diff --git a/cmd/mesh-compose/main.go b/cmd/mesh-compose/main.go
new file mode 100644
index 0000000..22a5753
--- /dev/null
+++ b/cmd/mesh-compose/main.go
@@ -0,0 +1,154 @@
+// mesh-compose is the node-engine's composer command (novox/hq ADR 0482 clause 4, ADR 0593 §7, issue 1621): it reads a
+// composer.Request on standard input, reads every manifest, composes the machines named in each case and writes one
+// composer.Verdict on standard output. Built at a commit of the node-engine's repository, it answers what that
+// commit's composition answers, so a group that changes the node-engine's composition is judged by its own next code.
+//
+//	mesh-compose < request.json > verdict.json
+//	mesh-compose -request request.json > verdict.json
+//	mesh-compose -catalogue <dir> [-node <name>]... [-depth resolve|compose] [-declarations] [< request.json]
+//
+// -catalogue reads <dir>/modules/*/module.json and a module.json at <dir>'s root as the first case's manifests (a
+// checkout or `git archive` of the catalogue repository at a ref: the command fetches nothing). -node adds a machine to
+// compose; -declarations answers each machine's declared paths with their owners and modes.
+//
+// It opens no network connection, bus, store or file beyond its standard input, the -request file and the -catalogue
+// directory, and reads
+// no environment. Exit codes: 0 the verdict is written (a machine that does not compose is a verdict, not an error);
+// 1 the request cannot be read or run, said on standard error; 2 the flags are wrong.
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/novox/mesh-host/internal/composer"
+)
+
+func main() {
+	os.Exit(run(os.Args[1:], os.Stdin, os.Stdout, os.Stderr))
+}
+
+type nodes []string
+
+func (n *nodes) String() string     { return strings.Join(*n, ",") }
+func (n *nodes) Set(v string) error { *n = append(*n, v); return nil }
+
+// run is the command: its arguments, standard input, output and error; it answers the exit code.
+func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("mesh-compose", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	catalogueDir := fs.String("catalogue", "", "a catalogue checkout: <dir>/modules/*/module.json are the first case's manifests")
+	var machines nodes
+	fs.Var(&machines, "node", "a machine to compose (repeatable)")
+	depth := fs.String("depth", "", "resolve or compose (default: the request's, else compose)")
+	declarations := fs.Bool("declarations", false, "answer each composed machine's declared paths, owners and modes")
+	requestFile := fs.String("request", "", "read the request from this file instead of standard input (a run step that hands no standard input)")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if fs.NArg() > 0 {
+		fmt.Fprintf(stderr, "mesh-compose: unexpected arguments %q\n", fs.Args())
+		return 2
+	}
+	var raw []byte
+	var err error
+	if *requestFile != "" {
+		raw, err = os.ReadFile(*requestFile)
+	} else {
+		raw, err = io.ReadAll(stdin)
+	}
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-compose: the request cannot be read:", err)
+		return 1
+	}
+	var req composer.Request
+	if strings.TrimSpace(string(raw)) == "" {
+		if *catalogueDir == "" {
+			fmt.Fprintln(stderr, "mesh-compose: no request on standard input and no -catalogue")
+			return 1
+		}
+		req = composer.Request{V: composer.Version}
+	} else if req, err = composer.Decode(raw); err != nil {
+		fmt.Fprintln(stderr, "mesh-compose:", err)
+		return 1
+	}
+	if *catalogueDir != "" {
+		read, err := readCatalogue(*catalogueDir)
+		if err != nil {
+			fmt.Fprintln(stderr, "mesh-compose:", err)
+			return 1
+		}
+		if len(req.Cases) == 0 {
+			req.Cases = []composer.Case{{Name: "catalogue", Manifests: map[string]composer.Manifest{}}}
+		}
+		if req.Cases[0].Manifests == nil {
+			req.Cases[0].Manifests = map[string]composer.Manifest{}
+		}
+		for name, m := range read {
+			if _, given := req.Cases[0].Manifests[name]; !given {
+				req.Cases[0].Manifests[name] = m
+			}
+		}
+		// No list of predefined keys is read: the composer judges no manifest (novox/hq ADR 0578 §5).
+	}
+	req.Machines = append(req.Machines, machines...)
+	if *depth != "" {
+		req.Depth = *depth
+	}
+	if *declarations {
+		req.Declarations = true
+	}
+	v, err := composer.Run(req)
+	if err != nil {
+		fmt.Fprintln(stderr, "mesh-compose:", err)
+		return 1
+	}
+	enc := json.NewEncoder(stdout)
+	if err := enc.Encode(v); err != nil {
+		fmt.Fprintln(stderr, "mesh-compose: the verdict cannot be written:", err)
+		return 1
+	}
+	return 0
+}
+
+// readCatalogue reads every module.json of a catalogue checkout by its module's name: the root's and each of
+// modules/*/. A manifest whose name cannot be read is kept under its directory's name, so the reader's refusal is said.
+func readCatalogue(dir string) (map[string]composer.Manifest, error) {
+	paths, err := filepath.Glob(filepath.Join(dir, "modules", "*", "module.json"))
+	if err != nil {
+		return nil, err
+	}
+	if _, err := os.Stat(filepath.Join(dir, "module.json")); err == nil {
+		paths = append(paths, filepath.Join(dir, "module.json"))
+	}
+	if len(paths) == 0 {
+		return nil, fmt.Errorf("the catalogue %s holds no module.json", dir)
+	}
+	sort.Strings(paths)
+	out := map[string]composer.Manifest{}
+	for _, p := range paths {
+		raw, err := os.ReadFile(p)
+		if err != nil {
+			return nil, err
+		}
+		var probe struct {
+			Module string `json:"module"`
+		}
+		name := filepath.Base(filepath.Dir(p))
+		if json.Unmarshal(raw, &probe) == nil && probe.Module != "" {
+			name = probe.Module
+		}
+		if _, twice := out[name]; twice {
+			return nil, errors.New("the catalogue " + dir + " defines " + name + " twice")
+		}
+		out[name] = composer.Manifest{Raw: raw}
+	}
+	return out, nil
+}
diff --git a/cmd/mesh-compose/main_test.go b/cmd/mesh-compose/main_test.go
new file mode 100644
index 0000000..83a5faf
--- /dev/null
+++ b/cmd/mesh-compose/main_test.go
@@ -0,0 +1,339 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"go/build"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"sort"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/beside"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/composer"
+)
+
+// captured is every manifest of the catalogue captured in testdata/beside (internal/beside), raw, by module name.
+func captured(t *testing.T) map[string]composer.Manifest {
+	t.Helper()
+	read, err := readCatalogue(filepath.Dir(beside.Catalogue(t)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(read) < 100 {
+		t.Fatalf("the captured catalogue holds %d manifests, fewer than the catalogue's", len(read))
+	}
+	return read
+}
+
+// meshOf is a mesh of three machines over the captured catalogue, each assigned real modules, the input the assigner
+// composes with (nodes and their assignments, holdings from the claims): anchor runs the bus and the store, laptop a
+// desktop's modules, ace a module whose requirement is provided elsewhere.
+func meshOf() compose.Input {
+	return compose.Input{Nodes: []compose.Node{
+		{Name: "anchor", Assigned: []string{"nats", "postgres"}},
+		{Name: "laptop", Assigned: []string{"sudo", "zsh"}},
+		{Name: "ace", Assigned: []string{"mesh-reads", "nats"}},
+	}}
+}
+
+func request(t *testing.T, depth string) composer.Request {
+	t.Helper()
+	r := composer.Request{V: composer.Version, Depth: depth, HoldingsFromClaims: true,
+		Machines: []string{"anchor", "laptop", "ace"},
+		Cases:    []composer.Case{{Name: "trunk", Manifests: captured(t)}}}
+	return withInput(t, r, meshOf())
+}
+
+// withInput is r with in as its input, as a caller puts it on the wire: the request's shape carries the input as JSON.
+func withInput(t *testing.T, r composer.Request, in compose.Input) composer.Request {
+	t.Helper()
+	raw, err := json.Marshal(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(raw, &r.Input); err != nil {
+		t.Fatal(err)
+	}
+	return r
+}
+
+func runJSON(t *testing.T, args []string, in []byte) (int, composer.Verdict, string) {
+	t.Helper()
+	var out, errOut bytes.Buffer
+	code := run(args, bytes.NewReader(in), &out, &errOut)
+	var v composer.Verdict
+	if code == 0 {
+		if err := json.Unmarshal(out.Bytes(), &v); err != nil {
+			t.Fatalf("the verdict is not JSON: %v\n%s", err, out.String())
+		}
+	}
+	return code, v, errOut.String()
+}
+
+func encode(t *testing.T, r composer.Request) []byte {
+	t.Helper()
+	raw, err := json.Marshal(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// 1621/AC1: the command reads the plain input and the manifests on standard input, validates every manifest, composes
+// the machines named and writes one verdict: per machine composes or the reason, per manifest accepted or the field
+// refused.
+func TestTheCommandWritesOneVerdictPerManifestAndMachine(t *testing.T) {
+	r := request(t, composer.DepthResolve)
+	r.Cases[0].Manifests["later"] = composer.Manifest{Raw: json.RawMessage(`{"module":"later","version":"1","shares":["x"]}`)}
+	r.Cases[0].Manifests["refused"] = composer.Manifest{Raw: json.RawMessage(`{"module":"refused","version":"1"}`)}
+	r.Cases[0].Verdicts = map[string]delivery.ManifestVerdict{"refused": {State: delivery.VerdictRefused, Problems: []string{"it is wrong"}}}
+	code, v, stderr := runJSON(t, nil, encode(t, r))
+	if code != 0 {
+		t.Fatalf("exit %d: %s", code, stderr)
+	}
+	if len(v.Cases) != 1 || v.Cases[0].Name != "trunk" || v.SDK == "" {
+		t.Fatalf("verdict = %+v", v)
+	}
+	c := v.Cases[0]
+	// ADR 0578 §5, §6: the composer judges nothing; it sets an unknown field aside and names it, and holds a manifest
+	// its verdict refuses, named in the indexer's words.
+	if got := c.Manifests["later"]; !got.Accepted || !strings.Contains(got.SetAside, `"shares"`) {
+		t.Errorf("the manifest with an unknown field reads %+v, want accepted naming the field set aside", got)
+	}
+	if got := c.Manifests["refused"]; got.Accepted || !strings.Contains(got.Refused, "refused the manifest of refused: it is wrong") {
+		t.Errorf("the refused manifest reads %+v, want refused in the verdict's words", got)
+	}
+	if got := c.Manifests["nats"]; !got.Accepted {
+		t.Errorf("nats reads %+v, want accepted", got)
+	}
+	if len(c.Machines) != 3 {
+		t.Fatalf("machines = %v, want the three named", c.Machines)
+	}
+	for name, m := range c.Machines {
+		if !m.Composes && m.Reason == "" {
+			t.Errorf("%s does not compose and says no reason", name)
+		}
+	}
+}
+
+// 1621/AC3: over the captured catalogue and a mesh of three machines, the command's verdict equals, machine for
+// machine and manifest for manifest, what the linked reader, resolution and composition answer, at both depths.
+func TestTheCommandAnswersWhatTheLinkedCompositionAnswers(t *testing.T) {
+	for _, depth := range []string{composer.DepthResolve, composer.DepthCompose} {
+		r := request(t, depth)
+		code, v, stderr := runJSON(t, nil, encode(t, r))
+		if code != 0 {
+			t.Fatalf("%s: exit %d: %s", depth, code, stderr)
+		}
+		in := meshOf()
+		in.Catalogue = map[string]catalogue.Manifest{}
+		for name, m := range r.Cases[0].Manifests {
+			// A request without a list of predefined keys reads a fallback as the indexer does (Request.Predefined).
+			parsed, err := catalogue.Decode(m.Raw)
+			got := v.Cases[0].Manifests[name]
+			if (err == nil) != got.Accepted || (err != nil && err.Error() != got.Refused) {
+				t.Errorf("%s: the manifest of %s: linked %v, command %+v", depth, name, err, got)
+			}
+			if err == nil {
+				in.Catalogue[name] = parsed
+			}
+		}
+		in.Holdings = composer.HoldingsOf(in.Catalogue, in.Nodes)
+		composed := 0
+		for _, node := range r.Machines {
+			got := v.Cases[0].Machines[node]
+			var want composer.Machine
+			if depth == composer.DepthResolve {
+				if _, err := compose.Resolve(in, node); err != nil {
+					want = composer.Machine{Reason: err.Error()}
+				} else {
+					want = composer.Machine{Composes: true}
+				}
+			} else {
+				d, problems, err := compose.Compose(in, node)
+				switch {
+				case err != nil:
+					want = composer.Machine{Reason: err.Error()}
+				default:
+					want = composer.Machine{Composes: len(problems) == 0, Problems: problems, Refusals: d.Refusals()}
+					if len(problems) > 0 {
+						want.Reason = "the node-engine's validator refuses the declaration"
+					}
+				}
+			}
+			if !reflect.DeepEqual(got, want) {
+				t.Errorf("%s: %s: command %+v, linked %+v", depth, node, got, want)
+			}
+			if got.Composes {
+				composed++
+			} else {
+				t.Logf("%s: %s does not compose: %s %v", depth, node, got.Reason, got.Problems)
+			}
+		}
+		t.Logf("%s: %d of %d machines compose", depth, composed, len(r.Machines))
+	}
+}
+
+// 1621 note 6: a person composes a catalogue checkout (repository@ref checked out or archived: the command fetches
+// nothing) for a node and reads its declaration: each path with its kind, owner and mode.
+func TestACatalogueCheckoutIsComposedForANode(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(dir, "modules", "demo"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	manifest := `{"module": "demo", "version": "1", "resources": [{"id": "state", "type": "directory", ` +
+		`"path": "/var/lib/demo", "mode": "0750", "owner": "root"}]}`
+	if err := os.WriteFile(filepath.Join(dir, "modules", "demo", "module.json"), []byte(manifest), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	in := encode(t, withInput(t, composer.Request{V: composer.Version}, compose.Input{Nodes: []compose.Node{{Name: "laptop", Assigned: []string{"demo"}}}}))
+	code, v, stderr := runJSON(t, []string{"-catalogue", dir, "-node", "laptop", "-declarations"}, in)
+	if code != 0 {
+		t.Fatalf("exit %d: %s", code, stderr)
+	}
+	m := v.Cases[0].Machines["laptop"]
+	want := []composer.Path{{Path: "/var/lib/demo", Kind: "directory", Owner: "root", Mode: "0750", Module: ""}}
+	if !m.Composes || len(m.Declared) != 1 || m.Declared[0].Path != want[0].Path || m.Declared[0].Mode != "0750" ||
+		m.Declared[0].Owner != "root" || m.Declared[0].Kind != "directory" {
+		t.Fatalf("laptop = %+v, want it composed declaring %+v", m, want)
+	}
+}
+
+// A run step hands the command no standard input: the request is read from the file -request names, and a file that is
+// not there is a request it cannot read.
+func TestTheRequestIsReadFromAFile(t *testing.T) {
+	file := filepath.Join(t.TempDir(), "request.json")
+	r := composer.Request{V: composer.Version, Cases: []composer.Case{{Name: "only", Manifests: map[string]composer.Manifest{
+		"demo": {Raw: json.RawMessage(`{"module":"demo","version":"1"}`)}}}}}
+	if err := os.WriteFile(file, encode(t, r), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	code, v, stderr := runJSON(t, []string{"-request", file}, nil)
+	if code != 0 || len(v.Cases) != 1 || !v.Cases[0].Manifests["demo"].Accepted {
+		t.Fatalf("exit %d (%s), verdict %+v", code, stderr, v)
+	}
+	if code, _, stderr := runJSON(t, []string{"-request", file + ".gone"}, nil); code != 1 || !strings.Contains(stderr, "cannot be read") {
+		t.Errorf("a request file that is not there: exit %d, %q", code, stderr)
+	}
+}
+
+// The exit codes: 1 for a request that cannot be read or run, 2 for wrong flags, each said on standard error.
+func TestTheExitCodesSayWhatFailed(t *testing.T) {
+	unfilled := encode(t, composer.Request{V: composer.Version, Cases: []composer.Case{{Name: "c", Manifests: map[string]composer.Manifest{"x": {Digest: "abc"}}}}})
+	for _, c := range []struct {
+		name string
+		args []string
+		in   string
+		code int
+		says string
+	}{
+		{"not JSON", nil, "{", 1, "not JSON"},
+		{"another version", nil, `{"v":2}`, 1, "version 2"},
+		{"a digest left unfilled", nil, string(unfilled), 1, "digest"},
+		{"an unknown depth", nil, `{"v":1,"depth":"deep"}`, 1, "depth"},
+		{"nothing to read", nil, "", 1, "no request"},
+		{"a wrong flag", []string{"-nope"}, "", 2, "nope"},
+		{"an argument", []string{"extra"}, "", 2, "unexpected"},
+	} {
+		var out, errOut bytes.Buffer
+		if got := run(c.args, strings.NewReader(c.in), &out, &errOut); got != c.code || !strings.Contains(errOut.String(), c.says) {
+			t.Errorf("%s: exit %d saying %q, want %d saying %q", c.name, got, errOut.String(), c.code, c.says)
+		}
+	}
+}
+
+// ownPackages is every package of this repository the command imports, directly or not, with the packages each
+// imports: what this repository adds to the composition; mesh-sdk's packages are judged in mesh-sdk.
+func ownPackages(t *testing.T) map[string][]string {
+	t.Helper()
+	_, file, _, _ := runtime.Caller(0)
+	root := filepath.Join(filepath.Dir(file), "..", "..")
+	const module = "github.com/novox/mesh-host"
+	out := map[string][]string{}
+	var walk func(path string)
+	walk = func(path string) {
+		if _, done := out[path]; done {
+			return
+		}
+		rel := strings.TrimPrefix(strings.TrimPrefix(path, module), "/")
+		pkg, err := build.Default.ImportDir(filepath.Join(root, rel), 0)
+		if err != nil {
+			t.Fatalf("%s: %v", path, err)
+		}
+		out[path] = pkg.Imports
+		for _, imp := range pkg.Imports {
+			if strings.HasPrefix(imp, module+"/") {
+				walk(imp)
+			}
+		}
+	}
+	walk(composer.Package)
+	return out
+}
+
+// 1621/AC2 and AC4: the command imports, through every package of this repository it reaches, only the standard
+// library, mesh-sdk and this repository's own packages, and none that reaches a bus, a store, a network service or
+// another process.
+func TestTheCommandImportsNoBusStoreNetworkOrProcess(t *testing.T) {
+	forbidden := []string{"net/http", "net/rpc", "net/smtp", "os/exec", "database/sql", "plugin", "syscall"}
+	own := ownPackages(t)
+	if len(own) < 4 {
+		t.Fatalf("the command reaches %d packages of this repository; the walk found too few to judge", len(own))
+	}
+	for path, imports := range own {
+		for _, imp := range imports {
+			std := !strings.Contains(strings.SplitN(imp, "/", 2)[0], ".")
+			if !std && !strings.HasPrefix(imp, "git.novox.be/novox/mesh-sdk/go") && !strings.HasPrefix(imp, "github.com/novox/mesh-host/") {
+				t.Errorf("%s imports %s, which is neither the standard library, mesh-sdk nor this repository", path, imp)
+			}
+			for _, f := range forbidden {
+				if imp == f {
+					t.Errorf("%s imports %s", path, imp)
+				}
+			}
+		}
+	}
+}
+
+// 1621/AC2: run with an empty network namespace, the command still writes its verdict: it needs no network. The test
+// runs its own binary again under `unshare --net` as an unprivileged user's namespace; where the kernel or the sandbox
+// allows no new namespace (a build module's run step is already one with no network), it says so and skips.
+func TestTheCommandRunsWithNoNetwork(t *testing.T) {
+	if os.Getenv("MESH_COMPOSE_HELPER") == "1" {
+		os.Exit(run(nil, os.Stdin, os.Stdout, os.Stderr))
+	}
+	unshare, err := exec.LookPath("unshare")
+	if err != nil {
+		t.Skip("no unshare on this machine, so no empty network namespace can be made here")
+	}
+	if out, err := exec.Command(unshare, "--net", "--map-root-user", "true").CombinedOutput(); err != nil {
+		t.Skipf("this machine makes no unprivileged network namespace (%v: %s); a run step's own has no network", err, out)
+	}
+	r := request(t, composer.DepthResolve)
+	cmd := exec.Command(unshare, "--net", "--map-root-user", os.Args[0], "-test.run=^TestTheCommandRunsWithNoNetwork$")
+	cmd.Env = []string{"MESH_COMPOSE_HELPER=1"}
+	cmd.Stdin = bytes.NewReader(encode(t, r))
+	var out, errOut bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &out, &errOut
+	if err := cmd.Run(); err != nil {
+		t.Fatalf("the command in an empty network namespace: %v: %s", err, errOut.String())
+	}
+	var v composer.Verdict
+	if err := json.Unmarshal(out.Bytes(), &v); err != nil || len(v.Cases) != 1 || len(v.Cases[0].Machines) != 3 {
+		t.Fatalf("no verdict from the command with no network: %v\n%s", err, out.String())
+	}
+	names := make([]string, 0, len(v.Cases[0].Machines))
+	for n := range v.Cases[0].Machines {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	t.Logf("composed with no network: %v", names)
+}
diff --git a/cmd/mesh-compose/reads-outside b/cmd/mesh-compose/reads-outside
new file mode 100644
index 0000000..f6b2d87
--- /dev/null
+++ b/cmd/mesh-compose/reads-outside
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
diff --git a/cmd/mesh-host/engineseat.go b/cmd/mesh-host/engineseat.go
index 6cba6a6..443f0fc 100644
--- a/cmd/mesh-host/engineseat.go
+++ b/cmd/mesh-host/engineseat.go
@@ -3,6 +3,7 @@ package main
 import (
 	"bufio"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -15,6 +16,7 @@ import (
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	meshasker "git.novox.be/novox/mesh-sdk/go/asker"
 	"git.novox.be/novox/mesh-sdk/go/asks"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"github.com/novox/mesh-host/internal/accounts"
 	"github.com/novox/mesh-host/internal/apply"
 	"github.com/novox/mesh-host/internal/link"
@@ -359,3 +361,31 @@ func packagesFrom(node string, session *link.Session, composer *atomic.Pointer[s
 		return v, nil
 	}
 }
+
+// composeCandidateFrom answers the verb compose-candidate (novox/hq ADR 0593 §7): the check's candidate composed on this
+// node in shadow by the run's shadow, applying and writing nothing, within delivery.ComposeAnswerBound. The answer is
+// the seat's shape (delivery.ComposeCandidateAnswer), checked as it is encoded; a node whose shadow does not run yet
+// answers unready, which the checker takes as no answer.
+func composeCandidateFrom(node string, shadow *atomic.Pointer[selfcompose.Shadow]) func(candidate string, input bool) (any, error) {
+	return func(candidate string, input bool) (any, error) {
+		ask := delivery.ComposeCandidateAsk{Candidate: candidate, Input: input}
+		if _, err := delivery.EncodeComposeCandidateAsk(ask); err != nil {
+			return nil, err
+		}
+		var a delivery.ComposeCandidateAnswer
+		if s := shadow.Load(); s == nil {
+			// Unready, never an error the checker reads words of: its agent is starting (ADR 0593 §9).
+			a = delivery.ComposeCandidateAnswer{Node: node, Candidate: candidate, Verdict: delivery.ComposeCandidateUnready,
+				Refused: "this node's shadow does not run now (its node agent is starting), so it composes no candidate"}
+		} else {
+			ctx, cancel := context.WithTimeout(context.Background(), delivery.ComposeAnswerBound)
+			defer cancel()
+			a = s.ComposeCandidate(ctx, ask)
+		}
+		raw, err := delivery.EncodeComposeCandidateAnswer(a)
+		if err != nil {
+			return nil, fmt.Errorf("this node's answer to %s does not fit the seat's shape: %w", candidate, err)
+		}
+		return json.RawMessage(raw), nil
+	}
+}
diff --git a/cmd/mesh-host/main.go b/cmd/mesh-host/main.go
index 3045eb9..b352d48 100644
--- a/cmd/mesh-host/main.go
+++ b/cmd/mesh-host/main.go
@@ -1001,6 +1001,7 @@ func runLink(ctx context.Context, opts options) error {
 	queue.Acts.Composition = compositionFrom(current)
 	queue.Acts.Compose = composeFrom(current, &composerNow)
 	queue.Acts.Packages = packagesFrom(mine.Node, queue, &composerNow)
+	queue.Acts.ComposeCandidate = composeCandidateFrom(mine.Node, &shadowNow)
 	setRunsHere(runsFromAgent(current))
 	factsOfNow := func(ctx context.Context, ag *agent.Agent) {
 		sayFacts(ctx, opts, mine.Membership.Signer, queue, say, ag)
diff --git a/cmd/mesh-host/nodeagent.go b/cmd/mesh-host/nodeagent.go
index c9a140a..8001ee3 100644
--- a/cmd/mesh-host/nodeagent.go
+++ b/cmd/mesh-host/nodeagent.go
@@ -14,12 +14,12 @@ import (
 	"sync/atomic"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/apply"
+	"github.com/novox/mesh-host/internal/compose/frombus"
 	"github.com/novox/mesh-host/internal/link"
 	"github.com/novox/mesh-host/internal/liveness"
 	"github.com/novox/mesh-host/internal/selfcompose"
@@ -623,6 +623,7 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, trus
 				session.NoteCandidates(ctx, delivery.WithValuesDiffer(answers))
 			})
 		go shadow.Keep(run, link.Backoff) // this run's alone: a switch begins a run, and its shadow, again
+		shadowNow.Store(shadow)           // what the verb compose-candidate composes a check's candidate with
 		// Its own composer, always (issue 1126, A7): a composition made elsewhere (the controller's, in the node's
 		// composition bucket) is never applied. While the seat's placement holds no key for this node it composes
 		// nothing and keeps running what it runs; a placement it cannot watch stops the agent, said, and it begins again.
@@ -640,6 +641,7 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, trus
 		cancel()
 		current.set(nil)
 		composerNow.Store(nil)
+		shadowNow.Store(nil)
 		if ctx.Err() != nil {
 			return
 		}
@@ -766,6 +768,10 @@ var machinesNow atomic.Pointer[selfcompose.Composer]
 // compositions or no run is going: what the verb compose asks a pass of (issue 774).
 var composerNow atomic.Pointer[selfcompose.Composer]
 
+// shadowNow is the shadow of the run now, which answers placement candidates and the verb compose-candidate; nil
+// between runs.
+var shadowNow atomic.Pointer[selfcompose.Shadow]
+
 // keptRetired says the kept declaration is read no more: every module the seat's placement puts on this node has a have of
 // its own (placedAllHave), so what runs is the agent's alone (ADR 0550 §2, design 47's L3 s9).
 var keptRetired atomic.Bool
@@ -968,6 +974,9 @@ func selfComposer(session *link.Session, node string, hooks composerHooks, say f
 	// And the packages its compositions declare in its own key of the state packages, which pacman reads (novox/hq ADR
 	// 0565 §6).
 	env.Packages = link.EnginePackages{Session: session}
+	// And every composition it makes in its composition state composed-<node>, a record the provisioner, the assigner
+	// and the view read and nothing applies (novox/hq ADR 0593 §6).
+	env.ComposedState = link.EngineComposed{Session: session, Node: node}
 	return selfcompose.New(env)
 }
 
diff --git a/cmd/mesh-host/nodeagent_integration_test.go b/cmd/mesh-host/nodeagent_integration_test.go
index a00bef5..68d8b5e 100644
--- a/cmd/mesh-host/nodeagent_integration_test.go
+++ b/cmd/mesh-host/nodeagent_integration_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/novox/mesh-host/internal/agent"
 	"github.com/novox/mesh-host/internal/link"
+	"github.com/novox/mesh-host/internal/nodegrant"
 	"github.com/novox/mesh-host/internal/selfcompose"
 )
 
@@ -32,7 +33,7 @@ type itBed struct {
 	t    *testing.T
 	conn *nats.Conn
 	js   nats.JetStreamContext
-	// nodeConn and nodeJS are the node's own, under its real grant (buscompose.PermissionsFor, KindNode): the agent runs
+	// nodeConn and nodeJS are the node's own, under its real grant (the grants part's, nodegrant.For): the agent runs
 	// on them, so a watch or a read the grant does not allow fails here as it fails on the bus (issue 1126, 2026-10-27
 	// 09:21: a watch of every have key stopped every node agent). conn is the test's, unrestricted, for setting up.
 	nodeConn *nats.Conn
@@ -51,13 +52,9 @@ type itBed struct {
 }
 
 // aServer is an embedded bus with JetStream and two users: the test's, unrestricted, and the node's, granted exactly what
-// buscompose.PermissionsFor gives a node (KindNode); it answers a connection of each.
-func aServer(t *testing.T, principal buscompose.Principal, refused func(error)) (admin, node *nats.Conn) {
+// the grants part gives a node (nodegrant.For); it answers a connection of each.
+func aServer(t *testing.T, perms nodegrant.Permissions, refused func(error)) (admin, node *nats.Conn) {
 	t.Helper()
-	perms, err := buscompose.PermissionsFor(principal)
-	if err != nil {
-		t.Fatal(err)
-	}
 	granted := &server.Permissions{Publish: &server.SubjectPermission{Allow: perms.Publish, Deny: perms.PublishDeny},
 		Subscribe: &server.SubjectPermission{Allow: perms.Subscribe}}
 	if perms.AllowResponses {
@@ -88,11 +85,11 @@ func aServer(t *testing.T, principal buscompose.Principal, refused func(error))
 
 func newItBed(t *testing.T) *itBed {
 	t.Helper()
-	return newItBedAs(t, buscompose.Principal{Kind: buscompose.KindNode, Node: itNode})
+	return newItBedAs(t, nodegrant.For(itNode))
 }
 
-// newItBedAs is newItBed with the node's connection under the grant of principal, a node's (KindNode).
-func newItBedAs(t *testing.T, principal buscompose.Principal) *itBed {
+// newItBedAs is newItBed with the node's connection under the grant perms, a node's.
+func newItBedAs(t *testing.T, perms nodegrant.Permissions) *itBed {
 	t.Helper()
 	// Not skipped off Arch: a package manager that answers is put on PATH, so the apply of files runs on any build node.
 	bin := t.TempDir()
@@ -105,7 +102,7 @@ func newItBedAs(t *testing.T, principal buscompose.Principal) *itBed {
 	t.Cleanup(func() { builtFor = was })
 
 	b := &itBed{t: t, dir: t.TempDir()}
-	b.conn, b.nodeConn = aServer(t, principal, func(err error) {
+	b.conn, b.nodeConn = aServer(t, perms, func(err error) {
 		b.mu.Lock()
 		b.refusals = append(b.refusals, err.Error())
 		b.mu.Unlock()
@@ -166,28 +163,6 @@ func fpIt(c string) string { return delivery.SourcePrefix2 + strings.Repeat(c, 6
 
 func fpDigest(c string) string { return "sha256:" + strings.Repeat(c, 64) }
 
-// compose writes a module's signed composition of one file into the node's bucket and returns its digest.
-func (b *itBed) compose(module, fp, content string, data bool, signer ed25519.PrivateKey) string {
-	b.t.Helper()
-	path := filepath.Join(b.dir, module+".conf")
-	res, _ := json.Marshal(map[string]any{"id": module + ".conf", "type": "file", "path": path, "content": content, "module": module})
-	c := delivery.Composed{Node: itNode, Module: module, FP: fp, Data: data, Resources: []json.RawMessage{res}}
-	signed, err := delivery.SignComposed(c, signer)
-	if err != nil {
-		b.t.Fatal(err)
-	}
-	raw, err := delivery.EncodeComposed(signed)
-	if err != nil {
-		b.t.Fatal(err)
-	}
-	dig, _ := delivery.ComposedDigestOf(signed)
-	key, _ := delivery.ComposedKey(itNode, module, fp)
-	if _, err := b.composed.Put(key, raw); err != nil {
-		b.t.Fatal(err)
-	}
-	return dig
-}
-
 func (b *itBed) want(module, fp, digest, backup string) {
 	b.t.Helper()
 	raw, err := delivery.EncodeWant(delivery.Want{FP: fp, Composed: digest, Backup: backup})
@@ -233,24 +208,10 @@ func within(t *testing.T, d time.Duration, what string, ok func() bool) {
 // in the node's own key, and nothing is applied for it (ADR 0559 §4, subtask 10 of the milestone).
 //
 // And (issue 1126, ADR 0560) it reads, through its own session under the grant the grants part composes for it
-// (buscompose.Users, so it carries ServedReads), the build of a placed module that declares one and the one config value
+// (nodegrant.For with the served key, as the grants part grants it), the build of a placed module that declares one and the one config value
 // a provider on another node serves from (a mail domain); under a grant without that served key the bus refuses the
 // read and the node composes nothing.
 func TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn(t *testing.T) {
-	users, err := buscompose.Users(buscompose.Records{Nodes: []string{itNode, "it2"},
-		Assigned: map[string][]buscompose.Declared{"it2": {{Module: "mailer", Served: []string{"domain"}}}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	var principal buscompose.Principal
-	for _, u := range users {
-		if u.Kind == buscompose.KindNode && u.Node == itNode {
-			principal = u
-		}
-	}
-	if len(principal.ServedReads) != 1 {
-		t.Fatalf("the grants part's principal of %s reads %v of the served keys", itNode, principal.ServedReads)
-	}
 	t.Run("without the served key the bus refuses the read", func(t *testing.T) {
 		b := newItBed(t)
 		stop, _ := h8(t, b, false)
@@ -268,7 +229,7 @@ func TestNatsANodeThePlacementNamesComposesAndAppliesItsOwn(t *testing.T) {
 			t.Errorf("composed and applied under a grant without the served key: %q", b.file("web"))
 		}
 	})
-	b := newItBedAs(t, principal)
+	b := newItBedAs(t, nodegrant.For(itNode, "it2.mailer.domain"))
 	stop, st := h8(t, b, true)
 	defer stop()
 	placement, resolved, candidates := st.placement, st.resolved, st.candidates
@@ -524,10 +485,22 @@ func h8rest(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, hkey str
 		h := b.have("web")
 		return h.FP == fp && h.Composed != "" && h.Phase == delivery.PhaseRunning
 	})
-	if keys, _ := b.composed.Keys(); len(keys) != 0 {
-		t.Errorf("the controller's compositions hold %v; the node composed its own", keys)
-	}
+	// ADR 0593 §6: the node publishes what it composed in its composition state, under its own grant: web at the build
+	// its want names, with the digest its have names (the plan left out of it), and the node's own.
 	first := b.have("web").Composed
+	webKey, _ := delivery.ComposedKey(itNode, "web", fp)
+	within(t, 5*time.Second, "the node did not publish web's composition in its composition state", func() bool {
+		e, err := b.composed.Get(webKey)
+		if err != nil {
+			return false
+		}
+		c, err := delivery.DecodeComposed(e.Value())
+		if err != nil {
+			return false
+		}
+		d, err := delivery.ComposedDigestOf(c)
+		return err == nil && d == first
+	})
 	if _, err := resolved.Put(itNode+".web.greeting", []byte(`{"value":"salut","source":"module"}`)); err != nil {
 		t.Fatal(err)
 	}
@@ -568,4 +541,78 @@ func h8rest(t *testing.T, b *itBed, resolved, candidates nats.KeyValue, hkey str
 	if h := b.have("web"); h.Composed != second || b.file("web") != "greeting=salut\n" {
 		t.Errorf("a candidate moved what runs: %+v, %q", h, b.file("web"))
 	}
+	h8candidate(t, b, fp, second)
+}
+
+// h8candidate is ADR 0593 §7: a check's candidate is composed on the node through its seat's verb compose-candidate,
+// under its own grant: the indexer's candidate changing web's manifest is answered composed, web changed at the
+// candidate's build, within the answer bound; nothing is applied and the composition state does not move.
+func h8candidate(t *testing.T, b *itBed, fp, running string) {
+	t.Helper()
+	kvOf := func(bucket string) nats.KeyValue {
+		kv, err := b.js.CreateKeyValue(&nats.KeyValueConfig{Bucket: bucket, History: 5})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return kv
+	}
+	cands, _ := kvOf(delivery.CandidatesBucket), kvOf(delivery.VerdictsBucket)
+	manifests, err := b.js.KeyValue(delivery.ManifestsBucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(b.dir, "web.conf")
+	man := `{"module":"web","version":"2","config":{"greeting":{"type":"string","description":"what the file says","default":"hello"}},` +
+		`"resources":[{"id":"conf","type":"file","path":"` + path + `","mode":"0640","content":"greeting=${config:greeting}\n"},` +
+		`{"id":"tools","type":"package","package":"web-tools"}]}`
+	digest := delivery.ManifestDigest([]byte(man))
+	mraw, _ := delivery.EncodeManifest(delivery.Manifest{Module: "web", JSON: man})
+	mkey, _ := delivery.ManifestsKey(digest)
+	if _, err := manifests.Put(mkey, mraw); err != nil {
+		t.Fatal(err)
+	}
+	head := delivery.Head{Repository: "novox/web", Number: 3, Head: strings.Repeat("3", 40)}
+	heads, _ := delivery.HeadsHash([]delivery.Head{head})
+	pulls := []delivery.CandidatePull{{Head: head, Modules: []string{"web"},
+		Fps: map[string]delivery.CandidateModule{"web": {FP2: fpIt("c"), Manifest: digest}}}}
+	craw, err := delivery.EncodeCandidate(delivery.Candidate{Group: "novox/web#3", HeadsHash: heads, Pulls: pulls,
+		FPSet: delivery.FingerprintSet(pulls)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := delivery.CompositionKey("novox/web#3", heads)
+	if _, err := cands.Put(key, craw); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := b.composed.Status()
+	got, err := composeCandidateFrom(itNode, &shadowNow)(key, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := got.(json.RawMessage)
+	a, err := delivery.DecodeComposeCandidateAnswer(raw)
+	if err != nil {
+		t.Fatalf("the answer %s: %v", raw, err)
+	}
+	if a.Verdict != delivery.ComposeCandidateComposed || len(a.Modules) != 1 || a.Modules[0].Module != "web" ||
+		a.Modules[0].FP != fpIt("c") || !a.Modules[0].Changed || a.Took > delivery.ComposeAnswerBound.Milliseconds() {
+		t.Errorf("the node's answer to a candidate changing web: %+v", a)
+	}
+	after, _ := b.composed.Status()
+	if h := b.have("web"); h.Composed != running || b.file("web") != "greeting=salut\n" || before == nil || after == nil ||
+		after.Values() != before.Values() {
+		t.Errorf("composing a candidate moved what runs or the composition state: %+v, %q", h, b.file("web"))
+	}
+	if _, err := b.composed.Get(mustComposedKey(t, "web", fpIt("c"))); err == nil {
+		t.Error("the candidate's composition was written into the composition state")
+	}
+}
+
+func mustComposedKey(t *testing.T, module, fp string) string {
+	t.Helper()
+	key, err := delivery.ComposedKey(itNode, module, fp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return key
 }
diff --git a/cmd/mesh-host/nodeclare_test.go b/cmd/mesh-host/nodeclare_test.go
index 430fec3..f295ca5 100644
--- a/cmd/mesh-host/nodeclare_test.go
+++ b/cmd/mesh-host/nodeclare_test.go
@@ -22,6 +22,11 @@ func TestNoPackageHearsOrOrdersAWholeDeclaration(t *testing.T) {
 		if err != nil {
 			return err
 		}
+		// The composition moved in from mesh-sdk (novox/hq ADR 0593 §7) has a node's input field of the same name,
+		// ReadsModules, which says the node reads a module per resource; it is no reconciling of a declaration.
+		if d.IsDir() && path == filepath.Join(root, "internal", "compose") {
+			return filepath.SkipDir
+		}
 		if d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "nodeclare_test.go") {
 			return nil
 		}
diff --git a/go.mod b/go.mod
index 119dc8a..7ec0e0a 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/novox/mesh-host
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0
diff --git a/go.sum b/go.sum
index ebd4e0f..43cc4ec 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791 h1:7SYIDPMxbPBr8dMB6k9fYsgVt4ZyWVL41q4LMFsfAvs=
-git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102112556-abf5eace7791/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
diff --git a/internal/agent/agent.go b/internal/agent/agent.go
index 5d50426..c392947 100644
--- a/internal/agent/agent.go
+++ b/internal/agent/agent.go
@@ -15,7 +15,6 @@ package agent
 import (
 	"bytes"
 	"context"
-	"crypto/ed25519"
 	"encoding/json"
 	"fmt"
 	"sort"
@@ -26,6 +25,7 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/declaration"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/judge"
 )
 
