-- The records already made are completed where the mesh can tell: a pin naming a node on which
-- exactly one assigned module offers the provision (or is the module itself, for a requirement that
-- names a module) gets that module. A node that answers twice is left to say which — the resolver
-- refuses it with the module asked for, rather than this guessing on its behalf.
update provision_pin p
   set module = sub.module
  from (
        select p2.node, p2.name, min(a.module) as module, count(distinct a.module) as answers
          from provision_pin p2
          join assignment a on a.node = p2.provider
          join module m on m.name = a.module
         where p2.module is null
           and (a.module = p2.name
                or exists (select 1
                             from jsonb_array_elements(coalesce(m.manifest -> 'provides', '[]'::jsonb)) e
                            where (case when jsonb_typeof(e) = 'string' then e #>> '{}' else e ->> 'name' end) = p2.name))
         group by p2.node, p2.name
       ) sub
 where sub.node = p.node and sub.name = p.name and sub.answers = 1;