Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk
carries no composition rule. The catalogue functions only the
node-engine's composition reaches (Resolve, Resolution's Compose,
Declaration, DataItems, LeftOut, Rules and the rest, the settings,
placeholder and template refusals, the rendering helpers) are copied
with their tests into internal/compose/resolution; a method of a
mesh-sdk shape becomes a function taking it first. The composition
calls its own copies, and the captured catalogue its tests read lives
here now, shared by mesh-compose's tests.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

testdata/beside/mesh-catalog/modules/networkmanager/files/50-mesh.conf

@@ -0,0 +1,63 @@
+# Managed by the mesh (module networkmanager). Replaced on every push; edit the
+# catalogue instead.
+#
+# This machine's uplink is NetworkManager's, and this file is the whole of what
+# the mesh asks of it (novox/hq ADR 0117): leave the resolver file to the mesh,
+# and leave the private network's interface alone. Nothing more. The mesh never
+# declares a connection profile, an address, a route, a wireless network or its
+# credentials — those are joined at the machine, by the person using it, and
+# the link they make is the only channel the mesh reaches this machine over. A
+# push that got a link wrong could not be undone by the next one.
+#
+# A drop-in of the mesh's own, beside NetworkManager.conf and whatever else the
+# operator keeps in this directory. NetworkManager reads the files here sorted by
+# name and a later one wins a key it sets again — so a file of the operator's
+# that sorts after this one (any name starting with a letter does) and sets dns=
+# or unmanaged-devices= overrides it. That is the operator's to decide, and the
+# reason this file sets nothing but the two keys it must.
+#
+# NetworkManager itself is the machine's: the mesh never starts, stops, enables
+# or disables it (its service is declared with no state), because stopping it
+# takes every link down, this machine's channel to the mesh included — and a
+# module unassigned by mistake must not be able to do that. When this file
+# changes, a running NetworkManager is reloaded (its D-Bus Reload call, which
+# re-reads its configuration — NetworkManager(8)), never restarted.
+
+[main]
+# The resolver file is the mesh's: this module writes /etc/resolv.conf itself,
+# listing the mesh's resolvers (novox/hq ADR 0223). Without this line
+# NetworkManager rewrites that file on
+# every connectivity change — every network joined, every lease renewed —
+# and the mesh's resolver is silently replaced while every surface of the mesh
+# still reads green. none: "NetworkManager will not modify resolv.conf. This
+# implies rc-manager unmanaged" (NetworkManager.conf(5), 1.58). On an adopted
+# machine the predecessor wrote the same line in a file of its own; both say one
+# thing, and the predecessor's is retired by hand after the take.
+#
+# Not NetworkManager's own global DNS ([global-dns-domain-*] with rc-manager=file):
+# it writes its own header and composes the options line itself, so it cannot
+# write the mesh's file byte for byte, and the three uplink modules would write
+# three different files for one fact. dns=none, and the file declared beside it.
+dns=none
+
+[keyfile]
+# mesh0 is the private network's interface: the mesh brings it up and the mesh
+# alone configures it. A manager that considers every interface its own could
+# try to configure it, or tear it down on a profile change.
+#
+# unmanaged-devices rather than a [device-mesh0] section with managed=0, because
+# NetworkManager.conf(5) says a device unmanaged by this key "is strictly
+# unmanaged and cannot be overruled by using the API like nmcli device set
+# $IFNAME managed yes", while device*.managed "can be overruled at runtime via
+# D-Bus". The same page adds that device*.managed "may be a better choice" for
+# exactly those reasons — for an interface the operator might want to hand back
+# at runtime. For the mesh's own interface, strict is the point.
+#
+# += rather than =: the same page documents appending to a list-valued key set
+# earlier ("plugins+=another-plugin") as an extension of its key file format,
+# and unmanaged-devices is a device list. = would replace whatever devices the
+# operator already keeps NetworkManager away from; += adds this one to them
+# (novox/hq ADR 0102: a list is added to, never replaced). A file of the
+# operator's read after this one that sets the key with = replaces it again;
+# that is the operator's to decide.
+unmanaged-devices+=interface-name:mesh0

testdata/beside/mesh-catalog/modules/networkmanager/module.json.captured

@@ -0,0 +1,71 @@
+{
+  "module": "networkmanager",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's network: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
+  },
+  "slug": "nm",
+  "requires": [
+    "wildcard-resolution"
+  ],
+  "capabilities": [
+    "package-manager",
+    "service-manager",
+    "uplink-networkmanager"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/uplink-tools",
+        "binary": "uplink-tools",
+        "loads": [
+          "uplink-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "facts": {
+    "resolvers": {
+      "path": "/etc/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's uplink:\n# the program that manages the machine's network would otherwise rewrite this\n# file on every change of network, so its holder is the one that writes it\n# (novox/hq ADR 0117, ADR 0223). Replaced on every push; edit nothing here.\n#\n# Every resolver of the mesh, by address, and nothing else (novox/hq ADR 0223) \u2014\n# this machine's own first when it holds one, then the others by name. Each\n# answers the mesh's names from the same roster and forwards every other name, so\n# whichever answers first gives the one answer. There is no public resolver here:\n# a C library that asks every listed server at once and takes the first reply \u2014\n# musl, so every Alpine container \u2014 took a public resolver's \"no such name\" for\n# a mesh name and failed. A machine that reaches none of these has no names until\n# it does. Containers copy these lines from their machine.\n{{range index .Holders \"mesh-dns-resolver\"}}nameserver {{.Address}}\n{{end}}options timeout:1 attempts:2 edns0\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "networkmanager"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/NetworkManager/conf.d/50-mesh.conf",
+      "mode": "0644",
+      "template": "files/50-mesh.conf"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "NetworkManager.service",
+      "reload-on": [
+        "config"
+      ]
+    }
+  ]
+}