 // Update is one change of a key in a watched bucket. Caught marks the end of the keys that were there when the watch
@@ -119,10 +119,6 @@ type Env struct {
 	// whose have names a composition the bucket keeps runs from that composition, never from the kept declaration
 	// (issue 924): the kept declaration is older than every composition applied since the switch.
 	KeptFilled func() map[string][]string
-	// Trusted is the public keys a composition may be signed by: the controller's and the operator's (ADR 0539 §3). A
-	// composition unsigned, signed by another key, or changed after it was signed is refused and nothing of it is
-	// applied. Nil trusts no key, so nothing is applied.
-	Trusted func() []ed25519.PublicKey
 	// Recorded says the engine holds a record of every resource of the composition, so it was applied and not removed
 	// since; nil says yes. A composition the kept declaration or a have says runs is applied again when it says no.
 	Recorded func(ctx context.Context, c delivery.Composed) bool
@@ -685,26 +681,14 @@ func (a *Agent) takeComposition(u Update) string {
 	}
 	now := compNow{Raw: u.Value, Rev: u.Revision}
 	c, err := delivery.DecodeComposed(u.Value)
-	if err == nil && a.env.SelfComposed {
-		// The node composed it itself: nothing crossed the bus, so nothing is signed (ADR 0547 §2).
+	if err == nil {
+		// The node composed it itself: it is applied as composed, never verified against a signer, since no composition
+		// read from the bus is applied (novox/hq ADR 0547 §2, ADR 0593 §6).
 		now.C = c
 		now.Dig, err = delivery.ComposedDigestOf(c)
 		if err != nil {
 			now.C = delivery.Composed{}
 		}
-	} else if err == nil {
-		var trusted []ed25519.PublicKey
-		if a.env.Trusted != nil {
-			trusted = a.env.Trusted()
-		}
-		// The signature before anything of the composition is used: its digest is what the want names.
-		now.C = c
-		now.Dig, err = delivery.VerifyComposed(c, trusted)
-		if err != nil {
-			now.C = delivery.Composed{}
-			a.sayOnce("verify:"+u.Key, fmt.Sprintf("the composition %s is refused and nothing of it is applied: %v", u.Key, err))
-			err = fmt.Errorf("refused: %w", err)
-		}
 	} else {
 		a.sayOnce("decode:"+u.Key, fmt.Sprintf("the composition %s cannot be read, and nothing of it is applied: %v", u.Key, err))
 	}
@@ -1646,14 +1630,14 @@ func (a *Agent) waitsForYes(ctx context.Context, module string, w wantNow, comp
 			prior = true
 		}
 	}
-	var j delivery.Judged
+	var j judge.Judged
 	switch {
 	case known:
-		j = delivery.JudgeMove(&from, comp.C)
+		j = judge.JudgeMove(&from, comp.C)
 	case prior:
-		j = delivery.Judged{Judgement: delivery.JudgedCannot, Words: "what " + module + " runs on this node cannot be read"}
+		j = judge.Judged{Judgement: delivery.JudgedCannot, Words: "what " + module + " runs on this node cannot be read"}
 	default:
-		j = delivery.JudgeMove(nil, comp.C)
+		j = judge.JudgeMove(nil, comp.C)
 	}
 	switch j.Judgement {
 	case delivery.JudgedRecreates, delivery.JudgedMovesData, delivery.JudgedCannot:
diff --git a/internal/agent/agent_test.go b/internal/agent/agent_test.go
index e6c128a..f2b3306 100644
--- a/internal/agent/agent_test.go
+++ b/internal/agent/agent_test.go
@@ -2,7 +2,6 @@ package agent
 
 import (
 	"context"
-	"crypto/ed25519"
 	"encoding/json"
 	"fmt"
 	"maps"
@@ -18,19 +17,6 @@ import (
 
 const node = "n1"
 
-// The keys of the tests: the controller's and the operator's are trusted, a stranger's is not.
-var controllerPub, controllerKey = newKey()
-var operatorPub, operatorKey = newKey()
-var _, strangerKey = newKey()
-
-func newKey() (ed25519.PublicKey, ed25519.PrivateKey) {
-	pub, key, err := ed25519.GenerateKey(nil)
-	if err != nil {
-		panic(err)
-	}
-	return pub, key
-}
-
 func fpOf(c string) string { return delivery.SourcePrefix2 + strings.Repeat(c, 64) }
 
 // A watcher the test writes to; it says Caught once the keys written before the watch began are out.
@@ -183,8 +169,7 @@ func newBed(t *testing.T) *bed {
 			b.settled = append(b.settled, m)
 			b.settledRan = append(b.settledRan, ran)
 		},
-		Kept:    func() map[string][]json.RawMessage { return b.kept },
-		Trusted: func() []ed25519.PublicKey { return []ed25519.PublicKey{controllerPub, operatorPub} },
+		Kept: func() map[string][]json.RawMessage { return b.kept },
 		Say: func(s string) {
 			t.Log(s)
 			b.mu.Lock()
@@ -223,21 +208,17 @@ func composition(t *testing.T, module, fp string, data bool, rs ...json.RawMessa
 	if err != nil {
 		t.Fatal(err)
 	}
-	return signedBy(t, c, key, controllerKey)
+	return encodedAs(t, c, key)
 }
 
-// signedBy is c signed with signer, as the writer's code signs it: its key, its bytes and its digest.
-func signedBy(t *testing.T, c delivery.Composed, key string, signer ed25519.PrivateKey) (string, []byte, string) {
+// encodedAs is c as the node's composer hands it: unsigned (ADR 0593 §6), its key, its bytes and its digest.
+func encodedAs(t *testing.T, c delivery.Composed, key string) (string, []byte, string) {
 	t.Helper()
-	signed, err := delivery.SignComposed(c, signer)
+	raw, err := delivery.EncodeComposed(c)
 	if err != nil {
 		t.Fatal(err)
 	}
-	raw, err := delivery.EncodeComposed(signed)
-	if err != nil {
-		t.Fatal(err)
-	}
-	digest, err := delivery.ComposedDigestOf(signed)
+	digest, err := delivery.ComposedDigestOf(c)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -735,76 +716,6 @@ func TestTheNodesOwnCompositionComesBeforeAnyModules(t *testing.T) {
 	}
 }
 
-// R6-A AC9: a composition signed by either trusted key is applied; one signed by another key, one changed after it was
-// signed and one unsigned are refused and nothing of them is applied (ADR 0539 §3).
-func TestOnlyACompositionSignedByATrustedKeyIsApplied(t *testing.T) {
-	t.Run("with no trusted key", testWithNoTrustedKeyNothingIsApplied)
-	b := newBed(t)
-	stop := b.run()
-	defer stop()
-
-	plain := func(module, fp, content string) delivery.Composed {
-		return delivery.Composed{Node: node, Module: module, FP: fp, Resources: []json.RawMessage{file(module, "x", content)}}
-	}
-	put := func(c delivery.Composed, signer ed25519.PrivateKey, tamper func([]byte) []byte) {
-		key, _ := delivery.ComposedKey(node, c.Module, c.FP)
-		var raw []byte
-		var dig string
-		if signer == nil {
-			raw, _ = delivery.EncodeComposed(c)
-			dig, _ = delivery.ComposedDigestOf(c)
-		} else {
-			_, raw, dig = signedBy(t, c, key, signer)
-		}
-		if tamper != nil {
-			raw = tamper(raw)
-		}
-		b.comps.put(key, raw)
-		wk, wraw := wantFor(t, c.Module, c.FP, dig, "")
-		b.wants.put(wk, wraw)
-	}
-
-	// Refused: signed by a stranger, changed after signing, unsigned.
-	put(plain("stranger", fpOf("1"), "x"), strangerKey, nil)
-	put(plain("changed", fpOf("2"), "before"), controllerKey, func(raw []byte) []byte {
-		return []byte(strings.Replace(string(raw), "before", "after!", 1))
-	})
-	put(plain("unsigned", fpOf("3"), "x"), nil, nil)
-	time.Sleep(200 * time.Millisecond)
-	if got := b.appliedList(); len(got) != 0 {
-		t.Fatalf("a composition that is not signed by a trusted key was applied: %v", got)
-	}
-
-	// Applied: signed by the controller, signed by the operator.
-	put(plain("bycontroller", fpOf("4"), "x"), controllerKey, nil)
-	put(plain("byoperator", fpOf("5"), "x"), operatorKey, nil)
-	eventually(t, "the trusted signers' compositions were not applied", func() bool { return len(b.appliedList()) == 2 })
-	got := b.appliedList()
-	if !(got[0] == "bycontroller" && got[1] == "byoperator") && !(got[0] == "byoperator" && got[1] == "bycontroller") {
-		t.Fatalf("applied %v", got)
-	}
-	if h := b.haves.last("byoperator"); h.Phase != string(delivery.PhaseRunning) || h.FP != fpOf("5") {
-		t.Fatalf("the operator's module has no running have: %+v", h)
-	}
-}
-
-// With no key trusted, nothing is applied: a node that does not know its signers fails closed.
-func testWithNoTrustedKeyNothingIsApplied(t *testing.T) {
-	b := newBed(t)
-	b.env.Trusted = nil
-	stop := b.run()
-	defer stop()
-	fp := fpOf("a")
-	ck, craw, dig := composition(t, "web", fp, false, file("web", "x", "1"))
-	b.comps.put(ck, craw)
-	wk, wraw := wantFor(t, "web", fp, dig, "")
-	b.wants.put(wk, wraw)
-	time.Sleep(200 * time.Millisecond)
-	if got := b.appliedList(); len(got) != 0 {
-		t.Fatalf("applied with no trusted key: %v", got)
-	}
-}
-
 // What a module's apply must not take is every other module that runs, those the agent holds and those still running from
 // the kept declaration (ADR 0429 §4): the resources of the kept declaration reach Apply as the others.
 func TestApplyingOneModuleHoldsOutTheModulesStillRunningFromTheKeptDeclaration(t *testing.T) {
@@ -860,7 +771,7 @@ func TestEverythingIsWhatTheAgentRunsAndWhatIsKeptForTheRest(t *testing.T) {
 	// and is what runs from before the first composition is watched; an apply keeps, a removal forgets.
 	t.Run("what this engine applied is what runs before the node composes its own", func(t *testing.T) {
 		b := newBed(t)
-		b.env.SelfComposed, b.env.Trusted, b.kept = true, nil, nil
+		b.env.SelfComposed, b.kept = true, nil
 		store := &memApplied{kept: map[string][]byte{}}
 		b.env.Applied = store
 		// A folded module's resource in the node's own composition: its id names the module, as the controller folds it.
@@ -930,7 +841,7 @@ func TestEverythingIsWhatTheAgentRunsAndWhatIsKeptForTheRest(t *testing.T) {
 		h.Write(context.Background(), Have{Module: NodeModule, Composed: "sha256:" + strings.Repeat("c", 64)})
 		firstPass := func(kept map[string][]json.RawMessage) []delivery.Composed {
 			b := newBed(t)
-			b.env.SelfComposed, b.env.Trusted, b.kept, b.env.Applied, b.env.Haves = true, nil, kept, store, h
+			b.env.SelfComposed, b.kept, b.env.Applied, b.env.Haves = true, kept, store, h
 			firstCh := make(chan []delivery.Composed, 1)
 			comps := b.comps
 			var ag *Agent
@@ -1155,8 +1066,7 @@ func testARemovedModulesCompositionHoldsNothingBack(t *testing.T) {
 	}
 }
 
-// The node's own composition is not applied while a module's composition in the node's bucket cannot be read or is not
-// signed by a trusted key: what that one carries may be what left the node's own, and the node's own apply would remove
+// The node's own composition is not applied while a module's composition in the node's bucket cannot be read: what that one carries may be what left the node's own, and the node's own apply would remove
 // it (issue 1945, the review's gap 2). It is said, naming the composition, and applied once that one reads.
 func TestTheNodesOwnWaitsWhileAModulesCompositionCannotBeRead(t *testing.T) {
 	b := newBed(t)
@@ -1284,11 +1194,11 @@ func TestWhatRunsBeforeTheAgentTakesAModuleNamesItsFilledPaths(t *testing.T) {
 	ck, _ := delivery.ComposedKey(node, "power", fp)
 	applied := delivery.Composed{Node: node, Module: "power", FP: fp, Filled: []string{old, added}, Data: true,
 		Resources: []json.RawMessage{filledFile("settings"), filledFile("bound")}}
-	_, appliedRaw, appliedDig := signedBy(t, applied, ck, controllerKey)
+	_, appliedRaw, appliedDig := encodedAs(t, applied, ck)
 	newer := applied
 	newer.Resources = append([]json.RawMessage{}, applied.Resources...)
 	newer.Resources = append(newer.Resources, file("power", "later", "1"))
-	_, newerRaw, _ := signedBy(t, newer, ck, controllerKey)
+	_, newerRaw, _ := encodedAs(t, newer, ck)
 	for _, tc := range []struct {
 		name string
 		// have is the module's have; bucket the value its composition key holds now, history the revisions kept.
@@ -1371,7 +1281,7 @@ func TestWhatRunsBeforeTheAgentTakesAModuleNamesItsFilledPaths(t *testing.T) {
 // the yes for that composition, and is then applied.
 func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(t *testing.T) {
 	b := newBed(t)
-	b.env.SelfComposed, b.env.Trusted = true, nil
+	b.env.SelfComposed = true
 	b.env.Policy = func(_ context.Context, m string) string {
 		if m == "db" || m == "rec" {
 			return catalogue.PolicyRecord
@@ -1560,6 +1470,19 @@ func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(
 	if _, err := b.ag.Composition(context.Background(), "db", "sha256:"+strings.Repeat("0", 64), false); err == nil {
 		t.Error("a digest no revision has was answered")
 	}
+	// novox/hq ADR 0593 §6: the engine publishes each composition with its plan in its composition state; the verb reads
+	// that revision by the digest its have and want name, its resources' (the plan left out of the digest).
+	planned, _ := delivery.DecodeComposed(draw)
+	planned.Plan = &catalogue.Plan{}
+	praw, err := delivery.EncodeComposed(planned)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keep(dk, praw)
+	if view, err := b.ag.Composition(context.Background(), "db", ddig, false); err != nil || view.Composition.Digest != ddig ||
+		len(view.Revisions) != 3 || view.Revisions[2].Digest != ddig {
+		t.Errorf("db's published revision with its plan, asked by its digest, reads %+v (%v)", view, err)
+	}
 	b.comps.put(dk, draw)
 	eventually(t, "db's have stays waiting-yes after its composition went back to what runs", func() bool {
 		h := b.haves.last("db")
diff --git a/internal/agent/composition.go b/internal/agent/composition.go
index 71ea0e7..938c2aa 100644
--- a/internal/agent/composition.go
+++ b/internal/agent/composition.go
@@ -2,12 +2,12 @@ package agent
 
 import (
 	"context"
-	"crypto/ed25519"
 	"errors"
 	"fmt"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/judge"
 )
 
 // The node-engine seat's read verb composition (issue 774): one module's composition beside what runs of it, so why a
@@ -31,7 +31,7 @@ type CompositionView struct {
 	// Judged is the move from what runs to the composition read, as the agent judges it before an apply.
 	Judged JudgedView `json:"judged"`
 	// Diff is every resource that differs from what runs, when asked.
-	Diff []delivery.ResourceChange `json:"diff,omitempty"`
+	Diff []judge.ResourceChange `json:"diff,omitempty"`
 }
 
 // WantView is a want as the verb shows it.
@@ -171,7 +171,7 @@ func (a *Agent) Composition(ctx context.Context, module, digest string, diff boo
 		}
 		view.Runs = rv
 	}
-	j := delivery.JudgeMove(running, read.C)
+	j := judge.JudgeMove(running, read.C)
 	view.Judged = JudgedView{Judgement: string(j.Judgement), Words: j.Words}
 	if a.env.SelfComposed && a.env.Policy != nil && module != NodeModule && (!w.Present || w.Want.Yes != read.Dig) {
 		switch j.Judgement {
@@ -180,7 +180,7 @@ func (a *Agent) Composition(ctx context.Context, module, digest string, diff boo
 		}
 	}
 	if diff {
-		view.Diff = delivery.ChangedResources(running, read.C)
+		view.Diff = judge.ChangedResources(running, read.C)
 	}
 	return view, nil
 }
@@ -193,8 +193,8 @@ func (a *Agent) compositionKey(module, fp string) (string, error) {
 	return delivery.ComposedKey(a.env.Node, module, fp)
 }
 
