A no-move tier waits for no new report, so its walk asks the next tier (issue 648)

A build made from the source every machine running it runs is marked sent
and sent nothing, yet the tier's wait asked each machine for a report after
that marking. None follows, and the walk waited for ever. Each machine is
now judged by whether it answered its last send, the one whose builds made
the build no move.

cmd/mesh-controller/accept_outside.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164, issue 165):
+// given once for its provider, at the controller's terminal, and sealed in one act to every consumer that binds the
+// provision from that provider now. The value is never read back, printed or kept.
+
+// outsideOffer is the provider module's own name when `secret accept <node> <module> <name>` names a provision that
+// module offers with a credential issued outside the mesh, and "" when it names anything else (an own secret, or a
+// pair with --provider).
+func outsideOffer(ctx context.Context, module, name, provider string) (string, error) {
+	if provider != "" {
+		return "", nil
+	}
+	open, err := openStores(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer open.Close()
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	if m, known := shelf[module]; known && m.IssuedOutsideOf(name) {
+		return module, nil
+	}
+	return "", nil
+}
+
+// offeredOutsideBy is a module that offers the provision with a credential issued outside the mesh, or "".
+func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
+	open, err := openStores(ctx)
+	if err != nil {
+		return "", err
+	}
+	defer open.Close()
+	shelf, err := open.inventory.Catalogue(ctx)
+	if err != nil {
+		return "", err
+	}
+	module, _ := catalogue.OffersIssuedOutside(shelf, provision)
+	return module, nil
+}
+
+// consumersFrom is every consumer that binds a provision from one provider now, found by resolving every machine as
+// its next send would, and the machines that could not be resolved, with why.
+func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
+	[]inventory.PairEnd, []string, error) {
+	nodes, err := open.inventory.Nodes(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	var out []inventory.PairEnd
+	var unresolved []string
+	for _, n := range nodes {
+		plan, _, err := planFor(ctx, open, n.Name)
+		if err != nil {
+			unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
+			continue
+		}
+		out = append(out, bindsFrom(plan, n.Name, provider, providerModule, provision)...)
+	}
+	return out, unresolved, nil
+}
+
+// bindsFrom is every consumer on one machine whose resolution answers the provision from that provider. Pure.
+func bindsFrom(plan catalogue.Resolution, machine, provider, providerModule, provision string) []inventory.PairEnd {
+	var out []inventory.PairEnd
+	for _, need := range plan.Needs {
+		if need.ByRecord || need.Name != provision || need.From != provider {
+			continue
+		}
+		if need.Module != "" && need.Module != providerModule {
+			continue
+		}
+		out = append(out, inventory.PairEnd{Consumer: machine, ConsumerModule: need.For, Local: need.Local})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return out[i].ConsumerModule+"\x00"+out[i].Local < out[j].ConsumerModule+"\x00"+out[j].Local
+	})
+	return out
+}
+
+// acceptForProvision gives a provision's credential issued outside the mesh, once for its provider (ADR 0337 §3).
+func acceptForProvision(ctx context.Context, provider, providerModule, provision, value string) error {
+	open, err := openStores(ctx)
+	if err != nil {
+		return err
+	}
+	defer open.Close()
+	consumers, unresolved, err := consumersFrom(ctx, open, provider, providerModule, provision)
+	if err != nil {
+		return err
+	}
+	accepted, err := open.inventory.AcceptSecretForProvision(ctx, provision, provider, providerModule, value, consumers)
+	value = ""
+	if err != nil {
+		return err
+	}
+	fmt.Print(acceptedSaid(provider, providerModule, provision, accepted, unresolved))
+	if len(accepted.Sealed) == 0 {
+		return nil
+	}
+	if err := sendTo(ctx, open, accepted.Machines); err != nil {
+		return fmt.Errorf("%s is sealed and could not be sent: %w; `push %s` sends it", provision, err,
+			strings.Join(accepted.Machines, "`, `push "))
+	}
+	fmt.Printf("  sent %s; each consumer starts again on it\n", strings.Join(accepted.Machines, ", "))
+	return nil
+}
+
+// acceptedSaid is what one accept for a provider did, in words that never carry the value. Pure.
+func acceptedSaid(provider, providerModule, provision string, a inventory.ProvisionAccepted, unresolved []string) string {
+	var b strings.Builder
+	if len(a.Sealed) == 0 {
+		fmt.Fprintf(&b, "%s from %s on %s: no consumer binds it now, so nothing was sealed; a consumer that binds "+
+			"later waits for it, and this line given again seals it to every consumer then\n", provision,
+			providerModule, provider)
+	} else {
+		var names []string
+		for _, c := range a.Sealed {
+			names = append(names, fmt.Sprintf("%s on %s%s", c.ConsumerModule, c.Consumer, asLocal(c.Local)))
+		}
+		fmt.Fprintf(&b, "%s from %s on %s is given, sealed to %s and to %s\n", provision, providerModule, provider,
+			strings.Join(names, ", "), provider)
+		fmt.Fprintf(&b, "  the mesh cannot read it back, never makes one of its own for it, and will not rotate it\n")
+	}
+	for _, c := range a.Unsealable {
+		fmt.Fprintf(&b, "  not sealed to %s on %s: no sealing key on that machine; give it again once it has one\n",
+			c.ConsumerModule, c.Consumer)
+	}
+	for _, u := range unresolved {
+		fmt.Fprintf(&b, "  not known whether a consumer on %s binds it, which did not resolve; give it again once it does\n", u)
+	}
+	return b.String()
+}

cmd/mesh-controller/acts.go

@@ -203,8 +203,9 @@ func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, mo
 	if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
 		return nil, nil, err
 	}
-	// Two modules declaring one package, path or unit is refused before anything is recorded
-	// (novox/hq ADR 0210, 04-ISSUES/235): kept, the node would not resolve until one came off again.
+	// Two modules declaring one path or unit, or one package present and absent, is refused before anything
+	// is recorded (novox/hq ADR 0210, ADR 0303, 04-ISSUES/235): kept, the node would not resolve until one came
+	// off again. Two modules declaring one package present is not a collision (ADR 0303, issue 628).
 	if err := catalogue.CollisionRefusal(shelf, node, assigned, adding); err != nil {
 		return nil, nil, err
 	}

cmd/mesh-controller/adoption.go

@@ -722,7 +722,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
 		return "", err
 	}
 	derived := derivedFilter{rules: rules, foundation: with.Foundation, mesh: with.Mesh,
-		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks}
+		outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks, local: with.LocalNetworks}
 	filtering, err := inv.FilteringOf(ctx, node)
 	if err != nil {
 		return "", err
@@ -930,6 +930,9 @@ type derivedFilter struct {
 	// The filter constrains what arrives on them; everything arriving elsewhere is this machine's
 	// own guest and is not filtered.
 	outwardLinks []string
+	// local is the machine's local networks, which a port from `local-network` stays open to (novox/hq
+	// ADR 0340).
+	local []string
 }
 
 // closesOutside is what a narrowing from everywhere to the private network is called: it closes.
@@ -977,6 +980,17 @@ func (d derivedFilter) fate(r inventory.Reach) string {
 			if !onMesh {
 				return fmt.Sprintf("%s — declared by %s from the mesh only", closesOutside, by)
 			}
+		case catalogue.FromLocalNetwork:
+			// The private network and this machine's local networks (novox/hq ADR 0340): it closes to
+			// everything else outside, and says which local networks stay.
+			if !onMesh {
+				if len(d.local) == 0 {
+					return fmt.Sprintf("%s — declared by %s from the local network, and this machine "+
+						"reported none", closesOutside, by)
+				}
+				return fmt.Sprintf("WILL CLOSE to everything outside the private network and %s — declared "+
+					"by %s from the local network", strings.Join(d.local, ", "), by)
+			}
 		}
 		return fmt.Sprintf("declared by %s (from %s)", by, rule.From)
 	}

cmd/mesh-controller/handacts_test.go

@@ -55,7 +55,7 @@ func TestARepairByHandCarriesItsReason(t *testing.T) {
 		want string
 	}{
 		{"push", map[string]any{"node": "anchor", "why": "stuck", "cause": "sent-not-reported"},
-			"push anchor --wait 0 --why stuck --cause sent-not-reported"},
+			"push anchor --wait 0s --why stuck --cause sent-not-reported"},
 		{"plans", map[string]any{"close": "plan-1", "why": "the report will not come"},
 			"plans close plan-1 --why the report will not come"},
 		{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},

cmd/mesh-controller/issue648_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A tier whose module is no move — made from the source every machine running it runs, so nothing is
+// sent — is not waited on for a report after its marking (novox/hq issue 648). Its machines answered the
+// send that last carried that build before the walk got there, and nothing will make them report again:
+// the walk asks the next tier in the same step, rather than "waiting for app on anchor, laptop" for ever.
+func TestANoMoveTierWaitsForNoNewReport(t *testing.T) {
+	judgeLeavesAsTheCore(t)
+	g := aGateMesh(t)
+	ctx := t.Context()
+	inv := g.open.inventory
+
+	// app is the build machine, so a module of the next tier is built by it: the tier gates the next on app
+	// running on its machines.
+	for _, m := range []catalogue.Manifest{
+		{Module: "app", Version: "c2", Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}},
+		{Module: "web", Version: "w1"},
+	} {
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog", Seat: "git",
+			Path: "modules/" + m.Module, BuiltFrom: m.Version, Head: m.Version, Asked: time.Now().Add(-time.Minute)}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// What anchor and laptop were last sent (c1) was made from the source the plan's build of c2 is.
+	for _, b := range []inventory.Build{
+		{ID: "build-1s", Module: "app", Commit: "c1", SourceFingerprint: "src1:app",
+			Asked: time.Now().Add(-30 * time.Second), At: time.Now().Add(-30 * time.Second)},
+		{ID: "build-2s", Module: "app", Commit: "c2", SourceFingerprint: "src1:app", Asked: time.Now(), At: time.Now()},
+	} {
+		b.Manifest, _ = json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+		if err := inv.RecordBuild(ctx, b); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Each machine answered that send, applied, before the walk's tier was built.
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.RecordDoing(ctx, nodeID(t, g.open, n), inventory.Doing{Node: n,
+			Outcome: inventory.OutcomeApplied, Declared: "d-" + n + "-c1", Applied: 1,
+			At: time.Now().Add(-10 * time.Second)}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	built := time.Now().UTC()
+	p := g.plan(t)
+	p.Tiers = [][]string{{"app"}, {"web"}}
+	p.Modules["app"].Build, p.Modules["app"].BuiltAt = "build-2s", &built
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+
+	advancePlans(ctx, g.open)
+
+	if len(g.sent) != 0 {
+		t.Fatalf("a no-move build was sent: %v", g.sent)
+	}
+	p = g.plan(t)
+	if s := p.Modules["app"]; s == nil || !strings.HasPrefix(s.Why, "no move") {
+		t.Fatalf("the build was not marked no move: %+v", s)
+	}
+	if p.Tier < 1 || strings.Contains(p.Note, "waiting for app") {
+		t.Fatalf("the walk waits on a no-move tier for a report nothing will cause: tier %d, %s %q", p.Tier, p.State, p.Note)
+	}
+
+	// A machine that has not answered its last send is still waited on: no move is not "never sent".
+	p.Tier, p.State, p.Note = 0, inventory.PlanRolling, ""
+	if err := inv.RecordSent(ctx, nodeID(t, g.open, "laptop"), "d-laptop-later", map[string]string{"app": "c1"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		t.Fatal(err)
+	}
+	advancePlans(ctx, g.open)
+	p = g.plan(t)
+	if p.Tier != 0 || !strings.Contains(p.Note, "waiting for app on laptop") {
+		t.Fatalf("a machine that has not answered its last send was not waited on: tier %d, %q", p.Tier, p.Note)
+	}
+}

cmd/mesh-controller/local_network.go

@@ -0,0 +1,67 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/overlay"
+)
+
+// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local
+// network, from what it last said of itself and the links it said face outside it. A machine that has
+// said none judges to nothing, and a port reached from `local-network` is then admitted from the private
+// network only, and said so.
+func localNetworksOf(ctx context.Context, inv *inventory.Inventory, node string) ([]catalogue.LocalNetwork, error) {
+	account, had, err := inv.MachineOf(ctx, node)
+	if err != nil {
+		return nil, err
+	}
+	outward, err := inv.OutwardLinksOf(ctx, node)
+	if err != nil {
+		return nil, err
+	}
+	return judgedNetworks(account, had, outward, overlay.Interface), nil
+}
+
+// judgedNetworks is the judging alone, from what was read.
+func judgedNetworks(account inventory.MachineAccount, had bool, outward []string, tunnel string) []catalogue.LocalNetwork {
+	if !had || account.Machine == nil {
+		return nil
+	}
+	attached := make([]catalogue.AttachedNetwork, 0, len(account.Machine.Networks))
+	for _, n := range account.Machine.Networks {
+		attached = append(attached, catalogue.AttachedNetwork{Link: n.Link, Network: n.Network})
+	}
+	return catalogue.JudgeLocalNetworks(attached, outward, tunnel)
+}
+
+// localNetworkLines is what `node` shows of a machine's attached networks (ADR 0340 §8): each one, with
+// whether it counts as the local network and why, or why none is shown.
+func localNetworkLines(account inventory.MachineAccount, had bool, judged []catalogue.LocalNetwork) []string {
+	out := []string{"  its local network (what a port reached from local-network is admitted from):"}
+	switch {
+	case !had || account.Machine == nil:
+		return append(out, "    not said — this machine has not reported what it is attached to")
+	case len(account.Machine.Networks) == 0:
+		why := account.Machine.Unknown["networks"]
+		if why == "" {
+			why = "its node-engine is older than the one that says it"
+		}
+		return append(out, "    not said — "+why)
+	}
+	counted := 0
+	for _, j := range judged {
+		verdict := "not counted"
+		if j.Counts {
+			verdict = "counts"
+			counted++
+		}
+		out = append(out, fmt.Sprintf("    %-22s on %-10s %s: %s", j.Network, j.Link, verdict, j.Why))
+	}
+	if counted == 0 {
+		out = append(out, "    none counts: a port reached from local-network is admitted from the private network only")
+	}
+	return out
+}

cmd/mesh-controller/local_network_test.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **node shows what the local network resolved to** (novox/hq ADR 0340 §8): every attached network,
+// whether it counts, and why the others do not — the public subnet named as never counted.
+func TestNodeShowsWhichAttachedNetworksCountAndWhy(t *testing.T) {
+	account := inventory.MachineAccount{Architecture: "amd64", Kernel: "linux", Machine: &inventory.MadeOf{
+		Networks: []inventory.AttachedNetwork{
+			{Link: "eth0", Network: "192.168.1.10/24"},
+			{Link: "eth1", Network: "203.0.113.7/24"},
+			{Link: "wg-mesh", Network: "10.10.0.4/24"},
+		}}}
+	judged := judgedNetworks(account, true, []string{"eth0", "eth1"}, "wg-mesh")
+	text := strings.Join(localNetworkLines(account, true, judged), "\n")
+	for _, want := range []string{
+		"192.168.1.0/24", "counts: in a private range (RFC 1918, 192.168.0.0/16)",
+		"203.0.113.0/24", "not counted: public, never counted",
+		"10.10.0.0/24", "the private network's own link",
+	} {
+		if !strings.Contains(text, want) {
+			t.Errorf("node does not say %q:\n%s", want, text)
+		}
+	}
+}
+
+// A machine that said none, or whose node-engine is older, is said as that — never as an empty list
+// that reads like a machine on no network.
+func TestNodeSaysWhenNoNetworkWasSaid(t *testing.T) {
+	older := inventory.MachineAccount{Machine: &inventory.MadeOf{}}
+	if text := strings.Join(localNetworkLines(older, true, nil), "\n"); !strings.Contains(text, "older than the one that says it") {
+		t.Errorf("an older node-engine is not said:\n%s", text)
+	}
+	public := inventory.MachineAccount{Machine: &inventory.MadeOf{
+		Networks: []inventory.AttachedNetwork{{Link: "eth0", Network: "198.51.100.9/24"}}}}
+	judged := judgedNetworks(public, true, []string{"eth0"}, "wg-mesh")
+	if text := strings.Join(localNetworkLines(public, true, judged), "\n"); !strings.Contains(text, "none counts") {
+		t.Errorf("a machine on a public network only is not said to have no local network:\n%s", text)
+	}
+	if text := strings.Join(localNetworkLines(inventory.MachineAccount{}, false, nil), "\n"); !strings.Contains(text, "not said") {
+		t.Errorf("a machine that never reported is not said:\n%s", text)
+	}
+}
+
+// The preview of a flip says what a port from the local network keeps: the local networks it stays
+// open to, or that the machine reported none (ADR 0340 §6).
+func TestTheFlipPreviewSaysWhatALocalNetworkPortKeeps(t *testing.T) {
+	rules := []catalogue.Rule{{Port: 1883, Protocol: "tcp", From: catalogue.FromLocalNetwork, Because: []string{"mosquitto"}}}
+	at := inventory.Reach{Protocol: "tcp", Address: "0.0.0.0", Port: 1883}
+	with := derivedFilter{rules: rules, mesh: []string{"10.10.0.1"}, outwardLinks: []string{"eth0"},
+		local: []string{"192.168.1.0/24"}}
+	if fate := with.fate(at); !strings.Contains(fate, "192.168.1.0/24") {
+		t.Errorf("the preview says %q, without the local network it stays open to", fate)
+	}
+	with.local = nil
+	if fate := with.fate(at); !strings.Contains(fate, "reported none") {
+		t.Errorf("the preview says %q, without saying no local network was reported", fate)
+	}
+}

cmd/mesh-controller/module_health.go

@@ -75,7 +75,7 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 			State: r.State, Reason: r.Reason, Since: r.Since, Streak: r.Streak, Restarts: r.Restarts,
 			Check: r.Check, Needs: r.Needs, Account: r.Account, Root: r.Root}
 		for _, w := range r.Waits {
-			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, What: w.What})
+			kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, Provision: w.Provision, What: w.What})
 		}
 		resources = append(resources, kept)
 	}

cmd/mesh-controller/network.go

@@ -684,7 +684,7 @@ func artifactStoreOnNetwork(ctx context.Context, inv *inventory.Inventory,
 			if !offers {
 				continue
 			}
-			serves, err := servedOnNode(ctx, inv, machine, m, catalogue.ArtifactStoreProvision)
+			serves, _, err := servedOnNode(ctx, inv, machine, m, catalogue.ArtifactStoreProvision)
 			if err != nil {
 				return "", "", false, fmt.Errorf("reading where %s puts the artifact store: %w", machine, err)
 			}

cmd/mesh-controller/nodes.go

@@ -19,6 +19,7 @@ import (
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/overlay"
 	"github.com/novox/mesh-controller/internal/token"
 )
 
@@ -884,6 +885,16 @@ func showNode(ctx context.Context, stored *stores, name string) error {
 		for _, line := range machineLines(account, had, time.Now()) {
 			fmt.Println(line)
 		}
+		// And which of the networks it is attached to count as its local network, and why the others
+		// do not (novox/hq ADR 0340 §8).
+		outward, err := inv.OutwardLinksOf(ctx, name)
+		if err != nil {
+			fmt.Printf("  its local network could NOT be judged: %v\n", err)
+		} else {
+			for _, line := range localNetworkLines(account, had, judgedNetworks(account, had, outward, overlay.Interface)) {
+				fmt.Println(line)
+			}
+		}
 	}
 
 	held, err := inv.Profile(ctx, name)

cmd/mesh-controller/operator_wait.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -44,6 +45,28 @@ func needsOperatorKey(module, node string) string {
 type operatorWaitFacts struct {
 	manifests map[string]catalogue.Manifest
 	given     map[string]map[string]time.Time
+	// outside is, per provision some module offers with a credential issued outside the mesh, that provider module
+	// and the machines it is assigned to (novox/hq ADR 0337); pairsGiven, per "<module>@<machine>", the provisions
+	// it holds a value a person gave for, sealed to the keys both ends have now. Absent is not known: no wait for a
+	// provision of it is excused.
+	outside    map[string]outsideProvider
+	pairsGiven map[string]map[string]bool
+}
+
+// outsideProvider is the module offering a provision whose credential only a person gives, and where it runs.
+type outsideProvider struct {
+	Module   string
+	Machines []string
+}
+
+// acceptLine is the one line that gives an outside provision's credential for every consumer of its provider: on
+// the provider's machine when it runs on one, named as <machine> when on several or none.
+func (p outsideProvider) acceptLine(provision string) string {
+	machine := "<its machine>"
+	if len(p.Machines) == 1 {
+		machine = p.Machines[0]
+	}
+	return inventory.AcceptLine(machine, p.Module, provision)
 }
 
 // checkWait is nil when a wait is excused, and otherwise why not, in words. Pure.
@@ -52,9 +75,18 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	if !known {
 		return fmt.Errorf("says it waits for %s, and the mesh holds no manifest of %s to check it against", waitNames(w), module)
 	}
+	named := 0
+	for _, n := range []string{w.Secret, w.Setting, w.Provision} {
+		if n != "" {
+			named++
+		}
+	}
 	switch {
-	case w.Secret != "" && w.Setting != "", w.Secret == "" && w.Setting == "":
-		return fmt.Errorf("says it waits, naming %s, where a wait names one secret or one setting", waitNames(w))
+	case named != 1:
+		return fmt.Errorf("says it waits, naming %s, where a wait names one secret, one setting or one provision",
+			waitNames(w))
+	case w.Provision != "":
+		return checkProvisionWait(module, machine, w, m, f)
 	case w.Setting != "":
 		if _, declared := m.Settings[w.Setting]; !declared {
 			return fmt.Errorf("says it waits for the setting %s, which %s does not declare", w.Setting, module)
@@ -80,20 +112,46 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
 	return nil
 }
 
+// checkProvisionWait excuses a wait for a provision's credential only when the store bears it out (novox/hq ADR 0337
+// §6): the module requires the provision, a provider offers it with a credential issued outside the mesh, and the
+// module on this machine holds no value a person gave for it under the keys both ends have now.
+func checkProvisionWait(module, machine string, w inventory.Wait, m catalogue.Manifest, f operatorWaitFacts) error {
+	if !slices.Contains(m.Requires, w.Provision) {
+		return fmt.Errorf("says it waits for the provision %s, which %s does not require", w.Provision, module)
+	}
+	if _, outside := f.outside[w.Provision]; !outside {
+		return fmt.Errorf("says it waits for the provision %s, whose credential the mesh gives itself: only a "+
+			"credential issued outside the mesh waits for the operator", w.Provision)
+	}
+	given, readable := f.pairsGiven[module+"@"+machine]
+	if !readable {
+		return fmt.Errorf("says it waits for the provision %s, and what was given on %s could not be read", w.Provision, machine)
+	}
+	if given[w.Provision] {
+		return fmt.Errorf("says it waits for the provision %s, whose credential was given", w.Provision)
+	}
+	return nil
+}
+
 // waitRefusedPrefix opens every reason checkWait gives, so the words of a refused wait are told from a check's own.
 const waitRefusedPrefix = "says it waits"
 
 // waitNames is what a wait names, as "the secret x" or "the setting y".
 func waitNames(w inventory.Wait) string {
-	switch {
-	case w.Secret != "" && w.Setting != "":
-		return "the secret " + w.Secret + " and the setting " + w.Setting
-	case w.Secret != "":
-		return "the secret " + w.Secret
-	case w.Setting != "":
-		return "the setting " + w.Setting
+	var names []string
+	if w.Secret != "" {
+		names = append(names, "the secret "+w.Secret)
 	}
-	return "nothing"
+	if w.Setting != "" {
+		names = append(names, "the setting "+w.Setting)
+	}
+	if w.Provision != "" {
+		names = append(names, "the provision "+w.Provision)
+	}
+	if len(names) == 0 {
+		return "nothing"
+	}
+	return strings.Join(names, " and ")
 }
 
 // checkWaiting reads one machine's resources against the facts: every waiting resource whose waits all check out is
@@ -107,11 +165,17 @@ func checkWaiting(machine string, rs []inventory.ResourceHealth, f operatorWaitF
 			if len(r.Waits) == 0 {
 				why = fmt.Errorf("says it waits, and names nothing it waits for")
 			}
+			waits := make([]inventory.Wait, 0, len(r.Waits))
 			for _, w := range r.Waits {
 				if why == nil {
 					why = checkWait(r.Module, machine, w, f)
 				}
+				if p, outside := f.outside[w.Provision]; outside && w.Provision != "" {
+					w.Act = p.acceptLine(w.Provision)
+				}
+				waits = append(waits, w)
 			}
+			r.Waits = waits
 			if why != nil {
 				r.State, r.Reason = link.StateUnhealthy, why.Error()
 			}
@@ -150,6 +214,10 @@ func operatorWaitSaid(module, machine string, waits []inventory.Wait) string {
 		if w.Secret != "" {
 			part += fmt.Sprintf(", given with `nox secret ask %s %s %s`", machine, module, w.Secret)
 		}
+		if w.Provision != "" && w.Act != "" {
+			// One line for the provider, which seals it to every consumer of it (ADR 0337 §3, §7).
+			part += fmt.Sprintf(", given for every consumer with `%s`", w.Act)
+		}
 		parts = append(parts, part+")")
 	}
 	return fmt.Sprintf("%s on %s waits for the operator: %s", module, machine, strings.Join(parts, "; "))
@@ -172,7 +240,7 @@ func needsOperatorObservation(module, node string, waits []inventory.Wait, rs []
 func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 	var acts []string
 	seen := map[string]bool{}
-	secret := false
+	secret, provision := false, false
 	for _, w := range waits {
 		var act string
 		switch {
@@ -180,6 +248,9 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 			act, secret = fmt.Sprintf("type %s at %s's desk prompt", w.What, node), true
 		case w.Setting != "":
 			act = fmt.Sprintf("approve %s of %s on %s when it is proposed to you", w.Setting, module, node)
+		case w.Provision != "":
+			// ADR 0337 §7: "give <what> of <provider> on <machine>"; the line is in the summary.
+			act, provision = "give "+w.What, true
 		}
 		if act != "" && !seen[act] {
 			seen[act] = true
@@ -197,6 +268,10 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
 		explanation += " A hidden prompt opens at the desk when the secret is asked for, and what you type there " +
 			"is sealed to the machine."
 	}
+	if provision {
+		explanation += " A key only you can give is given once for the app that issued it, and reaches every " +
+			"module that uses it."
+	}
 	explanation += " Its update is in place and nothing was undone; it carries on by itself once it is given."
 	return words{
 		Headline:    fmt.Sprintf("%s waits for you on %s", module, node),
@@ -217,6 +292,12 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 	if f.given == nil {
 		f.given = map[string]map[string]time.Time{}
 	}
+	if f.outside == nil {
+		f.outside = map[string]outsideProvider{}
+	}
+	if f.pairsGiven == nil {
+		f.pairsGiven = map[string]map[string]bool{}
+	}
 	if inv == nil {
 		return
 	}
@@ -238,15 +319,59 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
 				}
 			}
 		}
-		if _, read := f.given[module+"@"+machine]; read {
+		if _, read := f.given[module+"@"+machine]; !read {
+			if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
+				f.given[module+"@"+machine] = given
+			}
+		}
+		if _, read := f.pairsGiven[module+"@"+machine]; !read {
+			if given, err := inv.GivenPairsOf(ctx, machine, module); err == nil {
+				f.pairsGiven[module+"@"+machine] = given
+			}
+		}
+		// The provisions it requires whose credential only a person gives, and where their provider runs (ADR 0337).
+		m, known := f.manifests[module]
+		if !known {
 			continue
 		}
-		if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
-			f.given[module+"@"+machine] = given
+		for _, provision := range m.Requires {
+			if _, read := f.outside[provision]; read {
+				continue
+			}
+			if shelf == nil {
+				var err error
+				if shelf, err = inv.Catalogue(ctx); err != nil {
+					shelf = map[string]catalogue.Manifest{}
+				}
+			}
+			provider, outside := catalogue.OffersIssuedOutside(shelf, provision)
+			if !outside {
+				continue
+			}
+			f.outside[provision] = outsideProvider{Module: provider, Machines: machinesRunning(ctx, inv, provider)}
 		}
 	}
 }
 
