.Local).
+		Scan(&held.ForConsumer, &held.ForProvider, &held.ConsumerKey, &held.ProviderKey, &held.Origin, &pairGeneration)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return PairState{}, err
+	}
+	current := ownGeneration != nil && pairGeneration != nil && *ownGeneration == *pairGeneration &&
+		held.ConsumerKey == consumerKey && held.ProviderKey == providerKey && ownKey != nil && *ownKey == providerKey
+	if current {
+		return PairState{State: PairHeld, Sealed: held.ForConsumer}, nil
+	}
+	if _, outside, err := i.ownIssuedOutside(ctx, p.ProviderModule, p.Own); err != nil {
+		return PairState{}, err
+	} else if outside && (ownOrigin == nil || *ownOrigin != OriginAccepted) {
+		return PairState{State: PairNotGiven,
+			Why: "nobody gave " + p.ProviderModule + "'s own secret " + p.Own + ", which is issued outside the mesh"}, nil
+	}
+	if ownOrigin != nil && *ownOrigin == OriginAccepted {
+		return PairState{State: PairRefused, Why: fmt.Sprintf(
+			"%s on %s needs %s from %s, whose credential is %s's own secret %q — a value given to the "+
+				"mesh, which cannot seal it to a consumer that binds later (ADR 0158): `secret accept %s %s %s` "+
+				"again, which seals it to every current consumer",
+			p.ConsumerModule, p.Consumer, p.Name, p.Provider, p.ProviderModule, p.Own, p.Provider, p.ProviderModule, p.Own)}, nil
+	}
+	return PairState{State: PairWouldMake}, nil
+}
+
+// BusMinted is the name of every bus user the mesh has minted a password hash for: `<node>.<module>` for a module and
+// `provisioner.<node>` for a machine's provisioner client.
+func (i *Inventory) BusMinted(ctx context.Context) ([]string, error) {
+	kept, err := i.BusUsers(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]string, 0, len(kept))
+	for name := range kept {
+		out = append(out, name)
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// ModulesWithSettings is every module that has a settings row, mesh-wide or for a node: the modules whose layers
+// SettingsFor can answer with anything.
+func (i *Inventory) ModulesWithSettings(ctx context.Context) (map[string]bool, error) {
+	rows, err := i.store.Pool().Query(ctx, `select distinct module from settings`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]bool{}
+	for rows.Next() {
+		var module string
+		if err := rows.Scan(&module); err != nil {
+			return nil, err
+		}
+		out[module] = true
+	}
+	return out, rows.Err()
+}
diff --git a/internal/inventory/record_mirrors_integration_test.go b/internal/inventory/record_mirrors_integration_test.go
index b2dc6685..e2417202 100644
--- a/internal/inventory/record_mirrors_integration_test.go
+++ b/internal/inventory/record_mirrors_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"encoding/json"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAModuleInTheConfigFormIsMirroredWithItsWholeDeclaration(t *testing.T) {
diff --git a/internal/inventory/record_mirrors_test.go b/internal/inventory/record_mirrors_test.go
index 013d94e5..0462a09a 100644
--- a/internal/inventory/record_mirrors_test.go
+++ b/internal/inventory/record_mirrors_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // jsonFields is the names a struct's fields are encoded under.
diff --git a/internal/inventory/registered_held_integration_test.go b/internal/inventory/registered_held_integration_test.go
index cf299498..e690c21f 100644
--- a/internal/inventory/registered_held_integration_test.go
+++ b/internal/inventory/registered_held_integration_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestWhatRunsIsTheRegisteredBuildNotANewerOnePutBack(t *testing.T) {
diff --git a/internal/inventory/rootfree_grants_test.go b/internal/inventory/rootfree_grants_test.go
index 119ecff2..e4639c9f 100644
--- a/internal/inventory/rootfree_grants_test.go
+++ b/internal/inventory/rootfree_grants_test.go
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // grantMatches is a NATS subject pattern matching a subject: `*` one token, `>` the rest.
diff --git a/internal/inventory/seats.go b/internal/inventory/seats.go
index 972e3e2c..9fc19b62 100644
--- a/internal/inventory/seats.go
+++ b/internal/inventory/seats.go
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The seats the mesh has, as data (novox/hq ADR 0122).
diff --git a/internal/inventory/seats_test.go b/internal/inventory/seats_test.go
index ff22f6a2..c300e97c 100644
--- a/internal/inventory/seats_test.go
+++ b/internal/inventory/seats_test.go
@@ -5,7 +5,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The seat set is data the control plane owns (novox/hq ADR 0122): seeded from the binary's
diff --git a/internal/inventory/secret_family_integration_test.go b/internal/inventory/secret_family_integration_test.go
index 36f93ed3..833758ff 100644
--- a/internal/inventory/secret_family_integration_test.go
+++ b/internal/inventory/secret_family_integration_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 func TestAMemberGivenIsReadAsGivenAndNothingElseIs(t *testing.T) {
diff --git a/internal/inventory/secret_family_test.go b/internal/inventory/secret_family_test.go
index 85756a9b..53eaec89 100644
--- a/internal/inventory/secret_family_test.go
+++ b/internal/inventory/secret_family_test.go
@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A member of a secret family is given by its full name, at the desk too, and a name outside the family is refused
diff --git a/internal/inventory/secret_move_test.go b/internal/inventory/secret_move_test.go
index 9050ad15..ca75465d 100644
--- a/internal/inventory/secret_move_test.go
+++ b/internal/inventory/secret_move_test.go
@@ -6,7 +6,7 @@ import (
 	"context"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The move reads every row sealed to a machine as the store holds it (design 57's V3, issue 676): its modules' own
diff --git a/internal/inventory/secrets.go b/internal/inventory/secrets.go
index 21164bbf..7af5ea93 100644
--- a/internal/inventory/secrets.go
+++ b/internal/inventory/secrets.go
@@ -11,8 +11,8 @@ import (
 
 	"github.com/jackc/pgx/v5"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 )
 
diff --git a/internal/inventory/secrets_test.go b/internal/inventory/secrets_test.go
index 69abd1fa..2c715913 100644
--- a/internal/inventory/secrets_test.go
+++ b/internal/inventory/secrets_test.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/secrets"
 
 	"golang.org/x/crypto/nacl/box"
diff --git a/internal/inventory/sent_builds_test.go b/internal/inventory/sent_builds_test.go
index cde4b6ff..eeea1567 100644
--- a/internal/inventory/sent_builds_test.go
+++ b/internal/inventory/sent_builds_test.go
@@ -6,7 +6,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq issue 259: a send keeps which build of each module it carried. A machine never sent
diff --git a/internal/inventory/settings_judged_test.go b/internal/inventory/settings_judged_test.go
index ca1b8488..e410b7e1 100644
--- a/internal/inventory/settings_judged_test.go
+++ b/internal/inventory/settings_judged_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A setting is judged where it is stored (novox/hq ADR 0163, rule 6): one that cannot compose with
diff --git a/internal/inventory/state_keyttl_test.go b/internal/inventory/state_keyttl_test.go
index a15dfeb3..359edf86 100644
--- a/internal/inventory/state_keyttl_test.go
+++ b/internal/inventory/state_keyttl_test.go
@@ -3,7 +3,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // 1154/AC2: a module's state with key-ttl is composed into a bucket that carries KeyTTL; without it, none.
diff --git a/internal/inventory/stored_silent_file_test.go b/internal/inventory/stored_silent_file_test.go
index a110b235..5840e6f3 100644
--- a/internal/inventory/stored_silent_file_test.go
+++ b/internal/inventory/stored_silent_file_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A build kept from before ADR 0326 §3 is still read and composed (novox/hq issue 574). betterbird's
diff --git a/internal/inventory/streams_test.go b/internal/inventory/streams_test.go
index 4a4cd0fb..ce522f98 100644
--- a/internal/inventory/streams_test.go
+++ b/internal/inventory/streams_test.go
@@ -5,7 +5,7 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // A machine's layer wins over the mesh's for the setting that restricts a stream (novox/hq ADR 0363 §5).
diff --git a/internal/inventory/template_test.go b/internal/inventory/template_test.go
index 75c8c12e..2a9a0399 100644
--- a/internal/inventory/template_test.go
+++ b/internal/inventory/template_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The manifest the mesh holds carries each file's text (novox/hq ADR 0349 §2): one still naming a template — a
diff --git a/internal/inventory/unseen_test.go b/internal/inventory/unseen_test.go
index e19b0752..80ea3998 100644
--- a/internal/inventory/unseen_test.go
+++ b/internal/inventory/unseen_test.go
@@ -5,7 +5,7 @@ package inventory
 import (
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq ADR 0217: a settings layer can be read, and the one a set or a clear replaced is kept, so
diff --git a/internal/inventory/waits_grants_test.go b/internal/inventory/waits_grants_test.go
index c3841b4e..5a851cf0 100644
--- a/internal/inventory/waits_grants_test.go
+++ b/internal/inventory/waits_grants_test.go
@@ -6,8 +6,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 )
 
 // The tool runner's manifest with the families novox/hq ADR 0367 §5 starts the grant with, and one more.
diff --git a/internal/link/build.go b/internal/link/build.go
index e824d5ab..9405c532 100644
--- a/internal/link/build.go
+++ b/internal/link/build.go
@@ -180,8 +180,9 @@ type CheckRequest struct {
 	// gate puts through `module check`.
 	Manifests []string `json:"manifests,omitempty"`
 	// Judge is who judges the gate: empty for the controller the mesh runs; JudgeSelf for a change to
-	// the controller, judged by itself; JudgeValidator for a change to the node-engine, judged by the
-	// running controller built with the change's validator in place of the one it vendors.
+	// the controller, judged by itself. A change to the node-engine is judged by the controller the mesh runs, as any
+	// module is: the validator is mesh-sdk's, at the controller's pin (novox/hq ADR 0446 clause 5). An older request that
+	// says "validator" is read the same way: the judge is the controller the mesh runs.
 	Judge string `json:"judge,omitempty"`
 	// Siblings are the other open pull requests of this one's delivery group the check reads beside it (novox/hq ADR
 	// 0382 §1): each repository found under Dir is read at the sibling's head merged onto the sibling's base, in
@@ -295,8 +296,7 @@ type GroupMember struct {
 
 // Who judges a merge check's gate.
 const (
-	JudgeSelf      = "self"
-	JudgeValidator = "validator"
+	JudgeSelf = "self"
 )
 
 // CheckedOut is a repository cloned beside a check, at a ref.
diff --git a/internal/link/enrol_shape_test.go b/internal/link/enrol_shape_test.go
index 68cd60c4..3e47dd95 100644
--- a/internal/link/enrol_shape_test.go
+++ b/internal/link/enrol_shape_test.go
@@ -13,7 +13,7 @@ import (
 
 	"golang.org/x/crypto/nacl/box"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 )
diff --git a/internal/link/pull_buckets_test.go b/internal/link/pull_buckets_test.go
index 2e27f187..7a98a939 100644
--- a/internal/link/pull_buckets_test.go
+++ b/internal/link/pull_buckets_test.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"reflect"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -116,11 +117,30 @@ func contains(s, sub string) bool { return strings.Contains(s, sub) }
 // fakeWatch is one bucket's watch of the key, fed by the test.
 type fakeWatch struct {
 	updates chan jetstream.KeyValueEntry
-	stopped bool
+	done    chan struct{} // closed when the watch is stopped
+	once    sync.Once
+}
+
+func newFakeWatch() *fakeWatch {
+	return &fakeWatch{updates: make(chan jetstream.KeyValueEntry, 1), done: make(chan struct{})}
+}
+
+// handled returns once the watch has taken the entry fed before it and finished with it. The channel holds one entry,
+// so the second filler (an entry the watch passes over) can only be sent after the first was taken, which the watch
+// does only after it handled the entry before it. It needs a watch that is still listening: after a move it is not.
+func (f *fakeWatch) handled(t *testing.T) {
+	t.Helper()
+	for range 2 {
+		select {
+		case f.updates <- fakeEntry{value: "not a key"}:
+		case <-time.After(2 * time.Second):
+			t.Fatal("the watch took no entry")
+		}
+	}
 }
 
 func (f *fakeWatch) Updates() <-chan jetstream.KeyValueEntry { return f.updates }
-func (f *fakeWatch) Stop() error                             { f.stopped = true; return nil }
+func (f *fakeWatch) Stop() error                             { f.once.Do(func() { close(f.done) }); return nil }
 
 type fakeEntry struct {
 	jetstream.KeyValueEntry
@@ -138,7 +158,7 @@ func TestARunningChecksWatchFindsItsKeyInTheGatesBucketOrTodays(t *testing.T) {
 	run := func(exist ...string) (map[string]*fakeWatch, chan PullKey, func(), error) {
 		watches := map[string]*fakeWatch{}
 		for _, b := range exist {
-			watches[b] = &fakeWatch{updates: make(chan jetstream.KeyValueEntry, 1)}
+			watches[b] = newFakeWatch()
 		}
 		moved := make(chan PullKey, 2)
 		stop, err := watchPullIn(t.Context(), req.Check.Pulls, func(_ context.Context, bucket string) (pullWatcher, error) {
@@ -182,14 +202,28 @@ func TestARunningChecksWatchFindsItsKeyInTheGatesBucketOrTodays(t *testing.T) {
 		t.Fatal(err)
 	}
 	watches["mesh-delivery-gate_pulls"].updates <- fakeEntry{value: `{"head":"old","trunk":"t","verdict":"pass"}`}
-	if _, ok := wait(moved); ok {
+	watches["mesh-delivery-gate_pulls"].handled(t)
+	select {
+	case <-moved:
 		t.Error("a verdict alone moved the check")
+	default:
 	}
+	// Both buckets hear the move; the second watch is done (stopped) once it has handled its entry, and by then a
+	// second telling would be in the channel.
 	watches["mesh-delivery-gate_pulls"].updates <- fakeEntry{value: `{"head":"newer","trunk":"t"}`}
 	watches["mesh-delivery_pulls"].updates <- fakeEntry{value: `{"head":"newer","trunk":"t"}`}
 	wait(moved)
-	if _, ok := wait(moved); ok {
+	for b, w := range watches {
+		select {
+		case <-w.done:
+		case <-time.After(2 * time.Second):
+			t.Errorf("the watch of %s did not end after the move", b)
+		}
+	}
+	select {
+	case <-moved:
 		t.Error("a move was told twice")
+	default:
 	}
 	stop()
 	if _, _, _, err := run(); err == nil {
diff --git a/internal/overlay/declaration_test.go b/internal/overlay/declaration_test.go
deleted file mode 100644
index 64fabd97..00000000
--- a/internal/overlay/declaration_test.go
+++ /dev/null
@@ -1,311 +0,0 @@
-package overlay
-
-import (
-	"encoding/json"
-	"fmt"
-	"strings"
-	"testing"
-)
-
-func declarationFor(t *testing.T, node Node, peers []Peer) (string, []map[string]any) {
-	t.Helper()
-	raw, err := Declaration(node, peers, "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var d struct {
-		Declaration int              `json:"declaration"`
-		Resources   []map[string]any `json:"resources"`
-	}
-	if err := json.Unmarshal(raw, &d); err != nil {
-		t.Fatal(err)
-	}
-	if d.Declaration != 1 {
-		t.Fatalf("declaration version %d", d.Declaration)
-	}
-	for _, r := range d.Resources {
-		if r["type"] == "file" {
-			return r["content"].(string), d.Resources
-		}
-	}
-	t.Fatal("the declaration has no configuration file in it")
-	return "", nil
-}
-
-func TestNoPrivateKeyEverTravels(t *testing.T) {
-	// The property the whole design rests on: the node generated its keypair and kept the private
-	// half, so the mesh composes a configuration for a node it cannot impersonate. A private key
-	// appearing here would mean the control plane had one — and a copy of its database would then
-	// be every node's network identity.
-	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
-		[]Peer{{Name: "anchor", Key: "HUB", Allowed: "10.42.0.0/16", Endpoint: "198.51.100.1:51820"}})
-
-	if strings.Contains(config, "PrivateKey") {
-		t.Error("the configuration carries a PrivateKey line; the mesh must never hold one")
-	}
-	if !strings.Contains(config, "private-key "+DefaultKeyPath) {
-		t.Error("the configuration does not point at the key file the node wrote, so the " +
-			"interface would come up with no key at all")
-	}
-}
-
-func TestTheDeclarationUsesOnlyShapesTheHostAlreadyHas(t *testing.T) {
-	// Connectivity needs nothing new from tier 0, and that is worth holding: the host does not
-	// know what a private network is, and should not learn.
-	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-
-	allowed := map[string]bool{"package": true, "file": true, "service": true,
-		"directory": true, "container": true, "action": true}
-	for _, r := range resources {
-		if !allowed[r["type"].(string)] {
-			t.Errorf("the overlay declaration uses %q, which the host does not have", r["type"])
-		}
-	}
-}
-
-func TestTheInterfaceComesBackAfterAReboot(t *testing.T) {
-	// A node whose overlay only exists while something is watching is not a node that survives
-	// being switched off and on — and it would come back unreachable, which is the worst way to
-	// come back.
-	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	for _, r := range resources {
-		if r["type"] == "service" {
-			if r["boot"] != "enabled" {
-				t.Error("the overlay interface is not enabled at boot")
-			}
-			if r["state"] != "running" {
-				t.Error("the overlay interface is not asked to be running")
-			}
-			return
-		}
-	}
-	t.Error("nothing in the declaration brings the interface up")
-}
-
-func TestTheConfigurationIsNotWorldReadable(t *testing.T) {
-	// It lists every peer's key and endpoint, which is a map of the mesh. Not secret the way a
-	// private key is, and not something to leave readable on a machine somebody else also uses.
-	// The peer list specifically, not every file. `/etc/hosts` is in here too and must be
-	// world-readable, or nothing on the machine resolves anything — a check that swept all files
-	// would force it to 0600 and break the machine to protect a file that is not secret.
-	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	for _, r := range resources {
-		if r["id"] == "overlay-config" && r["mode"] != "0600" {
-			t.Errorf("the peer list is mode %v", r["mode"])
-		}
-		if r["id"] == "mesh-names" && r["mode"] != "0644" {
-			t.Errorf("the name file is mode %v; nothing on the machine could read it", r["mode"])
-		}
-	}
-}
-
-func TestAPeerThatCannotBeDialledSaysSo(t *testing.T) {
-	// A [Peer] with no Endpoint is correct and looks like a mistake. Saying why stops somebody
-	// helpfully adding one that cannot work.
-	config, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
-		Endpoint: "198.51.100.1:51820", Hub: true},
-		[]Peer{{Name: "laptop", Key: "PUB", Allowed: "10.42.0.2/32", Why: "routes through this hub"}})
-
-	if strings.Contains(config, "Endpoint =") {
-		t.Error("an endpoint was written for a peer that has none")
-	}
-	if !strings.Contains(config, "cannot be dialled") {
-		t.Error("the file does not say why that peer has no endpoint")
-	}
-}
-
-func TestTheFileSaysNotToEditIt(t *testing.T) {
-	// It is replaced whenever the graph changes. An edit survives until then and vanishes, which
-	// is worse than never being applied — the machine works, then stops, and nothing changed
-	// that anybody remembers.
-	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	if !strings.Contains(config, "Do not edit") {
-		t.Error("a generated file does not say it is generated")
-	}
-}
-
-func TestANodeWithNoAddressIsRefused(t *testing.T) {
-	// Rather than a configuration with a blank address, which wg-quick would reject on the
-	// machine, at boot, where the failure is much harder to see.
-	if _, err := Declaration(Node{Name: "laptop", Key: "PUB"}, nil, ""); err == nil {
-		t.Fatal("a node with no overlay address was given a configuration")
-	}
-}
-
-func TestOnlyAReachableNodeListens(t *testing.T) {
-	// A ListenPort on a node nothing can dial is a port open for no reason.
-	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	if strings.Contains(config, "ListenPort") {
-		t.Error("a node that cannot be dialled was told to listen")
-	}
-	config, _ = declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
-		Endpoint: "198.51.100.1:51820"}, nil)
-	if !strings.Contains(config, "ListenPort = 51820") {
-		t.Error("a reachable node does not listen on the port its endpoint names")
-	}
-}
-
-func TestTheServiceIsRestartedWhenThePeerListChanges(t *testing.T) {
-	// The fault this exists to catch, found in the lab the moment a third node arrived: a running
-	// WireGuard interface does not re-read its configuration. The file was replaced, the service
-	// was already running so nothing reloaded it, and every existing node kept a network that no
-	// longer matched the mesh — while looking entirely successful.
-	//
-	// So the declaration has to verify what the interface is *carrying*, not what the file says.
-	//
-	// And it must be declared state rather than a command: the host refuses an action arriving
-	// over the link (novox/hq ADR 0005), correctly, which is how this shape was arrived at. There
-	// is a test below that no action is ever in here.
-	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
-		[]Peer{{Name: "anchor", Key: "HUBKEY", Allowed: "10.42.0.0/16"}})
-
-	for _, r := range resources {
-		if r["type"] != "service" {
-			continue
-		}
-		reflects := fmt.Sprint(r["restart-on"])
-		if !strings.Contains(reflects, "overlay-config") {
-			t.Errorf("the interface does not restart when its configuration changes: %v", reflects)
-		}
-		return
-	}
-	t.Error("nothing in the declaration brings the interface up")
-}
-
-func TestTheOverlayDeclarationCarriesNoAction(t *testing.T) {
-	// The link may not carry an action, and the host refuses a declaration containing one — whole,
-	// not in part. An overlay declaration with an action in it does not half-apply: it leaves the
-	// node with no network at all.
-	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	for _, r := range resources {
-		if r["type"] == "action" {
-			t.Errorf("the declaration contains an action (%v); the host will refuse the whole "+
-				"thing and the node will have no network", r["id"])
-		}
-	}
-}
-
-func TestTheHubForwardsAndNobodyElseDoes(t *testing.T) {
-	// A hub carries traffic between its spokes, and Linux does not forward packets unless told
-	// to. Without it every spoke reaches the hub perfectly and no spoke reaches any other — which
-	// is how it failed in the lab, and it presents as a peering problem rather than a kernel
-	// setting, so it is worth being sure of.
-	hub, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
-		Endpoint: "198.51.100.1:51820", Hub: true}, nil)
-	if !strings.Contains(hub, "ip_forward=1") {
-		t.Error("the hub does not enable forwarding, so its spokes cannot reach each other")
-	}
-	if !strings.Contains(hub, "ip_forward=0") {
-		t.Error("the hub never stops forwarding; a machine that stops being the hub would keep " +
-			"passing traffic it is no longer part of")
-	}
-
-	// And past the machine's own firewall. Any node with a container runtime has FORWARD set to
-	// DROP by Docker, so enabling ip_forward alone changes nothing — which is exactly how it
-	// failed, with every spoke reaching the hub and no spoke reaching any other.
-	// Checked as PostUp specifically. "contains FORWARD" passes on the PostDown line alone,
-	// which would leave a hub that tears down rules it never put up.
-	if !strings.Contains(hub, "PostUp = command -v iptables") {
-		t.Error("the hub does not open its own firewall, so a container runtime's DROP policy " +
-			"silently eats everything it was supposed to carry")
-	}
-	if !strings.Contains(hub, "PostDown = command -v iptables") {
-		t.Error("the hub never removes those rules, so a machine that stops being the hub keeps " +
-			"passing traffic it is no longer part of")
-	}
-
-	spoke, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
-	if strings.Contains(spoke, "FORWARD") {
-		t.Error("a spoke was given forwarding rules it has no use for")
-	}
-	if strings.Contains(spoke, "ip_forward") {
-		t.Error("a spoke was told to forward packets, which is not its job and widens what a " +
-			"compromised one could do")
-	}
-}
-
-// novox/hq ADR 0105: a node whose private network takes over the tunnel it found is told so on
-// the interface's service, and nothing else about the declaration changes — the key is already
-// the found one, taken at enrolment.
-func TestTakingOverAFoundTunnelIsSaidOnTheInterfacesService(t *testing.T) {
-	node := Node{Name: "anchor", Key: "PUB", Address: "192.0.2.1", Hub: true,
-		Endpoint:  "198.51.100.1:51900",
-		TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Config: "/etc/wireguard/wg0.conf"}}
-	config, resources := declarationFor(t, node, nil)
-
-	var up map[string]any
-	for _, r := range resources {
-		if r["type"] == "service" {
-			up = r
-		}
-	}
-	takes, ok := up["takes-over"].(map[string]any)
-	if !ok {
-		t.Fatalf("the interface's service does not say what it takes over: %+v", up)
-	}
-	if takes["unit"] != "wg-quick@wg0" || takes["config"] != "/etc/wireguard/wg0.conf" || takes["interface"] != "wg0" {
-		t.Errorf("the takeover names the wrong tunnel: %+v", takes)
-	}
-	if !strings.Contains(config, "ListenPort = 51900") {
-		t.Errorf("the hub's interface does not listen on the tunnel's port:\n%s", config)
-	}
-	if strings.Contains(config, "PrivateKey") {
-		t.Error("the found key travelled in the configuration; it is the node's own, set from its key file")
-	}
-
-	_, plain := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "192.0.2.4"}, nil)
-	for _, r := range plain {
-		if _, says := r["takes-over"]; says {
-			t.Error("a node taking over nothing was told to take something over")
-		}
-	}
-}
-
-func TestATakenTunnelBringsItsListenPortEvenWhenNotDialable(t *testing.T) {
-	// A home node behind NAT (no Endpoint, so not Reachable) that took over a tunnel must still
-	// listen on that tunnel's port, because its LAN peers dial it there (novox/hq: a taken tunnel
-	// brings its port). Without this the takeover guard refuses overlay-up.
-	config, _ := declarationFor(t, Node{
-		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
-		TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Port: 51820},
-	}, nil)
-
-	if !strings.Contains(config, "ListenPort = 51820") {
-		t.Fatalf("a taken tunnel's port must be the mesh interface's ListenPort:\n%s", config)
-	}
-	if strings.Contains(config, "Endpoint =") {
-		t.Error("a node that only listens for LAN peers must not advertise an endpoint")
-	}
-}
-
-func TestANodeWithNoTunnelAndNoEndpointStillListensOnNothing(t *testing.T) {
-	// The guard against over-emitting: a plain spoke with neither an endpoint nor a taken tunnel
-	// writes no ListenPort — it purely dials out.
-	config, _ := declarationFor(t, Node{Name: "laptop", Key: "K", Address: "10.10.0.9"}, nil)
-	if strings.Contains(config, "ListenPort") {
-		t.Fatalf("a dial-only node needs no ListenPort:\n%s", config)
-	}
-}
-
-func TestATakenTunnelCarriesItsMTU(t *testing.T) {
-	// A path tuned to a smaller MTU (1380 here) must survive the takeover — the mesh interface
-	// comes up with the same MTU, or transfers hang silently (novox/hq: a taken tunnel carries
-	// its MTU).
-	config, _ := declarationFor(t, Node{
-		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
-		TakesOver: &TakeOver{Interface: "wg0", Port: 51820, MTU: 1380},
-	}, nil)
-	if !strings.Contains(config, "MTU = 1380") {
-		t.Fatalf("the tuned MTU was dropped:\n%s", config)
-	}
-}
-
-func TestNoMTULineWhenTheTunnelSetNone(t *testing.T) {
-	config, _ := declarationFor(t, Node{
-		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
-		TakesOver: &TakeOver{Interface: "wg0", Port: 51820},
-	}, nil)
-	if strings.Contains(config, "MTU") {
-		t.Fatalf("no MTU was found, so none should be written:\n%s", config)
-	}
-}
diff --git a/internal/overlay/generator_test.go b/internal/overlay/generator_test.go
deleted file mode 100644
index 569322bb..00000000
--- a/internal/overlay/generator_test.go
+++ /dev/null
@@ -1,30 +0,0 @@
-package overlay
-
-import (
-	"testing"
-)
-
-// novox/hq ADR 0222, issue 190: the runtime's file and service are the runtime's module's. The
-// private network writes nothing into either — being on it still grants the right to pull from the
-// mesh's store in the clear (ADR 0082), and the runtime's module states that trust itself.
-func TestTheNetworkWritesNothingOfTheRuntimes(t *testing.T) {
-	nodes := []Node{
-		{Name: "anchor", Site: "lab", Hub: true, Endpoint: "192.0.2.10:51820", Key: "k1", Address: "10.42.0.1"},
-		{Name: "node2", Site: "lab", Key: "k2", Address: "10.42.0.2"},
-	}
-	g, err := From(nodes, "10.42.0.0/16", "")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, node := range []string{"anchor", "node2"} {
-		resources, part, err := g.Resources(node)
-		if err != nil || !part {
-			t.Fatalf("%s: resources: %v part=%v", node, err, part)
-		}
-		for _, r := range resources {
-			if r["path"] == "/etc/docker/daemon.json" || r["unit"] == "docker.service" {
-				t.Errorf("%s: the private network declares the runtime's %v", node, r)
-			}
-		}
-	}
-}
diff --git a/internal/overlay/graph_test.go b/internal/overlay/graph_test.go
deleted file mode 100644
index 5cfe6ea4..00000000
--- a/internal/overlay/graph_test.go
+++ /dev/null
@@ -1,342 +0,0 @@
-package overlay
-
-import (
-	"errors"
-	"strings"
-	"testing"
-)
-
-const cidr = "10.42.0.0/16"
-
-func at(name, site, address, endpoint string, hub bool) Node {
-	return Node{Name: name, Key: "key-" + name, Site: site, Address: address,
-		Endpoint: endpoint, Hub: hub}
-}
-
-func peersOf(t *testing.T, g Graph, node string) map[string]Peer {
-	t.Helper()
-	out := map[string]Peer{}
-	for _, p := range g[node] {
-		out[p.Name] = p
-	}
-	return out
-}
-
-func TestEveryNodeReachesTheHub(t *testing.T) {
-	// The property that makes this a network at all. Without it a node has no route to anything
-	// it does not share a site with.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-		at("home", "house", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, node := range []string{"laptop", "home"} {
-		hub, ok := peersOf(t, g, node)["anchor"]
-		if !ok {
-			t.Fatalf("%s has no route to the hub", node)
-		}
-		if hub.Allowed != cidr {
-			t.Errorf("%s routes %s through the hub; it must be the whole overlay or the hub is "+
-				"not a route of last resort", node, hub.Allowed)
-		}
-	}
-}
-
-func TestNodesAtOneSitePeerDirectly(t *testing.T) {
-	// Machines that share a site have a path that does not need the hub, and using it keeps their
-	// traffic off a link that may be on another continent.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
-		at("server", "house", "10.42.0.3", "192.0.2.3:51820", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	direct, ok := peersOf(t, g, "desk")["server"]
-	if !ok {
-		t.Fatal("two machines at one site do not peer directly")
-	}
-	if direct.Allowed != "10.42.0.3/32" {
-		t.Errorf("the direct peer allows %s; a single address is what makes it win on "+
-			"specificity over the hub's whole-overlay route", direct.Allowed)
-	}
-}
-
-func TestARoamingNodeGetsExactlyOnePath(t *testing.T) {
-	// Hub-only, and not as a simplification. WireGuard has no failover: a more specific route to
-	// a dead endpoint blackholes rather than falling back, so two paths would mean one of them
-	// silently swallowing traffic.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-		at("other", "", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := len(g["laptop"]); got != 1 {
-		t.Fatalf("a roaming node has %d peers; it gets exactly one path", got)
-	}
-	if g["laptop"][0].Name != "anchor" {
-		t.Errorf("a roaming node's single path is %s, not the hub", g["laptop"][0].Name)
-	}
-}
-
-func TestTwoRoamingNodesDoNotPeerWithEachOther(t *testing.T) {
-	// An empty site is not a site. Nodes that roam have no shared location, and treating "" as
-	// one would have every roaming machine try to dial every other, none of which can be dialled.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-		at("phone", "", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := peersOf(t, g, "laptop")["phone"]; ok {
-		t.Error("two nodes with no site peered as though they shared one")
-	}
-}
-
-func TestOnlyTheSideThatCannotBeDialledKeepsThePathOpen(t *testing.T) {
-	// Keepalive matters exactly once: on the node behind NAT. Without it the peer's first packet
-	// arrives at a mapping that has already expired. On the reachable side it is pointless
-	// traffic for ever.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !peersOf(t, g, "laptop")["anchor"].Keepalive {
-		t.Error("a node that cannot be dialled does not keep its path open")
-	}
-	if peersOf(t, g, "anchor")["laptop"].Keepalive {
-		t.Error("a reachable node sends keepalives it does not need")
-	}
-
-	// And between two direct peers at one site, where whether to keep the path open depends on
-	// which end you are. Checked here because the hub's own peer list happens not to set the
-	// field at all, so asserting only against the hub tests an absence rather than the rule.
-	same, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
-		at("server", "house", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !peersOf(t, same, "server")["desk"].Keepalive {
-		t.Error("the peer that cannot be dialled does not keep the path open")
-	}
-	if peersOf(t, same, "desk")["server"].Keepalive {
-		t.Error("the peer that can be dialled sends keepalives it does not need")
-	}
-}
-
-func TestTheHubKnowsEveryoneItRoutesFor(t *testing.T) {
-	// The replies have to get back. A hub that does not hold a peer cannot answer it.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-		at("home", "house", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	hub := peersOf(t, g, "anchor")
-	for _, want := range []string{"laptop", "home"} {
-		if _, ok := hub[want]; !ok {
-			t.Errorf("the hub does not hold %s, so replies to it have nowhere to go", want)
-		}
-	}
-}
-
-func TestAMeshWithNoHubIsRefused(t *testing.T) {
-	// Not an empty graph. A mesh with no hub has no path between sites, and answering "no peers"
-	// would look like a working network in which nothing can reach anything — which is how the
-	// old arrangement failed, silently, when nobody knew the address convention.
-	_, err := Compute([]Node{
-		at("a", "", "10.42.0.1", "", false),
-		at("b", "", "10.42.0.2", "", false),
-	}, cidr)
-	if !errors.Is(err, ErrNoHub) {
-		t.Fatalf("a mesh with no hub gave %v", err)
-	}
-}
-
-func TestAnUnreachableHubIsRefused(t *testing.T) {
-	// The hub is the one node that must be dialable from wherever the others are. Left
-	// unchecked, every node would be given a peer it can never reach and the mesh would look
-	// configured and be silent.
-	_, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "", true),
-		at("laptop", "", "10.42.0.2", "", false),
-	}, cidr)
-	if err == nil {
-		t.Fatal("a hub with no endpoint was accepted")
-	}
-	if !strings.Contains(err.Error(), "must be reachable") {
-		t.Errorf("the refusal does not say why: %v", err)
-	}
-}
-
-func TestANodeWithNoPlaceYetIsSkippedRatherThanFatal(t *testing.T) {
-	// A node that has enrolled and not yet been given an address is an ordinary in-between state.
-	// Failing the whole graph over it would mean no node gets a network because one is half done.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("laptop", "", "10.42.0.2", "", false),
-		{Name: "newcomer", Key: "", Address: ""},
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := g["newcomer"]; ok {
-		t.Error("a node with no key or address was given a peer list")
-	}
-	if _, ok := peersOf(t, g, "laptop")["newcomer"]; ok {
-		t.Error("a node with no key was put in somebody's peer list")
-	}
-}
-
-func TestNobodyPeersWithThemselves(t *testing.T) {
-	g, err := Compute([]Node{
-		at("anchor", "house", "10.42.0.1", "198.51.100.1:51820", true),
-		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for node, peers := range g {
-		for _, p := range peers {
-			if p.Name == node {
-				t.Errorf("%s peers with itself", node)
-			}
-		}
-	}
-}
-
-func TestAHubAtYourOwnSiteAppearsOnceNotTwice(t *testing.T) {
-	// WireGuard takes one entry per public key. A hub that shares a site with a spoke was being
-	// emitted twice — once as a direct peer and once as the route of last resort — producing a
-	// configuration the interface refuses, from a mesh that thought it had succeeded.
-	//
-	// Found in the lab on the first two machines that shared a site with their hub, which is the
-	// ordinary case for a small mesh and was in none of the tests above.
-	g, err := Compute([]Node{
-		at("anchor", "lab", "10.42.0.1", "192.0.2.10:51820", true),
-		at("laptop", "lab", "10.42.0.2", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	seen := map[string]int{}
-	for _, p := range g["laptop"] {
-		seen[p.Key]++
-	}
-	for key, count := range seen {
-		if count > 1 {
-			t.Errorf("the key %s appears %d times; WireGuard takes one entry per key", key, count)
-		}
-	}
-
-	if len(g["laptop"]) != 1 {
-		t.Fatalf("laptop has %d peers; the hub at its own site is one peer, not two", len(g["laptop"]))
-	}
-	// And that single entry has to carry everything, or the node keeps a direct path to the hub
-	// and loses its route to everywhere else.
-	if got := g["laptop"][0].Allowed; got != cidr {
-		t.Errorf("the single entry allows %s; it is both the direct path and the route of last "+
-			"resort, so it carries the whole overlay", got)
-	}
-}
-
-func TestTwoUnreachableNodesAtOneSiteDoNotPeerDirectly(t *testing.T) {
-	// Nobody would open the path, and the direct route is more specific than the hub's — so it
-	// wins and blackholes. Both nodes would reach the hub perfectly and be unable to reach each
-	// other, which is the worst arrangement available: it looks configured and is not.
-	//
-	// This is the design's own warning arriving in its implementation, and the lab found it with
-	// two machines at one site behind no reachable address — the ordinary shape of a house.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("desk", "house", "10.42.0.2", "", false),
-		at("server", "house", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if _, ok := peersOf(t, g, "desk")["server"]; ok {
-		t.Error("two nodes that neither can be dialled were peered directly; neither could open " +
-			"the path and the route is more specific than the hub's, so it blackholes")
-	}
-	// And they must still be able to reach each other — through the hub.
-	if hub := peersOf(t, g, "desk")["anchor"]; hub.Allowed != cidr {
-		t.Errorf("desk's route to everything else allows %s", hub.Allowed)
-	}
-}
-
-func TestOneReachableNodeIsEnoughToPeerDirectly(t *testing.T) {
-	// The other side of it: if either end can be dialled, the path can be opened, and using it
-	// keeps their traffic off a hub that may be on another continent.
-	g, err := Compute([]Node{
-		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
-		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
-		at("server", "house", "10.42.0.3", "", false),
-	}, cidr)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, ok := peersOf(t, g, "server")["desk"]; !ok {
-		t.Error("a node did not peer with a reachable neighbour at its own site")
-	}
-	if _, ok := peersOf(t, g, "desk")["server"]; !ok {
-		t.Error("the reachable node did not hold its unreachable neighbour, so replies have " +
-			"nowhere to go")
-	}
-}
-
-// novox/hq ADR 0105: a hub that took over the predecessor's tunnel carries every peer that tunnel
-// had, under the key and at the address the peer knows, until a node enrols with that key.
-func TestTheHubCarriesTheTunnelsPeersUntilTheyEnrol(t *testing.T) {
-	hub := at("anchor", "hosting", "192.0.2.1", "198.51.100.1:51900", true)
-	hub.Carried = []Carried{
-		{Key: "key-home", Address: "192.0.2.2"},
-		{Key: "key-workstation", Address: "192.0.2.3"},
-	}
-	// The machine behind key-home enrolled: it is a node now, at the address it kept.
-	home := at("home", "house", "192.0.2.2", "", false)
-	home.Key = "key-home"
-
-	g, err := Compute([]Node{hub, home}, "192.0.2.0/24")
-	if err != nil {
-		t.Fatal(err)
-	}
-	peers := peersOf(t, g, "anchor")
-	carried, ok := peers[CarriedName("key-workstation")]
-	if !ok {
-		t.Fatalf("the hub does not carry the peer that has not enrolled: %+v", g["anchor"])
-	}
-	if carried.Allowed != "192.0.2.3/32" || carried.Endpoint != "" || carried.Key != "key-workstation" {
-		t.Errorf("a carried peer is not the tunnel's own entry — same key, its one address, no endpoint: %+v", carried)
-	}
-	if _, twice := peers[CarriedName("key-home")]; twice {
-		t.Error("a peer that enrolled is carried as well as listed as a node: WireGuard takes one entry per key")
-	}
-	if node, ok := peers["home"]; !ok || node.Key != "key-home" || node.Allowed != "192.0.2.2/32" {
-		t.Errorf("the enrolled peer is not the node it became: %+v", node)
-	}
-	// Carried peers are the hub's business only: a spoke routes everything through the hub.
-	if _, leaked := peersOf(t, g, "home")[CarriedName("key-workstation")]; leaked {
-		t.Error("a carried peer appeared in a spoke's peer list")
-	}
-}
diff --git a/internal/overlay/opens_test.go b/internal/overlay/opens_test.go
deleted file mode 100644
index 06f4c93d..00000000
--- a/internal/overlay/opens_test.go
+++ /dev/null
@@ -1,113 +0,0 @@
-package overlay
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-func networkOf(t *testing.T, nodes []Node) *Generator {
-	t.Helper()
-	made, err := From(nodes, "10.42.0.0/16", "/var/lib/mesh-host/overlay.key")
-	if err != nil {
-		t.Fatal(err)
-	}
-	return made
-}
-
-// A hub is dialled by every node at other sites, and needs its port open. A machine that is not a
-// hub dials out and needs nothing open at all.
-//
-// They are the same module, which is why a static field in a manifest cannot say it — and the
-// machine it gets wrong is the one facing the public internet, which is the machine that most
-// needs filtering.
-func TestOnlyAMachineThatCanBeDialledOpensTheOverlaysPort(t *testing.T) {
-	network := networkOf(t, []Node{
-		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:51820", Site: "one", Hub: true},
-		{Name: "laptop", Key: "b", Site: "one"},
-	})
-
-	opens, err := network.Listens("anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(opens) != 1 {
-		t.Fatalf("the machine every other one dials opens %d ports", len(opens))
-	}
-	if opens[0].Port != 51820 || opens[0].At() != "udp" {
-		t.Fatalf("the port is not the one the interface listens on: %+v", opens[0])
-	}
-	// From everywhere, and deliberately: a node at another site is not on the private network
-	// until this port lets it on, so restricting it to the mesh would be a rule that can never be
-	// satisfied by the thing it exists for.
-	if opens[0].From != catalogue.FromEverywhere {
-		t.Fatalf("the way onto the private network is restricted to the private network: %+v", opens[0])
-	}
-	if opens[0].Why == "" {
-		t.Fatal("a port is opened and nothing says why, which is what makes a rule set unreadable")
-	}
-
-	// And the machine nothing dials opens nothing. Not harmless to get wrong: a rule with no
-	// reason is one somebody later has to work out the reason for.
-	quiet, err := network.Listens("laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(quiet) != 0 {
-		t.Fatalf("a machine nothing dials opened %d port(s)", len(quiet))
-	}
-}
-
-// The port comes from the endpoint, which is where the interface takes its ListenPort from. One
-// source, so a rule set cannot open a port the interface is not on.
-func TestTheOpenedPortIsTheOneTheInterfaceListensOn(t *testing.T) {
-	network := networkOf(t, []Node{
-		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:60000", Site: "one", Hub: true},
-	})
-	opens, err := network.Listens("anchor")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(opens) != 1 || opens[0].Port != 60000 {
-		t.Fatalf("the rule set would open a port the interface is not on: %+v", opens)
-	}
-
-	written, err := Declaration(Node{Name: "anchor", Key: "a", Address: "10.42.0.1",
-		Endpoint: "198.51.100.10:60000", Hub: true}, nil, "/k")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(written), "ListenPort = 60000") {
-		t.Fatalf("the interface and the rule set disagree about the port:\n%s", written)
-	}
-}
-
-// An endpoint with no port is refused rather than treated as a machine that opens nothing.
-//
-// A generator that cannot say what a machine opens is not one that says it opens nothing, and
-// closing a port on the evidence of a failure to look is how a machine is severed by a fault
-// somewhere else entirely.
-func TestAnEndpointWithNoPortIsRefusedRatherThanTakenAsSilence(t *testing.T) {
-	network := networkOf(t, []Node{
-		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10", Site: "one", Hub: true},
-	})
-	if _, err := network.Listens("anchor"); err == nil {
-		t.Fatal("a machine whose port could not be read was treated as opening nothing")
-	}
-}
-
-// A machine the network has never heard of opens nothing, and that is an answer rather than an
-// error: a node assigned the module before it is placed is in exactly that state.
-func TestAMachineNotOnTheNetworkOpensNothing(t *testing.T) {
-	network := networkOf(t, []Node{
-		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:51820", Site: "one", Hub: true},
-	})
-	opens, err := network.Listens("a-stranger")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(opens) != 0 {
-		t.Fatalf("a machine not on the network opened %d port(s)", len(opens))
-	}
-}
diff --git a/internal/overlay/seat_test.go b/internal/overlay/seat_test.go
deleted file mode 100644
index 33512e70..00000000
--- a/internal/overlay/seat_test.go
+++ /dev/null
@@ -1,29 +0,0 @@
-package overlay
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/novox/mesh-controller/internal/catalogue"
-)
-
-// The private network's claim is a seat the mesh defines (novox/hq ADR 0110).
-//
-// Checked here because this is where the manifest is composed: it ships with the control plane and
-// has no module.json for a test reading the catalogue to find. Parsed with the real parser, so a
-// set that forgot this seat refuses the control plane's own module here rather than on a machine.
-func TestThePrivateNetworksClaimIsASeatTheMeshDefines(t *testing.T) {
-	for _, composed := range []map[string]any{Manifest()} {
-		raw, err := json.Marshal(composed)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := catalogue.ParseManifest(raw); err != nil {
-			t.Errorf("%s, composed by the control plane, is refused: %v", composed["module"], err)
-		}
-	}
-	seat, defined := catalogue.SeatNamed(TheNetwork)
-	if !defined || seat.Scope != catalogue.ScopeNode {
-		t.Fatalf("%s is not a node seat the mesh defines: %+v", TheNetwork, seat)
-	}
-}
diff --git a/internal/catalogue/controller_is_a_process_test.go b/internal/ownmanifest/controller_is_a_process_test.go
similarity index 98%
rename from internal/catalogue/controller_is_a_process_test.go
rename to internal/ownmanifest/controller_is_a_process_test.go
index f5dc530a..2098652b 100644
--- a/internal/catalogue/controller_is_a_process_test.go
+++ b/internal/ownmanifest/controller_is_a_process_test.go
@@ -1,4 +1,4 @@
-package catalogue
+package ownmanifest
 