-// revisionsOf is every revision of a composition key the bucket keeps, oldest first, each with its digest as this node
-// trusts it (its own unsigned with SelfComposed, else signed by a trusted key), or why it is refused. Nil Revisions
+// revisionsOf is every revision of a composition key the state keeps, oldest first, each with its digest (unsigned, ADR
+// 0593 §6), or why it is refused. Nil Revisions
 // reads none.
 func (a *Agent) revisionsOf(ctx context.Context, key string) ([]compNow, error) {
 	if a.env.Revisions == nil {
@@ -204,10 +204,6 @@ func (a *Agent) revisionsOf(ctx context.Context, key string) ([]compNow, error)
 	if err != nil {
 		return nil, err
 	}
-	var trusted []ed25519.PublicKey
-	if a.env.Trusted != nil {
-		trusted = a.env.Trusted()
-	}
 	var out []compNow
 	for _, u := range revs {
 		if u.Deleted || u.Key != key {
@@ -218,12 +214,7 @@ func (a *Agent) revisionsOf(ctx context.Context, key string) ([]compNow, error)
 			out = append(out, compNow{Raw: u.Value, Rev: u.Revision, Err: err})
 			continue
 		}
-		var dig string
-		if a.env.SelfComposed {
-			dig, err = delivery.ComposedDigestOf(c) // the node's own: unsigned (ADR 0547 §2)
-		} else {
-			dig, err = delivery.VerifyComposed(c, trusted)
-		}
+		dig, err := delivery.ComposedDigestOf(c) // unsigned: a record, never verified (ADR 0593 §6)
 		out = append(out, compNow{Raw: u.Value, C: c, Dig: dig, Rev: u.Revision, Err: err})
 	}
 	return out, nil
diff --git a/internal/beside/beside.go b/internal/beside/beside.go
new file mode 100644
index 0000000..d31ec1d
--- /dev/null
+++ b/internal/beside/beside.go
@@ -0,0 +1,134 @@
+// Package beside is where a test finds another repository of the mesh it reads: the catalogue's manifests,
+// the node-engine's genesis template (novox/hq issue 432), the SDK's conformance fixtures (issue 449).
+//
+// Copied from mesh-controller internal/beside at commit 6c2a8d62 (R4b, issue 1379); the one change is that Dir
+// lays out the captured copy of a repository once per process, not once per test (see laidOut). In mesh-sdk the
+// catalogue's tests read mesh-catalog and mesh-host only; the captured copy holds just what they read.
+//
+// A test used to read the checkout beside this one, `../../../mesh-catalog`, so its verdict depended on
+// whatever sat on the machine running it: a stale or dirty checkout failed it on a desktop, and where none
+// was beside it skipped and said nothing. Now there are two inputs, both named, and no third:
+//
+//   - In a merge check, the build seat clones each core repository beside the one checked (the catalogue
+//     at its main, the node-engine at the commit the mesh runs) and says where in MESH_CHECK_BESIDE. A
+//     test judges against those clones, so agreement with the other repository is checked where
+//     `mesh/repo-check` runs; a repository missing there fails the test, never skips it. Which clones a
+//     check gets is chosen from the inventory: mesh-catalog by the source of the `nats` module, mesh-host
+//     by the source of `mesh-host`, and mesh-sdk as the controller's sibling at the commit the controller's
+//     go.mod pins. Each repository's tests read these siblings, and the checker places exactly these
+//     (mesh-delivery's checker, besideRules, follows this list): mesh-controller's read mesh-catalog,
+//     mesh-host and mesh-sdk; mesh-host's read mesh-catalog, mesh-sdk and mesh-controller (its step-nine
+//     test reads the controller's own manifest, novox/hq issue 1295); mesh-sdk's read mesh-catalog and
+//     mesh-host; mesh-catalog's read mesh-sdk and mesh-controller; mesh-delivery's read mesh-sdk and
+//     mesh-catalog. In a mesh where either module has no source repository nothing is
+//     cloned, and these tests fail loudly with "not beside this check": a cause in the setup, not in the
+//     change. And in a delivery group that holds a mesh-catalog pull request, these tests read the
+//     catalogue's main, not the group's head.
+//   - Anywhere else, the test judges against the copy captured in this repository's testdata/beside, at the
+//     commit testdata/beside/CAPTURED names. Never against a developer's own checkout: to judge one, set
+//     MESH_CHECK_BESIDE to the directory holding it, as the check does.
+//
+// The captured manifests are named module.json.captured, and put back as module.json in a directory of
+// the test's own: a module.json anywhere in this repository is a module of it to the forge's announcer and
+// the planner, and a merge would build and register a hundred copies of the catalogue's.
+package beside
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// Env is where a merge check says the repositories cloned beside the one checked are (internal/builder's
+// EnvBeside, repeated here so a test does not import the builder).
+const Env = "MESH_CHECK_BESIDE"
+
+// CapturedSuffix is what a captured file's name carries that the repository's own does not.
+const CapturedSuffix = ".captured"
+
+// Dir is the named repository a test reads — the clone beside a merge check, or the captured copy — and
+// says which in the test's log.
+func Dir(t testing.TB, repository string) string {
+	t.Helper()
+	if root := os.Getenv(Env); root != "" {
+		dir := filepath.Join(root, repository)
+		if _, err := os.Stat(dir); err != nil {
+			t.Fatalf("%s is not beside this check in %s=%s, so its agreement with this repository cannot be "+
+				"judged here: %v", repository, Env, root, err)
+		}
+		t.Logf("judged against %s as cloned beside this check", dir)
+		return dir
+	}
+	from := filepath.Join(Captured(), repository)
+	if _, err := os.Stat(from); err != nil {
+		t.Fatalf("no captured copy of %s at %s: %v", repository, from, err)
+	}
+	dir, err := layOut(repository, from)
+	if err != nil {
+		t.Fatalf("the captured copy of %s could not be laid out: %v", repository, err)
+	}
+	t.Logf("judged against the copy of %s captured in testdata/beside (see CAPTURED); a merge check "+
+		"judges it against the repository's own clone", repository)
+	return dir
+}
+
+// laidOut is the captured copies already put back in place in this process, by repository. A copy is
+// read-only to every test, so it is laid out once per process and not once per test: with a copy per test
+// the catalogue's tests alone took 2.14 s, over mesh-sdk's unit bound of 2 s, and with one 0.81 s (measured
+// 2026-10-20). The directories are in the temp directory, which the system clears; a process cannot remove
+// them while another test may still read them.
+var (
+	laidOutMu sync.Mutex
+	laidOut   = map[string]string{}
+)
+
+func layOut(repository, from string) (string, error) {
+	laidOutMu.Lock()
+	defer laidOutMu.Unlock()
+	if dir, ok := laidOut[repository]; ok {
+		return dir, nil
+	}
+	root, err := os.MkdirTemp("", "beside-")
+	if err != nil {
+		return "", err
+	}
+	dir := filepath.Join(root, repository)
+	err = filepath.WalkDir(from, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		rel, _ := filepath.Rel(from, path)
+		into := filepath.Join(dir, strings.TrimSuffix(rel, CapturedSuffix))
+		if d.IsDir() {
+			return os.MkdirAll(into, 0o755)
+		}
+		raw, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		return os.WriteFile(into, raw, 0o644)
+	})
+	if err != nil {
+		os.RemoveAll(root)
+		return "", err
+	}
+	laidOut[repository] = dir
+	return dir, nil
+}
+
+// Catalogue is the catalogue's modules directory, as Dir finds the catalogue.
+func Catalogue(t testing.TB) string {
+	t.Helper()
+	return filepath.Join(Dir(t, "mesh-catalog"), "modules")
+}
+
+// Captured is this repository's testdata/beside, found from this file rather than from the working
+// directory, so a test in any package reaches it.
+func Captured() string {
+	_, file, _, _ := runtime.Caller(0)
+	return filepath.Join(filepath.Dir(file), "..", "..", "testdata", "beside")
+}
diff --git a/internal/beside/reads-outside b/internal/beside/reads-outside
new file mode 100644
index 0000000..f6b2d87
--- /dev/null
+++ b/internal/beside/reads-outside
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
diff --git a/internal/bootstrap/genesis_form_test.go b/internal/bootstrap/genesis_form_test.go
index dda3852..b196c84 100644
--- a/internal/bootstrap/genesis_form_test.go
+++ b/internal/bootstrap/genesis_form_test.go
@@ -237,35 +237,3 @@ func TestAFileNothingOfTheControllerWritesIsStillRefused(t *testing.T) {
 		t.Fatalf("a file nothing writes was accepted, or refused without its name: %v", err)
 	}
 }
-
-// The controller's own manifest, as the mesh runs it, passes step 9 (issue 597): in a merge check the
-// node-engine's check has the controller cloned beside it (MESH_CHECK_BESIDE), where it must be; else a
-// checkout beside this one; else it skips aloud.
-//
-// The checker places the controller beside this repository (mesh-delivery's besideRules, since R4g, issue 1295), so a
-// MESH_CHECK_BESIDE without a mesh-controller directory, or without its module.json, fails. Only a run with no
-// MESH_CHECK_BESIDE and no checkout beside this one (a developer's clone alone) skips aloud.
-func TestTheControllersOwnManifestPassesStepNine(t *testing.T) {
-	var manifest []byte
-	if root := os.Getenv("MESH_CHECK_BESIDE"); root != "" {
-		if info, err := os.Stat(filepath.Join(root, "mesh-controller")); err != nil || !info.IsDir() {
-			t.Fatalf("the controller is not beside this check in MESH_CHECK_BESIDE=%s: the checker places mesh-controller beside the node-engine's check (mesh-delivery besideRules, issue 1295), and this test judges the controller's own manifest", root)
-		}
-		raw, err := os.ReadFile(filepath.Join(root, "mesh-controller", "module.json"))
-		if err != nil {
-			t.Fatalf("the controller is not beside this check in MESH_CHECK_BESIDE=%s: %v", root, err)
-		}
-		manifest = raw
-	} else if raw, err := os.ReadFile(filepath.Join("..", "..", "..", "mesh-controller", "module.json")); err == nil {
-		manifest = raw
-	} else {
-		t.Skip("NOT JUDGED: no controller beside this checkout and no MESH_CHECK_BESIDE; the merge check judges it")
-	}
-	wanted, err := theStepNineSecretsOf(t, manifest)
-	if err != nil {
-		t.Fatalf("genesis's step 9 refuses the controller the mesh runs: %v", err)
-	}
-	if wanted["MESH_STORE_INVENTORY"] != "inventory" {
-		t.Errorf("step 9 delivers %v", wanted)
-	}
-}
diff --git a/internal/compose/composed.go b/internal/compose/composed.go
new file mode 100644
index 0000000..fffd0b8
--- /dev/null
+++ b/internal/compose/composed.go
@@ -0,0 +1,560 @@
+package compose
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// Compositions is one node's compositions (novox/hq ADR 0539 clauses 1 and 2): its declaration composed over in, as
+// the controller composes it, split into each module's composition at the fingerprint fps gives it and the node's own
+// (`<node>.node`), by key (delivery.ComposedKey). Each resource says its module, whatever the node reported it reads.
+// A module fps gives no fingerprint for is not composed and is named in skipped, so a caller composing one module
+// gets that one; but for a module the node runs inside its own composition (Node.InOwn, and the
+// private network's always), which fps names at no fingerprint of the new form: its resources go into the node's own,
+// their module taken off and their ids still naming it, and its filled paths with them, as the controller's composed
+// writer folds them (issue 1126). Each module's Data says whether its manifest declares data. The compositions are unsigned
+// (ADR 0593 §6) and not yet by digest (Composed.ByDigest).
+func Compositions(in Input, node string, fps map[string]string, mode Mode) (out map[string]delivery.Composed, skipped []string, err error) {
+	out, skipped, _, err = compositions(in, node, fps, mode, false)
+	return out, skipped, err
+}
+
+// ErrStoodIn is a composition that holds a stand-in for a value the input does not carry (an own secret, a grant's
+// sealed copy, a vault box, the certificate, the bus's user list) or a port it does not give: what a send would make,
+// never what may be applied.
+var ErrStoodIn = errors.New("compose: the composition stands in for what its input does not carry")
+
+// BusUsersStandIn is what a composition says it stood in for when its input carries no bus user list.
+const BusUsersStandIn = "the bus's user list"
+
+// CompositionsApplied is Compositions for a node that applies what it composed itself (novox/hq ADR 0547 §2, issue
+// 1126): a declaration that stands in for anything (Declared.StoodIn, Foreseen, ForeseenPorts) is refused with
+// ErrStoodIn, naming each, so a stand-in is never applied as if it were the value; but for the bus's user list
+// (BusUsersStandIn), which the bus node holds out of every apply of a composition it made itself.
+func CompositionsApplied(in Input, node string, fps map[string]string) (map[string]delivery.Composed, []string, error) {
+	out, skipped, _, err := compositions(in, node, fps, Reading, true)
+	return out, skipped, err
+}
+
+// CompositionsShadow is CompositionsApplied for a composition that is compared and never applied (a node's answer to a
+// placement candidate, novox/hq ADR 0559 §4): composed in the Foreseeing mode, so an own secret never issued (a module
+// the candidate adds) is a named stand-in rather than an error, and what it stands in for is answered (stood, sorted,
+// the bus's user list left out) rather than refused, so the caller judges each stand-in: a value not yet issued for a
+// module the candidate adds, or one missing for a module the node runs. A module whose every value is held composes
+// as CompositionsApplied composes it: the modes differ only in an own secret never issued.
+func CompositionsShadow(in Input, node string, fps map[string]string) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+	return compositions(in, node, fps, Foreseeing, false)
+}
+
+// CompositionsIn is the node's compositions in mode with what they stand in for answered (stood, sorted, the bus's user
+// list left out) rather than refused: CompositionsShadow in Foreseeing, and in Reading what CompositionsApplied refuses
+// before it is refused, so a caller that applies refuses each stand-in to the module it is for alone (issue 1126).
+func CompositionsIn(in Input, node string, fps map[string]string, mode Mode) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+	return compositions(in, node, fps, mode, false)
+}
+
+func compositions(in Input, node string, fps map[string]string, mode Mode, applied bool) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+	reading := in
+	reading.Nodes = append([]Node(nil), in.Nodes...)
+	found := false
+	inOwn := map[string]bool{}
+	held := map[string]bool{}
+	for i := range reading.Nodes {
+		if reading.Nodes[i].Name == node {
+			reading.Nodes[i].ReadsModules = true
+			found = true
+			for m, ok := range reading.Nodes[i].InOwn {
+				inOwn[m] = ok
+			}
+			for m, ok := range reading.Nodes[i].Held {
+				held[m] = ok
+			}
+		}
+	}
+	// The private network's module is built by nobody: no fingerprint of the new form ever names it.
+	inOwn[overlay.Name] = true
+	folds := func(module string) bool {
+		return module != "" && inOwn[module] && !strings.HasPrefix(fps[module], delivery.SourcePrefix2)
+	}
+	if !found {
+		return nil, nil, nil, fmt.Errorf("compose: the mesh has no node %q", node)
+	}
+	// A folded module built by a build of the old form (Node.RunsOwn) is left to the node: composed from what runs of it
+	// (Carried), so what it provides and requires still shapes the rest and what the others read of it (its published
+	// ports, the paths it owns) is what runs, and its resources are then the ones the node runs.
+	carried := map[string]bool{}
+	var runsOwn *delivery.Composed
+	for i := range reading.Nodes {
+		n := &reading.Nodes[i]
+		if n.Name != node || n.RunsOwn == nil {
+			continue
+		}
+		runsOwn = n.RunsOwn
+		candidates := map[string]bool{}
+		for m := range inOwn {
+			candidates[m] = true
+		}
+		for m := range held {
+			candidates[m] = true
+		}
+		for m := range candidates {
+			// A held module is carried as it runs wherever the node's own runs it, folded or leaving the fold for a
+			// composition of its own (its want new, its names still unset): its stub is never what the node's own applies,
+			// and what the node's own applies never drops what runs of it (issue 1126, review of the apply; issue 1945).
+			heldHere := held[m] && RunsAnyOf(runsOwn, m)
+			if !folds(m) && !heldHere {
+				continue
+			}
+			man, ok := n.Kept[m]
+			if !ok {
+				man, ok = reading.Catalogue[m]
+			}
+			if !ok || (!NamesBuild(man) && !held[m]) {
+				continue
+			}
+			carried[m] = true
+			kept := make(map[string]catalogue.Manifest, len(n.Kept)+1)
+			for k, v := range n.Kept {
+				kept[k] = v
+			}
+			kept[m] = Carried(man, m, runsOwn)
+			n.Kept = kept
+		}
+	}
+	// A module composed as what runs of it contributes to the runtime what the runtime serves of it as it runs
+	// (Node.RunsTools); one of its own account is served by a runtime of its own, from its manifest as before.
+	for i := range reading.Nodes {
+		n := &reading.Nodes[i]
+		if n.Name != node || n.RunsTools == nil {
+			continue
+		}
+		kept := make(map[string]catalogue.Manifest, len(n.Kept))
+		for m, man := range n.Kept {
+			if man.Stubbed && man.RunsAs == "" {
+				man.Bundles = runningBundles(n.RunsTools[m], reading.Catalogue[m])
+			}
+			kept[m] = man
+		}
+		n.Kept = kept
+	}
+	isCarried := func(module, id string) bool {
+		if module == "" {
+			module, _ = declaration.ModuleGuess(id)
+		}
+		return carried[module]
+	}
+	d, problems, err := ComposeIn(reading, node, mode)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	if len(problems) > 0 {
+		return nil, nil, nil, fmt.Errorf("compose: %s's declaration is refused by the node-engine's validator: %v", node, problems)
+	}
+	for _, x := range d.StoodIn {
+		// The bus's user list is the bus node's own to follow, written alone and never from a composition the node
+		// made itself (ADR 0547 §7, §8): its stand-in is held out of the apply, not applied.
+		if x != BusUsersStandIn {
+			stood = append(stood, x)
+		}
+	}
+	stood = append(stood, d.Foreseen...)
+	for _, p := range d.ForeseenPorts {
+		stood = append(stood, "port "+p)
+	}
+	sort.Strings(stood)
+	stood = slices.Compact(stood) // an own secret is both stood in for and foreseen
+	if applied && len(stood) > 0 {
+		return nil, nil, nil, fmt.Errorf("%w on %s: %s", ErrStoodIn, node, strings.Join(stood, ", "))
+	}
+	body, err := d.Body()
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	var envelope struct {
+		Resources   []json.RawMessage     `json:"resources"`
+		Adoption    *declaration.Adoption `json:"adoption"`
+		Filled      []string              `json:"filled_files"`
+		Provisioner string                `json:"provisioner_account"`
+	}
+	if err := json.Unmarshal(body, &envelope); err != nil {
+		return nil, nil, nil, err
+	}
+	var kept []json.RawMessage
+	keptPaths := map[string]bool{}
+	foldedPaths := map[string]bool{}
+	left := map[string]bool{}
+	for _, raw := range envelope.Resources {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+			Type   string `json:"type"`
+			Path   string `json:"path"`
+		}
+		if err := json.Unmarshal(raw, &head); err != nil {
+			return nil, nil, nil, err
+		}
+		if isCarried(head.Module, head.ID) {
+			continue // what the stub composed of it: the node's own carries what runs of it instead
+		}
+		if folds(head.Module) {
+			// Into the node's own, in its place among the node's resources, its module taken off (mesh-controller's
+			// compositionsOf): the node's own composition is then the controller's, byte for byte.
+			var fields map[string]json.RawMessage
+			if err := json.Unmarshal(raw, &fields); err != nil {
+				return nil, nil, nil, err
+			}
+			delete(fields, "module")
+			if raw, err = json.Marshal(fields); err != nil {
+				return nil, nil, nil, err
+			}
+			if head.Type == string(declaration.TypeFile) {
+				foldedPaths[head.Path] = true
+			}
+			kept = append(kept, raw)
+			continue
+		}
+		if _, ok := fps[head.Module]; head.Module != "" && !ok {
+			left[head.Module] = true
+			continue
+		}
+		if head.Type == string(declaration.TypeFile) {
+			keptPaths[head.Path] = true
+		}
+		kept = append(kept, raw)
+	}
+	// What runs of each carried module, in the node's own composition, each after the resource it runs after.
+	if len(carried) > 0 {
+		var err error
+		if kept, foldedPaths, err = carry(kept, foldedPaths, runsOwn, isCarried); err != nil {
+			return nil, nil, nil, err
+		}
+		for _, p := range runsOwn.Filled {
+			if foldedPaths[p] && !slices.Contains(envelope.Filled, p) {
+				envelope.Filled = append(envelope.Filled, p)
+			}
+		}
+	}
+	// A filled file of a module's own composition goes with that module (SplitComposed); one of a folded module goes with
+	// the node's own, after them, in the declaration's order; one of a module left out is dropped.
+	var filled, ownFilled []string
+	for _, p := range envelope.Filled {
+		switch {
+		case foldedPaths[p]:
+			ownFilled = append(ownFilled, p)
+		case keptPaths[p]:
+			filled = append(filled, p)
+		}
+	}
+	out, err = delivery.SplitComposed(node, kept, fps, filled,
+		delivery.NodeOwn{Adoption: envelope.Adoption, Provisioner: envelope.Provisioner})
+	if err != nil {
+		return nil, nil, nil, err
+	}
+	if len(ownFilled) > 0 {
+		own, err := delivery.ComposedNodeKey(node)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		c := out[own]
+		c.Filled = append(c.Filled, ownFilled...)
+		out[own] = c
+	}
+	for key, c := range out {
+		if held[c.Module] {
+			delete(out, key) // its stub's: the node keeps what it last applied of it (Node.Held)
+			continue
+		}
+		if m, ok := in.Catalogue[c.Module]; ok && c.Module != "" {
+			c.Data = len(m.DataItems()) > 0
+			out[key] = c
+		}
+	}
+	for m := range left {
+		skipped = append(skipped, m)
+	}
+	sort.Strings(skipped)
+	return out, skipped, stood, nil
+}
+
+// RunsAnyOf says runs (a composition as it runs) holds a resource of module, by its module or the module its id names.
+func RunsAnyOf(runs *delivery.Composed, module string) bool {
+	if runs == nil {
+		return false
+	}
+	for _, raw := range runs.Resources {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+		}
+		if json.Unmarshal(raw, &head) != nil {
+			continue
+		}
+		owner := head.Module
+		if owner == "" {
+			owner, _ = declaration.ModuleGuess(head.ID)
+		}
+		if owner == module {
+			return true
+		}
+	}
+	return false
+}
+
+// ToolsRunning is, by module, the tools bundles that run on the node (Node.RunsTools): each bundle archive a module's
+// resource unpacks at its BundlePath, with what the runtime's own process loads of it and the words it hands it
+// (catalogue.RuntimeToolModules, catalogue.RuntimeToolEnv, the mesh's own words left out). A bundle the runtime loads
+// nothing of has no Loads: the runtime dropped it, and the composition reads its loads again from the module's build
+// (issue 1126, review: shanks had already applied the drop of systemd-resolved). Nil when running holds no runtime process.
+func ToolsRunning(running []delivery.Composed) map[string][]catalogue.Bundle {
+	runtimeID := catalogue.RuntimeModule + "." + resolution.RuntimeProcessID()
+	type resource struct {
+		ID     string            `json:"id"`
+		Module string            `json:"module"`
+		Type   string            `json:"type"`
+		Path   string            `json:"path"`
+		Source string            `json:"source"`
+		Digest string            `json:"digest"`
+		Env    map[string]string `json:"env"`
+	}
+	var env map[string]string
+	out := map[string][]catalogue.Bundle{}
+	for _, c := range running {
+		for _, raw := range c.Resources {
+			var r resource
+			if json.Unmarshal(raw, &r) != nil {
+				continue
+			}
+			owner := r.Module
+			if owner == "" {
+				owner, _ = declaration.ModuleGuess(r.ID)
+			}
+			switch {
+			case r.Type == "process" && r.ID == runtimeID && owner == catalogue.RuntimeModule:
+				env = r.Env
+			case r.Type == "archive" && owner != "" && strings.HasPrefix(r.ID, owner+"."+resolution.BundleID("")):
+				name := strings.TrimPrefix(r.ID, owner+"."+resolution.BundleID(""))
+				if r.Path == resolution.BundlePath(owner, name) {
+					out[owner] = append(out[owner], catalogue.Bundle{Name: name, Source: catalogue.Recorded(r.Source), Digest: r.Digest})
+				}
+			}
+		}
+	}
+	if env == nil {
+		return nil
+	}
+	var words map[string]map[string]string
+	_ = json.Unmarshal([]byte(env[catalogue.RuntimeToolEnv]), &words)
+	for _, entry := range strings.Split(env[catalogue.RuntimeToolModules], ",") {
+		module, path, ok := strings.Cut(entry, "=")
+		if !ok || !strings.HasPrefix(path, catalogue.BundleRoot+"/"+module+"/") {
+			continue
+		}
+		name, load, ok := strings.Cut(strings.TrimPrefix(path, catalogue.BundleRoot+"/"+module+"/"), "/")
+		bundles := out[module]
+		i := slices.IndexFunc(bundles, func(b catalogue.Bundle) bool { return b.Name == name })
+		if !ok || i < 0 {
+			continue // no archive of it runs: nothing to load
+		}
+		var own map[string]string
+		for w, v := range words[module] {
+			if w == catalogue.FilesOwnedPaths || w == catalogue.ReadsSecretPlaces {
+				continue // the mesh's to say, composed again
+			}
+			if own == nil {
+				own = map[string]string{}
+			}
+			own[w] = v
+		}
+		bundles[i].Loads = append(bundles[i].Loads, load)
+		bundles[i].Env = own
+	}
+	for _, bundles := range out {
+		sort.Slice(bundles, func(i, j int) bool { return bundles[i].Name < bundles[j].Name })
+	}
+	return out
+}
+
+// runningBundles is the bundles of a module composed as what runs of it (Node.RunsTools): each that runs, with what the
+// runtime loads of it and its words; one the runtime loads nothing of takes its loads and words from the module's build
+// (man: its built bundles, else its build's artifacts, catalogue.BundleLoads), so a drop already applied is undone.
+func runningBundles(runs []catalogue.Bundle, man catalogue.Manifest) []catalogue.Bundle {
+	var out []catalogue.Bundle
+	for _, b := range runs {
+		if len(b.Loads) == 0 {
+			for _, built := range man.Bundles {
+				if built.Name == b.Name {
+					b.Loads, b.Env, b.Launchers, b.Binary = built.Loads, built.Env, built.Launchers, built.Binary
+				}
+			}
+			if man.Build != nil {
+				run := resolution.RunByAResource(man)
+				for _, a := range man.Build.Artifacts {
+					if a.Kind == catalogue.ArtifactBundle && a.Name == b.Name {
+						b.Loads, b.Env, b.Binary = catalogue.BundleLoads(man, a, run), a.Env, catalogue.BinaryOf(a)
+					}
+				}
+			}
+		}
+		out = append(out, b)
+	}
+	return out
+}
+
+// NamesBuild says a manifest names what a build makes: its build, or a resource naming an artifact. A node cannot
+// compose such a module folded into its own composition: the build of the old form it runs is held by the controller
+// alone (issue 1126).
+func NamesBuild(m catalogue.Manifest) bool {
+	if m.Build != nil {
+		return true
+	}
+	for _, r := range m.Resources {
+		if _, ok := r["artifact"]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// Stub is m with nothing to build and no resource but its directories: what it provides, requires, serves and grants
+// still shape the rest of the composition, the places its own secrets, data and grants name (${dir:…}) still resolve,
+// and nothing else of its own is composed (issue 1126: nats's ${dir:mesh-state} on novox). A module refused in a
+// node's answer is composed so; a folded one the node runs is Carried.
+func Stub(m catalogue.Manifest) catalogue.Manifest {
+	// The paths it owns stay its manifest's, as the controller tells the holder of node-files them (issue 1126, seed-8).
+	if m.OwnsPaths == nil {
+		m.OwnsPaths = resolution.DeclaredPaths(m)
+	}
+	m.Build = nil
+	// What it hands the provisioner is left out as it runs, not refused for want of a plan (catalogue.Manifest.Stubbed).
+	m.Stubbed = true
+	// Nor is a template its build kept for its own files handed: a stub carries none of them (issue 1126: novox's node
+	// refused "postgres: its build kept a template for consumers, which it does not declare" with postgres held). Its
+	// items stay, and the templates they render through: a held module's contributions to other modules' collections
+	// (seat contributions, shell blocks, seat data) still reach their collectors.
+	if m.Handed != nil {
+		h := *m.Handed
+		h.Templates = nil
+		m.Handed = &h
+	}
+	var dirs []map[string]any
+	for _, r := range m.Resources {
+		if r["type"] == "directory" {
+			dirs = append(dirs, r)
+		}
+	}
+	m.Resources = dirs
+	return m
+}
+
+// Carried is m, folded into its node's own composition at a build of the old form, as the node runs it (issue 1126,
+// C5): nothing to build; its containers and directories those the node's own composition (runs) carries of it, their
+// module's word taken off their ids, with the manifest's directories it does not run. So what other modules read of it
+// is what runs: the machine ports its containers publish (the filter's rules, the routes reaching it: MachineSide). The
+// paths it owns, which the holder of node-files is told, are its manifest's, as for its Stub: the controller composes
+// them from the manifest, not from every path a resource of it runs at (issue 1126, seed-8: f1-circuits, snake and
+// txt-game on ace, whose manifests leave their directories to the mesh). Its other resources are not taken, since the
+// composition makes some of them again from its manifest (its secrets' files) and one id twice is refused; none of them
+// is composed into what is applied either way (compositions leaves a carried module's out, and carries the ones that
+// run). What it provides, requires, listens on and grants is its manifest's. A module whose resources runs holds none
+// of is its Stub, as before.
+func Carried(m catalogue.Manifest, module string, runs *delivery.Composed) catalogue.Manifest {
+	if runs == nil {
+		return Stub(m)
+	}
+	var taken []map[string]any
+	runsAny := false
+	ids := map[string]bool{}
+	for _, raw := range runs.Resources {
+		var r map[string]any
+		if json.Unmarshal(raw, &r) != nil {
+			continue
+		}
+		id, _ := r["id"].(string)
+		owner, _ := r["module"].(string)
+		if owner == "" {
+			owner, _ = declaration.ModuleGuess(id)
+		}
+		if owner != module {
+			continue
+		}
+		runsAny = true
+		if typ := r["type"]; typ != "container" && typ != "directory" {
+			continue
+		}
+		r["id"] = strings.TrimPrefix(id, module+".")
+		delete(r, "module")
+		ids[r["id"].(string)] = true
+		taken = append(taken, r)
+	}
+	if !runsAny {
+		return Stub(m)
+	}
+	stub := Stub(m)
+	for _, r := range stub.Resources {
+		if id, _ := r["id"].(string); !ids[id] {
+			taken = append(taken, r)
+		}
+	}
+	stub.Resources = taken
+	return stub
+}
+
+// carry puts into the node's resources (kept, in the declaration's order) the resources of the node's own composition as
+// it runs (runs) that belong to a carried module, each after the resource it runs after, or first when that one is
+// not among them; a file among them is a folded path.
+func carry(kept []json.RawMessage, foldedPaths map[string]bool, runs *delivery.Composed, carried func(module, id string) bool) ([]json.RawMessage, map[string]bool, error) {
+	idOf := func(raw json.RawMessage) (string, string, string, string, error) {
+		var head struct {
+			ID     string `json:"id"`
+			Module string `json:"module"`
+			Type   string `json:"type"`
+			Path   string `json:"path"`
+		}
+		err := json.Unmarshal(raw, &head)
+		return head.ID, head.Module, head.Type, head.Path, err
+	}
+	present := map[string]bool{}
+	for _, raw := range kept {
+		if id, module, _, _, err := idOf(raw); err == nil && module == "" {
+			present[id] = true
+		}
+	}
+	// By the id of the resource of the node's own it runs after, "" for first: the last one before it that is composed.
+	after := map[string][]json.RawMessage{}
+	anchor := ""
+	for _, raw := range runs.Resources {
+		id, module, typ, path, err := idOf(raw)
+		if err != nil {
+			return nil, nil, fmt.Errorf("compose: a resource the node runs in its own composition: %w", err)
+		}
+		if !carried(module, id) {
+			if module == "" && present[id] {
+				anchor = id
+			}
+			continue
+		}
+		after[anchor] = append(after[anchor], raw)
+		if typ == string(declaration.TypeFile) {
+			foldedPaths[path] = true
+		}
+	}
+	out := make([]json.RawMessage, 0, len(kept)+len(runs.Resources))
+	out = append(out, after[""]...)
+	for _, raw := range kept {
+		out = append(out, raw)
+		if id, module, _, _, err := idOf(raw); err == nil && module == "" {
+			out = append(out, after[id]...)
+		}
+	}
+	return out, foldedPaths, nil
+}
diff --git a/internal/compose/composed_test.go b/internal/compose/composed_test.go
new file mode 100644
index 0000000..35091c1
--- /dev/null
+++ b/internal/compose/composed_test.go
@@ -0,0 +1,201 @@
+package compose
+
+import (
+	"encoding/json"
+	"sort"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+func fpFor(c byte) string { return delivery.SourcePrefix2 + strings.Repeat(string(c), 64) }
+
+// 1943/AC5: a node's compositions are its declaration as Compose gives it, split by the module each resource belongs
+// to: every resource once, each in its module's composition at the fingerprint given, the module's ownership said on
+// it; a module given no fingerprint is named as skipped and composed nowhere.
+func TestCompositionsAreTheDeclarationSplitByModule(t *testing.T) {
+	in := aSmallMesh(t)
+	d, _, err := Compose(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var want []string
+	for _, r := range d.Resources {
+		want = append(want, r["type"].(string)+":"+r["id"].(string))
+	}
+	sort.Strings(want)
+
+	fps := map[string]string{"mesh-wireguard": fpFor('a'), "files": fpFor('b')}
+	out, skipped, err := Compositions(in, "laptop", fps, Foreseeing)
+	if err != nil || len(skipped) != 0 {
+		t.Fatalf("Compositions = %v, skipped %v", err, skipped)
+	}
+	var got []string
+	for key, c := range out {
+		node, module, fp, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || node != "laptop" || module != c.Module || fp != c.FP || (isNode != (module == "")) {
+			t.Errorf("key %s holds %s at %s (%v)", key, c.Module, c.FP, err)
+		}
+		if !isNode && fp != fps[module] {
+			t.Errorf("%s is composed at %s, given %s", module, fp, fps[module])
+		}
+		if _, err := delivery.EncodeComposed(c); err != nil {
+			t.Errorf("%s: %v", key, err)
+		}
+		for _, raw := range c.Resources {
+			var r struct{ ID, Type, Module string }
+			_ = json.Unmarshal(raw, &r)
+			if r.Module != module {
+				t.Errorf("%s holds %s of %q", key, r.ID, r.Module)
+			}
+			got = append(got, r.Type+":"+r.ID)
+		}
+	}
+	sort.Strings(got)
+	if strings.Join(got, " ") != strings.Join(want, " ") {
+		t.Errorf("the compositions hold %v, the declaration %v", got, want)
+	}
+
+	one, skipped, err := Compositions(in, "laptop", map[string]string{"mesh-wireguard": fpFor('a')}, Foreseeing)
+	if err != nil || strings.Join(skipped, ",") != "files" {
+		t.Fatalf("one module: %v, skipped %v", err, skipped)
+	}
+	for _, c := range one {
+		if c.Module == "files" {
+			t.Errorf("a module given no fingerprint was composed")
+		}
+	}
+
+	// Issue 1126: a module the node runs inside its own composition (Node.InOwn), and the private network's always,
+	// given no fingerprint of the new form, is folded into the node's own as the controller's composed writer folds it:
+	// every resource in its place, its module taken off, its id still naming it, nothing skipped.
+	folding := in
+	folding.Nodes = append([]Node(nil), in.Nodes...)
+	for i := range folding.Nodes {
+		if folding.Nodes[i].Name == "laptop" {
+			folding.Nodes[i].InOwn = map[string]bool{"files": true}
+		}
+	}
+	all, skipped, err := Compositions(folding, "laptop", nil, Foreseeing)
+	nodeKey, _ := delivery.ComposedNodeKey("laptop")
+	if err != nil || len(skipped) != 0 || len(all) != 1 || len(all[nodeKey].Resources) != len(want) {
+		t.Fatalf("folded: %v, skipped %v, %d compositions, %d of %d resources in the node's own", err, skipped, len(all), len(all[nodeKey].Resources), len(want))
+	}
+	for i, raw := range all[nodeKey].Resources {
+		var r map[string]any
+		_ = json.Unmarshal(raw, &r)
+		if _, says := r["module"]; says || r["id"] != d.Resources[i]["id"] {
+			t.Errorf("folded resource %d is %v, the declaration's %v", i, r["id"], d.Resources[i]["id"])
+		}
+	}
+	if _, err := delivery.EncodeComposed(all[nodeKey]); err != nil {
+		t.Errorf("the node's own with the folded modules: %v", err)
+	}
+	if _, _, err := Compositions(in, "nowhere", fps, Foreseeing); err == nil {
+		t.Errorf("a node the mesh does not have was composed")
+	}
+
+	// Issue 1126, 2026-10-29: a module composed as what runs of it (folded at a build of the old form, or held) still
+	// contributes to the runtime what the runtime serves of it as it runs (Node.RunsTools): its manifest at the
+	// indexer's commit has no bundles (shanks's runtime lost the folded systemd-resolved, novox's the folded nats), and a
+	// held module's new build's bundles are not delivered.
+	dg := func(c byte) string { return "sha256:" + strings.Repeat(string(c), 64) }
+	runtime := catalogue.Manifest{Module: catalogue.RuntimeModule, Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/node-tools/broker"}},
+		Bundles: []catalogue.Bundle{{Name: "runtime", Source: catalogue.ArtifactStoreScheme + "node-tools/runtime/blobs/" + dg('a'),
+			Digest: dg('a'), Language: "go", Binary: "node-tools"}}}
+	store := catalogue.Manifest{Module: "artifacts", Version: "1",
+		Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5100}}}
+	lamp := catalogue.Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
+		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/lamp", "mode": "0700"}},
+		Build: &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "tools", Kind: catalogue.ArtifactBundle,
+			Language: "go", System: "arch", From: "cmd/lamp-tools", Env: map[string]string{"LAMP_CONF": "/var/lib/lamp/conf"}}}}}
+	newLamp, err := lamp.Resolve([]catalogue.Built{{Name: "tools", Kind: catalogue.ArtifactBundle,
+		Reference: catalogue.ArtifactStoreScheme + "lamp/tools/blobs/" + dg('c'), Digest: dg('c')}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	served := "lamp=" + resolution.BundlePath("lamp", "tools") + "/lamp-tools"
+	runtimeRuns := func(dropped bool) delivery.Composed {
+		env := `"MESH_TOOL_MODULES":"` + served + `","MESH_TOOL_ENV":"{\"lamp\":{\"LAMP_CONF\":\"/var/lib/lamp/conf\"}}"`
+		if dropped {
+			env = `"MESH_TOOL_MODULES":""` // the drop already applied (shanks, 2026-10-29)
+		}
+		return delivery.Composed{Node: "anchor", Module: catalogue.RuntimeModule, Resources: []json.RawMessage{json.RawMessage(
+			`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{` + env + `}}`)}}
+	}
+	lampRuns := `{"id":"lamp.bundle-tools","type":"archive","source":"` + catalogue.ArtifactStoreScheme + `lamp/tools/blobs/` + dg('b') +
+		`","digest":"` + dg('b') + `","path":"` + resolution.BundlePath("lamp", "tools") + `"}`
+	for _, row := range []struct {
+		name    string
+		set     func(n *Node) delivery.Composed // and what runs of lamp
+		fps     map[string]string
+		dropped bool
+	}{
+		{"folded at a build of the old form", func(n *Node) delivery.Composed {
+			n.InOwn = map[string]bool{"lamp": true}
+			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
+			return *n.RunsOwn
+		}, map[string]string{}, false},
+		{"folded, the runtime already dropped it", func(n *Node) delivery.Composed {
+			n.InOwn = map[string]bool{"lamp": true}
+			n.RunsOwn = &delivery.Composed{Node: "anchor", Resources: []json.RawMessage{json.RawMessage(lampRuns)}}
+			return *n.RunsOwn
+		}, map[string]string{}, true},
+		{"held, its new build not delivered", func(n *Node) delivery.Composed {
+			n.Held = map[string]bool{"lamp": true}
+			lr := delivery.Composed{Node: "anchor", Module: "lamp", Resources: []json.RawMessage{json.RawMessage(
+				strings.Replace(lampRuns, `"type"`, `"module":"lamp","type"`, 1))}}
+			n.Kept = map[string]catalogue.Manifest{"lamp": Carried(newLamp, "lamp", &lr)}
+			return lr