+// machinesRunning is every machine a module is assigned to, by name; a read that fails is left out.
+func machinesRunning(ctx context.Context, inv *inventory.Inventory, module string) []string {
+	nodes, err := inv.Nodes(ctx)
+	if err != nil {
+		// Only the summary's accept line reads it, which then names the provider's machine "<its machine>".
+		// empty-on-error: no wait is excused or refused by it
+		return nil
+	}
+	var out []string
+	for _, n := range nodes {
+		assigned, err := inv.Assigned(ctx, n.Name)
+		if err == nil && slices.Contains(assigned, module) {
+			out = append(out, n.Name)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
 // waitingModules is every module with a waiting resource in a statement.
 func waitingModules(rs []inventory.ResourceHealth) []string {
 	seen := map[string]bool{}

cmd/mesh-controller/operator_wait_test.go

@@ -55,8 +55,8 @@ func TestAWaitIsExcusedOnlyWhenItChecksOut(t *testing.T) {
 		{"a secret the mesh makes", inventory.Wait{Part: "p", Secret: "made", What: "w"}, factsGiven(nil), "mesh makes itself"},
 		{"the bus account", inventory.Wait{Part: "p", Secret: "broker", What: "w"}, factsGiven(nil), "mesh makes itself"},
 		{"a setting not declared", inventory.Wait{Part: "p", Setting: "logins", What: "w"}, factsGiven(nil), "does not declare"},
-		{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret or one setting"},
-		{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret or one setting"},
+		{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
+		{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
 		{"no manifest known", passwordWait, operatorWaitFacts{}, "no manifest"},
 		{"what was given cannot be read", passwordWait,
 			operatorWaitFacts{manifests: map[string]catalogue.Manifest{"mounts": mountsManifest}}, "could not be read"},

cmd/mesh-controller/outside_accept_test.go

@@ -0,0 +1,83 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// One accept for a provider reaches every consumer that binds the provision from it, and each consumer's send
+// places it; the per-pair form naming a consumer is refused for such a provision, naming the provider's form; a
+// value the mesh made before the rule is not placed (novox/hq ADR 0337 §2, §3, §4, issue 164, issue 165). Needs the
+// store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestOneAcceptForAProviderIsPlacedForEveryConsumer(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	// Before the rule: tv's offer said nothing of its credential, and the send made one per pair.
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh}}})
+	for _, m := range []string{"requests", "indexer"} {
+		register(t, open, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
+			Secrets: map[string]string{"tv-api": "/var/lib/mesh/" + m + "/tv-api.secret"}})
+	}
+	for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}, {"laptop", "indexer"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	placed := func(module string) bool {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatalf("laptop was refused: %v", err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("laptop did not compose: %v", err)
+		}
+		for _, r := range declared.Resources {
+			if r["path"] == "/var/lib/mesh/"+module+"/tv-api.secret" && r["sealed"] != nil {
+				return true
+			}
+		}
+		return false
+	}
+
+	if !placed("requests") || !placed("indexer") {
+		t.Fatal("before the rule, the send made and placed a credential per pair")
+	}
+	// The offer now says only a person gives it: the values the mesh made are not placed.
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "2",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
+	if placed("requests") || placed("indexer") {
+		t.Fatal("a credential nobody gave was placed")
+	}
+
+	// The per-pair form is refused, naming the provider's form, and reads nothing.
+	file := filepath.Join(t.TempDir(), "key")
+	if err := os.WriteFile(file, []byte("the app's key\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := secretCommand(ctx, []string{"accept", "laptop", "requests", "tv-api", "--provider", "anchor", "--from", file})
+	if err == nil || !strings.Contains(err.Error(), "secret accept anchor tv tv-api") {
+		t.Fatalf("the per-pair form was not refused naming the provider's: %v", err)
+	}
+
+	consumers, unresolved, err := consumersFrom(ctx, open, "anchor", "tv", "tv-api")
+	if err != nil || len(unresolved) != 0 {
+		t.Fatalf("the consumers of tv on anchor could not be found: %v %v", err, unresolved)
+	}
+	if len(consumers) != 2 {
+		t.Fatalf("the consumers of tv on anchor are %+v; want requests and indexer on laptop", consumers)
+	}
+	if _, err := open.inventory.AcceptSecretForProvision(ctx, "tv-api", "anchor", "tv", "the app's key", consumers); err != nil {
+		t.Fatal(err)
+	}
+	if !placed("requests") || !placed("indexer") {
+		t.Fatal("the value given once for the provider was not placed for every consumer")
+	}
+}

cmd/mesh-controller/outside_wait_test.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A consumer may wait for a provision's credential only a person gives (novox/hq ADR 0337 §5–§7, issue 164).
+
+var requestsManifest = catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api", "db"},
+	Secrets: map[string]string{"tv-api": "/s/tv-api", "db": "/s/db"}}
+
+var tvKeyWait = inventory.Wait{Part: "the tv library", Provision: "tv-api", What: "the API key of tv"}
+
+func outsideFacts(given map[string]bool) operatorWaitFacts {
+	return operatorWaitFacts{manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
+		outside:    map[string]outsideProvider{"tv-api": {Module: "tv", Machines: []string{"media"}}},
+		pairsGiven: map[string]map[string]bool{"requests@laptop": given}}
+}
+
+// §6: excused only when the module requires the provision, its provider says it is issued outside, and no value a
+// person gave is held for the pair under the keys both ends have now.
+func TestAWaitForAProvisionIsExcusedOnlyWhenTheStoreBearsItOut(t *testing.T) {
+	for _, c := range []struct {
+		name string
+		w    inventory.Wait
+		f    operatorWaitFacts
+		says string
+	}{
+		{"required, issued outside, not given", tvKeyWait, outsideFacts(nil), ""},
+		{"given", tvKeyWait, outsideFacts(map[string]bool{"tv-api": true}), "was given"},
+		{"not required", inventory.Wait{Part: "p", Provision: "music-api", What: "w"}, outsideFacts(nil), "does not require"},
+		{"a credential the mesh gives itself", inventory.Wait{Part: "p", Provision: "db", What: "w"}, outsideFacts(nil),
+			"mesh gives itself"},
+		{"what was given cannot be read", tvKeyWait, operatorWaitFacts{
+			manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
+			outside:   map[string]outsideProvider{"tv-api": {Module: "tv"}}}, "could not be read"},
+		{"a provision and a secret", inventory.Wait{Part: "p", Provision: "tv-api", Secret: "x", What: "w"},
+			outsideFacts(nil), "one secret, one setting or one provision"},
+	} {
+		err := checkWait("requests", "laptop", c.w, c.f)
+		switch {
+		case c.says == "" && err != nil:
+			t.Errorf("%s: refused: %v", c.name, err)
+		case c.says != "" && (err == nil || !strings.Contains(err.Error(), c.says)):
+			t.Errorf("%s: %v; want a refusal saying %q", c.name, err, c.says)
+		}
+	}
+}
+
+// §7: an excused wait is the consumer's needs-operator condition, in plain words, its summary naming the one line
+// that gives the credential for every consumer of the provider; the wait as kept is not changed.
+func TestAWaitForAProvisionNamesTheOneAcceptForItsProvider(t *testing.T) {
+	r := inventory.ResourceHealth{Module: "requests", Resource: "requests.app", Kind: "container", Target: "requests",
+		State: link.StateWaiting, Check: "tool", Waits: []inventory.Wait{tvKeyWait}}
+	kept := []inventory.ResourceHealth{r}
+	got := checkWaiting("laptop", kept, outsideFacts(nil))
+	if got[0].State != link.StateWaiting {
+		t.Fatalf("an excused wait for a provision was judged: %+v", got[0])
+	}
+	if kept[0].Waits[0].Act != "" {
+		t.Fatal("checking the wait changed the statement as kept")
+	}
+	waits, waiting := operatorWait("requests", got)
+	if !waiting {
+		t.Fatal("the module does not read as waiting for the operator")
+	}
+	o := needsOperatorObservation("requests", "laptop", waits, got)
+	if !strings.Contains(o.Summary, "secret accept media tv tv-api") {
+		t.Fatalf("the summary does not name the accept for the provider: %q", o.Summary)
+	}
+	if !strings.HasPrefix(o.Needs, "give the API key of tv") {
+		t.Fatalf("the needs do not name the act: %q", o.Needs)
+	}
+	if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
+		Resolved: o.Resolved, Needs: o.Needs, Actions: o.Actions}, "laptop"); !ok {
+		t.Fatalf("the condition is not in plain words: %s", why)
+	}
+	// A provider on several machines, or none: the line names its machine as a place to fill.
+	if line := (outsideProvider{Module: "tv", Machines: []string{"a", "b"}}).acceptLine("tv-api"); line !=
+		"secret accept <its machine> tv tv-api" {
+		t.Fatalf("a provider on two machines reads %q", line)
+	}
+}
+
+// §3: the consumers one accept reaches are those whose resolution answers the provision from that provider.
+func TestTheConsumersOfAProviderAreThoseItAnswers(t *testing.T) {
+	plan := catalogue.Resolution{Needs: []catalogue.Needed{
+		{Name: "tv-api", From: "media", Module: "tv", For: "requests"},
+		{Name: "tv-api", From: "media", Module: "tv", For: "indexer", Local: "main"},
+		{Name: "tv-api", From: "other", Module: "tv", For: "elsewhere"},
+		{Name: "tv-api", From: "media", Module: "another-tv", For: "not-this-module"},
+		{Name: "db", From: "media", Module: "tv", For: "requests"},
+		{Name: "tv-api", ByRecord: true, For: "by-record"},
+	}}
+	got := bindsFrom(plan, "laptop", "media", "tv", "tv-api")
+	if len(got) != 2 || got[0].ConsumerModule != "indexer" || got[0].Local != "main" || got[1].ConsumerModule != "requests" {
+		t.Fatalf("the consumers from tv on media are %+v", got)
+	}
+	said := acceptedSaid("media", "tv", "tv-api", inventory.ProvisionAccepted{
+		Sealed:     []inventory.PairEnd{{Consumer: "laptop", ConsumerModule: "requests"}},
+		Unsealable: []inventory.PairEnd{{Consumer: "new", ConsumerModule: "indexer"}}}, []string{"down: refused"})
+	for _, want := range []string{"sealed to requests on laptop", "no sealing key", "down: refused"} {
+		if !strings.Contains(said, want) {
+			t.Errorf("what the accept says lacks %q:\n%s", want, said)
+		}
+	}
+}

cmd/mesh-controller/plan.go

@@ -182,12 +182,21 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 		}
 		var secret inventory.Secret
 		var err error
-		if n.SharedOwn != "" {
+		if outsideModule, outside := issuedOutsideBy(shelf, n); outside {
+			// Only a person can give it (novox/hq ADR 0337, issue 164): read as given, never made.
+			secret, err = inv.GivenPairSecret(ctx, n.Name, nodeName, n.For, n.From, outsideModule, n.Local)
+		} else if n.SharedOwn != "" {
 			// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
 			secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
 		} else {
 			secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
 		}
+		if inventory.IsNotGiven(err) {
+			// **Not given, and the rest of the consumer runs** (ADR 0337 §4): no credential file, so the module can
+			// tell it was not given and says it waits for it; the machine is not refused for what only a person can
+			// give, and nothing the mesh made stands in for it.
+			continue
+		}
 		if err != nil {
 			// Said rather than skipped. A machine that resolves cleanly and receives no
 			// credential is one that will fail to authenticate at some later, less obvious
@@ -280,9 +289,14 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
 			continue
 		}
 		caps, _ := inv.ProfileOf(ctx, n.Name)
+		// Its public domain too (novox/hq ADR 0346): a provider elsewhere serves its own composed names,
+		// and composes them as its own plan does, under its own domain.
+		// Read as its profile is: a machine whose domain cannot be read (removed since the list was read)
+		// composes no public name, which leaves the key out and says so, and fails no other machine's plan.
+		domain, _ := inv.PublicDomainOf(ctx, n.Name)
 		others = append(others, candidate{
 			catalogue.Node{Name: n.Name, Site: siteOf[n.Name], Capabilities: caps,
-				At: onNetwork[n.Name]}, theirs})
+				At: onNetwork[n.Name], PublicDomain: domain}, theirs})
 	}
 
 	offered := map[string][]catalogue.Provider{}
@@ -301,12 +315,18 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
 				// What that module says a consumer needs to know, with that node's settings on
 				// it: a port somebody moved on the provider is a port its consumers must be told
 				// about, and the two coming from different places is how they come to disagree.
-				serves, err := servedOnNode(ctx, inv, o.node.Name, m, name)
+				serves, layers, err := servedOnNode(ctx, inv, o.node.Name, m, name)
+				if err != nil {
+					return catalogue.World{}, err
+				}
+				// And its own composed names, as that node composes them (novox/hq ADR 0346): a name it
+				// does not compose leaves the key out, said under each consumer's need.
+				serves, leftOut, err := got.ServedOwnNames(m, name, serves, catalogue.WithDefaults(m, layers))
 				if err != nil {
 					return catalogue.World{}, err
 				}
 				offered[name] = append(offered[name], catalogue.Provider{
-					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module})
+					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
 			}
 		}
 	}
@@ -442,6 +462,12 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return sendable{}, err
 	}
+	// Which ports the filter admits from the local network, and from which networks, for plan to say
+	// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
+	rules, err := plan.Rules(with)
+	if err != nil {
+		return sendable{}, err
+	}
 	// And what was taken on it, said in every declaration it is sent from this one place.
 	adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
 	if err != nil {
@@ -451,7 +477,8 @@ func declarationWith(ctx context.Context, open *stores, node string,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
 		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
 		unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
-		modules: namedModules(plan, composed.LeftOut)}
+		modules:      namedModules(plan, composed.LeftOut),
+		localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -960,6 +987,12 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
+	// private ranges only, on a link facing outside it. Reported by the machine, never set.
+	local, err := localNetworksOf(ctx, inv, node)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
 	// 0222): the artifact store as this network reaches it, which the container runtime is told to
 	// trust (ADR 0082). The same address composed into every reference the mesh built.
@@ -984,7 +1017,8 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Machines: machines, Zones: zones, Holders: replicas,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
-		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
+		LocalNetworks: catalogue.CountedLocalNetworks(local),
+		Given:         given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
 		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
 	}, record, nil
 }
@@ -1403,6 +1437,16 @@ func planCommand(ctx context.Context, args []string) error {
 	// in this output would have told anybody that.
 	for _, n := range plan.Needs {
 		fmt.Printf("  needs %s from %s, for %s\n", n.Name, n.From, n.For)
+		// And a served key the provider left out, because its machine composes no name it asks for
+		// (novox/hq ADR 0346 §3).
+		for _, line := range n.LeftOut {
+			fmt.Printf("    %s\n", line)
+		}
+	}
+	// What the providers on this machine leave out of what they serve, and why: said where the remedy
+	// is (novox/hq ADR 0346 §3).
+	for _, line := range plan.ServedLeftOut(settings) {
+		fmt.Printf("%s: %s\n", args[0], line)
 	}
 	for _, line := range unboundLines(plan) {
 		fmt.Println(line)
@@ -1417,6 +1461,11 @@ func planCommand(ctx context.Context, args []string) error {
 			fmt.Printf("  %-20s settings from %s\n", module, layer.From)
 		}
 	}
+	// What each port reached from the local network resolved to on this machine (novox/hq ADR 0340 §8),
+	// or that it resolved to none.
+	for _, p := range declared.localNetwork {
+		fmt.Println("  " + p.Said())
+	}
 	fmt.Printf("\n%d resource(s)\n", len(resources))
 
 	if *show {
@@ -1538,19 +1587,20 @@ func managerPublicKeyFor(
 // artifact store's trust and the references composed through it (04-ISSUES/102). Unreadable
 // given ports are that node's refusal to report, not this reader's.
 func servedOnNode(ctx context.Context, inv *inventory.Inventory, node string,
-	m catalogue.Manifest, provision string) (map[string]any, error) {
+	m catalogue.Manifest, provision string) (map[string]any, []catalogue.Layer, error) {
 	ports, layers, err := portsGivenOn(ctx, inv, node, m)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	serves := catalogue.ServedOn(m, provision, ports)
 	if len(serves) > 0 {
 		serves, err = catalogue.Settle(serves, catalogue.WithDefaults(m, layers))
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 	}
-	return serves, nil
+	// The layers too, read once, for what is filled after (novox/hq ADR 0346).
+	return serves, layers, nil
 }
 
 // portsGivenOn is where a node puts a module's ports — assigned, then given over them — and the
@@ -1742,6 +1792,17 @@ func busUserList(ctx context.Context, inv *inventory.Inventory,
 
 // providerModuleOf is which module answers a need on the providing node: the one in this node's
 // own set when the provider is here, else the one the catalogue says offers it.
+// issuedOutsideBy is whether a need's provision is offered by its provider with a credential issued outside the
+// mesh (novox/hq ADR 0337), and that provider module: the one answering it when known, else any that offers it so.
+func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (string, bool) {
+	if n.Module != "" {
+		if m, known := shelf[n.Module]; known {
+			return n.Module, m.IssuedOutsideOf(n.Name)
+		}
+	}
+	return catalogue.OffersIssuedOutside(shelf, n.Name)
+}
+
 func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
 	for _, m := range resolved.Modules {
 		if _, shared := m.SharedCredentialOf(n.Name); shared {

cmd/mesh-controller/proposals.go

@@ -18,8 +18,9 @@ package main
 // it beside the layer (`settings` says it back), and records the warrant in the hand-act log on the bus, where a
 // person's decisions are read; the router edits the ask on every channel to its outcome. No seat event of its
 // own: nothing consumes one, and the installer's first user list in the node-engine's repository names every
-// controller event, so one would cost a node-engine change for a fact without a reader. The push afterwards is a
-// separate act, as it is for a layer set at the terminal.
+// controller event, so one would cost a node-engine change for a fact without a reader. No push is left for
+// afterwards: the warrant that sets the layer opens the walk that sends it (novox/hq ADR 0344, settings_walk.go),
+// so the operator's one Approve is the act that makes the change take effect.
 //
 // **What the operator reads** is the module, the machine, each key with its exact new value and, for a changed
 // key, the value it replaces. A value that may not leave the mesh (an address, a path, a secret's shape: the
@@ -27,6 +28,13 @@ package main
 // ask says so, and the whole is read with `settings proposals <id>` — whose fingerprint must be the one on the
 // phone. Fail closed: a proposal nothing can carry to the operator is refused at once, in words, and never left
 // waiting for an answer that cannot come.
+//
+// **On a channel that proves who answers, the values are shown WHOLE** (novox/hq issue 383, the operator's
+// decision of 2026-10-10): a mount point, a share name or a private address is the thing being approved and must
+// be readable, so the ask carries them whole beside the explanation (asks.Ask.Whole), the router shows that only
+// on a kind that verifies its sender, and only a value shaped like a secret is withheld there. The message is the
+// headline, one line per key, who proposed it and when; the fingerprint and how to read the proposal whole are
+// the Details answer's (asks.Ask.Details). The masking stays for conditions and for channels that prove nothing.
 
 import (
 	"context"
@@ -47,6 +55,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/asks"
 
 	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
 	"github.com/novox/mesh-controller/internal/outward"
 )
@@ -154,47 +163,48 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
 	if len([]rune(headline)) > asks.HeadlineLength {
 		headline = verb + " settings?"
 	}
-	shown, whole := p.change(machines)
-	var b strings.Builder
-	if p.Clear {
-		fmt.Fprintf(&b, "Clear the settings of %s on %s, back to what the module says?\n\n", p.Module, p.where())
-	} else {
-		fmt.Fprintf(&b, "Set the settings of %s on %s to these values?\n\n", p.Module, p.where())
+	// The message reads at a glance (issues 383 and 639): a summary of what changes where, then at most three
+	// points, a key each; every key with its whole value, who proposed it, the fingerprint and how to read it at the
+	// terminal are its Details, which the router notes after the answers.
+	shown, shownAll, shownWhole := p.change(machines, false)
+	whole, wholeAll, _ := p.change(machines, true)
+	summary := p.summary()
+	compose := func(points []string) string {
+		return strings.Join(append([]string{summary}, points...), "\n")
 	}
-	fmt.Fprintf(&b, "Proposed by %s, at %s. ", sayable(p.From, machines), p.At.Local().Format("15:04 on 2 Jan"))
-	switch {
-	case p.Clear && p.HadLayer:
-		b.WriteString("The layer it removes:\n\n")
-	case p.Clear:
-		b.WriteString("There is no layer to remove; approving changes nothing.")
-	case !p.HadLayer:
-		b.WriteString("There is no layer yet; this is the whole of it:\n\n")
-	default:
-		b.WriteString("The layer is replaced whole; what changes against it:\n\n")
+	// The Details: every setting it sets, one line each, uncut — whole where the sender is proven (WholeDetails),
+	// masked elsewhere — then who proposed it, the fingerprint and how to read it at the terminal.
+	details := func(lines []string) string {
+		var d strings.Builder
+		d.WriteString(strings.Join(lines, "\n") + "\n")
+		d.WriteString(p.onApprove() + "\n")
+		fmt.Fprintf(&d, "Proposed by %s at %s. Fingerprint %s.\n", sayable(p.From, machines), p.At.Local().Format("15:04 on 2 Jan"),
+			fingerprint(p.Digest))
+		if !shownWhole {
+			d.WriteString("Where who answers is not proven, its values are shown as ‹address›, ‹path› or ‹withheld›.\n")
+		}
+		fmt.Fprintf(&d, "Read it whole, with this fingerprint: settings proposals %s at the controller's terminal, or the "+
+			"controller's settings verb with proposal %s through the mesh MCP server.", id, id)
+		return d.String()
 	}
-	b.WriteString(shown)
-	fmt.Fprintf(&b, "\n\nFingerprint %s.", fingerprint(p.Digest))
-	if !whole {
-		b.WriteString(" Parts shown as ‹address›, ‹path› or ‹withheld› may not leave the mesh: read it whole, with " +
-			"this fingerprint, through the mesh MCP server (mesh-controller.settings, proposal " + id + ") or with " +
-			"mesh-cli settings proposals " + id + ".")
-	}
-	if p.Clear {
-		b.WriteString(" Approved, the layer is removed at once and the machine takes it at its next push.")
-	} else {
-		b.WriteString(" Approved, the layer is set at once and the machine takes it at its next push.")
-	}
-	q := asks.Ask{ID: id, Headline: headline, Explanation: b.String(), Who: asks.Operator,
+	q := asks.Ask{ID: id, Headline: headline, Explanation: compose(shown), Who: asks.Operator,
 		Expires: p.At.Add(askApproveFor), OnExpiry: "the proposal is discarded; nothing changes",
-		About: p.about()}
+		About: p.about(), Details: details(shownAll)}
+	// Only where a value was masked: an ask whose values all pass the content rule shows the same everywhere.
+	if w := compose(whole); w != q.Explanation {
+		q.Whole = w
+	}
+	if w := details(wholeAll); w != q.Details {
+		q.WholeDetails = w
+	}
 	options := map[string]int{}
 	for i, act := range p.actions(id) {
 		binds, _ := asks.ActDigest(boundAct(act))
 		oid := optionID(act.Label)
 		options[oid] = i
-		does := "the settings are set; nothing is pushed yet"
+		does := "the settings are set and sent to " + p.reaches() + " at once, each machine judged"
 		if p.Clear {
-			does = "the layer is removed; nothing is pushed yet"
+			does = "the layer is removed and that is sent to " + p.reaches() + " at once, each machine judged"
 		}
 		if act.Arguments["answer"] == answerDecline {
 			does = "nothing changes; the proposal is discarded"
@@ -205,55 +215,141 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
 	return q, options
 }
 
-// shownMost is the most of a change the phone is shown, in bytes; the rest is read whole with `settings proposals`.
-const shownMost = 1400
+// summary is the proposal's first line, what changes where: how many settings, how many stay, and that Approve sends
+// the layer at once by a walk, one machine at a time (novox/hq ADR 0344); the rest of what Approve does
+// (onApprove) is the Details'.
+func (p settingsProposal) summary() string {
+	if p.Clear {
+		if !p.HadLayer {
+			return "There is no layer to remove; approving changes nothing."
+		}
+		return fmt.Sprintf("Removes the %d setting(s) of %s set on %s; approved, the layer is removed and that is sent at once "+
+			"by a walk to %s, one machine at a time, each judged.", len(leaves(p.Before, "")), p.Module, p.where(), p.reaches())
+	}
+	added, changed, removed := settingsChange(p.Before, p.Values)
+	n := len(added) + len(changed) + len(removed)
+	unchanged := len(leaves(p.Values, "")) - len(added) - len(changed)
+	if n == 0 {
+		return fmt.Sprintf("Nothing changes: the %d setting(s) of %s on %s are as they stand.", unchanged, p.Module, p.where())
+	}
+	stay := ""
+	if unchanged > 0 {
+		stay = fmt.Sprintf(", and %d stay as they are", unchanged)
+	}
+	return fmt.Sprintf("Changes %d setting(s) of %s on %s%s; approved, the layer is set and sent at once by a walk to %s, "+
+		"one machine at a time, each judged.", n, p.Module, p.where(), stay, p.reaches())
+}
 
-// change is what changes, line by line, each value shown under the content rule, and whether every value was
-// shown whole: "+ key: value" added, "~ key: value (was: old)" changed, "- key (was: old)" removed, and the
-// count of keys unchanged.
-func (p settingsProposal) change(machines []string) (string, bool) {
+// change is what changes: as at most asks.MostPoints points for the glance, as every line whole for the note, and
+// whether every value was shown exactly: "+ key: value"
+// added, "~ key: value (was: old)" changed, "- key (was: old)" removed. Each value is shown under the content rule
+// (sayableValue), or — exact, for a channel that proves who answers — as it is, withheld only when shaped like a
+// secret (wholeValue). More changes than points: the first two, and the keys of the rest; a point longer than a
+// phone shows at a glance is cut and says so. The note carries every line uncut (the review of #304: Approve sets
+// exactly what the operator can read).
+func (p settingsProposal) change(machines []string, exact bool) ([]string, []string, bool) {
 	whole := true
 	say := func(v any) string {
 		s, w := sayableValue(v, machines)
+		if exact {
+			s, w = wholeValue(v, machines)
+		}
 		whole = whole && w
 		return s
 	}
-	var lines []string
+	type line struct{ key, text string }
+	var lines []line
 	if p.Clear {
 		was := leaves(p.Before, "")
 		for _, k := range layerKeys(was) {
-			lines = append(lines, fmt.Sprintf("- %s: %s", k, say(was[k])))
+			lines = append(lines, line{k, fmt.Sprintf("- %s: %s", k, say(was[k]))})
 		}
 	} else {
 		added, changed, removed := settingsChange(p.Before, p.Values)
 		was, now := leaves(p.Before, ""), leaves(p.Values, "")
 		for _, k := range added {
-			lines = append(lines, fmt.Sprintf("+ %s: %s", k, say(now[k])))
+			lines = append(lines, line{k, fmt.Sprintf("+ %s: %s", k, say(now[k]))})
 		}
 		for _, k := range changed {
-			lines = append(lines, fmt.Sprintf("~ %s: %s (was: %s)", k, say(now[k]), say(was[k])))
+			lines = append(lines, line{k, fmt.Sprintf("~ %s: %s (was: %s)", k, say(now[k]), say(was[k]))})
 		}
 		for _, k := range removed {
-			lines = append(lines, fmt.Sprintf("- %s (was: %s)", k, say(was[k])))
-		}
-		unchanged := len(now) - len(added) - len(changed)
-		switch {
-		case len(lines) == 0 && unchanged > 0:
-			lines = append(lines, fmt.Sprintf("= nothing changes: the %d key(s) are as they stand", unchanged))
-		case unchanged > 0:
-			lines = append(lines, fmt.Sprintf("= %d key(s) unchanged", unchanged))
+			lines = append(lines, line{k, fmt.Sprintf("- %s (was: %s)", k, say(was[k]))})
 		}
 	}
-	out := strings.Join(lines, "\n")
-	if len(out) > shownMost {
-		cut := shownMost
-		for cut > 0 && out[cut] != '\n' {
-			cut--
+	// **Each line is judged as the router will judge it** (the review of #304, ADR 0347 §1 and §3): a line the
+	// content rule (masked) or the secret rule (whole) would refuse — a value given to a secret's name, say
+	// "+ password: hunter2" — is said with its key still named and its value withheld, never left for the
+	// router to withhold whole and unnamed. A line refused even so is the propose's refusal (judgeLines).
+	for i, l := range lines {
+		if lineLeaves(l.text, exact, machines) {
+			continue
 		}
-		out = out[:cut] + fmt.Sprintf("\n… NOT SHOWN IN FULL here: %d more bytes", len(strings.Join(lines, "\n"))-cut)
+		lines[i].text = l.text[:2] + l.key + " (value withheld)"
 		whole = false
 	}
-	return out, whole
+	all := make([]string, len(lines))
+	for i, l := range lines {
+		all[i] = l.text
+	}
+	// What the note holds of a value: whole where the glance is the whole one (shown only where the sender is
+	// proven, with the whole details beside it), under the content rule elsewhere — so the marker says no more than
+	// the note it points to (the review of ADR 0347).
+	inNote := "in the note"
+	if exact {
+		inNote = "whole in the note"
+	}
+	var out []string
+	for i, l := range lines {
+		if len(lines) > asks.MostPoints && i == asks.MostPoints-1 {
+			var rest []string
+			for _, r := range lines[i:] {
+				rest = append(rest, r.key)
+			}
+			out = append(out, fmt.Sprintf("and %d more, each %s: %s", len(rest), inNote, strings.Join(rest, ", ")))
+			break
+		}
+		out = append(out, l.text)
+	}
+	// A point too long for a glance is cut, and says so: its value is the note's.
+	cut := "… (cut: " + inNote + ")"
+	for i, l := range out {
+		if r := []rune(l); len(r) > asks.PointLength {
+			out[i] = string(r[:asks.PointLength-len([]rune(cut))]) + cut
+		}
+	}
+	return out, all, whole
+}
+
+// lineLeaves says whether a line may leave the mesh as the router judges it: under the content rule for the masked
+// form, the secret rule alone for the whole one.
+func lineLeaves(line string, exact bool, machines []string) bool {
+	if exact {
+		_, ok := outward.Secret(line, machines...)
+		return ok
+	}
+	_, ok := outward.Check(line, machines...)
+	return ok
+}
+
+// judgeLines is the first line of an ask's details the router would refuse, or withhold, and why: masked under
+// the content rule line by line, whole under the secret rule. Empty when every line may leave.
+func judgeLines(details string, exact bool, machines []string) (string, string) {
+	for _, line := range strings.Split(details, "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		if exact {
+			if refusal, ok := outward.Secret(line, machines...); !ok {
+				return line, refusal.String()
+			}
+			continue
+		}
+		if refusal, ok := outward.Check(line, machines...); !ok {
+			return line, refusal.String()
+		}
+	}
+	return "", ""
 }
 
 func layerKeys(m map[string]any) []string {
@@ -300,6 +396,27 @@ func sayableValue(v any, machines []string) (string, bool) {
 	return out, out == text
 }
 