 import (
 	"encoding/json"
@@ -6,6 +6,8 @@ import (
 	"os"
 	"strings"
 	"testing"
+
+	. "git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // novox/hq issue 213: the controller is a Go program and was the one piece of the mesh's own Go
diff --git a/internal/ownmanifest/doc.go b/internal/ownmanifest/doc.go
new file mode 100644
index 00000000..be9d6509
--- /dev/null
+++ b/internal/ownmanifest/doc.go
@@ -0,0 +1,5 @@
+// Package ownmanifest holds the tests of this repository's own manifests (module.json, modules/*), of its Dockerfile
+// and Makefile, and of the catalogue's modules as this repository reads them, against mesh-sdk's go/catalogue: the
+// tests that read a file of this repository, which mesh-sdk cannot (design 47 R4b, issue 1381). They were
+// internal/catalogue's, moved here with the package (a moved test is exempt from failing first).
+package ownmanifest
diff --git a/internal/ownmanifest/foundation_manifests_test.go b/internal/ownmanifest/foundation_manifests_test.go
new file mode 100644
index 00000000..a544a93d
--- /dev/null
+++ b/internal/ownmanifest/foundation_manifests_test.go
@@ -0,0 +1,38 @@
+package ownmanifest
+
+import (
+	"fmt"
+	"testing"
+
+	. "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// **The builder requires the registry the npm seat delivers, and carries no binding of its own.**
+//
+// It used to carry a hand-written binding because nothing provided a package registry to resolve
+// one from at genesis. The catalogue now requires it like any consumer, and ADR 0110 makes the
+// seat's holder the answer when more than one module provides it — so a carried copy would be a
+// second answer to the same question, free to drift from the first. Asserted gone, not merely
+// unused.
+//
+// The builder is the build-agent on every machine since novox/hq ADR 0190; this read the retired
+// `builder` and, finding no manifest, skipped unseen from then until novox/hq issue 432.
+func TestTheBuilderRequiresTheRegistryTheNpmSeatDelivers(t *testing.T) {
+	builder := catalogueManifest(t, "build-agent")
+	seat, _ := SeatNamed("npm-package-registry")
+	var requires bool
+	for _, r := range builder.Requires {
+		requires = requires || r == seat.Delivers
+	}
+	if !requires {
+		t.Fatalf("the builder does not require %q: %v", seat.Delivers, builder.Requires)
+	}
+	if builder.Binds[seat.Delivers] == "" {
+		t.Errorf("the builder is not told where the registry is: binds %v", builder.Binds)
+	}
+	for _, r := range builder.Resources {
+		if fmt.Sprint(r["id"]) == "package-binding" {
+			t.Fatal("the builder carries its own package binding beside the one the mesh resolves")
+		}
+	}
+}
diff --git a/internal/catalogue/genesis_image_test.go b/internal/ownmanifest/genesis_image_test.go
similarity index 98%
rename from internal/catalogue/genesis_image_test.go
rename to internal/ownmanifest/genesis_image_test.go
index ad3f0f1e..d57dac48 100644
--- a/internal/catalogue/genesis_image_test.go
+++ b/internal/ownmanifest/genesis_image_test.go
@@ -1,4 +1,4 @@
-package catalogue
+package ownmanifest
 
 import (
 	"os"
diff --git a/internal/catalogue/genesis_registry_test.go b/internal/ownmanifest/genesis_registry_test.go
similarity index 90%
rename from internal/catalogue/genesis_registry_test.go
rename to internal/ownmanifest/genesis_registry_test.go
index 2139c8af..a167a3ec 100644
--- a/internal/catalogue/genesis_registry_test.go
+++ b/internal/ownmanifest/genesis_registry_test.go
@@ -1,14 +1,11 @@
-package catalogue
+package ownmanifest
 
 import (
 	"strings"
 	"testing"
-)
 
-// Genesis assigns the build agent before the package registry exists (novox/hq ADR 0336, issue 121),
-// judged over the real catalogue. Genesis's step 13 was refused with "nothing provides
-// \"npm-package-registry\", wanted by build-agent": the forge genesis raises at its packages step is a
-// container, not the gitea module, and provides nothing.
+	. "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
 
 // agentBuilt is the build agent as the mesh holds it once built: its image pinned.
 func agentBuilt(t *testing.T) Manifest {
diff --git a/internal/ownmanifest/helpers_test.go b/internal/ownmanifest/helpers_test.go
new file mode 100644
index 00000000..281e0726
--- /dev/null
+++ b/internal/ownmanifest/helpers_test.go
@@ -0,0 +1,109 @@
+package ownmanifest
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/beside"
+)
+
+// Moved from internal/catalogue (issue 1381) with the tests below; each helper is the one the old package's tests
+// shared, over the SDK's exported API.
+
+var bundleDigest = "sha256:" + strings.Repeat("b", 64)
+
+func fileNamed(out []map[string]any, id string) map[string]any {
+	for _, r := range out {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+func shelf(ms ...catalogue.Manifest) map[string]catalogue.Manifest {
+	out := map[string]catalogue.Manifest{}
+	for _, m := range ms {
+		out[m.Module] = m
+	}
+	return out
+}
+
+func reachable() catalogue.Node {
+	return catalogue.Node{Name: "workstation", Site: "house", At: "workstation.internal",
+		Capabilities: map[string]bool{"seat": true, "container-runtime": true}}
+}
+
+func names(r catalogue.Resolution) []string {
+	var out []string
+	for _, m := range r.Modules {
+		out = append(out, m.Module)
+	}
+	return out
+}
+
+func boundFrom(t *testing.T, r catalogue.Resolution, consumer, provision string) catalogue.Needed {
+	t.Helper()
+	for _, n := range r.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("no binding of %s for %s: %+v", consumer, provision, r.Needs)
+	return catalogue.Needed{}
+}
+
+// moduleTree is where a module is read from: this repository's own modules/<module> when it lives whole here
+// (novox/hq ADR 0420 §1, issue 1019: build-agent and route-proxy), with this repository as the tree root;
+// otherwise the catalogue beside, with the catalogue as the root.
+func moduleTree(t *testing.T, module string) (root, dir string) {
+	t.Helper()
+	own := filepath.Join("..", "..", "modules", module)
+	if _, err := os.Stat(filepath.Join(own, "module.json")); err == nil {
+		return filepath.Join("..", ".."), own
+	}
+	return beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), module)
+}
+
+func catalogueManifest(t *testing.T, module string) catalogue.Manifest {
+	t.Helper()
+	root, dir := moduleTree(t, module)
+	m, err := catalogue.ReadTreeManifest(root, dir)
+	if err != nil {
+		t.Fatalf("%s does not parse:\n%v", module, err)
+	}
+	return m
+}
+
+// catalogueResolved is a catalogue module as the mesh holds it once built: the manifest as written, resolved against
+// what the build produced besides the archive its templates are packed into (novox/hq ADR 0349 §2).
+func catalogueResolved(t *testing.T, module string, built ...catalogue.Built) catalogue.Manifest {
+	t.Helper()
+	root, dir := moduleTree(t, module)
+	m, err := catalogue.ReadTreeManifestWritten(root, dir)
+	if err != nil {
+		t.Fatalf("%s does not parse:\n%v", module, err)
+	}
+	if name := catalogue.TemplatesArtifact(m); name != "" {
+		read, err := catalogue.ReadTemplates(m, dir)
+		if err != nil {
+			t.Fatalf("%s: %v", module, err)
+		}
+		// By the path inside the archive, as the build reads it back, not by the path in the module's directory.
+		texts := map[string]string{}
+		for path, text := range read {
+			texts[strings.TrimPrefix(path, m.TemplatesDir()+"/")] = text
+		}
+		built = append(built, catalogue.Built{Name: name, Kind: catalogue.ArtifactArchive,
+			Reference: catalogue.ArtifactStoreScheme + module + "/" + name + "/blobs/" + bundleDigest, Digest: bundleDigest,
+			Texts: texts})
+	}
+	held, err := m.Resolve(built)
+	if err != nil {
+		t.Fatalf("%s does not resolve against its own build: %v", module, err)
+	}
+	return held
+}
diff --git a/internal/ownmanifest/own_module_json_test.go b/internal/ownmanifest/own_module_json_test.go
new file mode 100644
index 00000000..743caa35
--- /dev/null
+++ b/internal/ownmanifest/own_module_json_test.go
@@ -0,0 +1,123 @@
+package ownmanifest
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	. "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTheControllersOwnManifestClaimsItsSeat(t *testing.T) {
+	// The seat test above fabricates manifests, so deleting the claim from the real module.json
+	// would fail nothing (novox/hq issue 059's review). This binds the one manifest this
+	// repository owns: the controller claims the mesh-scoped seat named after its server
+	// (ADR 0079), or the one-controller property is convention again.
+	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
+	if err != nil {
+		t.Fatalf("the controller's own manifest is unreadable: %v", err)
+	}
+	m, err := ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("the controller's own manifest does not parse: %v", err)
+	}
+	for _, c := range m.Claims {
+		if c.Name == "mesh-controller" && c.At() == ScopeMesh {
+			return
+		}
+	}
+	t.Fatalf("module.json no longer claims the mesh-scoped mesh-controller seat: %+v", m.Claims)
+}
+
+// **The control plane's own manifest, composed through the whole path.**
+//
+// The store was given 6852 and the broker's plain port 5679 (the control-node's migration, novox/hq
+// 04-ISSUES/102). The control plane's own connections are sealed at genesis with the ports genesis
+// wrote; what its container is told beside them is where this machine put the store and the
+// broker now, read from the node's settings exactly as every consumer's binding is.
+func TestTheControlPlanesOwnAddressesFollowTheNodesPorts(t *testing.T) {
+	raw, err := os.ReadFile("../../module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	m, err := ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("the control plane's own manifest does not parse:\n%v", err)
+	}
+	// The manifest itself names them now; withSeatPorts is a no-op on it, and this holds it so.
+	for _, r := range m.Resources {
+		if r["type"] != "process" {
+			continue
+		}
+		env, _ := r["env"].(map[string]any)
+		for key, want := range seatPorts {
+			if env[key] != want {
+				t.Errorf("module.json says %s=%v, not %q", key, env[key], want)
+			}
+		}
+	}
+	control, err := m.Resolve([]Built{{
+		Name: "controller", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + "mesh-controller/controller@sha256:" + strings.Repeat("c", 64),
+		Digest:    "sha256:" + strings.Repeat("c", 64),
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := Resolution{Node: "anchor", Modules: []Manifest{control}}
+	needed := map[string]map[string]string{"mesh-controller": {}}
+	for name := range m.OwnSecrets {
+		needed["mesh-controller"][name] = "sealed-" + name
+	}
+	out, err := r.Declaration(Rendering{
+		Needed:        needed,
+		ArtifactStore: "anchor.internal:5100",
+		Seats: map[string]map[int]int{
+			"mesh-store":  {5432: 6852},
+			"mesh-broker": {5671: 5671, 5672: 5679, 15672: 15673},
+		},
+	})
+	if err != nil {
+		t.Fatalf("the control plane does not compose: %v", err)
+	}
+	server := fileNamed(out, "mesh-controller.controller")
+	if server == nil {
+		t.Fatalf("the control plane's process is not in the declaration: %v", out)
+	}
+	env, _ := server["env"].(map[string]any)
+	for key, want := range map[string]string{
+		"MESH_STORE_INVENTORY_PORT":   "6852",
+		"MESH_STORE_IDENTITY_PORT":    "6852",
+		"MESH_STORE_LICENCES_PORT":    "6852",
+		"MESH_BROKER_MANAGEMENT_PORT": "15673",
+		"MESH_BROKER_ADDRESS_PORT":    "5671",
+	} {
+		if env[key] != want {
+			t.Errorf("the control plane is told %s=%v; the node put it on %s", key, env[key], want)
+		}
+	}
+	if got := server["source"]; got != "anchor.internal:5100/mesh-controller/controller@sha256:"+strings.Repeat("c", 64) {
+		t.Errorf("the control plane's own bundle is fetched from %v, not routed through the store", got)
+	}
+
+	// And on a mesh where the foundation is where genesis raised it, nothing is added.
+	out, err = r.Declaration(Rendering{Needed: needed, ArtifactStore: "anchor.internal:5100"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	env, _ = fileNamed(out, "mesh-controller.controller")["env"].(map[string]any)
+	if env["MESH_STORE_INVENTORY_PORT"] != "" {
+		t.Errorf("with no settings, the control plane is told %v", env)
+	}
+}
+
+// seatPorts is what the control plane's manifest says beside each sealed connection: the port
+// this machine put the seat's holder at (novox/hq 04-ISSUES/102).
+var seatPorts = map[string]string{
+	"MESH_STORE_INVENTORY_PORT":   "${seat:mesh-store:5432}",
+	"MESH_STORE_IDENTITY_PORT":    "${seat:mesh-store:5432}",
+	"MESH_STORE_LICENCES_PORT":    "${seat:mesh-store:5432}",
+	"MESH_BROKER_MANAGEMENT_PORT": "${seat:mesh-broker:15672}",
+	"MESH_BROKER_ADDRESS_PORT":    "${seat:mesh-broker:5671}",
+}
diff --git a/internal/catalogue/public_issuer_test.go b/internal/ownmanifest/public_issuer_test.go
similarity index 74%
rename from internal/catalogue/public_issuer_test.go
rename to internal/ownmanifest/public_issuer_test.go
index e80ddfb8..2d3e7d7e 100644
--- a/internal/catalogue/public_issuer_test.go
+++ b/internal/ownmanifest/public_issuer_test.go
@@ -1,11 +1,9 @@
-package catalogue
+package ownmanifest
 
 import (
-	"os"
-	"path/filepath"
 	"testing"
 
-	"github.com/novox/mesh-controller/internal/beside"
+	. "git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The public issuer is the proxy's own fact (novox/hq ADR 0226), and the folding of it must not
@@ -88,35 +86,3 @@ func TestRouteProxyKeepsItsPublicAccountDirectory(t *testing.T) {
 			"plan for the account (ADR 0226)", trust, trustImage)
 	}
 }
-
-// The modules ADR 0226 retired stay retired, and nothing asks for what they provided. A module is
-// in the catalogue when its manifest is: a directory left behind with no manifest in it (a build's
-// leftovers, untracked by git) is not a module, and failed this on a desktop (novox/hq issue 432).
-func TestTheRetiredNetworkingModulesAreNotInTheCatalogue(t *testing.T) {
-	modules := beside.Catalogue(t)
-	for _, gone := range []string{"public-acme", "dhcpcd", "cloudflare-dns"} {
-		if _, err := os.Stat(filepath.Join(modules, gone, "module.json")); err == nil {
-			t.Errorf("%s is in the catalogue again; ADR 0226 retired it", gone)
-		}
-	}
-	entries, err := os.ReadDir(modules)
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, e := range entries {
-		raw, err := os.ReadFile(filepath.Join(modules, e.Name(), "module.json"))
-		if err != nil {
-			continue
-		}
-		m, err := ParseManifest(raw)
-		if err != nil {
-			continue // judged by the catalogue's own tests
-		}
-		for _, r := range m.Requires {
-			if r == "acme-ca" || r == "public-dns" {
-				t.Errorf("%s requires %q, which nothing in the catalogue provides since ADR 0226",
-					m.Module, r)
-			}
-		}
-	}
-}
diff --git a/internal/ownmanifest/seats_test.go b/internal/ownmanifest/seats_test.go
new file mode 100644
index 00000000..9542e948
--- /dev/null
+++ b/internal/ownmanifest/seats_test.go
@@ -0,0 +1,50 @@
+package ownmanifest
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-controller/internal/beside"
+)
+
+// Every module in use claims a seat in the set, so closing it refuses nothing that runs.
+//
+// Read from the catalogue (internal/beside) and from this repository's own manifest, the two places a
+// manifest lives (ADR 0069). The private-network module's manifest is composed in code, and its claim
+// is checked where it is composed.
+func TestEveryManifestInUseClaimsASeatTheMeshDefines(t *testing.T) {
+	paths, _ := filepath.Glob(filepath.Join(beside.Catalogue(t), "*", "module.json"))
+	if len(paths) == 0 {
+		t.Fatal("no manifests in the catalogue, so this proved nothing")
+	}
+	root := beside.Dir(t, "mesh-catalog")
+	paths = append(paths, "../../module.json")
+	var checked int
+	for _, path := range paths {
+		// The SDK's claimProblems is unexported; the parser runs it on every manifest whose claims are well formed
+		// (go/catalogue manifest.go), so a manifest that parses claims only seats the mesh defines or declares. A
+		// catalogue manifest is judged as the merge check judges it, against the predefined list at the root of the tree it
+		// is read in (ADR 0348 §7, issue 914); this repository's own is judged alone.
+		var m catalogue.Manifest
+		var err error
+		if path == "../../module.json" {
+			var raw []byte
+			if raw, err = os.ReadFile(path); err != nil {
+				t.Fatal(err)
+			}
+			m, err = catalogue.ParseManifest(raw)
+		} else {
+			m, err = catalogue.ReadTreeManifest(root, filepath.Dir(path))
+		}
+		if err != nil {
+			t.Errorf("%s: %v", path, err)
+			continue
+		}
+		checked += len(m.Claims)
+	}
+	if checked == 0 {
+		t.Fatal("no claims were checked, so this proved nothing")
+	}
+}
diff --git a/internal/recordmirror/mirror_store_test.go b/internal/recordmirror/mirror_store_test.go
index 7e4cbdda..4b706724 100644
--- a/internal/recordmirror/mirror_store_test.go
+++ b/internal/recordmirror/mirror_store_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/novox/mesh-controller/internal/broker"
-	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/inventory"
 )
 
diff --git a/internal/recordmirror/readers_test.go b/internal/recordmirror/readers_test.go
index 864a22ea..91736ad0 100644
--- a/internal/recordmirror/readers_test.go
+++ b/internal/recordmirror/readers_test.go
@@ -17,7 +17,7 @@ import (
 