+		}, map[string]string{"lamp": fpFor('1')}, false},
+	} {
+		tools := aMesh(t)
+		tools.Catalogue[catalogue.RuntimeModule], tools.Catalogue["artifacts"], tools.Catalogue["lamp"] = runtime, store, lamp
+		anchor := nodeOf(t, &tools, "anchor")
+		anchor.Assigned = append(anchor.Assigned, "artifacts", catalogue.RuntimeModule, "lamp")
+		tools.BusMinted = []string{"anchor." + catalogue.RuntimeModule}
+		anchor.SealingKey = keyOf(t, "anchor")
+		anchor.RunsTools = ToolsRunning([]delivery.Composed{runtimeRuns(row.dropped), row.set(anchor)})
+		row.fps[overlay.Name], row.fps["artifacts"], row.fps[catalogue.RuntimeModule] = fpFor('a'), fpFor('5'), fpFor('e')
+		out, _, _, err := CompositionsIn(tools, "anchor", row.fps, Foreseeing)
+		if err != nil {
+			t.Fatalf("%s: %v", row.name, err)
+		}
+		var env map[string]any
+		for _, c := range out {
+			for _, raw := range c.Resources {
+				var r struct {
+					ID  string         `json:"id"`
+					Env map[string]any `json:"env"`
+				}
+				if json.Unmarshal(raw, &r) == nil && r.ID == "node-tools.runtime" {
+					env = r.Env
+				}
+			}
+		}
+		if env[catalogue.RuntimeToolModules] != served || env[catalogue.RuntimeToolEnv] != `{"lamp":{"LAMP_CONF":"/var/lib/lamp/conf"}}` {
+			t.Errorf("%s: the runtime serves %v with %v, want what runs of lamp, %s", row.name,
+				env[catalogue.RuntimeToolModules], env[catalogue.RuntimeToolEnv], served)
+		}
+	}
+}
+
+// 1943/AC1: the upgrade policies and sources a composition's value may name are the catalogue's own words.
+func TestTheComposedPoliciesAreTheCatalogues(t *testing.T) {
+	for _, p := range []string{catalogue.PolicyRoll, catalogue.PolicyTogether, catalogue.PolicyRecord} {
+		for _, from := range []string{catalogue.FromPerson, catalogue.FromModule, catalogue.FromBus, catalogue.FromData, catalogue.FromDefault} {
+			v := delivery.ComposedDigest{Digest: "sha256:" + strings.Repeat("a", 64), Judgement: delivery.JudgedNeither, Policy: p, PolicyFrom: from}
+			if _, err := delivery.EncodeComposedDigest(v); err != nil {
+				t.Errorf("%s from %s: %v", p, from, err)
+			}
+		}
+	}
+	if delivery.PolicyRecord != catalogue.PolicyRecord {
+		t.Errorf("delivery.PolicyRecord = %q, the catalogue's %q", delivery.PolicyRecord, catalogue.PolicyRecord)
+	}
+}
diff --git a/internal/compose/credentials.go b/internal/compose/credentials.go
new file mode 100644
index 0000000..374302d
--- /dev/null
+++ b/internal/compose/credentials.go
@@ -0,0 +1,499 @@
+package compose
+
+import (
+	"crypto/ecdh"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// Mode says what a composition does about what a send would make. Both modes read what the Input holds and make nothing; they
+// differ as the controller's Reading and Foreseeing modes do.
+type Mode int
+
+const (
+	// Reading composes what is held and leaves out an own secret the Input holds none for: that machine cannot be running it.
+	Reading Mode = iota
+	// Foreseeing composes an own secret the next send would make with a stand-in and names it foreseen, while one the send would
+	// refuse (a bus credential nobody issued, a given secret under an old key) is refused here, in the same words.
+	Foreseeing
+	// Planning composes for a provisioning plan alone (novox/hq ADR 0570 clause 2): every own secret the Input holds none
+	// for stands in, named foreseen, and nothing is refused for a value, since a plan names secrets and never carries one.
+	// The seat mesh-provisioner's holder composes so, reading no secret; a rendering in this mode is never applied.
+	Planning
+)
+
+// ForeseenCertificate and ForeseenBusUsers stand for what the Input does not carry, in a composition asked ahead of the send.
+// Never sent.
+const (
+	ForeseenCertificate = "foreseen: issued by the next send"
+	ForeseenBusUsers    = "foreseen: composed from the bus records by the next send"
+)
+
+// grantsFor is every credential this node must create, because something elsewhere uses it (plan.go grantsFor): the mirror of
+// what a consumer is given. A consumer whose identity overflows the provision's bound is left out of the grants and returned
+// beside them (novox/hq ADR 0225); one whose resolution binds it to another provider is withdrawn and returned beside them
+// (issue 274). Every other is granted.
+func (c *composer) grantsFor(node string) ([]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, []string, error) {
+	issued, err := c.rowsFor(node)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+	out := make([]catalogue.Grant, 0, len(issued))
+	var withheld []catalogue.Overflow
+	var unbound []catalogue.Unbound
+	var foreseen []string
+	for _, s := range issued {
+		resolved, err := c.planFor(s.Consumer)
+		switch {
+		case unresolvable(err):
+			// Their set does not resolve. Skipped rather than fatal: this node is not the place to report another machine's problem.
+			continue
+		case err != nil:
+			// The mesh could not be asked what they wanted, which is not the same as their wanting nothing.
+			return nil, nil, nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Provision, err)
+		}
+		plan := resolved.Plan
+		values, asks, err := resolution.ContributionsFrom(plan, s.Provision, s.ConsumerModule, resolved.Settings)
+		if err != nil {
+			return nil, nil, nil, nil, err
+		}
+		// A port in there is the consumer's software port until this: the assignment that moved it is that machine's.
+		consumer, err := c.in.node(s.Consumer)
+		if err != nil {
+			return nil, nil, nil, nil, err
+		}
+		values = resolution.AtPublishedPort(values, s.ConsumerModule, consumer.Ports[s.ConsumerModule])
+		from := s.ConsumerModule
+		if !asks {
+			// That module no longer wants this: left empty, which is how a login is withdrawn rather than kept working for ever.
+			from = ""
+		}
+		if bound := resolution.BindsFrom(plan, s.Provision, s.ConsumerModule, s.Local); from != "" && !slices.Contains(bound, node) {
+			// It still asks, and not of this node: withdrawn exactly as a credential nobody asks for, and said.
+			from = ""
+			unbound = append(unbound, catalogue.Unbound{Provision: s.Provision, Provider: node,
+				Consumer: s.Consumer, Module: s.ConsumerModule, Local: s.Local, BoundTo: bound})
+		}
+		// The consumer's identity slug, from its own manifest, carried on the grant so the provider derives the same login the
+		// consumer does (novox/hq ADR 0049).
+		slug := ""
+		for _, mm := range plan.Modules {
+			if mm.Module == s.ConsumerModule {
+				slug = mm.Slug
+				break
+			}
+		}
+		if from != "" {
+			bound := boundOfGrant(plan, s, node)
+			source := catalogue.IdentitySource(slug, s.ConsumerModule)
+			if catalogue.CheckIdentityWithin(s.Consumer, source, bound) != nil {
+				withheld = append(withheld, catalogue.Overflow{Provision: s.Provision, Provider: node,
+					Consumer: s.Consumer, Module: s.ConsumerModule,
+					Identity: catalogue.ConsumerIdentity(s.Consumer, source), Bound: bound})
+				continue
+			}
+		}
+		sealed := s.ForProvider
+		switch {
+		case credentiallessRow(plan, s, node):
+			// Its offer presents no credential (form none): the grant carries the consumer and nothing sealed, and
+			// nothing stands in for it, so neither end waits for a value nobody makes (issue 1126).
+			sealed = ""
+		case sealed == "":
+			sealed = catalogue.ForeseenSealed
+			foreseen = append(foreseen, fmt.Sprintf("the grant of %s for %s on %s", s.Provision, s.ConsumerModule, s.Consumer))
+		}
+		out = append(out, catalogue.Grant{
+			Provision: s.Provision, Consumer: s.Consumer, At: onNetwork[s.Consumer],
+			From: from, Values: values, Slug: slug, Sealed: sealed, Local: s.Local})
+	}
+	return out, withheld, unbound, foreseen, nil
+}
+
+// credentialless is whether a need's provider offers it with no credential (catalogue.CredentialFormNone): the vault
+// mints nothing for it, so nothing is asked of the vault, sealed into a grant or a file, or stood in for (issue 1126).
+func credentialless(n catalogue.Needed) bool { return n.CredentialForm == catalogue.CredentialFormNone }
+
+// credentiallessRow is whether the consumer's resolution answers row's need from provider with an offer of form none.
+func credentiallessRow(consumer catalogue.Resolution, row Issued, provider string) bool {
+	return slices.ContainsFunc(consumer.Needs, func(n catalogue.Needed) bool {
+		return n.Name == row.Provision && n.For == row.ConsumerModule && n.Local == row.Local && n.From == provider &&
+			credentialless(n)
+	})
+}
+
+// rowsFor is every pair credential this node's declaration must carry a grant for, in the order the controller reads them
+// (SecretsFrom: by provision, consumer, consumer module and local name): the ones the Input says were made, and the ones the same send
+// would make before it composes this node -- every need of a node that resolves (this one too), whose provider is this node, that is not
+// answered by a record and not a credential only a person gives and nobody gave. Those have no sealed copy (ForProvider empty), so the
+// grant is composed with a stand-in and named foreseen (plan.go: planFor makes the secret in every mode before grantsFor reads it).
+func (c *composer) rowsFor(node string) ([]Issued, error) {
+	var rows []Issued
+	for _, row := range c.in.Issued {
+		if row.Provider == node {
+			rows = append(rows, row)
+		}
+	}
+	for _, other := range c.in.sorted() {
+		resolved, err := c.planFor(other.Name)
+		switch {
+		case unresolvable(err):
+			continue
+		case err != nil:
+			return nil, fmt.Errorf("what %s asked of %s cannot be read: %w", other.Name, node, err)
+		}
+		shelf := c.shelfFor(other)
+		for _, n := range resolved.Plan.Needs {
+			if n.From != node || n.ByRecord {
+				continue
+			}
+			cred, held := c.credential(n, other.Name)
+			if _, outside := issuedOutsideBy(shelf, n); cred.State == CredentialNotGiven || (outside && !(held && cred.State == CredentialHeld)) {
+				continue
+			}
+			if slices.ContainsFunc(rows, func(r Issued) bool {
+				return r.Provision == n.Name && r.Consumer == other.Name && r.ConsumerModule == n.For && r.Local == n.Local
+			}) {
+				continue
+			}
+			rows = append(rows, Issued{Provision: n.Name, Consumer: other.Name, ConsumerModule: n.For, Local: n.Local, Provider: node})
+		}
+	}
+	sort.SliceStable(rows, func(i, j int) bool {
+		a, b := rows[i], rows[j]
+		switch {
+		case a.Provision != b.Provision:
+			return a.Provision < b.Provision
+		case a.Consumer != b.Consumer:
+			return a.Consumer < b.Consumer
+		case a.ConsumerModule != b.ConsumerModule:
+			return a.ConsumerModule < b.ConsumerModule
+		}
+		return a.Local < b.Local
+	})
+	return rows, nil
+}
+
+// boundOfGrant is the identity bound the consumer's own resolution states for the requirement this grant answers. A requirement
+// not found there is held to the tightest bound the mesh knows rather than to none.
+func boundOfGrant(consumer catalogue.Resolution, s Issued, provider string) catalogue.IdentityBound {
+	for _, n := range consumer.Needs {
+		if n.Name == s.Provision && n.For == s.ConsumerModule && n.From == provider {
+			return n.Identity
+		}
+	}
+	return catalogue.DefaultIdentityBound
+}
+
+// ownSecretRow is the row for one own secret of a module on a node.
+func (c *composer) ownSecretRow(node, module, name string) (OwnSecretRow, bool) {
+	for _, r := range c.in.OwnSecrets {
+		if r.Node == node && r.Module == module && r.Name == name {
+			return r, true
+		}
+	}
+	return OwnSecretRow{}, false
+}
+
+// givenMember is one own secret a person gave on a machine and whether it is sealed to the key the machine holds now.
+type givenMember struct {
+	Name    string
+	Sealed  string
+	Current bool
+}
+
+// givenMembers is every member of a module's secret family given on a machine, by name (inv.GivenMembers): the mesh never
+// makes a member, so only a value a person gave is one; a machine with no sealing key holds none.
+func (c *composer) givenMembers(node Node, module, family string) []givenMember {
+	if node.SealingKey == "" {
+		return nil
+	}
+	prefix := catalogue.FamilyPrefix(family)
+	var out []givenMember
+	for _, r := range c.in.OwnSecrets {
+		if r.Node == node.Name && r.Module == module && r.Origin == "accepted" && strings.HasPrefix(r.Name, prefix) {
+			out = append(out, givenMember{Name: r.Name, Sealed: r.Sealed, Current: r.SealedTo == node.SealingKey})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// givenOwnSecret is an own secret issued outside the mesh as a person gave it on a machine (inv.GivenOwnSecret): not given when
+// the value held was made by the mesh or the machine has no sealing key.
+func (c *composer) givenOwnSecret(node Node, module, name string) (givenMember, bool) {
+	if node.SealingKey == "" {
+		return givenMember{}, false
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	if !ok || r.Origin != "accepted" {
+		return givenMember{}, false
+	}
+	return givenMember{Name: name, Sealed: r.Sealed, Current: r.SealedTo == node.SealingKey}, true
+}
+
+// moduleSecretIfIssued is the read half of the controller's SecretForModule (inv.ModuleSecretIfIssued): the secret when one is
+// held and sealed to the key the machine holds now, and otherwise not held. A key it was sealed to that the machine no longer
+// has is reported as absent rather than as an error.
+func (c *composer) moduleSecretIfIssued(node Node, module, name string) (sealed string, held bool) {
+	if node.SealingKey == "" {
+		return "", false
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	if !ok || r.SealedTo != node.SealingKey {
+		return "", false
+	}
+	return r.Sealed, true
+}
+
+// wouldMakeSecretForModule says what the send would do about an own secret without doing it: nil when it would make one (or one
+// is held), and otherwise the very refusal it would meet (inv.WouldMakeSecretForModule).
+func (c *composer) wouldMakeSecretForModule(node Node, module, name string) error {
+	if node.SealingKey == "" {
+		return fmt.Errorf("%s needs a secret and %s has no sealing key, so nothing can be sealed to it", module, node.Name)
+	}
+	r, ok := c.ownSecretRow(node.Name, module, name)
+	switch {
+	case !ok:
+		return nil
+	case r.SealedTo != node.SealingKey && r.Origin == "accepted":
+		return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
+			"since generated a new sealing key. The mesh cannot make another; issue it again", module, node.Name, name, node.Name)
+	}
+	return nil
+}
+
+// givenUnderAnOldKey is the refusal for a value a person gave sealed to a key the machine no longer holds.
+func givenUnderAnOldKey(module, node, name string) error {
+	return fmt.Errorf("%s on %s holds %q, which was given to the mesh rather than made by it, and %s has "+
+		"since generated a new sealing key. The mesh cannot make another; give it again", module, node, name, node)
+}
+
+// ownSecretsFor is each module's own secrets as this node composes them (plan.go renderingFor): the needed ones sealed to the
+// node, and, in the Foreseeing mode, the ones the next send would make named foreseen. A module handed to the provisioner has its
+// secrets from the vault through the client, so none of them is composed here.
+func (c *composer) ownSecretsFor(node Node, plan catalogue.Resolution, handing catalogue.Rendering, mode Mode) (
+	needed map[string]map[string]string, foreseen map[string]map[string]bool, err error) {
+	needed = map[string]map[string]string{}
+	foreseen = map[string]map[string]bool{}
+	mark := func(module, name string) {
+		if foreseen[module] == nil {
+			foreseen[module] = map[string]bool{}
+		}
+		foreseen[module][name] = true
+	}
+	for _, m := range plan.Modules {
+		if resolution.Handing(handing, m) {
+			continue
+		}
+		// A secret family is never made (novox/hq ADR 0283): each member a person gave on this machine is placed, and one not
+		// given is nothing -- the module says it waits for it.
+		for _, family := range m.OwnSecrets.Families() {
+			for _, g := range c.givenMembers(node, m.Module, family) {
+				if _, fam, ok := m.OwnSecrets.Lookup(g.Name); !ok || fam != family {
+					continue // a longer family's member, or a name no longer of this family
+				}
+				if !g.Current {
+					continue
+				}
+				if needed[m.Module] == nil {
+					needed[m.Module] = map[string]string{}
+				}
+				needed[m.Module][g.Name] = g.Sealed
+				if g.Sealed == "" {
+					// Given, and its value is not in the Input: placed with a stand-in, named.
+					needed[m.Module][g.Name] = catalogue.ForeseenSealed
+					mark(m.Module, g.Name)
+				}
+			}
+		}
+		names := make([]string, 0)
+		for name := range m.OwnSecrets.Plain() {
+			names = append(names, name)
+		}
+		sort.Strings(names)
+		for _, name := range names {
+			own := m.OwnSecrets.Plain()[name]
+			// An own secret issued outside the mesh is never made (novox/hq issue 401, ADR 0228; ADR 0283 for a family): only a
+			// value a person gave is placed. One not given is nothing, and a value the mesh made for it before is not one either.
+			if own.IssuedBy == catalogue.IssuedOutside {
+				g, given := c.givenOwnSecret(node, m.Module, name)
+				if !given || !g.Current {
+					continue
+				}
+				if g.Sealed == "" {
+					mark(m.Module, name)
+					continue
+				}
+				if needed[m.Module] == nil {
+					needed[m.Module] = map[string]string{}
+				}
+				needed[m.Module][name] = g.Sealed
+				continue
+			}
+			sealed, held := c.moduleSecretIfIssued(node, m.Module, name)
+			if !held && mode == Planning {
+				mark(m.Module, name)
+				continue
+			}
+			if !held && mode == Foreseeing {
+				// Asked ahead of the send: what the send would do about it, by the send's own rules. Made by it -- a stand-in,
+				// named; refused by it -- refused here, the same words (novox/hq issue 275). A bus account not yet issued is
+				// foreseen, never refused: the vault mints it from the grants part's wanted list once the placement is written
+				// on the operator's Approve (ADR 0561 §1, ADR 0567 §5), so a composition asked ahead of that cannot hold it
+				// (issue 774, 2026-10-30: every proposal placing mesh-conditions, mesh-self-check or mesh-healers refused).
+				if err := c.wouldMakeSecretForModule(node, m.Module, name); err != nil {
+					return nil, nil, err
+				}
+				mark(m.Module, name)
+				continue
+			}
+			if !held {
+				// Never issued, so this machine cannot be running it: left out rather than invented.
+				continue
+			}
+			if sealed == "" {
+				// Held, and its value is not in the Input: composed with a stand-in, named.
+				mark(m.Module, name)
+				continue
+			}
+			if needed[m.Module] == nil {
+				needed[m.Module] = map[string]string{}
+			}
+			needed[m.Module][name] = sealed
+		}
+	}
+	return needed, foreseen, nil
+}
+
+// CoreBoxWanted is a core credential whose box the Input does not hold for a machine: the next send asks the vault for it and
+// keeps the answer. It is returned for the caller to ask and keep; this package asks and keeps nothing.
+type CoreBoxWanted struct {
+	Node   string
+	Module string
+	Name   string
+}
+
+// coreModulesOf is every module of the plan on the core's list whose own secrets this machine's declaration carries, with their
+// plain own secret names, sorted: one handed to the provisioner has its secrets from the vault through the client, and one issued
+// outside the mesh is never the vault's to seal here.
+func coreModulesOf(modules []catalogue.Manifest, handed func(catalogue.Manifest) bool) map[string][]string {
+	out := map[string][]string{}
+	for _, m := range modules {
+		if !resolution.CarriesVaultSealed(m.Module) || (handed != nil && handed(m)) {
+			continue
+		}
+		var names []string
+		for name, own := range m.OwnSecrets.Plain() {
+			if own.IssuedBy != catalogue.IssuedOutside {
+				names = append(names, name)
+			}
+		}
+		if len(names) > 0 {
+			sort.Strings(names)
+			out[m.Module] = names
+		}
+	}
+	return out
+}
+
+// sealingKeyValid says a machine's sealing key, recorded raw in base64, is a raw X25519 key.
+func sealingKeyValid(raw string) error {
+	b, err := base64.StdEncoding.DecodeString(strings.TrimSpace(raw))
+	if err != nil || len(b) != 32 {
+		return errors.New("the machine's sealing key is not a raw X25519 key")
+	}
+	_, err = ecdh.X25519().NewPublicKey(b)
+	return err
+}
+
+// coreBoxesFor decides each core credential of a machine in a composition that sends nothing and asks no vault (core_box.go
+// coreBoxesOf, in the modes that are not a send): the kept box while it is sealed to the key the machine holds now, and otherwise a
+// stand-in that the next send replaces by asking the vault -- returned in wanted for the caller to ask and keep. A machine with no
+// sealing key, or one whose key is not a key, leaves its module out, said.
+func (c *composer) coreBoxesFor(node Node, modules []catalogue.Manifest, handing catalogue.Rendering) (
+	sealed map[string]map[string]json.RawMessage, notPlaced map[string]string, wanted []CoreBoxWanted) {
+	core := coreModulesOf(modules, func(m catalogue.Manifest) bool { return resolution.Handing(handing, m) })
+	sealed, notPlaced = map[string]map[string]json.RawMessage{}, map[string]string{}
+	mods := make([]string, 0, len(core))
+	for m := range core {
+		mods = append(mods, m)
+	}
+	sort.Strings(mods)
+	for _, module := range mods {
+		if node.SealingKey == "" {
+			notPlaced[module] = fmt.Sprintf("%s has no sealing key, so the vault can seal %s's credentials to "+
+				"nothing there (novox/hq ADR 0349 §16)", node.Name, module)
+			continue
+		}
+		if err := sealingKeyValid(node.SealingKey); err != nil {
+			notPlaced[module] = fmt.Sprintf("%s's credentials cannot be asked of the vault: %v", module, err)
+			continue
+		}
+		boxes := map[string]json.RawMessage{}
+		for _, name := range core[module] {
+			var kept *CoreBox
+			for i := range c.in.KeptCoreBoxes {
+				k := &c.in.KeptCoreBoxes[i]
+				if k.Node == node.Name && k.Module == module && k.Name == name {
+					kept = k
+				}
+			}
+			if kept != nil && kept.SealedTo == node.SealingKey && len(kept.Box) > 0 {
+				boxes[name] = kept.Box
+				continue
+			}
+			boxes[name] = catalogue.ForeseenVaultBox
+			wanted = append(wanted, CoreBoxWanted{Node: node.Name, Module: module, Name: name})
+		}
+		sealed[module] = boxes
+	}
+	return sealed, notPlaced, wanted
+}
+
+// certificateFor is what the mesh certifies about one machine's internal name (plan.go certificateFor): refused for a machine that
+// never told the mesh what key it serves with, and for one not on the private network, which has no name to be certified for.
+// The certificate and the authority are public values the Input may carry; without them stand-ins are composed, and named.
+func (c *composer) certificateFor(node Node) (certificate, authority string, foreseen bool, err error) {
+	if node.ServingKey == "" {
+		return "", "", false, fmt.Errorf(
+			"%s wants a certificate and has never told the mesh what key it serves with; it "+
+				"joins again to report one", node.Name)
+	}
+	where, err := c.whereEveryoneIs()
+	if err != nil {
+		return "", "", false, err
+	}
+	if where[node.Name] == "" {
+		return "", "", false, fmt.Errorf(
+			"%s wants a certificate and is not on the private network, so it has no name inside "+
+				"the mesh to be certified for", node.Name)
+	}
+	certificate, authority = node.Certificate, c.in.Authority
+	if certificate == "" || authority == "" {
+		return ForeseenCertificate, ForeseenCertificate, true, nil
+	}
+	return certificate, authority, false, nil
+}
+
+// holdsTheBus says whether a node's set includes the module that asks for the bus's user list.
+func holdsTheBus(modules []catalogue.Manifest) bool {
+	for _, m := range modules {
+		if m.BusUsers != "" && m.ClaimsSeat("mesh-broker") {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/compose/credentials_needed.go b/internal/compose/credentials_needed.go
new file mode 100644
index 0000000..ec36c71
--- /dev/null
+++ b/internal/compose/credentials_needed.go
@@ -0,0 +1,69 @@
+package compose
+
+import (
+	"fmt"
+	"sort"
+)
+
+// CredentialKey names one pair credential by the ends it joins: the provision, the consumer's node and module, the
+// provider's node, and the local name where a module keeps several (Credential's and Issued's key).
+type CredentialKey struct {
+	Provision      string `json:"provision"`
+	Consumer       string `json:"consumer"`
+	ConsumerModule string `json:"consumer_module"`
+	Provider       string `json:"provider"`
+	Local          string `json:"local,omitempty"`
+}
+
+// CredentialsNeeded is every pair credential node's composition reads (novox/hq ADR 0547 §2, ADR 0550 §5, issue 1126):
+// as a consumer, each need of its resolution a provider's credential answers (a need answered by a record is a licence's,
+// not a pair's); as a provider, each credential it must carry a grant for (rowsFor). A node that composes its own asks the
+// vault for exactly these, sealed to its key, and composes with them; one it does not get is stood in for, which the
+// node's own apply refuses (CompositionsApplied). A need whose provider offers it with no credential (form none) is
+// in neither list: the vault mints nothing for it (issue 1126).
+func CredentialsNeeded(in Input, node string) (asConsumer, asProvider []CredentialKey, err error) {
+	c := newComposer(in)
+	resolved, err := c.resolution(node)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, n := range resolved.Needs {
+		if n.ByRecord || n.From == "" || credentialless(n) {
+			continue
+		}
+		asConsumer = append(asConsumer, CredentialKey{Provision: n.Name, Consumer: node, ConsumerModule: n.For,
+			Provider: n.From, Local: n.Local})
+	}
+	rows, err := c.rowsFor(node)
+	if err != nil {
+		return nil, nil, fmt.Errorf("compose: the credentials %s provides: %w", node, err)
+	}
+	for _, r := range rows {
+		// A grant whose offer presents no credential (form none) has none to ask for (issue 1126).
+		if consumer, err := c.planFor(r.Consumer); err == nil && credentiallessRow(consumer.Plan, r, node) {
+			continue
+		}
+		asProvider = append(asProvider, CredentialKey{Provision: r.Provision, Consumer: r.Consumer,
+			ConsumerModule: r.ConsumerModule, Provider: node, Local: r.Local})
+	}
+	sortKeys(asConsumer)
+	sortKeys(asProvider)
+	return asConsumer, asProvider, nil
+}
+
+func sortKeys(ks []CredentialKey) {
+	sort.Slice(ks, func(i, j int) bool {
+		a, b := ks[i], ks[j]
+		switch {
+		case a.Provision != b.Provision:
+			return a.Provision < b.Provision
+		case a.Provider != b.Provider:
+			return a.Provider < b.Provider
+		case a.Consumer != b.Consumer:
+			return a.Consumer < b.Consumer
+		case a.ConsumerModule != b.ConsumerModule:
+			return a.ConsumerModule < b.ConsumerModule
+		}
+		return a.Local < b.Local
+	})
+}
diff --git a/internal/compose/credentials_test.go b/internal/compose/credentials_test.go
new file mode 100644
index 0000000..dde374e
--- /dev/null
+++ b/internal/compose/credentials_test.go
@@ -0,0 +1,549 @@
+package compose
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// secretValue is a value the Input carries that must never appear in anything the composition says.
+const secretValue = "SECRET-VALUE-THAT-MUST-NOT-LEAK"
+
+func rendered(t *testing.T, in Input, node string, mode Mode) Rendered {
+	t.Helper()
+	got, err := Render(in, node, mode)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	return got
+}
+
+// anAssistant is mesh-controller's outside_not_given_test.go anAssistant (cmd/mesh-controller at 6c2a8d62): a module with a secret
+// the mesh makes and one only an outside party issues.
+func anAssistant() catalogue.Manifest {
+	return catalogue.Manifest{Module: "assistant", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{
+			"password":   {Path: "/var/lib/mesh/assistant/password", Taken: catalogue.TakenAtStart},
+			"vendor-key": {Path: "/var/lib/mesh/assistant/vendor-key", Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside},
+		},
+		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/mesh/assistant", "mode": "0700"}}}
+}
+
+func withAssistant(t *testing.T) Input {
+	t.Helper()
+	in := aMesh(t)
+	in.Catalogue["assistant"] = anAssistant()
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "assistant")
+	laptop.SealingKey = keyOf(t, "laptop")
+	return in
+}
+
+// Own secrets (plan.go renderingFor, novox/hq issue 275 and 401): one held and sealed to the machine's key is carried; one not held is
+// foreseen in the Foreseeing mode and left out in the Reading mode, and nothing is made.
+func TestAnOwnSecretHeldIsCarriedAndOneNotHeldIsForeseenOrLeftOut(t *testing.T) {
+	mk := func() Input {
+		in := withAssistant(t)
+		in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "made",
+			SealedTo: nodeOf(t, &in, "laptop").SealingKey, Sealed: secretValue}}
+		return in
+	}
+	in := mk()
+	got := rendered(t, in, "laptop", Foreseeing)
+	if got.Rendering.Needed["assistant"]["password"] != secretValue || len(got.Rendering.Foreseen) != 0 {
+		t.Errorf("a held secret: needed %v foreseen %v", got.Rendering.Needed, got.Rendering.Foreseen)
+	}
+	// Not held: foreseen with a stand-in (Foreseeing), left out (Reading).
+	in.OwnSecrets = nil
+	got = rendered(t, in, "laptop", Foreseeing)
+	if !got.Rendering.Foreseen["assistant"]["password"] || got.Rendering.Needed["assistant"]["password"] != "" ||
+		len(got.Foreseen) != 1 || got.Foreseen[0] != "assistant/password" {
+		t.Errorf("a secret the send makes: foreseen %v / %v needed %v", got.Rendering.Foreseen, got.Foreseen, got.Rendering.Needed)
+	}
+	got = rendered(t, in, "laptop", Reading)
+	if len(got.Rendering.Needed["assistant"]) != 0 || len(got.Foreseen) != 0 || got.Rendering.Foreseen != nil {
+		t.Errorf("Reading composed a secret that was never issued: %v %v", got.Rendering.Needed, got.Foreseen)
+	}
+	// Held but sealed to a key the machine no longer has is not held.
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "made", SealedTo: "an-old-key", Sealed: secretValue}}
+	if got := rendered(t, in, "laptop", Foreseeing); !got.Rendering.Foreseen["assistant"]["password"] {
+		t.Errorf("a secret sealed to an old key is held: %v", got.Rendering.Needed)
+	}
+	// Held with no value in the Input: a stand-in, named.
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "made", SealedTo: nodeOf(t, &in, "laptop").SealingKey}}
+	if got := rendered(t, in, "laptop", Reading); !got.Rendering.Foreseen["assistant"]["password"] {
+		t.Errorf("a held secret with no value is not named: %v", got.Rendering.Foreseen)
+	}
+	unchanged(t, mk, func(in Input) { rendered(t, in, "laptop", Foreseeing) })
+
+	// 1126 (ADR 0547 §2): a node applying what it composed itself never applies a stand-in: a held secret with no value in the
+	// Input is refused, naming it; held with its value, it composes.
+	fps := map[string]string{"assistant": "src2:" + strings.Repeat("a", 64), overlay.Name: "src2:" + strings.Repeat("b", 64)}
+	if _, _, err := CompositionsApplied(in, "laptop", fps); !errors.Is(err, ErrStoodIn) || !strings.Contains(err.Error(), "assistant/password") {
+		t.Errorf("a stand-in was not refused for a node's own apply: %v", err)
+	}
+	if out, _, err := CompositionsApplied(mk(), "laptop", fps); err != nil || len(out) == 0 {
+		t.Errorf("a held secret with its value is refused for a node's own apply: %v", err)
+	}
+}
+
+// An own secret issued outside the mesh that nobody gave is never made (novox/hq issue 401, ADR 0228): nothing is composed or
+// foreseen for it; a value the mesh made for it is not one a person gave; a value given is placed once it is sealed to the key held now.
+func TestAnOutsideSecretIsPlacedOnlyOnceAPersonGaveIt(t *testing.T) {
+	in := withAssistant(t)
+	key := nodeOf(t, &in, "laptop").SealingKey
+	for _, mode := range []Mode{Reading, Foreseeing} {
+		got := rendered(t, in, "laptop", mode)
+		if _, there := got.Rendering.Needed["assistant"]["vendor-key"]; there || got.Rendering.Foreseen["assistant"]["vendor-key"] {
+			t.Fatalf("%v: a secret nobody gave is composed: %v %v", mode, got.Rendering.Needed, got.Rendering.Foreseen)
+		}
+	}
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "vendor-key", Origin: "made", SealedTo: key, Sealed: secretValue}}
+	if _, there := rendered(t, in, "laptop", Foreseeing).Rendering.Needed["assistant"]["vendor-key"]; there {
+		t.Error("a value the mesh made for a secret issued outside was placed")
+	}
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "vendor-key", Origin: "accepted", SealedTo: key, Sealed: "the vendor's key, sealed"}}
+	if got := rendered(t, in, "laptop", Foreseeing).Rendering.Needed["assistant"]["vendor-key"]; got != "the vendor's key, sealed" {
+		t.Errorf("a value given is placed as %q", got)
+	}
+	in.OwnSecrets[0].SealedTo = "an-old-key"
+	if _, there := rendered(t, in, "laptop", Foreseeing).Rendering.Needed["assistant"]["vendor-key"]; there {
+		t.Error("a value given under an old key was placed")
+	}
+}
+
+// 1364/AC3 (the send's refusals, novox/hq issue 275): in the Foreseeing mode a given secret under an old key is refused in the
+// controller's words. No secret value is in an error. A bus account not yet issued is foreseen, issued or not (issue 774: the vault
+// mints it once the placement is written on the Approve, ADR 0561 §1, ADR 0567 §5; mesh-self-check's proposal on ace was refused
+// "has no bus credential: nothing was issued for ace.mesh-self-check").
+func TestTheSendsRefusalsAreRefusedInTheSendsWords(t *testing.T) {
+	broker := catalogue.Manifest{Module: "mesh-self-check", Version: "1", RunsAs: "mesh-self-check",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/mesh-self-check/broker", Taken: catalogue.TakenAtStart}}}
+	in := withAssistant(t)
+	in.Catalogue["mesh-self-check"] = broker
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "mesh-self-check")
+	for _, minted := range [][]string{nil, {"laptop.mesh-self-check"}} {
+		in.BusMinted = minted
+		got, err := Render(in, "laptop", Foreseeing)
+		if err != nil || !got.Rendering.Foreseen["mesh-self-check"]["broker"] {
+			t.Fatalf("minted %v: the bus account is not foreseen: %v", minted, err)
+		}
+		// Reading refuses nothing for it: the machine is not running it.
+		if _, err := Render(in, "laptop", Reading); err != nil {
+			t.Fatalf("Reading refused a secret the machine is not running: %v", err)
+		}
+	}
+	// A given secret under an old key.
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "accepted", SealedTo: "an-old-key", Sealed: secretValue},
+		{Node: "laptop", Module: "mesh-self-check", Name: "broker", Origin: "made", SealedTo: laptop.SealingKey, Sealed: secretValue}}
+	_, err := Render(in, "laptop", Foreseeing)
+	wantOld := "assistant on laptop holds \"password\", which was given to the mesh rather than made by it, and laptop has since generated a new " +
+		"sealing key. The mesh cannot make another; issue it again"
+	if err == nil || err.Error() != wantOld {
+		t.Fatalf("got %v, want %q", err, wantOld)
+	}
+	if strings.Contains(err.Error(), secretValue) {
+		t.Error("a secret value is in an error")
+	}
+	// A machine with no sealing key cannot be sealed to.
+	laptop.SealingKey = ""
+	in.OwnSecrets = nil
+	if _, err := Render(in, "laptop", Foreseeing); err == nil || !strings.Contains(err.Error(), "laptop has no sealing key, so nothing can be sealed to it") {
+		t.Fatalf("no sealing key: %v", err)
+	}
+}
+
+// aGrantMesh is the objects provider on anchor and its consumer files on laptop, with the pair credential made.
+func aGrantMesh(t *testing.T) Input {
+	t.Helper()
+	in := theObjectsMesh(t, objects())
+	in.Issued = []Issued{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", ForProvider: "sealed-to-anchor"}}
+	return in
+}
+
+// A credential made for a consumer is a grant on its provider's machine, carrying the consumer's values and the sealed copy; without
+// the sealed copy a stand-in is composed and named (novox/hq plan.go grantsFor).
+func TestAGrantIsCreatedForEachCredentialMadeForAConsumer(t *testing.T) {
+	in := aGrantMesh(t)
+	// 1126 (ADR 0550 §5): the credentials each node's composition reads, by their ends: laptop's files consumes anchor's
+	// s3-bucket, and anchor grants it; the node composing its own asks the vault for exactly these.
+	pair := CredentialKey{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor"}
+	if consumer, provider, err := CredentialsNeeded(in, "laptop"); err != nil || len(provider) != 0 || len(consumer) != 1 || consumer[0] != pair {
+		t.Errorf("laptop needs %v as consumer and %v as provider (%v), want %v as consumer", consumer, provider, err, pair)
+	}
+	if consumer, provider, err := CredentialsNeeded(in, "anchor"); err != nil || len(consumer) != 0 || len(provider) != 1 || provider[0] != pair {
+		t.Errorf("anchor needs %v as consumer and %v as provider (%v), want %v as provider", consumer, provider, err, pair)
+	}
+	got := rendered(t, in, "anchor", Foreseeing)
+	if len(got.Rendering.Grants) != 1 {
+		t.Fatalf("grants are %+v", got.Rendering.Grants)
+	}
+	g := got.Rendering.Grants[0]
+	if g.Provision != "s3-bucket" || g.Consumer != "laptop" || g.From != "files" || g.At != "laptop.internal" || g.Sealed != "sealed-to-anchor" {
+		t.Errorf("the grant is %+v", g)
+	}
+	if len(got.Foreseen) != 0 || len(got.Withheld) != 0 || len(got.Unbound) != 0 {
+		t.Errorf("foreseen %v withheld %v unbound %v", got.Foreseen, got.Withheld, got.Unbound)
+	}
+	in.Issued[0].ForProvider = ""
+	got = rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.Grants[0].Sealed != catalogue.ForeseenSealed || len(got.Foreseen) != 1 {
+		t.Errorf("a grant with no sealed copy: %+v foreseen %v", got.Rendering.Grants, got.Foreseen)
+	}
+	// A credential made for a consumer on another provider is not this node's grant.
+	if len(rendered(t, in, "laptop", Foreseeing).Rendering.Grants) != 0 {
+		t.Error("the consumer is granted its own credential")
+	}
+	// A consumer whose set does not resolve is skipped, not fatal.
+	nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "files")
+	in.Catalogue["files"] = catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
+		Claims: []catalogue.Claim{{Name: "x", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["twin"] = catalogue.Manifest{Module: "twin", Version: "1", Claims: []catalogue.Claim{{Name: "x", Scope: catalogue.ScopeNode}}}
+	nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "twin")
+	if got, err := Render(in, "anchor", Foreseeing); err != nil || len(got.Rendering.Grants) != 0 {
+		t.Errorf("a consumer that does not resolve: %v %+v", err, got.Rendering.Grants)
+	}
+}
+
+// 1364/AC2: a consumer the grants leave out because its identity overflows the provision's bound is returned beside them, naming the
+// consumer and the provision (novox/hq ADR 0225), and is not granted.
+func TestAConsumerWhoseIdentityOverflowsIsLeftOutOfTheGrantsAndNamed(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Nodes[1].Name = "a-machine-with-a-very-long-name"
+	in.Issued[0].Consumer = "a-machine-with-a-very-long-name"
+	got := rendered(t, in, "anchor", Foreseeing)
+	if len(got.Rendering.Grants) != 0 || len(got.Withheld) != 1 {
+		t.Fatalf("grants %+v withheld %+v", got.Rendering.Grants, got.Withheld)
+	}
+	w := got.Withheld[0]
+	if w.Consumer != "a-machine-with-a-very-long-name" || w.Provision != "s3-bucket" || w.Provider != "anchor" || w.Module != "files" ||
+		!strings.Contains(w.String(), "a-machine-with-a-very-long-name") || !strings.Contains(w.String(), "s3-bucket") {
+		t.Errorf("the consumer left out is %+v / %s", w, w.String())
+	}
+	if len(got.Rendering.Withheld) != 1 {
+		t.Errorf("the Rendering does not carry it: %+v", got.Rendering.Withheld)
+	}
+}
+
+// 1364/AC3: a credential on record for a consumer that its own resolution binds to another provider is withdrawn, named with where it is
+// bound (novox/hq issue 274): the grant stays, with no consumer module asking.
+func TestACredentialBoundToAnotherProviderIsWithdrawnAndSaidWhereItIsBound(t *testing.T) {
+	in := aGrantMesh(t)
+	second := objects()
+	second.Module = "objects2"
+	in.Catalogue["objects2"] = second
+	in.Nodes = append(in.Nodes, Node{Name: "ace", Place: Place{Site: "there", Address: "10.77.0.3"},
+		Assigned: []string{overlay.Name, "objects2"}, Capabilities: map[string]bool{"container-runtime": true, "wireguard": true, "systemd": true}})