+// wholeValue is a value as a channel that proves who answers is shown it (asks.Ask.Whole), and whether it was
+// shown whole: as it is, unless it is shaped like a secret (outward.Secret), which is withheld whole — never in
+// part, so no half of a key reaches the phone.
+func wholeValue(v any, machines []string) (string, bool) {
+	text, ok := v.(string)
+	if !ok {
+		raw, err := json.Marshal(v)
+		if err != nil {
+			return markWithheld, false
+		}
+		text = string(raw)
+	}
+	if text == "" {
+		return `""`, true
+	}
+	if _, ok := outward.Secret(text, machines...); !ok {
+		return markWithheld, false
+	}
+	return text, true
+}
+
 // sayable is a text with what may not leave the mesh replaced in place by a marker; what the markers cannot make
 // pass is withheld whole.
 func sayable(text string, machines []string) string {
@@ -432,6 +549,23 @@ func (pr proposer) propose(ctx context.Context, in proposeInput) (string, error)
 		return refuse("the ask's words would carry %s, which may not leave the mesh, and the change could not be "+
 			"shown without it; %s", refusal, atTheTerminalInstead(in))
 	}
+	// The whole words are shown only where the sender is proven, and never a secret's shape: wholeValue withholds
+	// one, and the router would refuse the ask if one were left, so it is refused here first, in words.
+	if refusal, ok := outward.Secret(q.Whole, machines...); !ok {
+		return refuse("the change shown whole would carry %s, which may not leave the mesh on any channel; %s",
+			refusal, atTheTerminalInstead(in))
+	}
+	// So are the details (ADR 0347 §1, §3): every line the router would withhold from the note, or refuse the ask
+	// for, is refused here, in the controller's own words, naming the line's key — Approve never sets a value the
+	// operator was shown nothing of.
+	if line, why := judgeLines(q.Details, false, machines); line != "" {
+		return refuse("the change's line %q would carry %s, which the operator's note may not show; %s",
+			keyOfLine(line), why, atTheTerminalInstead(in))
+	}
+	if line, why := judgeLines(q.WholeDetails, true, machines); line != "" {
+		return refuse("the change's line %q shown whole would carry %s, which may not leave the mesh on any channel; %s",
+			keyOfLine(line), why, atTheTerminalInstead(in))
+	}
 	// Fail closed, before anything is kept: no router, no grant, no channel means no ask.
 	if pr.routerHere != nil {
 		here, err := pr.routerHere(ctx)
@@ -519,15 +653,29 @@ func (pr proposer) propose(ctx context.Context, in proposeInput) (string, error)
 		fingerprint(p.Digest))
 	fmt.Fprintf(&b, "  until %s nothing changes: the layer is set only on Approve, and discarded on Decline or at expiry\n",
 		q.Expires.Local().Format("2006-01-02 15:04"))
-	fmt.Fprintf(&b, "  `settings proposals %s` shows it whole; once approved, `push %s` sends it", id, pushWord(p.Node))
+	fmt.Fprintf(&b, "  `settings proposals %s` shows it whole; once approved, a walk sends it to %s at once, one machine at "+
+		"a time, each judged, and its end is told as every walk's is (novox/hq ADR 0344)", id, p.reaches())
 	return b.String(), nil
 }
 
-func pushWord(node string) string {
-	if node == "" {
-		return "--behind"
+// reaches is the machines an approved layer is sent to, in words: the one it names, or every machine running the
+// module.
+func (p settingsProposal) reaches() string {
+	if p.Node == "" {
+		return "every machine running " + p.Module
 	}
-	return node
+	return p.Node
+}
+
+// onApprove is what the ask says Approve does (novox/hq ADR 0344 §4): the one Approve sets the layer and sends it.
+func (p settingsProposal) onApprove() string {
+	what := "the layer is set"
+	if p.Clear {
+		what = "the layer is removed"
+	}
+	return fmt.Sprintf("Approved, %s and sent at once to %s, one machine at a time, each judged, every build there "+
+		"kept; its end is told as every walk's is. A module that reads its settings only when it starts takes them at "+
+		"its next start.", what, p.reaches())
 }
 
 func newProposalID() string {
@@ -788,6 +936,40 @@ func setLayerIn(open *stores) setOnWarrant {
 				changed = "nothing changed"
 			}
 		}
-		return changed + " (ask " + askID + ")", nil
+		// **And sends it** (novox/hq ADR 0344): the layer the operator approved is walked to the machines it reaches
+		// at once. A walk that cannot be opened is said as the act's failure — the layer is set and nothing sends it.
+		walked, err := openSettingsWalk(ctx, open, inventory.PlanSettings{Module: p.Module, Node: p.Node, Ask: askID,
+			Change: changed})
+		if err != nil {
+			return "", fmt.Errorf("%s (ask %s) is set, and the walk that sends it could not be opened: %v — `push %s` sends it",
+				changed, askID, err, pushTo(p.Node))
+		}
+		return changed + " (ask " + askID + "); " + walked, nil
 	}
 }
+
+// pushTo is the push that sends a layer by hand when its walk could not: the machine, or every one behind.
+func pushTo(node string) string {
+	if node == "" {
+		return "--behind"
+	}
+	return node
+}
+
+// keyOfLine is what a refusal names of a line: the key of a change's line ("+ key: …"), or the line's first words.
+func keyOfLine(line string) string {
+	if len(line) > 2 && strings.ContainsRune("+~-=", rune(line[0])) && line[1] == ' ' {
+		rest := line[2:]
+		if i := strings.IndexAny(rest, ": "); i > 0 {
+			rest = rest[:i]
+		}
+		if _, ok := outward.Secret(rest); !ok {
+			return "whose key is shaped like a secret"
+		}
+		return rest
+	}
+	if r := []rune(line); len(r) > 40 {
+		return string(r[:40]) + "…"
+	}
+	return line
+}

cmd/mesh-controller/proposals_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"os"
 	"slices"
@@ -116,24 +117,43 @@ func TestAProposalAsksAtTheLevelApproveWithTheExactChange(t *testing.T) {
 	if q.Options[0].Binds == q.Options[1].Binds {
 		t.Error("Approve and Decline bind the same act")
 	}
-	for _, line := range []string{
-		"Set the settings of mounts on shanks to these values?",
-		"Proposed by g14/claude-code, through the mesh-controller seat, at " + r.now.Local().Format("15:04 on 2 Jan") + ".",
-		"+ sources: recalbox=‹address›@‹path›:ro",
-		"~ shares: library=‹path› (was: none)",
-		"- old (was: x)",
-		"Fingerprint " + fingerprint(layerDigest(mountsSources)) + ".",
-		"read it whole, with this fingerprint",
-	} {
-		if !strings.Contains(q.Explanation, line) {
-			t.Errorf("the explanation lacks %q:\n%s", line, q.Explanation)
-		}
+	// The message reads at a glance (issues 383 and 639): a summary, then one point per key — and nothing else:
+	// who proposed it, the fingerprint and the how-to are the Details, which the router notes after the answers.
+	summary := "Changes 3 setting(s) of mounts on shanks; approved, the layer is set and sent at once by a walk to shanks, one machine at a time, each judged."
+	if q.Explanation != summary+"\n+ sources: recalbox=‹address›@‹path›:ro\n~ shares: library=‹path› (was: none)\n- old (was: x)" {
+		t.Errorf("the explanation:\n%s", q.Explanation)
+	}
+	if err := asks.Glance(q.Explanation); err != nil {
+		t.Error(err)
 	}
 	for _, leak := range []string{"nas.lan", "/mnt/recalbox", "/mnt/library", "smb://"} {
 		if strings.Contains(q.Explanation, leak) {
 			t.Errorf("the explanation carries %q, which may not leave the mesh", leak)
 		}
 	}
+	// Where the sender is proven, the values whole: the mount point and the share are what is approved.
+	if q.Whole != summary+"\n+ sources: recalbox=smb://nas.lan/recalbox@/mnt/recalbox:ro\n~ shares: library=/mnt/library (was: none)\n- old (was: x)" ||
+		asks.Glance(q.Whole) != nil {
+		t.Errorf("the whole words:\n%s", q.Whole)
+	}
+	for _, line := range []string{
+		"Proposed by g14/claude-code, through the mesh-controller seat at " + r.now.Local().Format("15:04 on 2 Jan") +
+			". Fingerprint " + fingerprint(layerDigest(mountsSources)) + ".",
+		"Where who answers is not proven, its values are shown as ‹address›, ‹path› or ‹withheld›.",
+		"Read it whole, with this fingerprint: settings proposals " + kept(r).ID + " at the controller's terminal",
+	} {
+		if !strings.Contains(q.Details, line) {
+			t.Errorf("Details lack %q:\n%s", line, q.Details)
+		}
+	}
+	if refusal, ok := outward.Check(q.Details, "anchor", "laptop", "shanks"); !ok {
+		t.Errorf("the router would withhold a line of the details: %s", refusal)
+	}
+	for _, howTo := range []string{"ingerprint", "settings proposals", "settings verb", "not proven", "Proposed by"} {
+		if strings.Contains(q.Explanation, howTo) || strings.Contains(q.Whole, howTo) {
+			t.Errorf("the message carries the how-to %q", howTo)
+		}
+	}
 	all := []string{q.Headline, q.Explanation, q.OnExpiry}
 	for _, o := range q.Options {
 		all = append(all, o.Label, o.Does)
@@ -141,6 +161,9 @@ func TestAProposalAsksAtTheLevelApproveWithTheExactChange(t *testing.T) {
 	if refusal, ok := outward.Check(strings.Join(all, "\n"), "anchor", "laptop", "shanks"); !ok {
 		t.Errorf("the router would refuse the ask: %s", refusal)
 	}
+	if refusal, ok := outward.Secret(q.Whole, "anchor", "laptop", "shanks"); !ok {
+		t.Errorf("the router would refuse the whole words: %s", refusal)
+	}
 	// Kept as the controller's own ask, about no condition, with the proposal whole and its digests.
 	kept := r.theProposal(t)
 	p := kept.Proposal
@@ -173,11 +196,98 @@ func TestAMeshWideLayerIsProposed(t *testing.T) {
 	}
 	q := r.askSent(t)
 	if q.Headline != "Set notes on the whole mesh?" || q.About != "settings.notes.mesh" ||
-		!strings.Contains(q.Explanation, "Set the settings of notes on the whole mesh to these values?") {
+		q.Explanation != "Changes 1 setting(s) of notes on the whole mesh; approved, the layer is set and sent at once by a walk to every machine running notes, one machine at a time, each judged.\n+ x: 1" ||
+		q.Whole != "" {
 		t.Errorf("%+v", q)
 	}
 }
 
+// kept is the one proposal the rig keeps.
+func kept(r *proposerRig) asked {
+	for _, a := range r.store {
+		if a.Proposal != nil {
+			return a
+		}
+	}
+	return asked{}
+}
+
+// The switch between the masked and the whole change (issue 383): the same change, under the content rule and
+// exact, differs in the masked values alone; a value shaped like a secret is withheld in both, whole, with its
+// key still named; and a change no value of which is masked carries no whole words of its own.
+func TestAProposalShowsItsValuesWholeOnlyWhereTheSenderIsProvenAndNeverASecret(t *testing.T) {
+	machines := []string{"anchor", "laptop", "shanks"}
+	r := newProposerRig(t)
+	values := map[string]any{"shares": "media=/storage/media", "sources": "recalbox=smb://nas.lan/recalbox@/mnt/recalbox", "font": "Inter 13"}
+	if _, err := r.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: values}); err != nil {
+		t.Fatal(err)
+	}
+	q := r.askSent(t)
+	masked, _, _ := kept(r).Proposal.change(machines, false)
+	whole, _, _ := kept(r).Proposal.change(machines, true)
+	if !strings.HasSuffix(q.Explanation, "\n"+strings.Join(masked, "\n")) || !strings.HasSuffix(q.Whole, "\n"+strings.Join(whole, "\n")) {
+		t.Fatalf("the ask does not carry the change masked and whole:\n%s\n--\n%s", q.Explanation, q.Whole)
+	}
+	if want := []string{"+ font: Inter 13", "+ shares: media=‹path›", "+ sources: recalbox=‹address›@‹path›"}; strings.Join(masked, "\n") != strings.Join(want, "\n") {
+		t.Errorf("masked: %q", masked)
+	}
+	if want := []string{"+ font: Inter 13", "+ shares: media=/storage/media", "+ sources: recalbox=smb://nas.lan/recalbox@/mnt/recalbox"}; strings.Join(whole, "\n") != strings.Join(want, "\n") {
+		t.Errorf("whole: %q", whole)
+	}
+	if _, ok := outward.Secret(q.Whole, "shanks"); !ok {
+		t.Error("the router would refuse the whole words")
+	}
+	// Mutation: the masked and the whole change differ in exactly the lines whose value was masked.
+	differ := 0
+	for i := range masked {
+		if masked[i] != whole[i] {
+			differ++
+			if !strings.Contains(masked[i], "‹") || strings.Contains(whole[i], "‹") {
+				t.Errorf("the lines differ otherwise than by the mask:\n%s\n%s", masked[i], whole[i])
+			}
+		}
+	}
+	if differ != 2 {
+		t.Errorf("%d lines differ, and the mask covered 2", differ)
+	}
+	// A value shaped like a secret is withheld in both, whole, with its key still named.
+	r1 := newProposerRig(t)
+	secrets := map[string]any{"github": "ghp_abcdefghijklmnopqrstuvwxyz0123456789", "cert": "-----BEGIN CERTIFICATE-----"}
+	if _, err := r1.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: secrets}); err != nil {
+		t.Fatal(err)
+	}
+	q1 := r1.askSent(t)
+	for _, line := range []string{"+ cert: ‹withheld›", "+ github: ‹withheld›"} {
+		if !strings.Contains(q1.Explanation, line) {
+			t.Errorf("lacks %q:\n%s", line, q1.Explanation)
+		}
+	}
+	for _, secret := range []string{"ghp_", "BEGIN CERTIFICATE"} {
+		if strings.Contains(q1.Explanation, secret) || strings.Contains(q1.Whole, secret) || strings.Contains(q1.Details, secret) {
+			t.Errorf("the secret %q reaches the phone", secret)
+		}
+	}
+	// More keys than points (issue 639): the first two, then the keys of the rest, read whole at the terminal.
+	r3 := newProposerRig(t)
+	five := map[string]any{"a": "1", "b": "2", "c": "3", "d": "4", "e": "5"}
+	if _, err := r3.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop", values: five}); err != nil {
+		t.Fatal(err)
+	}
+	if q3 := r3.askSent(t); !strings.HasSuffix(q3.Explanation, "\n+ a: 1\n+ b: 2\nand 3 more, each in the note: c, d, e") || asks.Glance(q3.Explanation) != nil ||
+		!strings.Contains(q3.Details, "settings proposals") {
+		t.Errorf("five keys:\n%s", q3.Explanation)
+	}
+	// No value masked: the message is the same everywhere, and the ask says no whole words.
+	r2 := newProposerRig(t)
+	if _, err := r2.pr.propose(context.Background(), proposeInput{module: "dunst", node: "laptop", values: map[string]any{"font-size": 13, "width": 500}}); err != nil {
+		t.Fatal(err)
+	}
+	if q2 := r2.askSent(t); q2.Whole != "" || !strings.HasSuffix(q2.Explanation, "\n+ font-size: 13\n+ width: 500") ||
+		strings.Contains(q2.Details, "not proven") {
+		t.Errorf("%+v", q2)
+	}
+}
+
 // A proposal expired unanswered is kept so by the reconciling, and a warrant for it afterwards sets nothing.
 func TestAnExpiredProposalIsKeptExpired(t *testing.T) {
 	r := newAskerRig(t)
@@ -205,7 +315,8 @@ func TestAClearIsProposedAndShowsWhatItRemoves(t *testing.T) {
 	}
 	q := r.askSent(t)
 	if q.Headline != "Clear notes on laptop?" || !strings.Contains(q.Explanation, "- places.data.owner: 1001:1001") ||
-		!strings.Contains(q.Explanation, "- places.data.path: ‹path›") {
+		!strings.Contains(q.Explanation, "- places.data.path: ‹path›") || !strings.Contains(q.Whole, "- places.data.path: /srv/notes") ||
+		!strings.HasPrefix(q.Explanation, "Removes the 2 setting(s) of notes set on laptop; approved, the layer is removed and that is sent at once by a walk to laptop, one machine at a time") {
 		t.Errorf("%+v", q)
 	}
 	if p := r.theProposal(t).Proposal; !p.Clear || p.Digest != layerDigest(r.before) || len(r.judged) != 0 {
@@ -744,3 +855,125 @@ func captureStdout(t *testing.T, f func()) string {
 	_ = w.Close()
 	return <-done
 }
+
+// The review of #304: Approve sets exactly what the operator can read. A proposal of five keys, one value 300
+// characters long, shows two keys at a glance, says what it cut, and carries every key with its whole value in its
+// Details for a channel that proves who answers (WholeDetails), and every key masked for one that does not.
+func TestEveryKeyAndItsWholeValueReachTheOperator(t *testing.T) {
+	var long strings.Builder
+	long.WriteString("library=/storage")
+	for i := 0; long.Len() < 300; i++ {
+		long.WriteString(fmt.Sprintf("/album-%02d", i))
+	}
+	value := long.String()[:300]
+	values := map[string]any{"a": "1", "b": "2", "c": "3", "d": "4", "shares": value}
+	r := newProposerRig(t)
+	if _, err := r.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: values}); err != nil {
+		t.Fatal(err)
+	}
+	q := r.askSent(t)
+	if err := q.Check(r.now); err != nil {
+		t.Fatal(err)
+	}
+	// What the operator reads on a proving channel: the whole words, then the note's whole details.
+	visible := q.Whole + "\n" + q.WholeDetails
+	if q.Whole == "" {
+		visible = q.Explanation + "\n" + q.WholeDetails
+	}
+	for k, v := range values {
+		if !strings.Contains(visible, "+ "+k+": "+v.(string)) {
+			t.Errorf("the operator never reads %s whole:\n%s", k, visible)
+		}
+	}
+	// The masked glance points to a note that holds the values masked, and says no more; the whole glance, shown only
+	// beside the whole details, says they are whole there.
+	if asks.Glance(q.Explanation) != nil || !strings.HasSuffix(q.Explanation, "\nand 3 more, each in the note: c, d, shares") ||
+		strings.Contains(q.Explanation, "whole in the note") || !strings.HasSuffix(q.Whole, "\nand 3 more, each whole in the note: c, d, shares") {
+		t.Errorf("the glance:\n%s", q.Explanation)
+	}
+	for k := range values {
+		if !strings.Contains(q.Details, "+ "+k+": ") {
+			t.Errorf("the masked details lack %s:\n%s", k, q.Details)
+		}
+	}
+	if strings.Contains(q.Details, "/storage") {
+		t.Errorf("the masked details show a path:\n%s", q.Details)
+	}
+	if refusal, ok := outward.Check(q.Details, "shanks"); !ok {
+		t.Errorf("the router would withhold the masked details: %s", refusal)
+	}
+	if _, ok := outward.Secret(q.WholeDetails, "shanks"); !ok {
+		t.Error("the router would refuse the whole details")
+	}
+	// A value too long for a glance is cut there, and says so.
+	r2 := newProposerRig(t)
+	if _, err := r2.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: map[string]any{"shares": value}}); err != nil {
+		t.Fatal(err)
+	}
+	q2 := r2.askSent(t)
+	// The cut point is 160 characters, its marker inside the bound.
+	if last := q2.Whole[strings.LastIndex(q2.Whole, "\n")+1:]; len([]rune(last)) != asks.PointLength {
+		t.Errorf("the cut point is %d characters, not %d: %q", len([]rune(last)), asks.PointLength, last)
+	}
+	if !strings.HasSuffix(q2.Whole, "… (cut: whole in the note)") || !strings.HasSuffix(q2.Explanation, "‹path›") && !strings.HasSuffix(q2.Explanation, "… (cut: in the note)") || !strings.Contains(q2.WholeDetails, "+ shares: "+value) || asks.Glance(q2.Whole) != nil {
+		t.Errorf("the cut is not said, or the note lacks the whole:\n%s\n--\n%s", q2.Whole, q2.WholeDetails)
+	}
+}
+
+// The review of #304: a value given to a secret's name, past the second key, is said with its key named and its
+// value withheld, in the note on every channel; the router has nothing left to withhold unnamed or refuse. A line
+// the router would refuse even so is refused at propose, in the controller's words.
+func TestASecretNamedKeyIsNamedAndItsValueWithheld(t *testing.T) {
+	r := newProposerRig(t)
+	values := map[string]any{"a": "1", "b": "2", "c": "3", "password": "hunter2"}
+	if _, err := r.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop", values: values}); err != nil {
+		t.Fatal(err)
+	}
+	q := r.askSent(t)
+	for _, form := range []string{q.Details, q.WholeDetails, q.Explanation, q.Whole} {
+		if strings.Contains(form, "hunter2") {
+			t.Errorf("the value reaches the phone:\n%s", form)
+		}
+	}
+	if !strings.Contains(q.Details, "+ password (value withheld)") {
+		t.Errorf("the key is not named with its value withheld:\n%s", q.Details)
+	}
+	if q.WholeDetails != "" && !strings.Contains(q.WholeDetails, "+ password (value withheld)") {
+		t.Errorf("the whole details do not name the key:\n%s", q.WholeDetails)
+	}
+	if line, why := judgeLines(q.Details, false, nil); line != "" {
+		t.Errorf("the router would withhold %q: %s", line, why)
+	}
+	if line, why := judgeLines(q.WholeDetails, true, nil); line != "" {
+		t.Errorf("the router would refuse %q: %s", line, why)
+	}
+	if !strings.HasSuffix(q.Explanation, "\nand 2 more, each in the note: c, password") {
+		t.Errorf("the glance:\n%s", q.Explanation)
+	}
+	// A key shaped like a secret cannot be named on any channel: refused at propose, in the controller's words, and
+	// the key itself not echoed.
+	r2 := newProposerRig(t)
+	secretKey := "ghp_abcdefghijklmnopqrstuvwxyz0123456789"
+	_, err := r2.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop",
+		values: map[string]any{"a": "1", "b": "2", secretKey: "3"}})
+	if err == nil || !strings.Contains(err.Error(), "Nothing was proposed") || strings.Contains(err.Error(), secretKey) {
+		t.Errorf("a secret-shaped key: %v", err)
+	}
+	if len(r2.sent) != 0 {
+		t.Errorf("the refused proposal was asked")
+	}
+}
+
+// keyOfLine names a change's key, and never one shaped like a secret.
+func TestARefusalNamesTheKeyAndNeverASecret(t *testing.T) {
+	for line, want := range map[string]string{
+		"+ password (value withheld)":                   "password",
+		"~ shares: ‹path› (was: none)":                  "shares",
+		"+ ghp_abcdefghijklmnopqrstuvwxyz0123456789: 1": "whose key is shaped like a secret",
+		"Proposed by g14 at 15:04.":                     "Proposed by g14 at 15:04.",
+	} {
+		if got := keyOfLine(line); got != want {
+			t.Errorf("%q: %q, want %q", line, got, want)
+		}
+	}
+}

cmd/mesh-controller/push.go

@@ -740,7 +740,14 @@ func waitForApplied(ctx context.Context, inv *inventory.Inventory, node, digest
 				fmt.Printf("%s applied it\n", node)
 				return nil
 			case inventory.OutcomeFailed:
-				return fmt.Errorf("%s applied what it was sent but %d resource(s) failed", node, len(doing.Failed))
+				// Each failed resource by id with the machine's own words, so the answer says what to fix
+				// without a second look (novox/hq issue 629).
+				var each []string
+				for _, f := range doing.Failed {
+					each = append(each, f.ID+": "+f.Error)
+				}
+				return fmt.Errorf("%s applied what it was sent but %d resource(s) failed: %s", node, len(doing.Failed),
+					strings.Join(each, "; "))
 			case inventory.OutcomeRefused:
 				return fmt.Errorf("%s refused what it was sent: %s", node, doing.Refused)
 			}

cmd/mesh-controller/recorded_kept.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 
@@ -83,6 +84,27 @@ func everyBuildKept(ctx context.Context, node string) bool {
 	return on != "" && on == node
 }
 
+type keepForSettingsKey struct{}
+
+// keepingBuildsForSettings is a context whose sends compose every module of one machine — recorded or rolling out —
+// at the build that machine was last sent, as keepingEveryBuild does, for a settings walk's send (novox/hq ADR 0344):
+// the layer the operator approved, and nothing of any module's new code. A build held for a person, or waiting
+// for a gate, stays where it is; the walk that is its own carries it.
+func keepingBuildsForSettings(ctx context.Context, node string) context.Context {
+	return context.WithValue(ctx, keepForSettingsKey{}, node)
+}
+
+// errSettingsCannotKeep is a settings walk's send refused because a build of its machine cannot be kept: what the
+// machine was last sent is not known, or a build it runs is gone from the records. It does not clear by itself, so
+// the walk fails on it rather than trying again (ADR 0344).
+var errSettingsCannotKeep = errors.New("the settings cannot be sent with every build kept")
+
+// settingsKeptOn is whether this context is a settings walk's send to this machine.
+func settingsKeptOn(ctx context.Context, node string) bool {
+	on, _ := ctx.Value(keepForSettingsKey{}).(string)
+	return on != "" && on == node
+}
+
 // recordedKept is, for a send under keepingRecorded, every recorded module the machine was last sent a
 // build of that the mesh's build is not identical to: module → the commit it keeps. Nil when the context
 // keeps nothing, or when what the machine was last sent is not known (it is then held whole elsewhere —
@@ -92,7 +114,7 @@ func everyBuildKept(ctx context.Context, node string) bool {
 // 490), and a machine whose last send is not known refuses the send: there is nothing to keep it at, and
 // composing the mesh's builds would be the very move the grants step must not make.
 func recordedKept(ctx context.Context, open *stores, node string) (map[string]string, error) {
-	every := everyBuildKept(ctx, node)
+	every := everyBuildKept(ctx, node) || settingsKeptOn(ctx, node)
 	skip, on := keptExcept(ctx)
 	if !on && !every {
 		return nil, nil
@@ -106,6 +128,9 @@ func recordedKept(ctx context.Context, open *stores, node string) (map[string]st
 		return nil, err
 	}
 	if !known {
+		if settingsKeptOn(ctx, node) {
+			return nil, fmt.Errorf("%w: what %s was last sent is not known (novox/hq ADR 0344)", errSettingsCannotKeep, node)
+		}
 		if every {
 			return nil, fmt.Errorf("what %s was last sent is not known, so the bus's user list cannot be sent "+
 				"there alone with every build kept (novox/hq issue 490)", node)
@@ -166,6 +191,10 @@ func keepRecorded(ctx context.Context, open *stores, node string, shelf map[stri
 		if err != nil {
 			return nil, err
 		}
+		if !found && settingsKeptOn(ctx, node) {
+			return nil, fmt.Errorf("%w: %s runs %s's build %s, which the build records no longer hold (novox/hq ADR 0344)",
+				errSettingsCannotKeep, node, m, short(kept[m]))
+		}
 		if !found && everyBuildKept(ctx, node) {
 			return nil, fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
 				"list cannot be sent there alone with it kept (novox/hq issue 490)", node, m, short(kept[m]))

cmd/mesh-controller/release.go

@@ -616,6 +616,10 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 	}
 	for _, p := range plans {
 		if p.Release != nil {
+			if by != "" && p.Release.Settings != nil {
+				return nil, fmt.Errorf("%s is sending %s; what waits is released once it ends — `plans %s` says where it is",
+					p.ID, p.Repository, p.ID)
+			}
 			if by != "" {
 				return nil, fmt.Errorf("%s is already releasing what waits; `plans %s` says where it is", p.ID, p.ID)
 			}
@@ -641,7 +645,9 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 			return nil, err
 		}
 		for _, p := range recent {
-			if p.Release == nil {
+			// A settings walk that failed holds nothing back (novox/hq ADR 0344 §6): its failure is its module's
+			// settings on one machine, said on its own, not a build no gate passed.
+			if p.Release == nil || p.Release.Settings != nil {
 				continue
 			}
 			if p.State == inventory.PlanFailed {
@@ -702,6 +708,9 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
 // gate, or the machine being judged judged once more; the plan done when every machine is.
 func advanceRelease(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
 	r := p.Release
+	if r.Settings != nil {
+		return advanceSettingsWalk(ctx, open, p)
+	}
 	now := time.Now().UTC()
 	if r.Gate == nil {
 		heard, err := releaseHeard(ctx, open)

cmd/mesh-controller/release_plan.go

@@ -250,6 +250,16 @@ func gates(p inventory.Plan, edges []inventory.Edge, rollsOut func(string) bool)
 	return out
 }
 