 // mayNameAMirror are the files of the controller that may name a record mirror's bucket outside their tests:
 // where the buckets are defined, asserted and granted (internal/broker), the list a reader names in `reads`
-// (internal/catalogue/state.go), and each mirror's own writer (this package and the loop that runs it). The
+// (the catalogue's state.go, now mesh-sdk's), and each mirror's own writer (this package and the loop that runs it). The
 // audit of a mirror against its store (ADR 0289 §4, issue 419) joins this list when it is built.
 var mayNameAMirror = []string{
 	// The chain opens its buckets, the assignments' among them, which stopped being a mirror when the chain took them
@@ -28,7 +28,6 @@ var mayNameAMirror = []string{
 	// The grant of a machine's own keys of the assignments mirror to its provisioner client (design 57 P3).
 	"internal/broker/provisioner.go",
 	"internal/broker/writers.go",
-	"internal/catalogue/state.go",
 }
 
 // The packages whose names stand for a mirror, by import path, and the names in each.
diff --git a/testdata/beside/CAPTURED b/testdata/beside/CAPTURED
index 2b8b844e..16d7e706 100644
--- a/testdata/beside/CAPTURED
+++ b/testdata/beside/CAPTURED
@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  e0bc919d4945bb5f13f971f74643a0b714cf45da  modules/*/module.json, modules/nats/Dockerfile
 mesh-host     9d9e3a46c4f5943cfffb413d962ce48b75e2fd39  examples/foundation-first-node.lock
-mesh-sdk      aa68b67389c964ea3e573bc50630c77d6518cdab  conformance/events/module-event.json
+mesh-sdk      ab0c16ddad260289006a40c5dc6fd4973e0b5e0b  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 
@@ -27,7 +27,7 @@ and write the commits here. The SDK is captured at the commit go.mod pins for gi
   git -C ../mesh-sdk archive <commit> conformance/events | tar -x -C testdata/beside/mesh-sdk
 
 And from mesh-host at the same commit as its line above, the node-engine's placement guard, which
-internal/catalogue's engine_guard_test.go holds the controller's resolved-path rules to (novox/hq issue 496),
+mesh-sdk's go/catalogue engine_guard_test.go holds the controller's resolved-path rules to (novox/hq issue 496),
 kept as .captured so no Go tool reads it as this repository's code:
 
   mkdir -p testdata/beside/mesh-host/internal/apply
diff --git a/internal/catalogue/adoption.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/adoption.go
similarity index 100%
rename from internal/catalogue/adoption.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/adoption.go
diff --git a/internal/catalogue/artifacts.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/artifacts.go
similarity index 100%
rename from internal/catalogue/artifacts.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/artifacts.go
diff --git a/internal/catalogue/backup_placement.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/backup_placement.go
similarity index 100%
rename from internal/catalogue/backup_placement.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/backup_placement.go
diff --git a/internal/catalogue/bound.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/bound.go
similarity index 100%
rename from internal/catalogue/bound.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/bound.go
diff --git a/internal/catalogue/bound_into_files.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/bound_into_files.go
similarity index 100%
rename from internal/catalogue/bound_into_files.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/bound_into_files.go
diff --git a/internal/catalogue/build.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/build.go
similarity index 100%
rename from internal/catalogue/build.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/build.go
diff --git a/internal/catalogue/busy.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/busy.go
similarity index 100%
rename from internal/catalogue/busy.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/busy.go
diff --git a/internal/catalogue/chosen.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/chosen.go
similarity index 100%
rename from internal/catalogue/chosen.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/chosen.go
diff --git a/internal/catalogue/collections.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/collections.go
similarity index 100%
rename from internal/catalogue/collections.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/collections.go
diff --git a/internal/catalogue/config.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/config.go
similarity index 100%
rename from internal/catalogue/config.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/config.go
diff --git a/internal/catalogue/config_move.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/config_move.go
similarity index 100%
rename from internal/catalogue/config_move.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/config_move.go
diff --git a/internal/catalogue/consumer_into_serves.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/consumer_into_serves.go
similarity index 100%
rename from internal/catalogue/consumer_into_serves.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/consumer_into_serves.go
diff --git a/internal/catalogue/consumers.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/consumers.go
similarity index 100%
rename from internal/catalogue/consumers.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/consumers.go
diff --git a/internal/catalogue/core_credentials.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/core_credentials.go
similarity index 100%
rename from internal/catalogue/core_credentials.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/core_credentials.go
diff --git a/internal/catalogue/cron.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/cron.go
similarity index 100%
rename from internal/catalogue/cron.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/cron.go
diff --git a/internal/catalogue/data.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/data.go
similarity index 100%
rename from internal/catalogue/data.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/data.go
diff --git a/internal/catalogue/declaration.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/declaration.go
similarity index 100%
rename from internal/catalogue/declaration.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/declaration.go
diff --git a/internal/catalogue/delivery_seat.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/delivery_seat.go
similarity index 100%
rename from internal/catalogue/delivery_seat.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/delivery_seat.go
diff --git a/internal/catalogue/dir_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/dir_into.go
similarity index 100%
rename from internal/catalogue/dir_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/dir_into.go
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/doc.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/doc.go
new file mode 100644
index 00000000..32c0dc91
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/doc.go
@@ -0,0 +1,7 @@
+// Copied from mesh-controller internal/catalogue at commit 6c2a8d62100cb7d491f8eb9a623e1eeea5ec0de1 (novox/hq ADR 0453
+// clause 3, ADR 0446 clause 4), so the builder, the checker and the assigner can read and resolve a manifest. The files
+// are unchanged but for import paths, this note and KnownCapabilities, which gains user-namespaces (issue 1308's name).
+// The test files that read mesh-controller's other packages or its own module.json stay in mesh-controller, as do two
+// tests of single files here that read its module.json (TestTheControllersOwnManifestClaimsItsSeat and
+// TestTheControlPlanesOwnAddressesFollowTheNodesPorts). mesh-controller keeps its own copy until release 4b.
+package catalogue
diff --git a/internal/catalogue/environment_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/environment_into.go
similarity index 100%
rename from internal/catalogue/environment_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/environment_into.go
diff --git a/internal/catalogue/events.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/events.go
similarity index 100%
rename from internal/catalogue/events.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/events.go
diff --git a/internal/catalogue/files.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go
similarity index 100%
rename from internal/catalogue/files.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/files.go
diff --git a/internal/catalogue/filtering.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/filtering.go
similarity index 100%
rename from internal/catalogue/filtering.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/filtering.go
diff --git a/internal/catalogue/graphical_session.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/graphical_session.go
similarity index 100%
rename from internal/catalogue/graphical_session.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/graphical_session.go
diff --git a/internal/catalogue/handed.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/handed.go
similarity index 100%
rename from internal/catalogue/handed.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/handed.go
diff --git a/internal/catalogue/health.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/health.go
similarity index 100%
rename from internal/catalogue/health.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/health.go
diff --git a/internal/catalogue/identity.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/identity.go
similarity index 100%
rename from internal/catalogue/identity.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/identity.go
diff --git a/internal/catalogue/installation.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/installation.go
similarity index 100%
rename from internal/catalogue/installation.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/installation.go
diff --git a/internal/catalogue/jails_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/jails_into.go
similarity index 100%
rename from internal/catalogue/jails_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/jails_into.go
diff --git a/internal/catalogue/localnetwork.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/localnetwork.go
similarity index 100%
rename from internal/catalogue/localnetwork.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/localnetwork.go
diff --git a/internal/catalogue/logs.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/logs.go
similarity index 100%
rename from internal/catalogue/logs.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/logs.go
diff --git a/internal/catalogue/machine_into_files.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/machine_into_files.go
similarity index 100%
rename from internal/catalogue/machine_into_files.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/machine_into_files.go
diff --git a/internal/catalogue/manifest.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/manifest.go
similarity index 100%
rename from internal/catalogue/manifest.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/manifest.go
diff --git a/internal/catalogue/naming.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/naming.go
similarity index 100%
rename from internal/catalogue/naming.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/naming.go
diff --git a/internal/catalogue/node_resolver.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/node_resolver.go
similarity index 100%
rename from internal/catalogue/node_resolver.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/node_resolver.go
diff --git a/internal/catalogue/optional_requirements.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/optional_requirements.go
similarity index 100%
rename from internal/catalogue/optional_requirements.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/optional_requirements.go
diff --git a/internal/catalogue/placement.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/placement.go
similarity index 100%
rename from internal/catalogue/placement.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/placement.go
diff --git a/internal/catalogue/port_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/port_into.go
similarity index 100%
rename from internal/catalogue/port_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/port_into.go
diff --git a/internal/catalogue/predefined.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/predefined.go
similarity index 100%
rename from internal/catalogue/predefined.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/predefined.go
diff --git a/internal/catalogue/process_bus.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/process_bus.go
similarity index 100%
rename from internal/catalogue/process_bus.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/process_bus.go
diff --git a/internal/catalogue/reads.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/reads.go
similarity index 100%
rename from internal/catalogue/reads.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/reads.go
diff --git a/internal/catalogue/recreates.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/recreates.go
similarity index 100%
rename from internal/catalogue/recreates.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/recreates.go
diff --git a/internal/catalogue/resolve.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/resolve.go
similarity index 100%
rename from internal/catalogue/resolve.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/resolve.go
diff --git a/internal/catalogue/roster.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/roster.go
similarity index 100%
rename from internal/catalogue/roster.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/roster.go
diff --git a/internal/catalogue/runtime.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/runtime.go
similarity index 100%
rename from internal/catalogue/runtime.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/runtime.go
diff --git a/internal/catalogue/seat_contributions.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_contributions.go
similarity index 100%
rename from internal/catalogue/seat_contributions.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_contributions.go
diff --git a/internal/catalogue/seat_data.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_data.go
similarity index 99%
rename from internal/catalogue/seat_data.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_data.go
index 37442e66..bea4fc72 100644
--- a/internal/catalogue/seat_data.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_data.go
@@ -68,7 +68,7 @@ var capabilityName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]*$`)
 var KnownCapabilities = []string{
 	"battery", "container-runtime", "firewall", "graphical-session", "overlay", "package-manager",
 	"power-meter", "privileged", "seat", "service-manager", "uplink-dhcpcd", "uplink-networkmanager",
-	"uplink-systemd-networkd", "virtualisation",
+	"uplink-systemd-networkd", "user-namespaces", "virtualisation",
 }
 
