The mesh's knowledge is a fact a module asks for, not three modules

mesh-names, mesh-resolver and the names half of the overlay generators are gone.
They ran no software and could not be swapped for anything, which is the test of
whether something is a module at all — they existed because computed output
needed somewhere to live, and the control plane's only shape for output was a
module.

Now a module says where it wants what the mesh knows:

  facts: { node-zones: /etc/mesh-resolver/nodes.conf }

and is given a file, under its own name, applied and removed like anything else
it declares. Two facts exist: node-names (a hosts file — exact names) and
node-zones (every machine as a wildcard, *.homer.internal is homer). Asking for
a fact the mesh does not compute is refused naming what would have worked,
because a daemon that starts and reads a file nobody wrote is a worse way to
find out.

The names ride with the network now: wireguard's manifest asks for node-names
into /etc/hosts, because being on the private network is what gives a machine a
name. networking no longer requires name-resolution — names are not a provision,
and the module that answered it ran nothing.

One behaviour inverted, deliberately: choosing another VPN used to drag
WireGuard in anyway, because only WireGuard provided the addressing the names
module required — the node-scope claim existed to at least make that loud. With
names as a fact there is nothing to drag in: tailscale assigned means tailscale,
alone. The claim still catches two VPNs assigned explicitly.

And a machine the mesh cannot place is left out of both files rather than named
at nothing: a name resolving to nothing hangs a connection, where an unknown
name fails at once and says so. In practice that is only ever a token issued and
not yet used — a machine that has announced itself has an address.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

examples/modules/modules_test.go

@@ -64,13 +64,16 @@ func TestTheResolverReadsTheMeshsNamesAndFollowsThem(t *testing.T) {
 	if config == nil || service == nil {
 		t.Fatal("the module has no configuration or no service")
 	}
-	if !strings.Contains(config["content"].(string), overlay.ResolverPath) {
-		t.Fatalf("it does not read what the mesh writes at %s", overlay.ResolverPath)
+	// The zone file is a FACT the module asks for, at a path it chose. The mesh writes it there;
+	// what reads it and how is this module's own business, which is the whole shape.
+	const zones = "/etc/mesh-resolver/nodes.conf"
+	if !strings.Contains(config["content"].(string), zones) {
+		t.Fatalf("it does not read what the mesh writes at %s", zones)
 	}
 
 	var follows bool
 	for _, id := range service["restart-on"].([]any) {
-		if id.(string) == overlay.Resolver+".nodes" {
+		if id.(string) == "dnsmasq.fact-node-zones" {
 			follows = true
 		}
 	}