+// noMoveWhy is what a plan says of a module of its tier whose build was made from the source every machine
+// running it runs (novox/hq issue 280): nothing is sent for it.
+const noMoveWhy = "no move: made from the source every machine running it runs"
+
+// noMove is whether the plan marked the module no move and sent it nothing. Read from what the plan says,
+// so a plan kept before the mark had a name of its own is read the same (novox/hq issue 648).
+func noMove(s *inventory.PlanModule) bool {
+	return s != nil && s.FirstAt == nil && s.Gate == nil && strings.HasPrefix(s.Why, "no move")
+}
+
 // applied says whether every machine running the module has reported since the module was built.
 // appliedEach is applied with a moment of its own for each machine: the reports that count are the ones
 // after that machine was sent the build (novox/hq issue 256).
@@ -715,7 +725,7 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			} else if same {
 				now := time.Now().UTC()
 				state.SentAt = &now
-				state.Why = "no move: made from the source every machine running it runs"
+				state.Why = noMoveWhy
 				fmt.Printf("%s: %s built from the source every machine running it runs: no move, nothing sent\n", p.ID, m)
 				continue
 			}
@@ -905,6 +915,25 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			if state.BuiltAt != nil {
 				since = *state.BuiltAt
 			}
+			// **A build that is no move is waited on by the send that last carried it** (novox/hq issue 648).
+			// Nothing was sent for it, so no report follows its marking or its build: a machine that does not
+			// happen to report again held the walk for ever. Each machine runs it once it answered its last
+			// send — the one whose builds made it no move — whenever that was.
+			if noMove(state) {
+				byNode := map[string]inventory.Reported{}
+				for _, r := range reports {
+					byNode[r.Node] = r
+				}
+				if ok, on := appliedEach(m, func(node string) time.Time {
+					if s := byNode[node].Sent; s != nil {
+						return *s
+					}
+					return time.Time{}
+				}, running, reports); !ok {
+					waiting = append(waiting, fmt.Sprintf("%s on %s", m, strings.Join(on, ", ")))
+				}
+				continue
+			}
 			// **Each machine from its own send** (novox/hq issue 256). With one machine first (ADR 0218)
 			// a module is sent twice — the first machine, then the rest — and SentAt is the second.
 			// Asked of every machine, the first machine's report, made between the two sends, read as

cmd/mesh-controller/replay164_test.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// TestReplay164 replays novox/hq issue 164 (found provisioning the media machine's modules, re-checked
+// 2026-10-08): a Servarr app's API key, an indexer's key and a downloader's password are values the provider's
+// software holds and only a person can give, and for a consumer of such a provision the send made a random pair
+// credential, sealed it to both ends and placed it; the provider refused it, and a consumer retrying it could be
+// banned by the provider. The outcome asserted (ADR 0337): for a provision whose offer says its credential is
+// issued outside the mesh, the send makes no value and places none, the consumer's machine still composes, and a
+// value a person gave for the pair is placed. Written with only what the controller had before its fix —
+// register, assign, planFor, declarationFor, AcceptSecretForPair and the inventory's secret reads — so it is laid
+// over the commit before. Needs the store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestReplay164(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	const secretFile = "/var/lib/mesh/requests/tv-api.secret"
+	register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}},
+		Serves: map[string]map[string]any{"tv-api": {"port": 8989}}})
+	register(t, open, catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api"},
+		Secrets: map[string]string{"tv-api": secretFile}})
+	for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	sent := func() []map[string]any {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatalf("the consumer's machine was refused for a credential only a person gives: %v", err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("the send to laptop did not compose: %v", err)
+		}
+		return declared.Resources
+	}
+	placed := func(resources []map[string]any) map[string]any {
+		for _, r := range resources {
+			if r["path"] == secretFile && r["sealed"] != nil {
+				return r
+			}
+		}
+		return nil
+	}
+
+	if got := placed(sent()); got != nil {
+		t.Errorf("the send placed a credential for tv-api (%v), which only a person can give and nobody gave", got["id"])
+	}
+	held, err := open.inventory.SecretsOf(ctx, "laptop", "requests")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range held {
+		if s.Name == "tv-api" {
+			t.Fatalf("the mesh holds a value for tv-api that nobody gave (origin %q)", s.Origin)
+		}
+	}
+
+	// Given by a person for the pair, it is placed, as given.
+	if err := open.inventory.AcceptSecretForPair(ctx, "tv-api", "laptop", "requests", "anchor", "", "the app's key"); err != nil {
+		t.Fatal(err)
+	}
+	if placed(sent()) == nil {
+		t.Fatal("the value a person gave for tv-api was not placed")
+	}
+}

cmd/mesh-controller/replay614_test.go

@@ -0,0 +1,71 @@
+package main
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **A new SDK plans the toolchain, and then every bundle compiled in it** (novox/hq issue 614), reasoned
+// as `mesh-controller.delivery-plan` reasons it: the modules registered as a build registers them —
+// resolved, so carrying no `build` — their builds recorded with what they stood on and what they made,
+// the graph read by theGraph and the change scoped by pullScope. On 2026-10-13 mesh-sdk 0.1.14 planned
+// "builds mesh-sdk, sent nowhere": mesh-tools' `build.on` naming the SDK's package and the providers'
+// TypeScript bundles were edges only while their manifests were unbuilt.
+//
+// **The replay of issue 614** (mesh-lab R614): written only with what the controller had before its fix — a
+// store, modules registered and builds recorded, theGraph and pullScope — so it is laid over the commit before
+// and fails there with the plan of that day, [[mesh-sdk]]. Needs a store: MESH_TEST_POSTGRES.
+func TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles(t *testing.T) {
+	inv := inventory.ForTest(t)
+	ctx := t.Context()
+	asked := time.Now().Add(-time.Hour)
+	digest := func(c string) string { return "@sha256:" + strings.Repeat(c, 64) }
+	register := func(m catalogue.Manifest, repository, path string, against []string, made []inventory.Artifact) {
+		t.Helper()
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: repository, Seat: "git", Path: path,
+			Ref: "main", BuiltFrom: "old", Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-" + m.Module, Repository: repository, Ref: "main",
+			Module: m.Module, Commit: "old", On: "builder", Path: path, Against: against, Made: made, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	bundle := func(module, language string) catalogue.Manifest {
+		return catalogue.Manifest{Module: module, Version: "1", Bundles: []catalogue.Bundle{{
+			Name: "code", Language: language, Source: catalogue.ArtifactStoreScheme + module + "/code" + digest("2"),
+			Entrypoints: []string{"tools/index.js"}}}}
+	}
+	register(catalogue.Manifest{Module: "build-agent", Version: "1",
+		Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}},
+		"novox/mesh-catalog", "modules/build-agent", nil, nil)
+	register(catalogue.Manifest{Module: "mesh-sdk", Version: "1"}, "novox/mesh-sdk", "", nil,
+		[]inventory.Artifact{{Name: "lib", Kind: "package", Reference: "@novox/mesh-sdk@0.1.13"}})
+	register(catalogue.Manifest{Module: "mesh-tools", Version: "1"}, "novox/mesh-tools", "",
+		[]string{"@novox/mesh-sdk@0.1.13", catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node" + digest("0")},
+		[]inventory.Artifact{{Name: "build", Kind: "image", Reference: catalogue.ArtifactStoreScheme + "mesh-tools/build" + digest("1")}})
+	register(catalogue.Manifest{Module: "mesh-tools-go", Version: "1"}, "novox/mesh-tools", "go", nil, nil)
+	register(bundle("minio", "typescript"), "novox/mesh-catalog", "modules/minio", nil, nil)
+	register(bundle("umami", "typescript"), "novox/mesh-catalog", "modules/umami", nil, nil)
+	register(bundle("dnsmasq", "go"), "novox/mesh-catalog", "modules/dnsmasq", nil, nil)
+
+	entries, read, edges, err := theGraph(ctx, inv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := orderMember{ID: "novox/mesh-sdk@new", Repository: "novox/mesh-sdk", Head: "new",
+		Paths: []string{"src/provisioner/index.ts", "package.json"}}
+	s := pullScope(m.pull(), entries, read, edges)
+	want := [][]string{{"mesh-sdk"}, {"mesh-tools"}, {"minio", "umami"}}
+	if !reflect.DeepEqual(s.Reach.Plan.Tiers, want) {
+		t.Fatalf("a new SDK plans %v, want %v (edges %v)", s.Reach.Plan.Tiers, want, edges)
+	}
+	if !reflect.DeepEqual(s.Dependents, []string{"mesh-tools", "minio", "umami"}) {
+		t.Errorf("dependents %v", s.Dependents)
+	}
+}

cmd/mesh-controller/seatverbs.go

@@ -13,6 +13,7 @@ import (
 	"slices"
 	"sort"
 	"strings"
+	"time"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -519,9 +520,13 @@ func (a *verbArguments) commandLine() ([]string, error) {
 		}
 		return []string{"unpin", str("node"), str("provision")}, nil
 	case "push":
-		// Sent and not waited for: the asker reads `status` for what the machine did, which is
-		// what a person at a shell does too. A tool call that blocked for a push's whole apply would
-		// time out on every machine that takes a minute, and say nothing about the ones that did not.
+		// A push to a named machine waits for that machine's own answer, so the call's record says
+		// how it went: applied, refused with the machine's reason, or which resources failed and why
+		// (novox/hq issue 629). How long is the call's `wait`, else the controller's setting `push-wait`;
+		// neither given waits for nothing, as before. The caller is answered before the push starts
+		// (answersFirst) and the machines are released once sent, so the wait holds nobody; it is what
+		// `calls` then shows. A sweep (--behind) does not wait: the slowest machine would hold back
+		// what is said of the others.
 		// A push through the seat is a push by hand, and says why (novox/hq to-be 45 §7).
 		if err := need("why"); err != nil {
 			return nil, fmt.Errorf("%w: a push by hand is a repair, recorded in the hand-act log with why", err)
@@ -534,7 +539,11 @@ func (a *verbArguments) commandLine() ([]string, error) {
 			// behind is not read here: given with a machine, it is refused as passed over — naming
 			// a machine and asking for every machine behind are two requests, and guessing one
 			// would push a machine nobody named, or not push one somebody did.
-			argv := []string{"push", n, "--wait", "0"}
+			wait, err := pushWait(str("wait"))
+			if err != nil {
+				return nil, err
+			}
+			argv := []string{"push", n, "--wait", wait.String()}
 			// A running module's data moving is sent only when said, per module (novox/hq ADR 0217).
 			if m := str("move"); m != "" {
 				argv = append(argv, "--move", m)
@@ -1328,6 +1337,47 @@ var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
 	// 0259 §8): the router asks it before an approval.
 	"root-free": true}
 
+// pushFileVar names the file the controller's push settings are written to (module.json, `push-wait`).
+const pushFileVar = "MESH_PUSH_FILE"
+
+// pushWait is how long a push to a named machine waits for its answer (novox/hq issue 629): the call's own
+// `wait` when given, else the controller's setting `push-wait`, else nothing. No length is written here: the
+// setting's default is the module's, and a setting that cannot be read waits for nothing, as a push did
+// before, and is said.
+func pushWait(given string) (time.Duration, error) {
+	if strings.TrimSpace(given) != "" {
+		d, ok := durationSetting(given)
+		if !ok {
+			return 0, fmt.Errorf("push: wait %q is no duration: say it as \"90s\", \"2m\", or \"0\" to wait for nothing", given)
+		}
+		return d, nil
+	}
+	path := os.Getenv(pushFileVar)
+	if path == "" {
+		return 0, nil
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "the push settings cannot be read (%v); a push waits for nothing\n", err)
+		return 0, nil
+	}
+	var values map[string]any
+	if err := json.Unmarshal(raw, &values); err != nil {
+		fmt.Fprintf(os.Stderr, "the push settings are not JSON (%v); a push waits for nothing\n", err)
+		return 0, nil
+	}
+	v, has := values["push-wait"]
+	if !has || v == "" {
+		return 0, nil
+	}
+	d, ok := durationSetting(v)
+	if !ok {
+		fmt.Fprintf(os.Stderr, "the setting push-wait=%v is no duration; a push waits for nothing\n", v)
+		return 0, nil
+	}
+	return d, nil
+}
+
 // answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
 // through `command`. A push sends the machine holding the bus first when its user list changed, the
 // broker reloads, and a reload forgets every answer the bus was about to permit — so an answer

cmd/mesh-controller/seatverbs_schema_test.go

@@ -146,7 +146,7 @@ func TestAnArgumentAVerbDoesNotDeclareIsRefused(t *testing.T) {
 // naming one beside behind is refused rather than one of the two guessed.
 func TestAPushIsOneMachineOrSaysItIsTheWholeMesh(t *testing.T) {
 	argv, err := argvFor("push", map[string]any{"node": "g1", "why": "w"})
-	if err != nil || strings.Join(argv, " ") != "push g1 --wait 0 --why w" {
+	if err != nil || strings.Join(argv, " ") != "push g1 --wait 0s --why w" {
 		t.Fatalf("a named push: %v %v", argv, err)
 	}
 	for _, args := range []map[string]any{{"why": "w"}, {"behind": "true", "why": "w"}} {

cmd/mesh-controller/seatverbs_test.go

@@ -5,6 +5,8 @@ import (
 	"errors"
 	"fmt"
 	"github.com/novox/mesh-controller/internal/link"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -164,12 +166,14 @@ func TestAVerbMissingWhatItNeedsIsRefused(t *testing.T) {
 	}
 }
 
-// A push and a build are sent, not waited for: the asker reads status, or the build's log by its
-// id, for what happened. A repository given as a forge path is said to be one (issue 176).
+// Acts do not block the call. A build is sent, not waited for: the asker reads the build's log by its id.
+// A push answers its caller before it starts (answersFirst), so a named push waits for the machine's own
+// answer without holding anybody, and the call's record says how it went (novox/hq issue 629). A
+// repository given as a forge path is said to be one (issue 176).
 func TestActsDoNotBlockTheCall(t *testing.T) {
 	argv, _ := argvFor("push", map[string]any{"node": "one", "why": "w"})
-	if strings.Join(argv, " ") != "push one --wait 0 --why w" {
-		t.Fatalf("push waits: %v", argv)
+	if strings.Join(argv, " ") != "push one --wait 0s --why w" || !answersFirst(argv) {
+		t.Fatalf("a named push with no setting waits, or holds its caller: %v", argv)
 	}
 	argv, _ = argvFor("build", map[string]any{"repository": "novox/x", "path": "modules/x"})
 	if strings.Join(argv, " ") != "build novox/x --wait 0 --self --path modules/x" {
@@ -460,3 +464,40 @@ func TestAQuotedValueRoundTrips(t *testing.T) {
 		}
 	}
 }
+
+// A named push waits as long as the call says, else as long as the controller's setting push-wait says, else
+// not at all: no length is the code's own (novox/hq issue 629).
+func TestAPushWaitsAsTheCallOrTheSettingSays(t *testing.T) {
+	file := filepath.Join(t.TempDir(), "push.json")
+	if err := os.WriteFile(file, []byte(`{"push-wait": "2m"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(pushFileVar, file)
+	argv, err := argvFor("push", map[string]any{"node": "one", "why": "w"})
+	if err != nil || strings.Join(argv, " ") != "push one --wait 2m0s --why w" {
+		t.Fatalf("the setting was not the default: %v %v", argv, err)
+	}
+	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "30s"})
+	if err != nil || strings.Join(argv, " ") != "push one --wait 30s --why w" {
+		t.Fatalf("the call's wait did not win over the setting: %v %v", argv, err)
+	}
+	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "0"})
+	if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
+		t.Fatalf("a wait of 0 did not wait for nothing: %v %v", argv, err)
+	}
+	if _, err := argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "soon"}); err == nil ||
+		!strings.Contains(err.Error(), "no duration") {
+		t.Fatalf("a wait that is no duration was taken: %v", err)
+	}
+	if err := os.WriteFile(file, []byte(`{"push-wait": "later"}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	argv, err = argvFor("push", map[string]any{"node": "one", "why": "w"})
+	if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
+		t.Fatalf("an unreadable setting did not fall back to waiting for nothing: %v %v", argv, err)
+	}
+	argv, _ = argvFor("push", map[string]any{"why": "w"})
+	if strings.Join(argv, " ") != "push --behind --wait 0 --why w" {
+		t.Fatalf("a sweep waits: %v", argv)
+	}
+}

cmd/mesh-controller/secret.go

@@ -79,6 +79,37 @@ func secretCommand(ctx context.Context, args []string) error {
 		return fmt.Errorf("a secret's value is given at the controller's terminal or at the desk (`give`), never "+
 			"through a verb (this line came through %q): nothing was read or sealed", verb)
 	}
+	// **A provision's credential issued outside the mesh is given once, for its provider** (novox/hq ADR 0337 §3,
+	// issue 165): `secret accept <provider's machine> <provider module> <provision>`, sealed to every consumer of
+	// that provider; the per-pair form naming a consumer is refused for it, naming this one.
+	outsideAt, err := outsideOffer(ctx, module, name, *provider)
+	if err != nil {
+		return err
+	}
+	if outsideAt == "" && *provider != "" {
+		if offered, err := offeredOutsideBy(ctx, name); err != nil {
+			return err
+		} else if offered != "" {
+			return fmt.Errorf("%s is issued outside the mesh and given once for its provider, which seals it to "+
+				"every consumer of it (ADR 0337): `secret accept %s %s %s`; nothing was read or sealed",
+				name, *provider, offered, name)
+		}
+	}
+	if outsideAt != "" {
+		if *desk != "" || *local != "" {
+			return errors.New("a provision's credential issued outside the mesh is given at the controller's " +
+				"terminal, for every consumer of its provider; it takes neither --at-desk nor --local")
+		}
+		value, err := valueFor(node, module, name, *from)
+		if err != nil {
+			return err
+		}
+		value = asSupplied(value)
+		if value == "" {
+			return errors.New("there is nothing to seal")
+		}
+		return acceptForProvision(ctx, node, module, name, value)
+	}
 	if *desk != "" {
 		if *from != "" || *provider != "" {
 			return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
@@ -173,6 +204,7 @@ const secretUsage = "secret rotate <node> <module> <name> [--why <text> [--cause
 	"secret ask <node> <module> <name> [--at <machine>]\n" +
 	"secret issued <provision>\n" +
 	"secret accept <node> <module> <name> [--from <file> | --at-desk <machine>] [--provider <node> [--local <name>]]\n" +
+	"secret accept <provider's node> <provider module> <provision> [--from <file>]   (a credential issued outside the mesh, for every consumer)\n" +
 	"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
 	"secret export [--out <file>]"
 

cmd/mesh-controller/sendable.go

@@ -40,6 +40,9 @@ type sendable struct {
 	actingEpoch  uint64
 	// modules are the modules this declaration names, for the record of the send; never on the wire.
 	modules []string
+	// localNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR
+	// 0340 §8), for plan to say; never on the wire.
+	localNetwork []catalogue.LocalNetworkPort
 	// Adoption is nil for a converged node, and then the body is byte for byte what it was before
 	// adoption existed: an older host parses the envelope strictly and would refuse the key.
 	Adoption *adoptionEnvelope

cmd/mesh-controller/served_own_names_test.go

@@ -0,0 +1,60 @@
+package main
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// novox/hq ADR 0346, issue 624: a provider on another machine serves its consumers its own composed
+// names, as that machine composes them; one it does not compose is left out, said under the need.
+func TestAProviderElsewhereServesItsOwnComposedName(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	forge, err := catalogue.ParseManifest([]byte(`{"module":"forge","version":"1","requires":["route"],
+	  "provides":[{"name":"npm-package-registry","scope":"mesh"}],
+	  "contributes":{"route":{"web":{"label":"git","port":3000}}},
+	  "serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
+	    "public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	register(t, open, catalogue.Manifest{Module: "proxy", Version: "1", Provides: catalogue.FromAnywhere("route"),
+		Receives: map[string]string{"route": "/var/lib/proxy/routes.json"}})
+	register(t, open, forge)
+	register(t, open, catalogue.Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
+		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}})
+	for _, a := range [][2]string{{"anchor", "proxy"}, {"anchor", "forge"}, {"laptop", "lab"}} {
+		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
+			t.Fatalf("assign %s %s: %v", a[0], a[1], err)
+		}
+	}
+
+	if err := open.inventory.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
+		t.Fatal(err)
+	}
+	plan, _, err := planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := need(t, plan, "lab", "npm-package-registry")
+	if n.Serves["public-root"] != "https://git.example.test/api/packages/novox/npm/" || len(n.LeftOut) != 0 {
+		t.Fatalf("the consumer elsewhere is served the forge's public root: %v, left out %v", n.Serves, n.LeftOut)
+	}
+
+	if err := open.inventory.SetPublicDomain(ctx, "anchor", ""); err != nil {
+		t.Fatal(err)
+	}
+	plan, _, err = planFor(ctx, open, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	n = need(t, plan, "lab", "npm-package-registry")
+	if _, there := n.Serves["public-root"]; there {
+		t.Fatalf("anchor composes no public name, so the key is left out: %v", n.Serves)
+	}
+	if len(n.LeftOut) != 1 || !strings.Contains(n.LeftOut[0], `without "public-root"`) {
+		t.Fatalf("and the need says so: %v", n.LeftOut)
+	}
+}

cmd/mesh-controller/settings_walk.go

@@ -0,0 +1,281 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// An approved settings change is sent by a walk at once, and the operator's one Approve is its push (novox/hq ADR
+// 0344, issue 641).
+//
+// On 2026-10-13 the operator approved a betterbird proposal on Telegram and nothing happened: the warrant set the
+// layer, and the push stayed a separate act (ADR 0277 §18) that nobody took. Now the warrant that sets the layer
+// opens a **settings walk**: the walk ADR 0236 opens for builds waiting for a gate, with a layer in place of the
+// builds. Its order is every machine running the module that the layer reaches, the control node last; each is
+// sent and its module judged there, from the machine's report on that send, before the next is sent. The send is
+// the layer alone: every module there stays at the build its machine was last sent (keepingBuildsForSettings), so a
+// build held for a person (ADR 0242) or waiting for a gate stays where it is — a policy of `record` holds a build,
+// never a setting — and a send that would move a running module's data stops the walk (ADR 0217 §3). The walk says its start and end on `plan-moved` (ADR 0308), and the holder of the operator's
+// channel tells its end once. A failure stops the walk and leaves the layer as approved; it holds back nothing
+// else.
+
+// settingsWalkPrefix names a settings walk's id.
+const settingsWalkPrefix = "settings-"
+
+// settingsWalkFor is what a settings walk says it is for, where a merge's walk says its repository.
+func settingsWalkFor(s inventory.PlanSettings) string {
+	where := s.Node
+	if where == "" {
+		where = "the whole mesh"
+	}
+	return fmt.Sprintf("the settings of %s on %s", s.Module, where)
+}
+
+// settingsWalkOrder is the machines a layer reaches, in the order a settings walk sends them: every machine
+// running the module, or the one the layer names when it runs it there, sorted, the control node last. Pure.
+func settingsWalkOrder(node string, running, controllers []string) []string {
+	var order, last []string
+	for _, n := range running {
+		if node != "" && n != node {
+			continue
+		}
+		if slices.Contains(controllers, n) {
+			last = append(last, n)
+		} else {
+			order = append(order, n)
+		}
+	}
+	sort.Strings(order)
+	sort.Strings(last)
+	return append(order, last...)
+}
+
+// openSettingsWalk opens the walk that sends an approved layer, and answers the words of what it does: the
+// machines it sends, or that no machine runs the module and nothing is sent. Called on the operator's warrant,
+// after the layer is set.
+var openSettingsWalk = func(ctx context.Context, open *stores, s inventory.PlanSettings) (string, error) {
+	inv := open.inventory
+	running, err := inv.Running(ctx, s.Module)
+	if err != nil {
+		return "", err
+	}
+	controllers, err := inv.Running(ctx, catalogue.ControllerSeatName)
+	if err != nil {
+		return "", err
+	}
+	order := settingsWalkOrder(s.Node, running, controllers)
+	if len(order) == 0 {
+		return fmt.Sprintf("no machine runs %s there, so there is nothing to send", s.Module), nil
+	}
+	release, err := inv.HoldPlans(ctx, true)
+	if err != nil {
+		return "", err
+	}
+	defer release()
+	now := time.Now().UTC()
+	p := inventory.Plan{ID: fmt.Sprintf("%s%d", settingsWalkPrefix, now.UnixNano()), Repository: settingsWalkFor(s),
+		Created: now, State: inventory.PlanRolling, Tiers: [][]string{{s.Module}}, Modules: map[string]*inventory.PlanModule{},
+		Release: &inventory.PlanRelease{Order: order, Settings: &s},
+		Note: fmt.Sprintf("approved (ask %s): sent to %s, one machine at a time, each judged", s.Ask,
+			strings.Join(order, ", "))}
+	if err := inv.SavePlan(ctx, &p); err != nil {
+		return "", err
+	}
+	fmt.Printf("%s: %s — %s\n", p.ID, p.Repository, p.Note)
+	return fmt.Sprintf("%s sends it to %s, one machine at a time, each judged", p.ID, strings.Join(order, ", ")), nil
+}
+
+// settingsDataMoves is what a settings walk's send to a machine would move of a running module's data: composed as
+// that send composes it, every build kept, and compared with what the machine was last sent (ADR 0217 §3).
+var settingsDataMoves = func(ctx context.Context, open *stores, node string) ([]dataMove, error) {
+	keeping := keepingBuildsForSettings(keepingRecorded(ctx), node)
+	gens, err := generators(keeping, open)
+	if err != nil {
+		return nil, err
+	}
+	plan, settings, err := planFor(keeping, open, node)
+	if err != nil {
+		return nil, err
+	}
+	declared, err := declarationWith(keeping, open, node, plan, settings, gens, Reading)
+	if err != nil {
+		return nil, err
+	}
+	body, err := declared.Body()
+	if err != nil {
+		return nil, err
+	}
+	return heldMoves(keeping, open.inventory, node, body, nil)
+}
+
+// judgingOn is the open walk, other than the one named, whose gate is judging on a machine; empty when none is. A
+// settings walk sends a machine only when no other walk judges there: its send would set aside the declaration
+// that walk's gate reads the machine's report against.
+var judgingOn = func(ctx context.Context, open *stores, self, node string) (string, error) {
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil {
+		return "", err
+	}
+	return judgingIn(plans, self, node), nil
+}
+
+// judgingIn is judgingOn over plans read. Pure.
+func judgingIn(plans []inventory.Plan, self, node string) string {
+	judging := func(g *inventory.PlanGate) bool {
+		return g != nil && g.Verdict == "" && slices.Contains(g.Machines, node)
+	}
+	for _, p := range plans {
+		if p.ID == self || !p.Open() {
+			continue
+		}
+		if p.Release != nil {
+			if judging(p.Release.Gate) {
+				return p.ID
+			}
+			continue
+		}
+		for _, s := range p.Modules {
+			if s != nil && judging(s.Gate) {
+				return p.ID
+			}
+		}
+	}
+	return ""
+}
+
+// advanceSettingsWalk takes one step of a settings walk: the next machine sent and its module judged there, or the
+// machine being judged judged once more; done when every machine is.
+func advanceSettingsWalk(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
+	r, s := p.Release, p.Release.Settings
+	now := time.Now().UTC()
+	wait := func(note string) (bool, error) {
+		changed := p.Note != note
+		p.Note = note
+		return changed, nil
+	}
+	if r.Gate == nil {
+		heard, err := releaseHeard(ctx, open)
+		if err != nil {
+			return false, err
+		}
+		for r.Next < len(r.Order) {
+			node := r.Order[r.Next]
+			if !heard[node] {
+				r.Skipped = append(r.Skipped, node)
+				r.Next++
+				continue
+			}
+			if id, err := judgingOn(ctx, open, p.ID, node); err != nil {
+				return false, err
+			} else if id != "" {
+				return wait(fmt.Sprintf("waiting before %s: %s is judging there", node, id))
+			}
+			// **A running module's data that would move is a person's word** (ADR 0217 §3): the walk stops before
+			// that machine, failed and said, and `push --move` sends it.
+			held, err := settingsDataMoves(ctx, open, node)
+			if errors.Is(err, errSettingsCannotKeep) {
+				return failBefore(p, node, err.Error())
+			}
+			if err != nil {
+				return false, fmt.Errorf("whether %s's data would move could not be read: %w", node, err)
+			}
+			if len(held) > 0 {
+				var said strings.Builder
+				sayDataHeld(&said, node, held)
+				return failBefore(p, node, "a running module's data would move there — "+
+					strings.Join(strings.Fields(said.String()), " "))
+			}
+			// A build that cannot be kept is refused by the composition above, which is the send's own, and fails the
+			// walk there: the send flattens its refusals into words, so it is not looked for again here.
+			sent, grants, err := sendJudged(keepingBuildsForSettings(ctx, node), open, node)
+			if err != nil {
+				return false, fmt.Errorf("sending %s %s: %w", node, settingsWalkFor(*s), err)
+			}
+			// **The module's build is the one the gate judges** (issue 641 review): kept by this send, it is what a
+			// crossing send — a merge's walk sending the machine a new build of the module — supersedes, so this gate
+			// never reads that send's report as its own.
+			kept := ""
+			if builds, known, err := open.inventory.SentBuilds(ctx, node); err == nil && known {
+				kept = builds[s.Module]
+			}
+			r.Gate = &inventory.PlanGate{Component: coreComponent(s.Module), Machines: sent, Since: &now,
+				From: kept, To: kept, Sent: sentNow(ctx, open.inventory, sent), Grants: grants}
+			p.Note = fmt.Sprintf("sent %s %s (ask %s), every build there kept; judging %s there", node,
+				settingsWalkFor(*s), s.Ask, s.Module)
+			if said := grantsSaid(grants); said != "" {
+				p.Note += "; " + said
+			}
+			fmt.Printf("%s: %s\n", p.ID, p.Note)
+			return true, nil
+		}
+		p.State, p.Tier = inventory.PlanDone, len(p.Tiers)
+		p.Note = fmt.Sprintf("%s (ask %s) delivered on %s", settingsWalkFor(*s), s.Ask, strings.Join(r.Done, ", "))
+		if len(r.Done) == 0 {
+			// Sent nowhere is not delivered: said as the walk's failure, so the operator is not told it landed.
+			p.State = inventory.PlanFailed
+			p.Note = fmt.Sprintf("%s (ask %s) was sent to no machine", settingsWalkFor(*s), s.Ask)
+		}
+		if len(r.Skipped) > 0 {
+			p.Note += "; not heard from, left as they were, their next send carries it: " + strings.Join(r.Skipped, ", ")
+		}
+		fmt.Printf("%s: %s\n", p.ID, p.Note)
+		return true, nil
+	}
+	g := r.Gate
+	node := r.Order[r.Next]
+	verdict, err := judgeMoves(ctx, open, g, []judged{{module: s.Module, node: node}}, now)
+	if err != nil {
+		return false, err
+	}
+	switch verdict {
+	case "":
+		return wait(fmt.Sprintf("judging %s on %s: %s", s.Module, node, gateLine(g)))
+	case inventory.GatePassed:
+		r.Done = append(r.Done, node)
+		r.Next++
+		r.Gate = nil
+		return true, nil
+	case inventory.GateSuperseded:
+		p.State = inventory.PlanSuperseded
+		p.Note = fmt.Sprintf("superseded on %s: %s — nothing judged, nothing put back; the layer is set, and the "+
+			"machines not yet sent take it at their next send", node, g.Why)
+		fmt.Printf("%s: %s\n", p.ID, p.Note)
+		return true, nil
+	}
+	p.State = inventory.PlanFailed
+	p.Note = fmt.Sprintf("%s failed its gate on %s: %s — the layer stays as the operator approved it, and the one it "+
+		"replaced is in `settings %s` history", settingsWalkFor(*s), node, g.Why, s.Module) + unreached(r)
+	fmt.Printf("%s: %s\n", p.ID, p.Note)
+	return true, nil
+}
+
+// failBefore ends a settings walk failed before it sent a machine, saying why, and that the layer stays.
+func failBefore(p *inventory.Plan, node, why string) (bool, error) {
+	r, s := p.Release, p.Release.Settings
+	p.State = inventory.PlanFailed
+	p.Note = fmt.Sprintf("%s not sent to %s: %s; the layer stays as the operator approved it", settingsWalkFor(*s),
+		node, why) + unreached(r)
+	fmt.Printf("%s: %s\n", p.ID, p.Note)
+	return true, nil
+}
+
+// unreached is what a stopped settings walk left without the layer, in words: the machines after the one it stopped
+// at, and those passed over as away (ADR 0344 §6). Empty when there are none.
+func unreached(r *inventory.PlanRelease) string {
+	var out string
+	if r.Next+1 < len(r.Order) {
+		out += "; not sent: " + strings.Join(r.Order[r.Next+1:], ", ")
+	}
+	if len(r.Skipped) > 0 {
+		out += "; not heard from, left as they were: " + strings.Join(r.Skipped, ", ")
+	}
+	return out
+}