 // renderFuncs are the functions a holder's template may call. `quote` writes a value as a JSON
diff --git a/internal/catalogue/seat_dependencies.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_dependencies.go
similarity index 100%
rename from internal/catalogue/seat_dependencies.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_dependencies.go
diff --git a/internal/catalogue/seat_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_into.go
similarity index 100%
rename from internal/catalogue/seat_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_into.go
diff --git a/internal/catalogue/seat_pass.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_pass.go
similarity index 100%
rename from internal/catalogue/seat_pass.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_pass.go
diff --git a/internal/catalogue/seat_paths.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_paths.go
similarity index 100%
rename from internal/catalogue/seat_paths.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seat_paths.go
diff --git a/internal/catalogue/seats.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seats.go
similarity index 100%
rename from internal/catalogue/seats.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seats.go
diff --git a/internal/catalogue/seats_declared.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seats_declared.go
similarity index 100%
rename from internal/catalogue/seats_declared.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/seats_declared.go
diff --git a/internal/catalogue/secrets_into_files.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/secrets_into_files.go
similarity index 100%
rename from internal/catalogue/secrets_into_files.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/secrets_into_files.go
diff --git a/internal/catalogue/served_own_names.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/served_own_names.go
similarity index 100%
rename from internal/catalogue/served_own_names.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/served_own_names.go
diff --git a/internal/catalogue/setting_defaults.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_defaults.go
similarity index 100%
rename from internal/catalogue/setting_defaults.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_defaults.go
diff --git a/internal/catalogue/setting_into.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go
similarity index 100%
rename from internal/catalogue/setting_into.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_into.go
diff --git a/internal/catalogue/setting_takes.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_takes.go
similarity index 100%
rename from internal/catalogue/setting_takes.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/setting_takes.go
diff --git a/internal/catalogue/settings.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/settings.go
similarity index 100%
rename from internal/catalogue/settings.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/settings.go
diff --git a/internal/catalogue/shares.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/shares.go
similarity index 100%
rename from internal/catalogue/shares.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/shares.go
diff --git a/internal/catalogue/state.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/state.go
similarity index 100%
rename from internal/catalogue/state.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/state.go
diff --git a/internal/catalogue/streams.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/streams.go
similarity index 100%
rename from internal/catalogue/streams.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/streams.go
diff --git a/internal/catalogue/template.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/template.go
similarity index 100%
rename from internal/catalogue/template.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/template.go
diff --git a/internal/catalogue/terminal_keys.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/terminal_keys.go
similarity index 100%
rename from internal/catalogue/terminal_keys.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/terminal_keys.go
diff --git a/internal/catalogue/unconsumed_placeholder.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unconsumed_placeholder.go
similarity index 100%
rename from internal/catalogue/unconsumed_placeholder.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unconsumed_placeholder.go
diff --git a/internal/catalogue/unhealthy.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unhealthy.go
similarity index 100%
rename from internal/catalogue/unhealthy.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unhealthy.go
diff --git a/internal/catalogue/unknown_field.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unknown_field.go
similarity index 100%
rename from internal/catalogue/unknown_field.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/unknown_field.go
diff --git a/internal/catalogue/upgrade.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/upgrade.go
similarity index 100%
rename from internal/catalogue/upgrade.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/upgrade.go
diff --git a/internal/catalogue/verbs.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/verbs.go
similarity index 100%
rename from internal/catalogue/verbs.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/verbs.go
diff --git a/internal/catalogue/zones.go b/vendor/git.novox.be/novox/mesh-sdk/go/catalogue/zones.go
similarity index 100%
rename from internal/catalogue/zones.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/catalogue/zones.go
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/credentials.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/credentials.go
new file mode 100644
index 00000000..97668876
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/credentials.go
@@ -0,0 +1,495 @@
+package compose
+
+import (
+	"crypto/ecdh"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Mode says what a composition does about what a send would make. Both modes read what the Input holds and make nothing; they
+// differ as the controller's Reading and Foreseeing modes do.
+type Mode int
+
+const (
+	// Reading composes what is held and leaves out an own secret the Input holds none for: that machine cannot be running it.
+	Reading Mode = iota
+	// Foreseeing composes an own secret the next send would make with a stand-in and names it foreseen, while one the send would
+	// refuse (a bus credential nobody issued, a given secret under an old key) is refused here, in the same words.
+	Foreseeing
+)
+
+// ForeseenCertificate and ForeseenBusUsers stand for what the Input does not carry, in a composition asked ahead of the send.
+// Never sent.
+const (
+	ForeseenCertificate = "foreseen: issued by the next send"
+	ForeseenBusUsers    = "foreseen: composed from the bus records by the next send"
+)
+
+// grantsFor is every credential this node must create, because something elsewhere uses it (plan.go grantsFor): the mirror of
+// what a consumer is given. A consumer whose identity overflows the provision's bound is left out of the grants and returned
+// beside them (novox/hq ADR 0225); one whose resolution binds it to another provider is withdrawn and returned beside them
+// (issue 274). Every other is granted.
+func (c *composer) grantsFor(node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, []string, error) {
+	issued, err := c.rowsFor(node)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	out := make([]catalogue.Grant, 0, len(issued))
+	var withheld []catalogue.Overflow
+	var unbound []catalogue.Unbound
+	var foreseen []string
+	for _, s := range issued {
+		resolved, err := c.planFor(s.Consumer)
+		switch {
+		case unresolvable(err):
+			// Their set does not resolve. Skipped rather than fatal: this node is not the place to report another machine's problem.
+			continue
+		case err != nil:
+			// The mesh could not be asked what they wanted, which is not the same as their wanting nothing.
+			return nil, nil, nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Provision, err)
+		}
+		plan := resolved.Plan
+		values, asks, err := plan.ContributionsFrom(s.Provision, s.ConsumerModule, resolved.Settings)
+		if err != nil {
+			return nil, nil, nil, nil, err
+		}
+		// A port in there is the consumer's software port until this: the assignment that moved it is that machine's.
+		consumer, err := c.in.node(s.Consumer)
+		if err != nil {
+			return nil, nil, nil, nil, err
+		}
+		values = catalogue.AtPublishedPort(values, s.ConsumerModule, consumer.Ports[s.ConsumerModule])
+		from := s.ConsumerModule
+		if !asks {
+			// That module no longer wants this: left empty, which is how a login is withdrawn rather than kept working for ever.
+			from = ""
+		}
+		if bound := plan.BindsFrom(s.Provision, s.ConsumerModule, s.Local); from != "" && !slices.Contains(bound, node) {
+			// It still asks, and not of this node: withdrawn exactly as a credential nobody asks for, and said.
+			from = ""
+			unbound = append(unbound, catalogue.Unbound{Provision: s.Provision, Provider: node,
+				Consumer: s.Consumer, Module: s.ConsumerModule, Local: s.Local, BoundTo: bound})
+		}
+		// The consumer's identity slug, from its own manifest, carried on the grant so the provider derives the same login the
+		// consumer does (novox/hq ADR 0049).
+		slug := ""
+		for _, mm := range plan.Modules {
+			if mm.Module == s.ConsumerModule {
+				slug = mm.Slug
+				break
+			}
+		}
+		if from != "" {
+			bound := boundOfGrant(plan, s, node)
+			source := catalogue.IdentitySource(slug, s.ConsumerModule)
+			if catalogue.CheckIdentityWithin(s.Consumer, source, bound) != nil {
+				withheld = append(withheld, catalogue.Overflow{Provision: s.Provision, Provider: node,
+					Consumer: s.Consumer, Module: s.ConsumerModule,
+					Identity: catalogue.ConsumerIdentity(s.Consumer, source), Bound: bound})
+				continue
+			}
+		}
+		sealed := s.ForProvider
+		if sealed == "" {
+			sealed = catalogue.ForeseenSealed
+			foreseen = append(foreseen, fmt.Sprintf("the grant of %s for %s on %s", s.Provision, s.ConsumerModule, s.Consumer))
+		}
+		out = append(out, catalogue.Grant{
+			Provision: s.Provision, Consumer: s.Consumer, At: onNetwork[s.Consumer],
+			From: from, Values: values, Slug: slug, Sealed: sealed, Local: s.Local})
+	}
+	return out, withheld, unbound, foreseen, nil
+}
+
+// rowsFor is every pair credential this node's declaration must carry a grant for, in the order the controller reads them
+// (SecretsFrom: by provision, consumer, consumer module and local name): the ones the Input says were made, and the ones the same send
+// would make before it composes this node -- every need of a node that resolves (this one too), whose provider is this node, that is not
+// answered by a record and not a credential only a person gives and nobody gave. Those have no sealed copy (ForProvider empty), so the
+// grant is composed with a stand-in and named foreseen (plan.go: planFor makes the secret in every mode before grantsFor reads it).
+func (c *composer) rowsFor(node string) ([]Issued, error) {
+	var rows []Issued
+	for _, row := range c.in.Issued {
+		if row.Provider == node {
+			rows = append(rows, row)
+		}
+	}
+	for _, other := range c.in.sorted() {
+		resolved, err := c.planFor(other.Name)
+		switch {
+		case unresolvable(err):
+			continue
+		case err != nil:
+			return nil, fmt.Errorf("what %s asked of %s cannot be read: %w", other.Name, node, err)
+		}
+		shelf := c.shelfFor(other)
+		for _, n := range resolved.Plan.Needs {
+			if n.From != node || n.ByRecord {
+				continue
+			}
+			cred, held := c.credential(n, other.Name)
+			if _, outside := issuedOutsideBy(shelf, n); cred.State == CredentialNotGiven || (outside && !(held && cred.State == CredentialHeld)) {
+				continue
+			}
+			if slices.ContainsFunc(rows, func(r Issued) bool {
+				return r.Provision == n.Name && r.Consumer == other.Name && r.ConsumerModule == n.For && r.Local == n.Local
+			}) {
+				continue
+			}
+			rows = append(rows, Issued{Provision: n.Name, Consumer: other.Name, ConsumerModule: n.For, Local: n.Local, Provider: node})
+		}
+	}
+	sort.SliceStable(rows, func(i, j int) bool {
+		a, b := rows[i], rows[j]
+		switch {
+		case a.Provision != b.Provision:
+			return a.Provision < b.Provision
+		case a.Consumer != b.Consumer:
+			return a.Consumer < b.Consumer
+		case a.ConsumerModule != b.ConsumerModule:
+			return a.ConsumerModule < b.ConsumerModule
+		}
+		return a.Local < b.Local
+	})
+	return rows, nil
+}
+
+// boundOfGrant is the identity bound the consumer's own resolution states for the requirement this grant answers. A requirement
+// not found there is held to the tightest bound the mesh knows rather than to none.
+func boundOfGrant(consumer catalogue.Resolution, s Issued, provider string) catalogue.IdentityBound {
+	for _, n := range consumer.Needs {
+		if n.Name == s.Provision && n.For == s.ConsumerModule && n.From == provider {
+			return n.Identity
+		}
+	}
+	return catalogue.DefaultIdentityBound
+}
+
+// ownSecretRow is the row for one own secret of a module on a node.
+func (c *composer) ownSecretRow(node, module, name string) (OwnSecretRow, bool) {
+	for _, r := range c.in.OwnSecrets {
+		if r.Node == node && r.Module == module && r.Name == name {
+			return r, true
+		}
+	}
+	return OwnSecretRow{}, false
+}
+
+// givenMember is one own secret a person gave on a machine and whether it is sealed to the key the machine holds now.
+type givenMember struct {
+	Name    string
+	Sealed  string
+	Current bool
+}
+
+// givenMembers is every member of a module's secret family given on a machine, by name (inv.GivenMembers): the mesh never
+// makes a member, so only a value a person gave is one; a machine with no sealing key holds none.
+func (c *composer) givenMembers(node Node, module, family string) []givenMember {
+	if node.SealingKey == "" {
+		return nil
+	}
+	prefix := catalogue.FamilyPrefix(family)
+	var out []givenMember
+	for _, r := range c.in.OwnSecrets {
+		if r.Node == node.Name && r.Module == module && r.Origin == "accepted" && strings.HasPrefix(r.Name, prefix) {
+			out = append(out, givenMember{Name: r.Name, Sealed: r.Sealed, Current: r.SealedTo == node.SealingKey})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// givenOwnSecret is an own secret issued outside the mesh as a person gave it on a machine (inv.GivenOwnSecret): not given when
+// the value held was made by the mesh or the machine has no sealing key.
+func (c *composer) givenOwnSecret(node Node, module, name string) (givenMember, bool) {
+	if node.SealingKey == "" {
+		return givenMember{}, false
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	if !ok || r.Origin != "accepted" {
+		return givenMember{}, false
+	}
+	return givenMember{Name: name, Sealed: r.Sealed, Current: r.SealedTo == node.SealingKey}, true
+}
+
+// moduleSecretIfIssued is the read half of the controller's SecretForModule (inv.ModuleSecretIfIssued): the secret when one is
+// held and sealed to the key the machine holds now, and otherwise not held. A key it was sealed to that the machine no longer
+// has is reported as absent rather than as an error.
+func (c *composer) moduleSecretIfIssued(node Node, module, name string) (sealed string, held bool) {
+	if node.SealingKey == "" {
+		return "", false
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	if !ok || r.SealedTo != node.SealingKey {
+		return "", false
+	}
+	return r.Sealed, true
+}
+
+// wouldMakeSecretForModule says what the send would do about an own secret without doing it: nil when it would make one (or one
+// is held), and otherwise the very refusal it would meet (inv.WouldMakeSecretForModule).
+func (c *composer) wouldMakeSecretForModule(node Node, module, name string) error {
+	if node.SealingKey == "" {
+		return fmt.Errorf("%s needs a secret and %s has no sealing key, so nothing can be sealed to it", module, node.Name)
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	switch {
+	case !ok:
+		return nil
+	case r.SealedTo != node.SealingKey && r.Origin == "accepted":
+		return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
+			"since generated a new sealing key. The mesh cannot make another; issue it again", module, node.Name, name, node.Name)
+	}
+	return nil
+}
+
+// busCredentialIssued refuses an own secret called `broker` whose bus account nobody issued (novox/hq issue 203): the broker
+// credential is never invented, an account on the bus minted by `module issue`.
+func (c *composer) busCredentialIssued(node, module, name string) error {
+	var user string
+	switch name {
+	case "broker":
+		user = node + "." + module
+	case ProvisionerSecret:
+		user = "provisioner." + node
+	default:
+		return nil
+	}
+	if !slices.Contains(c.in.BusMinted, user) {
+		return fmt.Errorf(
+			"%s on %s has no bus credential: nothing was issued for %s, and a push "+
+				"would seal a placeholder its process cannot read (novox/hq issue 203). "+
+				"`module issue %s --node %s`, then push again",
+			module, node, user, module, node)
+	}
+	return nil
+}
+
+// givenUnderAnOldKey is the refusal for a value a person gave sealed to a key the machine no longer holds.
+func givenUnderAnOldKey(module, node, name string) error {
+	return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
+		"since generated a new sealing key. The mesh cannot make another; give it again", module, node, name, node)
+}
+
+// ownSecretsFor is each module's own secrets as this node composes them (plan.go renderingFor): the needed ones sealed to the
+// node, and, in the Foreseeing mode, the ones the next send would make named foreseen. A module handed to the provisioner has its
+// secrets from the vault through the client, so none of them is composed here.
+func (c *composer) ownSecretsFor(node Node, plan catalogue.Resolution, handing catalogue.Rendering, mode Mode) (
+	needed map[string]map[string]string, foreseen map[string]map[string]bool, err error) {
+	needed = map[string]map[string]string{}
+	foreseen = map[string]map[string]bool{}
+	mark := func(module, name string) {
+		if foreseen[module] == nil {
+			foreseen[module] = map[string]bool{}
+		}
+		foreseen[module][name] = true
+	}
+	for _, m := range plan.Modules {
+		if handing.Handing(m) {
+			continue
+		}
+		// A secret family is never made (novox/hq ADR 0283): each member a person gave on this machine is placed, and one not
+		// given is nothing -- the module says it waits for it.
+		for _, family := range m.OwnSecrets.Families() {
+			for _, g := range c.givenMembers(node, m.Module, family) {
+				if _, fam, ok := m.OwnSecrets.Lookup(g.Name); !ok || fam != family {
+					continue // a longer family's member, or a name no longer of this family
+				}
+				if !g.Current {
+					continue
+				}
+				if needed[m.Module] == nil {
+					needed[m.Module] = map[string]string{}
+				}
+				needed[m.Module][g.Name] = g.Sealed
+				if g.Sealed == "" {
+					// Given, and its value is not in the Input: placed with a stand-in, named.
+					needed[m.Module][g.Name] = catalogue.ForeseenSealed
+					mark(m.Module, g.Name)
+				}
+			}
+		}
+		names := make([]string, 0)
+		for name := range m.OwnSecrets.Plain() {
+			names = append(names, name)
+		}
+		sort.Strings(names)
+		for _, name := range names {
+			own := m.OwnSecrets.Plain()[name]
+			// An own secret issued outside the mesh is never made (novox/hq issue 401, ADR 0228; ADR 0283 for a family): only a
+			// value a person gave is placed. One not given is nothing, and a value the mesh made for it before is not one either.
+			if own.IssuedBy == catalogue.IssuedOutside {
+				g, given := c.givenOwnSecret(node, m.Module, name)
+				if !given || !g.Current {
+					continue
+				}
+				if g.Sealed == "" {
+					mark(m.Module, name)
+					continue
+				}
+				if needed[m.Module] == nil {
+					needed[m.Module] = map[string]string{}
+				}
+				needed[m.Module][name] = g.Sealed
+				continue
+			}
+			sealed, held := c.moduleSecretIfIssued(node, m.Module, name)
+			if !held && mode == Foreseeing {
+				// Asked ahead of the send: what the send would do about it, by the send's own rules. Made by it -- a stand-in,
+				// named; refused by it -- refused here, the same words (novox/hq issue 275).
+				if err := c.busCredentialIssued(node.Name, m.Module, name); err != nil {
+					return nil, nil, err
+				}
+				if err := c.wouldMakeSecretForModule(node, m.Module, name); err != nil {
+					return nil, nil, err
+				}
+				mark(m.Module, name)
+				continue
+			}
+			if !held {
+				// Never issued, so this machine cannot be running it: left out rather than invented.
+				continue
+			}
+			if sealed == "" {
+				// Held, and its value is not in the Input: composed with a stand-in, named.
+				mark(m.Module, name)
+				continue
+			}
+			if needed[m.Module] == nil {
+				needed[m.Module] = map[string]string{}
+			}
+			needed[m.Module][name] = sealed
+		}
+	}
+	return needed, foreseen, nil
+}
+
+// CoreBoxWanted is a core credential whose box the Input does not hold for a machine: the next send asks the vault for it and
+// keeps the answer. It is returned for the caller to ask and keep; this package asks and keeps nothing.
+type CoreBoxWanted struct {
+	Node   string
+	Module string
+	Name   string
+}
+
+// coreModulesOf is every module of the plan on the core's list whose own secrets this machine's declaration carries, with their
+// plain own secret names, sorted: one handed to the provisioner has its secrets from the vault through the client, and one issued
+// outside the mesh is never the vault's to seal here.
+func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest) bool) map[string][]string {
+	out := map[string][]string{}
+	for _, m := range modules {
+		if !catalogue.CarriesVaultSealed(m.Module) || (handed != nil && handed(m)) {
+			continue
+		}
+		var names []string
+		for name, own := range m.OwnSecrets.Plain() {
+			if own.IssuedBy != catalogue.IssuedOutside {
+				names = append(names, name)
+			}
+		}
+		if len(names) > 0 {
+			sort.Strings(names)
+			out[m.Module] = names
+		}
+	}
+	return out
+}
+
+// sealingKeyValid says a machine's sealing key, recorded raw in base64, is a raw X25519 key.
+func sealingKeyValid(raw string) error {
+	b, err := base64.StdEncoding.DecodeString(strings.TrimSpace(raw))
+	if err != nil || len(b) != 32 {
+		return errors.New("the machine's sealing key is not a raw X25519 key")
+	}
+	_, err = ecdh.X25519().NewPublicKey(b)
+	return err
+}
+
+// coreBoxesFor decides each core credential of a machine in a composition that sends nothing and asks no vault (core_box.go
+// coreBoxesOf, in the modes that are not a send): the kept box while it is sealed to the key the machine holds now, and otherwise a
+// stand-in that the next send replaces by asking the vault -- returned in wanted for the caller to ask and keep. A machine with no
+// sealing key, or one whose key is not a key, leaves its module out, said.
+func (c *composer) coreBoxesFor(node Node, modules []catalogue.Manifest, handing catalogue.Rendering) (
+	sealed map[string]map[string]json.RawMessage, notPlaced map[string]string, wanted []CoreBoxWanted) {
+	core := coreModulesOf(modules, func(m catalogue.Manifest) bool { return handing.Handing(m) })
+	sealed, notPlaced = map[string]map[string]json.RawMessage{}, map[string]string{}
+	mods := make([]string, 0, len(core))
+	for m := range core {
+		mods = append(mods, m)
+	}
+	sort.Strings(mods)
+	for _, module := range mods {
+		if node.SealingKey == "" {
+			notPlaced[module] = fmt.Sprintf("%s has no sealing key, so the vault can seal %s's credentials to "+
+				"nothing there (novox/hq ADR 0349 §16)", node.Name, module)
+			continue
+		}
+		if err := sealingKeyValid(node.SealingKey); err != nil {
+			notPlaced[module] = fmt.Sprintf("%s's credentials cannot be asked of the vault: %v", module, err)
+			continue
+		}
+		boxes := map[string]json.RawMessage{}
+		for _, name := range core[module] {
+			var kept *CoreBox
+			for i := range c.in.KeptCoreBoxes {
+				k := &c.in.KeptCoreBoxes[i]
+				if k.Node == node.Name && k.Module == module && k.Name == name {
+					kept = k
+				}
+			}
+			if kept != nil && kept.SealedTo == node.SealingKey && len(kept.Box) > 0 {
+				boxes[name] = kept.Box
+				continue
+			}
+			boxes[name] = catalogue.ForeseenVaultBox
+			wanted = append(wanted, CoreBoxWanted{Node: node.Name, Module: module, Name: name})
+		}
+		sealed[module] = boxes
+	}
+	return sealed, notPlaced, wanted
+}
+
+// certificateFor is what the mesh certifies about one machine's internal name (plan.go certificateFor): refused for a machine that
+// never told the mesh what key it serves with, and for one not on the private network, which has no name to be certified for.
+// The certificate and the authority are public values the Input may carry; without them stand-ins are composed, and named.
+func (c *composer) certificateFor(node Node) (certificate, authority string, foreseen bool, err error) {
+	if node.ServingKey == "" {
+		return "", "", false, fmt.Errorf(
+			"%s wants a certificate and has never told the mesh what key it serves with; it "+
+				"joins again to report one", node.Name)
+	}
+	where, err := c.whereEveryoneIs()
+	if err != nil {
+		return "", "", false, err
+	}
+	if where[node.Name] == "" {
+		return "", "", false, fmt.Errorf(
+			"%s wants a certificate and is not on the private network, so it has no name inside "+
+				"the mesh to be certified for", node.Name)
+	}
+	certificate, authority = node.Certificate, c.in.Authority
+	if certificate == "" || authority == "" {
+		return ForeseenCertificate, ForeseenCertificate, true, nil
+	}
+	return certificate, authority, false, nil
+}
+
+// holdsTheBus says whether a node's set includes the module that asks for the bus's user list.
+func holdsTheBus(modules []catalogue.Manifest) bool {
+	for _, m := range modules {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/input.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/input.go
new file mode 100644
index 00000000..853eab7a
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/input.go
@@ -0,0 +1,325 @@
+// Package compose is the controller's composition of a machine, as a function over a plain input (novox/hq ADR 0453
+// clause 3, ADR 0446 clause 4): what the rest of the mesh offers and holds, the private network's generator, one
+// node's resolution and, in the issues after, its rendering and its declaration.
+//
+// **It never allocates, makes, writes, logs or raises.** The controller composes with a store behind it; this
+// package is its Reading and Foreseeing modes over data. Everything the controller reads from its store is a field of
+// Input, and everything a send would make or record (a port, a credential, a seat passed on, a node left out) is
+// returned for the caller to act on, never done. Input is never changed by a call. No field holds a secret value
+// the composition needs: sealed values are optional inputs, and without them the composition uses stand-ins named
+// foreseen. The logic is the controller's, ported from mesh-controller cmd/mesh-controller at commit
+// 6c2a8d62100cb7d491f8eb9a623e1eeea5ec0de1 (plan.go, network.go, holdings.go, seat_pass.go), in the same order, with the
+// same refusals in the same words, so that a comparison node for node is a fair one.
+//
+// It imports the standard library and mesh-sdk's own packages only.
+// It reads no environment variable: the range the mesh allocates from and the suffix of its internal names are fields of Input.
+package compose
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Input is everything the composition reads. Each field is what one read of the controller's inventory answers, named
+// beside it; the controller's adapter fills it from its stores and the assigner from the mesh's facts and buckets
+// (ADR 0446 clause 2).
+type Input struct {
+	// Catalogue is the shelf: every module's manifest by name (inv.Catalogue), as it is to be composed. A recorded
+	// module kept at the build a machine runs (keepRecorded) is that node's Kept, applied to its own resolution only (never to the rest of the mesh).
+	Catalogue map[string]catalogue.Manifest
+	// Nodes is every node the mesh has (inv.Nodes and inv.Overlays together, one row per node).
+	Nodes []Node
+	// Holdings is every seat whose holder is on record (inv.Holdings).
+	Holdings []catalogue.Held
+	// Licences is every licence the mesh holds, with the machines that use it (open.Licences); none for a mesh with no
+	// licence.
+	Licences []Licence
+
+	// OverlayCIDR is the range the mesh allocates from when no tunnel was adopted, as genesis was told it (the
+	// controller's OverlayCIDRVar); empty means DefaultOverlayCIDR. The package reads no environment.
+	OverlayCIDR string
+	// InternalSuffix is what the mesh's internal names end in (the controller's MESH_INTERNAL_SUFFIX), with or without a leading
+	// dot; empty means overlay.DefaultSuffix. A fact of the whole mesh, so it is in the Input and never read from the environment.
+	InternalSuffix string
+	// Tunnels is, by node name, the found tunnel whose key is the node's overlay key (inv.Tunnels).
+	Tunnels map[string]FoundTunnel
+	// Adopted is the hub's found tunnel and the hub's name, whether or not the hub took it (inv.AdoptedTunnel); nil
+	// when no hub has one.
+	Adopted *AdoptedTunnel
+	// CarriedPeers is every peer of the adopted tunnel (inv.CarriedPeers).
+	CarriedPeers []CarriedPeer
+	// Joining is the nodes that hold a live enrolment token (inv.NodesWithALiveToken).
+	Joining []string
+
+	// Credentials is how each pair credential a node takes from elsewhere stands, never its value (what inv.SecretFor,
+	// SharedSecretFor and GivenPairSecret would answer): held, to be made by the next send, only a person's to give, or
+	// refused. A need with no entry here is one the next send would make.
+	Credentials []Credential
+
+	// Built is every repository the mesh has built (the keys of inv.Held): what tells a reference recorded with an address
+	// from an image a module runs straight from a public registry.
+	Built []string
+	// OperatorExport is every operator-sealed secret in the mesh, for a module that keeps them (inv.OperatorExport): sealed
+	// values the composition carries without opening. Nil when the mesh has no operator key.
+	OperatorExport *catalogue.KeptExport
+
+	// Issued is the credentials made for the consumers of each provider (inv.SecretsFrom): one row for each pair credential
+	// that exists, by the provider node it is for. The grants a provider must create are read from these, so a credential not
+	// made yet has no grant until the send that makes it. An assigner fills it from the facts snapshot's Grants of each
+	// machine (go/facts, from format 2), which carry who each credential is for and never the credential.
+	Issued []Issued
+	// OwnSecrets is the own secrets held on each machine (the module_secret rows): who made each, and the key it is sealed to.
+	// Their sealed values are optional.
+	OwnSecrets []OwnSecretRow
+	// KeptCoreBoxes is the vault's box last kept for each core credential on each machine (inv.KeptCoreBoxes).
+	KeptCoreBoxes []CoreBox
+	// BusUsers is the bus's user list as the controller composes it from the bus records and the hashes it holds (composeBusUsers),
+	// for the machine that runs the bus: names and hashes, never passwords. Empty when the Input does not carry it, and then
+	// the composition uses a stand-in, named foreseen. BusMissing are the users left out of it for want of a credential.
+	BusUsers   string
+	BusMissing []string
+	// BusMinted are the bus users the mesh has minted a password hash for (inv.BusUserHash): `<node>.<module>` for a module and
+	// `provisioner.<node>` for a machine's provisioner client.
+	BusMinted []string
+	// BusMemberships is, by node, the membership sealed to it for the bus the mesh is moving to (inv.BusMemberships).
+	BusMemberships map[string]string
+	// Authority is the mesh's own certificate (identity.EstablishAuthority), public. Optional.
+	Authority string
+
+	// CurrentBuilds is, by module, the commit of the build the mesh holds for it (inv.CurrentBuilds, the commit it was built from);
+	// BuildIDs the build made from a commit of a module (inv.BuildOf), by module then commit. Read only to name the builds a
+	// declaration carries to a node-engine that reads them.
+	CurrentBuilds map[string]string
+	BuildIDs      map[string]map[string]string
+}
+
+// Issued is one pair credential made for a consumer of a provider (inv.Secret): ForProvider is its copy sealed to the
+// provider, optional.
+type Issued struct {
+	Provision      string
+	Consumer       string
+	ConsumerModule string
+	Local          string
+	Provider       string
+	ForProvider    string
+}
+
+// OwnSecretRow is one own secret held on a machine: Origin is `made` (the mesh generated it) or `accepted` (a person gave it),
+// SealedTo the sealing key it is sealed to, and Sealed its value sealed to that key, optional.
+type OwnSecretRow struct {
+	Node     string
+	Module   string
+	Name     string
+	Origin   string
+	SealedTo string
+	Sealed   string
+}
+
+// CoreBox is the vault's box for one core credential of one machine, as last kept (inv.CoreBox).
+type CoreBox struct {
+	Node       string
+	Module     string
+	Name       string
+	Generation int
+	SealedTo   string
+	Box        json.RawMessage
+}
+
+// Node is one node of the mesh and what the composition reads about it.
+type Node struct {
+	Name string
+	// Place is where it is on the private network (inv.Overlays).
+	Place Place
+	// Assigned is the modules assigned to it, in the order the controller reads them (inv.Assigned).
+	Assigned []string
+	// Capabilities are the ones present on it (inv.ProfileOf).
+	Capabilities map[string]bool
+	// PublicDomain is the domain it composes its routed names under (inv.PublicDomainOf).
+	PublicDomain string
+	// Account, AccountHome, AgentAccount and AgentAccountHome are its operator and agent logins (inv.NodeByName).
+	Account, AccountHome, AgentAccount, AgentAccountHome string
+	// Adopted is whether it is adopted rather than converged.
+	Adopted bool
+	// Pins is the provider each provision was pinned to for it (inv.PinsFor).
+	Pins map[string]catalogue.Chosen
+	// Bound is where each of its consumers of a provision that keeps data was last sent (inv.BindingsFor), by consumer
+	// module and provision. An assigner fills it from the facts snapshot's Bindings of the machine (go/facts, from format 2).
+	Bound map[string]map[string]catalogue.Chosen
+	// Settings is its settings layers by module (inv.SettingsFor); a module with none is absent.
+	Settings map[string][]catalogue.Layer
+	// Ports is the machine port each module's software port was given on it (inv.PortsFor), by module then port.
+	Ports map[string]map[int]int
+	// SealingKey is the public key its secrets are sealed to (inv.SealingKeyOf); empty when it has none. A public key, so
+	// nothing secret.
+	SealingKey string
+	// Taken is the modules taken on it, for an adopted node (inv.Taken).
+	Taken []string
+	// OutwardLinks are the links it reported as facing outside it (inv.OutwardLinksOf).
+	OutwardLinks []string
+	// Networks are the networks it reported being attached to, as link and network (inv.MachineOf); NetworksSaid is whether
+	// its node-engine said any at all, which is not the same as saying none.
+	Networks     []catalogue.AttachedNetwork
+	NetworksSaid bool
+	// ServingKey is the key the machine serves with, which a certificate is issued for (identity.ServingKeyOf); empty when it has
+	// never reported one. Certificate is the certificate the mesh issued for its internal name, public and optional.
+	ServingKey  string
+	Certificate string
+	// Sequence, Epoch and Generation are what the declaration is sent under (inv.Sequence, SentEpoch, SentGeneration): the order
+	// against every other send to the node, the lease epoch and the assignment generation it was last sent. Zero is not sent.
+	Sequence   int64
+	Epoch      uint64
+	Generation int64
+	// ReadsModules says its node-engine reads a module per resource and a build per module (inv.ReadsModules, issue 1145); only
+	// then are they sent. SentBuilds is the build of each module it was last sent, by module to commit, and SentKnown whether
+	// that is known at all (inv.SentBuilds); Runs is what each of its assignments runs (inv.AssignmentRuns), by module.
+	ReadsModules bool
+	SentBuilds   map[string]string
+	SentKnown    bool
+	Runs         map[string]Run
+	// Kept is, by module, the manifest of a recorded or core module kept at the build this machine runs (plan.go keepRecorded:
+	// the caller reads it with recordedKept and ManifestAt), and KeptBuilds the commit of that build. They apply to this node's
+	// own resolution only, never to another node's, and a declaration carries the kept commit for the module.
+	Kept       map[string]catalogue.Manifest
+	KeptBuilds map[string]string
+	// Contract is the contract of its node-engine's newest statement (inv.HealthOf); Stated is whether it ever stated one.
+	Contract int
+	Stated   bool
+}
+
+// Place is where a node is, as its placement says (inv.Overlay).
+type Place struct {
+	Key      string
+	Endpoint string
+	Site     string
+	Hub      bool
+	Address  string
+}
+
+// Reachable says whether the node can be dialled.
+func (p Place) Reachable() bool { return strings.TrimSpace(p.Endpoint) != "" }
+
+// Tunnel is a tunnel found on a node (inv.Tunnel).
+type Tunnel struct {
+	Interface string
+	Unit      string
+	Config    string
+	Port      int
+	MTU       int
+	// Address is the interface's own address with its prefix length, Range the network that prefix names.
+	Address   string
+	Range     string
+	PublicKey string
+	Peers     []TunnelPeer
+}
+
+// TunnelPeer is one peer of a found tunnel.
+type TunnelPeer struct {
+	PublicKey string
+	Address   string
+}
+
+// FoundTunnel is a node's tunnel and whether the node is adopted (inv.FoundTunnel).
+type FoundTunnel struct {
+	Tunnel
+	NodeAdopted bool
+}
+
+// AdoptedTunnel is the hub's tunnel, the hub's name, and whether the hub's overlay key is the tunnel's, which is
+// whether the private network took the tunnel over.
+type AdoptedTunnel struct {
+	Tunnel  Tunnel
+	Hub     string
+	Adopted bool
+}
+
+// CarriedPeer is a peer of the adopted tunnel (inv.CarriedPeer).
+type CarriedPeer struct {
+	PublicKey  string
+	Address    string
+	EnrolledAs string
+	Named      string
+}
+
+// Licence is one licence the mesh holds: its name, what a consumer may know of it, and the machines and modules
+// that use it.
+type Licence struct {
+	Name    string
+	Serves  map[string]any
+	Holders []Holder
+	// Keys is, by holder, the licence's key sealed to that holder's machine (held.KeyFor), empty where the mesh holds none:
+	// the plaintext was discarded when it was supplied. Optional: nil means not given, and the composition uses a stand-in named
+	// foreseen; given (even empty), a holder with no entry is one the mesh holds no key for.
+	Keys map[Holder]string
+	// Manager is the holder of a refreshable-grant licence that manages it (held.ManagerOf); the zero Holder when none.
+	Manager Holder
+}
+
+// Holder is a module on a node that uses a licence.
+type Holder struct {
+	Node   string
+	Module string
+}
+
+// ErrNoSuchNode is what the controller's inventory answers for a node it does not have.
+var ErrNoSuchNode = errors.New("no node of that name")
+
+// node is the node of that name, or the refusal the controller's inventory gives for one it does not have.
+func (in Input) node(name string) (Node, error) {
+	for _, n := range in.Nodes {
+		if n.Name == name {
+			return n, nil
+		}
+	}
+	return Node{}, fmt.Errorf("%w: %s", ErrNoSuchNode, name)
+}
+
+// sorted is the nodes by name, the order the controller reads them in.
+func (in Input) sorted() []Node {
+	out := append([]Node(nil), in.Nodes...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// CredentialState is how one pair credential stands.
+type CredentialState string
+
+const (
+	// CredentialHeld is a credential held for both ends as they stand now. Sealed, when given, is the consumer's copy; a held
+	// credential with no value is composed with a stand-in, named foreseen.
+	CredentialHeld CredentialState = "held"
+	// CredentialWouldMake is a credential none is held for: the next send makes it, and the composition uses a stand-in,
+	// named foreseen. It is also what a need with no entry is.
+	CredentialWouldMake CredentialState = "would-make"
+	// CredentialNotGiven is a credential only a person gives (novox/hq ADR 0337 clause 4) that nobody has given, or that was given
+	// under a key one end no longer has: the consumer still resolves, without it. Why is the controller's words for it.
+	CredentialNotGiven CredentialState = "not-given"
+	// CredentialRefused is a credential the send would refuse to make, for the reason Why gives in the controller's words: a
+	// value a person gave sealed to a key the machine no longer has, a machine with no sealing key.
+	CredentialRefused CredentialState = "refused"
+)
+
+// Credential is the state of one pair credential, by the ends it joins: the provision, the consumer's node and module, the
+// provider's node, and the local name where a module keeps several (inv.Secret's key).
+type Credential struct {
+	Provision      string
+	Consumer       string
+	ConsumerModule string
+	Provider       string
+	Local          string
+	State          CredentialState
+	// Sealed is the consumer's copy as it is sealed to the consumer's key; optional, and only the controller's adapter passes it.
+	Sealed string
+	// Why is the words of a CredentialNotGiven or CredentialRefused.
+	Why string
+}
+
+// Run is the build an assignment names: the commit it is of and the build made from it (chain.Ref).
+type Run struct {
+	Commit string
+	Build  string
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/network.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/network.go
new file mode 100644
index 00000000..1e66c516
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/network.go
@@ -0,0 +1,262 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// The private network: who is on it, where, and what they are called. Ported from mesh-controller
+// cmd/mesh-controller/network.go at 6c2a8d62.
+
+// DefaultOverlayCIDR is the range the mesh allocates from when nothing says another.
+const DefaultOverlayCIDR = "10.42.0.0/16"
+
+// composer is one composition over an Input: it reads Input, changes nothing in it, and keeps what the controller
+// said on its standard error as lines to return.
+type composer struct {
+	in   Input
+	said []string
+	seen map[string]bool
+}
+
+func newComposer(in Input) *composer { return &composer{in: in, seen: map[string]bool{}} }
+
+// say keeps a line the controller would have written to its log, once.
+func (c *composer) say(format string, args ...any) {
+	line := fmt.Sprintf(format, args...)
+	if c.seen[line] {
+		return
+	}
+	c.seen[line] = true
+	c.said = append(c.said, line)
+}
+
+// suffix is what the mesh's internal names end in: the Input's, and overlay.DefaultSuffix when it gives none. The package never calls
+// overlay.Suffix or overlay.InternalName, which read the environment, so the assigner and the controller compose the same names
+// from the same Input.
+func (c *composer) suffix() string {
+	if v := strings.TrimPrefix(strings.TrimSpace(c.in.InternalSuffix), "."); v != "" {
+		return v
+	}
+	return overlay.DefaultSuffix
+}
+
+// internalName is a node's name inside the mesh.
+func (c *composer) internalName(node string) string { return node + "." + c.suffix() }
+
+// saidBeside is the lines already said and then every line the composer kept, once each, in the order they were found.
+func (c *composer) saidBeside(lines []string) []string {
+	for _, l := range c.said {
+		if !slices.Contains(lines, l) {
+			lines = append(lines, l)
+		}
+	}
+	return lines
+}
+
+// overlayRange is the range the mesh allocates node addresses from: the adopted tunnel's first (novox/hq ADR 0105),
+// then the range genesis was told, then the default.
+func (c *composer) overlayRange() string {
+	if a := c.in.Adopted; a != nil && a.Adopted {
+		return a.Tunnel.Range
+	}
+	if v := strings.TrimSpace(c.in.OverlayCIDR); v != "" {
+		return v
+	}
+	return DefaultOverlayCIDR
+}
+
+// network builds the private network over the machines that resolved the module for it. A machine is on it because it
+// was given the module, or because it is joining with a key and an address (novox/hq ADR 0169).
+func (c *composer) network(on map[string]bool, refused map[string]string) (*overlay.Generator, error) {
+	tunnels := c.in.Tunnels
+	carried := c.in.CarriedPeers
+	isJoining := map[string]bool{}
+	for _, name := range c.in.Joining {
+		isJoining[name] = true
+	}
+	var nodes []overlay.Node
+	for _, node := range c.in.sorted() {
+		p := node.Place
+		if !on[node.Name] && !(isJoining[node.Name] && p.Key != "" && p.Address != "") {
+			continue
+		}
+		n := overlay.Node{
+			Name: node.Name, Key: p.Key, Endpoint: p.Endpoint,
+			Site: p.Site, Hub: p.Hub, Address: p.Address,
+		}
+		if t, takes := tunnels[node.Name]; takes && t.NodeAdopted {
+			// Only an adopted node is told to take the found unit over. A hub whose placement disagrees with the tunnel is
+			// refused, not composed.
+			if wrong := disagrees(p, t.Tunnel); wrong != "" {
+				return nil, fmt.Errorf("%s takes over the tunnel on %s and its placement disagrees with it: %s. "+
+					"Re-place it — `overlay place %s --hub --endpoint <host>:%d …` — and push again; "+
+					"nothing was composed", node.Name, t.Interface, wrong, node.Name, t.Port)
+			}
+			n.TakesOver = &overlay.TakeOver{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU}
+		}
+		if p.Hub {
+			for _, cp := range carried {
+				n.Carried = append(n.Carried, overlay.Carried{Key: cp.PublicKey, Address: cp.Address})
+			}
+		}
+		nodes = append(nodes, n)
+	}
+	if len(nodes) == 0 {
+		// Nobody was given it: an empty network is a legitimate mesh, not a broken one.
+		return overlay.Empty(), nil
+	}
+	g, err := overlay.From(nodes, c.overlayRange(), "")
+	if err != nil && len(refused) > 0 {
+		// The network is missing something, and some machines could not be resolved at all: almost always the same fact.
+		var who []string
+		for name, why := range refused {
+			who = append(who, fmt.Sprintf("  %s: %s", name, why))
+		}
+		sort.Strings(who)
+		return nil, fmt.Errorf("%w\n\nand %d node(s) could not be resolved at all, which is "+
+			"probably why:\n%s", err, len(refused), strings.Join(who, "\n"))
+	}
+	return g, err
+}
+
+// Graph is the whole mesh's network, for showing it: the nodes on it and each one's peers.
+func Graph(in Input) ([]overlay.Node, overlay.Graph, error) {
+	c := newComposer(in)
+	on, refused, err := c.whoResolves(overlay.Requirement)
+	if err != nil {
+		return nil, nil, err
+	}
+	g, err := c.network(on, refused)
+	if err != nil {
+		return nil, nil, err
+	}
+	return g.Nodes(), g.Graph(), nil
+}
+
+// whoResolves is the machines whose resolution answers a requirement, and why the others did not: by what a module
+// provides, not by its name, resolved rather than read from the assignments.
+func (c *composer) whoResolves(requirement string) (map[string]bool, map[string]string, error) {
+	on := map[string]bool{}
+	// Why a node could not be resolved, kept rather than raised: one broken node must not stop the rest being described.
+	refused := map[string]string{}
+	for _, n := range c.in.sorted() {
+		resolved, err := c.planFor(n.Name)
+		switch {
+		case unresolvable(err):
+			refused[n.Name] = err.Error()
+			continue
+		case err != nil:
+			// Not a node that does not resolve: a question that went unanswered.
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, offered := range m.Offers() {
+				if offered == requirement {
+					on[n.Name] = true
+				}
+			}
+		}
+	}
+	return on, refused, nil
+}
+
+// Generators is what every node's declaration is composed with, over the whole mesh: the private network's generator
+// (one generator now; the names and a resolver's zone file are facts a module asks for in its manifest).
+func Generators(in Input) (map[string]catalogue.Generator, error) {
+	c := newComposer(in)
+	return c.generators()
+}
+
+func (c *composer) generators() (map[string]catalogue.Generator, error) {
+	on, refused, err := c.whoResolves(overlay.Addressing)
+	if err != nil {
+		return nil, err
+	}
+	net, err := c.network(on, refused)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]catalogue.Generator{overlay.Name: net}, nil
+}
+
+// disagrees says how a node's placement differs from the tunnel it takes over — its address not the tunnel's, its
+// endpoint not on the tunnel's port — or nothing when both agree.
+func disagrees(p Place, t Tunnel) string {
+	var wrong []string
+	want := t.Address
+	if i := strings.Index(want, "/"); i >= 0 {
+		want = want[:i]
+	}
+	if p.Address != want {
+		wrong = append(wrong, fmt.Sprintf("its address is %s and the tunnel's is %s", orNothing(p.Address), want))
+	}
+	if p.Reachable() && portOfEndpoint(p.Endpoint) != strconv.Itoa(t.Port) {
+		wrong = append(wrong, fmt.Sprintf("its endpoint %s is not on the tunnel's port %d", p.Endpoint, t.Port))
+	}
+	return strings.Join(wrong, "; ")
+}
+
+func orNothing(s string) string {
+	if s == "" {
+		return "unset"
+	}
+	return s
+}
+
+// portOfEndpoint is the port in host:port, or empty.
+func portOfEndpoint(endpoint string) string {
+	if i := strings.LastIndex(endpoint, ":"); i >= 0 {
+		return endpoint[i+1:]
+	}
+	return ""
+}
+
+// whereEveryoneIs is each machine's name on the private network, for the ones on it. Resolved without consulting the
+// rest of the mesh (it is called from that path), and refused without the catalogue.
+func (c *composer) whereEveryoneIs() (map[string]string, error) {
+	if c.in.Catalogue == nil {
+		return nil, errors.New("asked where everyone is without the catalogue, which cannot be answered")
+	}
+	out := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		out[p.Name] = c.internalName(p.Name)
+	}
+	return out, nil
+}
+
+// onTheNetwork is every placed machine that resolves the private network: has an address AND runs what puts it there
+// (novox/hq issue 079). A machine that does not resolve is not counted, and said.
+func (c *composer) onTheNetwork() []Node {
+	var out []Node
+	for _, n := range c.in.sorted() {
+		if n.Place.Address == "" {
+			continue
+		}
+		if len(n.Assigned) == 0 {
+			continue
+		}
+		got, err := catalogue.Resolve(c.in.Catalogue, n.Assigned,
+			catalogue.Node{Name: n.Name, Site: n.Place.Site, Capabilities: n.Capabilities},
+			catalogue.World{Unchecked: true, Holdings: c.in.Holdings})
+		if err != nil {
+			c.say("%s is not counted as on the network: it does not resolve: %v", n.Name, err)
+			continue
+		}
+		for _, m := range got.Modules {
+			for _, offered := range m.Offers() {
+				if offered == overlay.Requirement {
+					out = append(out, n)
+				}
+			}
+		}
+	}
+	return out
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/node.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/node.go
new file mode 100644
index 00000000..858f77da
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/node.go
@@ -0,0 +1,335 @@
+package compose
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/validate"
+)
+
+// Declared is a declaration as a machine is sent it (the controller's sendable, sendable.go): its resources and, for an adopted
+// node, its mode and which modules were taken on it (novox/hq ADR 0100), with what the composition says beside it and never puts on
+// the wire.
+//
+// **Body is the only place the envelope is marshalled**, so the digest the mesh compares and the body validated are one.
+type Declared struct {
+	Resources []map[string]any
+	// Sequence, Epoch and Generation are what the Input gave the node: zero is not sent at all.
+	Sequence   int64
+	Epoch      uint64
+	Generation int64
+	// ReadsModules says the machine's node-engine reads a module per resource and a build per module (novox/hq issue 1145): only
+	// then are they sent. ModuleOf is the composer's owner of each resource id and BuildIDs the build each module carries.
+	ReadsModules bool
+	ModuleOf     map[string]string
+	BuildIDs     map[string]string
+	// Adoption is nil for a converged node, and then the body is byte for byte what it was before adoption existed.
+	Adoption *Adoption
+	// Filled is the path of every file this declaration hands to the provisioner, and Provisioner the account its client runs as
+	// (novox/hq ADR 0349): on the wire as `filled_files` and `provisioner_account`, both absent when nothing is handed.
+	Filled      []string
+	Provisioner string
+	// LeftOut is every module of the machine's set left out because a stored setting cannot compose with its definition (novox/hq
+	// ADR 0163, rule 6), sorted; LeftOutWhy is why each was.
+	LeftOut    []string
+	LeftOutWhy map[string]string
+
+	// Not on the wire:
+	Received map[string]map[string][]catalogue.Contribution
+	Mesh     []string
+	BusUsers string
+	// Modules are the modules this declaration names, sorted.
+	Modules []string
+	// LocalNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR 0340).
+	LocalNetwork []catalogue.LocalNetworkPort
+	Withheld     []catalogue.Overflow
+	Unbound      []catalogue.Unbound
+	Unplaced     []string
+	HandedOnly   []string
+	// RequiredBy is, for each handed module only pulled in by another, the module that requires it (issue 765).
+	RequiredBy map[string]string
+	// Foreseen is every own secret composed with a stand-in, as `module/name`; StoodIn is everything the composition stood in for
+	// (an own secret, a grant's sealed copy, the certificate, the bus's user list); ForeseenPorts the ports the mesh may assign that
+	// the Input holds none for. A declaration that has any is never sent: what a send would make, named, never invented.
+	Foreseen      []string
+	StoodIn       []string
+	ForeseenPorts []string
+	// CoreBoxesWanted are the core credentials whose box the send must ask the vault for and keep.
+	CoreBoxesWanted []CoreBoxWanted
+	// Passes are the seats the mesh would pass on, for the caller to record, and Said the lines found while composing.
+	Passes Passes
+	Said   []string
+}
+
+// Adoption is what an adopted node is told about its mode. Taken is every module taken on it that it runs; Untaken is, for every
+// module it runs that is not taken, the ids of every one of that module's resources: what the host keeps as found until the module
+// is taken (ADR 0103).
+type Adoption struct {
+	Taken   []string            `json:"taken"`
+	Untaken map[string][]string `json:"untaken,omitempty"`
+}
+
+// Body is the declaration's bytes, as sent and as digested.
+func (d Declared) Body() ([]byte, error) {
+	envelope := map[string]any{"declaration": 1, "resources": d.Resources}
+	if d.ReadsModules {
+		// The module of each resource the composer owns, and the build of each module (novox/hq issue 1145): to a machine that
+		// said it reads them, and no other.
+		named := make([]map[string]any, len(d.Resources))
+		for n, r := range d.Resources {
+			module, owned := d.ModuleOf[fmt.Sprint(r["id"])]
+			if !owned {
+				named[n] = r
+				continue
