The forge writes every package tarball at its public name, and its consumers had no source for that name but a second copy kept by hand, though the mesh composes it for the forge's route. A served value may now name the provider's own names; a name its machine does not compose leaves the key out, and the plan says so.