cmd/mesh-controller/settings_walk_test.go

@@ -0,0 +1,568 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+)
+
+// novox/hq ADR 0344, issue 641: the operator's one Approve on a settings proposal is the act that makes it take
+// effect. The warrant sets the layer and opens a settings walk, which sends it to the machines it reaches one at a
+// time, judging the module on each; the ask says so before the Approve, and nothing names a push.
+
+// The order: every machine running the module, or the one the layer names, the control node last.
+func TestASettingsWalkGoesToTheMachinesTheLayerReachesTheControlNodeLast(t *testing.T) {
+	running := []string{"shanks", "novox", "g14", "ace"}
+	for _, c := range []struct {
+		node string
+		want []string
+	}{
+		{"", []string{"ace", "g14", "shanks", "novox"}},
+		{"g14", []string{"g14"}},
+		{"novox", []string{"novox"}},
+		{"elsewhere", nil},
+	} {
+		if got := settingsWalkOrder(c.node, running, []string{"novox"}); !reflect.DeepEqual(got, c.want) {
+			t.Errorf("a layer on %q goes to %v, want %v", c.node, got, c.want)
+		}
+	}
+}
+
+// A settings walk sends a machine only when no other walk judges there.
+func TestASettingsWalkWaitsWhileAnotherWalkJudgesOnTheMachine(t *testing.T) {
+	judging := &inventory.PlanGate{Machines: []string{"g14"}}
+	passed := &inventory.PlanGate{Machines: []string{"g14"}, Verdict: inventory.GatePassed}
+	plans := []inventory.Plan{
+		{ID: "settings-1", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: judging}},
+		{ID: "release-2", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: passed}},
+		{ID: "plan-3", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
+		{ID: "plan-4", State: inventory.PlanDone, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
+	}
+	if id := judgingIn(plans, "settings-1", "g14"); id != "plan-3" {
+		t.Errorf("on g14 %q judges, want plan-3 (itself, a passed gate and an ended walk are not judging)", id)
+	}
+	if id := judgingIn(plans[1:2], "x", "g14"); id != "" {
+		t.Errorf("a passed gate judges: %q", id)
+	}
+	if id := judgingIn(plans, "x", "shanks"); id != "" {
+		t.Errorf("on shanks %q judges", id)
+	}
+}
+
+// The ask says, before the Approve, that the layer is sent at once and judged, and that its end is told as every
+// walk's is; neither the ask nor the proposer's answer names a push any more.
+func TestTheAskSaysAnApprovedLayerIsSentAtOnce(t *testing.T) {
+	for _, c := range []struct {
+		in    proposeInput
+		where string
+		had   bool
+	}{
+		{proposeInput{module: "mounts", node: "shanks", values: mountsSources}, "shanks", false},
+		{proposeInput{module: "notes", values: map[string]any{"x": "1"}}, "every machine running notes", true},
+		{proposeInput{module: "notes", node: "laptop", clear: true}, "laptop", true},
+	} {
+		r := newProposerRig(t)
+		if c.had {
+			r.before, r.had = map[string]any{"x": "0"}, true
+		}
+		words, err := r.pr.propose(context.Background(), c.in)
+		if err != nil {
+			t.Fatal(err)
+		}
+		q := r.askSent(t)
+		if err := q.Check(r.now); err != nil {
+			t.Fatalf("the ask is refused: %v", err)
+		}
+		// At a glance (ADR 0345): the summary says it is sent at once by a walk, one machine at a time; the rest of
+		// what Approve does is the Details', which the router notes after the answers.
+		if !strings.Contains(q.Explanation, "sent at once by a walk to "+c.where+", one machine at a time, each judged") ||
+			!strings.Contains(q.Details, "and sent at once to "+c.where+", one machine at a time, each judged, "+
+				"every build there kept; its end is told as every walk's is") {
+			t.Errorf("the ask does not say the layer is sent at once to %s:\n%s", c.where, q.Explanation)
+		}
+		approve := q.Options[0]
+		if approve.Label != "Approve" || !strings.Contains(approve.Does, "sent to "+c.where+" at once") {
+			t.Errorf("Approve does %q", approve.Does)
+		}
+		if !strings.Contains(words, "a walk sends it to "+c.where+" at once") {
+			t.Errorf("the proposer's answer:\n%s", words)
+		}
+		for _, said := range []string{q.Explanation, q.Whole, approve.Does, words} {
+			if strings.Contains(said, "push") {
+				t.Errorf("a push is still named, as if a second act were needed:\n%s", said)
+			}
+		}
+	}
+}
+
+// ---- on the real stores -----------------------------------------------------------------------------
+
+// The warrant sets the layer and opens the walk that sends it, naming the machines it reaches; a layer for a
+// machine that does not run the module opens none and says so.
+func TestAnApprovedLayerOpensTheWalkThatSendsIt(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/notes.conf", "mode": "0644",
+			"content": "x = ${setting:x}\n"}}})
+	if _, err := assign(ctx, open, "laptop", "notes"); err != nil {
+		t.Fatal(err)
+	}
+	// A layer set by hand opens no walk: it still waits for a push (ADR 0344 §7).
+	if err := atTheTerminal(t, "settings", "set", "notes", `{"x":"0"}`, "--node", "laptop"); err != nil {
+		t.Fatal(err)
+	}
+	if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 0 {
+		t.Fatalf("a layer set at the terminal opened %d walk(s)", len(plans))
+	}
+	set := setLayerIn(open)
+	now := time.Now()
+	values := map[string]any{"x": "1"}
+	p := settingsProposal{Module: "notes", Values: values, From: "g14/claude-code", At: now,
+		Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
+	words, err := set(ctx, p, "s9", "approved by the operator (ask s9)")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(words, "+ x (ask s9); settings-") || !strings.Contains(words, "sends it to laptop, one machine at a time") {
+		t.Errorf("the warrant's words: %q", words)
+	}
+	plans, err := open.inventory.OpenPlans(ctx)
+	if err != nil || len(plans) != 1 {
+		t.Fatalf("open walks: %+v %v", plans, err)
+	}
+	w := plans[0]
+	if w.Release == nil || w.Release.Settings == nil || w.Release.Settings.Module != "notes" || w.Release.Settings.Ask != "s9" ||
+		!reflect.DeepEqual(w.Release.Order, []string{"laptop"}) || w.Repository != "the settings of notes on the whole mesh" ||
+		!reflect.DeepEqual(w.Tiers, [][]string{{"notes"}}) {
+		t.Fatalf("the settings walk: %+v %+v", w, w.Release)
+	}
+
+	// A machine's layer where the module does not run: set, and nothing to send.
+	q := settingsProposal{Module: "notes", Node: "anchor", Values: values, From: "g14/claude-code", At: now,
+		Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
+	words, err = set(ctx, q, "s10", "approved by the operator (ask s10)")
+	if err != nil || !strings.Contains(words, "no machine runs notes there, so there is nothing to send") {
+		t.Fatalf("a layer nobody runs: %q %v", words, err)
+	}
+	if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 1 {
+		t.Fatalf("a walk was opened for a machine that does not run the module: %d open", len(plans))
+	}
+
+	// A walk that cannot be opened is the act's failure, said with the push that sends it by hand.
+	was := openSettingsWalk
+	openSettingsWalk = func(context.Context, *stores, inventory.PlanSettings) (string, error) {
+		return "", fmt.Errorf("the plans are not to be had")
+	}
+	t.Cleanup(func() { openSettingsWalk = was })
+	again := map[string]any{"x": "2"}
+	byHand := map[string]any{"x": "0"}
+	r := settingsProposal{Module: "notes", Node: "laptop", Values: again, Before: byHand, HadLayer: true,
+		From: "g14/claude-code", At: now, Digest: layerDigest(again), BeforeDigest: layerDigest(byHand)}
+	if _, err := set(ctx, r, "s11", "approved"); err == nil || !strings.Contains(err.Error(), "is set, and the walk that "+
+		"sends it could not be opened: the plans are not to be had — `push laptop` sends it") {
+		t.Errorf("an unopened walk: %v", err)
+	}
+}
+
+// walkMesh is a mesh where `app` runs c1 on anchor and laptop and nothing waits for a gate: every send applied at
+// once, recorded, and judged from the reports, with a machine named broken failing what it was sent.
+type walkMesh struct {
+	open   *stores
+	sent   [][]string
+	broken map[string]bool
+	// kept says, per send, whether it kept every build of its machine; moves is the data a machine's send would move.
+	kept  []bool
+	moves map[string][]dataMove
+	heard map[string]bool
+}
+
+func aSettledMesh(t *testing.T) *walkMesh {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	w := &walkMesh{open: open, broken: map[string]bool{}, moves: map[string][]dataMove{},
+		heard: map[string]bool{"anchor": true, "laptop": true}}
+	withConditionsInMemory(t)
+	was := doctorFrom
+	doctorFrom = nil
+	t.Cleanup(func() { doctorFrom = was })
+	old := time.Now().Add(-2 * time.Hour)
+	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c1", Module: "app", Commit: "c1",
+		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: old, At: old,
+		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-1"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c1", Head: "c1", Asked: old}); err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range []string{"anchor", "laptop"} {
+		if _, err := inv.Assign(ctx, n, "app"); err != nil {
+			t.Fatal(err)
+		}
+		if err := inv.RecordSent(ctx, nodeID(t, open, n), "d-"+n, map[string]string{"app": "c1"}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	wasMoves, wasHeard, wasSend, wasGather, wasData := machineMoves, releaseHeard, sendRollout, gatherGateFacts, settingsDataMoves
+	settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) { return w.moves[node], nil }
+	machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
+		modules, err := open.inventory.Assigned(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		sent, known, err := open.inventory.SentBuilds(ctx, node)
+		if err != nil {
+			return nil, err
+		}
+		return f.moves(node, modules, sent, known, all), nil
+	}
+	releaseHeard = func(context.Context, *stores) (map[string]bool, error) { return w.heard, nil }
+	n := 0
+	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
+		w.sent = append(w.sent, append([]string(nil), names...))
+		w.kept = append(w.kept, len(names) == 1 && settingsKeptOn(ctx, names[0]))
+		current, err := open.inventory.CurrentBuilds(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range names {
+			modules, _ := open.inventory.Assigned(ctx, node)
+			carried := map[string]string{}
+			for _, m := range modules {
+				carried[m] = current[m].Commit
+			}
+			n++
+			digest := fmt.Sprintf("d-%s-%d", node, n)
+			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, carried); err != nil {
+				return nil, err
+			}
+			if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
+				Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
+				return nil, err
+			}
+		}
+		return names, nil
+	}
+	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+		f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
+			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
+		reports, err := open.inventory.LastReports(ctx)
+		if err != nil {
+			return f, err
+		}
+		for _, r := range reports {
+			if w.broken[r.Node] {
+				r.Outcome = inventory.OutcomeFailed
+			}
+			f.reports[r.Node] = r
+		}
+		return f, nil
+	}
+	wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
+	gateSettle, gateEvery = 0, time.Hour
+	t.Cleanup(func() {
+		machineMoves, releaseHeard, sendRollout, gatherGateFacts = wasMoves, wasHeard, wasSend, wasGather
+		settingsDataMoves = wasData
+		gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound
+	})
+	return w
+}
+
+func (w *walkMesh) walk(t *testing.T) inventory.Plan {
+	t.Helper()
+	plans, err := w.open.inventory.RecentPlans(t.Context(), 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, p := range plans {
+		if p.Release != nil && p.Release.Settings != nil {
+			return p
+		}
+	}
+	t.Fatal("no settings walk")
+	return inventory.Plan{}
+}
+
+// The walk sends the first machine alone and judges the module there before it sends the next, and ends
+// delivered on both; nothing waited for a gate, so each send carried the layer alone.
+func TestASettingsWalkSendsOneMachineAtATimeEachJudged(t *testing.T) {
+	judgeLeavesAsTheCore(t)
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	words, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s1", Change: "~ x"})
+	if err != nil || !strings.Contains(words, "sends it to anchor, laptop") {
+		t.Fatalf("%q %v", words, err)
+	}
+	advancePlans(ctx, w.open)
+	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v: the first machine alone, before it is judged", w.sent)
+	}
+	p := w.walk(t)
+	if p.Release.Gate == nil || p.Release.Next != 0 || !strings.Contains(p.Note, "judging app on anchor") {
+		t.Fatalf("the walk after its first send: %s %+v", p.Note, p.Release)
+	}
+	gateEvery = 0
+	for i := 0; i < 6; i++ {
+		advancePlans(ctx, w.open)
+	}
+	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}, {"laptop"}}) {
+		t.Fatalf("sent %v", w.sent)
+	}
+	p = w.walk(t)
+	if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Done, []string{"anchor", "laptop"}) ||
+		p.Outcome() != inventory.WalkDelivered || !strings.Contains(p.Note, "delivered on anchor, laptop") {
+		t.Fatalf("the walk is %s: %s %+v", p.State, p.Note, p.Release)
+	}
+	// It said its start and its end, so the operator is told once (ADR 0308).
+	if p.Times == nil || p.Times.Started == nil || p.Times.Ended == nil {
+		t.Fatalf("the walk's start and end are not marked: %+v", p.Times)
+	}
+	// Nothing waits, and no walk of waiting builds opened beside it.
+	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r != nil {
+		t.Fatalf("%+v %v", r, err)
+	}
+}
+
+// A machine that fails what it was sent stops the walk there: the next is not sent, the layer stays, and the
+// failure holds back no walk of waiting builds.
+func TestAFailedSettingsWalkStopsAndHoldsNothingBack(t *testing.T) {
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	inv := w.open.inventory
+	w.broken["anchor"] = true
+	if err := inv.KeepSettings(ctx, "", "app", map[string]any{"x": "1"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s2"}); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, w.open)
+	}
+	p := w.walk(t)
+	if p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
+		!strings.Contains(p.Note, "the settings of app on the whole mesh failed its gate on anchor") ||
+		!strings.Contains(p.Note, "the layer stays as the operator approved it") || !strings.Contains(p.Note, "not sent: laptop") {
+		t.Fatalf("the walk is %s: %s", p.State, p.Note)
+	}
+	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v: anchor alone, nothing to laptop", w.sent)
+	}
+	if layer, has, err := inv.Layer(ctx, "", "app"); err != nil || !has || layer["x"] != "1" {
+		t.Fatalf("the layer after the failure: %v %v %v", layer, has, err)
+	}
+	// A build that waits for a gate is still walked: the failed settings walk holds nothing back.
+	w.broken["anchor"] = false
+	now := time.Now().Add(-time.Minute)
+	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
+		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
+		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
+		t.Fatal(err)
+	}
+	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
+		t.Fatalf("the waiting build is held back by a failed settings walk: %+v %v", r, err)
+	}
+}
+
+// Each send of a settings walk keeps every build of its machine: the layer goes, and a build held for a person or
+// waiting for a gate stays where it is (ADR 0344 §3).
+func TestASettingsWalkSendsTheLayerAloneEveryBuildKept(t *testing.T) {
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	inv := w.open.inventory
+	gateEvery = 0
+	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s3"}); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, w.open)
+	}
+	if !reflect.DeepEqual(w.kept, []bool{true, true}) || w.walk(t).State != inventory.PlanDone {
+		t.Fatalf("the sends kept every build: %v; the walk: %s", w.kept, w.walk(t).Note)
+	}
+	// What such a send keeps, on the store: a rolled-out build waiting there is kept at the one last sent.
+	now := time.Now().Add(-time.Minute)
+	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
+		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
+		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
+		t.Fatal(err)
+	}
+	kept, err := recordedKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor")
+	if err != nil || kept["app"] != "c1" {
+		t.Fatalf("a settings send to anchor keeps %v (%v), want app at c1", kept, err)
+	}
+	if kept, _ := recordedKept(ctx, w.open, "anchor"); kept["app"] != "" {
+		t.Fatalf("an ordinary send keeps a rolled-out build: %v", kept)
+	}
+	// And so the ungated build waiting on anchor is no move of the settings send's: nothing for a gate to see.
+	f, err := readMoveFacts(ctx, inv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	waiting, _ := machineMoves(ctx, w.open, f, "anchor", false)
+	if len(waiting) != 1 || waiting[0].Module != "app" {
+		t.Fatalf("anchor waits for %+v, want app's c2", waiting)
+	}
+	if moved, err := withoutKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor", waiting); err != nil || len(moved) != 0 {
+		t.Fatalf("a settings send to anchor would move %+v (%v)", moved, err)
+	}
+}
+
+// A machine whose send would move a running module's data stops the walk there, failed and said with the push that
+// sends it on a person's word (ADR 0217 §3); one not heard from is passed over and named; and a walk that reached
+// no machine is not said delivered.
+func TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway(t *testing.T) {
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	gateEvery = 0
+	w.moves["laptop"] = []dataMove{{Container: "app-server", Inside: "/data", From: "/srv/a", To: "/srv/b"}}
+	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s4"}); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, w.open)
+	}
+	p := w.walk(t)
+	if p.State != inventory.PlanFailed || !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) ||
+		!strings.Contains(p.Note, "not sent to laptop: a running module's data would move there") ||
+		!strings.Contains(p.Note, "push laptop --move app") {
+		t.Fatalf("sent %v; the walk is %s: %s", w.sent, p.State, p.Note)
+	}
+
+	v := aSettledMesh(t)
+	v.heard = map[string]bool{"laptop": true}
+	gateEvery = 0
+	if _, err := openSettingsWalk(ctx, v.open, inventory.PlanSettings{Module: "app", Ask: "s5"}); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, v.open)
+	}
+	p = v.walk(t)
+	if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Skipped, []string{"anchor"}) ||
+		!strings.Contains(p.Note, "delivered on laptop; not heard from, left as they were, their next send carries it: anchor") {
+		t.Fatalf("the walk with anchor away is %s: %s", p.State, p.Note)
+	}
+
+	u := aSettledMesh(t)
+	u.heard = map[string]bool{}
+	if _, err := openSettingsWalk(ctx, u.open, inventory.PlanSettings{Module: "app", Ask: "s6"}); err != nil {
+		t.Fatal(err)
+	}
+	advancePlans(ctx, u.open)
+	if p := u.walk(t); p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
+		!strings.Contains(p.Note, "was sent to no machine") || len(u.sent) != 0 {
+		t.Fatalf("a walk that reached nobody is %s: %s", p.State, p.Note)
+	}
+}
+
+// The gate keeps the module's build its send kept, so a crossing send — a merge's walk sending the machine a new
+// build of the module while the settings gate judges there — supersedes it, and its report is never read as the
+// settings send's (issue 641 review, finding 1).
+func TestACrossingSendSupersedesASettingsGate(t *testing.T) {
+	judgeLeavesAsTheCore(t)
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	inv := w.open.inventory
+	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s7"}); err != nil {
+		t.Fatal(err)
+	}
+	advancePlans(ctx, w.open)
+	p := w.walk(t)
+	if g := p.Release.Gate; g == nil || g.To != "c1" || g.From != "c1" {
+		t.Fatalf("the settings gate judges no build: %+v", p.Release.Gate)
+	}
+	// Another walk sends anchor app's c2 while the settings gate judges there.
+	now := time.Now().Add(-time.Minute)
+	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
+		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
+		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, nodeID(t, w.open, "anchor"), "d-merge", map[string]string{"app": "c2"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.RecordDoing(ctx, nodeID(t, w.open, "anchor"), inventory.Doing{Node: "anchor",
+		Outcome: inventory.OutcomeApplied, Declared: "d-merge", Applied: 1, At: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	gateEvery = 0
+	advancePlans(ctx, w.open)
+	p = w.walk(t)
+	if p.State != inventory.PlanSuperseded || p.Release.Gate == nil || p.Release.Gate.Verdict != inventory.GateSuperseded ||
+		!strings.Contains(p.Note, "superseded on anchor") || len(p.Release.Done) != 0 {
+		t.Fatalf("the settings walk after a crossing send is %s: %s %+v", p.State, p.Note, p.Release)
+	}
+	if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
+		t.Fatalf("sent %v: laptop was sent after a superseded judging", w.sent)
+	}
+}
+
+// A send refusal that cannot clear by itself — what the machine was last sent is not known, or a build it runs is
+// gone — fails the walk with why, rather than keeping it open and holding the walk of waiting builds; and a
+// failure names the machines passed over as away (issue 641 review, findings 2 and 3).
+func TestASettingsWalkFailsOnARefusalThatCannotClear(t *testing.T) {
+	w := aSettledMesh(t)
+	ctx := t.Context()
+	inv := w.open.inventory
+	// What a send to a machine never sent can keep: nothing, and said as the refusal the walk fails on.
+	if _, err := inv.AddNode(ctx, "fresh"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := recordedKept(keepingBuildsForSettings(ctx, "fresh"), w.open, "fresh"); !errors.Is(err, errSettingsCannotKeep) {
+		t.Fatalf("a settings send to a machine never sent: %v", err)
+	}
+	w.heard = map[string]bool{"laptop": true}
+	settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) {
+		return nil, fmt.Errorf("%w: what %s was last sent is not known", errSettingsCannotKeep, node)
+	}
+	if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s8"}); err != nil {
+		t.Fatal(err)
+	}
+	advancePlans(ctx, w.open)
+	p := w.walk(t)
+	if p.State != inventory.PlanFailed || len(w.sent) != 0 ||
+		!strings.Contains(p.Note, "not sent to laptop: the settings cannot be sent with every build kept: what laptop was last sent is not known") ||
+		!strings.Contains(p.Note, "not heard from, left as they were: anchor") {
+		t.Fatalf("the walk is %s: %s", p.State, p.Note)
+	}
+	// It is not open, so a build waiting for a gate is walked.
+	now := time.Now().Add(-time.Minute)
+	manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
+	if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
+		Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
+		Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
+		Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
+		t.Fatal(err)
+	}
+	if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
+		t.Fatalf("the waiting build is held by the failed settings walk: %+v %v", r, err)
+	}
+}

cmd/mesh-controller/unseen_test.go

@@ -160,7 +160,7 @@ func TestTheVerbsCarryReadReplaceAndMove(t *testing.T) {
 		{"settings", map[string]any{"module": "plex", "history": "true"}, []string{"settings", "show", "plex", "--history"}},
 		{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace"}},
 		{"push", map[string]any{"node": "home", "move": "plex", "why": "w"},
-			[]string{"push", "home", "--wait", "0", "--move", "plex", "--why", "w"}},
+			[]string{"push", "home", "--wait", "0s", "--move", "plex", "--why", "w"}},
 		{"push", map[string]any{"why": "w"}, []string{"push", "--behind", "--wait", "0", "--why", "w"}},
 		{"plan", map[string]any{"node": "home", "diff": "true"}, []string{"plan", "home", "--diff"}},
 	} {

go.mod

@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0

go.sum

@@ -2,6 +2,12 @@ git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f h1:8N5OW2mdTNIck
 git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c h1:l5onJwoIeH8yE/PjVlEeoPyXBsHp2NQiWLllz2fwX7s=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629 h1:7TYFV1Q6Mcz+lsLP/sds87tysET4rKCn3rRIQV8gNmA=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d h1:HEJyqorKktrkJPeeJdwEo0kdrJjH3fm/YVS9MGftCqY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44 h1:r5xIo5qWOXQdCSMxvqJy8kV4U+P/QWXFK6971Ha6wU8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/catalogue/adoption.go

@@ -87,6 +87,11 @@ func Openings(rules []Rule, foundation []int, published map[string]map[int]int)
 			widen(key{rule.Protocol, rule.Port}, OpeningFromEverywhere)
 		case FromMesh:
 			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
+		case FromLocalNetwork:
+			// The private network's part only (novox/hq ADR 0340). An adopted node's found firewall
+			// stays, and it is what admits the machine's local network; an opening has no word for a
+			// local network, and widening it to everywhere would open the port to the internet.
+			widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
 		}
 	}
 	for _, port := range foundation {

internal/catalogue/bound.go

@@ -127,6 +127,7 @@ func boundNeed(n Needed, bound Chosen, catalogue map[string]Manifest, node Node,
 		identity = pm.IdentityBoundOf(n.Name)
 	}
 	held.From, held.At, held.Module, held.Serves, held.Identity = p.Node, p.At, p.Module, p.Serves, identity
+	held.LeftOut = p.LeftOut
 	return held, true, ""
 }
 

internal/catalogue/consumer_into_serves.go

@@ -135,6 +135,9 @@ func CheckServes(m Manifest) []string {
 		for _, key := range sortedAnyKeys(m.Serves[provision]) {
 			text, ok := m.Serves[provision][key].(string)
 			if !ok {
+				// A provider's own name is filled only in a value of its own (novox/hq ADR 0346): one
+				// nested in a list or an object would be served as the placeholder, unsaid.
+				problems = append(problems, nestedOwnNames(m, provision, key, m.Serves[provision][key])...)
 				continue
 			}
 			// A probe identity, because what is checked is the shape of the statement and not
@@ -143,6 +146,8 @@ func CheckServes(m Manifest) []string {
 				problems = append(problems, fmt.Sprintf(
 					"%s serves %s, and the value it serves as %q %s", m.Module, provision, key, err))
 			}
+			// And the provider's own names it may serve (novox/hq ADR 0346).
+			problems = append(problems, checkServedOwnNames(m, provision, key, text)...)
 			// A label longer than DNS keeps is not truncated here (asDNSLabel), so the offer's own
 			// bound has to keep the identity inside one (ADR 0225).
 			if strings.Contains(text, "${consumer:as:dns}") {

internal/catalogue/declaration.go

@@ -135,6 +135,12 @@ type Rendering struct {
 	// composes no filter for it rather than writing a rule around a link with no name.
 	OutwardLinks []string
 
+	// LocalNetworks is this machine's local networks (novox/hq ADR 0340): the networks it reported on a
+	// link facing outside it that lie wholly in a private range (JudgeLocalNetworks), which a port
+	// reached from `local-network` is admitted from beside the private network. Empty when it reported
+	// none, and the rule set then says so rather than widening the port or dropping it.
+	LocalNetworks []string
+
 	// TunnelInterface is the interface the mesh's private network runs on, named here rather than
 	// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
 	// not this machine's own guest, so the filter admits it only by a rule.
@@ -527,8 +533,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 				"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
 				"keeps the filter it has", r.Node, r.Node, filters)
 	}
-	filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
-		with.OutwardLinks, with.TunnelInterface)
+	filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
+		with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
 
 	// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
 	// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
@@ -2033,7 +2039,13 @@ func (r Resolution) servedOnThisMachine(provision string, with Rendering) (map[s
 		if err != nil {
 			return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
 		}
-		return settled, true, nil
+		// And the provider's own names, as this machine composes them (novox/hq ADR 0346); one it does
+		// not compose leaves its key out, said by the plan on this machine (ServedLeftOut).
+		named, _, err := r.ServedOwnNames(m, provision, settled, WithDefaults(m, with.Settings[m.Module]))
+		if err != nil {
+			return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
+		}
+		return named, true, nil
 	}
 	return nil, false, nil
 }
@@ -2551,8 +2563,8 @@ func onlyGroups(r map[string]any) bool {
 
 // generatedHere is what each computed module's generator answers for this machine, by module —
 // absent for a module whose machine is not yet part of what it generates — held to the rule every
-// module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq
-// issue 190, step 5; ADR 0222).
+// module is held to: no two modules on a machine declare one path, unit or name, nor one package present
+// and absent (novox/hq issue 190, step 5; ADR 0222, ADR 0303).
 //
 // Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
 // resources it will declare — they exist only once its generator has answered for this machine,

internal/catalogue/filtering.go

@@ -152,9 +152,10 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 					m.Module, port)
 			}
 			source, ok := value.(string)
-			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine) {
-				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q or %q",
-					m.Module, port, value, FromMesh, FromEverywhere, FromMachine)
+			if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine &&
+				source != FromLocalNetwork) {
+				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q, %q or %q",
+					m.Module, port, value, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork)
 			}
 			out[port] = source
 		}
@@ -172,7 +173,9 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
 // the appearance-of-restriction this mechanism exists to remove. The narrower rule's sources are
 // carried onto the wider one, so the module that wanted it is still named.
 func widest(rules []Rule) []Rule {
-	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromEverywhere: 2}
+	// The local network is the private network and the machine's own local networks (novox/hq ADR
+	// 0340 §4), so it covers `mesh` and is covered by `anywhere`.
+	reach := map[string]int{FromMachine: 0, FromMesh: 1, FromLocalNetwork: 2, FromEverywhere: 3}
 	var out []Rule
 	for _, rule := range rules {
 		covered := false
@@ -232,6 +235,15 @@ const SSHPort = 22
 // any module asks for, and neither may be derived away.
 func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
 	outwardLinks []string, tunnel string) string {
+	return AsNftablesWithLocal(rules, mesh, outward, foundation, outwardLinks, tunnel, nil)
+}
+
+// AsNftablesWithLocal is AsNftables with the machine's local networks: the networks it reported on a
+// link facing outside that count (novox/hq ADR 0340, JudgeLocalNetworks), which a rule from
+// `local-network` admits on its own port alone, beside the private network. None is not widened to
+// anywhere and not dropped silently: the rule set says the port wanted the local network and found none.
+func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation []int,
+	outwardLinks []string, tunnel string, local []string) string {
 	// The links that are not this machine's own: the ones facing outside, and the mesh's tunnel.
 	// Traffic arriving on any of them is admitted only by a rule below; traffic arriving anywhere
 	// else is this machine's own guest and is not something the mesh has a position on.
@@ -394,6 +406,31 @@ func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
 					strings.Join(six, ", "), rule.Protocol, rule.Port))
 			}
+		case FromLocalNetwork:
+			// The private network and the machine's own local networks, on this port alone (novox/hq
+			// ADR 0340 §5).
+			four, six := byFamily(mesh)
+			lfour, lsix := byFamily(local)
+			four, six = append(four, lfour...), append(six, lsix...)
+			if len(lfour) == 0 && len(lsix) == 0 {
+				b.WriteString(fmt.Sprintf(
+					"\t\t# %s/%d wanted the local network, and this machine reported no private network "+
+						"on a link facing outside; admitted from no local network\n", rule.Protocol, rule.Port))
+			}
+			if len(four) == 0 && len(six) == 0 {
+				b.WriteString(fmt.Sprintf(
+					"\t\t# %s/%d wanted the local network, and this node knows neither mesh addresses nor a "+
+						"local network; closed\n", rule.Protocol, rule.Port))
+				break
+			}
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
+					strings.Join(four, ", "), rule.Protocol, rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
+					strings.Join(six, ", "), rule.Protocol, rule.Port))
+			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\t%s dport %d accept\n", rule.Protocol, rule.Port))
 		}
@@ -487,6 +524,18 @@ func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
 				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
 					strings.Join(six, ", "), rule.Port))
 			}
+		case FromLocalNetwork:
+			four, six := byFamily(mesh)
+			lfour, lsix := byFamily(local)
+			four, six = append(four, lfour...), append(six, lsix...)
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(four, ", "), rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(six, ", "), rule.Port))
+			}
 		case FromEverywhere:
 			b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", rule.Port))
 		}
@@ -793,10 +842,14 @@ const (
 	// are a subset of anywhere. What differs is the names, which is the whole reason reach is not
 	// simply the filter's vocabulary with nicer words.
 	ReachBoth = "both"
+	// ReachLocalNetwork is `internal` with the machine's own local networks added to what the filter
+	// opens (novox/hq ADR 0340 §4): the internal name and not the public one, the mesh's own authority,
+	// and the port opened to the private network and to the private networks the machine is attached to.
+	ReachLocalNetwork = "local-network"
 )
 