+	nodeOf(t, &in, "laptop").Pins = map[string]catalogue.Chosen{"s3-bucket": {Node: "ace", Module: "objects2"}}
+	got := rendered(t, in, "anchor", Foreseeing)
+	if len(got.Unbound) != 1 {
+		t.Fatalf("unbound %+v grants %+v", got.Unbound, got.Rendering.Grants)
+	}
+	u := got.Unbound[0]
+	if u.Provision != "s3-bucket" || u.Provider != "anchor" || u.Consumer != "laptop" || u.Module != "files" ||
+		len(u.BoundTo) != 1 || u.BoundTo[0] != "ace" || !strings.Contains(u.String(), "ace") {
+		t.Errorf("unbound is %+v / %s", u, u.String())
+	}
+	if len(got.Rendering.Grants) != 1 || got.Rendering.Grants[0].From != "" {
+		t.Errorf("the withdrawn credential is still asked for: %+v", got.Rendering.Grants)
+	}
+}
+
+func aCertificateMesh(t *testing.T) Input {
+	t.Helper()
+	in := aMesh(t)
+	in.Catalogue["secure"] = catalogue.Manifest{Module: "secure", Version: "1", Certificate: &catalogue.Certificate{Into: "/etc/secure/tls.pem", Authority: "/etc/secure/ca.pem"}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "secure")
+	return in
+}
+
+// 1364/AC4: with no certificate and authority in the Input a stand-in is composed and named; given them, the composition carries them as
+// given. A machine that never reported a serving key, and one not on the private network, are refused in the controller's words.
+func TestACertificateIsCarriedAsGivenOrStoodInForAndNamed(t *testing.T) {
+	in := aCertificateMesh(t)
+	laptop := nodeOf(t, &in, "laptop")
+	if _, err := Render(in, "laptop", Foreseeing); err == nil || err.Error() != "laptop wants a certificate and has never told the mesh what key it serves with; it joins again to report one" {
+		t.Fatalf("no serving key: %v", err)
+	}
+	laptop.ServingKey = "serving-key"
+	got := rendered(t, in, "laptop", Foreseeing)
+	if got.Rendering.Certificate != ForeseenCertificate || got.Rendering.Authority != ForeseenCertificate || len(got.Foreseen) != 1 {
+		t.Errorf("no certificate in the Input: %q %q foreseen %v", got.Rendering.Certificate, got.Rendering.Authority, got.Foreseen)
+	}
+	laptop.Certificate, in.Authority = "the-certificate", "the-authority"
+	got = rendered(t, in, "laptop", Foreseeing)
+	if got.Rendering.Certificate != "the-certificate" || got.Rendering.Authority != "the-authority" || len(got.Foreseen) != 0 {
+		t.Errorf("a certificate given: %q %q foreseen %v", got.Rendering.Certificate, got.Rendering.Authority, got.Foreseen)
+	}
+	laptop.Place.Address = "" // placed nowhere: no name inside the mesh
+	if _, err := Render(in, "laptop", Foreseeing); err == nil || err.Error() != "laptop wants a certificate and is not on the private network, so it has no name inside the mesh to be certified for" {
+		t.Fatalf("off the network: %v", err)
+	}
+}
+
+func aValidKey(t *testing.T, name string) string { return keyOf(t, name) }
+
+// 1364/AC5 and AC6: a core credential the node needs and the Input holds no box for is composed with a stand-in and returned as one
+// to keep; a kept box sealed to the key held now is carried; a node-engine below the vault-box contract is sent none (and nothing is
+// asked of it); a machine with no sealing key has its core module left out, said.
+func TestACoreBoxTheInputHoldsNoneOfIsReturnedToKeepAndNothingIsWritten(t *testing.T) {
+	mk := func() Input {
+		in := aMesh(t)
+		in.Catalogue["nats"] = catalogue.Manifest{Module: "nats", Version: "1",
+			OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/nats/broker", Taken: catalogue.TakenAtStart}}}
+		laptop := nodeOf(t, &in, "laptop")
+		laptop.Assigned = append(laptop.Assigned, "nats")
+		laptop.SealingKey = aValidKey(t, "laptop")
+		laptop.Stated, laptop.Contract = true, VaultBoxContract
+		in.BusMinted = []string{"laptop.nats"}
+		return in
+	}
+	in := mk()
+	got := rendered(t, in, "laptop", Foreseeing)
+	box := got.Rendering.VaultSealed["nats"]["broker"]
+	if string(box) != string(catalogue.ForeseenVaultBox) || len(got.CoreBoxesWanted) != 1 ||
+		got.CoreBoxesWanted[0] != (CoreBoxWanted{Node: "laptop", Module: "nats", Name: "broker"}) {
+		t.Errorf("no box held: %s wanted %v", box, got.CoreBoxesWanted)
+	}
+	kept := json.RawMessage(`{"v":1,"eph":"e","iv":"i","tag":"t","ct":"c"}`)
+	in.KeptCoreBoxes = []CoreBox{{Node: "laptop", Module: "nats", Name: "broker", Generation: 3, SealedTo: nodeOf(t, &in, "laptop").SealingKey, Box: kept}}
+	got = rendered(t, in, "laptop", Foreseeing)
+	if string(got.Rendering.VaultSealed["nats"]["broker"]) != string(kept) || len(got.CoreBoxesWanted) != 0 {
+		t.Errorf("a kept box: %s wanted %v", got.Rendering.VaultSealed["nats"]["broker"], got.CoreBoxesWanted)
+	}
+	in.KeptCoreBoxes[0].SealedTo = "an-old-key"
+	if got = rendered(t, in, "laptop", Foreseeing); len(got.CoreBoxesWanted) != 1 {
+		t.Errorf("a box sealed to an old key is kept: %v", got.CoreBoxesWanted)
+	}
+	// Below the vault-box contract: none, and the controller's own seal as before.
+	nodeOf(t, &in, "laptop").Contract = VaultBoxContract - 1
+	if got = rendered(t, in, "laptop", Foreseeing); got.Rendering.VaultSealed != nil || len(got.CoreBoxesWanted) != 0 {
+		t.Errorf("an engine below the contract is sent boxes: %v %v", got.Rendering.VaultSealed, got.CoreBoxesWanted)
+	}
+	// No sealing key: the module is left out, said.
+	nodeOf(t, &in, "laptop").Contract, nodeOf(t, &in, "laptop").SealingKey = VaultBoxContract, ""
+	got = rendered(t, in, "laptop", Reading)
+	if why := got.Rendering.NotPlaced["nats"]; !strings.Contains(why, "laptop has no sealing key, so the vault can seal nats's credentials to nothing there") {
+		t.Errorf("not placed: %v", got.Rendering.NotPlaced)
+	}
+	unchanged(t, mk, func(in Input) { rendered(t, in, "laptop", Foreseeing) })
+}
+
+// 1364/AC1: the bus's user list is carried for the machine that runs the bus and for no other; without it a stand-in is composed and
+// named; the users left out for want of a credential are said; each machine's membership is carried. (The list is composed by the
+// controller from the bus records, which stay the controller's: see the commit message.)
+func TestTheBusUserListIsCarriedForTheMachineThatRunsTheBus(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["bus"] = catalogue.Manifest{Module: "bus", Version: "1", BusUsers: "/etc/bus/accounts.conf",
+		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "bus")
+	in.BusUsers = "accounts { anchor.bus: hash }"
+	in.BusMissing = []string{"laptop.files", "laptop.web"}
+	in.BusMemberships = map[string]string{"laptop": "sealed-membership"}
+	got := rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.BusUsers != in.BusUsers || len(got.Foreseen) != 0 {
+		t.Errorf("the list is %q foreseen %v", got.Rendering.BusUsers, got.Foreseen)
+	}
+	if len(got.Said) != 1 || got.Said[0] != "the bus's user list leaves out 2 user(s) the mesh has minted no credential for: laptop.files, laptop.web. Each is a user that cannot connect until one is issued" {
+		t.Errorf("said %v", got.Said)
+	}
+	if other := rendered(t, in, "laptop", Foreseeing); other.Rendering.BusUsers != "" || other.Rendering.BusMembership != "sealed-membership" {
+		t.Errorf("laptop: list %q membership %q", other.Rendering.BusUsers, other.Rendering.BusMembership)
+	}
+	in.BusUsers = ""
+	got = rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.BusUsers != ForeseenBusUsers || len(got.Foreseen) != 1 {
+		t.Errorf("no list in the Input: %q foreseen %v", got.Rendering.BusUsers, got.Foreseen)
+	}
+}
+
+// 1364/AC7: nothing the composition says carries a secret value the Input holds.
+func TestNoSecretValueOfTheInputIsInWhatTheCompositionSays(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Issued[0].ForProvider = secretValue
+	laptop := nodeOf(t, &in, "laptop")
+	in.Catalogue["assistant"] = anAssistant()
+	laptop.Assigned = append(laptop.Assigned, "assistant")
+	laptop.SealingKey = keyOf(t, "laptop")
+	in.OwnSecrets = []OwnSecretRow{{Node: "laptop", Module: "assistant", Name: "password", Origin: "made", SealedTo: laptop.SealingKey, Sealed: secretValue}}
+	in.Credentials = []Credential{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialHeld, Sealed: secretValue}}
+	for _, node := range []string{"anchor", "laptop"} {
+		got := rendered(t, in, node, Foreseeing)
+		for _, said := range append(append([]string{}, got.Foreseen...), got.Said...) {
+			if strings.Contains(said, secretValue) {
+				t.Errorf("%s: %q carries a secret value", node, said)
+			}
+		}
+	}
+}
+
+// A consumer no credential was made for yet is granted with a stand-in and named foreseen, for every form whose credential
+// the vault mints or takes in; an offer of form none has no credential (issue 1126, 2026-11-02: mesh-cli on ace held for
+// "the grant of mcp-endpoint", whose provider node-tools offers form none): its grant carries the consumer and no
+// credential, nothing stands in on either side, and neither end asks the vault for one.
+func TestAConsumerNoCredentialWasMadeForYetIsGrantedWithAStandInUnlessItsOfferHasNone(t *testing.T) {
+	for _, tc := range []struct {
+		form string
+		cred *catalogue.OfferCredential
+	}{
+		{"undeclared", nil},
+		{catalogue.CredentialFormPair, &catalogue.OfferCredential{Form: catalogue.CredentialFormPair}},
+		{catalogue.CredentialFormShared, &catalogue.OfferCredential{Own: "access-key"}},
+		{catalogue.CredentialFormNone, &catalogue.OfferCredential{Form: catalogue.CredentialFormNone}},
+	} {
+		in := aGrantMesh(t)
+		in.Issued = nil
+		provider := in.Catalogue["objects"]
+		provider.Provides[0].Credential = tc.cred
+		if tc.cred != nil && tc.cred.Own != "" {
+			provider.OwnSecrets = catalogue.OwnSecrets{"access-key": {Path: "/var/lib/mesh/objects/access-key"}}
+		}
+		in.Catalogue["objects"] = provider
+		none := tc.form == catalogue.CredentialFormNone
+		got := rendered(t, in, "anchor", Foreseeing)
+		if len(got.Rendering.Grants) != 1 {
+			t.Fatalf("%s: grants are %+v", tc.form, got.Rendering.Grants)
+		}
+		g, wantSealed := got.Rendering.Grants[0], catalogue.ForeseenSealed
+		if none {
+			wantSealed = ""
+		}
+		if g.Provision != "s3-bucket" || g.Consumer != "laptop" || g.From != "files" || g.Sealed != wantSealed {
+			t.Errorf("%s: the grant is %+v", tc.form, g)
+		}
+		if has(got.Foreseen, "the grant of s3-bucket for files on laptop") == none {
+			t.Errorf("%s: foreseen %v", tc.form, got.Foreseen)
+		}
+		consumer, asProvider, err := CredentialsNeeded(in, "laptop")
+		_, anchorProvides, err2 := CredentialsNeeded(in, "anchor")
+		if err != nil || err2 != nil || len(asProvider) != 0 || (len(consumer) == 0) != none || (len(anchorProvides) == 0) != none {
+			t.Errorf("%s: laptop asks %v, anchor provides %v (%v %v)", tc.form, consumer, anchorProvides, err, err2)
+		}
+		resolved, err := Resolve(in, "laptop")
+		if err != nil {
+			t.Fatalf("%s: %v", tc.form, err)
+		}
+		if n := theFilesNeed(t, resolved); (n.Sealed == "") != none || (len(resolved.Foreseen) == 0) != none {
+			t.Errorf("%s: the consumer's credential is %q, foreseen %v", tc.form, n.Sealed, resolved.Foreseen)
+		}
+		if lap := rendered(t, in, "laptop", Foreseeing); none && len(lap.Foreseen) != 0 {
+			t.Errorf("%s: the consumer stands in for %v", tc.form, lap.Foreseen)
+		}
+		// Only the provider's own: the consumer is granted nothing, and nothing in the Input changed.
+		if len(rendered(t, in, "laptop", Foreseeing).Rendering.Grants) != 0 {
+			t.Errorf("%s: the consumer is granted its own credential", tc.form)
+		}
+		if len(in.Issued) != 0 {
+			t.Errorf("%s: a row was added to the Input", tc.form)
+		}
+		// A row made long ago for an offer of form none (the controller's) carries no credential either.
+		in.Issued = []Issued{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", ForProvider: "sealed-to-anchor"}}
+		if g := rendered(t, in, "anchor", Foreseeing).Rendering.Grants; none && (len(g) != 1 || g[0].Sealed != "") {
+			t.Errorf("%s: an old row's grant is %+v", tc.form, g)
+		}
+	}
+	// A credential only a person gives and nobody has is no grant.
+	in := aGrantMesh(t)
+	in.Issued = nil
+	in.Credentials = []Credential{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialNotGiven}}
+	if got := rendered(t, in, "anchor", Foreseeing); len(got.Rendering.Grants) != 0 {
+		t.Errorf("a credential nobody gave is granted: %+v", got.Rendering.Grants)
+	}
+}
+
+// And a consumer whose identity overflows the provision's bound is judged before any credential is made for it (issue 263).
+func TestAnOverflowingConsumerNoCredentialWasMadeForYetIsWithheld(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Issued = nil
+	in.Catalogue["resolver"] = storeManifests()[1]
+	in.Catalogue["networkmanager"] = catalogue.Manifest{Module: "networkmanager", Version: "1", Requires: []string{"wildcard-resolution", "s3-bucket"}}
+	nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "networkmanager")
+	nodeOf(t, &in, "anchor").Assigned = append(nodeOf(t, &in, "anchor").Assigned, "resolver")
+	in.Holdings = []catalogue.Held{{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "resolver", Site: "here"}}
+	got := rendered(t, in, "anchor", Foreseeing)
+	if len(got.Withheld) != 1 || got.Withheld[0].Module != "networkmanager" {
+		t.Fatalf("withheld %+v", got.Withheld)
+	}
+}
+
+// The grants come in the order the controller reads them, whatever order the Input gives its rows.
+func TestGrantsComeInTheOrderOfProvisionConsumerModuleAndLocal(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Issued = []Issued{
+		{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Local: "b", Provider: "anchor", ForProvider: "x"},
+		{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Local: "a", Provider: "anchor", ForProvider: "x"},
+	}
+	rows, err := newComposer(in).rowsFor("anchor")
+	// The credential the same send would make (no local name) comes first, then the two the Input gives, a before b.
+	if err != nil || len(rows) != 3 || rows[0].Local != "" || rows[1].Local != "a" || rows[2].Local != "b" {
+		t.Errorf("rows are %+v %v", rows, err)
+	}
+}
+
+// Round 1, finding 4: a member of a secret family a person gave, whose sealed value the Input does not carry, is placed with a
+// stand-in and named foreseen, not dropped as if nobody gave it.
+func TestAGivenFamilyMemberWithoutItsValueIsAStandInAndNamedForeseen(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["mailer"] = catalogue.Manifest{Module: "mailer", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"credential-*": {Path: "/var/lib/mailer/credential-*.secret", Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside}}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "mailer")
+	laptop.SealingKey = keyOf(t, "laptop")
+	in.OwnSecrets = []OwnSecretRow{
+		{Node: "laptop", Module: "mailer", Name: "credential-a", Origin: "accepted", SealedTo: laptop.SealingKey},
+		{Node: "laptop", Module: "mailer", Name: "credential-b", Origin: "accepted", SealedTo: laptop.SealingKey, Sealed: "b-sealed"},
+	}
+	got := rendered(t, in, "laptop", Foreseeing)
+	needed := got.Rendering.Needed["mailer"]
+	if needed["credential-a"] != catalogue.ForeseenSealed || needed["credential-b"] != "b-sealed" {
+		t.Errorf("needed %v", needed)
+	}
+	if !has(got.Foreseen, "mailer/credential-a") || has(got.Foreseen, "mailer/credential-b") {
+		t.Errorf("foreseen %v", got.Foreseen)
+	}
+}
+
+// Round 1, finding 5: the suffix internal names end in is a field of the Input, and the environment is never read.
+func TestTheInternalSuffixIsTheInputsAndNeverTheEnvironments(t *testing.T) {
+	t.Setenv(overlay.SuffixVar, "from-the-environment")
+	in := aGrantMesh(t)
+	got := rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.Suffix != "internal" || got.Rendering.Grants[0].At != "laptop.internal" {
+		t.Errorf("by default: suffix %q, grant at %q", got.Rendering.Suffix, got.Rendering.Grants[0].At)
+	}
+	in.InternalSuffix = ".lan"
+	got = rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.Suffix != "lan" || got.Rendering.Grants[0].At != "laptop.lan" {
+		t.Errorf("given: suffix %q, grant at %q", got.Rendering.Suffix, got.Rendering.Grants[0].At)
+	}
+	where, err := newComposer(in).whereEveryoneIs()
+	if err != nil || where["anchor"] != "anchor.lan" {
+		t.Errorf("where everyone is: %v %v", where, err)
+	}
+	if names := newComposer(in).namesInTheMesh(); names["anchor.lan"] == "" || names["anchor.internal"] != "" {
+		t.Errorf("names: %v", names)
+	}
+}
+
+// Round 2: a need answered on the same machine is a grant too (catalogue resolve.go gives it From: the node's own name).
+func TestAConsumerOnTheProvidersOwnNodeIsGrantedWithAStandInAndNamedForeseen(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Issued = nil
+	laptop, anchor := nodeOf(t, &in, "laptop"), nodeOf(t, &in, "anchor")
+	laptop.Assigned = []string{overlay.Name}
+	anchor.Assigned = append(anchor.Assigned, "files")
+	got := rendered(t, in, "anchor", Foreseeing)
+	if len(got.Rendering.Grants) != 1 || got.Rendering.Grants[0].Consumer != "anchor" || got.Rendering.Grants[0].Sealed != catalogue.ForeseenSealed {
+		t.Fatalf("grants are %+v", got.Rendering.Grants)
+	}
+	if !has(got.Foreseen, "the grant of s3-bucket for files on anchor") {
+		t.Errorf("foreseen %v", got.Foreseen)
+	}
+}
diff --git a/internal/compose/fixture_test.go b/internal/compose/fixture_test.go
new file mode 100644
index 0000000..1766852
--- /dev/null
+++ b/internal/compose/fixture_test.go
@@ -0,0 +1,90 @@
+package compose
+
+import (
+	"crypto/ecdh"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// aPublicKey is a key a machine could have reported, made as mesh-controller's mesh_for_test.go aPublicKey makes it.
+func aPublicKey(t *testing.T) string {
+	t.Helper()
+	k, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(k.PublicKey().Bytes())
+}
+
+// keys are made once per run, so two Inputs made the same way are equal.
+var keys = map[string]string{}
+
+func keyOf(t *testing.T, name string) string {
+	t.Helper()
+	if keys[name] == "" {
+		keys[name] = aPublicKey(t)
+	}
+	return keys[name]
+}
+
+// theOverlayModule is the module the mesh provides for itself, as mesh-controller's providedModules makes it
+// (cmd/mesh-controller/modules.go at 6c2a8d62).
+func theOverlayModule(t *testing.T) catalogue.Manifest {
+	t.Helper()
+	var m catalogue.Manifest
+	b, err := json.Marshal(overlay.Manifest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(b, &m); err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+// aMesh is the Input of mesh-controller's aMesh (cmd/mesh-controller/mesh_for_test.go at 6c2a8d62): two placed
+// machines, `anchor` the hub, both reporting container-runtime, wireguard and systemd, both assigned what puts them on the
+// private network, each at <name>.example:51820 on the site `here`, anchor at 10.77.0.1 and laptop at 10.77.0.2.
+func aMesh(t *testing.T) Input {
+	t.Helper()
+	in := Input{Catalogue: map[string]catalogue.Manifest{overlay.Name: theOverlayModule(t)}}
+	for i, name := range []string{"anchor", "laptop"} {
+		in.Nodes = append(in.Nodes, Node{
+			Name: name,
+			Place: Place{Key: keyOf(t, name), Endpoint: name + ".example:51820", Site: "here",
+				Hub: name == "anchor", Address: []string{"10.77.0.1", "10.77.0.2"}[i]},
+			Assigned:     []string{overlay.Name},
+			Capabilities: map[string]bool{"container-runtime": true, "wireguard": true, "systemd": true},
+		})
+	}
+	return in
+}
+
+// nodeOf is the named node of an Input, for a test to change.
+func nodeOf(t *testing.T, in *Input, name string) *Node {
+	t.Helper()
+	for i := range in.Nodes {
+		if in.Nodes[i].Name == name {
+			return &in.Nodes[i]
+		}
+	}
+	t.Fatalf("no node %s", name)
+	return nil
+}
+
+// unchanged runs call on one Input and compares it with another made the same way: the composition changes nothing in what
+// it is given (deep equality, nothing shared).
+func unchanged(t *testing.T, mk func() Input, call func(Input)) {
+	t.Helper()
+	used, same := mk(), mk()
+	call(used)
+	if !reflect.DeepEqual(used, same) {
+		t.Fatalf("the call changed its Input")
+	}
+}
diff --git a/internal/compose/frombus/answer.go b/internal/compose/frombus/answer.go
new file mode 100644
index 0000000..d2b0162
--- /dev/null
+++ b/internal/compose/frombus/answer.go
@@ -0,0 +1,583 @@
+package frombus
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// Answer is a node's answer to its proposal's placement candidates (novox/hq ADR 0567 §3, ADR 0559 §4): s.Node composed in shadow with
+// s.Placements laid over the trunk's placement (compose.CompositionsShadow, its own sealed values and boxes through r as
+// for its own composition), compared with what it runs (delivery.CompareComposed). It applies nothing and writes
+// nothing; the proposal and the revision are the candidate's, said back in the answer.
+//
+// The node's own composition is compared only where the node runs one. fps gives the build each module is composed at: what the node runs, and for a module the candidate places that the
+// node does not run, the build the trunk holds; a placed module with none is added, with no build of it known. What the
+// composition stands in for is judged: a value of a module the proposal adds (on this node or another: its credential, own
+// secrets and boxes are made only once it is placed, ADR 0549 §5) is not yet issued, which is no refusal; any other
+// stand-in is a value missing for a module the node runs, a refusal naming it ("node" when it is the node's own).
+func Answer(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string, running []delivery.Composed, proposal string, revision uint64) delivery.CandidateAnswer {
+	a := delivery.CandidateAnswer{Proposal: proposal, Revision: revision}
+	refuse := func(err error) delivery.CandidateAnswer {
+		a.Refused = err.Error()
+		a.Verdict = delivery.CandidateRefused
+		return a
+	}
+	trunk, err := r.Placements(ctx)
+	if err != nil {
+		return refuse(fmt.Errorf("frombus: placement: %w", err))
+	}
+	if s.Running == nil {
+		s.Running = running
+	}
+	// Every module it cannot compose is named, not the first only (issue 1126): a build it cannot read or take in, and
+	// below, a module the composition refuses, each composed as a stub so the rest is composed and compared.
+	failed := map[string]string{}
+	in, err := input(ctx, r, mesh, s, func(module string, err error) { failed[module] = err.Error() }, nil)
+	if err != nil {
+		return refuse(err)
+	}
+	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
+	if err != nil {
+		return refuse(err)
+	}
+	// What the node runs, by module. A consumer's credential is asked only for a module it runs: the vault refuses the
+	// whole ask for a consuming module not assigned to the node (mesh-vault's own), and a module the candidate adds is
+	// assigned only after the merge (ADR 0549 §5), so its credential is left missing, a stand-in answered as not yet
+	// issued under Added (review of L2b, round 1, finding 1).
+	runs := map[string]bool{}
+	for _, c := range running {
+		if c.Module != "" {
+			runs[c.Module] = true
+		}
+	}
+	var consumed []compose.CredentialKey
+	for _, k := range asConsumer {
+		if runs[k.ConsumerModule] {
+			consumed = append(consumed, k)
+		}
+	}
+	asConsumer = consumed
+	if len(asConsumer)+len(asProvider) > 0 {
+		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
+			return refuse(fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err))
+		}
+	}
+	composed, skipped, stood, err := composeEach(in, s.Node, fps, false, s.Running, failed, ranOf(ctx, r, mesh, s.Running, fps))
+	if err != nil {
+		// Not one module's: the node's own (a value served elsewhere, the mesh's network), said once as the node's.
+		if len(failed) == 0 {
+			return refuse(err)
+		}
+		failed[delivery.HaveNodeWord] = err.Error()
+		composed, skipped, stood = nil, nil, nil
+	}
+	// The node's own composition is judged only where the node runs one: one that runs none applies it only once a want
+	// names it (the node agent's own composer hands it on that want alone), so a candidate does not add it.
+	runsOwn := false
+	for _, c := range running {
+		runsOwn = runsOwn || c.Module == ""
+	}
+	if !runsOwn {
+		for key, c := range composed {
+			if c.Module == "" {
+				delete(composed, key)
+			}
+		}
+	}
+	if _, whole := failed[delivery.HaveNodeWord]; whole {
+		// Nothing composed to compare: every refusal is said, and nothing else.
+		for _, m := range sortedKeys(failed) {
+			a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
+		}
+		heldAsToday(&a, s.HeldToday)
+		a.Verdict = delivery.VerdictOf(a)
+		return a
+	}
+	// A module the composition folds inside the node's own is judged there: the agent also says it runs by module, from
+	// the declaration it kept before the switch (agent.Everything), which is no removal (issue 1126, seed #531).
+	if len(s.InOwn) > 0 {
+		var judged []delivery.Composed
+		for _, c := range running {
+			if c.Module == "" || !slices.Contains(s.InOwn, c.Module) {
+				judged = append(judged, c)
+			}
+		}
+		running = judged
+	}
+	cmp := delivery.CompareComposedWith(composed, running, s.SameValue)
+	// The answer rides in the node's have key: its shown bodies are bounded, the rest named only.
+	budget := MaxShown
+	for i := range cmp.Differs {
+		kept := cmp.Differs[i].Bodies[:0]
+		for _, b := range cmp.Differs[i].Bodies {
+			if n := len(b.Composed) + len(b.Running); n <= budget {
+				budget -= n
+				kept = append(kept, b)
+			} else {
+				kept = append(kept, delivery.ResourceBodies{ID: b.ID, Why: b.Why})
+				a.Note = "some differing resources are named without their bodies: the answer holds at most " +
+					fmt.Sprint(MaxShown) + " bytes of them"
+			}
+		}
+		cmp.Differs[i].Bodies = kept
+	}
+	// A refused module was composed as a stub: what it composed is no difference; its refusal is said.
+	notFailed := func(m string) bool { _, ok := failed[m]; return !ok }
+	a.Same = slices.DeleteFunc(cmp.Same, func(m string) bool { return !notFailed(m) })
+	a.Removed = slices.DeleteFunc(cmp.Removed, func(m string) bool { return !notFailed(m) })
+	a.Differs = slices.DeleteFunc(cmp.Differs, func(d delivery.ModuleDiffers) bool { return !notFailed(d.Module) })
+	cmp.Added = slices.DeleteFunc(cmp.Added, func(d delivery.ModuleAdded) bool { return !notFailed(d.Module) })
+	skipped = slices.DeleteFunc(skipped, func(m string) bool { return !notFailed(m) })
+
+	// What the proposal adds, by node and module: placed by a candidate and not by the trunk on that node.
+	added := map[string]bool{}
+	for node, p := range s.Placements {
+		if p == nil {
+			continue
+		}
+		was := map[string]bool{}
+		for _, m := range trunk[node].Modules {
+			was[m.Module] = true
+		}
+		for _, m := range p.Modules {
+			if !was[m.Module] {
+				added[node+"/"+m.Module] = true
+			}
+		}
+	}
+	unissued := map[string][]string{}
+	refusals := map[string][]string{}
+	for _, x := range stood {
+		node, module := standsInFor(x, s.Node)
+		switch {
+		case node == s.Node && runs[module]:
+			// A value missing for a module the node runs is a refusal, whatever the trunk places (the seed's trunk is
+			// empty, and every module counts as the group's).
+			refusals[module] = append(refusals[module], x)
+		case module != "" && added[node+"/"+module]:
+			if node == s.Node {
+				unissued[module] = append(unissued[module], x)
+			} // another node's addition: the module here that carries it differs, which the assigner judges
+		case module == "" || node != s.Node:
+			// The node's own, or a value this node holds for a module elsewhere (a grant it provides): said as the node's.
+			refusals[delivery.HaveNodeWord] = append(refusals[delivery.HaveNodeWord], x)
+		default:
+			refusals[module] = append(refusals[module], x)
+		}
+	}
+	addedHere := map[string]delivery.ModuleAdded{}
+	for _, m := range cmp.Added {
+		addedHere[m.Module] = m
+	}
+	for _, m := range skipped { // placed, and no build given to compose it at
+		addedHere[m] = delivery.ModuleAdded{Module: m, Unissued: []string{"no build of " + m + " is known to compose it at"}}
+	}
+	for m, xs := range unissued {
+		got := addedHere[m]
+		got.Module = m
+		got.Unissued = append(got.Unissued, xs...)
+		addedHere[m] = got
+	}
+	for _, m := range sortedKeys(addedHere) {
+		a.Added = append(a.Added, addedHere[m])
+	}
+	for _, m := range sortedKeys(refusals) {
+		if _, isAdded := addedHere[m]; isAdded {
+			continue // a module the candidate adds here: what it lacks is said under Added
+		}
+		if _, isFailed := failed[m]; isFailed {
+			continue // said below, as why it could not be composed
+		}
+		a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: "stands in for " + strings.Join(refusals[m], ", ")})
+	}
+	for _, m := range sortedKeys(failed) {
+		a.Refusals = append(a.Refusals, delivery.ModuleRefused{Module: m, Why: failed[m]})
+	}
+	sort.Slice(a.Refusals, func(i, j int) bool { return a.Refusals[i].Module < a.Refusals[j].Module })
+	heldAsToday(&a, s.HeldToday)
+	a.Verdict = delivery.VerdictOf(a)
+	return a
+}
+
+// heldAsToday moves into Held each refusal of a module the node keeps today as it runs (Scope.HeldToday, with how:
+// held, failed, running a build of the old form): the candidate keeps it as the node does, which is no change (issue
+// 1126: a seed reproduces today, and today keeps them so). Each says how it stands today (ModuleRefused.Today). No
+// module is held behind another (issue 1960): a module that reads from a held one composes with what it last offered.
+func heldAsToday(a *delivery.CandidateAnswer, today map[string]string) {
+	if len(today) == 0 {
+		return
+	}
+	kept := a.Refusals[:0]
+	for _, r := range a.Refusals {
+		if w, keep := today[r.Module]; keep {
+			r.Today = w
+			a.Held = append(a.Held, r)
+		} else {
+			kept = append(kept, r)
+		}
+	}
+	a.Refusals = kept
+	if len(a.Refusals) == 0 {
+		a.Refusals = nil
+	}
+}
+
+// maxCulprits bounds the modules one refusal is tried on, each a whole composition.
+const maxCulprits = 8
+
+// MaxShown bounds the bytes of shown resource bodies in one answer (delivery.ModuleDiffers.Bodies).
+const MaxShown = 256 << 10
+
+var (
+	grantStandIn = regexp.MustCompile(`^the grant of \S+ for (\S+) on (\S+)$`)
+	// grantOfStandIn is the provision a grant's stand-in is of.
+	grantOfStandIn = regexp.MustCompile(`^the grant of (\S+) for \S+ on \S+$`)
+	needsStandIn   = regexp.MustCompile(`^(\S+) on (\S+) needs `)
+)
+
+// standsInFor is the node and module a stand-in of compose's words is for: an own secret `module/name`, a port
+// `port module:port`, a grant `the grant of <provision> for <module> on <node>`, a need `<module> on <node> needs ...`;
+// the module empty when the words name none (the certificate, the authority).
+func standsInFor(x, node string) (string, string) {
+	if m := grantStandIn.FindStringSubmatch(x); m != nil {
+		return m[2], m[1]
+	}
+	if m := needsStandIn.FindStringSubmatch(x); m != nil {
+		return m[2], m[1]
+	}
+	if rest, ok := strings.CutPrefix(x, "port "); ok {
+		if module, _, ok := strings.Cut(rest, ":"); ok {
+			return node, module
+		}
+	}
+	if module, _, ok := strings.Cut(x, "/"); ok && !strings.Contains(x, " ") {
+		return node, module
+	}
+	return node, ""
+}
+
+// composeEach is the one rule, for the node that applies and for its answer to a candidate alike, by which a module's
+// own refusal refuses that module and never the node (issue 1126: seed-8 fixed it in the answer alone, and the
+// applying path still refused all of novox for de-spiegel's unset route names). The node is composed; a refusal is laid
+// on the module whose stub (compose.Stub) changes it (culprit), that module is held (compose.Node.Held) and said in
+// failed with the refusal's words, and the rest is composed again, until it composes or the refusal is no single
+// module's, which is answered as the node's (err). Applied composes as the node applies (compose.Reading) and holds the
+// module placed here each stand-in is for; one for no module placed here (the node's own, a value this node holds for a
+// module elsewhere) refuses the node (compose.ErrStoodIn). Not applied, it composes in compose.Foreseeing and answers
+// every stand-in for the caller to judge (Answer).
+//
+// **A held module is what runs of it** (review of the apply, round 1): composed from what running holds of it
+// (compose.Carried of its own composition there; the node's own carries it wherever it runs there), so what the others
+// read of it (the machine ports its containers publish, the routes reaching it) is what runs, and none of its own
+// composition is in out: the node keeps what it last applied.
+//
+// **A hold never spreads** (issue 1126, issue 1960: de-spiegel's hold for an unset value held mailu, which held
+// route-proxy, nftables and postgres on novox). No module is held because a module it reads from is held: a consumer,
+// a collector, the provider of what the held one contributes to and the filter where it listens each compose with what
+// the held module last offered. That offer (what it contributes, contributes many, listens on) is its manifest at the
+// build it runs where one is known (ran: a composition of its own running at another build than it is composed at),
+// else the manifest it is composed from. Only the part of the offer that cannot compose is left out, by provision
+// (culprit): de-spiegel's routes, its names unset, leave route-proxy without them while mailu keeps its smtp account,
+// and the hold says so.
+func composeEach(in compose.Input, node string, fps map[string]string, applied bool, running []delivery.Composed, failed map[string]string,
+	ran func(module string) (catalogue.Manifest, bool)) (out map[string]delivery.Composed, skipped, stood []string, err error) {
+	mode := compose.Foreseeing
+	if applied {
+		mode = compose.Reading
+	}
+	runs := map[string]*delivery.Composed{}
+	for i := range running {
+		if m := running[i].Module; m != "" {
+			runs[m] = &running[i]
+		}
+	}
+	src := map[string]catalogue.Manifest{} // each held module's manifest before it was held, offering what it last offered
+	left := map[string]map[string]bool{}   // by held module, what of its offer is left out (leaveOut)
+	hold := func(m, why, leave string) {
+		if _, done := failed[m]; !done {
+			failed[m] = why // a held module tried again keeps the words it was first held for
+		}
+		if _, ok := src[m]; !ok {
+			man, ok := manifestOn(in, node, m)
+			if !ok {
+				return
+			}
+			if ran != nil {
+				if was, ok := ran(m); ok {
+					man.Contributes, man.ContributesMany, man.Listens = was.Contributes, was.ContributesMany, was.Listens
+				}
+			}
+			src[m] = man
+		}
+		if leave != "" {
+			if left[m] == nil {
+				left[m] = map[string]bool{}
+			}
+			left[m][leave] = true
+			if leave != leaveAll && leave != leaveOwn {
+				failed[m] += "; composed without what it contributes to " + leave + ", which does not compose"
+			}
+		}
+		in = heldAs(in, node, m, src[m], left[m], runs[m])
+	}
+	for _, m := range sortedKeys(failed) {
+		hold(m, failed[m], "")
+	}
+	for {
+		out, skipped, stood, err = compose.CompositionsIn(in, node, fps, mode)
+		if err != nil {
+			module, leave := culprit(in, node, fps, mode, failed, err)
+			if module == "" {
+				return nil, nil, nil, firstReason(err, failed)
+			}
+			hold(module, err.Error(), leave)
+			continue
+		}
+		again := false
+		if applied && len(stood) > 0 {
+			placed := map[string]bool{}
+			for _, m := range assignedOn(in, node) {
+				placed[m] = true
+			}
+			of := map[string][]string{}
+			var nodes []string
+			for _, x := range stood {
+				if n, m := standsInFor(x, node); n == node && placed[m] {
+					of[m] = append(of[m], x)
+				} else {
+					nodes = append(nodes, x)
+				}
+			}
+			for _, m := range sortedKeys(of) {
+				if _, done := failed[m]; !done {
+					hold(m, "stands in for "+strings.Join(of[m], ", "), "")
+					again = true
+					continue
+				}
+				// Already held, and still a stand-in in another module's composition: a grant not yet issued for what
+				// it contributes (a module held for its own secret keeps its contributions, leaveOwn). Its contribution
+				// to that provision is left out, so the provider never applies a stand-in (issue 774, review round 1).
+				for _, x := range of[m] {
+					if g := grantOfStandIn.FindStringSubmatch(x); g != nil && !left[m][g[1]] {
+						hold(m, failed[m], g[1])
+						again = true
+					}
+				}
+			}
+			if !again && len(nodes) > 0 {
+				return nil, nil, nil, fmt.Errorf("%w on %s: %s", compose.ErrStoodIn, node, strings.Join(nodes, ", "))
+			}
+		}
+		if !again {
+			break
+		}
+	}
+	skipped = slices.DeleteFunc(skipped, func(m string) bool { _, held := failed[m]; return held })
+	return out, skipped, stood, nil
+}
+
+// firstReason is err, a refusal no culprit is found for, led by the first reason of each held module it names: a held
+// module's stand-in refused later never replaces why it was held (issue 774, 2026-10-30: mesh-self-check on ace held for
+// "has no bus credential", then refused as "runs as its own account and declares no own secret broker", its bare stub's
+// words, which were all the proposal's refusal said).
+func firstReason(err error, failed map[string]string) error {
+	var named []string
+	for _, m := range sortedKeys(failed) {
+		if strings.Contains(err.Error(), m) {
+			named = append(named, m+" is held: "+failed[m])
+		}
+	}
+	if len(named) == 0 {
+		return err
+	}
+	return fmt.Errorf("%s; its stand-in is then refused: %w", strings.Join(named, "; "), err)
+}
+
+// blames says the composition with m's stub (again) makes m the culprit of err: it composes, or fails otherwise. The
+// runtime's stub is never a runtime (no build is taken in, so it carries no bundle) and always fails otherwise: it is
+// the culprit only where its stub composes (issue 774, 2026-10-30 19:30: node-tools held for any error naming it).
+func blames(m string, again, err error) bool {
+	if m == catalogue.RuntimeModule {
+		// Or where its stub fails only for the modules of their own account it would run (issue 774): they are held
+		// after it, each for its own words, and the node composes the rest.
+		var none *resolution.NoRuntimeToRunError
+		return again == nil || errors.As(again, &none) && none.Held
+	}
+	return again == nil || again.Error() != err.Error()
+}
+
+// leaveAll leaves out the whole of a held module's offer and its own secrets (a bare stub); leaveOwn its own secrets
+// alone, its offer kept; any other word leaves out what it contributes to that provision alone.
+//
+// leaveOwn is tried before leaveAll: a module held for an own secret never made (nextcloud's admin, issue 774,
+// 2026-10-30) keeps what it contributes, so its providers' received files keep it and their helpers never retire its
+// login while it is held.
+const (
+	leaveAll = "*"
+	leaveOwn = "own-secrets"
+)
+
+// assignedOn is the modules placed on node, in placement order.
+func assignedOn(in compose.Input, node string) []string {
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			return n.Assigned
+		}
+	}
+	return nil
+}
+
+// manifestOn is the manifest node composes module from: its Kept, else the catalogue's.
+func manifestOn(in compose.Input, node, module string) (catalogue.Manifest, bool) {
+	for _, n := range in.Nodes {
+		if n.Name == node {
+			if man, ok := n.Kept[module]; ok {
+				return man, true
+			}
+		}
+	}
+	man, ok := in.Catalogue[module]
+	return man, ok
+}
+
+// culprit is the module placed on node whose composition the error is of, and what of its offer to leave out: the
+// first, in placement order, whose stub (compose.Stub) makes the composition in mode succeed or fail otherwise (leave
+// ""); else the first whose stub without what it contributes to one provision does (leave that provision: de-spiegel's
+// routes, its names unset, and not its smtp account, issue 1960); else the first whose bare stub does (leaveAll: its
+// stub contributing nothing, its own secret never issued, issue 1126 seed-8). Empty when none does (the error is not
+// one module's). Modules already refused are passed over for their stub.
+func culprit(in compose.Input, node string, fps map[string]string, mode compose.Mode, failed map[string]string, err error) (string, string) {
+	assigned := assignedOn(in, node)