+			}
+			with := make(map[string]any, len(r)+1)
+			for k, v := range r {
+				with[k] = v
+			}
+			with["module"] = module
+			named[n] = with
+		}
+		envelope["resources"] = named
+		if len(d.BuildIDs) > 0 {
+			envelope["builds"] = d.BuildIDs
+		}
+	}
+	if d.Adoption != nil {
+		envelope["adoption"] = d.Adoption
+	}
+	if d.Sequence > 0 {
+		envelope["sequence"] = d.Sequence
+	}
+	if d.Epoch > 0 {
+		envelope["epoch"] = d.Epoch
+	}
+	if len(d.LeftOut) > 0 {
+		envelope["left_out"] = d.LeftOut
+	}
+	if d.Generation > 0 {
+		envelope["generation"] = d.Generation
+	}
+	if len(d.Filled) > 0 {
+		envelope["filled_files"] = d.Filled
+		envelope["provisioner_account"] = d.Provisioner
+	}
+	// An empty declaration is deliberate: the node owns nothing the mesh put there (novox/hq issue 127), and the host refuses an
+	// empty body unless it is told the emptiness is meant.
+	if len(d.Resources) == 0 {
+		envelope["owns_nothing"] = true
+	}
+	return json.Marshal(envelope)
+}
+
+// Refusals are the findings a check refuses a change for, beside the validator's problems: a consumer left out of the grants
+// because its identity overflows the provision's bound, and a credential bound to another consumer (novox/hq ADR 0446 clause 1).
+// Each names the consumer and the provision.
+func (d Declared) Refusals() []string {
+	var out []string
+	for _, o := range d.Withheld {
+		out = append(out, o.String())
+	}
+	for _, u := range d.Unbound {
+		out = append(out, u.String())
+	}
+	sort.Strings(out)
+	return out
+}
+
+// Compose composes one node's declaration (the issue calls it Node; the Input already has a type of that name) over an Input -- as a push would, without the sending (the controller's
+// composedAndValidated in the Foreseeing mode) -- and runs the node-engine's own validator over its body. An error is that the
+// node did not compose (a set that does not compose satisfies IsUnresolvable); problems are what the validator refuses, in the
+// node-engine's words. It allocates, makes, keeps and writes nothing, and names what a send would do as foreseen.
+func Compose(in Input, node string) (Declared, []string, error) {
+	return ComposeIn(in, node, Foreseeing)
+}
+
+// ComposeIn is Compose in a chosen mode.
+func ComposeIn(in Input, node string, mode Mode) (Declared, []string, error) {
+	c := newComposer(in)
+	d, err := c.declaration(node, mode)
+	if err != nil {
+		return Declared{}, nil, err
+	}
+	body, err := d.Body()
+	if err != nil {
+		return Declared{}, nil, err
+	}
+	return d, validate.Declaration(body), nil
+}
+
+// declaration is the controller's declarationWith over the plain Input.
+func (c *composer) declaration(nodeName string, mode Mode) (Declared, error) {
+	resolved, err := c.planFor(nodeName)
+	if err != nil {
+		return Declared{}, err
+	}
+	gens, err := c.generators()
+	if err != nil {
+		return Declared{}, err
+	}
+	rendered, err := c.render(nodeName, mode)
+	if err != nil {
+		return Declared{}, err
+	}
+	with := rendered.Rendering
+	with.Generators = gens
+	plan := resolved.Plan
+	composed, err := plan.Compose(with)
+	if err != nil {
+		return Declared{}, err
+	}
+	// Which ports the filter admits from the local network, and from which networks (novox/hq ADR 0340 clause 8): the same rules the
+	// composition rendered, never sent.
+	rules, err := plan.Rules(with)
+	if err != nil {
+		return Declared{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Declared{}, err
+	}
+	out := Declared{Resources: composed.Resources, Adoption: adoptionFor(plan, node, composed),
+		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
+		LeftOut: sortedKeysOf(composed.LeftOut), LeftOutWhy: composed.LeftOut,
+		Withheld: rendered.Withheld, Unbound: rendered.Unbound,
+		Foreseen: composed.Foreseen, StoodIn: rendered.Foreseen, ForeseenPorts: rendered.ForeseenPorts,
+		Unplaced: composed.Unplaced, HandedOnly: composed.HandedOnly, Modules: namedModules(plan, composed.LeftOut),
+		Filled: composed.Filled, LocalNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks),
+		CoreBoxesWanted: rendered.CoreBoxesWanted, Said: rendered.Said,
+		Sequence: node.Sequence, Epoch: node.Epoch, Generation: node.Generation}
+	if len(composed.Filled) > 0 {
+		out.Provisioner = with.Provisioner
+	}
+	// A handed module only pulled in by another keeps what requires it, for its value of its own in the assignments mirror (issue 765).
+	for module := range composed.Plans {
+		if by := plan.RequiredBy(module); by != "" {
+			if out.RequiredBy == nil {
+				out.RequiredBy = map[string]string{}
+			}
+			out.RequiredBy[module] = by
+		}
+	}
+	// And the module of each resource and the build of each module, to a machine whose node-engine said it reads them (novox/hq issue
+	// 1145) and to no other.
+	if node.ReadsModules {
+		carried := c.carriedOn(node, plan, composed.LeftOut)
+		out.ReadsModules, out.ModuleOf, out.BuildIDs = true, composed.Owner, c.wireBuilds(carried, node.Runs)
+	}
+	_, passes, left, err := c.theRestOfTheMesh("")
+	if err != nil {
+		return Declared{}, err
+	}
+	out.Passes = passes
+	for _, l := range left {
+		out.Said = append(out.Said, l.String())
+	}
+	out.Said = c.saidBeside(out.Said)
+	return out, nil
+}
+
+// carriedOn is the build of each module a declaration for the node carries (plan.go carriedOn, in a question that sends nothing): the
+// module's current build for each module in it, and for a module left out of it the build it was last sent, since the machine keeps
+// that one -- or nothing, when that is not known.
+func (c *composer) carriedOn(node Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
+	before := node.SentBuilds
+	if !node.SentKnown {
+		before = nil
+	}
+	out := map[string]string{}
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; left {
+			if was, kept := before[m.Module]; kept {
+				out[m.Module] = was
+			}
+			continue
+		}
+		out[m.Module] = c.in.CurrentBuilds[m.Module]
+		// A module kept at the build the machine runs is carried at that build (plan.go carriedOn).
+		if kept, ok := node.KeptBuilds[m.Module]; ok && kept != "" {
+			out[m.Module] = kept
+		}
+	}
+	return out
+}
+
+// wireBuilds is the build of each carried module that goes on the wire (novox/hq issue 1145): the build its assignment names when
+// that assignment is of the commit carried, else the build made from that commit; a module with neither is not named.
+func (c *composer) wireBuilds(carried map[string]string, runs map[string]Run) map[string]string {
+	out := map[string]string{}
+	for module, commit := range carried {
+		if commit == "" {
+			continue
+		}
+		if ref, ok := runs[module]; ok && ref.Commit == commit && ref.Build != "" {
+			out[module] = ref.Build
+			continue
+		}
+		if build := c.in.BuildIDs[module][commit]; build != "" {
+			out[module] = build
+		}
+	}
+	return out
+}
+
+// adoptionFor is the envelope computed from what was taken and who owns each resource: nil for a converged node. Every module the
+// node runs that is not taken is untaken -- including one pulled in by another rather than assigned.
+func adoptionFor(plan catalogue.Resolution, node Node, composed catalogue.Composed) *Adoption {
+	if !node.Adopted {
+		return nil
+	}
+	isTaken := map[string]bool{}
+	for _, m := range node.Taken {
+		isTaken[m] = true
+	}
+	out := &Adoption{Taken: []string{}}
+	runs := map[string]bool{}
+	for _, m := range plan.Modules {
+		runs[m.Module] = true
+		if isTaken[m.Module] {
+			out.Taken = append(out.Taken, m.Module)
+		}
+	}
+	sort.Strings(out.Taken)
+	for _, r := range composed.Resources {
+		id, _ := r["id"].(string)
+		module, owned := composed.Owner[id]
+		// Every kind, not only files and containers (novox/hq ADR 0103). What the mesh declares of its own is never held.
+		if !owned || !runs[module] || isTaken[module] || strings.HasPrefix(id, catalogue.AdoptionPrefix) {
+			continue
+		}
+		if out.Untaken == nil {
+			out.Untaken = map[string][]string{}
+		}
+		out.Untaken[module] = append(out.Untaken[module], id)
+	}
+	return out
+}
+
+// sortedKeysOf is a map's keys, sorted: so what a declaration says it left out does not move for a reordering nobody made.
+func sortedKeysOf(m map[string]string) []string {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// namedModules are the modules a declaration names: its machine's set, less what was left out of it.
+func namedModules(plan catalogue.Resolution, leftOut map[string]string) []string {
+	out := make([]string, 0, len(plan.Modules))
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; !left {
+			out = append(out, m.Module)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/render.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/render.go
new file mode 100644
index 00000000..a50a65ea
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/render.go
@@ -0,0 +1,128 @@
+package compose
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Rendered is everything a node's declaration is composed with (plan.go renderingFor), over an Input: the place half (Places)
+// and the credential half. Nothing was allocated, made, kept or written; what a send would do is returned for the caller to do.
+type Rendered struct {
+	Rendering catalogue.Rendering
+	// ForeseenPorts are the ports the mesh may assign that the Input holds none for ("<module>:<port>").
+	ForeseenPorts []string
+	// Foreseen are the stand-ins the composition used for what the Input does not hold: an own secret the next send makes
+	// ("<module>/<name>"), a grant's sealed copy, the certificate and the bus's user list.
+	Foreseen []string
+	// CoreBoxesWanted are the core credentials whose box the send must ask the vault for and keep.
+	CoreBoxesWanted []CoreBoxWanted
+	// Withheld are the consumers the grants leave out because their identity overflows the provision's bound (novox/hq ADR 0225),
+	// and Unbound those whose credential from this node is on record and whose own resolution binds them elsewhere (issue
+	// 274). The controller says them; a check refuses a change that adds one (ADR 0446 clause 1).
+	Withheld []catalogue.Overflow
+	Unbound  []catalogue.Unbound
+	// Said are the lines the controller says while composing (the bus users left out for want of a credential).
+	Said []string
+}
+
+// Render composes the rendering of a node: the grants it must create, where it puts its ports, its own secrets, the vault's boxes,
+// its certificate, the names of the mesh, the bus's user list and its membership. The refusals are the controller's, in its words;
+// where more than one fault stands, the first reported may differ from the controller's, which interleaves the halves.
+func Render(in Input, node string, mode Mode) (Rendered, error) {
+	return newComposer(in).render(node, mode)
+}
+
+func (c *composer) render(nodeName string, mode Mode) (Rendered, error) {
+	resolved, err := c.planFor(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	plan := resolved.Plan
+	var out Rendered
+	foreseen := func(s string) { out.Foreseen = append(out.Foreseen, s) }
+
+	grants, withheld, unbound, grantsForeseen, err := c.grantsFor(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	placed, err := c.places(nodeName, resolved)
+	if err != nil {
+		return Rendered{}, err
+	}
+	r := placed.Rendering
+	out.ForeseenPorts = placed.ForeseenPorts
+	r.Grants, r.Withheld, r.Unbound = grants, withheld, unbound
+	out.Withheld, out.Unbound = withheld, unbound
+	for _, g := range grantsForeseen {
+		foreseen(g)
+	}
+
+	// And each module's own secrets: a module handed to the provisioner has its secrets from the vault through the client.
+	handing := catalogue.Rendering{Hands: r.Hands, Provisioner: r.Provisioner}
+	needed, foreseenOwn, err := c.ownSecretsFor(node, plan, handing, mode)
+	if err != nil {
+		return Rendered{}, err
+	}
+	r.Needed = needed
+	if mode == Foreseeing || len(foreseenOwn) > 0 {
+		r.Foreseen = foreseenOwn
+	}
+	var names []string
+	for module, secrets := range foreseenOwn {
+		for name := range secrets {
+			names = append(names, module+"/"+name)
+		}
+	}
+	sort.Strings(names)
+	for _, n := range names {
+		foreseen(n)
+	}
+
+	// The core's own credentials as the vault sealed them, for an engine that opens the vault's box.
+	if node.Stated && node.Contract >= VaultBoxContract {
+		sealed, notPlaced, wanted := c.coreBoxesFor(node, plan.Modules, handing)
+		r.VaultSealed, r.NotPlaced = sealed, notPlaced
+		out.CoreBoxesWanted = wanted
+	}
+
+	// And a certificate for this machine's name inside the mesh, when anything on it asks.
+	for _, m := range plan.Modules {
+		if m.Certificate == nil {
+			continue
+		}
+		certificate, authority, stood, err := c.certificateFor(node)
+		if err != nil {
+			return Rendered{}, err
+		}
+		r.Certificate, r.Authority = certificate, authority
+		if stood {
+			foreseen("the certificate and the authority of " + nodeName)
+		}
+		break
+	}
+
+	// The bus's user list, for the machine that runs the bus: names and hashes the Input carries, never passwords.
+	if holdsTheBus(plan.Modules) {
+		r.BusUsers = c.in.BusUsers
+		if r.BusUsers == "" {
+			r.BusUsers = ForeseenBusUsers
+			foreseen("the bus's user list")
+		}
+		if len(c.in.BusMissing) > 0 {
+			out.Said = append(out.Said, fmt.Sprintf("the bus's user list leaves out %d user(s) the mesh has minted no credential "+
+				"for: %s. Each is a user that cannot connect until one is issued", len(c.in.BusMissing), strings.Join(c.in.BusMissing, ", ")))
+		}
+	}
+	r.BusMembership = c.in.BusMemberships[nodeName]
+	out.Rendering = r
+	// And what the composition found on the way, which the controller writes to its log: a machine not counted as on the network.
+	out.Said = c.saidBeside(out.Said)
+	return out, nil
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/rendering.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/rendering.go
new file mode 100644
index 00000000..468683d3
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/rendering.go
@@ -0,0 +1,532 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// The contracts of the node-engine's statement that gate what a machine is sent, as the controller's link package names them
+// (mesh-controller internal/link/protocol.go at 6c2a8d62). An older engine parses strictly and refuses a field it does not
+// know, whole.
+const (
+	ReadinessContract = 2  // the engine reads a resource's `health` (novox/hq ADR 0240)
+	RootContract      = 3  // the engine judges a user's declared `root` (ADR 0266)
+	BusyContract      = 8  // the engine reads a container's `busy` (ADR 0335)
+	HandedContract    = 11 // the engine writes a filled file on the provisioner client's word alone
+	VaultBoxContract  = 12 // the engine opens the vault's box
+)
+
+// The provisioner client's seat and own secret (the controller's broker.NodeProvisionerSeat and ProvisionerSecret).
+const (
+	NodeProvisionerSeat = "node-provisioner"
+	ProvisionerSecret   = "provisioner-broker"
+)
+
+// ErrPortTaken is the controller's refusal for a machine port held twice on one machine.
+var ErrPortTaken = errors.New("that port is already held on this machine")
+
+// Placed is the place half of a rendering (plan.go renderingFor): where a machine puts what its modules need reachable, the
+// seats and who holds them, the names of the mesh, the networks, accounts and the operator's export. It is a catalogue.Rendering
+// with those fields set, and the ports it could not read named foreseen. Nothing was allocated.
+type Placed struct {
+	Rendering catalogue.Rendering
+	// ForeseenPorts are the ports the mesh may assign that the Input holds none for, as "<module>:<port>": composed with the
+	// manifest's own number as the Reading mode composes them, and never invented. The controller's adapter allocates and
+	// composes again.
+	ForeseenPorts []string
+}
+
+// Places composes the place half of the rendering for a node (the controller's renderingFor in the Reading and Foreseeing modes,
+// without the credentials): over an Input, allocating nothing and changing nothing in it. The refusals are the controller's,
+// in its words.
+func Places(in Input, node string) (Placed, error) {
+	c := newComposer(in)
+	resolved, err := c.planFor(node)
+	if err != nil {
+		return Placed{}, err
+	}
+	return c.places(node, resolved)
+}
+
+func (c *composer) places(nodeName string, resolved Resolved) (Placed, error) {
+	var out Placed
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return out, err
+	}
+	plan, settings := resolved.Plan, resolved.Settings
+	r := &out.Rendering
+
+	// Where this machine puts what each module needs reachable (novox/hq ADR 0038): what it was already given, and the ports
+	// it was given over those (ADR 0100).
+	given, err := c.portsFor(node, plan, settings, r, &out.ForeseenPorts)
+	if err != nil {
+		return out, err
+	}
+
+	// Hands: whether the engine writes a filled file on the provisioner client's word alone; engines older than a contract are
+	// not sent the field they would refuse.
+	r.Hands = takesHanded(node)
+	r.Provisioner = provisionerAccount(plan)
+	r.ReadsHealth = node.Stated && node.Contract >= ReadinessContract
+	r.JudgesRoot = node.Stated && node.Contract >= RootContract
+	r.ReadsBusy = node.Stated && node.Contract >= BusyContract
+
+	// And who else is on the private network, which is what a rule saying "from the mesh" resolves to.
+	r.Mesh = c.onThePrivateNetwork()
+	// The private network's range, offered to a module as ${machine:mesh-range}.
+	r.MeshRange = c.overlayRange()
+
+	// The artifact store as this node reaches it now, with what the mesh has built.
+	store, err := c.artifactStoreAddress(nodeName)
+	if err != nil {
+		return out, err
+	}
+	r.ArtifactStore = store
+	r.Built = make(map[string]bool, len(c.in.Built))
+	for _, repository := range c.in.Built {
+		r.Built[repository] = true
+	}
+
+	// And every machine's name, so a container can reach one.
+	r.Names = c.namesInTheMesh()
+
+	// Each machine's operator account, so an ssh Host block can name the login for every node (novox/hq to-be 29).
+	r.Accounts = map[string]string{}
+	for _, n := range c.in.sorted() {
+		if n.Account != "" {
+			r.Accounts[n.Name] = n.Account
+		}
+	}
+
+	// The roster is the machines and nothing else (novox/hq ADR 0191).
+	r.Machines = make(map[string]string, len(r.Names))
+	for name, at := range r.Names {
+		r.Machines[name] = at
+	}
+
+	// And every zone a module in the mesh answers itself (novox/hq ADR 0199).
+	zones, err := c.zonesInTheMesh()
+	if err != nil {
+		return out, err
+	}
+	r.Zones = zones
+
+	// And who holds each replicated seat, where (novox/hq ADR 0223).
+	r.Holders = c.replicatedHolders()
+
+	r.Suffix, r.TunnelInterface = c.suffix(), overlay.Interface
+
+	// And, for a module that keeps them, every operator-sealed secret in the mesh (novox/hq ADR 0085, amended).
+	for _, m := range plan.Modules {
+		if m.Keeps == "" {
+			continue
+		}
+		r.Kept = c.in.OperatorExport
+		break
+	}
+
+	// Whether this node is adopted (novox/hq ADR 0100), and which modules were taken there.
+	r.Adopted = node.Adopted
+	var taken map[string]bool
+	if node.Adopted {
+		taken = map[string]bool{}
+		for _, m := range node.Taken {
+			taken[m] = true
+		}
+	}
+	r.Taken = taken
+
+	// Where this node put the foundation's servers (novox/hq 04-ISSUES/102).
+	seats, err := c.seatsOn(node, plan.Modules, node.Adopted, taken)
+	if err != nil {
+		return out, err
+	}
+	r.Seats = seats
+
+	// Which of this machine's links face outside (novox/hq ADR 0140), and which of its networks count as its local network
+	// (ADR 0340).
+	r.OutwardLinks = node.OutwardLinks
+	r.LocalNetworks = catalogue.CountedLocalNetworks(localNetworksOf(node))
+
+	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR 0222).
+	if store != "" {
+		r.SeatReach = map[string]string{"mesh-artifact-store": store}
+	}
+	r.Settings = settings
+	r.Given = given
+	return out, nil
+}
+
+// takesHanded says whether a machine's newest statement is of an engine that writes a filled file on the provisioner client's
+// word alone.
+func takesHanded(n Node) bool { return n.Stated && n.Contract >= HandedContract }
+
+// provisionerAccount is the account the provisioner's client runs as on this machine (novox/hq ADR 0349 clause 4): the user
+// the process of the module running it runs as, empty where no such module is on the machine.
+func provisionerAccount(plan catalogue.Resolution) string {
+	for _, m := range plan.Modules {
+		if !runsTheProvisionerClient(m) {
+			continue
+		}
+		for _, r := range m.Resources {
+			if r["type"] == "process" {
+				if user, _ := r["user"].(string); user != "" && user != "root" {
+					return user
+				}
+			}
+		}
+	}
+	return ""
+}
+
+// runsTheProvisionerClient says a module runs its machine's provisioner client: it claims the seat and declares the own
+// secret that account is delivered in.
+func runsTheProvisionerClient(m catalogue.Manifest) bool {
+	_, reads := m.OwnSecrets[ProvisionerSecret]
+	return reads && m.ClaimsSeat(NodeProvisionerSeat)
+}
+
+// portsFor is where a node puts what each module needs reachable, in the Reading mode: the ports it was given win, then the
+// ones the mesh assigned, and a port the Input holds none for is composed as the manifest says and named foreseen. One holder
+// per machine port across the node's modules: settings written before this was refused are refused here.
+func (c *composer) portsFor(node Node, plan catalogue.Resolution, settings catalogue.SettingsBy, r *catalogue.Rendering,
+	foreseen *[]string) (map[string]map[int]int, error) {
+	already := node.Ports
+
+	given := map[string]map[int]int{}
+	for _, m := range plan.Modules {
+		g, err := catalogue.GivenPorts(m, settings[m.Module])
+		if err != nil {
+			// A given port its definition no longer publishes: the module is left out of the declaration, by name, when it is
+			// composed (novox/hq ADR 0163, rule 6) -- never the machine refused here for it.
+			continue
+		}
+		if g != nil {
+			given[m.Module] = g
+		}
+	}
+	holders := map[int]string{}
+	for _, m := range plan.Modules {
+		for _, at := range given[m.Module] {
+			if other, twice := holders[at]; twice && other != m.Module {
+				return nil, fmt.Errorf("%w: %s and %s are both given machine port %d on %s", ErrPortTaken, other, m.Module,
+					at, node.Name)
+			}
+			holders[at] = m.Module
+		}
+	}
+
+	ports := map[string]map[int]int{}
+	for _, m := range plan.Modules {
+		for _, l := range m.Listens {
+			if at, isGiven := given[m.Module][l.Port]; isGiven {
+				if ports[m.Module] == nil {
+					ports[m.Module] = map[int]int{}
+				}
+				ports[m.Module][l.Port] = at
+				continue
+			}
+			// Only a port the module actually publishes is the mesh's to move. Recorded either way, because this map means where
+			// this module's port is on this machine.
+			where, mayAssign := m.MachineSide(l.Port)
+			if mayAssign {
+				// Whatever was chosen last time, and nothing if there was no last time.
+				if at, known := already[m.Module][l.Port]; known {
+					where = at
+				} else {
+					*foreseen = append(*foreseen, fmt.Sprintf("%s:%d", m.Module, l.Port))
+				}
+			}
+			if ports[m.Module] == nil {
+				ports[m.Module] = map[int]int{}
+			}
+			ports[m.Module][l.Port] = where
+		}
+	}
+	r.Ports = ports
+	return given, nil
+}
+
+// onThePrivateNetwork is every node's address on the private network, sorted: the same set the names mean by it, so a rule
+// saying "from the mesh" admits exactly the machines the mesh names. A node with no address is left out, not rendered as an
+// empty source.
+func (c *composer) onThePrivateNetwork() []string {
+	var out []string
+	for _, p := range c.onTheNetwork() {
+		if strings.TrimSpace(p.Place.Address) != "" {
+			out = append(out, p.Place.Address)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// namesInTheMesh is every machine's internal name and the address behind it, for every machine on the private network, and
+// the carried peers the operator has named (novox/hq issue 112).
+func (c *composer) namesInTheMesh() map[string]string {
+	out := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		out[c.internalName(p.Name)] = p.Place.Address
+	}
+	for _, p := range c.in.CarriedPeers {
+		if p.Named == "" || p.EnrolledAs != "" {
+			continue
+		}
+		if _, taken := out[c.internalName(p.Named)]; taken {
+			continue // a node of the mesh owns the name; the stale statement loses
+		}
+		out[c.internalName(p.Named)] = p.Address
+	}
+	return out
+}
+
+// artifactStoreOnNetwork is the machine on this network that offers the artifact store, and the port that machine put it on.
+func (c *composer) artifactStoreOnNetwork(on map[string]bool) (node, port string, found bool, err error) {
+	providers := map[string]catalogue.Manifest{}
+	for name, m := range c.in.Catalogue {
+		if _, offers := m.Serves[catalogue.ArtifactStoreProvision]; offers {
+			providers[name] = m
+		}
+	}
+	if len(providers) == 0 {
+		return "", "", false, nil
+	}
+	// In a stated order, so two machines offering it would always answer the same one.
+	machines := make([]string, 0, len(on))
+	for machine := range on {
+		machines = append(machines, machine)
+	}
+	sort.Strings(machines)
+	for _, machine := range machines {
+		n, err := c.in.node(machine)
+		if err != nil {
+			return "", "", false, fmt.Errorf("reading what %s is assigned: %w", machine, err)
+		}
+		for _, a := range n.Assigned {
+			m, offers := providers[a]
+			if !offers {
+				continue
+			}
+			serves, _, err := c.servedOnNode(machine, m, catalogue.ArtifactStoreProvision)
+			if err != nil {
+				return "", "", false, fmt.Errorf("reading where %s puts the artifact store: %w", machine, err)
+			}
+			if p, ok := serves["port"]; ok {
+				return machine, fmt.Sprintf("%v", p), true, nil
+			}
+		}
+	}
+	return "", "", false, nil
+}
+
+// artifactStoreAddress is the artifact store as `forNode` reaches it: `<node>.internal:<port>` over the private network, or
+// `127.0.0.1:<port>` for the node that holds the store itself when nothing is on the network yet, and empty for any other
+// (novox/hq 04-ISSUES/102).
+func (c *composer) artifactStoreAddress(forNode string) (string, error) {
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return "", err
+	}
+	on := map[string]bool{}
+	for name := range onNetwork {
+		on[name] = true
+	}
+	node, port, found, err := c.artifactStoreOnNetwork(on)
+	if err != nil {
+		return "", err
+	}
+	if found {
+		return c.internalName(node) + ":" + port, nil
+	}
+	all := map[string]bool{}
+	for _, n := range c.in.Nodes {
+		all[n.Name] = true
+	}
+	holder, port, found, err := c.artifactStoreOnNetwork(all)
+	if err != nil || !found || holder != forNode {
+		return "", err
+	}
+	return "127.0.0.1:" + port, nil
+}
+
+// zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR 0199): the zone settled
+// from that node's settings, the node's private address, the port the answering listen is published on there. A node whose set
+// does not compose declares nothing and is passed over; what the mesh refuses about the zones together is refused, by name.
+func (c *composer) zonesInTheMesh() ([]catalogue.ZoneAt, error) {
+	address := map[string]string{}
+	for _, n := range c.in.sorted() {
+		if strings.TrimSpace(n.Place.Address) != "" {
+			address[n.Name] = n.Place.Address
+		}
+	}
+	var zones []catalogue.ZoneAt
+	var public []string
+	for _, n := range c.in.sorted() {
+		resolved, err := c.planFor(n.Name)
+		switch {
+		case unresolvable(err):
+			continue
+		case err != nil:
+			return nil, fmt.Errorf("the zones %s answers cannot be read: %w", n.Name, err)
+		}
+		plan := resolved.Plan
+		if plan.PublicDomain != "" {
+			public = append(public, plan.PublicDomain)
+		}
+		for _, m := range plan.Modules {
+			if m.Zone == nil {
+				continue
+			}
+			at := address[n.Name]
+			if at == "" {
+				// Not on the private network yet: nothing could reach its answerer.
+				continue
+			}
+			published, layers, err := c.portsGivenOn(n.Name, m)
+			if err != nil {
+				return nil, fmt.Errorf("the zone %s declares on %s cannot be read: %w", m.Module, n.Name, err)
+			}
+			z, err := catalogue.ZoneOn(m, layers, published, n.Name, at)
+			if err != nil {
+				return nil, err
+			}
+			zones = append(zones, *z)
+		}
+	}
+	if problems := catalogue.ZonesProblems(zones, c.suffix(), public); len(problems) > 0 {
+		return nil, fmt.Errorf("the mesh's zones cannot be forwarded:\n  - %s", strings.Join(problems, "\n  - "))
+	}
+	return zones, nil
+}
+
+// replicatedHolders is, for each replicated mesh seat, every machine on the private network holding it, by internal name at its
+// private address (novox/hq ADR 0223): the holders on record, and only the sole claimant when there are none. A holder off
+// the private network is left out.
+func (c *composer) replicatedHolders() map[string]map[string]string {
+	var replicated []catalogue.Seat
+	for _, s := range catalogue.Seats() {
+		if s.Replicated && s.Scope == catalogue.ScopeMesh {
+			replicated = append(replicated, s)
+		}
+	}
+	if len(replicated) == 0 {
+		return nil
+	}
+	address := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		address[p.Name] = p.Place.Address
+	}
+	// Every module of the catalogue with the nodes it is assigned on, sorted, as the controller's Catalogued answers.
+	on := map[string][]string{}
+	for _, n := range c.in.sorted() {
+		for _, module := range n.Assigned {
+			on[module] = append(on[module], n.Name)
+		}
+	}
+	names := make([]string, 0, len(c.in.Catalogue))
+	for name := range c.in.Catalogue {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	out := map[string]map[string]string{}
+	for _, seat := range replicated {
+		var nodes []string
+		for _, h := range c.in.Holdings {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope {
+				nodes = append(nodes, h.Node)
+			}
+		}
+		if len(nodes) == 0 {
+			var derived []string
+			for _, name := range names {
+				for _, cl := range c.in.Catalogue[name].Claims {
+					if cs, ok := catalogue.SeatNamed(cl.Name); ok && cs.Name == seat.Name && cl.At() == seat.Scope {
+						derived = append(derived, on[name]...)
+					}
+				}
+			}
+			if len(derived) == 1 {
+				nodes = derived
+			}
+		}
+		at := map[string]string{}
+		for _, n := range nodes {
+			if address[n] != "" {
+				at[c.internalName(n)] = address[n]
+			}
+		}
+		out[seat.Name] = at
+	}
+	return out
+}
+
+// seatsOn is where a node put the holder of each mesh-scoped seat, by seat and by the port the holder's software uses: what
+// ${seat:...} answers with (novox/hq 04-ISSUES/102). Read for every module in the catalogue that claims a seat, in this node's set
+// or not; a holder in this node's set wins over one that is not.
+func (c *composer) seatsOn(node Node, inSet []catalogue.Manifest, adopted bool, taken map[string]bool) (map[string]map[int]int, error) {
+	assigned := map[string]bool{}
+	for _, m := range inSet {
+		assigned[m.Module] = true
+	}
+	names := make([]string, 0, len(c.in.Catalogue))
+	for name := range c.in.Catalogue {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	seats := map[string]map[int]int{}
+	for _, name := range names {
+		m := c.in.Catalogue[name]
+		var claims []string
+		for _, cl := range m.Claims {
+			if cl.At() == catalogue.ScopeMesh {
+				claims = append(claims, cl.Name)
+			}
+		}
+		if len(claims) == 0 {
+			continue
+		}
+		// Only a port the node was given or the mesh assigned, never the manifest's own number. And on an adopted node a holder
+		// assigned but not yet taken is the found container, so its mesh-assigned ports do not count there; a given port does.
+		ports, _, err := c.portsGivenOn(node.Name, m)
+		if err != nil {
+			return nil, err
+		}
+		if adopted && !taken[name] {
+			layers := node.Settings[m.Module]
+			ports = map[int]int{}
+			if given, err := catalogue.GivenPorts(m, layers); err == nil {
+				ports = given
+			}
+		}
+		if len(ports) == 0 {
+			continue
+		}
+		for _, seat := range claims {
+			if seats[seat] == nil {
+				seats[seat] = map[int]int{}
+			}
+			for wanted, at := range ports {
+				if _, said := seats[seat][wanted]; said && !assigned[name] {
+					continue
+				}
+				seats[seat][wanted] = at
+			}
+		}
+	}
+	return seats, nil
+}
+
+// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local network, from what it
+// last said of itself and the links it said face outside it. A machine that has said none judges to nothing.
+func localNetworksOf(n Node) []catalogue.LocalNetwork {
+	if !n.NetworksSaid {
+		return nil
+	}
+	return catalogue.JudgeLocalNetworks(n.Networks, n.OutwardLinks, overlay.Interface)
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/resolve.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/resolve.go
new file mode 100644
index 00000000..d2fffd8a
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/resolve.go
@@ -0,0 +1,280 @@
+package compose
+
+import (
+	"fmt"
+	"slices"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// LicenceProvision is what a module requires in order to be given a licence (the controller's licences.Provision).
+const LicenceProvision = "model-access"
+
+// Resolved is what one node should run, from what was assigned to it, with the settings of everything that resolved.
+type Resolved struct {
+	Plan     catalogue.Resolution
+	Settings catalogue.SettingsBy
+	// Foreseen are the needs composed with a stand-in for a credential the next send makes (or holds with no value given
+	// here), as "<module> on <node> needs <provision> from <provider>". Nothing was made.
+	Foreseen []string
+	// NotGiven are the words of each credential only a person gives that nobody has: the consumer still resolves without it
+	// (novox/hq ADR 0337 clause 4).
+	NotGiven []string
+}
+
+// Resolve works out everything a node should run, from what was assigned to it (the controller's planFor, plan.go): the
+// resolution over the rest of the mesh, the credential of each thing the node takes from elsewhere, and the settings of
+// every module that resolved. It makes and writes nothing: a credential not held is composed with a stand-in and named
+// foreseen, one only a person gives and nobody has is left out and said, one the send would refuse is refused with the
+// controller's words. A failure to compose the node's own modules is an error that satisfies IsUnresolvable, told apart
+// from an unreadable Input (novox/hq 04-ISSUES/152).
+func Resolve(in Input, node string) (Resolved, error) {
+	return newComposer(in).planFor(node)
+}
+
+// IsUnresolvable reports whether err is a node's own set failing to compose, rather than the mesh being unable to answer.
+func IsUnresolvable(err error) bool { return unresolvable(err) }
+
+// planFor is the controller's planFor.
+func (c *composer) planFor(nodeName string) (Resolved, error) {
+	resolved, err := c.resolution(nodeName)
+	if err != nil {
+		return Resolved{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Resolved{}, err
+	}
+	shelf := c.shelfFor(node)
+	var out Resolved
+
+	// The credential for each thing this node takes from elsewhere.
+	for i, n := range resolved.Needs {
+		// Issued for this holder alone and kept by the vault (issue 757).
+		resolved.Needs[i].IssuedToHolder = issuedToHolder(shelf, n)
+		resolved.Needs[i].ProviderMoved = providerMoved(shelf, n)
+		if n.ByRecord {
+			// Answered by something the mesh holds, so there is no pair-wise secret between two machines.
+			licence, _ := c.licence(n.From)
+			if licence.Keys == nil {
+				// The keys are not given: composed with a stand-in and named, not failed for a value only a send reads.
+				resolved.Needs[i].Sealed = catalogue.ForeseenSealed
+				out.Foreseen = append(out.Foreseen, fmt.Sprintf("%s on %s needs %s from %s", n.For, nodeName, n.Name, n.From))
+			} else {
+				// Given, and none for this holder: the mesh holds none.
+				resolved.Needs[i].Sealed = licence.Keys[Holder{Node: nodeName, Module: n.For}]
+			}
+			// If this holder is the licence's manager, hand it the manager node's PUBLIC sealing key in its bound facts
+			// (novox/hq ADR 0050).
+			if pub := c.managerPublicKeyFor(licence, nodeName, n.For); pub != "" {
+				serves := map[string]any{}
+				for k, v := range resolved.Needs[i].Serves {
+					serves[k] = v
+				}
+				serves["manager_public_key"] = pub
+				resolved.Needs[i].Serves = serves
+				// The manager holder: its empty pre-adoption refresh token is a waiting state, not a missing consumer key.
+				resolved.Needs[i].Manager = true
+			}
+			continue
+		}
+		cred, held := c.credential(n, nodeName)
+		_, outside := issuedOutsideBy(shelf, n)
+		switch {
+		case cred.State == CredentialRefused:
+			// Said rather than skipped. A machine that resolves cleanly and receives no credential is one that will fail to
+			// authenticate at some later, less obvious moment.
+			return Resolved{}, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %s",
+				n.For, nodeName, n.Name, n.From, cred.Why)
+		case cred.State == CredentialNotGiven, outside && !(held && cred.State == CredentialHeld):
+			// Not given, and the rest of the consumer runs (ADR 0337 clause 4): no credential file, so the module can tell
+			// it was not given; nothing the mesh made stands in for it.
+			why := cred.Why
+			if why == "" {
+				why = "nobody gave it"
+			}
+			out.NotGiven = append(out.NotGiven, fmt.Sprintf("%s on %s holds no %s from %s: %s", n.For, nodeName, n.Name, n.From, why))
+			continue
+		case cred.State == CredentialHeld && cred.Sealed != "":
+			resolved.Needs[i].Sealed = cred.Sealed
+		default:
+			// Held with no value here, or none held: the next send makes it (or reads it), and a stand-in is composed.
+			resolved.Needs[i].Sealed = catalogue.ForeseenSealed
+			out.Foreseen = append(out.Foreseen, fmt.Sprintf("%s on %s needs %s from %s", n.For, nodeName, n.Name, n.From))
+		}
+	}
+
+	// Settings for everything that resolved, including modules nobody assigned directly: a requirement pulled in by
+	// something else is still configurable.
+	settings := catalogue.SettingsBy{}
+	for _, m := range resolved.Modules {
+		layers := node.Settings[m.Module]
+		if len(layers) == 0 {
+			continue
+		}
+		settings[m.Module] = append([]catalogue.Layer(nil), layers...)
+	}
+	out.Plan, out.Settings = resolved, settings
+	return out, nil
+}
+
+// credential is how the pair credential of one need stands in the Input, and whether the Input names it at all.
+func (c *composer) credential(n catalogue.Needed, consumer string) (Credential, bool) {
+	for _, cr := range c.in.Credentials {
+		if cr.Provision == n.Name && cr.Consumer == consumer && cr.ConsumerModule == n.For && cr.Provider == n.From && cr.Local == n.Local {
+			return cr, true
+		}
+	}
+	return Credential{State: CredentialWouldMake}, false
+}
+
+// licence is the licence of that name.
+func (c *composer) licence(name string) (Licence, bool) {
+	for _, l := range c.in.Licences {
+		if l.Name == name {
+			return l, true
+		}
+	}
+	return Licence{}, false
+}
+
+// managerPublicKeyFor is the manager node's public sealing key, but only when (node, module) is the licence's manager holder
+// and empty otherwise (plan.go managerPublicKeyFor): delivered to the manager module in its bound facts so it can re-seal a
+// rotated refresh token to this node (novox/hq ADR 0050), and to no consumer.
+func (c *composer) managerPublicKeyFor(l Licence, node, module string) string {
+	if l.Manager == (Holder{}) || node != l.Manager.Node || module != l.Manager.Module {
+		return ""
+	}
+	n, err := c.in.node(node)
+	if err != nil {
+		return ""
+	}
+	return n.SealingKey
+}
+
+// issuedOutsideBy is whether a need's provision is offered by its provider with a credential issued outside the mesh
+// (novox/hq ADR 0337), and that provider module: the one answering it when known, else any that offers it so.
+func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (string, bool) {
+	if n.Module != "" {
+		if m, known := shelf[n.Module]; known {
+			return n.Module, m.IssuedOutsideOf(n.Name)
+		}
+	}
+	return catalogue.OffersIssuedOutside(shelf, n.Name)
+}
+
+// issuedToHolder is whether the vault keeps a need's credential for its holder alone (issues 749, 757 and 779).
+func issuedToHolder(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
+	if n.ByRecord || n.Module == "" {
+		return false
+	}
+	provider, known := shelf[n.Module]
+	if !known || !movedProvider(provider) {
+		return false
+	}
+	if _, issued := provider.IssuedCredentialOf(n.Name); issued {
+		return true
+	}
+	return provider.CredentialFormOf(n.Name) == catalogue.CredentialFormPair
+}
+
+// providerMoved is whether a need is answered by a module marked moved (issue 788), or by one whose offer of the provision
+// says the provider helper answers it (issue 792).
+func providerMoved(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
+	if n.ByRecord || n.Module == "" {
+		return false
+	}
+	provider, known := shelf[n.Module]
+	return known && (movedProvider(provider) || provider.AnsweredByHelperFor(n.Name))
+}
+
+// movedProvider is whether a provider's credentials are the vault's: the module is marked moved, or it holds the
+// mesh-vault seat (issue 793).
+func movedProvider(m catalogue.Manifest) bool {
+	return m.Moved || slices.ContainsFunc(m.Claims, func(c catalogue.Claim) bool { return c.Name == "mesh-vault" })
+}
+
+// resolution works out what one node should run, from what was assigned to it: the controller's planFor up to and
+// including the resolution (plan.go planFor), and no further. A failure to compose the node's own modules is wrapped as
+// notResolvable; every other failure is returned as it is.
+func (c *composer) resolution(nodeName string) (catalogue.Resolution, error) {
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+	shelf := c.shelfFor(node)
+	world, _, _, err := c.theRestOfTheMesh(nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+	world.Pinned = node.Pins
+	// Where each of its consumers of a provision that keeps data was last sent (novox/hq ADR 0232).
+	world.Bound = node.Bound
+
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+
+	// What this mesh can answer with a record rather than a machine, and which record each of this node's modules was
+	// put on.
+	world.Licences, world.Using = c.licencesFor(nodeName)
+
+	resolved, err := catalogue.Resolve(shelf, node.Assigned,
+		catalogue.Node{Name: nodeName, Site: node.Place.Site, Capabilities: node.Capabilities,
+			At: onNetwork[nodeName], PublicDomain: node.PublicDomain,
+			Account: node.Account, AccountHome: node.AccountHome,
+			AgentAccount: node.AgentAccount, AgentAccountHome: node.AgentAccountHome}, world)
+	if err != nil {
+		// The node's own set does not compose: the only failure a mesh-wide gatherer may pass over.
+		return catalogue.Resolution{}, notResolvable{err}
+	}
+	return resolved, nil
+}
+
+// shelfFor is the catalogue as one node composes its own set: the Input's, with each recorded or core module the node keeps at the
+// build it runs put in place of the current one (plan.go keepRecorded). A copy: the Input's catalogue is untouched. Only the node's own planFor and
+// resolution use it; the rest of the mesh and who is on the network are read with the current manifests, as the controller reads them
+// before it keeps a recorded module.
+func (c *composer) shelfFor(node Node) map[string]catalogue.Manifest {
+	if len(node.Kept) == 0 {
+		return c.in.Catalogue
+	}
+	shelf := make(map[string]catalogue.Manifest, len(c.in.Catalogue)+len(node.Kept))
+	for name, m := range c.in.Catalogue {
+		shelf[name] = m
+	}
+	for name, m := range node.Kept {
+		shelf[name] = m
+	}
+	return shelf
+}
+
+// licencesFor is what this node can be answered with by record, and what it was put on. A mesh with no licences at all
+// is the ordinary case and not an error.
+func (c *composer) licencesFor(node string) (map[string][]catalogue.Record, map[string]map[string]catalogue.Record) {
+	all := c.in.Licences
+	if len(all) == 0 {
+		return nil, nil
+	}
+	offered := map[string][]catalogue.Record{}
+	byName := map[string]catalogue.Record{}
+	for _, one := range all {
+		record := catalogue.Record{Name: one.Name, Serves: one.Serves}
+		offered[LicenceProvision] = append(offered[LicenceProvision], record)
+		byName[one.Name] = record
+	}
+	using := map[string]map[string]catalogue.Record{}
+	for _, one := range all {
+		for _, h := range one.Holders {
+			if h.Node != node {
+				continue
+			}
+			if using[h.Module] == nil {
+				using[h.Module] = map[string]catalogue.Record{}
+			}
+			using[h.Module][LicenceProvision] = byName[one.Name]
+		}
+	}
+	return offered, using
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/compose/rest.go b/vendor/git.novox.be/novox/mesh-sdk/go/compose/rest.go
new file mode 100644
index 00000000..f7509e2f
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/compose/rest.go
@@ -0,0 +1,233 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// notResolvable marks the one failure in a node's resolution that is a statement about the node: its assigned modules
+// do not compose. Every other failure means the mesh could not be asked. Whoever gathers across the mesh skips a node
+// that cannot resolve and never a node that could not be read (novox/hq 04-ISSUES/152).
+type notResolvable struct{ err error }
+
+func (n notResolvable) Error() string { return n.err.Error() }
+func (n notResolvable) Unwrap() error { return n.err }
+
+// unresolvable reports whether err is a node's own set failing to compose.
+func unresolvable(err error) bool {
+	var n notResolvable
+	return errors.As(err, &n)
+}
+
+// Passes is what a composition found that the mesh must record, and did not: each seat held once whose holder on record
+// is assigned nowhere that exactly one claimant takes over (novox/hq ADR 0449 clause 4), and the lines that say what was
+// found. The caller records a pass and writes its hand act; this package does neither.
+type Passes struct {
+	// Passes are the seats to pass, in the order they were found.
+	Passes []catalogue.SeatPass
+	// Said are the lines the finding says (a seat two claimants could take, one nothing can).
+	Said []string
+}
+
+// LeftOut is a node that does not resolve in the view of the rest of the mesh, with why: it offers nothing and holds
+// nothing as far as every other machine's plan can tell (novox/hq issue 188).
+type LeftOut struct {
+	Node string
+	Err  error
+}
+
+// String is the line the controller says of it.
+func (l LeftOut) String() string {
+	return fmt.Sprintf("%s is left out of the rest of the mesh: it does not resolve: %v", l.Node, l.Err)
+}
+
+// TheRestOfTheMesh is what every other node holds and offers, as the controller works it out (plan.go theRestOfTheMesh):
+// two passes over the others, because what a node offers needs it resolved and resolving it may need what the mesh
+// offers. The first takes brokered requirements on trust and answers only what each node offers; the second answers
+// everything with that in hand. Nothing is declared from the first.
+//
+// It writes nothing. A seat the mesh passes on is returned in Passes for the caller to record; the World carries the
+// holdings as they stand after the passes, and Input's own are unchanged. A node left out is returned with its reason, in
+// the order the controller said them (the first pass's, then the second's when no node is excluded).
+func TheRestOfTheMesh(in Input, exclude string) (catalogue.World, Passes, []LeftOut, error) {
+	c := newComposer(in)
+	return c.theRestOfTheMesh(exclude)
+}
+
+func (c *composer) theRestOfTheMesh(exclude string) (catalogue.World, Passes, []LeftOut, error) {
+	shelf := c.in.Catalogue
+	holdings := append([]catalogue.Held(nil), c.in.Holdings...)
+	nodes := c.in.sorted()
+
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return catalogue.World{}, Passes{}, nil, err
+	}
+
+	type candidate struct {
+		node     catalogue.Node
+		assigned []string
+		pins     map[string]catalogue.Chosen
+	}
+	var others []candidate
+	// Every machine's assignments, before the holdings are read by any resolution (novox/hq ADR 0449 clause 4): a seat
+	// held once whose holder on record is assigned on no machine passes to its only claimant here.
+	everyAssigned := map[string][]string{}
+	for _, n := range nodes {
+		if len(n.Assigned) > 0 {
+			everyAssigned[n.Name] = n.Assigned
+		}
+	}
+	var passes Passes
+	holdings, passes = passSeatsOn(holdings, assignmentsOf(shelf, everyAssigned))
+	for _, n := range nodes {
+		if n.Name == exclude {
+			continue
+		}
+		theirs := everyAssigned[n.Name]
+		if len(theirs) == 0 {
+			continue
+		}
+		others = append(others, candidate{
+			node: catalogue.Node{Name: n.Name, Site: n.Place.Site, Capabilities: n.Capabilities,
+				At: onNetwork[n.Name], PublicDomain: n.PublicDomain},
+			assigned: theirs, pins: n.Pins})
+	}
+
+	var left []LeftOut
+	offered := map[string][]catalogue.Provider{}
+	var firstHeld []catalogue.Held
+	for _, o := range others {
+		got, err := catalogue.Resolve(shelf, o.assigned, o.node, catalogue.World{Unchecked: true, Holdings: holdings})
+		if err != nil {
+			// Said, not skipped: a machine dropped here offers nothing and holds nothing.
+			left = append(left, LeftOut{Node: o.node.Name, Err: err})
+			continue
+		}
+		firstHeld = append(firstHeld, got.Claims...)
+		for _, m := range got.Modules {
+			for _, name := range m.OffersAt(catalogue.ScopeMesh) {
+				// What that module says a consumer needs to know, with that node's settings on it.
+				serves, layers, err := c.servedOnNode(o.node.Name, m, name)
+				if err != nil {
+					return catalogue.World{}, Passes{}, nil, err
+				}
+				// And its own composed names, as that node composes them (novox/hq ADR 0346).
+				serves, leftOut, err := got.ServedOwnNames(m, name, serves, catalogue.WithDefaults(m, layers))
+				if err != nil {
+					return catalogue.World{}, Passes{}, nil, err
+				}
+				offered[name] = append(offered[name], catalogue.Provider{
+					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
+			}
+		}
+	}
+	for k := range offered {
+		sort.Slice(offered[k], func(i, j int) bool {
+			return offered[k][i].Node < offered[k][j].Node
+		})
+	}
+
+	// The second pass is given the first pass's holdings (novox/hq ADR 0110).
+	world := catalogue.World{Offered: offered, Held: firstHeld, Holdings: holdings}
+	var held []catalogue.Held
+	for _, o := range others {
+		// Each machine is resolved with its own pins, as its plan is.
+		theirs := world
+		theirs.Pinned = o.pins
+		got, err := catalogue.Resolve(shelf, o.assigned, o.node, theirs)
+		if err != nil {
+			// Said only for the whole-mesh view: with one machine excluded, the view is partial by design.
+			if exclude == "" {
+				left = append(left, LeftOut{Node: o.node.Name, Err: err})
+			}
+			continue
+		}
+		held = append(held, got.Claims...)
+	}
+	world.Held = held
+	return world, passes, left, nil
+}
+
+// passSeatsOn finds, in the composition that finds it, the new holder of each seat held once whose holder on record is
+// assigned nowhere and which has exactly one claimant able to hold it (novox/hq ADR 0449 clause 4), and answers the
+// holdings as they are after it, with the passes. Nothing is recorded.
+func passSeatsOn(holdings []catalogue.Held, assignments []catalogue.Assignment) ([]catalogue.Held, Passes) {
+	passes, said := catalogue.SeatsToPassOn(holdings, assignments)
+	out := Passes{Said: said}
+	for _, p := range passes {
+		out.Passes = append(out.Passes, p)
+		var next []catalogue.Held
+		for _, h := range holdings {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == p.Seat.Name {
+				continue
+			}
+			next = append(next, h)
+		}
+		p.To.Site = p.From.Site
+		holdings = append(next, p.To)
+	}
+	return holdings, out
+}
+
+// assignmentsOf are the assignments of every machine, as the passing of a seat reads them. A module assigned and
+// missing from the shelf is still assigned: an assignment with no claims, so its holder is not taken for gone.
+func assignmentsOf(shelf map[string]catalogue.Manifest, assigned map[string][]string) []catalogue.Assignment {
+	var out []catalogue.Assignment
+	names := make([]string, 0, len(assigned))
+	for node := range assigned {
+		names = append(names, node)
+	}
+	sort.Strings(names)
+	for _, node := range names {
+		for _, module := range assigned[node] {
+			m, ok := shelf[module]
+			if !ok {
+				m = catalogue.Manifest{Module: module}
+			}
+			out = append(out, catalogue.Assignment{Node: node, Manifest: m})
+		}
+	}
+	return out
+}
+
+// servedOnNode is what a module on a node tells a consumer of one of its provisions, with THAT node's ports on it: the
+// port the node was given over the one the mesh assigned over the manifest's own, settled with the node's settings
+// layers. The one derivation for every reader of a provider's address.
+func (c *composer) servedOnNode(node string, m catalogue.Manifest, provision string) (map[string]any, []catalogue.Layer, error) {
+	ports, layers, err := c.portsGivenOn(node, m)
+	if err != nil {
+		return nil, nil, err
+	}
+	serves := catalogue.ServedOn(m, provision, ports)
+	if len(serves) > 0 {
+		serves, err = catalogue.Settle(serves, catalogue.WithDefaults(m, layers))
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	return serves, layers, nil
+}
+
+// portsGivenOn is where a node puts a module's ports — assigned, then given over them — and the node's settings layers
+// for the module.
+func (c *composer) portsGivenOn(node string, m catalogue.Manifest) (map[int]int, []catalogue.Layer, error) {
+	n, err := c.in.node(node)
+	if err != nil {
+		return nil, nil, err
+	}
+	ports := map[int]int{}
+	for wanted, at := range n.Ports[m.Module] {
+		ports[wanted] = at
+	}
+	layers := n.Settings[m.Module]
+	if given, err := catalogue.GivenPorts(m, layers); err == nil {
+		for wanted, at := range given {
+			ports[wanted] = at
+		}
+	}
+	return ports, layers, nil
+}
diff --git a/vendor/github.com/novox/mesh-host/internal/declaration/busy.go b/vendor/git.novox.be/novox/mesh-sdk/go/declaration/busy.go
similarity index 100%
rename from vendor/github.com/novox/mesh-host/internal/declaration/busy.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/declaration/busy.go
diff --git a/vendor/github.com/novox/mesh-host/internal/declaration/cron.go b/vendor/git.novox.be/novox/mesh-sdk/go/declaration/cron.go
similarity index 100%
rename from vendor/github.com/novox/mesh-host/internal/declaration/cron.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/declaration/cron.go
diff --git a/vendor/github.com/novox/mesh-host/internal/declaration/declaration.go b/vendor/git.novox.be/novox/mesh-sdk/go/declaration/declaration.go
similarity index 99%
rename from vendor/github.com/novox/mesh-host/internal/declaration/declaration.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/declaration/declaration.go
index 1fd3c5bc..ea16b919 100644
--- a/vendor/github.com/novox/mesh-host/internal/declaration/declaration.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/declaration/declaration.go
@@ -4,6 +4,9 @@
 // refuses the whole declaration rather than being skipped — a host that applied most of what
 // it was sent and reported success is a node that looks configured and is not
 // (novox/hq ADR 0005).
+//
+// Copied from mesh-host internal/declaration at commit 619e14aa8e572c5056e3d2a2412c7f8b364bf840, files unchanged but
+// for this note (novox/hq ADR 0453 clause 3, ADR 0446 clause 4). mesh-host keeps its own copy until release 4b.
 package declaration
 