 // reaches is every value, in the order a refusal lists them.
-var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth}
+var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth, ReachLocalNetwork}
 
 // RoutedPorts are the ports a module serves through a proxy, taken from its route contributions.
 //
@@ -845,6 +898,8 @@ func FilterSource(reach string) (string, bool) {
 		return FromMesh, true
 	case ReachPublic, ReachBoth:
 		return FromEverywhere, true
+	case ReachLocalNetwork:
+		return FromLocalNetwork, true
 	default:
 		return "", false
 	}
@@ -854,7 +909,9 @@ func FilterSource(reach string) (string, bool) {
 func WantsPublicName(reach string) bool { return reach == ReachPublic || reach == ReachBoth }
 
 // WantsInternalName is whether a reach asks for the route's internal name to be composed.
-func WantsInternalName(reach string) bool { return reach == ReachInternal || reach == ReachBoth }
+func WantsInternalName(reach string) bool {
+	return reach == ReachInternal || reach == ReachBoth || reach == ReachLocalNetwork
+}
 
 // Reaches reads a module's per-node reach settings: declared port → how far it reaches.
 //

internal/catalogue/generated_collision_test.go

@@ -6,7 +6,8 @@ import (
 )
 
 // novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
-// every module is — no two modules on a machine declare one path, unit, name or package. The
+// every module is — no two modules on a machine declare one path, unit or name (a package may be declared by
+// several, novox/hq ADR 0303). The
 // private network once declared the container runtime's file and service beside the runtime's own
 // module, and nothing refused it, because the collision check only ever saw catalogue manifests.
 

internal/catalogue/issued_credential_test.go

@@ -25,13 +25,13 @@ func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
 	}
 
 	for want, raw := range map[string]string{
-		"the one issuer an offer may name": `{"module":"d","version":"1",
+		"the issuers an offer may name": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
 		"names no tool that answers it": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
 		"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
 			"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
-		"the one issuer an offer may name ": `{"module":"d","version":"1",
+		"the issuers an offer may name ": `{"module":"d","version":"1",
 			"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
 	} {
 		want = strings.TrimSpace(want)

internal/catalogue/issued_outside_test.go

@@ -0,0 +1,46 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
+// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
+// either. An offer that says `software` keeps ADR 0305's shape.
+func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
+	m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
+		"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
+		"serves":{"tv-api":{"port":8989}}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !m.IssuedOutsideOf("tv-api") {
+		t.Fatal("the offer's credential issued outside was not read")
+	}
+	if m.IssuedOutsideOf("other") {
+		t.Fatal("a provision the module does not offer reads as issued outside")
+	}
+	if _, issued := m.IssuedCredentialOf("tv-api"); issued {
+		t.Fatal("a credential issued outside was read as issued by the software")
+	}
+	if _, shared := m.SharedCredentialOf("tv-api"); shared {
+		t.Fatal("a credential issued outside was read as an own secret shared")
+	}
+	if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
+		t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
+	}
+
+	for want, raw := range map[string]string{
+		"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
+		"names the tool": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
+		"the issuers an offer may name": `{"module":"d","version":"1",
+			"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
+	} {
+		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("expected a refusal saying %q, got %v", want, err)
+		}
+	}
+}

internal/catalogue/localnetwork.go

@@ -0,0 +1,154 @@
+package catalogue
+
+import (
+	"fmt"
+	"net/netip"
+	"slices"
+	"sort"
+	"strings"
+)
+
+// AttachedNetwork is one network a machine said it is directly attached to: the link it is on and the
+// network as address and prefix (novox/hq ADR 0340 §7), as the node-engine reports it among its facts.
+type AttachedNetwork struct {
+	Link    string `json:"link"`
+	Network string `json:"network"`
+}
+
+// LocalNetwork is one attached network judged: whether it counts as this machine's local network for a
+// port reached from `local-network`, and why — said for one that counts as well as for one that does
+// not, so `node` can show which counted and why the others did not (ADR 0340 §8).
+type LocalNetwork struct {
+	Link    string
+	Network string
+	Counts  bool
+	Why     string
+}
+
+// privateRanges are the only ranges a local network may lie in (ADR 0340 §2): RFC 1918 for IPv4 and the
+// unique local addresses for IPv6. A network counts only when it lies wholly inside one of them.
+var privateRanges = []struct {
+	prefix netip.Prefix
+	name   string
+}{
+	{netip.MustParsePrefix("10.0.0.0/8"), "a private range (RFC 1918, 10.0.0.0/8)"},
+	{netip.MustParsePrefix("172.16.0.0/12"), "a private range (RFC 1918, 172.16.0.0/12)"},
+	{netip.MustParsePrefix("192.168.0.0/16"), "a private range (RFC 1918, 192.168.0.0/16)"},
+	{netip.MustParsePrefix("fc00::/7"), "the IPv6 unique local range (fc00::/7)"},
+}
+
+// JudgeLocalNetworks says, for each network a machine reported, whether it counts as its local network.
+//
+// **A public subnet never counts** (ADR 0340 §2): a network counts only when it lies wholly in a private
+// range, so `local-network` can never open a port to the internet — a machine sitting on a public /24 has
+// that /24 judged and refused, never rendered. A link-local network does not count either. And only a
+// link the machine reported as facing outside it counts (§3): the private network's own link and a
+// container bridge are this machine's own, not its local network, whatever their addresses.
+//
+// Sorted by link and then network, one entry per (link, network), so what `node` shows and what the
+// filter is rendered from do not depend on the order a machine happened to say them in.
+func JudgeLocalNetworks(attached []AttachedNetwork, outward []string, tunnel string) []LocalNetwork {
+	seen := map[[2]string]bool{}
+	var out []LocalNetwork
+	for _, a := range attached {
+		key := [2]string{a.Link, a.Network}
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, judgeOne(a, outward, tunnel))
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Link != out[j].Link {
+			return out[i].Link < out[j].Link
+		}
+		return out[i].Network < out[j].Network
+	})
+	return out
+}
+
+func judgeOne(a AttachedNetwork, outward []string, tunnel string) LocalNetwork {
+	j := LocalNetwork{Link: a.Link, Network: a.Network}
+	prefix, err := netip.ParsePrefix(strings.TrimSpace(a.Network))
+	if err != nil {
+		j.Why = "not a network the mesh can read (" + err.Error() + ")"
+		return j
+	}
+	prefix = prefix.Masked()
+	j.Network = prefix.String()
+	switch {
+	case tunnel != "" && a.Link == tunnel:
+		j.Why = "the private network's own link, not the local network"
+		return j
+	case !slices.Contains(outward, a.Link):
+		j.Why = fmt.Sprintf("%s does not face outside this machine (a bridge or a link of its own)", a.Link)
+		return j
+	case prefix.Addr().IsLoopback():
+		j.Why = "loopback"
+		return j
+	case prefix.Addr().IsLinkLocalUnicast():
+		j.Why = "link-local, never counted"
+		return j
+	}
+	for _, r := range privateRanges {
+		if r.prefix.Contains(prefix.Addr()) && prefix.Bits() >= r.prefix.Bits() {
+			j.Counts = true
+			j.Why = "in " + r.name
+			return j
+		}
+	}
+	if prefix.Addr().IsPrivate() {
+		// Overlaps a private range without lying wholly inside it (a /7 around 10.0.0.0/8, say).
+		j.Why = "not wholly in a private range, so never counted"
+		return j
+	}
+	j.Why = "public, never counted: local-network may not open a port to the internet"
+	return j
+}
+
+// CountedLocalNetworks is the networks that count, as the filter renders them: sorted, without repeats.
+func CountedLocalNetworks(judged []LocalNetwork) []string {
+	var out []string
+	for _, j := range judged {
+		if j.Counts && !slices.Contains(out, j.Network) {
+			out = append(out, j.Network)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// LocalNetworkPort is one port the filter admits from `local-network`, and what that resolved to on this
+// machine (ADR 0340 §8): what `plan` shows for it.
+type LocalNetworkPort struct {
+	Port     int
+	Protocol string
+	Because  []string
+	// Networks is the local networks it is admitted from; empty when the machine reported none (§6).
+	Networks []string
+}
+
+// LocalNetworkPorts is every rule admitted from `local-network`, with the networks it resolved to.
+func LocalNetworkPorts(rules []Rule, networks []string) []LocalNetworkPort {
+	var out []LocalNetworkPort
+	for _, rule := range rules {
+		if rule.From != FromLocalNetwork {
+			continue
+		}
+		out = append(out, LocalNetworkPort{Port: rule.Port, Protocol: rule.Protocol,
+			Because: rule.Because, Networks: networks})
+	}
+	return out
+}
+
+// Said is how `plan` says one such port: the networks, or that there are none and the port is admitted
+// from the private network only.
+func (p LocalNetworkPort) Said() string {
+	by := strings.Join(p.Because, ", ")
+	if len(p.Networks) == 0 {
+		return fmt.Sprintf("%s/%d (%s) from the local network: none — this machine reported no private "+
+			"network on a link facing outside, so it is admitted from the private network only", p.Protocol, p.Port, by)
+	}
+	return fmt.Sprintf("%s/%d (%s) from the local network: %s, and the private network", p.Protocol, p.Port, by,
+		strings.Join(p.Networks, ", "))
+}

internal/catalogue/localnetwork_test.go

@@ -0,0 +1,195 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
+// provider handed it, beside the private network's own link and a container bridge.
+var homeServer = []AttachedNetwork{
+	{Link: "eth0", Network: "192.168.1.10/24"},
+	{Link: "eth1", Network: "203.0.113.7/24"},
+	{Link: "eth0", Network: "fe80::1/64"},
+	{Link: "eth0", Network: "fd12:3456:789a::5/64"},
+	{Link: "wg-mesh", Network: "10.10.0.4/24"},
+	{Link: "docker0", Network: "172.17.0.1/16"},
+}
+
+func judged(t *testing.T) []LocalNetwork {
+	t.Helper()
+	return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
+}
+
+// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
+// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
+func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
+	got := CountedLocalNetworks(judged(t))
+	want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
+	if strings.Join(got, " ") != strings.Join(want, " ") {
+		t.Fatalf("counted %v, want %v", got, want)
+	}
+	for _, j := range judged(t) {
+		if j.Why == "" {
+			t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
+		}
+		switch j.Network {
+		case "203.0.113.0/24":
+			if j.Counts || !strings.Contains(j.Why, "public") {
+				t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
+			}
+		case "fe80::/64":
+			if j.Counts || !strings.Contains(j.Why, "link-local") {
+				t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
+			}
+		case "10.10.0.0/24", "172.17.0.0/16":
+			if j.Counts {
+				t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
+			}
+		}
+	}
+}
+
+// A network overlapping a private range without lying wholly inside it does not count either, so a
+// wide prefix around a private range cannot carry the internet with it.
+func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
+	for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
+		got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
+		if len(got) != 1 || got[0].Counts {
+			t.Errorf("%s counts as a local network: %+v", n, got)
+		}
+	}
+}
+
+// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
+// in both chains, and never the public subnet.
+func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
+	rules := []Rule{
+		{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}},
+		{Port: 5432, Protocol: "tcp", From: FromMesh, Because: []string{"postgres"}},
+	}
+	local := CountedLocalNetworks(judged(t))
+	out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
+		[]string{"eth0", "eth1"}, "wg-mesh", local)
+
+	for _, want := range []string{
+		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
+		"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
+		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
+		// The mesh-only port is not widened by the machine having a local network.
+		"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("the rule set lacks %q:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, "203.0.113") {
+		t.Errorf("the public subnet reached the rule set:\n%s", out)
+	}
+	if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
+		t.Errorf("1883 is open to anywhere:\n%s", out)
+	}
+	for _, line := range strings.Split(out, "\n") {
+		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
+			t.Fatalf("1883 is open to anywhere:\n%s", out)
+		}
+	}
+}
+
+// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
+// port from the private network only, and the rule set says it found none — never widened to anywhere.
+func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
+	rules := []Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}}}
+	out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
+	if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
+		t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
+	}
+	if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
+		t.Errorf("the port is not admitted from the private network:\n%s", out)
+	}
+	for _, line := range strings.Split(out, "\n") {
+		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
+			t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
+		}
+	}
+	said := LocalNetworkPorts(rules, nil)[0].Said()
+	if !strings.Contains(said, "none") {
+		t.Errorf("plan says %q, want it to say no local network was found", said)
+	}
+}
+
+// `local-network` is a source a manifest may name (§1, changing ADR 0045 §3), and an unknown source is
+// still refused.
+func TestAManifestMayListenFromTheLocalNetwork(t *testing.T) {
+	if _, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
+		"listens":[{"port":1883,"from":"local-network"}]}`)); err != nil {
+		t.Fatalf("a listen from the local network is refused: %v", err)
+	}
+	_, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
+		"listens":[{"port":1883,"from":"lan"}]}`))
+	if err == nil || !strings.Contains(err.Error(), `from "lan"`) {
+		t.Fatalf("a source the mesh cannot render is not refused: %v", err)
+	}
+}
+
+// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
+// filter opens — the internal name, not the public one.
+func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
+	public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachLocalNetwork))
+	if public != "" || internal != "app.anchor.internal" {
+		t.Fatalf("names are %q and %q, want the internal name only", public, internal)
+	}
+	bare := aRoutedWeb()
+	bare.Contributes = nil
+	r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
+	rules, err := r.Rules(Rendering{Settings: reachSet(ReachLocalNetwork)})
+	if err != nil {
+		t.Fatalf("rules: %v", err)
+	}
+	if len(rules) != 1 || rules[0].From != FromLocalNetwork {
+		t.Fatalf("reach local-network made the filter say %+v", rules)
+	}
+}
+
+// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
+// the local network: it covers the mesh, and anywhere covers it.
+func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
+	got := widest([]Rule{
+		{Port: 53, Protocol: "udp", From: FromMesh, Because: []string{"a"}},
+		{Port: 53, Protocol: "udp", From: FromLocalNetwork, Because: []string{"b"}},
+	})
+	if len(got) != 1 || got[0].From != FromLocalNetwork || len(got[0].Because) != 2 {
+		t.Fatalf("got %+v", got)
+	}
+	got = widest(append(got, Rule{Port: 53, Protocol: "udp", From: FromEverywhere, Because: []string{"c"}}))
+	if len(got) != 1 || got[0].From != FromEverywhere {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+// On an adopted node the opening is the private network's part only: the found firewall admits the
+// local network, and an opening that widened to everywhere would open the port to the internet.
+func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
+	out := Openings([]Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork}}, nil, nil)
+	if len(out) != 1 || out[0]["from"] != OpeningFromMesh {
+		t.Fatalf("openings %v", out)
+	}
+}
+
+// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
+// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
+func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
+	got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
+	if len(got) != 1 {
+		t.Fatalf("judged %+v", got)
+	}
+	if got[0].Counts {
+		t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
+	}
+	if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
+		t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
+	}
+	if n := CountedLocalNetworks(got); len(n) != 0 {
+		t.Fatalf("counted %v", n)
+	}
+}

internal/catalogue/manifest.go

@@ -269,7 +269,8 @@ func KeepsConsumerData(catalogue map[string]Manifest, provision string) bool {
 func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }
 
 // OfferCredential names which of the provider's own secrets a provision's consumers receive — or, with
-// IssuedBy, that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
+// IssuedBy "outside", that only a person can give the provision's credential (novox/hq ADR 0337, issue 164) — or,
+// with IssuedBy "software", that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
 // issue 526): a media server's sign-in token from its vendor, which the mesh can neither make nor rotate.
 // Tool is then the provider's own tool that answers that value, sealed to a key made for the controller's
 // one call, and to the controller alone.
@@ -293,6 +294,34 @@ func (m Manifest) IssuedCredentialOf(provision string) (string, bool) {
 	return "", false
 }
 
+// IssuedOutsideOf is whether this module's offer of a provision says only a person outside the mesh can give its
+// credential (novox/hq ADR 0337): the mesh never makes a value for it, and a consumer holds one only once a person
+// gave it with `secret accept`.
+func (m Manifest) IssuedOutsideOf(provision string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision && o.Credential != nil && o.Credential.IssuedBy == IssuedOutside {
+			return true
+		}
+	}
+	return false
+}
+
+// OffersIssuedOutside is whether any module of a catalogue offers the provision with a credential issued outside
+// the mesh (novox/hq ADR 0337), and the first such module by name.
+func OffersIssuedOutside(shelf map[string]Manifest, provision string) (string, bool) {
+	var names []string
+	for name, m := range shelf {
+		if m.IssuedOutsideOf(provision) {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return "", false
+	}
+	sort.Strings(names)
+	return names[0], true
+}
+
 // SharedCredentialOf is the own secret an offer of this module names as the provision's credential,
 // and whether it names one.
 func (m Manifest) SharedCredentialOf(provision string) (string, bool) {
@@ -1136,6 +1165,12 @@ const (
 	FromEverywhere = "anywhere"
 	// FromMachine is this machine only — a port bound for something else on the same host.
 	FromMachine = "machine"
+	// FromLocalNetwork is the private network and the networks this machine is directly attached to
+	// through its uplink, as it reports them, and only those wholly in a private range (novox/hq ADR
+	// 0340): a local service reached by devices that will never be nodes, said as exactly that rather
+	// than as `anywhere`. A public subnet the machine sits on never counts, so it cannot open a port to
+	// the internet.
+	FromLocalNetwork = "local-network"
 )
 
 // At is this port's protocol, with the default applied.
@@ -1647,14 +1682,28 @@ func ParseManifest(raw []byte) (Manifest, error) {
 						"makes is %d", m.Module, p, id.Max, shortest))
 			}
 		}
-		if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
+		if c := offer.Credential; c != nil && c.IssuedBy == IssuedOutside {
+			// Only a person can give it (novox/hq ADR 0337 §1, issue 164): the software holds a value the mesh can
+			// neither make nor fetch, so the offer names nothing that would answer it — no own secret, no tool.
+			switch {
+			case c.Own != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names its own secret %q too; a "+
+						"person gives the value with `secret accept`, so the offer names no own secret (ADR 0337)",
+					m.Module, p, c.Own))
+			case c.Tool != "":
+				problems = append(problems, fmt.Sprintf(
+					"%s provides %q with a credential issued outside the mesh and names the tool %q; only a "+
+						"person gives it, so the offer names no tool (ADR 0337)", m.Module, p, c.Tool))
+			}
+		} else if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
 			// The software issues it (novox/hq ADR 0305): named by the tool that answers it, never by an own
 			// secret, which would be a second copy for the mesh to keep in step with the software's.
 			switch {
 			case c.IssuedBy != IssuedBySoftware:
 				problems = append(problems, fmt.Sprintf(
-					"%s provides %q with a credential issued by %q; the one issuer an offer may name is %q (ADR 0305)",
-					m.Module, p, c.IssuedBy, IssuedBySoftware))
+					"%s provides %q with a credential issued by %q; the issuers an offer may name are %q and %q "+
+						"(ADR 0305, ADR 0337)", m.Module, p, c.IssuedBy, IssuedBySoftware, IssuedOutside))
 			case c.Own != "":
 				problems = append(problems, fmt.Sprintf(
 					"%s provides %q with a credential its software issues and names its own secret %q too; the "+
@@ -1886,17 +1935,17 @@ func ParseManifest(raw []byte) (Manifest, error) {
 				"%s listens on port %d, which is not a port", m.Module, l.Port))
 		}
 		switch l.From {
-		case FromMesh, FromEverywhere, FromMachine:
+		case FromMesh, FromEverywhere, FromMachine, FromLocalNetwork:
 		case "":
 			// The fault this field exists to prevent. A rule with no source is open, and a
 			// manifest that omitted it would read as a restriction and be none.
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d and does not say from where; it is %q, %q or %q",
-				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine))
+				"%s listens on %d and does not say from where; it is %q, %q, %q or %q",
+				m.Module, l.Port, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
 		default:
 			problems = append(problems, fmt.Sprintf(
-				"%s listens on %d from %q; it is %q, %q or %q",
-				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine))
+				"%s listens on %d from %q; it is %q, %q, %q or %q",
+				m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
 		}
 		if p := l.At(); p != "tcp" && p != "udp" {
 			problems = append(problems, fmt.Sprintf(

internal/catalogue/resolve.go

@@ -111,6 +111,9 @@ type Provider struct {
 	// (novox/hq to-be 23), and the pair is what tells the holder of a seat apart from another module
 	// providing the same thing (ADR 0110).
 	Module string
+	// LeftOut says each served key left out of Serves because that node composes no name it asks
+	// for (novox/hq ADR 0346 §3): said under each consumer's need.
+	LeftOut []string
 }
 
 // Held is a claim somebody already has, used for the scopes wider than one node.
@@ -230,6 +233,9 @@ type Needed struct {
 	// state, not a consumer missing its key. Set by the plan, which is the only layer that knows a
 	// licence's manager; empty for every consumer.
 	Manager bool
+	// LeftOut says each served key the provider left out, because its machine composes no name the
+	// value asks for (novox/hq ADR 0346 §3).
+	LeftOut []string
 	// Module is the providing module on From, empty for a need answered by a record or by nothing
 	// that serves it. A provider is a (node, module) pair (novox/hq to-be 23), and a binding to data
 	// is a binding to the pair (ADR 0232).
@@ -582,7 +588,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
 					bound = pm.IdentityBoundOf(want)
 				}
 				needs = append(needs, Needed{Name: want, From: p.Node, At: p.At, Module: p.Module,
-					Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound})
+					Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound, LeftOut: p.LeftOut})
 			}
 			switch {
 			case world.Unchecked:

internal/catalogue/seat_dependencies.go

@@ -331,12 +331,13 @@ func UnassignRefusal(catalogue map[string]Manifest, node string, assigned, remov
 }
 
 // CollisionRefusal is why assigning `adding` beside `assigned` is refused for what two modules
-// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235).
+// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235): one path, unit or name, or a package one
+// declares present and another absent. A package several modules declare present is no collision (ADR 0303).
 //
 // **Refused, not kept like an unresolved provision.** An assignment is otherwise kept when the
 // node does not resolve, because assignment is not an ordering: a consumer's provider can follow.
 // A collision is not an order anything can complete — no further assignment makes two owners of one
-// package one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
+// file one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
 // it from the mesh. Only collisions involving a module being added are refused; one already on the
 // node is `status`'s, and refusing an unrelated assignment for it would block its own remedy.
 func CollisionRefusal(catalogue map[string]Manifest, node string, assigned, adding []string) error {

internal/catalogue/served_own_names.go

@@ -0,0 +1,202 @@
+package catalogue
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// A provider may tell its consumers its own composed names (novox/hq ADR 0346, issue 624).
+//
+// **The name is already the mesh's.** A module contributes a label to a requirement — a route — and
+// the mesh joins it with the providing machine's domains; the module reads the result in its own files
+// as `${bound:<requirement>:name}` (novox/hq 04-ISSUES/122). Its consumers could not be told it: a
+// served value named only the consumer (ADR 0202) and settings. The forge's package registry writes
+// every tarball at its public name, and a consumer that must trust that name had no source for it but a
+// second copy kept by hand. So a served value may say `${bound:<requirement>:<name>}` for a requirement
+// the provider contributes to, and the mesh fills it from the same composition the provider's own files
+// and its proxy receive.
+//
+// **A name the providing machine does not compose leaves the key out** (ADR 0346 §3): a machine with
+// no public domain has no public name to give, and an empty value or a refusal would be worse than a
+// consumer told nothing — a refused provider machine takes every provision it offers down with it. The
+// plan says which key was left out, and why, on the provider's machine and under each consumer's need.
+
+// ownNameFacts are what a served value may name of the provider's own composition: the names, as its
+// own files read them (withOwnNames).
+var ownNameFacts = []string{"name", "internal-name"}
+
+// requirementsContributedTo is every requirement m contributes to, sorted.
+func requirementsContributedTo(m Manifest) []string {
+	seen := map[string]bool{}
+	for to := range m.Contributes {
+		seen[to] = true
+	}
+	for to := range m.ContributesMany {
+		seen[to] = true
+	}
+	out := make([]string, 0, len(seen))
+	for to := range seen {
+		out = append(out, to)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// ownNameKeys is every name a served value of m may say for one requirement it contributes to:
+// `name` and `internal-name`, and `name-<local>` and `internal-name-<local>` for each local name it
+// contributes under.
+func ownNameKeys(m Manifest, to string) []string {
+	keys := append([]string{}, ownNameFacts...)
+	for _, local := range sortedKeys(m.ContributesMany[to]) {
+		for _, fact := range ownNameFacts {
+			keys = append(keys, fact+"-"+local)
+		}
+	}
+	return keys
+}
+
+// ServedOwnNames fills the provider's own composed names into what it serves one provision's
+// consumers, from this resolution's composition of the provider's machine (ADR 0346).
+//
+// A value naming a name this machine does not compose is left out, with its key, and said. The map is
+// copied only when something changes, as ServedTo does: the caller's may be the manifest's.
+func (r Resolution) ServedOwnNames(m Manifest, provision string, serves map[string]any, layers []Layer) (
+	map[string]any, []string, error) {
+	var asking []string
+	for _, key := range sortedAnyKeys(serves) {
+		if text, ok := serves[key].(string); ok && bound.MatchString(text) {
+			asking = append(asking, key)
+		}
+	}
+	if len(asking) == 0 {
+		return serves, nil, nil
+	}
+	own := map[string]map[string]string{}
+	for _, to := range requirementsContributedTo(m) {
+		names, err := r.ownNames(m, to, layers)
+		if err != nil {
+			return nil, nil, err
+		}
+		values := map[string]string{}
+		withOwnNames(values, names)
+		own[to] = values
+	}
+	out := make(map[string]any, len(serves))
+	for k, v := range serves {
+		out[k] = v
+	}
+	var said []string
+	for _, key := range asking {
+		text := serves[key].(string)
+		var missing string
+		filled := bound.ReplaceAllStringFunc(text, func(token string) string {
+			parts := bound.FindStringSubmatch(token)
+			if value := own[parts[1]][parts[2]]; value != "" && parts[3] == "" {
+				return value
+			}
+			if missing == "" {
+				missing = token
+			}
+			return token
+		})
+		if missing != "" {
+			delete(out, key)
+			said = append(said, fmt.Sprintf(
+				"%s serves %s without %q: it names %s, and %s composes no such name for %s (it has no "+
+					"public domain, or the endpoint is not reached publicly) (novox/hq ADR 0346)",
+				m.Module, provision, key, missing, orHere(r.Node), m.Module))
+			continue
+		}
+		out[key] = filled
+	}
+	return out, said, nil
+}
+
+func orHere(node string) string {
+	if node == "" {
+		return "this machine"
+	}
+	return node
+}
+
+// ServedLeftOut is what the providers in this node's own set leave out of what they serve, because
+// this machine composes no name a served value asks for (ADR 0346 §3): said on the provider's machine,
+// where the remedy is.
+func (r Resolution) ServedLeftOut(settings SettingsBy) []string {
+	var said []string
+	for _, m := range r.Modules {
+		for _, provision := range sortedServes(m.Serves) {
+			_, lines, err := r.ServedOwnNames(m, provision, m.Serves[provision], WithDefaults(m, settings[m.Module]))
+			if err != nil {
+				said = append(said, fmt.Sprintf("%s serves %s, and its own names could not be composed: %v",
+					m.Module, provision, err))
+				continue
+			}
+			said = append(said, lines...)
+		}
+	}
+	return said
+}
+
+// checkServedOwnNames refuses a served `${bound:…}` that names a requirement the module does not
+// contribute to, a fact other than its own names, or a local name it does not contribute under; and
+// one with a default, since a served value is left out rather than given one (ADR 0346 §3, §4).
+func checkServedOwnNames(m Manifest, provision, key, text string) []string {
+	var problems []string
+	contributes := requirementsContributedTo(m)
+	for _, parts := range bound.FindAllStringSubmatch(text, -1) {
+		to, fact, fallback := parts[1], parts[2], parts[3]
+		says := fmt.Sprintf("%s serves %s, and the value it serves as %q says %s", m.Module, provision, key, parts[0])
+		switch {
+		case fallback != "":
+			problems = append(problems, says+": a served name takes no default; one the machine does not "+
+				"compose leaves the key out (novox/hq ADR 0346)")
+		case !oneOf(contributes, to):
+			problems = append(problems, fmt.Sprintf(
+				"%s, and %s contributes to %s: a served value names only the provider's own names "+
+					"(novox/hq ADR 0346)", says, m.Module, orNothing(quoted(contributes))))
+		case !oneOf(ownNameKeys(m, to), fact):
+			problems = append(problems, fmt.Sprintf("%s, and what %s is called through %s is %s (novox/hq ADR 0346)",
+				says, m.Module, to, strings.Join(ownNameKeys(m, to), ", ")))
+		}
+	}
+	return problems
+}
+
+func quoted(values []string) []string {
+	out := make([]string, len(values))
+	for i, v := range values {
+		out[i] = fmt.Sprintf("%q", v)
+	}
+	return out
+}
+
+// nestedOwnNames refuses a `${bound:…}` inside a served list or object: only a string value of its own is
+// filled (ServedOwnNames), so a nested one would reach the consumer as the placeholder (ADR 0346 §5).
+func nestedOwnNames(m Manifest, provision, key string, value any) []string {
+	var found []string
+	var walk func(v any)
+	walk = func(v any) {
+		switch x := v.(type) {
+		case string:
+			found = append(found, bound.FindAllString(x, -1)...)
+		case []any:
+			for _, e := range x {
+				walk(e)
+			}
+		case map[string]any:
+			for _, k := range sortedAnyKeys(x) {
+				walk(x[k])
+			}
+		}
+	}
+	walk(value)
+	if len(found) == 0 {
+		return nil
+	}
+	return []string{fmt.Sprintf(
+		"%s serves %s, and the value it serves as %q holds %s inside a list or an object: a provider's own "+
+			"name is filled only in a string value of its own (novox/hq ADR 0346)",
+		m.Module, provision, key, strings.Join(found, ", "))}
+}