+	// Only the modules the error names: the words of a module's refusal name it. Each try is a whole composition, so a
+	// refusal naming none is no module's, answered at once rather than after a composition per module (issue 1126: ace's
+	// answer took 7m46s).
+	var order []string
+	for _, m := range assigned {
+		if strings.Contains(err.Error(), m) && len(order) < maxCulprits {
+			order = append(order, m)
+		}
+	}
+	changes := func(m, leave string) bool {
+		_, _, _, again := compose.CompositionsIn(stubbed(in, node, m, leave), node, fps, mode)
+		return blames(m, again, err)
+	}
+	for _, m := range order {
+		if _, done := failed[m]; done {
+			continue
+		}
+		if changes(m, "") {
+			return m, ""
+		}
+	}
+	for _, m := range order {
+		man, ok := manifestOn(in, node, m)
+		if !ok {
+			continue
+		}
+		// One already held is tried again too: held for its build, its stub may still refuse (its own secret never
+		// issued, issue 1126). A provision named in the error is tried first, each at one more composition.
+		var to []string
+		for p := range man.Contributes {
+			to = append(to, p)
+		}
+		for p := range man.ContributesMany {
+			if _, both := man.Contributes[p]; !both {
+				to = append(to, p)
+			}
+		}
+		sort.SliceStable(to, func(i, j int) bool {
+			return strings.Contains(err.Error(), " "+to[i]) && !strings.Contains(err.Error(), " "+to[j])
+		})
+		for _, p := range to {
+			if changes(m, p) {
+				return m, p
+			}
+		}
+		if isBare(man) {
+			continue
+		}
+		if len(man.OwnSecrets) > 0 && changes(m, leaveOwn) {
+			return m, leaveOwn
+		}
+		if changes(m, leaveAll) {
+			return m, leaveAll
+		}
+	}
+	return "", ""
+}
+
+// isBare says a stub contributes nothing and declares no own secret (stubbed, leaveAll).
+func isBare(m catalogue.Manifest) bool {
+	return len(m.Contributes) == 0 && len(m.ContributesMany) == 0 && len(m.OwnSecrets) == 0
+}
+
+// stubbed is in with module held on node as its stub alone (heldAs, nothing of it running), from the manifest node
+// composes it from, leave left out of its offer: a culprit's try.
+func stubbed(in compose.Input, node, module, leave string) compose.Input {
+	man, ok := manifestOn(in, node, module)
+	if !ok {
+		return in
+	}
+	var left map[string]bool
+	if leave != "" {
+		left = map[string]bool{leave: true}
+	}
+	return heldAs(in, node, module, man, left, nil)
+}
+
+// heldAs is in with module held on node (compose.Node.Held): composed from man as what runs of it (compose.Carried of
+// runs; its stub, compose.Stub, when runs is nil or holds nothing of it), as node's Kept; with what left names out of
+// its offer: a provision's contributions, with leaveOwn its own secrets alone, or with leaveAll everything it contributes
+// and its own secrets, none of a held module's own composition being applied, so what it has not been issued (restic's
+// repository on a node it never ran on) is no refusal of the rest.
+func heldAs(in compose.Input, node, module string, man catalogue.Manifest, left map[string]bool, runs *delivery.Composed) compose.Input {
+	out := in
+	out.Nodes = append([]compose.Node(nil), in.Nodes...)
+	for i := range out.Nodes {
+		if out.Nodes[i].Name != node {
+			continue
+		}
+		if left[leaveAll] {
+			man.Contributes, man.ContributesMany, man.OwnSecrets = nil, nil, nil
+		} else if len(left) > 0 {
+			if left[leaveOwn] {
+				man.OwnSecrets = nil
+			}
+			contributes := map[string]map[string]any{}
+			for p, v := range man.Contributes {
+				if !left[p] {
+					contributes[p] = v
+				}
+			}
+			many := maps.Clone(man.ContributesMany)
+			for p := range left {
+				delete(many, p)
+			}
+			man.Contributes, man.ContributesMany = contributes, many
+		}
+		kept := make(map[string]catalogue.Manifest, len(out.Nodes[i].Kept)+1)
+		for k, v := range out.Nodes[i].Kept {
+			kept[k] = v
+		}
+		kept[module] = compose.Carried(man, module, runs)
+		out.Nodes[i].Kept = kept
+		held := make(map[string]bool, len(out.Nodes[i].Held)+1)
+		for k, v := range out.Nodes[i].Held {
+			held[k] = v
+		}
+		held[module] = true
+		out.Nodes[i].Held = held
+	}
+	return out
+}
diff --git a/internal/compose/frombus/answer_rows_test.go b/internal/compose/frombus/answer_rows_test.go
new file mode 100644
index 0000000..daee654
--- /dev/null
+++ b/internal/compose/frombus/answer_rows_test.go
@@ -0,0 +1,596 @@
+package frombus
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// Issue 1126 (the seed's shadow, round 2): a node's answer names every module it cannot compose, not the first only;
+// and a module folded into its own composition that names a build of the old form (de-spiegel on novox, nats, photos,
+// systemd-resolved: their haves name a build-... id and no fingerprint) is left to the node, carried as it runs.
+func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
+	ctx := context.Background()
+	image := "alpine@sha256:" + strings.Repeat("a", 64)
+	manifest := func(module string) []byte {
+		// Its data names its directory, as nats's names ${dir:mesh-state} (issue 1126: novox's own composition refused
+		// "nats says ${dir:mesh-state}, and nats declares no directory mesh-state" when its stub held no directory).
+		return []byte(`{"module":"` + module + `","version":"1","capabilities":["container-runtime"],` +
+			`"own-secrets":{"token":"${dir:state}/token"},` +
+			`"resources":[{"id":"state","type":"directory","path":"/var/lib/` + module + `","mode":"0700"},` +
+			`{"id":"server","type":"container","name":"` + module + `","artifact":"site"}],` +
+			`"build":{"artifacts":[{"name":"site","kind":"upstream","from":"` + image + `"}]}}`)
+	}
+	lemurs := []byte(`{"module":"lemurs","version":"1","resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`)
+	fp := func(c string) string { return "src2:" + strings.Repeat(c, 64) }
+	mk := func(placed ...string) *bus {
+		p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
+		for _, m := range placed {
+			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+		}
+		b := &bus{placements: map[string]delivery.Placement{"n1": p},
+			records:   map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: publicKey(t), SealingKey: "sk", Capabilities: []string{"systemd", "container-runtime"}}},
+			modules:   map[string]delivery.Module{"lemurs": {Manifest: delivery.ManifestDigest(lemurs)}},
+			manifests: map[string][]byte{delivery.ManifestDigest(lemurs): lemurs},
+			builds:    map[string]*delivery.BuilderBuild{}}
+		for _, m := range []string{"web", "api", "spiegel"} {
+			b.own = append(b.own, compose.OwnSecretRow{Node: "n1", Module: m, Name: "token", Origin: "made", SealedTo: "sk", Sealed: `"box"`})
+		}
+		for _, m := range []string{"web", "api", "spiegel"} {
+			raw := manifest(m)
+			b.manifests[delivery.ManifestDigest(raw)] = raw
+			b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+		}
+		// web and api are built, their keys done and waiting for the reference of their image; spiegel has no build of
+		// the new form at all.
+		for i, m := range []string{"web", "api"} {
+			mod := b.modules[m]
+			mod.FP2 = fp(string(rune('1' + i)))
+			b.modules[m] = mod
+			b.builds[m+" "+mod.FP2] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
+				Artifacts: []delivery.BuiltArtifact{{Name: "site", Kind: "image", Digest: "sha256:" + strings.Repeat("b", 64)}}}
+		}
+		return b
+	}
+	given := func(b *bus) map[string]*delivery.Placement {
+		p := b.placements["n1"]
+		return map[string]*delivery.Placement{"n1": &p}
+	}
+
+	// Every refusal: two builds taken in, and a module the composition refuses (its image never built), each named.
+	b := mk("lemurs", "web", "api", "spiegel")
+	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b)},
+		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
+	var refused []string
+	for _, r := range a.Refusals {
+		refused = append(refused, r.Module)
+	}
+	if a.Verdict != delivery.CandidateRefused || a.Refused != "" || !reflect.DeepEqual(refused, []string{"api", "spiegel", "web"}) {
+		t.Errorf("every refusal: %+v, want api, spiegel and web refused, each named", a)
+	}
+	for _, r := range a.Refusals {
+		want := map[string]string{"api": "waits for the reference of site", "web": "waits for the reference of site",
+			"spiegel": "spiegel has not been built for this mesh"}[r.Module]
+		if !strings.Contains(r.Why, want) {
+			t.Errorf("%s refused as %q, want %q", r.Module, r.Why, want)
+		}
+	}
+	if raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Candidates: map[string]delivery.CandidateAnswer{"g": a}}); err != nil {
+		t.Errorf("the answer is not one a have holds: %v (%s)", err, raw)
+	}
+	if lemursOK := slices.ContainsFunc(a.Added, func(m delivery.ModuleAdded) bool { return m.Module == "lemurs" }); !lemursOK {
+		t.Errorf("lemurs, which composes, is not answered beside the refusals: %+v", a)
+	}
+	// Issue 1126: a module the node holds today that the candidate holds too is held as today, no refusal: with every
+	// refused module held today the verdict is no refusal, and each is named under Held.
+	today := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held", "spiegel": "held", "web": "held"}},
+		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
+	if today.Verdict == delivery.CandidateRefused || len(today.Refusals) != 0 || len(today.Held) != 3 || today.Held[0].Why == "" {
+		t.Errorf("held as today: %+v", today)
+	}
+	// A refused module the node does not hold today stays a refusal: holding only api today leaves spiegel and web refused.
+	part := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), HeldToday: map[string]string{"api": "held"}},
+		map[string]string{"lemurs": fp("e"), "web": fp("1"), "api": fp("2"), "spiegel": fp("3")}, nil, "p-h1", 3)
+	if part.Verdict != delivery.CandidateRefused || len(part.Refusals) != 2 || len(part.Held) != 1 || part.Held[0].Module != "api" {
+		t.Errorf("held as today in part: %+v", part)
+	}
+	// No module is held behind one kept today (issue 1960): mailu's own refusal stays a refusal beside de-spiegel's hold.
+	if a := (delivery.CandidateAnswer{Refusals: []delivery.ModuleRefused{{Module: "de-spiegel", Why: "a value is unset"},
+		{Module: "mailu", Why: "no build"}}}); true {
+		heldAsToday(&a, map[string]string{"de-spiegel": "runs a build of the old form"})
+		if len(a.Refusals) != 1 || a.Refusals[0].Module != "mailu" || len(a.Held) != 1 {
+			t.Errorf("held as today spreads: %+v", a)
+		}
+	}
+
+	// The fold: spiegel runs inside the node's own composition at a build of the old form. Its resources are carried as
+	// they run, each after the one it runs after: the node's own is the one it runs, and the node composes itself.
+	b = mk("lemurs", overlay.Name, "spiegel")
+	p := b.placements["n1"]
+	p.Decided.Endpoint = "n1.example:51820"
+	b.placements["n1"] = p
+	fps := map[string]string{"lemurs": fp("e")}
+	stub := Scope{Node: "n1"}
+	in, err := Input(ctx, b, Mesh{}, stub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	in.Nodes[0].Kept = map[string]catalogue.Manifest{"spiegel": compose.Stub(in.Catalogue["spiegel"])}
+	base, _, err := compose.Compositions(in, "n1", fps, compose.Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A refusal naming no module placed here is no module's: no compose is spent stubbing each in turn (issue 1126: ace's
+	// answer took 7m46s, one compose per module), though here a stub would compose.
+	if m, _ := culprit(in, "n1", fps, compose.Foreseeing, map[string]string{}, fmt.Errorf("nothing in this mesh provides \"artifact-store\"")); m != "" {
+		t.Errorf("a refusal naming no placed module was laid on %s", m)
+	}
+	ownKey, _ := delivery.ComposedNodeKey("n1")
+	own := base[ownKey]
+	carriedRes := []json.RawMessage{
+		json.RawMessage(`{"id":"spiegel.state","type":"directory","path":"/var/lib/spiegel","mode":"0700"}`),
+		json.RawMessage(`{"id":"spiegel.server","type":"container","name":"spiegel","image":"registry.example/spiegel@sha256:` + strings.Repeat("c", 64) + `"}`)}
+	// They run after the node's first own resource.
+	own.Resources = append(append(append([]json.RawMessage{}, own.Resources[:1]...), carriedRes...), own.Resources[1:]...)
+	var running []delivery.Composed
+	for k, c := range base {
+		if k == ownKey {
+			c = own
+		}
+		running = append(running, c)
+	}
+	scope := Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}
+	got, _, held, err := Compose(ctx, b, Mesh{}, scope, fps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatalf("the node does not compose itself with spiegel folded at a build of the old form: %v", err)
+	}
+	gotOwn, _ := json.Marshal(got[ownKey].Resources)
+	wantOwn, _ := json.Marshal(own.Resources)
+	if string(gotOwn) != string(wantOwn) {
+		t.Errorf("the node's own composition is\n%s\nwant what runs\n%s", gotOwn, wantOwn)
+	}
+	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, running, "p-h1", 3)
+	if a.Verdict != delivery.CandidateSame {
+		t.Errorf("the fold's answer: %+v, want the same", a)
+	}
+	// (A) The agent also says spiegel runs by module, from the declaration kept before the switch (agent.Everything): a
+	// module the composition folds is judged inside the node's own, not as removed (issue 1126, seed #531's answer).
+	keptToo := append(append([]delivery.Composed{}, running...), delivery.Composed{Node: "n1", Module: "spiegel", Resources: carriedRes})
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, keptToo, "p-h1", 3); a.Verdict != delivery.CandidateSame || len(a.Removed) != 0 {
+		t.Errorf("a folded module running from the kept declaration is answered %+v, want the same", a)
+	}
+	// (B) The node's own composition carries its bus membership as it runs it (the controller's, from its store): composed
+	// the same, not 'in what runs, not composed' (seed #531, novox).
+	membership := json.RawMessage(`{"id":"bus-membership","type":"file","path":"` + catalogue.BusMembershipPath + `","sealed":"{\"box\":\"m\"}","mode":"0600"}`)
+	withMembership := make([]delivery.Composed, 0, len(running))
+	for _, c := range running {
+		if c.Module == "" {
+			c.Resources = append(append([]json.RawMessage{}, c.Resources...), membership)
+		}
+		withMembership = append(withMembership, c)
+	}
+	if a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"spiegel"}}, fps, withMembership, "p-h1", 3); a.Verdict != delivery.CandidateSame {
+		t.Errorf("the node's own with its bus membership is answered %+v, want the same", a)
+	}
+	// Without what runs, the fold composes spiegel from its manifest, as before, and the composition refuses it.
+	if _, _, held, err := Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}}, fps); err != nil ||
+		!strings.Contains(held["spiegel"], "spiegel has not been built for this mesh") {
+		t.Errorf("composed spiegel without what runs: %v %v, want spiegel held alone", err, held)
+	}
+
+	// (C) Issue 1126, C5: what the others read of a module carried as it runs is what runs, never its stub's: the filter
+	// opens the machine port its running container publishes (de-spiegel's 20005 on novox, not its software's 8080; a
+	// stub had no container, so snake's 80 on ace was opened beside the route proxy's). And C6: the operator export's file
+	// a module that keeps it runs is carried as it runs (mesh-vault.kept on novox), since the node holds no export.
+	listening := []byte(`{"module":"spiegel","version":"1","capabilities":["container-runtime"],` +
+		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"token":"${dir:state}/token"},` +
+		`"resources":[{"id":"state","type":"directory","path":"/var/lib/spiegel","mode":"0700"},` +
+		`{"id":"server","type":"container","name":"spiegel","artifact":"site","ports":["8080"]}],` +
+		`"build":{"artifacts":[{"name":"site","kind":"upstream","from":"` + image + `"}]}}`)
+	nft := []byte(`{"module":"nft","version":"1","capabilities":["systemd"],"filtering":{"into":"/etc/nftables.conf"}}`)
+	vault := []byte(`{"module":"vault","version":"1","capabilities":["systemd"],"keeps":"/var/lib/vault/root",` +
+		`"resources":[{"id":"service","type":"service","unit":"vault.service","state":"running","boot":"enabled"}]}`)
+	b = mk("lemurs", overlay.Name, "spiegel", "nft", "vault")
+	for m, raw := range map[string][]byte{"spiegel": listening, "nft": nft, "vault": vault} {
+		b.manifests[delivery.ManifestDigest(raw)] = raw
+		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+	}
+	p = b.placements["n1"]
+	p.Decided.Endpoint = "n1.example:51820"
+	for i := range p.Modules {
+		if p.Modules[i].Module == "spiegel" {
+			p.Modules[i].Ports = map[string]int{"8080": 20005}
+		}
+	}
+	b.placements["n1"] = p
+	rec := b.records["n1"]
+	rec.OutwardLinks = []string{"eth0"}
+	b.records["n1"] = rec
+	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "vault": fp("9")}
+	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
+		t.Fatal(err)
+	}
+	in.Nodes[0].Kept = map[string]catalogue.Manifest{"spiegel": compose.Stub(in.Catalogue["spiegel"])}
+	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
+		t.Fatal(err)
+	}
+	keptFile := json.RawMessage(`{"digest":"sha256:` + strings.Repeat("d", 64) + `","id":"vault.kept","mode":"0600","module":"vault","path":"/var/lib/vault/root/export.json","size":143604,"type":"file"}`)
+	running = nil
+	for _, c := range base {
+		switch c.Module {
+		case "":
+			c.Resources = append(append([]json.RawMessage{}, c.Resources...),
+				json.RawMessage(`{"id":"spiegel.state","type":"directory","path":"/var/lib/spiegel","mode":"0700"}`),
+				json.RawMessage(`{"id":"spiegel.server","type":"container","name":"spiegel","image":"registry.example/spiegel@sha256:`+strings.Repeat("c", 64)+`","ports":["10.77.0.1:20005:8080"]}`),
+				json.RawMessage(`{"id":"spiegel.server-env","type":"file","path":"/var/lib/spiegel/server.env","mode":"0600","content":"A=1\n"}`))
+		case "vault":
+			c.Resources = append(append([]json.RawMessage{}, c.Resources...), keptFile)
+		}
+		running = append(running, c)
+	}
+	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"spiegel"}, Running: running}, fps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatalf("the node does not compose itself with spiegel carried: %v", err)
+	}
+	var rules string
+	var keptComposed json.RawMessage
+	for _, c := range got {
+		for _, raw := range c.Resources {
+			var r struct {
+				ID      string `json:"id"`
+				Content string `json:"content"`
+			}
+			_ = json.Unmarshal(raw, &r)
+			switch r.ID {
+			case "nft." + catalogue.FilteringID():
+				rules = r.Content
+			case "vault." + resolution.KeptID():
+				keptComposed = raw
+			}
+		}
+	}
+	if !strings.Contains(rules, "# spiegel — the site") || !strings.Contains(rules, "dport 20005 accept") || strings.Contains(rules, "dport 8080") {
+		t.Errorf("the filter does not open the machine port spiegel runs at:\n%s", rules)
+	}
+	// The paths a carried module owns are its manifest's, as the controller composes them, never what runs of it (issue
+	// 1126, seed-8 #542: on ace, the folded f1-circuits, snake and txt-game, whose manifests leave their directories and
+	// files to ${dir:…}, owned their /var/lib paths on the node and none on the controller, shifting node-tools'
+	// MESH_OWNED_PATHS). f1-circuits' manifest at the indexer's commit (c0ea2c94) is captured; what runs of it is
+	// composed from that manifest by the controller's rule (the directory at /var/lib/f1-circuits, its file, its container).
+	for _, c := range running {
+		if c.Module == "" && !reflect.DeepEqual(compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths, []string{"/var/lib/spiegel"}) {
+			t.Errorf("spiegel carried owns %v, want its manifest's /var/lib/spiegel alone", compose.Carried(in.Catalogue["spiegel"], "spiegel", &c).OwnsPaths)
+		}
+	}
+	f1raw, err := os.ReadFile("testdata/f1-circuits-c0ea2c94.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	f1, err := catalogue.Decode(f1raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f1runs := delivery.Composed{Node: "ace", Resources: []json.RawMessage{
+		json.RawMessage(`{"id":"f1-circuits.state","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits","mode":"0700"}`),
+		json.RawMessage(`{"id":"f1-circuits.cache","module":"f1-circuits","type":"directory","path":"/var/lib/f1-circuits/cache","mode":"0700"}`),
+		json.RawMessage(`{"id":"f1-circuits.site-env","module":"f1-circuits","type":"file","path":"/var/lib/f1-circuits/site.env","mode":"0644","content":"F1_CIRCUITS_BASE_URL=https://f1.example\n"}`),
+		json.RawMessage(`{"id":"f1-circuits.server","module":"f1-circuits","type":"container","name":"f1-circuits","image":"registry.example/f1@sha256:` + strings.Repeat("c", 64) + `"}`)}}
+	if got, want := resolution.DeclaredPaths(compose.Carried(f1, "f1-circuits", &f1runs)), resolution.DeclaredPaths(f1); !reflect.DeepEqual(got, want) {
+		t.Errorf("f1-circuits carried owns %v, want what the controller composes from its manifest, %v", got, want)
+	}
+	// Issue 1126: a held module hands no template its build kept for a file it no longer carries (novox's node:
+	// "postgres: its build kept a template for consumers"), but keeps its items and their templates, so what it
+	// contributes to other modules' collections still reaches them.
+	for _, row := range []struct {
+		name   string
+		handed *catalogue.Handed
+		items  []catalogue.Item
+	}{
+		{"templates and items", &catalogue.Handed{Templates: map[string]string{"consumers": "files/consumers.json"},
+			Items: map[string]string{"routes": "files/routes.tmpl"}}, []catalogue.Item{{Collection: "routes", Content: "x"}}},
+		{"items alone", nil, []catalogue.Item{{Collection: "routes", Content: "x"}}},
+	} {
+		kept := f1
+		kept.Handed, kept.Items = row.handed, row.items
+		st := compose.Stub(kept)
+		if st.Handed != nil && st.Handed.Templates != nil {
+			t.Errorf("%s: a stub hands templates %v", row.name, st.Handed.Templates)
+		}
+		if !reflect.DeepEqual(st.Items, row.items) {
+			t.Errorf("%s: a stub collects %+v, want its items %+v", row.name, st.Items, row.items)
+		}
+		if row.handed != nil && (st.Handed == nil || !reflect.DeepEqual(st.Handed.Items, row.handed.Items) || row.handed.Templates == nil) {
+			t.Errorf("%s: a stub hands item templates %+v, want %v and its manifest untouched", row.name, st.Handed, row.handed.Items)
+		}
+	}
+	var k1, k2 any
+	_ = json.Unmarshal(keptComposed, &k1)
+	_ = json.Unmarshal(keptFile, &k2)
+	if !reflect.DeepEqual(k1, k2) {
+		t.Errorf("the operator export is composed as %s, want the file that runs %s", keptComposed, keptFile)
+	}
+
+	// (D) Issue 1126, seed-8 (mesh-catalog #542): a module's own refusal refuses that module, never the node. novox runs
+	// de-spiegel folded, and its manifest at the indexer's commit (e25e1beb, captured) asks four required config values
+	// for its route names that nothing sets. novox answered the whole candidate refused ("de-spiegel contributing
+	// praktijk to route says ${setting:praktijk-name} ...": its stub still contributed the route). Only de-spiegel is
+	// refused, in the config form's words; the rest is judged. Issue 1960, novox's chain on 2026-10-29: the hold spread
+	// to mailu (its smtp provider) and proxy (its route provider), and from them on. Neither is held now: proxy composes
+	// without de-spiegel's routes, which do not compose, and mailu with its smtp account, which does.
+	spiegel, err := os.ReadFile("testdata/de-spiegel-e25e1beb.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxy := []byte(`{"module":"proxy","version":"1","capabilities":["systemd"],"provides":[{"name":"route","scope":"mesh"}],` +
+		`"resources":[{"id":"service","type":"service","unit":"proxy.service","state":"running","boot":"enabled"}]}`)
+	mailu := []byte(`{"module":"mailu","version":"1","capabilities":["systemd"],"provides":[{"name":"smtp","scope":"mesh"}],` +
+		`"resources":[{"id":"service","type":"service","unit":"mailu.service","state":"running","boot":"enabled"}]}`)
+	b = mk("lemurs", overlay.Name, "mailu", "proxy", "de-spiegel")
+	for m, raw := range map[string][]byte{"de-spiegel": spiegel, "proxy": proxy, "mailu": mailu} {
+		b.manifests[delivery.ManifestDigest(raw)] = raw
+		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+	}
+	p = b.placements["n1"]
+	p.Decided.Endpoint = "n1.example:51820"
+	b.placements["n1"] = p
+	fps = map[string]string{"lemurs": fp("e"), "proxy": fp("f"), "mailu": fp("d")}
+	a = Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given(b), InOwn: []string{"de-spiegel"}}, fps, nil, "p-h1", 3)
+	refused = nil
+	for _, r := range a.Refusals {
+		refused = append(refused, r.Module)
+		if r.Module == "de-spiegel" && (!strings.Contains(r.Why, "${config:praktijk-name}") || strings.Contains(r.Why, "${setting:")) {
+			t.Errorf("de-spiegel is refused in other words than its config form's: %s", r.Why)
+		}
+	}
+	if a.Refused != "" || !reflect.DeepEqual(refused, []string{"de-spiegel"}) {
+		t.Errorf("a module's own refusal: %+v, want de-spiegel refused alone, the node, mailu and proxy not", a)
+	}
+	for _, m := range []string{"lemurs", "mailu", "proxy"} {
+		if !slices.ContainsFunc(a.Added, func(x delivery.ModuleAdded) bool { return x.Module == m }) {
+			t.Errorf("%s, which composes, is not judged beside de-spiegel's refusal: %+v", m, a)
+		}
+	}
+
+	// (E) Issue 1126, the applying path (review of the seed): the composition novox applies follows the same rule. It
+	// composed with no culprit, so de-spiegel's unset route names refused the whole node and every module it runs was
+	// marked not composed. Now de-spiegel is held, its refusal said in its config form's words, with proxy, which
+	// receives its routes; lemurs composes, and the node's own composition carries de-spiegel as it runs, so applying it
+	// removes nothing of it.
+	spiegelRuns := []json.RawMessage{
+		json.RawMessage(`{"id":"de-spiegel.state","type":"directory","path":"/var/lib/de-spiegel","mode":"0755"}`),
+		json.RawMessage(`{"id":"de-spiegel.server-env","type":"file","path":"/var/lib/de-spiegel/server.env","mode":"0600","content":"A=1\n"}`),
+		json.RawMessage(`{"id":"de-spiegel.server","type":"container","name":"de-spiegel","image":"registry.example/de-spiegel@sha256:` + strings.Repeat("c", 64) + `"}`)}
+	if in, err = Input(ctx, b, Mesh{}, stub); err != nil {
+		t.Fatal(err)
+	}
+	in.Nodes[0].Kept = map[string]catalogue.Manifest{"de-spiegel": compose.Stub(in.Catalogue["de-spiegel"])}
+	in.Nodes[0].Kept["de-spiegel"] = func(m catalogue.Manifest) catalogue.Manifest {
+		m.Contributes, m.ContributesMany = nil, nil
+		return m
+	}(in.Nodes[0].Kept["de-spiegel"])
+	if base, _, err = compose.Compositions(in, "n1", fps, compose.Reading); err != nil {
+		t.Fatal(err)
+	}
+	running = nil
+	for _, c := range base {
+		if c.Module == "" {
+			c.Resources = append(append([]json.RawMessage{}, c.Resources...), spiegelRuns...)
+		}
+		running = append(running, c)
+	}
+	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", InOwn: []string{"de-spiegel"}, Running: running}, fps)
+	if err != nil {
+		t.Fatalf("de-spiegel's own refusal refuses the node's whole composition: %v", err)
+	}
+	if len(held) != 1 || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") || !strings.Contains(held["de-spiegel"], "without what it contributes to route") {
+		t.Errorf("held %v, want de-spiegel alone, in its config form's words, composed without its routes", held)
+	}
+	for _, m := range []string{"lemurs", "mailu", "proxy"} {
+		if key, _ := delivery.ComposedKey("n1", m, fps[m]); got[key].Module != m {
+			t.Errorf("%s is not composed beside de-spiegel's hold: %v", m, sortedKeys(got))
+		}
+	}
+	carries := func(c delivery.Composed, what string) {
+		t.Helper()
+		ownRes, _ := json.Marshal(c.Resources)
+		for _, raw := range spiegelRuns {
+			var r struct{ ID string }
+			_ = json.Unmarshal(raw, &r)
+			if !strings.Contains(string(ownRes), `"id":"`+r.ID+`"`) {
+				t.Errorf("%s: the node's own composition drops %s, which de-spiegel runs: %s", what, r.ID, ownRes)
+			}
+		}
+	}
+	carries(got[ownKey], "folded")
+	// (F) Leaving the fold (review of the apply, round 1, finding 1): de-spiegel's want names a build of the new form,
+	// so it is no longer folded, while its names are still unset and the node's own still runs it. Held, it is carried
+	// in the node's own as it runs until a composition of its own is handed: else the node's own apply removes its
+	// container, files and units (issue 1945 by a new path).
+	fps["de-spiegel"] = fp("7")
+	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: running}, fps)
+	if err != nil || !strings.Contains(held["de-spiegel"], "${config:praktijk-name}") {
+		t.Fatalf("de-spiegel leaving the fold: %v, held %v", err, held)
+	}
+	spiegelKey, _ := delivery.ComposedKey("n1", "de-spiegel", fps["de-spiegel"])
+	if _, ok := got[spiegelKey]; ok {
+		t.Errorf("held de-spiegel's own composition is handed")
+	}
+	carries(got[ownKey], "leaving the fold")
+
+	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
+	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
+	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
+	// reads what site listens on, composes with it (issue 1960: a hold never spreads).
+	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
+		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
+		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
+		`{"id":"server","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}]}`)
+	b = mk("lemurs", overlay.Name, "site", "nft")
+	for m, raw := range map[string][]byte{"site": site, "nft": nft} {
+		b.manifests[delivery.ManifestDigest(raw)] = raw
+		b.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+	}
+	p = b.placements["n1"]
+	p.Decided.Endpoint = "n1.example:51820"
+	for i := range p.Modules {
+		if p.Modules[i].Module == "site" {
+			p.Modules[i].Ports = map[string]int{"8080": 20005}
+		}
+	}
+	b.placements["n1"] = p
+	rec = b.records["n1"]
+	rec.OutwardLinks = []string{"eth0"}
+	b.records["n1"] = rec
+	fps = map[string]string{"lemurs": fp("e"), "nft": fp("f"), "site": fp("8")}
+	siteRuns := delivery.Composed{Node: "n1", Module: "site", FP: fps["site"], Resources: []json.RawMessage{
+		json.RawMessage(`{"id":"site.state","module":"site","type":"directory","path":"/var/lib/site","mode":"0700"}`),
+		json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["10.77.0.1:20005:8080"]}`)}}
+	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
+	nftKey, _ := delivery.ComposedKey("n1", "nft", fps["nft"])
+	if err != nil || held["site"] == "" || held["nft"] != "" || got[nftKey].Module != "nft" {
+		t.Fatalf("site, its own secret never issued: %v, held %v; want site held alone, and the filter composed", err, held)
+	}
+	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 20005") {
+		t.Errorf("the filter drops held site's opening where it runs (20005): %s", rules)
+	}
+	for key, c := range got {
+		for _, raw := range c.Resources {
+			if strings.Contains(string(raw), "dport 8080") || (c.Module == "nft" && !strings.Contains(string(raw), "dport 20005") && strings.Contains(string(raw), "# site")) {
+				t.Errorf("%s composes held site from its stub, not from what runs: %s", key, raw)
+			}
+		}
+	}
+	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
+	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
+	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
+	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
+	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
+		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
+	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
+	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
+		b2.manifests[delivery.ManifestDigest(raw)] = raw
+		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+	}
+	p2 := b2.placements["n1"]
+	p2.Decided.Endpoint = "n1.example:51820"
+	for i := range p2.Modules {
+		if p2.Modules[i].Module == "site" {
+			p2.Modules[i].Ports = map[string]int{"8080": 20005}
+		}
+	}
+	b2.placements["n1"] = p2
+	b2.records["n1"] = rec
+	b2.held = true
+	fps["app"] = fp("9")
+	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
+	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
+	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
+		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
+	}
+	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
+		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
+	}
+	delete(fps, "app")
+	// A held module's offer is left out by provision, never whole when one part composes (issue 1960): de-spiegel's
+	// routes, its names unset, leave the proxy without them, and its smtp account stays with mailu.
+	withProxy := compose.Input{Catalogue: map[string]catalogue.Manifest{},
+		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder"}}}}
+	feeder := catalogue.Manifest{Module: "feeder", Contributes: map[string]map[string]any{"route": {"name": "x"}, "smtp": {"account": "feeder"}},
+		OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}}}
+	for _, row := range []struct {
+		left             map[string]bool
+		route, smtp, own bool
+	}{{nil, true, true, true}, {map[string]bool{"route": true}, false, true, true}, {map[string]bool{leaveOwn: true}, true, true, false}, {map[string]bool{leaveAll: true}, false, false, false}} {
+		k := heldAs(withProxy, "n1", "feeder", feeder, row.left, nil).Nodes[0].Kept["feeder"]
+		if _, r := k.Contributes["route"]; r != row.route || (k.Contributes["smtp"] != nil) != row.smtp || (len(k.OwnSecrets) > 0) != row.own {
+			t.Errorf("held leaving out %v offers %+v, own secrets %v", row.left, k.Contributes, k.OwnSecrets)
+		}
+	}
+	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
+	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
+	// build that runs (7) listens on 8080. The filter composes with what site last offered, its manifest at the build
+	// that runs (issue 1960: a hold never spreads), so it opens 8080 and nothing applied opens 9090.
+	moved := []byte(strings.Replace(string(site), `"port":8080`, `"port":9090`, 1))
+	b.manifests[delivery.ManifestDigest(moved)] = moved
+	b.modules["site"] = delivery.Module{Manifest: delivery.ManifestDigest(moved)}
+	for i := range p.Modules {
+		p.Modules[i].Ports = nil
+	}
+	b.placements["n1"] = p
+	siteRuns.Resources[1] = json.RawMessage(`{"id":"site.server","module":"site","type":"container","name":"site","image":"registry.example/site@sha256:` + strings.Repeat("c", 64) + `","ports":["8080"]}`)
+	siteRuns.FP = fp("7")
+	b.manifests[delivery.ManifestDigest(site)] = site
+	b.builds["site "+fp("7")] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: delivery.ManifestDigest(site)}
+	got, _, held, err = Compose(ctx, b, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
+	if err != nil || held["site"] == "" || held["nft"] != "" {
+		t.Errorf("site moved to 9090 in its new manifest: %v, held %v; want site held alone", err, held)
+	}
+	if rules, _ := json.Marshal(got[nftKey].Resources); !strings.Contains(string(rules), "dport 8080") {
+		t.Errorf("the filter drops what held site last offered (8080): %s", rules)
+	}
+	for key, c := range got {
+		for _, raw := range c.Resources {
+			if strings.Contains(string(raw), "dport 9090") {
+				t.Errorf("%s opens 9090, which held site's new manifest names and nothing runs: %s", key, raw)
+			}
+		}
+	}
+}
+
+// A module another node cannot run in this composition offers nothing in it: the refusal names it and why
+// (issue 1126, probe #532: ace and g14 answered "nothing in this mesh provides artifact-store … assign distribution to a
+// node" while novox runs it). And a refusal no module's stub changes is answered at once, not after a compose per module
+// (ace took 7m46s).
+func otherNodeNotResolvedIsNamed(t *testing.T) {
+	ctx := context.Background()
+	prov := []byte(`{"module":"prov","version":"1","capabilities":["container-runtime"],"provides":[{"name":"thing","scope":"mesh"}]}`)
+	cons := []byte(`{"module":"cons","version":"1","requires":["thing"]}`)
+	// n2 runs prov, which needs a container runtime n2's record does not say it has: n2's set does not resolve here.
+	b := &bus{placements: map[string]delivery.Placement{
+		"n1": {Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1", Endpoint: "n1.example:51820"}, Modules: []delivery.PlacedModule{{Module: "cons"}, {Module: overlay.Name}}},
+		"n2": {Node: "n2", Decided: delivery.NodeDecided{Address: "10.77.0.2"}, Modules: []delivery.PlacedModule{{Module: "prov"}, {Module: overlay.Name}}}},
+		records:   map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: publicKey(t)}, "n2": {Node: "n2", TunnelKey: publicKey(t)}},
+		modules:   map[string]delivery.Module{"prov": {Manifest: delivery.ManifestDigest(prov)}, "cons": {Manifest: delivery.ManifestDigest(cons)}},
+		manifests: map[string][]byte{delivery.ManifestDigest(prov): prov, delivery.ManifestDigest(cons): cons}}
+	given := map[string]*delivery.Placement{}
+	for n, p := range b.placements {
+		p := p
+		given[n] = &p
+	}
+	a := Answer(ctx, b, Mesh{}, Scope{Node: "n1", Placements: given}, map[string]string{"cons": "src2:" + strings.Repeat("1", 64)}, nil, "p-h1", 1)
+	if a.Verdict != delivery.CandidateRefused || !strings.Contains(a.Refused, "prov on n2 lacks container-runtime") {
+		t.Errorf("a refusal for want of n2's provider = %+v", a)
+	}
+}
+
+// A node that reaches no artifact store says what its composition holds of one (issue 1126: ace and g14 answered
+// "reaches no artifact store", and nothing said why).
+func noStoreReachedSaysWhy(t *testing.T) {
+	in := compose.Input{Catalogue: map[string]catalogue.Manifest{
+		"distribution": {Module: "distribution", Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5000}}}},
+		Nodes: []compose.Node{{Name: "g14", Assigned: []string{"adwaita"}}, {Name: "novox", Assigned: []string{"distribution"}}}}
+	if got := storeSought(in); got != "the composition holds g14, novox; artifact-store is served by distribution on novox, none of it on the private network with a port" {
+		t.Errorf("said %q", got)
+	}
+	in.Nodes = in.Nodes[:1]
+	if got := storeSought(in); got != "the composition holds g14; no module placed there serves artifact-store" {
+		t.Errorf("said %q", got)
+	}
+}
diff --git a/internal/compose/frombus/export.go b/internal/compose/frombus/export.go
new file mode 100644
index 0000000..8726c0f
--- /dev/null
+++ b/internal/compose/frombus/export.go
@@ -0,0 +1,112 @@
+package frombus
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+)
+
+// Export is one node's placement as the composition input the controller fills says it (novox/hq ADR 0555 §6, ADR 0567
+// §7): the inverse of Input for what a person decides, so the controller's one read-only verb `placement-export`
+// answers, from its own store by its own code, exactly what the seat's adopt proposes as the seed. Its answer must stay
+// stable for the same store, since adopt checks its digest again at the warrant.
+// What the machine observes (its record) is not in it.
+func Export(in compose.Input, node string) (delivery.Placement, error) {
+	var n *compose.Node
+	for i := range in.Nodes {
+		if in.Nodes[i].Name == node {
+			n = &in.Nodes[i]
+		}
+	}
+	if n == nil {
+		return delivery.Placement{}, fmt.Errorf("frombus: the input has no node %q", node)
+	}
+	// At the version a placement key is read at, with a list of modules even when none is placed: the export is the
+	// seed's value, and the reader refuses a value of version 0 or without its modules.
+	p := delivery.Placement{V: delivery.Version, Node: node, Modules: []delivery.PlacedModule{}, Decided: delivery.NodeDecided{
+		Endpoint: n.Place.Endpoint, Site: n.Place.Site, Hub: n.Place.Hub, Address: n.Place.Address,
+		PublicDomain: n.PublicDomain, Account: n.Account, AccountHome: n.AccountHome, AgentAccount: n.AgentAccount,
+		AgentHome: n.AgentAccountHome, Adopted: n.Adopted, Taken: n.Taken}}
+	// The tunnel found at the node's adoption: the one its private network took over, or, on the hub, the mesh's adopted
+	// one whether or not the hub took it; and the names a person gave the hub's carried peers.
+	if t, ok := in.Tunnels[node]; ok {
+		rt := recordTunnelOf(t.Tunnel)
+		p.Decided.Tunnel = &rt
+	} else if in.Adopted != nil && in.Adopted.Hub == node {
+		rt := recordTunnelOf(in.Adopted.Tunnel)
+		p.Decided.Tunnel = &rt
+	}