 import (
diff --git a/vendor/github.com/novox/mesh-host/internal/declaration/health.go b/vendor/git.novox.be/novox/mesh-sdk/go/declaration/health.go
similarity index 100%
rename from vendor/github.com/novox/mesh-host/internal/declaration/health.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/declaration/health.go
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/builder.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/builder.go
new file mode 100644
index 00000000..205e5d56
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/builder.go
@@ -0,0 +1,172 @@
+package delivery
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// The builder's keys (novox/hq ADR 0429 clauses 5 and 16, ADR 0437 clause 5, ADR 0405 clauses 2 and 7, ADR 0453
+// clause 4): a build is `<module>.<fingerprint key part>` in the builder's bucket, one key per fingerprint, since equal
+// fingerprints are equal content and the same source is never built twice. They are written only by the builder part
+// from R4c and read by the checker, the assigner and the view, and from R4e by the controller. They are not the
+// controller's build records (buildrecord.go: BuildsBucket, BuildKey), which stay as they are.
+//
+// **The rules its writer keeps.** A builder claims a fingerprint that has no build key by creating it queued or
+// building, a create that fails when the key exists, and moves it by compare-and-set; a builder reclaims only a build
+// whose `by` is offline in presence. A failed key is built again as a new revision of the same key (ADR 0429 clause
+// 18). Only the builder's credential writes the bucket (clause 5); every other part reads it.
+const (
+	// BuilderModule is the module of the builder part.
+	BuilderModule = "mesh-delivery-builder"
+	// BuilderBuildsBucket is the builder's bucket of builds: `<owner module>_<name>`.
+	BuilderBuildsBucket = BuilderModule + "_builds"
+	// BuilderBuildsHistory is the revisions the bucket keeps per key.
+	BuilderBuildsHistory = 5
+)
+
+// The states of a build.
+const (
+	BuildQueued   = "queued"
+	BuildBuilding = "building"
+	BuildDone     = "done"
+	BuildFailed   = "failed"
+)
+
+// BuilderBuildKey is the key, in BuilderBuildsBucket, of a module's build at a fingerprint: `<module>.<hex>`, the hex
+// being the fingerprint's key part (FingerprintKeyPart), since a bus key may not hold ':'. A module holding a dot or a
+// character a key refuses, and a fingerprint not of the new form, are refused, naming them.
+func BuilderBuildKey(module, fingerprint string) (string, error) {
+	if err := checkName("module", module); err != nil {
+		return "", err
+	}
+	part, err := FingerprintKeyPart(fingerprint)
+	if err != nil {
+		return "", err
+	}
+	return module + "." + part, nil
+}
+
+// ParseBuilderBuildKey is the inverse of BuilderBuildKey: the module and the fingerprint (`src2:` and the hex).
+func ParseBuilderBuildKey(key string) (module, fingerprint string, err error) {
+	module, part, ok := strings.Cut(key, ".")
+	if !ok {
+		return "", "", fmt.Errorf("delivery: %q is not a builder build key, <module>.<fingerprint hex>", key)
+	}
+	if err := checkName("module", module); err != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a builder build key: %w", key, err)
+	}
+	if fingerprint, err = ParseFingerprintKeyPart(part); err != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a builder build key: %w", key, err)
+	}
+	return module, fingerprint, nil
+}
+
+// BuiltArtifact is one artifact of a done build: its name in the manifest, its kind, its content digest and, for an
+// image, the reference it was pushed to.
+type BuiltArtifact struct {
+	Name      string `json:"name"`
+	Kind      string `json:"kind,omitempty"`
+	Digest    string `json:"digest"`
+	Reference string `json:"reference,omitempty"`
+}
+
+// ToolchainUsed is what a build used for one language (ADR 0405 clauses 2 and 7): the installed toolchain's version and
+// the build module's recipe version.
+type ToolchainUsed struct {
+	Version string `json:"version"`
+	Recipe  string `json:"recipe"`
+}
+
+// BuilderBuild is the value of a builder build key: its State (queued, building, done or failed), By the builder
+// instance that holds it, Step what it is doing or did last, Manifest the digest of the module's manifest (the key of
+// the indexer's manifests bucket), Artifacts when done, Toolchains by language when it built or is building (a done
+// build names them, so two builders that differ are seen: ADR 0405 clause 2), and Error when failed.
+type BuilderBuild struct {
+	V          int                      `json:"v"`
+	State      string                   `json:"state"`
+	By         string                   `json:"by,omitempty"`
+	Step       string                   `json:"step,omitempty"`
+	Manifest   string                   `json:"manifest,omitempty"`
+	Artifacts  []BuiltArtifact          `json:"artifacts,omitempty"`
+	Toolchains map[string]ToolchainUsed `json:"toolchains,omitempty"`
+	Error      string                   `json:"error,omitempty"`
+}
+
+func (b BuilderBuild) check() error {
+	switch b.State {
+	case BuildQueued, BuildBuilding, BuildDone, BuildFailed:
+	default:
+		return fmt.Errorf("delivery: the build state %q is not queued, building, done or failed", b.State)
+	}
+	if b.Manifest != "" {
+		if _, err := ManifestsKey(b.Manifest); err != nil {
+			return err
+		}
+	}
+	for language, t := range b.Toolchains {
+		if t.Version == "" {
+			return fmt.Errorf("delivery: the toolchain of %q has no version", language)
+		}
+		if t.Recipe == "" {
+			return fmt.Errorf("delivery: the toolchain of %q has no recipe version", language)
+		}
+	}
+	for i, a := range b.Artifacts {
+		if a.Name == "" {
+			return fmt.Errorf("delivery: artifact %d of the build has no name", i)
+		}
+		if a.Digest == "" {
+			return fmt.Errorf("delivery: the artifact %q of the build has no digest", a.Name)
+		}
+	}
+	switch b.State {
+	case BuildQueued, BuildBuilding:
+		if len(b.Artifacts) > 0 || b.Error != "" {
+			return fmt.Errorf("delivery: a %s build carries no artifact and no error", b.State)
+		}
+	case BuildDone:
+		if len(b.Artifacts) == 0 {
+			return fmt.Errorf("delivery: a done build names no artifact")
+		}
+		if b.Manifest == "" {
+			return fmt.Errorf("delivery: a done build names no manifest digest")
+		}
+		if b.Error != "" {
+			return fmt.Errorf("delivery: a done build carries an error")
+		}
+	case BuildFailed:
+		if b.Error == "" {
+			return fmt.Errorf("delivery: a failed build says no error")
+		}
+	}
+	return nil
+}
+
+// EncodeBuilderBuild is b as JSON at Version; it refuses a build its state does not allow (done without artifacts or a
+// manifest digest, failed without an error, an artifact without a name or digest, a toolchain without a version or a
+// recipe version).
+func EncodeBuilderBuild(b BuilderBuild) ([]byte, error) {
+	if err := b.check(); err != nil {
+		return nil, err
+	}
+	b.V = Version
+	return json.Marshal(b)
+}
+
+// DecodeBuilderBuild reads a builder build value; it refuses an unknown version (ErrUnknownVersion) and what
+// EncodeBuilderBuild refuses.
+func DecodeBuilderBuild(data []byte) (BuilderBuild, error) {
+	var b BuilderBuild
+	if err := decode(data, &b); err != nil {
+		return BuilderBuild{}, err
+	}
+	if err := b.check(); err != nil {
+		return BuilderBuild{}, err
+	}
+	return b, nil
+}
+
+// SameBuilderBuild says whether two builds are the same value, so the builder writes only when they differ.
+func SameBuilderBuild(a, b BuilderBuild) bool { return reflect.DeepEqual(a, b) }
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/buildrecord.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/buildrecord.go
new file mode 100644
index 00000000..86bd87b4
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/buildrecord.go
@@ -0,0 +1,42 @@
+package delivery
+
+import "time"
+
+// BuildRecord is the layout mesh-controller internal/chain/records.go Build writes (line 91), the fields a reader outside
+// the controller reads (novox/hq ADR 0437 §4 §5, issue 1223). The controller's record carries more; a decode ignores
+// what is not here. Path is the module's directory in its repository, as the controller writes it (Build.Path, records.go:100,
+// set from the build request trimmed of slashes at internal/inventory/chain_requests.go:19); empty for a module whose
+// manifest is the repository's root. SourceInputs has no json keys of its own: it is written under its Go field names, as the controller
+// writes it.
+type BuildRecord struct {
+	ID                string        `json:"id"`
+	State             string        `json:"state,omitempty"`
+	Failed            string        `json:"failed,omitempty"`
+	Repository        string        `json:"repository"`
+	Ref               string        `json:"ref,omitempty"`
+	Module            string        `json:"module,omitempty"`
+	Path              string        `json:"path,omitempty"`
+	Commit            string        `json:"commit,omitempty"`
+	At                time.Time     `json:"at,omitzero"`
+	SourceFingerprint string        `json:"source-fingerprint,omitempty"`
+	SourceInputs      *SourceInputs `json:"source-inputs,omitempty"`
+}
+
+// BuildsBucket is the bucket the builds are kept in: mesh-controller internal/broker/controller_buckets.go:101,
+// BucketName(ControllerSeat, ChainBuilds), with ControllerSeat "mesh-controller" (internal/broker/streams.go:359) and
+// ChainBuilds "builds" (controller_buckets.go:113).
+const BuildsBucket = "mesh-controller_builds"
+
+// BuildKey is a build's record under its module, a build that knew none under the request's key: copied from
+// mesh-controller internal/chain/keys.go:35-40 (BuildKey, with RequestKey at line 42).
+func BuildKey(module, id string) string {
+	if module == "" {
+		return "req." + id
+	}
+	return module + ".build." + id
+}
+
+// NewestKey is the key of a module's newest build, of any state: copied from mesh-controller internal/chain/keys.go:44.
+// The key holds no record: its value is the newest build's id as raw bytes (internal/inventory/chain_builds.go:210 and
+// :546), and the record lives at BuildKey(module, id). The pointer is a hint, checked against that record.
+func NewestKey(module string) string { return module + ".newest" }
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/checker.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/checker.go
new file mode 100644
index 00000000..bdb57e96
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/checker.go
@@ -0,0 +1,295 @@
+package delivery
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+	"time"
+)
+
+// The checker's keys (novox/hq ADR 0447 clauses 1 to 3, ADR 0444, ADR 0446 clause 5, ADR 0453 clause 4): the verdicts of
+// its checks and the passing verdicts it keeps per package and level. The checker writes them from R4c, dark; the
+// forge bridge writes the status `mesh/check` from a verdict (unrequired until R4f), the gate reads it from R4f, and
+// the view and the watchman read them (a running check carries a pulse).
+//
+// **The verdict's key is the group and the heads, not the fingerprints** (the lead's limit for R4a). Research 063
+// section 01 drew `verdicts.<g>.check.<fpset>`; ADR 0447 clause 1 judges a pull request's head merged onto its
+// trunk's head, and a repository without modules has no fingerprint set, so the key is `<group>.<heads hash>` as the
+// heads hash of HeadsHash gives it. The fpset (FingerprintSet) is not part of it.
+const (
+	// CheckerModule is the module of the checker part.
+	CheckerModule = "mesh-delivery-checker"
+	// CheckerVerdictsBucket is the checker's bucket of verdicts, `<owner module>_<name>`.
+	CheckerVerdictsBucket = CheckerModule + "_verdicts"
+	// CheckerVerdictsHistory is the revisions the verdicts bucket keeps per key.
+	CheckerVerdictsHistory = 5
+	// CheckerKeptBucket is the checker's bucket of kept verdicts. A key is written once, by a create that fails when
+	// the key exists, by the checker's credential alone, from the result the checker reads from the test run and
+	// never from anything the code under test writes (ADR 0444 clause 5); nothing changes it afterwards.
+	CheckerKeptBucket = CheckerModule + "_kept"
+	// CheckerKeptHistory is the revisions the kept bucket keeps per key.
+	CheckerKeptHistory = 1
+)
+
+// The test levels (ADR 0445 clause 2) and the states of a verdict.
+const (
+	LevelUnit        = "unit"
+	LevelIntegration = "integration"
+
+	VerdictRunning = "running"
+	VerdictPass    = "pass"
+	VerdictFail    = "fail"
+)
+
+func checkLevel(level string) error {
+	if level != LevelUnit && level != LevelIntegration {
+		return fmt.Errorf("delivery: the level %q is not %s or %s", level, LevelUnit, LevelIntegration)
+	}
+	return nil
+}
+
+func isHex12(s string) bool { return len(s) == 12 && strings.Trim(s, "0123456789abcdef") == "" }
+
+// CheckerVerdictKey is the key, in CheckerVerdictsBucket, of a group's check at its heads: `<escaped group>.<heads
+// hash>`, the group escaped as CandidatesKey does and the heads hash as HeadsHash gives it (12 lowercase hex digits).
+func CheckerVerdictKey(group, headsHash string) (string, error) {
+	g, err := groupKey(group)
+	if err != nil {
+		return "", err
+	}
+	if !isHex12(headsHash) {
+		return "", fmt.Errorf("delivery: %q is not a heads hash, 12 lowercase hex digits", headsHash)
+	}
+	return g + "." + headsHash, nil
+}
+
+// ParseCheckerVerdictKey is the inverse of CheckerVerdictKey.
+func ParseCheckerVerdictKey(key string) (group, headsHash string, err error) {
+	i := strings.LastIndex(key, ".")
+	if i < 0 {
+		return "", "", fmt.Errorf("delivery: %q is not a verdict key, <group>.<heads hash>", key)
+	}
+	part, headsHash := key[:i], key[i+1:]
+	if !isHex12(headsHash) {
+		return "", "", fmt.Errorf("delivery: %q is not a verdict key: %q is not a heads hash, 12 lowercase hex digits", key, headsHash)
+	}
+	if group, err = parseGroupKey(part); err != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a verdict key: %w", key, err)
+	}
+	if strings.Contains(part, ".") {
+		return "", "", fmt.Errorf("delivery: %q is not a verdict key: the group part holds a dot", key)
+	}
+	return group, headsHash, nil
+}
+
+// LevelResult is a level's tests: how many ran in this check and how many were taken from kept verdicts (ADR 0444
+// clause 2).
+type LevelResult struct {
+	Run  int `json:"run"`
+	Kept int `json:"kept"`
+}
+
+// Took is the time of each part of a check in integer milliseconds (ADR 0447 clause 3): waiting in the queue, cloning,
+// the unit level, the integration level's setup and its running, and the composition.
+type Took struct {
+	Queue            int64 `json:"queue"`
+	Clone            int64 `json:"clone"`
+	Unit             int64 `json:"unit"`
+	IntegrationSetup int64 `json:"integration-setup"`
+	IntegrationRun   int64 `json:"integration-run"`
+	Composition      int64 `json:"composition"`
+}
+
+// FailedFirst names what failed first: a test (its package and name) or a machine (and the words of the composition's
+// refusal); one of them, with Words optional.
+type FailedFirst struct {
+	Test    string `json:"test,omitempty"`
+	Machine string `json:"machine,omitempty"`
+	Words   string `json:"words,omitempty"`
+}
+
+// Verdict is the value of a verdict key: the group and its heads hash, the trunk head of each repository it was judged
+// against (repository to full sha), the State (running, pass or fail), what failed first, the tests run and kept per
+// level, each part's time, the machines composed and the mesh-sdk version the composition ran with (ADR 0446 clause 5).
+type Verdict struct {
+	V        int                    `json:"v"`
+	Group    string                 `json:"group"`
+	Heads    string                 `json:"heads"`
+	Trunk    map[string]string      `json:"trunk,omitempty"`
+	State    string                 `json:"state"`
+	Failed   FailedFirst            `json:"failed,omitzero"`
+	Levels   map[string]LevelResult `json:"levels,omitempty"`
+	Took     Took                   `json:"took,omitzero"`
+	Machines []string               `json:"machines,omitempty"`
+	SDK      string                 `json:"sdk,omitempty"`
+}
+
+func (v Verdict) check() error {
+	if v.Group == "" {
+		return fmt.Errorf("delivery: a verdict names no group")
+	}
+	if !isHex12(v.Heads) {
+		return fmt.Errorf("delivery: the verdict's heads hash %q is not 12 lowercase hex digits", v.Heads)
+	}
+	for repository, head := range v.Trunk {
+		if head == "" {
+			return fmt.Errorf("delivery: the verdict's trunk head of %s is empty", repository)
+		}
+	}
+	for level, r := range v.Levels {
+		if err := checkLevel(level); err != nil {
+			return err
+		}
+		if r.Run < 0 || r.Kept < 0 {
+			return fmt.Errorf("delivery: the verdict's %s level counts a negative number of tests", level)
+		}
+	}
+	for part, ms := range map[string]int64{"queue": v.Took.Queue, "clone": v.Took.Clone, "unit": v.Took.Unit,
+		"integration-setup": v.Took.IntegrationSetup, "integration-run": v.Took.IntegrationRun, "composition": v.Took.Composition} {
+		if ms < 0 {
+			return fmt.Errorf("delivery: the verdict's time of the part %s is negative", part)
+		}
+	}
+	named := v.Failed.Test != "" || v.Failed.Machine != ""
+	switch v.State {
+	case VerdictRunning:
+		if v.Failed != (FailedFirst{}) {
+			return fmt.Errorf("delivery: a running verdict names no failure")
+		}
+	case VerdictPass:
+		if v.Failed != (FailedFirst{}) {
+			return fmt.Errorf("delivery: a pass names no failure")
+		}
+		for _, level := range []string{LevelUnit, LevelIntegration} {
+			if _, ok := v.Levels[level]; !ok {
+				return fmt.Errorf("delivery: a pass says nothing of the %s level", level)
+			}
+		}
+	case VerdictFail:
+		if !named {
+			return fmt.Errorf("delivery: a fail names neither a test nor a machine")
+		}
+	default:
+		return fmt.Errorf("delivery: the verdict state %q is not running, pass or fail", v.State)
+	}
+	return nil
+}
+
+// EncodeVerdict is v as JSON at Version; it refuses a fail that names neither a test nor a machine, a pass without both
+// levels, an unknown state or level, and a negative count or time.
+func EncodeVerdict(v Verdict) ([]byte, error) {
+	if err := v.check(); err != nil {
+		return nil, err
+	}
+	v.V = Version
+	return json.Marshal(v)
+}
+
+// DecodeVerdict reads a verdict; it refuses an unknown version (ErrUnknownVersion) and what EncodeVerdict refuses.
+func DecodeVerdict(data []byte) (Verdict, error) {
+	var v Verdict
+	if err := decode(data, &v); err != nil {
+		return Verdict{}, err
+	}
+	if err := v.check(); err != nil {
+		return Verdict{}, err
+	}
+	return v, nil
+}
+
+// SameVerdict says whether two verdicts are the same value, so the checker writes only when they differ.
+func SameVerdict(a, b Verdict) bool { return reflect.DeepEqual(a, b) }
+
+// KeptKey is the key, in CheckerKeptBucket, of a kept verdict: `<level>.<digest>`, the level unit or integration (ADR
+// 0445 clause 2) and the digest, lowercase hex, of everything that package's tests read at that level as the
+// language's build module names it (ADR 0444 clause 1, ADR 0445 clause 5).
+func KeptKey(level, digest string) (string, error) {
+	if err := checkLevel(level); err != nil {
+		return "", err
+	}
+	if digest == "" || strings.Trim(digest, "0123456789abcdef") != "" {
+		return "", fmt.Errorf("delivery: %q is not a digest, lowercase hex", digest)
+	}
+	return level + "." + digest, nil
+}
+
+// ParseKeptKey is the inverse of KeptKey.
+func ParseKeptKey(key string) (level, digest string, err error) {
+	level, digest, ok := strings.Cut(key, ".")
+	if !ok {
+		return "", "", fmt.Errorf("delivery: %q is not a kept key, <level>.<digest>", key)
+	}
+	if _, err = KeptKey(level, digest); err != nil {
+		return "", "", fmt.Errorf("delivery: %q is not a kept key: %w", key, err)
+	}
+	return level, digest, nil
+}
+
+// Kept is the value of a kept key: a passing verdict of one package at one level (State is pass and nothing else: a
+// failure is never kept, ADR 0444 clause 1), with the repository, the package, the number of tests, the time they took
+// in milliseconds, the toolchain's version and when it was kept.
+type Kept struct {
+	V          int       `json:"v"`
+	State      string    `json:"state"`
+	Repository string    `json:"repository"`
+	Package    string    `json:"package"`
+	Level      string    `json:"level"`
+	Tests      int       `json:"tests"`
+	Took       int64     `json:"took"`
+	Toolchain  string    `json:"toolchain"`
+	At         time.Time `json:"at"`
+}
+
+func (k Kept) check() error {
+	if k.State != VerdictPass {
+		return fmt.Errorf("delivery: a kept verdict is a pass, never %q: a failure is never kept", k.State)
+	}
+	if err := checkRepository(k.Repository); err != nil {
+		return err
+	}
+	if k.Package == "" {
+		return fmt.Errorf("delivery: a kept verdict names no package")
+	}
+	if err := checkLevel(k.Level); err != nil {
+		return err
+	}
+	if k.Tests < 0 || k.Took < 0 {
+		return fmt.Errorf("delivery: a kept verdict counts a negative number of tests or a negative time")
+	}
+	if k.Toolchain == "" {
+		return fmt.Errorf("delivery: a kept verdict names no toolchain version")
+	}
+	if k.At.IsZero() {
+		return fmt.Errorf("delivery: a kept verdict says no time")
+	}
+	return nil
+}
+
+// EncodeKept is k as JSON at Version; it refuses a kept value that is not a pass.
+func EncodeKept(k Kept) ([]byte, error) {
+	if err := k.check(); err != nil {
+		return nil, err
+	}
+	k.V = Version
+	return json.Marshal(k)
+}
+
+// DecodeKept reads a kept value; it refuses an unknown version (ErrUnknownVersion) and what EncodeKept refuses.
+func DecodeKept(data []byte) (Kept, error) {
+	var k Kept
+	if err := decode(data, &k); err != nil {
+		return Kept{}, err
+	}
+	if err := k.check(); err != nil {
+		return Kept{}, err
+	}
+	return k, nil
+}
+
+// SameKept says whether two kept values are the same value.
+func SameKept(a, b Kept) bool {
+	at := a.At.Equal(b.At)
+	a.At, b.At = time.Time{}, time.Time{}
+	return at && a == b
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/delivery.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/delivery.go
index fe995284..e4e541df 100644
--- a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/delivery.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/delivery.go
@@ -30,11 +30,17 @@
 // **The source fingerprint** (issue 1203; ADR 0437 §5): one function of named inputs that the controller's builder and
 // the indexer both call, so they agree byte for byte (fingerprint.go).
 //
+// **The release 4 layouts** (issues 1356 to 1359; ADR 0453 clauses 4, 6 and 16): the new fingerprint form (fingerprint2.go),
+// the indexer's manifests by digest and the new fields of its modules and candidates (manifests.go, source.go), the
+// builder's build keys (builder.go) and the checker's verdicts and kept verdicts (checker.go). A manifests value is the
+// one exception to the size above: a manifest is up to about 21 KB, whole, byte for byte.
+//
 // Standard library only, and this module's own asks package.
 package delivery
 