internal/catalogue/served_own_names_test.go

@@ -0,0 +1,168 @@
+package catalogue
+
+import (
+	"strings"
+	"testing"
+)
+
+// novox/hq ADR 0346, issue 624: the forge's package registry writes every tarball at its public name,
+// and the lab, its consumer, must trust that name and no other. The name is the mesh's own composition
+// of the forge's route, which the forge's files read as ${bound:route:name-web}; a consumer can now be
+// served it.
+
+const aRegistryForge = `{"module":"forge","version":"1","requires":["route"],
+  "provides":[{"name":"npm-package-registry","scope":"mesh"}],
+  "contributes":{"route":{"web":{"label":"git","port":3000}}},
+  "serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
+    "public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`
+
+func aForgeManifest(t *testing.T) Manifest {
+	t.Helper()
+	m, err := ParseManifest([]byte(aRegistryForge))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func TestAProviderServesItsOwnComposedName(t *testing.T) {
+	m := aForgeManifest(t)
+	r := Resolution{Node: "home", PublicDomain: "example.org"}
+	got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["public-root"] != "https://git.example.org/api/packages/novox/npm/" || len(said) != 0 {
+		t.Fatalf("the public root is the route's composed name: %v, said %v", got, said)
+	}
+	if got["npm-path"] != "/api/packages/novox/npm/" || got["port"] != float64(3000) {
+		t.Fatalf("the rest is served as it was: %v", got)
+	}
+	if m.Serves["npm-package-registry"]["public-root"] != "https://${bound:route:name-web}/api/packages/novox/npm/" {
+		t.Fatal("the manifest's own map was rewritten")
+	}
+}
+
+func TestANameTheMachineDoesNotComposeLeavesTheKeyOutAndSaysSo(t *testing.T) {
+	m := aForgeManifest(t)
+	r := Resolution{Node: "home"} // no public domain
+	got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, there := got["public-root"]; there {
+		t.Fatalf("a name not composed is left out, never written as the placeholder or empty: %v", got)
+	}
+	if got["npm-path"] == nil {
+		t.Fatalf("only the key that names it is left out: %v", got)
+	}
+	if len(said) != 1 || !strings.Contains(said[0], `forge serves npm-package-registry without "public-root"`) ||
+		!strings.Contains(said[0], "home composes no such name") {
+		t.Fatalf("said: %v", said)
+	}
+	if lines := (Resolution{Node: "home", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 1 {
+		t.Fatalf("the plan on the provider's machine says it: %v", lines)
+	}
+	if lines := (Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 0 {
+		t.Fatalf("nothing to say when the name is composed: %v", lines)
+	}
+}
+
+// On the provider's own machine the consumer is served the same name (ADR 0346 §2).
+func TestAConsumerBesideTheProviderIsServedItsName(t *testing.T) {
+	m := aForgeManifest(t)
+	consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
+		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
+	node := workstation()
+	node.PublicDomain = "example.org"
+	got, err := Resolve(shelf(minimalRouteProxy(), m, consumer), []string{"route-proxy", "forge", "lab"}, node, World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	served, answered, err := got.servedOnThisMachine("npm-package-registry", Rendering{})
+	if err != nil || !answered {
+		t.Fatalf("answered %v: %v", answered, err)
+	}
+	if served["public-root"] != "https://git.example.org/api/packages/novox/npm/" {
+		t.Fatalf("served beside the provider: %v", served)
+	}
+	out, err := got.Declaration(Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var binding string
+	for _, r := range out {
+		if r["path"] == "/var/lib/lab/package-registry.json" {
+			binding, _ = r["content"].(string)
+		}
+	}
+	if !strings.Contains(binding, `"public-root": "https://git.example.org/api/packages/novox/npm/"`) &&
+		!strings.Contains(binding, `"public-root":"https://git.example.org/api/packages/novox/npm/"`) {
+		t.Fatalf("the consumer's binding carries the name:\n%s", binding)
+	}
+	if strings.Contains(binding, "${bound:") {
+		t.Fatalf("a placeholder reached the consumer:\n%s", binding)
+	}
+}
+
+// From another machine, the provider's served values carry what that machine composed, and a key it
+// left out is said on the consumer's need (ADR 0346 §2, §3).
+func TestAConsumerElsewhereIsToldWhatTheProviderLeftOut(t *testing.T) {
+	consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
+		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
+	node := workstation()
+	node.At = "workstation.internal"
+	world := World{Offered: map[string][]Provider{"npm-package-registry": {{Node: "home", At: "home.internal",
+		Module: "forge", Serves: map[string]any{"port": 3000},
+		LeftOut: []string{`forge serves npm-package-registry without "public-root"`}}}}}
+	got, err := Resolve(shelf(aForgeManifest(t), consumer), []string{"lab"}, node, world)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "npm-package-registry" {
+			if len(n.LeftOut) != 1 {
+				t.Fatalf("the need carries what was left out: %+v", n)
+			}
+			return
+		}
+	}
+	t.Fatalf("no need: %+v", got.Needs)
+}
+
+func TestAServedNameIsCheckedWhenTheDefinitionIsRead(t *testing.T) {
+	for bad, want := range map[string]string{
+		`"public-root":"https://${bound:route:name-api}/x"`:           "what forge is called through route is name, internal-name, name-web, internal-name-web",
+		`"public-root":"https://${bound:postgres-database:name}/x"`:   `forge contributes to "route"`,
+		`"public-root":"https://${bound:route:name-web|default:x}/x"`: "takes no default",
+		`"public-root":"https://${bound:route:at}/x"`:                 "what forge is called through route",
+	} {
+		raw := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`, bad, 1)
+		_, err := ParseManifest([]byte(raw))
+		if err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: want a refusal saying %q, got %v", bad, want, err)
+		}
+	}
+	nested := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`,
+		`"roots":["https://${bound:route:name-web}/x"]`, 1)
+	if _, err := ParseManifest([]byte(nested)); err == nil || !strings.Contains(err.Error(), "inside a list or an object") {
+		t.Errorf("a nested own name is refused, not served as the placeholder: %v", err)
+	}
+	if _, err := ParseManifest([]byte(aRegistryForge)); err != nil {
+		t.Fatalf("its own name is accepted: %v", err)
+	}
+}
+
+// The provider's contributions file carries no own name on a consumer's entry (ADR 0346 §4): only what
+// is derived for that consumer is there (ADR 0202 §5), and the provider reads its own names in its files.
+func TestAProvidersOwnNameIsNotOnItsConsumersEntry(t *testing.T) {
+	m := aForgeManifest(t)
+	r := Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}
+	derived, err := r.derivedFor("npm-package-registry", "lab_home", "lab", "", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if derived != nil {
+		t.Fatalf("a consumer's entry carries only what was derived for it: %v", derived)
+	}
+}

internal/catalogue/settings.go

@@ -192,6 +192,16 @@ func settle(base map[string]any, layers []Layer, protected map[string]bool, what
 					"%s sets %q on %v, and that module keeps %q for itself — it is not settable",
 					layer.From, key, what, key)
 			}
+			// **No layer replaces a secret the vault fills, at any depth** (novox/hq issue 610): a
+			// mergeable file's `${secret:<name>}` is the vault's value, and a layer that reached it —
+			// `server.secret_key` under a `server` the file takes — would put a value the operator or an
+			// agent chose where the vault's belongs. Judged against the file's own content, so it holds
+			// whatever a module's `protected` list says.
+			if at := secretReplacedBy(base[key], value, key); at != "" {
+				return nil, fmt.Errorf(
+					"%s sets %q on %v, which the vault fills (${secret:…}); a secret comes from the vault, "+
+						"never from a setting (novox/hq issues 342, 610)", layer.From, at, what)
+			}
 			merged[key] = mergeValue(merged[key], value)
 		}
 	}
@@ -576,3 +586,54 @@ func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
 	}
 	return nil
 }
+
+// secretReplacedBy is the path in a mergeable file's own content that a layer's value would replace while the
+// vault fills it — a string holding `${secret:` — or "" when the value leaves every such string as it is
+// (novox/hq issue 610). Maps merge key by key (mergeValue), so only the keys the value names are judged; any
+// other value replaces the whole of what it lands on.
+func secretReplacedBy(base, value any, at string) string {
+	if baseMap, isMap := base.(map[string]any); isMap {
+		if valueMap, also := value.(map[string]any); also {
+			keys := make([]string, 0, len(valueMap))
+			for k := range valueMap {
+				keys = append(keys, k)
+			}
+			sort.Strings(keys)
+			for _, k := range keys {
+				if found := secretReplacedBy(baseMap[k], valueMap[k], at+"."+k); found != "" {
+					return found
+				}
+			}
+			return ""
+		}
+	}
+	return secretIn(base, at)
+}
+
+// secretIn is the first path under v holding a vault placeholder, or "".
+func secretIn(v any, at string) string {
+	switch t := v.(type) {
+	case string:
+		if strings.Contains(t, "${secret:") {
+			return at
+		}
+	case map[string]any:
+		keys := make([]string, 0, len(t))
+		for k := range t {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, k := range keys {
+			if found := secretIn(t[k], at+"."+k); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for i, item := range t {
+			if found := secretIn(item, fmt.Sprintf("%s[%d]", at, i)); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}

internal/catalogue/settings_test.go

@@ -234,3 +234,29 @@ func TestAServedValueMayBeTheOperators(t *testing.T) {
 		t.Errorf("a setting a served fact asks for is not stray: %v", unused)
 	}
 }
+
+// No layer replaces a value the vault fills, at any depth (novox/hq issue 610): searxng's server.secret_key
+// sits under `server`, a key its file takes, and a layer reaching it was let through by a top-level-only check.
+func TestNoLayerReplacesAVaultSecretAtAnyDepth(t *testing.T) {
+	file := map[string]any{"id": "settings", "type": "file", "merge": MergeJSON,
+		"content": `{"server": {"secret_key": "${secret:secret}", "port": 8080}, "ui": {"theme": "simple"}, "token": "${secret:token}"}`}
+	layer := func(values map[string]any) []Layer { return []Layer{{From: "anchor", Values: values}} }
+
+	merged, err := ApplySettings(file, layer(map[string]any{"server": map[string]any{"port": float64(9000)}, "ui": map[string]any{"theme": "dark"}}))
+	if err != nil {
+		t.Fatalf("a key beside the secret was refused: %v", err)
+	}
+	if c := merged["content"].(string); !strings.Contains(c, `"secret_key": "${secret:secret}"`) || !strings.Contains(c, `"port": 9000`) {
+		t.Fatalf("the secret or the setting did not land as meant:\n%s", c)
+	}
+	for name, values := range map[string]map[string]any{
+		"the nested secret":        {"server": map[string]any{"secret_key": "chosen"}},
+		"the whole map holding it": {"server": "elsewhere"},
+		"a top-level secret":       {"token": "chosen"},
+		"the secret, emptied":      {"server": map[string]any{"secret_key": ""}},
+	} {
+		if _, err := ApplySettings(file, layer(values)); err == nil || !strings.Contains(err.Error(), "vault") {
+			t.Errorf("%s: %v, want a refusal naming the vault", name, err)
+		}
+	}
+}

internal/catalogue/verbs.go

@@ -217,14 +217,16 @@ var ControllerVerbs = []Verb{
 		Input: schema(map[string]string{"node": "the machine's name", "provision": "the provision"}, []string{"node", "provision"})},
 	{Name: "push", Description: "Send one machine everything it should be. With no machine named it is a push of the " +
 		"WHOLE mesh — every machine that is behind — and the answer says so first; behind says that outright. " +
-		"Answers at once that it is running, with a call id: `calls` with that id says what it sent " +
-		"(a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
+		"Answers at once that it is running, with a call id: `calls` with that id says what it sent and, for a " +
+		"machine named, how that machine applied it — applied, refused with its reason, or each failed resource — " +
+		"once it reports within wait (a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
 		"and says why: recorded in the hand-act log (novox/hq to-be 45 §7). A machine whose push would give a " +
 		"running module's data another directory is held and named, the others sent (novox/hq ADR 0217): read " +
 		"`plan` with diff, and name the machine with move to send it.",
 		Input: schema(map[string]string{
 			"node":   "the machine's name; without it, every machine that is behind",
 			"move":   "with node: the modules whose data may move with this push, comma-separated (optional)",
+			"wait":   "with node: how long the call waits for the machine to report how it applied what it was sent, as \"90s\" or \"2m\"; \"0\" waits for nothing; without it, the controller's setting push-wait (optional)",
 			"behind": "\"true\": every machine that is behind, the whole mesh — the same as naming none, said outright; not with node",
 			"why":    "why this is pushed by hand: recorded in the hand-act log",
 			"cause":  "the cause in a word, or a condition's kind — the word a second push for the same reason uses (optional)",

internal/inventory/dependencies.go

@@ -58,7 +58,42 @@ func (i *Inventory) Dependencies(ctx context.Context) ([]Edge, error) {
 	if err != nil {
 		return nil, err
 	}
-	return dependenciesOf(entries, against, nil), nil
+	held, err := i.Held(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return dependenciesWith(entries, against, held), nil
+}
+
+// packagesHeld is, by package name, the module whose artifact the mesh holds as that package: a
+// `package` artifact's reference is `<name>@<version>` (the builder's publishPackage), never an
+// artifact-store reference, so a build that stood on it recorded the package's name and version.
+func packagesHeld(held map[string]string) map[string]string {
+	out := map[string]string{}
+	for key, reference := range held {
+		module, _, ok := strings.Cut(key, "/")
+		if !ok {
+			continue
+		}
+		if name := packageName(reference); name != "" {
+			out[name] = module
+		}
+	}
+	return out
+}
+
+// packageName is the name of a `<name>@<version>` package reference, or "" for anything else: a
+// kept or pinned image (`…@sha256:…`), a URL, or a reference with no version.
+func packageName(reference string) string {
+	if strings.HasPrefix(reference, catalogue.ArtifactStoreScheme) || strings.Contains(reference, "@sha256:") ||
+		strings.Contains(reference, "://") {
+		return ""
+	}
+	at := strings.LastIndex(reference, "@")
+	if at <= 0 || at == len(reference)-1 {
+		return ""
+	}
+	return reference[:at]
 }
 
 // dependenciesOf is Dependencies over what was read, so a test can hand it a catalogue.
@@ -66,6 +101,20 @@ func (i *Inventory) Dependencies(ctx context.Context) ([]Edge, error) {
 // `read` draws no edge (novox/hq ADR 0267 rule 4): what a build read moves it through its build source, in
 // the planner, never through the relation.
 func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][]ReadRepository) []Edge {
+	return dependenciesWith(entries, against, nil)
+}
+
+// dependenciesWith is the relation with the artifacts the mesh holds, "<module>/<artifact>" to its
+// reference (Held), so a package a build stood on is read as its module's.
+//
+// **A built manifest carries no `build`** (catalogue.Resolve drops it), so what a module declared it
+// is built on is read from what is kept of it once it is built (novox/hq issue 614): the bases its
+// newest build was handed (`against`) — an artifact-store reference, or a package's `<name>@<version>`
+// — and the language of every bundle it compiled (`Bundles`). Read only from records the mesh already
+// keeps, so it holds for every module built before it, and a controller rolled back to one without it
+// reads the same records as before.
+func dependenciesWith(entries []Entry, against map[string][]string, held map[string]string) []Edge {
+	packages := packagesHeld(held)
 	known := map[string]bool{}
 	var builders []string
 	for _, e := range entries {
@@ -111,6 +160,13 @@ func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][
 				}
 			}
 		}
+		// **And once it is built**, from the bundles its resolved manifest keeps (novox/hq issue 614): the
+		// `build` it was declared with is gone by then, and a toolchain that moved rebuilt none of them.
+		for _, b := range e.Manifest.Bundles {
+			if chain, err := builder.ToolchainFor(b.Language); err == nil {
+				add(name, chain.Base, EdgeStandsOn)
+			}
+		}
 		for _, ref := range against[name] {
 			if rest, ok := strings.CutPrefix(ref, catalogue.ArtifactStoreScheme); ok {
 				// A copy of an upstream image is no module's artifact (novox/hq ADR 0257): its
@@ -121,6 +177,13 @@ func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][
 				if base, _, found := strings.Cut(rest, "/"); found {
 					add(name, base, EdgeStandsOn)
 				}
+				continue
+			}
+			// A package base (`build.on` naming a module's `package` artifact) is recorded as the
+			// package's name and version (novox/hq issue 614): the module that publishes that package
+			// is what it stood on, whichever version the mesh holds now.
+			if base, ok := packages[packageName(ref)]; ok {
+				add(name, base, EdgeStandsOn)
 			}
 		}
 		if e.Source.Repository != "" {

internal/inventory/dependencies_test.go

@@ -1,6 +1,7 @@
 package inventory
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -174,3 +175,74 @@ func TestACopyOfAnUpstreamImageIsNoEdge(t *testing.T) {
 		}
 	}
 }
+
+// **A built module keeps its build edges** (novox/hq issue 614). A manifest the mesh registers from a
+// build carries no `build` (catalogue.Resolve drops it), so mesh-tools' `build.on` naming mesh-sdk's
+// `lib` package and a provider's TypeScript bundle drew no edge once built, and a new SDK rebuilt
+// neither. The package base is read from what the build was handed (`@novox/mesh-sdk@0.1.13`, the
+// package's name whichever version the mesh holds now), the toolchain from the bundles it keeps.
+func TestABuiltModuleKeepsItsBuildEdges(t *testing.T) {
+	built := func(name string, bundles ...catalogue.Bundle) Entry {
+		return Entry{Manifest: catalogue.Manifest{Module: name, Bundles: bundles},
+			Source: Source{Repository: "http://forge/novox/" + name + ".git"}}
+	}
+	entries := []Entry{
+		built("mesh-sdk"),
+		built("mesh-tools"),
+		built("mesh-tools-go"),
+		built("minio", catalogue.Bundle{Name: "code", Language: "typescript"}),
+		built("umami", catalogue.Bundle{Name: "code", Language: "TypeScript"}),
+		built("dnsmasq", catalogue.Bundle{Name: "tools", Language: "go"}),
+		built("plain"),
+	}
+	against := map[string][]string{
+		"mesh-tools": {"@novox/mesh-sdk@0.1.13",
+			catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node@sha256:" + strings.Repeat("0", 64)},
+		// A package nobody in the mesh publishes is no edge.
+		"plain": {"left-pad@1.3.0"},
+	}
+	held := map[string]string{
+		"mesh-sdk/lib":       "@novox/mesh-sdk@0.1.14",
+		"mesh-tools/runtime": catalogue.ArtifactStoreScheme + "mesh-tools/runtime@sha256:" + strings.Repeat("1", 64),
+	}
+	got := dependenciesWith(entries, against, held)
+	has := func(from, to string) bool {
+		for _, e := range got {
+			if e.From == from && e.To == to && e.Kind == EdgeStandsOn {
+				return true
+			}
+		}
+		return false
+	}
+	for _, want := range [][2]string{
+		{"mesh-tools", "mesh-sdk"},
+		{"minio", "mesh-tools"},
+		{"umami", "mesh-tools"},
+		{"dnsmasq", "mesh-tools-go"},
+	} {
+		if !has(want[0], want[1]) {
+			t.Errorf("no %s stands-on %s: %+v", want[0], want[1], got)
+		}
+	}
+	for _, e := range got {
+		if e.From == "plain" && e.Kind != EdgeBuiltBy {
+			t.Errorf("an unknown package drew an edge: %+v", e)
+		}
+	}
+}
+
+func TestAPackageNameIsReadOnlyFromAPackageReference(t *testing.T) {
+	for ref, want := range map[string]string{
+		"@novox/mesh-sdk@0.1.14": "@novox/mesh-sdk",
+		"left-pad@1.3.0":         "left-pad",
+		"@novox/mesh-sdk":        "",
+		"novox.internal:5100/mesh-tools/build@sha256:" + strings.Repeat("0", 64): "",
+		catalogue.ArtifactStoreScheme + "mesh-tools/build@sha256:0":              "",
+		"http://store/v2/x/blobs/sha256:0":                                       "",
+		"":                                                                       "",
+	} {
+		if got := packageName(ref); got != want {
+			t.Errorf("packageName(%q) = %q, want %q", ref, got, want)
+		}
+	}
+}

internal/inventory/health.go

@@ -44,7 +44,13 @@ type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	What    string `json:"what"`
+	// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
+	// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
+	Provision string `json:"provision,omitempty"`
+	What      string `json:"what"`
+	// Act is the line that gives a provision's credential, filled by the controller when it excuses the wait
+	// (ADR 0337 §7); never said by a machine.
+	Act string `json:"act,omitempty"`
 }
 
 // NodeHealth is a machine's newest statement, as kept.

internal/inventory/machine.go

@@ -36,7 +36,16 @@ type MadeOf struct {
 	BootedAt      *time.Time          `json:"booted_at"`
 	Timezone      string              `json:"timezone"`
 	Filesystems   []MountedFilesystem `json:"filesystems"`
-	Unknown       map[string]string   `json:"unknown"`
+	// Networks is every network the machine is directly attached to on a link facing outside it, as
+	// link and network (novox/hq ADR 0340 §7): what a port reached from `local-network` resolves from.
+	Networks []AttachedNetwork `json:"networks"`
+	Unknown  map[string]string `json:"unknown"`
+}
+
+// AttachedNetwork is one network a machine said it is attached to, and the link it is on.
+type AttachedNetwork struct {
+	Link    string `json:"link"`
+	Network string `json:"network"`
 }
 
 // MountedFilesystem is one local filesystem a machine has mounted.

internal/inventory/machine_test.go

@@ -40,3 +40,18 @@ func TestAProfileWithoutTheFactsIsAnOlderNodeEngineNotNothing(t *testing.T) {
 		t.Error("a node that never reported read as having reported")
 	}
 }
+
+// The networks a machine is attached to (novox/hq ADR 0340 §7), in the node-engine's words: what a port
+// reached from `local-network` resolves from.
+func TestAMachinesAttachedNetworksAreRead(t *testing.T) {
+	a, had, err := machineFrom([]byte(`{"architecture":"amd64","kernel":"linux",
+		"machine":{"observed_at":"2026-10-13T09:00:00Z",
+		"networks":[{"link":"eth0","network":"192.168.1.0/24"},{"link":"eth1","network":"203.0.113.0/24"}]}}`))
+	if err != nil || !had || a.Machine == nil {
+		t.Fatalf("%+v had %v err %v", a, had, err)
+	}
+	n := a.Machine.Networks
+	if len(n) != 2 || n[0].Link != "eth0" || n[0].Network != "192.168.1.0/24" || n[1].Network != "203.0.113.0/24" {
+		t.Fatalf("networks read as %+v", n)
+	}
+}

internal/inventory/outside.go

@@ -0,0 +1,252 @@
+package inventory
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/secrets"
+)
+
+// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164): a Servarr
+// app's API key, an indexer's key, a downloader's password. The provider's software holds the value; the mesh can
+// neither make one that would work nor fetch it. So the mesh never makes one (§2), a person gives it once per
+// provider and it is sealed to every consumer of that provider (§3), and until then a consumer holds no credential
+// for it and is told so (§4), and the rest of it runs.
+
+// NotGivenError is a pair credential only a person can give, which no person gave for this pair under the keys its
+// two ends have now: the consumer receives no credential for it, and waits (ADR 0337 §4, §8). It is not a fault of
+// the machine, so the plan does not refuse the machine for it.
+type NotGivenError struct {
+	Provision, Consumer, ConsumerModule, Provider, ProviderModule, Local string
+	// Own is set when the credential is the provider's own secret issued outside (ADR 0158, ADR 0228), and names it.
+	Own string
+	// Why is why no value is held, in words that never carry one.
+	Why string
+}
+
+func (e *NotGivenError) Error() string {
+	if e.Own != "" {
+		return fmt.Sprintf("%s on %s holds no %s from %s: %s; give it with `secret accept %s %s %s`",
+			e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, e.Provider, e.ProviderModule, e.Own)
+	}
+	return fmt.Sprintf("%s on %s holds no %s from %s: %s; it is issued outside the mesh and given with `%s`",
+		e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, acceptLine(e.Provider, e.ProviderModule, e.Provision))
+}
+
+// IsNotGiven is whether an error is a credential only a person gives, not given yet.
+func IsNotGiven(err error) bool {
+	var ng *NotGivenError
+	return errors.As(err, &ng)
+}
+
+// acceptLine is the one line that gives a provision's credential issued outside, for every consumer of a provider.
+func acceptLine(provider, providerModule, provision string) string {
+	if providerModule == "" {
+		providerModule = "<provider module>"
+	}
+	return fmt.Sprintf("secret accept %s %s %s", provider, providerModule, provision)
+}
+
+// AcceptLine is acceptLine, for the controller's words.
+func AcceptLine(provider, providerModule, provision string) string {
+	return acceptLine(provider, providerModule, provision)
+}
+
+// issuedOutside is whether a module in the catalogue offers the provision with a credential issued outside the
+// mesh, and which.
+func (i *Inventory) issuedOutside(ctx context.Context, provision string) (string, bool, error) {
+	shelf, err := i.Catalogue(ctx)
+	if err != nil {
+		return "", false, err
+	}
+	module, outside := catalogue.OffersIssuedOutside(shelf, provision)
+	return module, outside, nil
+}
+
+// ownIssuedOutside is whether a provider's own secret says only an outside party issues it (ADR 0228).
+func (i *Inventory) ownIssuedOutside(ctx context.Context, providerModule, own string) (string, bool, error) {
+	if providerModule == "" {
+		return own, false, nil
+	}
+	m, err := i.declared(ctx, providerModule)
+	if err != nil {
+		return own, false, err
+	}
+	return own, m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside, nil
+}
+
+// GivenPairSecret is the credential of a pair whose provision is issued outside the mesh, as a person gave it, and
+// never one the mesh makes (ADR 0337 §2, §4). It writes nothing. A value is answered only when a person gave it
+// (`accepted`) and it is sealed to the keys both ends have now; otherwise a NotGivenError says why — never given, or
+// given under a key one end no longer has (§8), or a value the mesh made before the rule, which is not given and
+// never delivered again (§2).
+func (i *Inventory) GivenPairSecret(ctx context.Context, name, consumer, consumerModule, provider, providerModule,
+	local string) (Secret, error) {
+	consumerKey, err := i.SealingKeyOf(ctx, consumer)
+	if err != nil {
+		return Secret{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, provider)
+	if err != nil {
+		return Secret{}, err
+	}
+	consumerNode, err := i.NodeByName(ctx, consumer)
+	if err != nil {
+		return Secret{}, err
+	}
+	providerNode, err := i.NodeByName(ctx, provider)
+	if err != nil {
+		return Secret{}, err
+	}
+	notGiven := func(why string) (Secret, error) {
+		return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
+	}
+	var held Secret
+	err = i.store.Pool().QueryRow(ctx,
+		`select for_consumer, for_provider, consumer_key, provider_key, origin from secret
+		 where name = $1 and consumer = $2 and consumer_module = $3 and provider = $4 and local = $5`,
+		name, consumerNode.ID, consumerModule, providerNode.ID, local).
+		Scan(&held.ForConsumer, &held.ForProvider, &held.ConsumerKey, &held.ProviderKey, &held.Origin)
+	switch {
+	case errors.Is(err, pgx.ErrNoRows):
+		return notGiven("nobody gave it")
+	case err != nil:
+		return Secret{}, err
+	case held.Origin != OriginAccepted:
+		return notGiven("the value held was made by the mesh, which " + providerModule + "'s software would refuse")
+	case consumerKey == "" || providerKey == "" || held.ConsumerKey != consumerKey || held.ProviderKey != providerKey:
+		return notGiven("it was given under a sealing key one end no longer has")
+	}
+	held.Name, held.Consumer, held.Provider = name, consumer, provider
+	held.ConsumerModule, held.Local = consumerModule, local
+	return held, nil
+}
+
+// PairEnd is one consumer of a provision from one provider: the machine, the module there and its local name.
+type PairEnd struct {
+	Consumer, ConsumerModule, Local string
+}
+
+// ProvisionAccepted is what one accept for a provider sealed (ADR 0337 §3): the consumers it reached, those it could
+// not (no sealing key on their machine), and the machines to send.
+type ProvisionAccepted struct {
+	Sealed, Unsealable []PairEnd
+	Machines           []string
+}
+
+// AcceptSecretForProvision seals one value a person gave for a provision issued outside the mesh to the provider's
+// machine, to every consumer named, and to the operator, in one act under one generation, each row `accepted`
+// (ADR 0337 §3, issue 165); the plaintext is not kept. The consumers are every one that binds the provision from
+// this provider now, which the caller finds by resolving every machine. A consumer whose machine has no sealing key
+// is not sealed to, and said.
+func (i *Inventory) AcceptSecretForProvision(ctx context.Context, provision, provider, providerModule, value string,
+	consumers []PairEnd) (ProvisionAccepted, error) {
+	m, err := i.declared(ctx, providerModule)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	if !m.IssuedOutsideOf(provision) {
+		return ProvisionAccepted{}, fmt.Errorf("%s does not offer %q with a credential issued outside the mesh "+
+			"(\"credential\": {\"issued-by\": \"outside\"}, ADR 0337), so its consumers' credentials are not given "+
+			"once for the provider", providerModule, provision)
+	}
+	if value == "" {
+		return ProvisionAccepted{}, errors.New("there is nothing to seal")
+	}
+	providerNode, err := i.NodeByName(ctx, provider)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	providerKey, err := i.SealingKeyOf(ctx, provider)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	if providerKey == "" {
+		return ProvisionAccepted{}, fmt.Errorf("%s has no sealing key, so nothing can be sealed to it; a node joins to get one", provider)
+	}
+	forOperator, operatorKey, err := i.operatorSeal(ctx, value)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	generation := secrets.Stamp()
+	var out ProvisionAccepted
+	machines := map[string]bool{provider: true}
+	tx, err := i.store.Pool().Begin(ctx)
+	if err != nil {
+		return ProvisionAccepted{}, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for _, c := range consumers {
+		consumerNode, err := i.NodeByName(ctx, c.Consumer)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		consumerKey, err := i.SealingKeyOf(ctx, c.Consumer)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		if consumerKey == "" {
+			out.Unsealable = append(out.Unsealable, c)
+			continue
+		}
+		sealed, err := secrets.Accept(value, consumerKey, providerKey)
+		if err != nil {
+			return ProvisionAccepted{}, err
+		}
+		if _, err := tx.Exec(ctx,
+			`insert into secret (name, consumer, consumer_module, provider, for_consumer, for_provider,
+			                     consumer_key, provider_key, operator_sealed, operator_key, origin, local, generation)
+			 values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+			 on conflict (name, local, consumer, consumer_module, provider) do update set
+			   for_consumer = excluded.for_consumer, for_provider = excluded.for_provider,
+			   consumer_key = excluded.consumer_key, provider_key = excluded.provider_key,
+			   created_at = now(), origin = excluded.origin, generation = excluded.generation,
+			   operator_sealed = excluded.operator_sealed, operator_key = excluded.operator_key`,
+			provision, consumerNode.ID, c.ConsumerModule, providerNode.ID,
+			sealed.ForConsumer, sealed.ForProvider, sealed.ConsumerKey, sealed.ProviderKey,
+			forOperator, operatorKey, OriginAccepted, c.Local, generation); err != nil {
+			return ProvisionAccepted{}, err
+		}
+		out.Sealed = append(out.Sealed, c)
+		machines[c.Consumer] = true
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return ProvisionAccepted{}, err
+	}
+	for n := range machines {
+		out.Machines = append(out.Machines, n)
+	}
+	sort.Strings(out.Machines)
+	return out, nil
+}
+
+// GivenPairsOf is every provision a module on a machine holds a value a person gave for, sealed to the keys both
+// ends have now: what a wait for a provision's credential is checked against (ADR 0337 §6).
+func (i *Inventory) GivenPairsOf(ctx context.Context, machine, module string) (map[string]bool, error) {
+	rows, err := i.store.Pool().Query(ctx,
+		`select s.name
+		   from secret s
+		   join node c on c.id = s.consumer
+		   join node p on p.id = s.provider
+		  where c.name = $1 and s.consumer_module = $2 and s.origin = 'accepted'
+		    and s.consumer_key = c.sealing_key and s.provider_key = p.sealing_key`, machine, module)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]bool{}
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, err
+		}
+		out[name] = true
+	}
+	return out, rows.Err()
+}