+	if n.Place.Hub {
+		for _, c := range in.CarriedPeers {
+			if c.Named != "" {
+				if p.Decided.PeerNames == nil {
+					p.Decided.PeerNames = map[string]string{}
+				}
+				p.Decided.PeerNames[c.PublicKey] = c.Named
+			}
+		}
+	}
+	for _, module := range n.Assigned {
+		m := delivery.PlacedModule{Module: module}
+		for port, at := range n.Ports[module] {
+			if m.Ports == nil {
+				m.Ports = map[string]int{}
+			}
+			m.Ports[strconv.Itoa(port)] = at
+		}
+		for provision, to := range n.Bound[module] {
+			if m.Bindings == nil {
+				m.Bindings = map[string]delivery.Provider{}
+			}
+			m.Bindings[provision] = delivery.Provider{Node: to.Node, Module: to.Module}
+		}
+		// A module in the settings form keeps its config values in its layers, not in mesh-config: they are exported with
+		// the placement. A module in the config form has mesh-config's values laid into its layer, which are not.
+		settingsForm := !in.Catalogue[module].DeclaresConfig()
+		for _, layer := range n.Settings[module] {
+			if layer.From == catalogue.MeshWideLayer {
+				m.HasMesh, m.MeshWide = true, layer.Placement
+				if settingsForm && len(layer.Values) > 0 {
+					m.MeshValues = layer.Values
+				}
+			} else {
+				m.HasLayer, m.Layer = true, layer.Placement
+				if settingsForm && len(layer.Values) > 0 {
+					m.Values = layer.Values
+				}
+			}
+		}
+		p.Modules = append(p.Modules, m)
+	}
+	for provision, to := range n.Pins {
+		if p.Pins == nil {
+			p.Pins = map[string]delivery.Provider{}
+		}
+		p.Pins[provision] = delivery.Provider{Node: to.Node, Module: to.Module}
+	}
+	for _, h := range in.Holdings {
+		if h.Node == node {
+			p.Holds = append(p.Holds, delivery.Holding{Claim: h.Claim, Scope: h.Scope, Module: h.Module, Site: h.Site, Kind: h.Kind})
+		}
+	}
+	sort.SliceStable(p.Holds, func(i, j int) bool {
+		if p.Holds[i].Claim != p.Holds[j].Claim {
+			return p.Holds[i].Claim < p.Holds[j].Claim
+		}
+		return p.Holds[i].Module < p.Holds[j].Module
+	})
+	return p, nil
+}
+
+func recordTunnelOf(t compose.Tunnel) delivery.RecordTunnel {
+	out := delivery.RecordTunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, peer := range t.Peers {
+		out.Peers = append(out.Peers, delivery.RecordTunnelPeer{PublicKey: peer.PublicKey, Address: peer.Address})
+	}
+	return out
+}
diff --git a/internal/compose/frombus/frombus.go b/internal/compose/frombus/frombus.go
new file mode 100644
index 0000000..f063f49
--- /dev/null
+++ b/internal/compose/frombus/frombus.go
@@ -0,0 +1,1168 @@
+// Package frombus fills mesh-sdk's composition input from what is on the bus, so a node agent, the composition check
+// and the grants part compose with one composer over the same inputs (novox/hq ADR 0547 §2, ADR 0549 §3; issue 1126).
+//
+// **One composer, three callers.** compose.Compositions is the composer; Input is how each caller fills its
+// compose.Input from the bus: the node agent for its own node (ADR 0547 §2), the seat mesh-placement's holder judging a
+// proposal for every node (ADR 0567 §4), and the grants part (ADR 0547 §5). Each reads the bus with its own credential
+// through a Reader, so this package holds no bus client, no store and no timer: what it is given is all it reads.
+//
+// **What it reads, and from whom.**
+//   - which modules run on each node, with their pins, holdings, host ports, bindings and settings placement: the
+//     seat mesh-placement's state `placement`, one key per node (ADR 0567 §1);
+//   - what a person decided of each node (its endpoint, site, hub, address on the private network, public domain and
+//     accounts): the same placement key, Placement.Decided;
+//   - what each node observes of itself (its tunnel key, capabilities, keys, certificate, links and networks): the
+//     node's own have key, `<node>.node` (HaveNode.Record); the tunnel found at a node's adoption and the names of the hub's peers are decided,
+//     in its placement, and whether the hub took the tunnel over and who enrolled under a peer's key are read from both;
+//   - every module's manifest: the indexer's `modules.<module>` and its manifests by digest; for each module placed on
+//     the composing node, its built manifest instead: the builder's done key at the trunk's FP2, or at the fingerprint
+//     the node's want names where it runs another build (Scope.KeptAt), resolved by the controller's own take-in rule
+//     (takein.Manifest), a moved module's templates archive read in the artifact store (issue 1126);
+//   - each module's config values on a node: mesh-config's resolved state, the composing node's slice alone unless the
+//     caller composes every node (ADR 0547 §2, the prepare step's L4); of another node, only the keys its modules'
+//     served values fill (catalogue.ServedSettings), which every consumer is told (issue 1126).
+//
+// **Own secrets and pair credentials** come from the vault sealed to the composing node's key (OwnSecrets, Credentials),
+// for that node alone: as a consumer and as a provider, exactly the keys compose.CredentialsNeeded names. **Not yet
+// read** (each a later subtask of issue 1126): licences (none is placed today) and core boxes. Without one
+// the composition stands in for it, and Compose holds the module it stands in for (or refuses the node, for a stand-in
+// of no module placed there; compose.ErrStoodIn): a node never applies a stand-in. No node is joining before ADR 0547's third milestone (ADR 0550 §6), so Joining is
+// always empty.
+package frombus
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"maps"
+	"net/netip"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+	"github.com/novox/mesh-host/internal/takein"
+)
+
+// Reader is the bus as a caller reads it with its own credential. Each method reads one part's state; an error is a
+// read that failed, never an absent key (an absent key is an empty answer).
+type Reader interface {
+	// Placements is every node's placement, by node (delivery.PlacementBucket).
+	Placements(ctx context.Context) (map[string]delivery.Placement, error)
+	// Records is every node's record, by node: HaveNode.Record of each node's own have key, `<node>.node` of
+	// delivery.HaveBucket (ADR 0555 §3).
+	Records(ctx context.Context) (map[string]delivery.NodeRecord, error)
+	// Modules is every module the indexer holds, by module (delivery.ModulesBucket).
+	Modules(ctx context.Context) (map[string]delivery.Module, error)
+	// Manifest is the raw manifest of a digest (delivery.ManifestsBucket).
+	Manifest(ctx context.Context, digest string) ([]byte, error)
+	// Values is one module's config values on one node as mesh-config resolved them (mesh-config's state `resolved`,
+	// keys `<node>.<module>.<key>`), decoded; nil when it has none.
+	Values(ctx context.Context, node, module string) (map[string]any, error)
+	// OwnSecrets is the own secrets of the composing node's modules, each sealed to that node's key, as the vault answers
+	// the node's engine (the vault's verb `own`, ADR 0550 §5); asked only for the node composing itself.
+	OwnSecrets(ctx context.Context, node string) ([]compose.OwnSecretRow, error)
+	// Credentials is, for the composing node, each pair credential it reads as a consumer, held and sealed to its key,
+	// and each it grants as a provider, with the copy sealed to it (the vault's `own` with the keys, ADR 0550 §5). A key
+	// the vault holds no value for is left out; the composition then stands in for it, and Compose refuses it.
+	Credentials(ctx context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error)
+	// Build is a module's build at a fingerprint, the builder's key (delivery.BuilderBuildsBucket, BuilderBuildKey); nil
+	// when the builder holds none. The composing node composes each of its modules from its build (issue 1126).
+	Build(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error)
+	// Archive is the archive at url, a kept reference routed to the artifact store as the composing node reaches it
+	// (catalogue.Routed), checked against digest: a moved module's templates archive, read back for its texts as the
+	// controller's take-in reads it (takein.Built).
+	Archive(ctx context.Context, url, digest string) ([]byte, error)
+	// Served is, of one module's config values on another node than the composing one (mesh-config's state `resolved`,
+	// keys `<node>.<module>.<key>`), the keys named, decoded: the keys its served values and zone name fill
+	// (catalogue.ServedSettings), which every consumer is told and so every node may read (issue 1126). Nil when none
+	// is set.
+	Served(ctx context.Context, node, module string, keys []string) (map[string]any, error)
+}
+
+// SignersReader is a Reader that also reads the vault's public authority from its state `signers` (delivery.SignersBucket,
+// key delivery.SignersAuthorityKey; ADR 0550 §2). A Reader that has it composes the mesh's authority as a bundle, the
+// controller's and the vault's; one that has not, or that answers none, composes the controller's alone, as before.
+type SignersReader interface {
+	// VaultAuthority is the vault's authority certificate as PEM, checked (delivery.DecodeSignerAuthority); empty when the
+	// vault has published none. A read that fails is said by the reader and answered empty: a node that may not read the
+	// state yet composes as before rather than not at all.
+	VaultAuthority(ctx context.Context) string
+}
+
+// HandedReader is a Reader that also says, of the composing node's modules, which the vault judged handed to the
+// provisioner when it answered OwnSecrets (the vault's `own`, its `handed`: catalogue.AssignmentHands of the plan in
+// each module's assignment). The node's composition then hands exactly those (compose.Node.Handed, issue 774), so the
+// vault and the node never judge one module two ways. Nil, or a Reader without it (a vault older than the field),
+// composes by the manifest and the machine, as before.
+type HandedReader interface {
+	Handed(ctx context.Context, node string) map[string]bool
+}
+
+// Mesh is what is true of the whole mesh and is no part's state on the bus yet: the private network's range and the
+// internal names' suffix as genesis was told them, and the mesh's authority certificate (public). Empty fields take
+// compose's defaults.
+type Mesh struct {
+	OverlayCIDR    string
+	InternalSuffix string
+	Authority      string
+	// Predefined is the list of predefined keys mesh-config published. No longer read: a reader decodes a manifest and
+	// takes the indexer's verdict on it, and judges nothing (novox/hq ADR 0578 §3); kept so a caller that sets it builds.
+	Predefined catalogue.PredefinedList
+}
+
+// Scope says who composes. Node is the node composing; only its config values are read unless Every is set, as the
+// composition check sets it to compose every node (of another node's modules, only the values their served values fill
+// are read, Reader.Served). KeptAt is, by module, the fingerprint the composing node's want names where it differs from
+// the indexer's trunk: that node composes the module from its build at that fingerprint, as it runs it.
+//
+// **Composed from its build** (issue 1126): each module placed on the composing node, and each in KeptAt, composes from
+// its built manifest (takein.Manifest over the builder's done key at the trunk's FP2 or the kept fingerprint), as the
+// controller composes from the manifest its take-in resolved: so a moved module is handed to the provisioner, a resource
+// naming an artifact names what was built, and a templated file has its text. A placed module the builder holds no done
+// build of at the trunk's FP2 composes from the indexer's manifest, as before. Every leaves the catalogue as the indexer
+// read it: the check of every node judges placement, and reads no archive.
+//
+// Placements, when set, stands in for the placement of the nodes it names: a proposal's candidates
+// (delivery.PlacementCandidate), so a node composes in shadow with a proposal laid over and compares the result with
+// what it runs (ADR 0567 §3); a nil value removes the node's placement. The rest is read as always.
+//
+// InOwn is the modules the composing node runs inside its own composition (InOwn of what it runs), composed there again
+// (compose.Node.InOwn) rather than cut out as modules no build is given for (issue 1126).
+//
+// Running is what the composing node runs; of it, its own composition (`<node>.node`) is given to the composition
+// (compose.Node.RunsOwn), so a module folded there that names a build of the old form is left to the node, carried
+// as it runs (issue 1126). Nil composes every folded module from its manifest.
+type Scope struct {
+	Node       string
+	Every      bool
+	KeptAt     map[string]string
+	Placements map[string]*delivery.Placement
+	InOwn      []string
+	Running    []delivery.Composed
+	// HeldToday is, in an answer, the modules the node keeps today as they run ("node" for its own composition), each with
+	// how ("held", "failed", "runs a build of the old form"): a candidate that cannot compose one, or holds one only
+	// behind one of them, keeps it as today, which is said under CandidateAnswer.Held and is no refusal (issue 1126).
+	HeldToday map[string]string
+	// SameValue, in an answer, says whether two sealed values open to the same value (the node opens them with its own
+	// key), so a differing resource shows a value sealed again as such (delivery.CompareComposedWith). Nil shows them
+	// as differing.
+	SameValue func(a, b string) (same, known bool)
+}
+
+// InOwn is, of the modules p places on its node, those whose resources the node's own composition it runs
+// (`<node>.node` in running) carries, by the module their ids name (declaration.ModuleGuess), sorted: the modules the
+// controller's composed writer folded there because no fingerprint of the new form names them (mesh-wireguard, a module
+// run at a build of the old form; issue 1126). A node composing itself passes it as Scope.InOwn, so its own
+// composition keeps them as it runs them until a want names a build of the new form for one.
+func InOwn(running []delivery.Composed, p delivery.Placement) []string {
+	placed := map[string]bool{}
+	for _, m := range p.Modules {
+		placed[m.Module] = true
+	}
+	in := map[string]bool{}
+	for _, c := range running {
+		if c.Module != "" {
+			continue
+		}
+		for _, raw := range c.Resources {
+			var head struct {
+				ID     string `json:"id"`
+				Module string `json:"module"`
+			}
+			if json.Unmarshal(raw, &head) != nil || head.Module != "" {
+				continue
+			}
+			if m, ok := declaration.ModuleGuess(head.ID); ok && placed[m] {
+				in[m] = true
+			}
+		}
+	}
+	return sortedKeys(in)
+}
+
+// Input is the composition input for s, read through r.
+//
+// **A refused manifest never ends the read** (novox/hq ADR 0578 §3): each manifest is decoded leniently
+// (catalogue.Decode) and the indexer's verdict on it taken from its modules value (delivery.TakeManifestVerdict, a missing
+// one accepted); a module whose manifest the indexer's judge refused, or whose bytes do not decode, stands in the
+// catalogue as its stub (unusable), so what it provides and requires still shapes the rest, and is named with why in
+// the input's Refused; a field set aside is named in its SetAside. Every other module of the read goes on.
+func Input(ctx context.Context, r Reader, mesh Mesh, s Scope) (compose.Input, error) {
+	return input(ctx, r, mesh, s, nil, nil)
+}
+
+// taken is a module's manifest as a reader takes it (novox/hq ADR 0578 §3): decoded leniently, with the indexer's verdict
+// from its modules value. A refused one, or bytes that do not decode, stands as its stub (unusable) and why says so; a
+// manifest not read past a field it set aside holds its name alone and is held the same.
+func taken(name string, raw []byte, m delivery.Module) (man catalogue.Manifest, why string) {
+	if v := m.VerdictOf(name); v != nil {
+		if refused, _ := delivery.TakeManifestVerdict(v); refused {
+			return unusable(name, raw), v.Why()
+		}
+	}
+	man, err := catalogue.Decode(raw)
+	switch {
+	case err != nil:
+		return unusable(name, raw), fmt.Sprintf("the manifest of %s does not decode: %v", name, err)
+	case man.ReadNoFurther():
+		return unusable(name, raw), fmt.Sprintf("the manifest of %s could not be read past a field this reader does not "+
+			"know: %s", name, man.SetAside())
+	}
+	return man, ""
+}
+
+// input is Input; with refuse set, a module placed on the composing node whose build cannot be read or taken in, or whose
+// manifest the indexer refused, is also handed to refuse and composed as a stub (compose.Stub, kept for that node alone),
+// so a node's answer names every module it cannot compose (issue 1126, issue 774); a module placed elsewhere whose
+// manifest is refused is read for its offer alone (unusable). A manifest the bus does not answer for still ends the
+// read: that is the bus's, not the module's.
+func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module string, err error), wanted map[string]string) (compose.Input, error) {
+	b, err := readBase(ctx, r, mesh, s)
+	b.refuseOwn(refuse)
+	if err != nil {
+		return compose.Input{}, err
+	}
+	return b.finish(ctx, r, r.Build, mesh, s, b.in, refuse, wanted)
+}
+
+// base is the part of a node's input that the fingerprints it composes its modules at leave alone (issue 1954): read once
+// for its plans at the wanted builds and at the newest, whose builds alone differ (PlansHeldTwice).
+type base struct {
+	in         compose.Input
+	placements map[string]delivery.Placement
+	records    map[string]delivery.NodeRecord
+	modules    map[string]delivery.Module
+	// ownRefused is each module placed on the composing node whose manifest the indexer refused, with why, in the order
+	// read: every scope holds it.
+	ownRefused [][2]string
+}
+
+// refuseOwn hands refuse each module placed on the composing node whose manifest is refused.
+func (b base) refuseOwn(refuse func(module string, err error)) {
+	if refuse == nil {
+		return
+	}
+	for _, r := range b.ownRefused {
+		refuse(r[0], errors.New(r[1]))
+	}
+}
+
+// cloned is the input with its own catalogue, nodes and kept manifests, what finishing it sets: two scopes finished over
+// one base never see each other's builds.
+func (b base) cloned() compose.Input {
+	in := b.in
+	in.Catalogue = maps.Clone(b.in.Catalogue)
+	in.Nodes = slices.Clone(b.in.Nodes)
+	for i := range in.Nodes {
+		in.Nodes[i].Kept = maps.Clone(in.Nodes[i].Kept)
+	}
+	in.KeptCoreBoxes = slices.Clone(b.in.KeptCoreBoxes)
+	in.OwnSecrets = slices.Clone(b.in.OwnSecrets)
+	return in
+}
+
+// readBase is input up to the builds: placement, records, the indexer's modules and manifests, each node's values.
+func readBase(ctx context.Context, r Reader, mesh Mesh, s Scope) (base, error) {
+	var b base
+	placements, err := r.Placements(ctx)
+	if err != nil {
+		return b, fmt.Errorf("frombus: placement: %w", err)
+	}
+	if len(s.Placements) > 0 {
+		given := make(map[string]delivery.Placement, len(placements)+len(s.Placements))
+		for node, p := range placements {
+			given[node] = p
+		}
+		for node, p := range s.Placements {
+			if p == nil {
+				delete(given, node)
+				continue
+			}
+			if p.Node != node {
+				return b, fmt.Errorf("frombus: the placement given for %s names the node %q", node, p.Node)
+			}
+			given[node] = *p
+		}
+		placements = given
+	}
+	records, err := r.Records(ctx)
+	if err != nil {
+		return b, fmt.Errorf("frombus: node records: %w", err)
+	}
+	modules, err := r.Modules(ctx)
+	if err != nil {
+		return b, fmt.Errorf("frombus: the indexer's modules: %w", err)
+	}
+	if _, ok := placements[s.Node]; !ok && !s.Every {
+		return b, fmt.Errorf("frombus: %s has no placement in the catalogue", s.Node)
+	}
+
+	in := compose.Input{OverlayCIDR: mesh.OverlayCIDR, InternalSuffix: mesh.InternalSuffix, Authority: mesh.Authority,
+		Catalogue: map[string]catalogue.Manifest{}}
+	if in.Authority == "" {
+		// The mesh's own certificate, public, as the composing node holds it; for the check of every node, as the first
+		// node holding one does.
+		if rec, ok := records[s.Node]; ok && rec.Authority != "" {
+			in.Authority = rec.Authority
+		} else {
+			for _, node := range sortedKeys(records) {
+				if a := records[node].Authority; a != "" {
+					in.Authority = a
+					break
+				}
+			}
+		}
+	}
+	// And the vault's authority beside it, once the vault publishes one (ADR 0550 §2): a certificate either signed checks
+	// against the bundle. The controller's stays while a certificate it issued is in a node's record.
+	if sr, ok := r.(SignersReader); ok {
+		if vault := sr.VaultAuthority(ctx); vault != "" {
+			in.Authority = delivery.AuthorityBundle(in.Authority, vault)
+		}
+	}
+	named := func(field *map[string]string, module, why string) {
+		if *field == nil {
+			*field = map[string]string{}
+		}
+		(*field)[module] = why
+	}
+	ownPlaced := map[string]bool{}
+	for _, pm := range placements[s.Node].Modules {
+		ownPlaced[pm.Module] = true
+	}
+	for _, name := range sortedKeys(modules) {
+		m := modules[name]
+		if m.Manifest == "" {
+			continue // a registered module the indexer has not read: nothing to compose it from
+		}
+		raw, err := r.Manifest(ctx, m.Manifest)
+		if err != nil {
+			// Not read is no refusal of the module: a bus that does not answer is waited out by the caller.
+			return b, fmt.Errorf("frombus: the manifest of %s (digest %s): %w", name, m.Manifest, err)
+		}
+		// One module's manifest the indexer refused refuses that module alone, by the rule a build that cannot be read
+		// follows (issue 774: power's bar item refused every node's composition, 2026-10-30; ADR 0578 §3: one refused
+		// manifest silenced disk-load for 45 hours). It stands in as its stub, so what it provides and requires still
+		// shapes the rest; it is held on the composing node where it is placed there, and elsewhere only its offer is read.
+		man, why := taken(name, raw, m)
+		if why != "" {
+			named(&in.Refused, name, why)
+			if ownPlaced[name] {
+				b.ownRefused = append(b.ownRefused, [2]string{name, why})
+			}
+		} else if aside := man.SetAside(); aside != "" {
+			named(&in.SetAside, name, aside)
+		}
+		in.Catalogue[name] = man
+	}
+
+	// The module the mesh provides itself (the private network) has no repository the indexer reads: its manifest comes
+	// with mesh-sdk and always wins, as the controller's providedModules and the grants part have it.
+	for _, name := range delivery.ProvidedModules() {
+		raw, err := json.Marshal(overlay.Manifest())
+		if err != nil {
+			return b, err
+		}
+		var private catalogue.Manifest
+		if err := json.Unmarshal(raw, &private); err != nil {
+			return b, fmt.Errorf("frombus: the manifest mesh-sdk provides for %s: %w", name, err)
+		}
+		in.Catalogue[name] = private
+	}
+
+	var missing []string
+	for _, node := range nodesOf(placements, records) {
+		rec, hasRecord := records[node]
+		p := placements[node]
+		if !hasRecord {
+			if len(p.Modules) > 0 {
+				missing = append(missing, node)
+			}
+			continue
+		}
+		n := nodeOf(rec, p)
+		withValues := s.Every || node == s.Node
+		for _, m := range p.Modules {
+			var values map[string]any
+			if withValues {
+				if values, err = r.Values(ctx, node, m.Module); err != nil {
+					return b, fmt.Errorf("frombus: %s's config values on %s: %w", m.Module, node, err)
+				}
+			} else if keys := catalogue.ServedSettings(in.Catalogue[m.Module]); len(keys) > 0 {
+				// What a provider elsewhere serves from its settings is told to every consumer: the composing node reads
+				// those keys of it, and no other (issue 1126: mailu's smtp domain, a consumer's on shanks).
+				if values, err = r.Served(ctx, node, m.Module, keys); err != nil {
+					return b, fmt.Errorf("frombus: what %s serves on %s (%s): %w", m.Module, node,
+						strings.Join(keys, ", "), err)
+				}
+			}
+			if layers := m.Layers(node, values); layers != nil {
+				if n.Settings == nil {
+					n.Settings = map[string][]catalogue.Layer{}
+				}
+				n.Settings[m.Module] = layers
+			}
+		}
+		if node == s.Node {
+			// What its runtime serves as it runs: what a module composed as what runs of it contributes there (issue 1126).
+			n.RunsTools = compose.ToolsRunning(s.Running)
+			for _, module := range s.InOwn {
+				if n.InOwn == nil {
+					n.InOwn = map[string]bool{}
+				}
+				n.InOwn[module] = true
+			}
+			for i := range s.Running {
+				// The operator export as the vault runs it: the controller composes it from its store, which the node
+				// does not read; until the export is on the bus, the node carries the file it runs (issue 1126, C6:
+				// mesh-vault.kept on novox, "in what runs, and not composed").
+				if m := s.Running[i].Module; m != "" {
+					if kept := keptOf(s.Running[i]); kept != nil {
+						if in.KeptRuns == nil {
+							in.KeptRuns = map[string]map[string]map[string]any{}
+						}
+						if in.KeptRuns[s.Node] == nil {
+							in.KeptRuns[s.Node] = map[string]map[string]any{}
+						}
+						in.KeptRuns[s.Node][m] = kept
+					}
+					continue
+				}
+				if s.Running[i].Module == "" {
+					own := s.Running[i]
+					n.RunsOwn = &own
+					// Its bus membership as it runs it: the controller composes it from its store, which the node does
+					// not read; until the grants part hands memberships sealed to the node, the node's own composition
+					// carries the one it runs (issue 1126, seed #531 on novox: "bus-membership in what runs, not
+					// composed", which applied would have taken the node's bus credential away).
+					if sealed := membershipOf(own); sealed != "" {
+						if in.BusMemberships == nil {
+							in.BusMemberships = map[string]string{}
+						}
+						in.BusMemberships[s.Node] = sealed
+					}
+				}
+			}
+		}
+		in.Nodes = append(in.Nodes, n)
+		in.Holdings = append(in.Holdings, p.Held()...)
+		// A tunnel found at adoption is the node's private network's when the node's tunnel key is the tunnel's (the
+		// controller's inv.Tunnels); the hub's found tunnel is the mesh's adopted one whether or not the hub took it over
+		// (inv.AdoptedTunnel), and its peers are carried once it did (inv.CarriedPeers).
+		if t := p.Decided.Tunnel; t != nil {
+			if rec.TunnelKey == t.PublicKey {
+				if in.Tunnels == nil {
+					in.Tunnels = map[string]compose.FoundTunnel{}
+				}
+				in.Tunnels[node] = compose.FoundTunnel{Tunnel: tunnelOf(*t), NodeAdopted: p.Decided.Adopted}
+			}
+			if p.Decided.Hub {
+				in.Adopted = &compose.AdoptedTunnel{Tunnel: tunnelOf(*t), Hub: node, Adopted: rec.TunnelKey == t.PublicKey}
+			}
+		}
+	}
+	if in.Adopted != nil && in.Adopted.Adopted {
+		in.CarriedPeers = carriedPeers(in.Adopted.Tunnel, placements[in.Adopted.Hub].Decided.PeerNames, records)
+	}
+	if len(missing) > 0 {
+		return b, fmt.Errorf("frombus: modules are placed on %s, whose agent has written no record yet",
+			strings.Join(missing, ", "))
+	}
+	b.in, b.placements, b.records, b.modules = in, placements, records, modules
+	return b, nil
+}
+
+// finish is input from its base on: the composing node's modules from their builds (build reads one), its own secrets.
+// in is the base's input, or a copy of it (base.cloned) where one base is finished more than once.
+func (b base) finish(ctx context.Context, r Reader, build func(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error),
+	mesh Mesh, s Scope, in compose.Input, refuse func(module string, err error), wanted map[string]string) (compose.Input, error) {
+	var err error
+	parse := parser(mesh)
+	read := func(module, digest string) (catalogue.Manifest, error) {
+		raw, err := r.Manifest(ctx, digest)
+		if err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the manifest of %s (digest %s): %w", module, digest, err)
+		}
+		man, err := parse(raw)
+		if err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the manifest of %s (digest %s) does not decode: %w", module, digest, err)
+		}
+		return man, nil
+	}
+	if !s.Every {
+		if _, ok := b.records[s.Node]; !ok {
+			return compose.Input{}, fmt.Errorf("frombus: %s has written no record of itself yet", s.Node)
+		}
+		if err := fromBuilds(ctx, r, build, &in, s, b.placements[s.Node], b.modules, read, parse, refuse, wanted); err != nil {
+			return compose.Input{}, err
+		}
+		// Its own modules' secrets, sealed to its own key by the vault: a composition carries them sealed (ADR 0550 §5).
+		// Asked only when a module placed on it declares one: a node none of whose modules has a secret composes
+		// whether or not the vault answers.
+		if declaresOwnSecrets(in, s.Node) {
+			if in.OwnSecrets, err = r.OwnSecrets(ctx, s.Node); err != nil {
+				return compose.Input{}, fmt.Errorf("frombus: the own secrets of %s's modules: %w", s.Node, err)
+			}
+			// And which of its modules the vault left out of that answer as handed: the node hands exactly those.
+			if hr, ok := r.(HandedReader); ok {
+				if handed := hr.Handed(ctx, s.Node); handed != nil {
+					for i := range in.Nodes {
+						if in.Nodes[i].Name == s.Node {
+							in.Nodes[i].Handed = handed
+						}
+					}
+				}
+			}
+		}
+		// The core's credentials travel as the vault's box sealed to the machine (ADR 0349 §16): the same values, which
+		// the composition reads for a core module as its kept boxes.
+		for _, o := range in.OwnSecrets {
+			if json.Valid([]byte(o.Sealed)) {
+				in.KeptCoreBoxes = append(in.KeptCoreBoxes, compose.CoreBox{Node: o.Node, Module: o.Module, Name: o.Name,
+					SealedTo: o.SealedTo, Box: json.RawMessage(o.Sealed)})
+			}
+		}
+	}
+	return in, nil
+}
+
+// Compose is the node's compositions over the bus (ADR 0547 §2): input for s, then composed at the fingerprints fps
+// gives each module in the Reading mode, as the controller composes them, by the one rule its answer to a candidate
+// follows too (composeEach, issue 1126): a module refused alone (its build unread or not taken in, its composition
+// refused, a stand-in for a value of its own the input does not carry, compose.ErrStoodIn) is held, named in held with
+// why, and none of its own composition is in out, so the node keeps what it last applied of it and applies the rest; a
+// node never applies a stand-in. Only a refusal that is no single module's (the node's own resources, a value served
+// elsewhere, a stand-in for the node's own) refuses the node, err.
+func Compose(ctx context.Context, r Reader, mesh Mesh, s Scope, fps map[string]string) (out map[string]delivery.Composed, skipped []string, held map[string]string, err error) {
+	held = map[string]string{}
+	// A node refused whole says what it held on the way, since the refusal can be of a held module's stub (issue 774,
+	// 2026-10-30 19:30: node-tools held, then "its build produced 0 bundle(s)" with its own refusal unsaid).
+	defer func() {
+		if err != nil && len(held) > 0 {
+			var said []string
+			for _, m := range sortedKeys(held) {
+				said = append(said, m+": "+held[m])
+			}
+			err = fmt.Errorf("%w (held before: %s)", err, strings.Join(said, "; "))
+		}
+	}()
+	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() }, fps)
+	if err != nil {
+		return nil, nil, held, err
+	}
+	// The pair credentials its composition reads, asked of the vault sealed to it (ADR 0550 §5).
+	asConsumer, asProvider, err := compose.CredentialsNeeded(in, s.Node)
+	if err != nil {
+		return nil, nil, held, err
+	}
+	if len(asConsumer)+len(asProvider) > 0 {
+		if in.Credentials, in.Issued, err = r.Credentials(ctx, s.Node, asConsumer, asProvider); err != nil {
+			return nil, nil, held, fmt.Errorf("frombus: the credentials of %s: %w", s.Node, err)
+		}
+	}
+	out, skipped, _, err = composeEach(in, s.Node, fps, true, s.Running, held, ranOf(ctx, r, mesh, s.Running, fps))
+	return out, skipped, held, err
+}
+
+// Plans is the provisioning plan of each module handed to the provisioner on the scope's node, composed from the bus
+// alone (novox/hq ADR 0570 clause 2): the controller's handedPlans over the same input (mesh-control
+// cmd/mesh-controller/compose_sdk.go), its rendering in the Foreseeing mode with the mesh's generators. A plan names
+// templates, files, own secrets by name, items, collections and provisions, never a value, so no value is read for it:
+// the seat mesh-provisioner's holder composes every node's plans with a Reader that reads no secret.
+func Plans(ctx context.Context, r Reader, mesh Mesh, s Scope) (map[string]catalogue.Plan, error) {
+	in, err := Input(ctx, r, mesh, s)
+	if err != nil {
+		return nil, err
+	}
+	return PlansOf(in, s.Node)
+}
+
+// PlansHeld is Plans composed module by module (issue 774: one bad module must not drop its node): a module placed on
+// the scope's node whose build cannot be read or taken in, or whose plan refuses the node's, is held, by the one rule
+// Compose follows (composeEach, culprit): composed as its stub so what it provides and requires still shapes the rest,
+// named in held with why, and none of its plan in plans. Only a refusal that is no single module's refuses the node,
+// err. The seat mesh-provisioner's holder composes so: a node with one bad manifest still has every other module's plan.
+func PlansHeld(ctx context.Context, r Reader, mesh Mesh, s Scope) (plans map[string]catalogue.Plan, held map[string]string, err error) {
+	held = map[string]string{}
+	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() }, nil)
+	if err != nil {
+		return nil, held, err
+	}
+	plans, err = plansHeldOf(in, s.Node, held)
+	return plans, held, err
+}
+
+// plansHeldOf is the plans of node over in, every module in held held, and each module a refusal is of held too until
+// the plans compose (culprit's rule over the Planning mode: its stub first, then its bare stub).
+func plansHeldOf(in compose.Input, node string, held map[string]string) (map[string]catalogue.Plan, error) {
+	return heldOf(in, node, held, func(in compose.Input) (map[string]catalogue.Plan, error) { return plansIn(in, node, compose.Planning) })
+}
+
+// heldOf composes compose1 over in with every module in held held, and each module a refusal is of held too until it
+// composes (culprit's rule: its stub first, then its bare stub); what compose1 answers of a held module is left out.
+// Plans and data items are composed so (PlansHeld, DataItemsHeld): one module never ends the read (novox/hq ADR 0578 §3).
+func heldOf[V any](in compose.Input, node string, held map[string]string, compose1 func(compose.Input) (map[string]V, error)) (map[string]V, error) {
+	for _, m := range sortedKeys(held) {
+		in = stubbed(in, node, m, "")
+	}
+	// Each try holds one module more or leaves out all of one held module's offer: bounded by twice the modules placed.
+	for tries := 0; tries <= 2*len(assignedOn(in, node))+1; tries++ {
+		plans, err := compose1(in)
+		if err == nil {
+			for m := range held {
+				delete(plans, m)
+			}
+			return plans, nil
+		}
+		var order []string
+		for _, m := range assignedOn(in, node) {
+			if strings.Contains(err.Error(), m) && len(order) < maxCulprits {
+				order = append(order, m)
+			}
+		}
+		module, leave := "", ""
+	find:
+		for _, l := range []string{"", leaveAll} {
+			for _, m := range order {
+				if _, done := held[m]; done && l == "" {
+					continue
+				}
+				if _, again := compose1(stubbed(in, node, m, l)); again == nil || again.Error() != err.Error() {
+					module, leave = m, l
+					break find
+				}
+			}
+		}
+		if module == "" {
+			return nil, err
+		}
+		if _, done := held[module]; !done {
+			held[module] = err.Error()
+		}
+		in = stubbed(in, node, module, leave)
+	}
+	return nil, fmt.Errorf("frombus: what %s composes does not compose with %d module(s) held: %s", node, len(held),
+		strings.Join(sortedKeys(held), ", "))
+}
+
+// PlansOf is Plans over an input already filled, rendered in the Planning mode (compose.Planning): every own secret the
+// input holds none for stands in, so no value and no record of one is needed.
+func PlansOf(in compose.Input, node string) (map[string]catalogue.Plan, error) {
+	return plansIn(in, node, compose.Planning)
+}
+
+// plansIn is the controller's handedPlans in a mode: Foreseeing is the controller's own.
+func plansIn(in compose.Input, node string, mode compose.Mode) (map[string]catalogue.Plan, error) {
+	// One composition for the three, so each node of the mesh is resolved once (issue 1954).
+	resolved, rendered, gens, err := compose.Composing(in, node, mode)
+	if err != nil {
+		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
+	}
+	with := rendered.Rendering
+	with.Generators = gens
+	composed, err := resolution.Compose(resolved.Plan, with)
+	if err != nil {
+		return nil, fmt.Errorf("frombus: the plans of %s: %w", node, err)
+	}
+	return composed.Plans, nil
+}
+
+// unusable is what stands in for a module's manifest the mesh refuses: its stub (compose.Stub)
+// read from its JSON unjudged, so what it provides, requires and serves still shapes the rest, and without its items,
+// since nothing judged what they would put into another module's collection. Bytes that are no manifest of the module
+// stand in as a stub that offers nothing.
+func unusable(module string, raw []byte) catalogue.Manifest {
+	var m catalogue.Manifest
+	if json.Unmarshal(raw, &m) != nil || m.Module != module {
+		m = catalogue.Manifest{Module: module}
+	}
+	m.Items = nil
+	return compose.Stub(m)
+}
+
+// parser reads a manifest as every reader does (novox/hq ADR 0578 §3): decoded leniently, judged by nothing here.
+func parser(Mesh) func([]byte) (catalogue.Manifest, error) {
+	return catalogue.Decode
+}
+
+// ranOf is what a module last offered the others, read when it is held (composeEach, issue 1960): its manifest at the
+// build its own composition runs at (running), where that is another build than the one it is composed at (fps) and
+// the builder holds it done. False where nothing is known of it (it runs no composition of its own, it runs the build
+// it is composed at, or its build is unread): the manifest it is composed from is its offer then. Only what it says to
+// others is taken of it, which needs no take-in of its artifacts.
+func ranOf(ctx context.Context, r Reader, mesh Mesh, running []delivery.Composed, fps map[string]string) func(string) (catalogue.Manifest, bool) {
+	parse := parser(mesh)
+	return func(module string) (catalogue.Manifest, bool) {
+		for _, c := range running {
+			if c.Module != module || c.FP == "" || c.FP == fps[module] {
+				continue
+			}
+			b, err := r.Build(ctx, module, c.FP)
+			if err != nil || b == nil || b.State != delivery.BuildDone || b.Manifest == "" {
+				return catalogue.Manifest{}, false
+			}
+			raw, err := r.Manifest(ctx, b.Manifest)
+			if err != nil {
+				return catalogue.Manifest{}, false
+			}
+			man, err := parse(raw)
+			return man, err == nil
+		}
+		return catalogue.Manifest{}, false
+	}
+}
+
+// fromBuilds puts in the built manifest of each module placed on the composing node, at the trunk's FP2, and of each
+// module it keeps at another build (Scope.KeptAt, into its node's Kept), read from the builder's done key and resolved
+// by the one take-in rule (takein.Manifest), a templates archive read in the artifact store as the node reaches it
+// (issue 1126).
+func fromBuilds(ctx context.Context, r Reader, build func(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error),
+	in *compose.Input, s Scope, p delivery.Placement, modules map[string]delivery.Module,
+	read func(module, digest string) (catalogue.Manifest, error), parse func([]byte) (catalogue.Manifest, error),
+	refuse func(module string, err error), wanted map[string]string) error {
+	// stub keeps a refused module in the composition as a stub for this node alone (compose.Stub): what it provides
+	// and requires still shapes the rest.
+	stub := func(module string, err error) {
+		refuse(module, err)
+		for i := range in.Nodes {
+			if in.Nodes[i].Name != s.Node {
+				continue
+			}
+			man, ok := in.Nodes[i].Kept[module]
+			if !ok {
+				man, ok = in.Catalogue[module]
+			}
+			if !ok {
+				return
+			}
+			if in.Nodes[i].Kept == nil {
+				in.Nodes[i].Kept = map[string]catalogue.Manifest{}