 import (
 	"bytes"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -79,6 +85,10 @@ const (
 	PhaseChecking  Phase = "checking"
 	PhaseRunning   Phase = "running"
 	PhaseFailed    Phase = "failed"
+	// PhaseRemoved is written by the node-engine, once, for a module its applied declaration no longer holds and
+	// for which it had written a have key; the key is never deleted (issue 1369, ADR 0408 §4), so a reader can tell
+	// that the module stopped.
+	PhaseRemoved Phase = "removed"
 )
 
 // Health is what the module's own check says.
@@ -105,6 +115,49 @@ func checkName(kind, name string) error {
 	return nil
 }
 
+// EscapeName is name as a key part: a character outside letters, digits, `-`, `/` and `_` is written `=` and its
+// two lowercase hex digits per byte, and `=` itself is escaped, so any non-empty name keys and a name of allowed
+// characters only keys as it is. UnescapeName is its inverse.
+func EscapeName(name string) string {
+	var b strings.Builder
+	for i := 0; i < len(name); i++ {
+		c := name[i]
+		switch {
+		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9', c == '-', c == '/', c == '_':
+			b.WriteByte(c)
+		default:
+			fmt.Fprintf(&b, "=%02x", c)
+		}
+	}
+	return b.String()
+}
+
+// UnescapeName is the inverse of EscapeName; it refuses a part with a bare `=` or any character EscapeName leaves
+// escaped.
+func UnescapeName(part string) (string, error) {
+	var out []byte
+	for i := 0; i < len(part); i++ {
+		c := part[i]
+		if c != '=' {
+			if !nameOK.MatchString(string(c)) {
+				return "", fmt.Errorf("delivery: %q holds %q, which a key part escapes", part, c)
+			}
+			out = append(out, c)
+			continue
+		}
+		if i+3 > len(part) {
+			return "", fmt.Errorf("delivery: %q ends in an incomplete escape", part)
+		}
+		v, err := hex.DecodeString(part[i+1 : i+3])
+		if err != nil || part[i+1:i+3] != strings.ToLower(part[i+1:i+3]) {
+			return "", fmt.Errorf("delivery: %q holds a malformed escape %q", part, part[i:i+3])
+		}
+		out = append(out, v[0])
+		i += 2
+	}
+	return string(out), nil
+}
+
 // HaveKey is the key, in HaveBucket, of a module's have on a node: `<node>.<module>`. A module named `node` is
 // refused, since `<node>.node` is the node's own facts.
 func HaveKey(node, module string) (string, error) {
@@ -294,9 +347,9 @@ func decode(data []byte, into any) error {
 
 func (h Have) check() error {
 	switch h.Phase {
-	case PhaseBackingUp, PhaseApplying, PhaseChecking, PhaseRunning, PhaseFailed:
+	case PhaseBackingUp, PhaseApplying, PhaseChecking, PhaseRunning, PhaseFailed, PhaseRemoved:
 	default:
-		return fmt.Errorf("delivery: phase %q is not backing-up, applying, checking, running or failed", h.Phase)
+		return fmt.Errorf("delivery: phase %q is not backing-up, applying, checking, running, failed or removed", h.Phase)
 	}
 	switch h.Health {
 	case HealthOK, HealthFailed, HealthWaits, HealthUnknown:
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/fingerprint2.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/fingerprint2.go
new file mode 100644
index 00000000..23a991aa
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/fingerprint2.go
@@ -0,0 +1,105 @@
+package delivery
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// SourcePrefix2 opens every source fingerprint of the new form.
+const SourcePrefix2 = "src2:"
+
+// Toolchain2 is what an artifact's toolchain enters the new fingerprint as (novox/hq ADR 0405 clause 7): the
+// artifact's language, the installed toolchain's version and the build module's recipe version, in place of the
+// toolchain image's digest. A toolchain update so changes the fingerprints of that language's modules only.
+type Toolchain2 struct {
+	Language string
+	Version  string
+	Recipe   string
+}
+
+// SourceInputs2 are what a module's source fingerprint of the new form is of (novox/hq ADR 0429 clause 5 as ADR 0437
+// clause 5 changed it; ADR 0453 clause 6). It differs from SourceInputs in exactly four things: a base enters by its
+// module's fingerprint (src2:...), not its image digest; the builder enters by its own module's fingerprint, not its
+// executable's digest; an artifact that resolves packages when it is built enters by the hash of its lock file; and
+// an artifact's toolchain enters as Toolchain2. Module, Tree, Contexts and Unpinned are as in SourceInputs.
+//
+// Locks names the artifacts that resolve packages when built, each with the hash of its lock file; an entry with an
+// empty hash is such an artifact with no lock, which has no fingerprint. An artifact that resolves nothing is not in
+// Locks.
+type SourceInputs2 struct {
+	Module     string
+	Tree       string
+	Bases      []string
+	Builder    string
+	Contexts   map[string]string
+	Locks      map[string]string
+	Toolchains map[string]Toolchain2
+	Unpinned   string
+}
+
+// SourceFingerprint2 is the module's source fingerprint of the new form, `src2:` and the hex sha256 of its inputs'
+// lines, or none and the reason when the source does not pin the build: Unpinned when set, "no tree" when Tree is
+// empty, "no lock" when an artifact resolves packages and has no lock. It is a pure function of its inputs: the order
+// of maps and a base given twice change nothing. The lines are "module <m>", "tree <t>" and "builder <fp>", then
+// "base <fp>" (once each), "context <artifact> <tree>", "lock <artifact> <hash>" and "toolchain <artifact> <language>
+// <version> <recipe>", sorted, all joined by a newline.
+func SourceFingerprint2(in SourceInputs2) (fp, none string) {
+	if in.Unpinned != "" {
+		return "", in.Unpinned
+	}
+	if in.Tree == "" {
+		return "", "no tree"
+	}
+	for _, h := range in.Locks {
+		if h == "" {
+			return "", "no lock"
+		}
+	}
+	lines := []string{"module " + in.Module, "tree " + in.Tree, "builder " + in.Builder}
+	bases := map[string]bool{}
+	for _, b := range in.Bases {
+		bases[b] = true
+	}
+	for b := range bases {
+		lines = append(lines, "base "+b)
+	}
+	for a, t := range in.Contexts {
+		lines = append(lines, "context "+a+" "+t)
+	}
+	for a, h := range in.Locks {
+		lines = append(lines, "lock "+a+" "+h)
+	}
+	for a, t := range in.Toolchains {
+		lines = append(lines, "toolchain "+a+" "+t.Language+" "+t.Version+" "+t.Recipe)
+	}
+	sort.Strings(lines[3:])
+	sum := sha256.Sum256([]byte(strings.Join(lines, "\n")))
+	return SourcePrefix2 + hex.EncodeToString(sum[:]), ""
+}
+
+// FingerprintKeyPart is a new-form fingerprint as a key part: its 64 hex digits without the prefix, since a bus key
+// may not hold ':'. It refuses a value that is not `src2:` and 64 lowercase hex digits, a src1 fingerprint included,
+// naming it.
+func FingerprintKeyPart(fp string) (string, error) {
+	part, ok := strings.CutPrefix(fp, SourcePrefix2)
+	if !ok || !isHex64(part) {
+		return "", fmt.Errorf("delivery: %q is not a fingerprint of the new form, %s and 64 lowercase hex digits", fp, SourcePrefix2)
+	}
+	return part, nil
+}
+
+// ParseFingerprintKeyPart is the inverse of FingerprintKeyPart. It refuses a part that is not 64 lowercase hex
+// digits, a src1 fingerprint or a prefixed value included, naming it.
+func ParseFingerprintKeyPart(part string) (string, error) {
+	if !isHex64(part) {
+		return "", fmt.Errorf("delivery: %q is not the key part of a fingerprint, 64 lowercase hex digits", part)
+	}
+	return SourcePrefix2 + part, nil
+}
+
+func isHex64(s string) bool {
+	return len(s) == 64 && strings.Trim(s, "0123456789abcdef") == ""
+}
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/gate.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/gate.go
index cd85b3f9..61ec74d1 100644
--- a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/gate.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/gate.go
@@ -56,23 +56,21 @@ var hashOK = regexp.MustCompile(`^[0-9a-f]{12}$`)
 
 // MergesKey is the key, in MergesBucket, of a group: `<group>`.
 func MergesKey(group string) (string, error) {
-	if err := checkName("group", group); err != nil {
-		return "", err
-	}
-	return group, nil
+	return groupKey(group)
 }
 
 // MergeAskKey is the key, in AsksBucket, of the ask for merging a group at these heads: `merge.<group>.<heads
 // hash>`. The teller's answer has the same key in AnswersBucket (AnswerKey).
 func MergeAskKey(group string, heads []Head) (string, error) {
-	if err := checkName("group", group); err != nil {
+	part, err := groupKey(group)
+	if err != nil {
 		return "", err
 	}
 	hash, err := HeadsHash(heads)
 	if err != nil {
 		return "", err
 	}
-	return AskKindMerge + "." + group + "." + hash, nil
+	return AskKindMerge + "." + part + "." + hash, nil
 }
 
 // ParseAskKey is the inverse of MergeAskKey: the kind, the group and the heads hash.
@@ -81,13 +79,14 @@ func ParseAskKey(key string) (kind, group, hash string, err error) {
 	if len(parts) != 3 || parts[0] != AskKindMerge {
 		return "", "", "", fmt.Errorf("delivery: %q is not an ask key, merge.<group>.<heads hash>", key)
 	}
-	if err := checkName("group", parts[1]); err != nil {
+	group, err = parseGroupKey(parts[1])
+	if err != nil {
 		return "", "", "", fmt.Errorf("delivery: %q is not an ask key: %w", key, err)
 	}
 	if !hashOK.MatchString(parts[2]) {
 		return "", "", "", fmt.Errorf("delivery: %q is not an ask key: %q is not 12 hex digits", key, parts[2])
 	}
-	return parts[0], parts[1], parts[2], nil
+	return parts[0], group, parts[2], nil
 }
 
 // AnswerKey is the key, in AnswersBucket, of the teller's answer to the ask at askKey: the same string.
@@ -120,6 +119,18 @@ func AskID(askKey string) string {
 	return string(readable) + "-" + hex.EncodeToString(sum[:])[:12]
 }
 
+// AskingID is the id of the asking-th writing of the ask at askKey. Asking 0 and 1 give AskID(askKey), so the first
+// asking's id is unchanged; asking n of 2 or more gives the AskID form of askKey + "." + n, so each asking has an id
+// of its own (at most 64 bytes, ending in the 12 hex digits of the hash of that whole string) and the router, which
+// drops an ask under an id it keeps as a redelivery, takes each as new and an answer to an earlier asking is never
+// taken for a later one.
+func AskingID(askKey string, asking int) string {
+	if asking < 2 {
+		return AskID(askKey)
+	}
+	return AskID(askKey + "." + strconv.Itoa(asking))
+}
+
 func checkOwedAct(act string) (kind, context string, err error) {
 	kind, context, hasContext := strings.Cut(act, "=")
 	switch kind {
@@ -131,27 +142,44 @@ func checkOwedAct(act string) (kind, context string, err error) {
 			return "", "", err
 		}
 		return kind, context, nil
-	case OwedView, OwedNote, OwedComment:
+	case OwedView, OwedNote:
 		if hasContext {
 			return "", "", fmt.Errorf("delivery: the owed act %q takes no context", act)
 		}
 		return kind, "", nil
 	}
-	return "", "", fmt.Errorf("delivery: the owed act %q is not status=<context>, view, note or comment", act)
+	if kind, seq, ok := strings.Cut(act, "."); ok && kind == OwedComment {
+		if n, err := strconv.Atoi(seq); err != nil || n < 1 || strconv.Itoa(n) != seq {
+			return "", "", fmt.Errorf("delivery: the owed act %q is a comment without its sequence, comment.<seq> with seq of 1 or more", act)
+		}
+		return OwedComment, seq, nil
+	}
+	return "", "", fmt.Errorf("delivery: the owed act %q is not status=<context>, view, note or comment.<seq>", act)
 }
 
-// ParseOwedAct splits an owed act into its kind and, for a status, its context.
+// OwedCommentAct is the act of the seq-th comment on a head: `comment.<seq>`, seq of 1 or more, so a second comment
+// has a key of its own and does not overwrite the first.
+func OwedCommentAct(seq int) (string, error) {
+	if seq < 1 {
+		return "", fmt.Errorf("delivery: a comment's sequence is 1 or more, not %d", seq)
+	}
+	return OwedComment + "." + strconv.Itoa(seq), nil
+}
+
+// ParseOwedAct splits an owed act into its kind and, for a status, its context, for a comment its sequence as
+// digits.
 func ParseOwedAct(act string) (kind, context string, err error) { return checkOwedAct(act) }
 
 // OwedKey is the key, in OwedBucket, of an act the gate owes the forge on a pull request at a head:
 // `<repository>.<number>.<head>.<act>`, the act being `status=<context>` (mesh/merge-gate), `view`, `note` or
-// `comment`.
+// `comment.<seq>`. The number is 0 for a commit no pull request names, and never negative.
 func OwedKey(repository string, number int, head, act string) (string, error) {
-	if err := checkRepository(repository); err != nil {
+	repo, err := escapeRepository(repository)
+	if err != nil {
 		return "", err
 	}
-	if number <= 0 {
-		return "", fmt.Errorf("delivery: an owed key needs the pull request number, not %d", number)
+	if number < 0 {
+		return "", fmt.Errorf("delivery: an owed key's pull request number is 0 (none) or more, not %d", number)
 	}
 	if err := checkName("head", head); err != nil {
 		return "", err
@@ -159,12 +187,12 @@ func OwedKey(repository string, number int, head, act string) (string, error) {
 	if _, _, err := checkOwedAct(act); err != nil {
 		return "", err
 	}
-	return repository + "." + strconv.Itoa(number) + "." + head + "." + act, nil
+	return repo + "." + strconv.Itoa(number) + "." + head + "." + act, nil
 }
 
 // ParseOwedKey is the inverse of OwedKey; act is whole, as `status=<context>` for a status.
 func ParseOwedKey(key string) (repository string, number int, head, act string, err error) {
-	parts := strings.Split(key, ".")
+	parts := strings.SplitN(key, ".", 4) // a comment's act holds a dot
 	if len(parts) != 4 {
 		return "", 0, "", "", fmt.Errorf("delivery: %q is not an owed key, <repository>.<number>.<head>.<act>", key)
 	}
@@ -172,19 +200,31 @@ func ParseOwedKey(key string) (repository string, number int, head, act string,
 	if convErr != nil {
 		return "", 0, "", "", fmt.Errorf("delivery: %q is not an owed key: %q is not a pull request number", key, parts[1])
 	}
-	if _, err := OwedKey(parts[0], number, parts[2], parts[3]); err != nil {
+	repository, err = unescapeRepository(parts[0])
+	if err != nil {
 		return "", 0, "", "", fmt.Errorf("delivery: %q is not an owed key: %w", key, err)
 	}
-	return parts[0], number, parts[2], parts[3], nil
+	if _, err := OwedKey(repository, number, parts[2], parts[3]); err != nil {
+		return "", 0, "", "", fmt.Errorf("delivery: %q is not an owed key: %w", key, err)
+	}
+	return repository, number, parts[2], parts[3], nil
 }
 
 // Merge is the value of a merges key: the ask approved and, for each pull request, the head the approval expects
-// and how far its merge has come.
+// and how far its merge has come. Approved is the Approve's heads of every member of the group, ApprovedKey of
+// the member to its full head sha: the forge's merge tool wants them for every sibling whichever member it is
+// handed (ADR 0450 §3). A merge written before Approved existed has none and is not checked against it.
 type Merge struct {
-	V     int         `json:"v"`
-	Group string      `json:"group"`
-	Ask   string      `json:"ask"`
-	Pulls []MergePull `json:"pulls"`
+	V        int               `json:"v"`
+	Group    string            `json:"group"`
+	Ask      string            `json:"ask"`
+	Approved map[string]string `json:"approved,omitempty"`
+	Pulls    []MergePull       `json:"pulls"`
+}
+
+// ApprovedKey is the key of a member in Merge.Approved: `<repository>@<number>`.
+func ApprovedKey(repository string, number int) string {
+	return repository + "@" + strconv.Itoa(number)
 }
 
 // MergePull is one pull request of a merge: its expected head, its state, the merge commit once merged, the
@@ -197,8 +237,8 @@ type MergePull struct {
 }
 
 func (m Merge) check() error {
-	if err := checkName("group", m.Group); err != nil {
-		return err
+	if m.Group == "" {
+		return fmt.Errorf("delivery: a merge names no group")
 	}
 	if m.Ask == "" {
 		return fmt.Errorf("delivery: a merge names no ask")
@@ -206,8 +246,22 @@ func (m Merge) check() error {
 	if len(m.Pulls) == 0 {
 		return fmt.Errorf("delivery: a merge names no pull request")
 	}
+	for key, sha := range m.Approved {
+		if sha == "" {
+			return fmt.Errorf("delivery: the approved head of %s is empty", key)
+		}
+	}
 	for _, p := range m.Pulls {
 		who := fmt.Sprintf("%s#%d", p.Repository, p.Number)
+		if len(m.Approved) > 0 {
+			sha, ok := m.Approved[ApprovedKey(p.Repository, p.Number)]
+			if !ok {
+				return fmt.Errorf("delivery: the pull request %s is handed to the merge but is not among the approved heads", who)
+			}
+			if sha != p.Head.Head {
+				return fmt.Errorf("delivery: the pull request %s is handed at head %q but the Approve was for %q", who, p.Head.Head, sha)
+			}
+		}
 		switch p.State {
 		case MergeMerging:
 		case MergeMerged:
@@ -232,15 +286,22 @@ type Ask struct {
 	Group string   `json:"group"`
 	Heads []Head   `json:"heads"`
 	Ask   asks.Ask `json:"ask"`
+	// Asking counts the times the gate wrote this group's ask at these heads: 0 or 1 for the first, n for the n-th.
+	// The router drops an ask whose id it has already kept as a redelivery, so each asking has its own id
+	// (AskingID); the first asking's id is unchanged and the field is omitted for it.
+	Asking int `json:"asking,omitempty"`
 }
 
 func (a Ask) check() error {
+	if a.Asking < 0 {
+		return fmt.Errorf("delivery: the ask's asking %d is negative", a.Asking)
+	}
 	key, err := MergeAskKey(a.Group, a.Heads)
 	if err != nil {
 		return fmt.Errorf("delivery: an ask needs its group and at least one pull request's head: %w", err)
 	}
-	if want := AskID(key); a.Ask.ID != want {
-		return fmt.Errorf("delivery: the ask's id %q is not %q, the id its group and heads give", a.Ask.ID, want)
+	if want := AskingID(key, a.Asking); a.Ask.ID != want {
+		return fmt.Errorf("delivery: the ask's id %q is not %q, the id its group, heads and asking %d give", a.Ask.ID, want, a.Asking)
 	}
 	if len(a.Ask.Options) == 0 {
 		return fmt.Errorf("delivery: the ask has no option")
@@ -265,12 +326,14 @@ func (a Answer) check() error {
 	return nil
 }
 
