Archived
Confining allocation to the push path took `plan` with it, and `plan` belongs on the other side: it is a person asking what a push would do to one named machine, so the port it shows and the secret it seals must be the ones a push would use. Both are kept once chosen, so showing numbers a later push would replace answers a question nobody asked. Caught by the lab: composing the real modules stopped producing postgres's sealed superuser, because nothing had minted it and the read-only path correctly declined to. The line is not question versus command. It is a person asking once about one machine, against the mesh asking continuously about all of them — the second is what hung, and the second is what reads.