internal/inventory/outside_test.go

@@ -0,0 +1,195 @@
+package inventory
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// outsideProvision registers a provider offering tv-api with a credential issued outside the mesh (novox/hq ADR
+// 0337 §1) and two consumers requiring it, on twoNodesWithKeys' machines.
+func outsideProvision(t *testing.T, inv *Inventory) {
+	t.Helper()
+	ctx := t.Context()
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "tv", Version: "1",
+		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []string{"requests", "indexer"} {
+		if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
+			Secrets: map[string]string{"tv-api": "/run/tv-api.secret"}}, Source{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// pairRows is how many pair rows the store holds for tv-api.
+func pairRows(t *testing.T, inv *Inventory) int {
+	t.Helper()
+	var n int
+	if err := inv.store.Pool().QueryRow(t.Context(), `select count(*) from secret where name = 'tv-api'`).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+// A credential only a person can give is never made (ADR 0337 §2, issue 164): not for a pair with no row, which is
+// what a newly bound consumer has, and not after a key change; a value the mesh made before the rule is not given.
+func TestACredentialIssuedOutsideIsNeverMade(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	outsideProvision(t, inv)
+
+	_, err := inv.SecretFor(ctx, "tv-api", "consumer", "requests", "provider", "")
+	if !IsNotGiven(err) {
+		t.Fatalf("SecretFor made or refused a credential only a person gives, rather than saying it was not given: %v", err)
+	}
+	if !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
+		t.Fatalf("not given does not name the one line that gives it: %v", err)
+	}
+	if n := pairRows(t, inv); n != 0 {
+		t.Fatalf("the store holds %d rows for tv-api, which nobody gave", n)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) {
+		t.Fatalf("a pair nobody gave read as given: %v", err)
+	}
+	if n := pairRows(t, inv); n != 0 {
+		t.Fatalf("reading the pair wrote %d rows", n)
+	}
+
+	// A value the mesh made before the rule (the minted value of issue 164) is not given.
+	if _, err := inv.store.Pool().Exec(ctx, `insert into secret (name, consumer, consumer_module, provider,
+		for_consumer, for_provider, consumer_key, provider_key, local)
+		select 'tv-api', c.id, 'indexer', p.id, 'x', 'y', c.sealing_key, p.sealing_key, ''
+		  from node c, node p where c.name = 'consumer' and p.name = 'provider'`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "indexer", "provider", "tv", ""); !IsNotGiven(err) ||
+		!strings.Contains(err.Error(), "made by the mesh") {
+		t.Fatalf("a value the mesh made before the rule read as given: %v", err)
+	}
+
+	// Given, then a key changes: not given, and nothing is made in its place (ADR 0337 §8).
+	if _, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key",
+		[]PairEnd{{Consumer: "consumer", ConsumerModule: "requests"}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); err != nil {
+		t.Fatalf("the value given does not read as given: %v", err)
+	}
+	cn, _ := inv.NodeByName(ctx, "consumer")
+	key, _ := aSealingKey(t)
+	if err := inv.RecordSealingKey(ctx, cn.ID, key); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) ||
+		!strings.Contains(err.Error(), "sealing key") {
+		t.Fatalf("a value given under a key the consumer no longer has read as given: %v", err)
+	}
+	var origin string
+	if err := inv.store.Pool().QueryRow(ctx, `select origin from secret where name = 'tv-api' and consumer_module = 'requests'`).
+		Scan(&origin); err != nil || origin != OriginAccepted {
+		t.Fatalf("the given row was replaced (origin %q, %v)", origin, err)
+	}
+
+	// Rotate refuses it, naming the accept (ADR 0337 §9).
+	err = inv.RotateSecret(ctx, "tv-api", "consumer", "requests", "provider", "")
+	if err == nil || !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
+		t.Fatalf("rotate of a credential issued outside was not refused naming the accept: %v", err)
+	}
+}
+
+// One accept for a provider is sealed to every consumer named, to the provider and to the operator, under one
+// generation, each row accepted (ADR 0337 §3, issue 165); a consumer with no sealing key is said, not sealed to.
+func TestOneAcceptForAProviderIsSealedToEveryConsumer(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	outsideProvision(t, inv)
+	operatorKey, operatorOpens := aSealingKey(t)
+	if _, err := inv.SetOperatorKey(ctx, operatorKey); err != nil {
+		t.Fatal(err)
+	}
+	consumerKey, consumerOpens := aSealingKey(t)
+	cn, _ := inv.NodeByName(ctx, "consumer")
+	if err := inv.RecordSealingKey(ctx, cn.ID, consumerKey); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.AddNode(ctx, "keyless"); err != nil {
+		t.Fatal(err)
+	}
+
+	accepted, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key", []PairEnd{
+		{Consumer: "consumer", ConsumerModule: "requests"}, {Consumer: "consumer", ConsumerModule: "indexer"},
+		{Consumer: "keyless", ConsumerModule: "requests"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(accepted.Sealed) != 2 || len(accepted.Unsealable) != 1 || accepted.Unsealable[0].Consumer != "keyless" {
+		t.Fatalf("the accept did not seal to both consumers with keys and say the keyless one: %+v", accepted)
+	}
+	if strings.Join(accepted.Machines, ",") != "consumer,provider" {
+		t.Fatalf("the machines to send are the provider's and every consumer's sealed to: %v", accepted.Machines)
+	}
+	rows, err := inv.store.Pool().Query(ctx, `select consumer_module, origin, coalesce(generation, ''), for_consumer,
+		coalesce(operator_sealed, '') from secret where name = 'tv-api'`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	generations := map[string]bool{}
+	seen := 0
+	for rows.Next() {
+		var module, origin, generation, forConsumer, forOperator string
+		if err := rows.Scan(&module, &origin, &generation, &forConsumer, &forOperator); err != nil {
+			t.Fatal(err)
+		}
+		seen++
+		if origin != OriginAccepted || generation == "" {
+			t.Fatalf("%s's row is not accepted under a generation (origin %q)", module, origin)
+		}
+		generations[generation] = true
+		if opened, ok := consumerOpens(forConsumer); !ok || string(opened) != "the app's key" {
+			t.Fatalf("%s's copy does not open to the value given", module)
+		}
+		if opened, ok := operatorOpens(forOperator); !ok || string(opened) != "the app's key" {
+			t.Fatalf("%s's operator copy does not open to the value given", module)
+		}
+	}
+	if seen != 2 || len(generations) != 1 {
+		t.Fatalf("%d rows under %d generations; want 2 under one", seen, len(generations))
+	}
+	given, err := inv.GivenPairsOf(ctx, "consumer", "indexer")
+	if err != nil || !given["tv-api"] {
+		t.Fatalf("the provision given does not read as given for indexer (%v)", err)
+	}
+
+	// Only an offer that says so is given this way.
+	if _, err := inv.AcceptSecretForProvision(ctx, "secret", "provider", "gitea", "x", nil); err == nil {
+		t.Fatal("a provision not issued outside was given once for its provider")
+	}
+}
+
+// The provider's own secret issued outside the mesh, named as a provision's shared credential (ADR 0158, ADR 0228),
+// is never made for a consumer that binds: the consumer is told it was not given (ADR 0337 §2, §4).
+func TestASharedOwnSecretIssuedOutsideIsNeverMade(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "downloader", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"password": {Path: "/run/password", Taken: catalogue.TakenAtStart,
+			IssuedBy: catalogue.IssuedOutside}},
+		Provides: []catalogue.Offer{{Name: "downloader-api", Scope: catalogue.ScopeMesh,
+			Credential: &catalogue.OfferCredential{Own: "password"}}}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	_, err := inv.SharedSecretFor(ctx, "downloader-api", "consumer", "gitea", "provider", "downloader", "", "password")
+	if !IsNotGiven(err) {
+		t.Fatalf("a shared own secret issued outside was made or refused rather than not given: %v", err)
+	}
+	var n int
+	if err := inv.store.Pool().QueryRow(ctx, `select count(*) from module_secret where module = 'downloader'`).Scan(&n); err != nil || n != 0 {
+		t.Fatalf("the mesh made %d values of an own secret issued outside (%v)", n, err)
+	}
+	if err := inv.remakeShared(ctx, nil, "", "downloader", "password", "", nil, "", "", ""); err == nil ||
+		!strings.Contains(err.Error(), "issued outside") {
+		t.Fatalf("remakeShared made a value of an own secret issued outside: %v", err)
+	}
+}

internal/inventory/plans.go

@@ -433,6 +433,20 @@ type PlanRelease struct {
 	Skipped []string `json:"skipped,omitempty"`
 	// By is the person who released it, empty when the mesh did.
 	By string `json:"by,omitempty"`
+	// Settings is set on a settings walk (novox/hq ADR 0344): not the builds waiting for a gate, but a settings
+	// layer the operator approved, sent to the machines it reaches one at a time, its module judged on each.
+	Settings *PlanSettings `json:"settings,omitempty"`
+}
+
+// PlanSettings is what a settings walk sends (novox/hq ADR 0344): the module whose layer the operator approved, the
+// layer's scope, the ask that approved it and what changed, in words.
+type PlanSettings struct {
+	Module string `json:"module"`
+	// Node is the machine the layer is for, empty for the whole mesh.
+	Node string `json:"node,omitempty"`
+	// Ask is the proposal the operator approved, and Change what its layer changed ("~ prefs").
+	Ask    string `json:"ask"`
+	Change string `json:"change,omitempty"`
 }
 
 // The states a plan passes through.

internal/inventory/secrets.go

@@ -104,6 +104,21 @@ func (i *Inventory) SecretFor(ctx context.Context, name, consumer, consumerModul
 			consumerModule, name, provider, consumer, consumerModule, name, provider, localFlag(local))
 	}
 
+	// **Never made where only a person can give it** (novox/hq ADR 0337 §2, issue 164): a provision whose offer
+	// says `issued-by: outside` gets no value of the mesh's, which its provider's software would refuse. Asked
+	// here, on the one path that makes a value, so no caller can have one made by not knowing; the plan reads
+	// such a pair with GivenPairSecret, which never makes one and delivers only a value a person gave.
+	why := "nobody gave it"
+	if err == nil {
+		why = "the value held was sealed to a key one end no longer has"
+	}
+	if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
+		return Secret{}, oerr
+	} else if outside {
+		return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
+	}
+
 	// And to the operator, when the mesh has one (novox/hq ADR 0085, amended): the third copy that
 	// makes a vault-provided secret recoverable, and nothing the mesh can open.
 	operator, err := i.OperatorKey(ctx)
@@ -239,6 +254,16 @@ func (i *Inventory) RotateSecret(ctx context.Context, name, consumer, consumerMo
 		`select origin from secret where name = $1 and consumer = $2 and consumer_module = $3
 		   and provider = $4 and local = $5`,
 		name, consumerNode.ID, consumerModule, providerNode.ID, local).Scan(&origin)
+	if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
+		return oerr
+	} else if outside {
+		// Only a person can give it, so only a person can give its next value (novox/hq ADR 0337 §9, ADR 0092 §7):
+		// deleting the row would leave the consumer waiting for nothing new.
+		return fmt.Errorf(
+			"%s is issued outside the mesh: %s's software holds it and the mesh cannot make its replacement. "+
+				"Give the new value with `%s`, which seals it to every consumer of %s on %s",
+			name, providerModule, acceptLine(provider, providerModule, name), providerModule, provider)
+	}
 	if err == nil && origin == OriginAccepted {
 		return fmt.Errorf(
 			"%s's %q credential from %s was accepted from a person, and the mesh cannot make "+
@@ -886,6 +911,15 @@ func (i *Inventory) SharedSecretFor(ctx context.Context, provision, consumer, co
 		held.ConsumerModule, held.Local = consumerModule, local
 		return held, nil
 	}
+	if own, outside, err := i.ownIssuedOutside(ctx, providerModule, own); err != nil {
+		return Secret{}, err
+	} else if outside && (ownOrigin == nil || *ownOrigin != OriginAccepted) {
+		// The provider's own secret only an outside party issues, which nobody gave (ADR 0228, issue 401): the
+		// mesh makes no value for it here either, and the consumer is told it was not given (ADR 0337 §4).
+		return Secret{}, &NotGivenError{Provision: provision, Consumer: consumer, ConsumerModule: consumerModule,
+			Provider: provider, ProviderModule: providerModule, Local: local, Own: own,
+			Why: "nobody gave " + providerModule + "'s own secret " + own + ", which is issued outside the mesh"}
+	}
 	if ownOrigin != nil && *ownOrigin == OriginAccepted {
 		return Secret{}, fmt.Errorf(
 			"%s on %s needs %s from %s, whose credential is %s's own secret %q — a value given to the "+
@@ -912,6 +946,11 @@ func (i *Inventory) remakeShared(ctx context.Context, providerID any, providerKe
 	if len(provisions) == 0 {
 		return fmt.Errorf("%s names no provision whose credential is its own secret %q", providerModule, own)
 	}
+	if m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside {
+		// Never made (novox/hq ADR 0228, ADR 0337 §2): only a person can give it, with `secret accept`.
+		return fmt.Errorf("%s's own secret %q is issued outside the mesh, so the mesh makes no value for it; a "+
+			"person gives it with `secret accept <machine> %s %s`", providerModule, own, providerModule, own)
+	}
 	operator, err := i.OperatorKey(ctx)
 	if err != nil {
 		return err

internal/link/protocol.go

@@ -577,7 +577,10 @@ type Wait struct {
 	Part    string `json:"part"`
 	Secret  string `json:"secret,omitempty"`
 	Setting string `json:"setting,omitempty"`
-	What    string `json:"what"`
+	// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
+	// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
+	Provision string `json:"provision,omitempty"`
+	What      string `json:"what"`
 }
 
 // ResourceHealth is one long-running resource's state.

internal/outward/outward.go

@@ -80,6 +80,57 @@ func Check(text string, machines ...string) (Refusal, bool) {
 		return Refusal{"address", "a hardware address"}, false
 	case reIPv6.MatchString(text):
 		return Refusal{"address", "an IPv6 address"}, false
+	}
+	if refusal, ok := secretShape(text); !ok {
+		return refusal, false
+	}
+	if reWinPath.MatchString(text) {
+		return Refusal{"path", "a drive path"}, false
+	}
+	if refusal, ok := randomRun(text); !ok {
+		return refusal, false
+	}
+	for _, word := range strings.FieldsFunc(text, isSeparator) {
+		w := strings.TrimRight(word, ".:!?")
+		if isPath(w) {
+			return Refusal{"path", "a file path"}, false
+		}
+		if isHostName(w) {
+			return Refusal{"address", "a host name"}, false
+		}
+	}
+	return Refusal{}, true
+}
+
+// Secret says whether a text carries a secret's shape, the one class that leaves the mesh nowhere — the
+// messenger's CheckSecret, one for one. It is what an ask's whole words (asks.Ask.Whole, novox/hq issue 383)
+// are held to: on a channel that proves who answers, a path or an address is what the operator approves and
+// is shown; a secret never is. A path is read as one: a run with a slash in it is judged piece by piece
+// between the slashes, so "/mnt/Photos_2024/Jochen" is a path and not a random string (the review of
+// 2026-10-10); the named shapes hold whatever the run holds.
+func Secret(text string, machines ...string) (Refusal, bool) {
+	text = withoutMachines(text, machines)
+	if refusal, ok := secretShape(text); !ok {
+		return refusal, false
+	}
+	return randomRunOutsidePaths(text)
+}
+
+// randomRunOutsidePaths is randomRun with each run that holds a slash judged by its pieces between the slashes.
+func randomRunOutsidePaths(text string) (Refusal, bool) {
+	for _, run := range reRun.FindAllString(text, -1) {
+		for _, piece := range strings.Split(run, "/") {
+			if len(piece) >= 20 && looksRandom(piece) {
+				return Refusal{"secret", "a long random-looking string"}, false
+			}
+		}
+	}
+	return Refusal{}, true
+}
+
+// secretShape is the secret shapes a pattern names.
+func secretShape(text string) (Refusal, bool) {
+	switch {
 	case rePEM.MatchString(text):
 		return Refusal{"secret", "a key block"}, false
 	case reJWT.MatchString(text):
@@ -92,23 +143,17 @@ func Check(text string, machines ...string) (Refusal, bool) {
 		return Refusal{"secret", "a value given to a secret's name"}, false
 	case reHex.MatchString(text):
 		return Refusal{"secret", "a long hexadecimal string"}, false
-	case reWinPath.MatchString(text):
-		return Refusal{"path", "a drive path"}, false
 	}
+	return Refusal{}, true
+}
+
+// randomRun is a long unbroken run of characters spread as a random string's are.
+func randomRun(text string) (Refusal, bool) {
 	for _, run := range reRun.FindAllString(text, -1) {
 		if looksRandom(run) {
 			return Refusal{"secret", "a long random-looking string"}, false
 		}
 	}
-	for _, word := range strings.FieldsFunc(text, isSeparator) {
-		w := strings.TrimRight(word, ".:!?")
-		if isPath(w) {
-			return Refusal{"path", "a file path"}, false
-		}
-		if isHostName(w) {
-			return Refusal{"address", "a host name"}, false
-		}
-	}
 	return Refusal{}, true
 }
 

internal/outward/outward_test.go

@@ -86,3 +86,40 @@ func TestScrubAlwaysGivesWhatMayLeave(t *testing.T) {
 		t.Errorf("a text that passes was changed: %q", got)
 	}
 }
+
+// Secret is the one class that leaves the mesh nowhere (novox/hq issue 383): it refuses every secret's shape
+// Check refuses, and nothing Check refuses as an address or a path — those an ask's whole words may carry.
+func TestSecretRefusesOnlyASecretsShape(t *testing.T) {
+	for _, text := range []string{
+		"-----BEGIN RSA PRIVATE KEY-----",
+		"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc",
+		"123456789:ABCdefGHIjklMNOpqrSTUvwxYZ0123456789ab",
+		"ghp_abcdefghijklmnopqrstuvwxyz0123456789",
+		"password=hunter2",
+		"0123456789abcdef0123456789abcdef",
+		"a key xK9mQ2vL8pR4tW7yB3nF6hJ1dG5sA0zC",
+	} {
+		r, ok := Secret(text)
+		if ok || r.Class != "secret" {
+			t.Errorf("not refused as a secret: %q (%s)", text, r)
+		}
+	}
+	for _, text := range []string{
+		"recalbox=smb://nas.lan/recalbox@/mnt/recalbox:ro",
+		"library=/mnt/library",
+		"photos=/mnt/Photos_2024/Jochen",
+		"games=smb://nas.lan/Recalbox_Games2024",
+		"/srv/media/Series_Archive/Season01",
+		"10.77.0.9:53",
+		"jochen@example.com",
+		"C:\\Users\\jo",
+		"anchor and the laptop",
+	} {
+		if r, ok := Secret(text, "anchor"); !ok {
+			t.Errorf("refused as %s: %q", r, text)
+		}
+		if _, ok := Check(text, "anchor"); ok && text != "anchor and the laptop" {
+			t.Errorf("Check lets %q leave, so Secret is not the narrower rule", text)
+		}
+	}
+}

module.json

@@ -35,6 +35,11 @@
       "kind": "preference",
       "default": "10m",
       "why": "a busy period never holds a batch longer than this after its first merge (novox/hq ADR 0276)"
+    },
+    "push-wait": {
+      "kind": "preference",
+      "default": "2m",
+      "why": "how long a push to a named machine waits for that machine's answer, so its call says how it went; a call's own wait overrides it, and 0 waits for nothing (novox/hq issue 629)"
     }
   },
   "tools": [
@@ -120,6 +125,15 @@
       "owner": "mesh-controller",
       "content": "{\n  \"merge-window\": \"${setting:merge-window}\",\n  \"merge-window-at-most\": \"${setting:merge-window-at-most}\"\n}\n"
     },
+    {
+      "id": "push",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:mesh-state}/push.json",
+      "mode": "0600",
+      "owner": "mesh-controller",
+      "content": "{\n  \"push-wait\": \"${setting:push-wait}\"\n}\n"
+    },
     {
       "id": "controller",
       "type": "process",
@@ -144,7 +158,8 @@
         "MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
         "MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus",
         "MESH_CONTROLLER_VERSION": "${version}",
-        "MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json"
+        "MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json",
+        "MESH_PUSH_FILE": "${dir:mesh-state}/push.json"
       },
       "replaces": [
         "server"

testdata/beside/CAPTURED

@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
 
 mesh-catalog  e0bc919d4945bb5f13f971f74643a0b714cf45da  modules/*/module.json, modules/nats/Dockerfile
 mesh-host     7a41e120635b3f7b6cb94cca8b3fc4093e4e6110  examples/foundation-first-node.lock
-mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
+mesh-sdk      5933eb757d443293631be2bed27a96288c2348d8  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
 

testdata/store-tests

@@ -45,3 +45,18 @@
 ./cmd/mesh-controller TestReplay348AFaultFromBeforeTheSendFailsNoGate
 ./cmd/mesh-controller TestReplay239AModuleNameIsNotTakenOverByAnotherRepository
 ./cmd/mesh-controller TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns
+./cmd/mesh-controller TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles
+./internal/inventory TestACredentialIssuedOutsideIsNeverMade
+./internal/inventory TestOneAcceptForAProviderIsSealedToEveryConsumer
+./internal/inventory TestASharedOwnSecretIssuedOutsideIsNeverMade
+./cmd/mesh-controller TestOneAcceptForAProviderIsPlacedForEveryConsumer
+./cmd/mesh-controller TestReplay164
+./cmd/mesh-controller TestAnApprovedLayerOpensTheWalkThatSendsIt
+./cmd/mesh-controller TestASettingsWalkSendsOneMachineAtATimeEachJudged
+./cmd/mesh-controller TestAFailedSettingsWalkStopsAndHoldsNothingBack
+./cmd/mesh-controller TestASettingsWalkSendsTheLayerAloneEveryBuildKept
+./cmd/mesh-controller TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway
+./cmd/mesh-controller TestACrossingSendSupersedesASettingsGate
+./cmd/mesh-controller TestASettingsWalkFailsOnARefusalThatCannotClear
+./cmd/mesh-controller TestAProviderElsewhereServesItsOwnComposedName
+./cmd/mesh-controller TestANoMoveTierWaitsForNoNewReport

vendor/git.novox.be/novox/mesh-sdk/go/asks/asks.go

@@ -170,10 +170,18 @@ func (a Ask) Digest() string {
 			canonical(&b, v)
 		}
 	}
-	if a.Whole != "" || a.Details != "" {
+	// Whole and Details are written whenever either or WholeDetails is given, and WholeDetails after them whenever
+	// it is given (novox/hq ADR 0347): the fields after the options are then always one of three fixed shapes —
+	// none, the two, or the three — and the count of values the sequence holds tells them apart, so no two asks
+	// encode the same (the review of mesh-sdk #25). An ask with none of them digests as before they existed, and
+	// one without WholeDetails as before it existed.
+	if a.Whole != "" || a.Details != "" || a.WholeDetails != "" {
 		canonical(&b, a.Whole)
 		canonical(&b, a.Details)
 	}
+	if a.WholeDetails != "" {
+		canonical(&b, a.WholeDetails)
+	}
 	sum := sha256.Sum256([]byte(b.String()))
 	return "sha256:" + hex.EncodeToString(sum[:])
 }
@@ -202,9 +210,59 @@ type Ask struct {
 	// The asker withholds a value shaped like a secret in it, and the router refuses the ask when one is left;
 	// Explanation stays under the whole content rule everywhere else. Empty, Explanation is shown everywhere.
 	Whole string `json:"whole,omitempty"`
-	// Details is what the Details answer on the ask's message shows, line by line under the content rule: a
-	// fingerprint, how to read the proposal whole at the terminal. Empty, an ask's own message offers no Details.
+	// Details are the ask's secondary words, line by line under the content rule: who proposed it, a
+	// fingerprint, how to read it whole. The router shows them in the note of the ask's own message
+	// (Message.Note), after what the ask's options do and when it expires — never in its body (novox/hq
+	// issue 639).
 	Details string `json:"details,omitempty"`
+	// WholeDetails are the Details with their exact values whole, shown in place of Details where Whole is shown
+	// in place of the explanation (a kind that proves who answers, given the ask's answers): every value an
+	// approval sets, whole, so the person reads exactly what they approve (novox/hq issue 383). Held, like
+	// Whole, to the secret rule alone; the router refuses the ask when a secret's shape is left in it. Empty,
+	// Details are shown everywhere.
+	WholeDetails string `json:"whole-details,omitempty"`
+}
+
+// What an ask's explanation is held to, so it reads at a glance on a phone (novox/hq issue 639): a summary
+// of two or three short sentences on its first line — what changes, why, what it costs or risks — then at
+// most three points, a line each, only where they add something. Whole is held to the same. Who asked, when,
+// the fingerprint and how to read it whole are Details, never the explanation.
+const (
+	SummaryLength = 300
+	MostPoints    = 3
+	PointLength   = 160
+)
+
+// Glance says why an explanation does not read at a glance, or nil: its first line, the summary, longer than
+// SummaryLength; more than MostPoints lines after it; a point longer than PointLength. Blank lines are not
+// counted. An asker holds its asks to it in its own tests; the router says, without refusing, an ask that
+// does not hold to it.
+func Glance(explanation string) error {
+	var lines []string
+	for _, l := range strings.Split(explanation, "\n") {
+		if strings.TrimSpace(l) != "" {
+			lines = append(lines, strings.TrimSpace(l))
+		}
+	}
+	var problems []string
+	switch {
+	case len(lines) == 0:
+		problems = append(problems, "it has no summary")
+	case len([]rune(lines[0])) > SummaryLength:
+		problems = append(problems, fmt.Sprintf("its summary is %d characters, more than %d", len([]rune(lines[0])), SummaryLength))
+	}
+	if len(lines) > 1+MostPoints {
+		problems = append(problems, fmt.Sprintf("it has %d points after its summary, more than %d", len(lines)-1, MostPoints))
+	}
+	for i, l := range lines {
+		if i > 0 && len([]rune(l)) > PointLength {
+			problems = append(problems, fmt.Sprintf("its point %d is %d characters, more than %d", i, len([]rune(l)), PointLength))
+		}
+	}
+	if len(problems) > 0 {
+		return errors.New("the explanation does not read at a glance: " + strings.Join(problems, "; "))
+	}
+	return nil
 }
 
 // The bounds of an ask (novox/hq ADR 0234 §8, ADR 0259 §4).
@@ -435,8 +493,14 @@ type Message struct {
 	Title   string   `json:"title"`
 	Body    string   `json:"body"`
 	Buttons []Button `json:"buttons,omitempty"`
-	Urgent  bool     `json:"urgent,omitempty"`
-	Silent  bool     `json:"silent,omitempty"`
+	// Note is the message's secondary words, after its body and its buttons: who asked and when, what each
+	// answer does, when it expires, and the ask's Details. A channel shows it smaller, collapsed or set apart
+	// where it can, and after the body where it cannot (novox/hq issue 639). A channel that bounds a message's
+	// length cuts the body first and the note only when the title and the note alone do not fit, saying each
+	// cut (novox/hq ADR 0347 §5).
+	Note   string `json:"note,omitempty"`
+	Urgent bool   `json:"urgent,omitempty"`
+	Silent bool   `json:"silent,omitempty"`
 	// Reply is the Choice or LinkAsked this answers, by its ID: the channel shows it where that was made.
 	Reply string `json:"reply,omitempty"`
 	// To is the account linked as the operator on this kind, for a channel that verifies its sender: where

vendor/modules.txt

@@ -1,4 +1,4 @@
-# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c
+# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44
 ## explicit; go 1.22
 git.novox.be/novox/mesh-sdk/go/asks
 # github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op