-// Owed is the value of an owed key: what the forge bridge performs. A status needs Context and State, a view and a
-// comment need Text, a note needs Text and Ref (the notes ref, mesh-plan).
+// Owed is the value of an owed key: what the forge bridge performs. A status needs Context, State and Target (the
+// address the status points at), a view and a comment need Text, a note needs Text and Ref (the notes ref,
+// mesh-plan).
 type Owed struct {
 	V       int    `json:"v"`
 	Act     string `json:"act"`
 	Context string `json:"context,omitempty"`
+	Target  string `json:"target,omitempty"`
 	State   string `json:"state,omitempty"`
 	Text    string `json:"text,omitempty"`
 	Ref     string `json:"ref,omitempty"`
@@ -282,6 +345,9 @@ func (o Owed) check() error {
 		if o.Context == "" {
 			return fmt.Errorf("delivery: an owed status has no context")
 		}
+		if o.Target == "" {
+			return fmt.Errorf("delivery: an owed status has no target")
+		}
 		for _, s := range statusStates {
 			if o.State == s {
 				return nil
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/manifests.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/manifests.go
new file mode 100644
index 00000000..d0d0bcd2
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/manifests.go
@@ -0,0 +1,85 @@
+package delivery
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"unicode/utf8"
+)
+
+// ManifestDigest is the hex sha256 of a manifest's bytes exactly as read at the commit: the key of a manifests value
+// and the digest a Module and a candidate's module carry (novox/hq ADR 0429 clause 16).
+func ManifestDigest(raw []byte) string {
+	sum := sha256.Sum256(raw)
+	return hex.EncodeToString(sum[:])
+}
+
+// ManifestsKey is the key, in ManifestsBucket, of a manifest: its digest, 64 lowercase hex digits. The indexer
+// writes it once, by a create that fails when the key exists.
+func ManifestsKey(digest string) (string, error) {
+	if !isHex64(digest) {
+		return "", fmt.Errorf("delivery: %q is not a manifest digest, 64 lowercase hex digits", digest)
+	}
+	return digest, nil
+}
+
+// ParseManifestsKey is the inverse of ManifestsKey.
+func ParseManifestsKey(key string) (digest string, err error) {
+	if digest, err = ManifestsKey(key); err != nil {
+		return "", fmt.Errorf("delivery: %q is not a manifests key: %w", key, err)
+	}
+	return digest, nil
+}
+
+// Manifest is the value of a manifests key: the module and its manifest, the raw text of its module.json as read at the
+// commit, byte for byte (ManifestDigest of JSON is the key). It is the one value of delivery that is larger than about
+// 500 bytes: the largest manifest of the catalogue is about 21 KB. It is a string, not nested JSON, because nesting
+// would re-write the manifest's spacing and so change its digest.
+type Manifest struct {
+	V      int    `json:"v"`
+	Module string `json:"module"`
+	JSON   string `json:"manifest"`
+}
+
+func (m Manifest) check() error {
+	if err := checkName("module", m.Module); err != nil {
+		return err
+	}
+	if m.JSON == "" {
+		return fmt.Errorf("delivery: the manifest of %s is empty", m.Module)
+	}
+	if !utf8.ValidString(m.JSON) {
+		return fmt.Errorf("delivery: the manifest of %s is not UTF-8 text, which a value cannot hold byte for byte", m.Module)
+	}
+	if !json.Valid([]byte(m.JSON)) {
+		return fmt.Errorf("delivery: the manifest of %s is not JSON", m.Module)
+	}
+	return nil
+}
+
+// EncodeManifest is m as JSON at Version; it refuses a module that is not a name, and a manifest that is empty, not
+// UTF-8 or not JSON.
+func EncodeManifest(m Manifest) ([]byte, error) {
+	if err := m.check(); err != nil {
+		return nil, err
+	}
+	m.V = Version
+	return json.Marshal(m)
+}
+
+// DecodeManifest reads a manifests value; it refuses an unknown version (ErrUnknownVersion) and what EncodeManifest
+// refuses.
+func DecodeManifest(data []byte) (Manifest, error) {
+	var m Manifest
+	if err := decode(data, &m); err != nil {
+		return Manifest{}, err
+	}
+	if err := m.check(); err != nil {
+		return Manifest{}, err
+	}
+	return m, nil
+}
+
+// SameManifest says whether two manifests are the same value, so a writer writes only when they differ.
+func SameManifest(a, b Manifest) bool { return a == b }
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/source.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/source.go
index 533fb32f..31c1a9a0 100644
--- a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/source.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/source.go
@@ -31,6 +31,10 @@ const (
 	ModulesBucket     = IndexerModule + "_modules"
 	// ModulesHistory is the revisions the modules bucket keeps per key.
 	ModulesHistory = 20
+	// ManifestsBucket is the indexer's bucket of manifests by digest (novox/hq ADR 0429 clause 16); see manifests.go.
+	ManifestsBucket = IndexerModule + "_manifests"
+	// ManifestsHistory is the revisions the manifests bucket keeps per key: a key is written once.
+	ManifestsHistory = 1
 )
 
 // ForgeStream is the forge bridge's stream as its manifest declares it; the broker derives the real names.
@@ -41,8 +45,19 @@ const (
 	ForgePull    = "pull"
 	ForgeMerged  = "merged"
 	ForgeRefused = "refused"
+	ForgeOpen    = "open"
 )
 
+// OpenPull names an open pull request into the trunk: the repository as `<owner>/<name>` and the number.
+type OpenPull struct {
+	Repository string `json:"repository"`
+	Number     int    `json:"number"`
+}
+
+// OpenEvent is the name of an open message: `forge.open`. It names no repository: it says every open pull request of
+// every repository the forge bridge reads (novox/hq ADR 0443 §5).
+func OpenEvent() string { return "forge." + ForgeOpen }
+
 // The actions of a pull message.
 const (
 	PullOpened  = "opened"
@@ -56,18 +71,62 @@ const SourcePrefix = "src1:"
 // CandidatesKey is the key, in CandidatesBucket, of a group: `<group>`, the branch name the group's pull requests
 // share (a slash is allowed); a lone pull request is a group of one under its branch name.
 func CandidatesKey(group string) (string, error) {
-	if err := checkName("group", group); err != nil {
+	return groupKey(group)
+}
+
+// ParseCandidatesKey is the inverse of CandidatesKey.
+func ParseCandidatesKey(key string) (group string, err error) {
+	if group, err = parseGroupKey(key); err != nil {
+		return "", fmt.Errorf("delivery: %q is not a candidates key: %w", key, err)
+	}
+	return group, nil
+}
+
+// groupKey is a group name as a key part: escaped (EscapeName), so a branch such as `fix/1.2` keys.
+func groupKey(group string) (string, error) {
+	if group == "" {
+		return "", fmt.Errorf("delivery: the group name is empty")
+	}
+	return EscapeName(group), nil
+}
+
+// parseGroupKey is the inverse of groupKey.
+func parseGroupKey(part string) (string, error) {
+	if part == "" {
+		return "", fmt.Errorf("delivery: the group name is empty")
+	}
+	group, err := UnescapeName(part)
+	if err != nil {
 		return "", err
 	}
 	return group, nil
 }
 
-// ParseCandidatesKey is the inverse of CandidatesKey.
-func ParseCandidatesKey(key string) (group string, err error) {
-	if group, err = CandidatesKey(key); err != nil {
-		return "", fmt.Errorf("delivery: %q is not a candidates key: %w", key, err)
+// escapeRepository is `<owner>/<name>` as a key part, each part escaped; the repository must have exactly one slash
+// and neither part empty.
+func escapeRepository(repository string) (string, error) {
+	owner, name, ok := strings.Cut(repository, "/")
+	if !ok || owner == "" || name == "" || strings.Contains(name, "/") {
+		return "", fmt.Errorf("delivery: the repository %q is not <owner>/<name>, with exactly one slash", repository)
 	}
-	return group, nil
+	return EscapeName(owner) + "/" + EscapeName(name), nil
+}
+
+// unescapeRepository is the inverse of escapeRepository.
+func unescapeRepository(part string) (string, error) {
+	owner, name, ok := strings.Cut(part, "/")
+	if !ok || owner == "" || name == "" || strings.Contains(name, "/") {
+		return "", fmt.Errorf("delivery: the repository %q is not <owner>/<name>, with exactly one slash", part)
+	}
+	o, err := UnescapeName(owner)
+	if err != nil {
+		return "", err
+	}
+	n, err := UnescapeName(name)
+	if err != nil {
+		return "", err
+	}
+	return o + "/" + n, nil
 }
 
 // ModulesKey is the key, in ModulesBucket, of a module: `<module>`.
@@ -106,18 +165,21 @@ func checkRepository(repository string) error {
 
 func checkForgeKind(kind string) error {
 	switch kind {
-	case ForgePull, ForgeMerged, ForgeRefused:
+	case ForgePull, ForgeMerged, ForgeRefused, ForgeOpen:
 		return nil
 	}
-	return fmt.Errorf("delivery: the forge kind %q is not pull, merged or refused", kind)
+	return fmt.Errorf("delivery: the forge kind %q is not pull, merged, refused or open", kind)
 }
 
 // ForgeEvent is the name of a forge message of the given kind: `forge.<owner>.<name>.<kind>`.
 func ForgeEvent(repository, kind string) (string, error) {
-	if err := checkRepository(repository); err != nil {
+	if err := checkForgeKind(kind); err != nil {
 		return "", err
 	}
-	if err := checkForgeKind(kind); err != nil {
+	if kind == ForgeOpen {
+		return "", fmt.Errorf("delivery: an open message names no repository, its event is %s", OpenEvent())
+	}
+	if err := checkRepository(repository); err != nil {
 		return "", err
 	}
 	owner, name, _ := strings.Cut(repository, "/")
@@ -126,6 +188,9 @@ func ForgeEvent(repository, kind string) (string, error) {
 
 // ParseForgeEvent is the inverse of ForgeEvent.
 func ParseForgeEvent(event string) (repository, kind string, err error) {
+	if event == OpenEvent() {
+		return "", ForgeOpen, nil
+	}
 	parts := strings.Split(event, ".")
 	if len(parts) != 4 || parts[0] != "forge" {
 		return "", "", fmt.Errorf("delivery: %q is not a forge event, forge.<owner>.<name>.<kind>", event)
@@ -184,19 +249,86 @@ func (s Source) check() error {
 
 // Candidate is the value of a candidates key: the group's pull requests and heads, the heads hash, the base (the
 // source revision it was previewed onto) and the modules each pull request touches. It carries no fingerprint
-// until release 4 (ADR 0437 §5).
+// until release 4 (ADR 0437 §5); from R4c the indexer writes the new form's fingerprint of each touched module in
+// the pull request's Fps and, over all of them, FPSet (novox/hq ADR 0453 clauses 6 and 16). Both are absent in a
+// value written before, and a reader of today's shape ignores them.
 type Candidate struct {
 	V         int             `json:"v"`
 	Group     string          `json:"group"`
 	Base      uint64          `json:"base"`
 	HeadsHash string          `json:"heads"`
 	Pulls     []CandidatePull `json:"pulls"`
+	FPSet     string          `json:"fpset,omitempty"`
 }
 
-// CandidatePull is one pull request of a candidate and the modules it touches.
+// CandidatePull is one pull request of a candidate and the modules it touches. Fps is, by module name, the new
+// form's fingerprint of the module at the merge preview, or why it has none, and the digest of its manifest (the key
+// of the indexer's manifests bucket); a module of Modules without an entry has none written yet.
 type CandidatePull struct {
 	Head
-	Modules []string `json:"modules"`
+	Modules []string                   `json:"modules"`
+	Fps     map[string]CandidateModule `json:"fps,omitempty"`
+}
+
+// CandidateModule is one touched module's new-form fingerprint FP2 (`src2:` and 64 hex digits), or None2, the reason
+// it has none; exactly one of them. Manifest is the digest of the module's manifest as read at the preview.
+type CandidateModule struct {
+	FP2      string `json:"fp2,omitempty"`
+	None2    string `json:"none2,omitempty"`
+	Manifest string `json:"manifest,omitempty"`
+}
+
+func (m CandidateModule) check() error {
+	switch {
+	case m.FP2 != "" && m.None2 != "":
+		return fmt.Errorf("delivery: a module has both fp2 and none2")
+	case m.FP2 == "" && m.None2 == "":
+		return fmt.Errorf("delivery: a module has neither fp2 nor none2")
+	}
+	return checkNewForm(m.FP2, m.Manifest)
+}
+
+// checkNewForm refuses an fp2 that is not of the new form and a manifest digest that is not a digest, naming it.
+func checkNewForm(fp2, manifest string) error {
+	if fp2 != "" {
+		if _, err := FingerprintKeyPart(fp2); err != nil {
+			return err
+		}
+	}
+	if manifest != "" {
+		if _, err := ManifestsKey(manifest); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// FingerprintSet is the fpset of a candidate's pull requests: the first 12 hex digits of the sha256 over the lines
+// `<module>=<fp2>` or `<module>=none:<reason>` of every module with an entry in Fps, sorted and joined by a newline,
+// so it is the same for every order and changes with any fingerprint or reason. A manifest digest does not enter: the
+// fingerprint already covers the manifest. It is the empty string when no pull request carries a fingerprint. The
+// checker keys its verdict by it (research 063 section 01).
+func FingerprintSet(pulls []CandidatePull) string {
+	lines := map[string]bool{}
+	for _, p := range pulls {
+		for module, m := range p.Fps {
+			if m.FP2 != "" {
+				lines[module+"="+m.FP2] = true
+			} else {
+				lines[module+"=none:"+m.None2] = true
+			}
+		}
+	}
+	if len(lines) == 0 {
+		return ""
+	}
+	all := make([]string, 0, len(lines))
+	for l := range lines {
+		all = append(all, l)
+	}
+	sort.Strings(all)
+	sum := sha256.Sum256([]byte(strings.Join(all, "\n")))
+	return hex.EncodeToString(sum[:])[:12]
 }
 
 func (c Candidate) check() error {
@@ -211,16 +343,46 @@ func (c Candidate) check() error {
 	if c.HeadsHash != want {
 		return fmt.Errorf("delivery: the candidate's heads hash %q is not the hash %q of its pull requests' heads", c.HeadsHash, want)
 	}
+	seen := map[string]CandidateModule{}
+	for _, p := range c.Pulls {
+		touched := map[string]bool{}
+		for _, m := range p.Modules {
+			touched[m] = true
+		}
+		for module, m := range p.Fps {
+			if !touched[module] {
+				return fmt.Errorf("delivery: the candidate gives a fingerprint of the module %q, which pull request %s#%d does not touch", module, p.Repository, p.Number)
+			}
+			if err := m.check(); err != nil {
+				return fmt.Errorf("delivery: the candidate's module %q: %w", module, err)
+			}
+			if before, ok := seen[module]; ok && before != m {
+				return fmt.Errorf("delivery: two pull requests of the candidate give the module %q different fingerprints", module)
+			}
+			seen[module] = m
+		}
+	}
+	if wantSet := FingerprintSet(c.Pulls); c.FPSet != wantSet {
+		return fmt.Errorf("delivery: the candidate's fpset %q is not the hash %q of its fingerprints", c.FPSet, wantSet)
+	}
 	return nil
 }
 
 // Module is the value of a modules key: the module's source fingerprint, or none and why (a build that resolves
 // packages when built gets none, said here), and where it was computed: Repository and Commit are the trunk merge,
 // Src the source revision then (0 before the gate writes source.main). Exactly one of FP and None is set.
+//
+// From R4c the indexer writes the new form beside it (novox/hq ADR 0453 clause 6): FP2, the fingerprint of the new
+// form (`src2:` and 64 hex digits), or None2, why it has none; one of them whenever either is, never both; and
+// Manifest, the digest of the module's manifest, the key of the manifests bucket. A value written before has none of
+// the three, and a reader of today's shape ignores them.
 type Module struct {
 	V          int    `json:"v"`
 	FP         string `json:"fp,omitempty"`
 	None       string `json:"none,omitempty"`
+	FP2        string `json:"fp2,omitempty"`
+	None2      string `json:"none2,omitempty"`
+	Manifest   string `json:"manifest,omitempty"`
 	Src        uint64 `json:"src,omitempty"`
 	Repository string `json:"repository"`
 	Commit     string `json:"commit"`
@@ -234,14 +396,18 @@ func (m Module) check() error {
 		return fmt.Errorf("delivery: a module has neither a fingerprint nor a reason for none")
 	case m.FP != "" && !strings.HasPrefix(m.FP, SourcePrefix):
 		return fmt.Errorf("delivery: the module's fingerprint %q does not start with %s", m.FP, SourcePrefix)
+	case m.FP2 != "" && m.None2 != "":
+		return fmt.Errorf("delivery: a module has both fp2 and none2")
 	}
-	return nil
+	return checkNewForm(m.FP2, m.Manifest)
 }
 
 // Forge is a message of the forge bridge's stream, trimmed to repository, branch, pull request and head. A pull
 // message says Action; a merged message carries the merge commit, the tree of every directory holding a
 // module.json and the repository's root tree; a refused message names the owed act it answers and the forge's own
-// words.
+// words. A pull message may also carry the module directories its head changes (Dirs, in the order the forge said) and
+// DirsKnown, true when the forge could say them: known and empty is DirsKnown with no Dirs, not known is neither
+// (the forge's module_dirs and module_dirs_said, mesh-catalog modules/gitea/trunk.ts). Other messages carry neither.
 type Forge struct {
 	V          int               `json:"v"`
 	Kind       string            `json:"kind"`
@@ -250,18 +416,27 @@ type Forge struct {
 	Number     int               `json:"number,omitempty"`
 	Head       string            `json:"head,omitempty"`
 	Action     string            `json:"action,omitempty"`
+	Dirs       []string          `json:"dirs,omitempty"`
+	DirsKnown  bool              `json:"dirs-known,omitempty"`
 	Merge      string            `json:"merge,omitempty"`
 	Trees      map[string]string `json:"trees,omitempty"`
 	Root       string            `json:"root,omitempty"`
 	Act        string            `json:"act,omitempty"`
 	Words      string            `json:"words,omitempty"`
+	Open       []OpenPull        `json:"open,omitempty"`
 }
 
 func (f Forge) check() error {
-	if err := checkRepository(f.Repository); err != nil {
+	if err := checkForgeKind(f.Kind); err != nil {
 		return err
 	}
-	if err := checkForgeKind(f.Kind); err != nil {
+	if f.Kind == ForgeOpen {
+		return f.checkOpen()
+	}
+	if len(f.Open) > 0 {
+		return fmt.Errorf("delivery: only an open message names open pull requests")
+	}
+	if err := checkRepository(f.Repository); err != nil {
 		return err
 	}
 	switch f.Kind {
@@ -277,7 +452,13 @@ func (f Forge) check() error {
 		default:
 			return fmt.Errorf("delivery: the pull action %q is not opened, updated or closed", f.Action)
 		}
+		if len(f.Dirs) > 0 && !f.DirsKnown {
+			return fmt.Errorf("delivery: a pull message with module directories must say it knows them (dirs-known)")
+		}
 	case ForgeMerged:
+		if len(f.Dirs) > 0 || f.DirsKnown {
+			return fmt.Errorf("delivery: a merged message carries no module directories")
+		}
 		if f.Number <= 0 {
 			return fmt.Errorf("delivery: a merged message needs its pull request number")
 		}
@@ -299,6 +480,9 @@ func (f Forge) check() error {
 			}
 		}
 	case ForgeRefused:
+		if len(f.Dirs) > 0 || f.DirsKnown {
+			return fmt.Errorf("delivery: a refused message carries no module directories")
+		}
 		if f.Act == "" {
 			return fmt.Errorf("delivery: a refused message needs the act it answers")
 		}
@@ -309,6 +493,24 @@ func (f Forge) check() error {
 	return nil
 }
 
+// checkOpen refuses an open message that names a repository, a branch, a head or anything of the other kinds, or
+// an open pull request that is not `<owner>/<name>` and a number.
+func (f Forge) checkOpen() error {
+	if f.Repository != "" || f.Branch != "" || f.Number != 0 || f.Head != "" || f.Action != "" || len(f.Dirs) > 0 || f.DirsKnown ||
+		f.Merge != "" || len(f.Trees) > 0 || f.Root != "" || f.Act != "" || f.Words != "" {
+		return fmt.Errorf("delivery: an open message carries only the open pull requests it names")
+	}
+	for _, p := range f.Open {
+		if err := checkRepository(p.Repository); err != nil {
+			return err
+		}
+		if p.Number <= 0 {
+			return fmt.Errorf("delivery: the open pull request of %s has no number", p.Repository)
+		}
+	}
+	return nil
+}
+
 // EncodeSource is s as JSON at Version; it refuses a source with no repository or an empty head.
 func EncodeSource(s Source) ([]byte, error) {
 	if err := s.check(); err != nil {
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/delivery/trunk.go b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/trunk.go
new file mode 100644
index 00000000..42d79717
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/delivery/trunk.go
@@ -0,0 +1,32 @@
+package delivery
+
+import "strings"
+
+// RepositoryName is the repository as the forge names it, "owner/name", from either spelling the mesh holds: the name
+// itself, or the clone URL a build record carries ("http://host:port/owner/name.git", with or without ".git" or a
+// trailing slash). A string of fewer than two path segments is returned as it is, trimmed (issue 1281).
+func RepositoryName(s string) string {
+	s = strings.TrimSpace(s)
+	s = strings.TrimRight(s, "/")
+	s = strings.TrimSuffix(s, ".git")
+	s = strings.TrimRight(s, "/")
+	parts := strings.FieldsFunc(s, func(r rune) bool { return r == '/' || r == ':' })
+	if len(parts) < 2 {
+		return s
+	}
+	return parts[len(parts)-2] + "/" + parts[len(parts)-1]
+}
+
+// SameRepository is whether two spellings name one repository: the same owner and name, whichever way each is written
+// (RepositoryName), compared without regard to case as the forge does. An empty spelling names none (issue 1281).
+func SameRepository(a, b string) bool {
+	a, b = RepositoryName(a), RepositoryName(b)
+	return a != "" && strings.EqualFold(a, b)
+}
+
+// IsTrunkBuild is whether the record is a successful build of the trunk that recorded its source inputs: an outcome
+// (the controller writes no state on one; state asked is a request, records.go:57-59), not failed, and ref "main" or none. A build a delivery plan asked after a merge, or rebuild or build --behind, follows the branch
+// without naming it, so it carries no ref; a build of any other branch or of a commit names it (issue 1281).
+func (r BuildRecord) IsTrunkBuild() bool {
+	return r.State == "" && r.Failed == "" && r.SourceInputs != nil && (r.Ref == "" || r.Ref == "main")
+}
diff --git a/internal/facts/facts.go b/vendor/git.novox.be/novox/mesh-sdk/go/facts/facts.go
similarity index 84%
rename from internal/facts/facts.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/facts/facts.go
index 6526db66..c6333cd9 100644
--- a/internal/facts/facts.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/facts/facts.go
@@ -17,6 +17,9 @@
 // secret is withheld, an address is replaced by one from a documentation range, and a machine's name, a
 // site, an account and a public domain are replaced wherever they appear. So a snapshot can be copied
 // into a test, a replay or a pull request without carrying anything of the installation it came from.
+//
+// Copied from mesh-controller internal/facts at 6c2a8d62 (R4b, issue 1380); the one change is each machine's
+// Grants and Bindings, from format 2.
 package facts
 
 import (
@@ -29,7 +32,17 @@ import (
 
 // Format is the snapshot's version. A reader refuses one newer than it knows: a field it cannot read
 // is a fact it would judge without.
-const Format = 1
+//
+// Format 2 is the first to carry a machine's Grants and Bindings (GrantsFrom): a reader of format 1 refuses a
+// snapshot of 2 rather than judge a change to a credential or a binding without them, and a reader of 2 reads a
+// snapshot of 1 as one whose machines have none. MediaType stays as it is: it names the kind of document, and the
+// format inside it says which fields it carries.
+const Format = 2
+
+// GrantsFrom is the first format that carries each machine's Grants and Bindings (novox/hq ADR 0446 section 2): the
+// credentials made for the consumers of what the machine provides, and where each of its consumers of a provision is
+// bound. A snapshot of an earlier format says nothing of them, which is not the same as saying there are none.
+const GrantsFrom = 2
 
 // Repository and Tag are where the controller keeps the newest snapshot in the artifact store, and
 // MediaType what it is kept as.
@@ -150,6 +163,14 @@ type Machine struct {
 	// Accepted are the secrets a person gave the mesh for modules here, by name only: the mesh cannot
 	// make them, so a check composing this machine gives each a stand-in instead of refusing it.
 	Accepted []Accepted `json:"accepted,omitempty"`
+	// Grants are the pair credentials made for the consumers of what this machine provides (mesh-controller's
+	// inv.SecretsFrom for it): who each is for, never the credential, sealed or not. Written from format GrantsFrom; an
+	// assigner reads them as compose.Input.Issued.
+	Grants []Grant `json:"grants,omitempty"`
+	// Bindings are where each consumer on this machine was last bound to a provision that keeps data (mesh-controller's
+	// inv.BindingsFor for it), by consumer module and provision. Written from format GrantsFrom; an assigner reads them
+	// as compose.Node.Bound.
+	Bindings []Binding `json:"bindings,omitempty"`
 	// Declaration is how its declaration composes today, as the controller that took this saw it.
 	Declaration Declaration `json:"declaration"`
 }
@@ -177,6 +198,25 @@ type Accepted struct {
 	Local    string `json:"local,omitempty"`
 }
 
+// Grant is one pair credential made for a consumer of a provision this machine provides: the provision, the machine and
+// module that consume it, and the local name the consumer takes it under. The machine is a pseudonym. Nothing of the
+// credential is here, not even sealed (compose.Issued without its ForProvider).
+type Grant struct {
+	Provision      string `json:"provision"`
+	ConsumerNode   string `json:"consumer-node"`
+	ConsumerModule string `json:"consumer-module"`
+	Local          string `json:"local,omitempty"`
+}
+
+// Binding is where one consumer module on this machine was last bound for a provision: the provider's machine (a
+// pseudonym) and module (compose.Node.Bound).
+type Binding struct {
+	ConsumerModule string `json:"consumer-module"`
+	Provision      string `json:"provision"`
+	ProviderNode   string `json:"provider-node"`
+	ProviderModule string `json:"provider-module"`
+}
+
 // Settings is one layer of one module's settings.
 type Settings struct {
 	Module string         `json:"module"`
@@ -263,6 +303,15 @@ func (f *Facts) Sorted() {
 		sort.Slice(m.Capabilities, func(a, b int) bool { return m.Capabilities[a].Name < m.Capabilities[b].Name })
 		sort.Slice(m.Pins, func(a, b int) bool { return m.Pins[a].Provision < m.Pins[b].Provision })
 		sort.Slice(m.Settings, func(a, b int) bool { return m.Settings[a].Module < m.Settings[b].Module })
+		sort.Slice(m.Grants, func(a, b int) bool {
+			x, y := m.Grants[a], m.Grants[b]
+			return x.Provision+"\x00"+x.ConsumerNode+"\x00"+x.ConsumerModule+"\x00"+x.Local <
+				y.Provision+"\x00"+y.ConsumerNode+"\x00"+y.ConsumerModule+"\x00"+y.Local
+		})
+		sort.Slice(m.Bindings, func(a, b int) bool {
+			x, y := m.Bindings[a], m.Bindings[b]
+			return x.ConsumerModule+"\x00"+x.Provision < y.ConsumerModule+"\x00"+y.Provision
+		})
 		sort.Slice(m.Accepted, func(a, b int) bool {
 			x, y := m.Accepted[a], m.Accepted[b]
 			return x.Module+"\x00"+x.Name+"\x00"+x.Provider+"\x00"+x.Local < y.Module+"\x00"+y.Name+"\x00"+y.Provider+"\x00"+y.Local
diff --git a/internal/facts/scrub.go b/vendor/git.novox.be/novox/mesh-sdk/go/facts/scrub.go
similarity index 94%
rename from internal/facts/scrub.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/facts/scrub.go
index 4615bb34..febc1f52 100644
--- a/internal/facts/scrub.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/facts/scrub.go
@@ -54,6 +54,17 @@ func NewScrubber() *Scrubber { return &Scrubber{seen: map[string]bool{}} }
 // Machine registers a machine's name and answers its pseudonym.
 func (s *Scrubber) Machine(name string) string { return s.word("machine", name) }
 
+// Grant is a grant with the consumer's machine under its pseudonym, as a pin's machine is: the one place a grant is
+// built from a real name.
+func (s *Scrubber) Grant(provision, consumerNode, consumerModule, local string) Grant {
+	return Grant{Provision: provision, ConsumerNode: s.Machine(consumerNode), ConsumerModule: consumerModule, Local: local}
+}
+
+// Binding is a binding with the provider's machine under its pseudonym.
+func (s *Scrubber) Binding(consumerModule, provision, providerNode, providerModule string) Binding {
+	return Binding{ConsumerModule: consumerModule, Provision: provision, ProviderNode: s.Machine(providerNode), ProviderModule: providerModule}
+}
+
 // Site registers a site's name and answers its pseudonym.
 func (s *Scrubber) Site(name string) string { return s.word("site", name) }
 
diff --git a/internal/overlay/declaration.go b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/declaration.go
similarity index 100%
rename from internal/overlay/declaration.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/overlay/declaration.go
diff --git a/vendor/git.novox.be/novox/mesh-sdk/go/overlay/doc.go b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/doc.go
new file mode 100644
index 00000000..8a9f1b7c
--- /dev/null
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/doc.go
@@ -0,0 +1,5 @@
+// Package overlay is the private network's generator, copied from mesh-controller internal/overlay at commit
+// 6c2a8d62100cb7d491f8eb9a623e1eeea5ec0de1 (novox/hq ADR 0453 clause 3, ADR 0446 clause 4): the files are unchanged but
+// for the import path of the catalogue, which is mesh-sdk's go/catalogue, and this note. mesh-controller keeps its own copy
+// until release 4b.
+package overlay
diff --git a/internal/overlay/generator.go b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/generator.go
similarity index 99%
rename from internal/overlay/generator.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/overlay/generator.go
index 6c829f0b..d74087dc 100644
--- a/internal/overlay/generator.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/generator.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"github.com/novox/mesh-controller/internal/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 )
 
 // The private network as a module rather than as code beside the module system.
diff --git a/internal/overlay/graph.go b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/graph.go
similarity index 100%
rename from internal/overlay/graph.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/overlay/graph.go
diff --git a/internal/overlay/names.go b/vendor/git.novox.be/novox/mesh-sdk/go/overlay/names.go
similarity index 100%
rename from internal/overlay/names.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/overlay/names.go
diff --git a/vendor/github.com/novox/mesh-host/validate/validate.go b/vendor/git.novox.be/novox/mesh-sdk/go/validate/validate.go
similarity index 83%
rename from vendor/github.com/novox/mesh-host/validate/validate.go
rename to vendor/git.novox.be/novox/mesh-sdk/go/validate/validate.go
index aa140890..1291866a 100644
--- a/vendor/github.com/novox/mesh-host/validate/validate.go
+++ b/vendor/git.novox.be/novox/mesh-sdk/go/validate/validate.go
@@ -8,6 +8,10 @@
 // changed. So the host's own parsing is exported here, unchanged: what the controller's self-check and
 // the merge gate run is what every machine runs.
 //
+// Copied from mesh-host at commit 619e14aa8e572c5056e3d2a2412c7f8b364bf840 (validate/validate.go), unchanged but for
+// the import path of the parser, which is mesh-sdk's go/declaration (novox/hq ADR 0453 clause 3, ADR 0446 clause 4).
+// mesh-host keeps its own copy until release 4b.
+//
 // It judges a declaration as it arrives over the link: actions are refused, as the host refuses them
 // from the link (novox/hq ADR 0005). Nothing here touches a machine.
 package validate
@@ -15,7 +19,7 @@ package validate
 import (
 	"errors"
 
-	"github.com/novox/mesh-host/internal/declaration"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
 )
 
 // Declaration is every problem the node-engine would refuse a declaration for, each in its own words;
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ff0a7f49..8e1f1467 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,8 +1,14 @@
-# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261019091011-aa68b67389c9
+# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261020085642-ab0c16ddad26
 ## explicit; go 1.26.0
 git.novox.be/novox/mesh-sdk/go/asks
+git.novox.be/novox/mesh-sdk/go/catalogue
+git.novox.be/novox/mesh-sdk/go/compose
+git.novox.be/novox/mesh-sdk/go/declaration
 git.novox.be/novox/mesh-sdk/go/delivery
+git.novox.be/novox/mesh-sdk/go/facts
+git.novox.be/novox/mesh-sdk/go/overlay
 git.novox.be/novox/mesh-sdk/go/seal
+git.novox.be/novox/mesh-sdk/go/validate
 # github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op
 ## explicit; go 1.24.0
 github.com/antithesishq/antithesis-sdk-go/assert
@@ -82,9 +88,7 @@ github.com/nats-io/nkeys
 github.com/nats-io/nuid
 # github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261018171808-9d9e3a46c4f5
 ## explicit; go 1.26.0
-github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/rootsearch
-github.com/novox/mesh-host/validate
 # github.com/therootcompany/xz v1.0.1
 ## explicit; go 1.15
 github.com/therootcompany/xz