Derive the terminal's settings from what a module serves and which files it trusts; a found directory is its own condition

The third review of #170 (hq issue 339): a setting overrides any key a
provider serves, so any caller of the settings verb could move a database's
port, a registry's port or an issuer to a listener of its own and collect
what consumers present. TerminalKeys now derives from the manifest: places,
accesses, every served key and every setting a served value asks for, and
every setting a file marked `trusted` asks for. `trusted` is the catalogue's
word, taken out before the declaration; `module check` warns of a file that
asks for a setting without saying, and refuses it from 2026-10-30. The hand
list is gone. A directory used as found is now its own condition kind, the
operator's, never urgent, and the gate exempts it where it exempts a relogin.

cmd/mesh-controller/terminal_settings_test.go

@@ -151,22 +151,33 @@ func TestPlacesAndAccessesAreRefusedThroughEveryVerb(t *testing.T) {
 	}
 }
 
-// The mesh's trust anchors are set at the terminal alone (novox/hq issue 339): through the settings verb, a caller
-// could replace the internal authority's root every consumer trusts, or the issuer every login is checked against.
-func TestATrustAnchorIsRefusedThroughAVerb(t *testing.T) {
+// What a provider serves is set at the terminal alone (novox/hq issue 339): through the settings verb, a caller
+// could move a database's port to a listener of its own and collect every consumer's credentials, or point every
+// login at an issuer of its own.
+func TestAServedKeyIsRefusedThroughAVerb(t *testing.T) {
 	open := aMesh(t)
 	ctx := t.Context()
-	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
-		Provides: catalogue.FromAnywhere("acme-ca"),
-		Serves:   map[string]map[string]any{"acme-ca": {"root": "", "path": "/acme/acme/directory"}},
-		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/step.conf", "mode": "0644",
-			"content": "x = ${setting:x}\n"}}})
+	register(t, open, catalogue.Manifest{Module: "store", Version: "1",
+		Provides: catalogue.FromAnywhere("database"),
+		Serves:   map[string]map[string]any{"database": {"port": 5432.0}},
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/store.conf", "mode": "0644",
+			"trusted": false, "content": "x = ${setting:x}\n"}}})
 	register(t, open, catalogue.Manifest{Module: "keycloak", Version: "1",
 		Provides: catalogue.FromAnywhere("oidc-client"),
 		Serves:   map[string]map[string]any{"oidc-client": {"issuer": "${setting:issuer}"}},
 		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/kc.conf", "mode": "0644",
-			"content": "issuer = ${setting:issuer}\nx = ${setting:x}\n"}}})
-	for _, m := range []string{"step-ca", "keycloak"} {
+			"trusted": false, "content": "x = ${setting:x}\n"}}})
+	register(t, open, catalogue.Manifest{Module: "power", Version: "1",
+		Resources: []map[string]any{{"id": "logind", "type": "file", "path": "/etc/systemd/logind.conf.d/power.conf",
+			"mode": "0644", "trusted": true, "content": "HandleLidSwitch=${setting:lid}\nx=${setting:x}\n"}}})
+	if err := atTheTerminal(t, "settings", "set", "keycloak", `{"issuer":"https://id.example/realms/mesh","x":0}`,
+		"--node", "anchor"); err != nil {
+		t.Fatalf("the issuer at the terminal: %v", err)
+	}
+	if err := atTheTerminal(t, "settings", "set", "power", `{"lid":"suspend","x":0}`, "--node", "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []string{"store", "keycloak", "power"} {
 		if _, err := assign(ctx, open, "anchor", m); err != nil {
 			t.Fatal(err)
 		}
@@ -177,20 +188,23 @@ func TestATrustAnchorIsRefusedThroughAVerb(t *testing.T) {
 			t.Fatalf("%s: %v", what, err)
 		}
 	}
-	if err := atTheTerminal(t, "settings", "set", "keycloak", `{"issuer":"https://id.example/realms/mesh","x":0}`,
-		"--node", "anchor"); err != nil {
-		t.Fatalf("the issuer at the terminal: %v", err)
-	}
+	refused("a served port through the verb", throughVerb(t, "settings", map[string]any{"module": "store",
+		"node": "anchor", "values": `{"port":6543,"x":0}`}))
+	refused("a served port, mesh-wide, through the verb", throughVerb(t, "settings",
+		map[string]any{"module": "store", "values": `{"port":6543}`}))
 	refused("the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
 		"node": "anchor", "values": `{"issuer":"https://evil.example/realms/mesh","x":0}`}))
-	refused("the authority's root path through the verb", throughVerb(t, "settings", map[string]any{"module": "step-ca",
-		"node": "anchor", "values": `{"path":"/evil","x":0}`}))
-	refused("the authority's root path, mesh-wide, through the verb", throughVerb(t, "settings",
-		map[string]any{"module": "step-ca", "values": `{"path":"/evil"}`}))
 	refused("clearing the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
 		"node": "anchor", "clear": "true"}))
 	if err := throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor",
 		"values": `{"issuer":"https://id.example/realms/mesh","x":1}`}); err != nil {
 		t.Fatalf("another key through the verb, the issuer kept: %v", err)
 	}
+	refused("a setting a trusted file asks for, through the verb", throughVerb(t, "settings", map[string]any{
+		"module": "power", "node": "anchor", "values": `{"lid":"ignore","x":0}`}))
+	// And `trusted` is the catalogue's word: it never reaches the machine, whose engine parses strictly.
+	plan := printed(t, func() error { return atTheTerminal(t, "plan", "anchor", "--json") })
+	if strings.Contains(plan, `"trusted"`) {
+		t.Fatal("the declaration carries the catalogue's `trusted`")
+	}
 }