+			}
+			in.Nodes[i].Kept[module] = compose.Stub(man)
+		}
+	}
+	address, addressErr := "", error(nil)
+	addressed := false
+	archive := func(ctx context.Context, reference, digest string) ([]byte, error) {
+		if !addressed {
+			address, addressErr = compose.ArtifactStoreAddress(*in, s.Node)
+			addressed = true
+		}
+		switch {
+		case addressErr != nil:
+			return nil, addressErr
+		case address == "":
+			return nil, fmt.Errorf("%s reaches no artifact store (%s)", s.Node, storeSought(*in))
+		}
+		return r.Archive(ctx, catalogue.Routed(reference, address), digest)
+	}
+	built := func(module, fp string, b *delivery.BuilderBuild) (catalogue.Manifest, error) {
+		if b.Manifest == "" {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the build of %s at %s names no manifest", module, fp)
+		}
+		// A take-in kept by the reader is read back as below, never shared: each composition holds its own manifest.
+		keeper, keeps := r.(takenInKeeper)
+		if keeps && !addressed {
+			address, addressErr = compose.ArtifactStoreAddress(*in, s.Node)
+			addressed = true
+		}
+		// Kept by the store's address too: a node that reaches no store takes in as before, and fails where it did.
+		key, keyed := takenInKey(module, fp, address, *b)
+		keyed = keyed && addressErr == nil && address != ""
+		if keeps && keyed {
+			if raw, ok := keeper.takenIn(key); ok {
+				resolved, err := parse(raw)
+				if err != nil {
+					return catalogue.Manifest{}, fmt.Errorf("frombus: the built manifest of %s at %s: %w", module, fp, err)
+				}
+				return resolved, nil
+			}
+		}
+		src, err := read(module, b.Manifest)
+		if err != nil {
+			return catalogue.Manifest{}, err
+		}
+		resolved, err := takein.Manifest(ctx, src, *b, archive)
+		if err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: %s at %s: %w", module, fp, err)
+		}
+		// Read back as the mesh holds a built manifest (the controller keeps the resolved manifest's bytes and reads them
+		// as any manifest): a template's text is then in the manifest's own words, its ${config:…} in the settings form.
+		raw, err := json.Marshal(resolved)
+		if err != nil {
+			return catalogue.Manifest{}, err
+		}
+		if resolved, err = parse(raw); err != nil {
+			return catalogue.Manifest{}, fmt.Errorf("frombus: the built manifest of %s at %s: %w", module, fp, err)
+		}
+		if keeps && keyed {
+			keeper.keepTakenIn(key, raw)
+		}
+		return resolved, nil
+	}
+	// A module wanted at another build than the trunk's is composed from the build its want names (issue 774), as one
+	// the scope keeps at another build is.
+	keptAt := maps.Clone(s.KeptAt)
+	for _, pm := range p.Modules {
+		if m, ok := modules[pm.Module]; ok && m.FP2 != "" && wanted[pm.Module] != "" && wanted[pm.Module] != m.FP2 &&
+			keptAt[pm.Module] == "" && !slices.Contains(s.InOwn, pm.Module) {
+			if keptAt == nil {
+				keptAt = map[string]string{}
+			}
+			keptAt[pm.Module] = wanted[pm.Module]
+		}
+	}
+	runs := map[string]bool{}
+	for _, c := range s.Running {
+		if c.Module != "" {
+			runs[c.Module] = true
+		}
+	}
+	for _, pm := range p.Modules {
+		m, ok := modules[pm.Module]
+		if !ok || m.FP2 == "" || keptAt[pm.Module] != "" || slices.Contains(s.InOwn, pm.Module) {
+			// A module it runs inside its own composition is composed there as before: no build of the new form is what
+			// it runs (Scope.InOwn).
+			continue
+		}
+		if _, refused := in.Refused[pm.Module]; refused {
+			continue // held as its stub: no build of a refused manifest is taken in (ADR 0578 §3)
+		}
+		if man, ok := in.Catalogue[pm.Module]; !ok || (man.Build == nil && !man.Templated()) {
+			continue // nothing is built of it: its manifest is what it composes from
+		}
+		b, err := build(ctx, pm.Module, m.FP2)
+		if err != nil {
+			err = fmt.Errorf("frombus: the build of %s at %s: %w", pm.Module, m.FP2, err)
+			if refuse == nil {
+				return err
+			}
+			stub(pm.Module, err)
+			continue
+		}
+		if b == nil || b.State != delivery.BuildDone {
+			if refuse != nil && runs[pm.Module] {
+				// A module that runs is never composed from the indexer's manifest, which names no build's artifacts (no
+				// runtime's bundle): it is held, keeping what runs, until its build lands (issue 774, 2026-10-30 19:30:
+				// node-tools on ace, g14 and shanks, "its build produced 0 bundle(s)", and every module refused).
+				stub(pm.Module, fmt.Errorf("frombus: %s is wanted at %s, of which the builder holds no done build yet; it "+
+					"keeps running what it runs", pm.Module, m.FP2))
+			}
+			continue // nothing of it runs: composed from the indexer's manifest, as before
+		}
+		resolved, err := built(pm.Module, m.FP2, b)
+		if err != nil {
+			if refuse == nil {
+				return err
+			}
+			stub(pm.Module, err)
+			continue
+		}
+		in.Catalogue[pm.Module] = resolved
+	}
+	for i := range in.Nodes {
+		if in.Nodes[i].Name != s.Node {
+			continue
+		}
+		for _, module := range sortedKeys(keptAt) {
+			fp := keptAt[module]
+			b, err := build(ctx, module, fp)
+			switch {
+			case err != nil:
+				err = fmt.Errorf("frombus: the build of %s at %s: %w", module, fp, err)
+			case b == nil || b.State != delivery.BuildDone:
+				err = fmt.Errorf("frombus: %s is wanted at %s, of which the builder holds no done build", module, fp)
+			}
+			var resolved catalogue.Manifest
+			if err == nil {
+				resolved, err = built(module, fp, b)
+			}
+			if err != nil {
+				if refuse == nil {
+					return err
+				}
+				stub(module, err)
+				continue
+			}
+			if in.Nodes[i].Kept == nil {
+				in.Nodes[i].Kept = map[string]catalogue.Manifest{}
+			}
+			in.Nodes[i].Kept[module] = resolved
+		}
+	}
+	return nil
+}
+
+// declaresOwnSecrets says a module assigned to node declares an own secret, in the manifest the node composes it from.
+func declaresOwnSecrets(in compose.Input, node string) bool {
+	for _, n := range in.Nodes {
+		if n.Name != node {
+			continue
+		}
+		for _, module := range n.Assigned {
+			m, ok := n.Kept[module]
+			if !ok {
+				m = in.Catalogue[module]
+			}
+			if len(m.OwnSecrets) > 0 {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// nodeOf is the composition's node from its record (what the machine observes) and its placement (what a person
+// decided of it, and where its modules run).
+func nodeOf(rec delivery.NodeRecord, p delivery.Placement) compose.Node {
+	n := compose.Node{
+		Name:         rec.Node,
+		Place:        compose.Place{Key: rec.TunnelKey},
+		SealingKey:   rec.SealingKey,
+		OutwardLinks: rec.OutwardLinks, Networks: rec.Networks, NetworksSaid: rec.NetworksSaid,
+		ServingKey: rec.ServingKey, Certificate: rec.Certificate, Contract: rec.Contract, Stated: rec.Contract > 0,
+	}
+	placeNode(&n, p)
+	if len(rec.Capabilities) > 0 {
+		n.Capabilities = make(map[string]bool, len(rec.Capabilities))
+		for _, c := range rec.Capabilities {
+			n.Capabilities[c] = true
+		}
+	}
+	return n
+}
+
+// placeNode sets what a person decided of n and where its modules run, from its placement; what the machine observes
+// (its keys, links, networks, certificate) and its settings layers are left as they are.
+func placeNode(n *compose.Node, p delivery.Placement) {
+	d := p.Decided
+	n.Place = compose.Place{Key: n.Place.Key, Endpoint: d.Endpoint, Site: d.Site, Hub: d.Hub, Address: d.Address}
+	n.Assigned, n.PublicDomain = p.Assigned(), d.PublicDomain
+	n.Account, n.AccountHome, n.AgentAccount, n.AgentAccountHome = d.Account, d.AccountHome, d.AgentAccount, d.AgentHome
+	n.Adopted, n.Taken = d.Adopted, d.Taken
+	n.Pins, n.Bound, n.Ports = p.ChosenPins(), p.Bound(), p.HostPorts()
+}
+
+// Placed is in with the placements given standing in for those of the nodes they name (issue 1126): each such node's
+// decided parts, modules, pins, bindings, host ports, settings placement and holdings are the given placement's, its
+// config values those in already carries for it (the layer of the node's own name), and what the machine observes is
+// kept. A nil placement leaves the node in the mesh with nothing placed on it. A node in does not hold is refused: it has
+// no record to compose it from. The found tunnel and the hub's peers are read from in as they are, not from the given
+// placement. It is how a check composes a change's own placement over an input already filled (composer.Case's
+// Placements).
+func Placed(in compose.Input, placements map[string]*delivery.Placement) (compose.Input, error) {
+	if len(placements) == 0 {
+		return in, nil
+	}
+	out := in
+	out.Nodes = append([]compose.Node(nil), in.Nodes...)
+	index := map[string]int{}
+	for i, n := range out.Nodes {
+		index[n.Name] = i
+	}
+	for _, node := range sortedKeys(placements) {
+		p := placements[node]
+		i, ok := index[node]
+		if !ok {
+			return compose.Input{}, fmt.Errorf("frombus: a placement is given for %s, which the input holds no node for", node)
+		}
+		if p == nil {
+			p = &delivery.Placement{Node: node}
+		}
+		if p.Node != node {
+			return compose.Input{}, fmt.Errorf("frombus: the placement given for %s names the node %q", node, p.Node)
+		}
+		n := out.Nodes[i]
+		placeNode(&n, *p)
+		settings := map[string][]catalogue.Layer{}
+		for _, m := range p.Modules {
+			var values map[string]any
+			for _, l := range n.Settings[m.Module] {
+				if l.From == node {
+					values = l.Values
+				}
+			}
+			if layers := m.Layers(node, values); layers != nil {
+				settings[m.Module] = layers
+			}
+		}
+		n.Settings = nil
+		if len(settings) > 0 {
+			n.Settings = settings
+		}
+		out.Nodes[i] = n
+	}
+	out.Holdings = nil
+	for _, h := range in.Holdings {
+		if _, given := placements[h.Node]; !given {
+			out.Holdings = append(out.Holdings, h)
+		}
+	}
+	for _, node := range sortedKeys(placements) {
+		if p := placements[node]; p != nil {
+			out.Holdings = append(out.Holdings, p.Held()...)
+		}
+	}
+	return out, nil
+}
+
+func tunnelOf(t delivery.RecordTunnel) compose.Tunnel {
+	out := compose.Tunnel{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU,
+		Address: t.Address, Range: t.Range, PublicKey: t.PublicKey}
+	for _, p := range t.Peers {
+		out.Peers = append(out.Peers, compose.TunnelPeer{PublicKey: p.PublicKey, Address: p.Address})
+	}
+	return out
+}
+
+// carriedPeers is every peer of the hub's adopted tunnel, by address, each with the node that enrolled under its key
+// where one has (a node whose tunnel key is the peer's) and the name a person gave it (inv.CarriedPeers).
+func carriedPeers(t compose.Tunnel, names map[string]string, records map[string]delivery.NodeRecord) []compose.CarriedPeer {
+	byKey := map[string]string{}
+	for node, rec := range records {
+		if rec.TunnelKey != "" {
+			byKey[rec.TunnelKey] = node
+		}
+	}
+	var out []compose.CarriedPeer
+	for _, p := range t.Peers {
+		address, _, _ := strings.Cut(p.Address, "/")
+		out = append(out, compose.CarriedPeer{PublicKey: p.PublicKey, Address: address, EnrolledAs: byKey[p.PublicKey], Named: names[p.PublicKey]})
+	}
+	sort.SliceStable(out, func(i, j int) bool {
+		a, errA := netip.ParseAddr(out[i].Address)
+		b, errB := netip.ParseAddr(out[j].Address)
+		if errA != nil || errB != nil {
+			return out[i].Address < out[j].Address
+		}
+		return a.Less(b)
+	})
+	return out
+}
+
+// nodesOf is every node named by a placement or a record, by name: the order the controller reads them in.
+func nodesOf(placements map[string]delivery.Placement, records map[string]delivery.NodeRecord) []string {
+	seen := map[string]bool{}
+	for n := range placements {
+		seen[n] = true
+	}
+	for n := range records {
+		seen[n] = true
+	}
+	return sortedKeys(seen)
+}
+
+func sortedKeys[V any](m map[string]V) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// storeSought says, for a node that reaches no artifact store, what the composition holds of one: the nodes it holds and
+// where each module serving the artifact store is placed, so the refusal names why (issue 1126).
+func storeSought(in compose.Input) string {
+	var nodes, where []string
+	for _, n := range in.Nodes {
+		nodes = append(nodes, n.Name)
+		for _, a := range n.Assigned {
+			if m, ok := in.Catalogue[a]; ok {
+				if _, serves := m.Serves[catalogue.ArtifactStoreProvision]; serves {
+					where = append(where, a+" on "+n.Name)
+				}
+			}
+		}
+	}
+	sort.Strings(nodes)
+	sort.Strings(where)
+	said := "the composition holds " + strings.Join(nodes, ", ")
+	if len(where) == 0 {
+		return said + "; no module placed there serves " + catalogue.ArtifactStoreProvision
+	}
+	return said + "; " + catalogue.ArtifactStoreProvision + " is served by " + strings.Join(where, ", ") +
+		", none of it on the private network with a port"
+}
+
+// keptOf is the operator export's file (catalogue.KeptID) of a module's composition as it runs, or nil.
+func keptOf(c delivery.Composed) map[string]any {
+	for _, raw := range c.Resources {
+		var r map[string]any
+		if json.Unmarshal(raw, &r) == nil && r["id"] == c.Module+"."+resolution.KeptID() {
+			return r
+		}
+	}
+	return nil
+}
+
+// membershipOf is the sealed value of the bus membership resource (catalogue.BusMembershipID) of a node's own
+// composition, or "".
+func membershipOf(own delivery.Composed) string {
+	for _, raw := range own.Resources {
+		var r struct {
+			ID     string `json:"id"`
+			Sealed string `json:"sealed"`
+		}
+		if json.Unmarshal(raw, &r) == nil && r.ID == resolution.BusMembershipID() {
+			return r.Sealed
+		}
+	}
+	return ""
+}
+
+// DataItems is every data item the modules placed on scope's node declare, placed there, composed from the bus as Plans
+// composes (novox/hq ADR 0571 clause 3): disk-load measures these. A module whose manifest the indexer refused is held
+// and its items left out; DataItemsHeld names it, and a reader that must say what it leaves out reads that.
+func DataItems(ctx context.Context, r Reader, mesh Mesh, s Scope) (map[string][]catalogue.PlacedDataItem, []string, error) {
+	items, unplaced, _, err := DataItemsHeld(ctx, r, mesh, s)
+	return items, unplaced, err
+}
+
+// DataItemsHeld is DataItems and, by module, why each module placed on scope's node is held: its manifest refused by
+// the indexer's judge or not decoded (compose.Input.Refused). One refused manifest never ends the read (novox/hq ADR
+// 0578 §3: disk-load measured nothing for 45 hours when one did).
+func DataItemsHeld(ctx context.Context, r Reader, mesh Mesh, s Scope) (items map[string][]catalogue.PlacedDataItem, unplaced []string, held map[string]string, err error) {
+	held = map[string]string{}
+	in, err := input(ctx, r, mesh, s, func(module string, err error) { held[module] = err.Error() }, nil)
+	if err != nil {
+		return nil, nil, held, err
+	}
+	// Held module by module, as PlansHeld holds them: a refused stub or one module's composition refusal (an item's
+	// template) holds that module and never ends the read.
+	items, err = heldOf(in, s.Node, held, func(in compose.Input) (map[string][]catalogue.PlacedDataItem, error) {
+		var err error
+		items, unplaced, err = compose.DataItems(withoutHeldData(in, s.Node), s.Node)
+		return items, err
+	})
+	return items, unplaced, held, err
+}
+
+// withoutHeldData is in with no data item of a module held on node: none of a held module's items is measured, so its
+// data never refuses the rest (its stub keeps its data for the backups the plans compose).
+func withoutHeldData(in compose.Input, node string) compose.Input {
+	out := in
+	out.Nodes = append([]compose.Node(nil), in.Nodes...)
+	for i := range out.Nodes {
+		n := &out.Nodes[i]
+		if n.Name != node || len(n.Held) == 0 {
+			continue
+		}
+		kept := maps.Clone(n.Kept)
+		for m := range n.Held {
+			if man, ok := kept[m]; ok {
+				man.Data = nil
+				kept[m] = man
+			}
+		}
+		n.Kept = kept
+	}
+	return out
+}
diff --git a/internal/compose/frombus/frombus_test.go b/internal/compose/frombus/frombus_test.go
new file mode 100644
index 0000000..cd566f5
--- /dev/null
+++ b/internal/compose/frombus/frombus_test.go
@@ -0,0 +1,869 @@
+package frombus
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/ecdh"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// bus is a Reader over values held in memory, counting whose config values were read.
+type bus struct {
+	vaultAuthority string
+	handed         map[string]bool
+	placements     map[string]delivery.Placement
+	records        map[string]delivery.NodeRecord
+	modules        map[string]delivery.Module
+	manifests      map[string][]byte
+	values         map[string]map[string]any // by node.module
+	valuesRead     []string
+	own            []compose.OwnSecretRow
+	ownErr         error
+	// asked is every consumer credential asked; the fake refuses the whole ask, as the vault's own does, for a consuming
+	// module its placement does not put on the node.
+	asked []compose.CredentialKey
+	// builds are the builder's keys, by "<module> <fp>"; archives the artifact store's blobs, by digest, and fetched
+	// every URL asked; served another node's values by "<node>.<module>", and servedRead every ask with its keys.
+	builds     map[string]*delivery.BuilderBuild
+	archives   map[string][]byte
+	fetched    []string
+	served     map[string]map[string]any
+	servedRead []string
+	buildsRead []string
+	// held answers every credential asked as held, sealed to the consumer.
+	held bool
+}
+
+func (b *bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+	b.buildsRead = append(b.buildsRead, module)
+	return b.builds[module+" "+fp], nil
+}
+
+func (b *bus) Archive(_ context.Context, url, digest string) ([]byte, error) {
+	b.fetched = append(b.fetched, url)
+	body, ok := b.archives[digest]
+	if !ok {
+		return nil, errors.New("the store holds no such blob")
+	}
+	return body, nil
+}
+
+func (b *bus) Served(_ context.Context, node, module string, keys []string) (map[string]any, error) {
+	b.servedRead = append(b.servedRead, node+"."+module+":"+strings.Join(keys, ","))
+	out := map[string]any{}
+	for _, k := range keys {
+		if v, ok := b.served[node+"."+module][k]; ok {
+			out[k] = v
+		}
+	}
+	return out, nil
+}
+
+func (b *bus) Placements(context.Context) (map[string]delivery.Placement, error) {
+	return b.placements, nil
+}
+func (b *bus) VaultAuthority(context.Context) string                           { return b.vaultAuthority }
+func (b *bus) Handed(context.Context, string) map[string]bool                  { return b.handed }
+func (b *bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.records, nil }
+func (b *bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.modules, nil }
+func (b *bus) Manifest(_ context.Context, digest string) ([]byte, error) {
+	raw, ok := b.manifests[digest]
+	if !ok {
+		return nil, errors.New("no such manifest")
+	}
+	return raw, nil
+}
+func (b *bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
+	return b.own, b.ownErr
+}
+
+func (b *bus) Credentials(_ context.Context, node string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+	b.asked = append(b.asked, asConsumer...)
+	for _, k := range asConsumer {
+		placed := false
+		for _, m := range b.placements[node].Modules {
+			placed = placed || m.Module == k.ConsumerModule
+		}
+		if !placed {
+			return nil, nil, fmt.Errorf("%s is not on %s: neither assigned there nor required by a module there", k.ConsumerModule, node)
+		}
+	}
+	var out []compose.Credential
+	var issued []compose.Issued
+	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
+		if b.held {
+			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
+				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
+			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
+				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
+		}
+	}
+	return out, issued, nil
+}
+
+func (b *bus) Values(_ context.Context, node, module string) (map[string]any, error) {
+	b.valuesRead = append(b.valuesRead, node+"."+module)
+	return b.values[node+"."+module], nil
+}
+
+func publicKey(t *testing.T) string {
+	t.Helper()
+	k, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(k.PublicKey().Bytes())
+}
+
+// Issue 1126 (S3, S4, S5): the bus's placement, node records, manifests and config values fill the same compose.Input the
+// controller's store fills for compose's own two-machine mesh (compose's aMesh: anchor the hub, laptop), and that Input
+// composes; a node reads only its own config values; what cannot be composed is refused, naming it.
+func TestInput(t *testing.T) {
+	// Issue 1126, the seed's shadow: every refusal named, an old-form module left to the node, and no store reached
+	// saying why (answer_rows_test.go).
+	t.Run("every refusal, and an old build left to the node", answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode)
+	t.Run("no store reached says why", noStoreReachedSaysWhy)
+	// Issue 774: a node refused whole says what it held on the way.
+	t.Run("a node refused whole says what it held", aNodeRefusedWholeSaysWhatItHeld)
+	t.Run("a refused manifest never ends the read", aRefusedManifestNeverEndsTheRead)
+	t.Run("the runtime is blamed only where its stub composes", theRuntimeIsBlamedOnlyWhereItsStubComposes)
+	t.Run("a running module waits for its build", aRunningModuleWaitsForItsBuild)
+	t.Run("a held module's first reason leads", aHeldModulesFirstReasonLeads)
+	t.Run("a held module of its own account never refuses the node", aHeldModuleOfItsOwnAccountNeverRefusesTheNode)
+	t.Run("another node not resolved is named", otherNodeNotResolvedIsNamed)
+	ctx := context.Background()
+	xterm, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := delivery.ManifestDigest(xterm)
+	// A module in the settings form (plex and the media modules on one node, 2026-10-26): its config values are in its
+	// layers, not mesh-config, so the placement carries them (MeshValues, Values) and mesh-config's are not read for it.
+	media := []byte(`{"module":"media","version":"1","settings":{"lines":{"kind":"preference","default":0,"why":"kept"},` +
+		`"name":{"kind":"preference","default":"x","why":"shown"}},"own-secrets":{"token":"/srv/media/token"},"resources":[{"id":"conf","type":"file",` +
+		`"path":"/srv/media/conf","mode":"0644","content":"uid=${setting:lines} name=${setting:name}\n"}]}`)
+	mediaDigest := delivery.ManifestDigest(media)
+	keys := map[string]string{"anchor": publicKey(t), "laptop": publicKey(t)}
+	caps := []string{"container-runtime", "systemd", "wireguard"}
+	tunnel := &delivery.RecordTunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
+		Peers: []delivery.RecordTunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
+	mk := func() *bus {
+		return &bus{
+			placements: map[string]delivery.Placement{
+				"anchor": {Node: "anchor", Decided: delivery.NodeDecided{Endpoint: "anchor.example:51820", Site: "here", Hub: true, Address: "10.77.0.1",
+					Tunnel: tunnel, PeerNames: map[string]string{"peer": "phone"}},
+					Modules: []delivery.PlacedModule{{Module: overlay.Name}},
+					Holds:   []delivery.Holding{{Claim: "mesh-private-network", Scope: "mesh", Module: overlay.Name}}},
+				"laptop": {Node: "laptop", Decided: delivery.NodeDecided{Endpoint: "laptop.example:51820", Site: "here", Address: "10.77.0.2"},
+					Modules: []delivery.PlacedModule{{Module: overlay.Name},
+						{Module: "xterm", HasLayer: true, Ports: map[string]int{"80": 8080}},
+						{Module: "media", HasMesh: true, MeshValues: map[string]any{"name": "mesh"}, HasLayer: true,
+							Layer: map[string]any{"places": map[string]any{"data": "/srv/data"}}, Values: map[string]any{"lines": float64(1000)}}}},
+			},
+			records: map[string]delivery.NodeRecord{
+				"anchor": {Node: "anchor", TunnelKey: keys["anchor"], Capabilities: caps, Contract: 2},
+				"laptop": {Node: "laptop", TunnelKey: keys["laptop"], Capabilities: caps, Authority: "the mesh's certificate"},
+			},
+			modules:   map[string]delivery.Module{"xterm": {Manifest: digest}, "media": {Manifest: mediaDigest}, "unread": {}},
+			manifests: map[string][]byte{digest: xterm, mediaDigest: media},
+			values: map[string]map[string]any{"laptop.xterm": {"font": "mono"}, "anchor.xterm": {"font": "serif"},
+				"laptop.media": {"lines": "not mesh-config's"}},
+			own: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
+		}
+	}
+
+	// What the controller's store gives for the same mesh, as compose's aMesh and SettingsFor build it.
+	var private catalogue.Manifest
+	raw, _ := json.Marshal(overlay.Manifest())
+	if err := json.Unmarshal(raw, &private); err != nil {
+		t.Fatal(err)
+	}
+	parsed, err := catalogue.Decode(xterm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	parsedMedia, err := catalogue.Decode(media)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capsSet := map[string]bool{"container-runtime": true, "systemd": true, "wireguard": true}
+	tun := compose.Tunnel{Interface: "wg0", PublicKey: keys["anchor"], Address: "10.77.0.1/24",
+		Peers: []compose.TunnelPeer{{PublicKey: "peer", Address: "10.77.0.9/32"}, {PublicKey: keys["laptop"], Address: "10.77.0.2/32"}}}
+	want := compose.Input{
+		Catalogue: map[string]catalogue.Manifest{overlay.Name: private, "xterm": parsed, "media": parsedMedia},
+		Nodes: []compose.Node{
+			{Name: "anchor", Place: compose.Place{Key: keys["anchor"], Endpoint: "anchor.example:51820", Site: "here", Hub: true,
+				Address: "10.77.0.1"}, Assigned: []string{overlay.Name}, Capabilities: capsSet, Contract: 2, Stated: true},
+			{Name: "laptop", Place: compose.Place{Key: keys["laptop"], Endpoint: "laptop.example:51820", Site: "here",
+				Address: "10.77.0.2"}, Assigned: []string{overlay.Name, "xterm", "media"}, Capabilities: capsSet,
+				Ports: map[string]map[int]int{"xterm": {80: 8080}},
+				Settings: map[string][]catalogue.Layer{"xterm": {{From: "laptop", Values: map[string]any{"font": "mono"}}},
+					"media": {{From: catalogue.MeshWideLayer, Values: map[string]any{"name": "mesh"}},
+						{From: "laptop", Values: map[string]any{"lines": float64(1000)}, Placement: map[string]any{"places": map[string]any{"data": "/srv/data"}}}}}},
+		},
+		Holdings:   []catalogue.Held{{Claim: "mesh-private-network", Scope: "mesh", Node: "anchor", Module: overlay.Name}},
+		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: "media", Name: "token", Origin: "made", SealedTo: "sk", Sealed: "{}"}},
+		// The same value as a core credential's box, for a core module (ADR 0349 §16).
+		KeptCoreBoxes: []compose.CoreBox{{Node: "laptop", Module: "media", Name: "token", SealedTo: "sk", Box: json.RawMessage("{}")}},
+		Tunnels:       map[string]compose.FoundTunnel{"anchor": {Tunnel: tun}},
+		Adopted:       &compose.AdoptedTunnel{Tunnel: tun, Hub: "anchor", Adopted: true},
+		// The controller's order is by address; laptop enrolled under its peer's key, and a person named the other.
+		Authority: "the mesh's certificate",
+		CarriedPeers: []compose.CarriedPeer{{PublicKey: keys["laptop"], Address: "10.77.0.2", EnrolledAs: "laptop"},
+			{PublicKey: "peer", Address: "10.77.0.9", Named: "phone"}},
+	}
+
+	b := mk()
+	got, err := Input(ctx, b, Mesh{}, Scope{Node: "laptop"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		gj, _ := json.MarshalIndent(got, "", " ")
+		wj, _ := json.MarshalIndent(want, "", " ")
+		t.Fatalf("Input from the bus differs from the store's:\n got %s\nwant %s", gj, wj)
+	}
+	// L3 s8 (ADR 0550 §2): with the vault's authority published, the mesh's authority is the bundle of the controller's
+	// and the vault's; with none, the controller's alone, as above.
+	signing := mk()
+	signing.vaultAuthority = "the vault's certificate"
+	if bundled, err := Input(ctx, signing, Mesh{}, Scope{Node: "laptop"}); err != nil ||
+		bundled.Authority != "the mesh's certificate\nthe vault's certificate\n" {
+		t.Errorf("the authority with the vault's published: %q, %v", bundled.Authority, err)
+	}
+	// Issue 774: the modules the vault judged handed when it answered own are the node's to hand, and no other node's.
+	judged := mk()
+	judged.handed = map[string]bool{"media": true, "xterm": false}
+	if in, err := Input(ctx, judged, Mesh{}, Scope{Node: "laptop"}); err != nil ||
+		!reflect.DeepEqual(in.Nodes[1].Handed, judged.handed) || in.Nodes[0].Handed != nil {
+		t.Errorf("the vault's handed verdicts: %+v, %v", in.Nodes, err)
+	}
+	if !reflect.DeepEqual(b.valuesRead, []string{"laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
+		t.Errorf("laptop read config values %v; a node reads its own slice alone", b.valuesRead)
+	}
+
+	// The same composer over both: the compositions from the bus are the store's, byte for byte.
+	fps := map[string]string{overlay.Name: "src2:" + strings.Repeat("a", 64), "xterm": "src2:" + strings.Repeat("b", 64),
+		"media": "src2:" + strings.Repeat("c", 64)}
+	fromBus, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop"}, fps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	fromStore, _, err := compose.Compositions(want, "laptop", fps, compose.Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(fromBus) == 0 || !reflect.DeepEqual(fromBus, fromStore) {
+		t.Fatalf("compositions differ or are empty: %d from the bus, %d from the store", len(fromBus), len(fromStore))
+	}
+
+	// Issue 1126: a candidate placement equal to the node's composes what it runs, and CompareComposed says so; one
+	// thing changed in the group's candidate of another node (the hub's endpoint) names exactly the module it moves
+	// here. Placed puts the same placement over the store's input unchanged.
+	running := make([]delivery.Composed, 0, len(fromBus))
+	for _, c := range fromBus {
+		running = append(running, c)
+	}
+	laptop := mk().placements["laptop"]
+	asIs, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop}}, fps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c := delivery.CompareComposed(asIs, running); len(c.Differs)+len(c.Added)+len(c.Removed) != 0 || len(c.Same) != len(running) {
+		t.Errorf("the candidate equal to the placement: %+v", c)
+	}
+	moved := mk().placements["anchor"]
+	moved.Decided.Endpoint = "anchor.example:51821"
+	changed, _, held, err := Compose(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": &laptop, "anchor": &moved}}, fps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c := delivery.CompareComposed(changed, running); len(c.Differs) != 1 || c.Differs[0].Module != overlay.Name || c.Differs[0].Resource != overlay.Name+".overlay-config" {
+		t.Errorf("the hub's endpoint changed: %+v, want %s alone, naming its config", c, overlay.Name)
+	}
+	if c := delivery.CompareComposed(changed, running[:0]); len(c.Added) != len(changed) {
+		t.Errorf("nothing runs: %+v", c)
+	}
+
+	// ADR 0559 §4, the node's answer: the same; one module differing; a module the group adds, whose own secret is not
+	// yet issued (no refusal); a value missing for a module the node runs (a refusal); a module the candidate removes.
+	keeper := []byte(`{"module":"keeper","version":"1","own-secrets":{"password":"/var/lib/mesh/keeper/password"},` +
+		`"resources":[{"id":"state","type":"directory","path":"/var/lib/mesh/keeper","mode":"0700"}]}`)
+	lemurs := []byte(`{"module":"lemurs","version":"1","capabilities":["systemd"],"resources":[{"id":"service","type":"service","unit":"lemurs.service","state":"running","boot":"enabled"}]}`)
+	// A provider and a consumer of a pair credential on the one node (compose's objects and files).
+	objects, _ := json.Marshal(catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh, Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}})
+	files, _ := json.Marshal(catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/files/config.json", "mode": "0600", "content": "{}", "merge": "json"}}})
+	one := func(placed ...string) *bus {
+		p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
+		for _, m := range placed {
+			p.Modules = append(p.Modules, delivery.PlacedModule{Module: m})
+		}
+		return &bus{placements: map[string]delivery.Placement{"n1": p},
+			records: map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: keys["anchor"], SealingKey: "sk", Capabilities: []string{"systemd"}}},
+			modules: map[string]delivery.Module{"keeper": {Manifest: delivery.ManifestDigest(keeper)}, "lemurs": {Manifest: delivery.ManifestDigest(lemurs)},
+				"objects": {Manifest: delivery.ManifestDigest(objects)}, "files": {Manifest: delivery.ManifestDigest(files)}},
+			manifests: map[string][]byte{delivery.ManifestDigest(keeper): keeper, delivery.ManifestDigest(lemurs): lemurs,
+				delivery.ManifestDigest(objects): objects, delivery.ManifestDigest(files): files},
+			own: []compose.OwnSecretRow{{Node: "n1", Module: "keeper", Name: "password", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}}
+	}
+	oneFps := map[string]string{"keeper": "src2:" + strings.Repeat("d", 64), "lemurs": "src2:" + strings.Repeat("e", 64),
+		"objects": "src2:" + strings.Repeat("f", 64), "files": "src2:" + strings.Repeat("0", 64)}
+	runs, _, held, err := Compose(ctx, one("keeper", "lemurs"), Mesh{}, Scope{Node: "n1"}, oneFps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	var runsNow []delivery.Composed
+	for _, c := range runs {
+		runsNow = append(runsNow, c)
+	}
+	objectsRun, _, held, err := Compose(ctx, one("objects"), Mesh{}, Scope{Node: "n1"}, oneFps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	var consumerRuns []delivery.Composed
+	for _, c := range objectsRun {
+		consumerRuns = append(consumerRuns, c)
+	}
+	withoutOwn := func(cs []delivery.Composed) []delivery.Composed {
+		var out []delivery.Composed
+		for _, c := range cs {
+			if c.Module != "" {
+				out = append(out, c)
+			}
+		}
+		return out
+	}
+	// What the controller runs on n1 for a module no want names (lemurs, at a build of the old form) and the private
+	// network's (built by nobody): its composed writer (mesh-controller compositionsOf) folds their resources into the
+	// node's own, each in its place, its module taken off; the rest split by module.
+	tunnelled := func() *bus {
+		b := one("keeper", "lemurs", overlay.Name)
+		p := b.placements["n1"]
+		p.Decided.Endpoint = "n1.example:51820"
+		b.placements["n1"] = p
+		return b
+	}
+	tunnelledAs := func() map[string]*delivery.Placement {
+		p := tunnelled().placements["n1"]
+		return map[string]*delivery.Placement{"n1": &p}
+	}
+	folded := func() []delivery.Composed {
+		b := tunnelled()
+		in, err := Input(ctx, b, Mesh{}, Scope{Node: "n1"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		reading := in
+		reading.Nodes = append([]compose.Node(nil), in.Nodes...)
+		reading.Nodes[0].ReadsModules = true
+		d, _, err := compose.ComposeIn(reading, "n1", compose.Reading)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, err := d.Body()
+		if err != nil {
+			t.Fatal(err)
+		}
+		var envelope struct {
+			Resources []map[string]json.RawMessage `json:"resources"`
+		}
+		if err := json.Unmarshal(body, &envelope); err != nil {
+			t.Fatal(err)
+		}
+		var resources []json.RawMessage
+		for _, r := range envelope.Resources {
+			var module string
+			_ = json.Unmarshal(r["module"], &module)
+			if module == "lemurs" || module == overlay.Name {
+				delete(r, "module")
+			}
+			raw, _ := json.Marshal(r)
+			resources = append(resources, raw)
+		}
+		split, err := delivery.SplitComposed("n1", resources, map[string]string{"keeper": oneFps["keeper"]}, nil, delivery.NodeOwn{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var out []delivery.Composed
+		for _, c := range split {
+			out = append(out, c)
+		}
+		return out
+	}()
+	if got := InOwn(folded, tunnelled().placements["n1"]); !reflect.DeepEqual(got, []string{"lemurs", overlay.Name}) {
+		t.Errorf("InOwn of the controller's composition = %v, want lemurs and %s", got, overlay.Name)
+	}
+	placedAs := func(modules ...string) map[string]*delivery.Placement {
+		p := one(modules...).placements["n1"]
+		return map[string]*delivery.Placement{"n1": &p}
+	}
+	for name, c := range map[string]struct {
+		b       *bus
+		given   map[string]*delivery.Placement
+		running []delivery.Composed
+		verdict string
+		check   func(delivery.CandidateAnswer) bool
+	}{
+		"the same": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), runsNow, delivery.CandidateSame,
+			func(a delivery.CandidateAnswer) bool {
+				return len(a.Same) == 3 && a.Proposal == "p-h1" && a.Revision == 7
+			}},
+		"the node runs no own composition": {one("keeper", "lemurs"), placedAs("keeper", "lemurs"), withoutOwn(runsNow), delivery.CandidateSame,
+			func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
+		"one removed": {one("keeper", "lemurs"), placedAs("keeper"), runsNow, delivery.CandidateDiffers,
+			func(a delivery.CandidateAnswer) bool { return reflect.DeepEqual(a.Removed, []string{"lemurs"}) }},
+		"one added, its secret not yet issued": {func() *bus { b := one("lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			nil, delivery.CandidateDiffers, func(a delivery.CandidateAnswer) bool {
+				for _, m := range a.Added {
+					if m.Module == "keeper" {
+						return reflect.DeepEqual(m.Unissued, []string{"keeper/password"}) && len(a.Refusals) == 0
+					}
+				}
+				return false
+			}},
+		"a value missing for a module that runs": {func() *bus { b := one("keeper", "lemurs"); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
+				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && strings.Contains(a.Refusals[0].Why, "keeper/password")
+			}},
+		// Review of L2b, round 1, finding 1: a consumer the candidate adds has no credential yet, and the vault refuses an
+		// ask for a module not on the node; it is not asked, and the module is added, its credential not yet issued.
+		"a consumer added, the vault not asked for it": {one("objects"), placedAs("objects", "files"), consumerRuns, delivery.CandidateDiffers,
+			func(a delivery.CandidateAnswer) bool {
+				return len(a.Added) == 1 && a.Added[0].Module == "files" && len(a.Added[0].Unissued) > 0 && len(a.Refusals) == 0
+			}},
+		// And with no trunk at all (the seed), a stand-in of a module the node runs is a refusal, not an addition.
+		"the seed, a value missing for a module that runs": {func() *bus { b := one(); b.own = nil; return b }(), placedAs("keeper", "lemurs"),
+			runsNow, delivery.CandidateRefused, func(a delivery.CandidateAnswer) bool {
+				return len(a.Refusals) == 1 && a.Refusals[0].Module == "keeper" && len(a.Added) == 0
+			}},
+		"cannot compose": {one("keeper"), map[string]*delivery.Placement{"n1": {Node: "n2"}}, runsNow, delivery.CandidateRefused,
+			func(a delivery.CandidateAnswer) bool { return a.Refused != "" }},
+		// Issue 1126 (the seed's review): the private network's module and one at a build of the old form, which no want
+		// names and the controller folds into the node's own, are folded there again: the node's own is the same, and
+		// neither is added.
+		"mesh-wireguard and an old-form module, folded": {tunnelled(), tunnelledAs(),
+			folded, delivery.CandidateSame, func(a delivery.CandidateAnswer) bool { return len(a.Same) == 2 && len(a.Added) == 0 }},
+	} {
+		fps := oneFps
+		if name == "mesh-wireguard and an old-form module, folded" {
+			fps = map[string]string{"keeper": oneFps["keeper"]} // the node's wants: no build of lemurs or the private network
+		}
+		a := Answer(ctx, c.b, Mesh{}, Scope{Node: "n1", Placements: c.given, InOwn: InOwn(c.running, *c.given["n1"])}, fps, c.running, "p-h1", 7)
+		if a.Verdict != c.verdict || !c.check(a) {
+			t.Errorf("%s: %+v", name, a)
+		}
+		if raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Candidates: map[string]delivery.CandidateAnswer{"g": a}}); err != nil {
+			t.Errorf("%s: the answer is not one a have holds: %v (%s)", name, err, raw)
+		}
+	}
+	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": &laptop}); err != nil || !reflect.DeepEqual(got, want) {
+		t.Errorf("Placed with the node's own placement changes the input: %v", err)
+	}
+	if got, err := Placed(want, map[string]*delivery.Placement{"laptop": nil}); err != nil || len(got.Nodes[1].Assigned) != 0 || got.Nodes[1].Place.Key != keys["laptop"] {
+		t.Errorf("Placed with no placement: %+v, %v", got.Nodes[1], err)
+	}
+	if _, err := Placed(want, map[string]*delivery.Placement{"stranger": {Node: "stranger"}}); err == nil {
+		t.Error("Placed a node the input holds no node for")
+	}
+	if _, err := Input(ctx, mk(), Mesh{}, Scope{Node: "laptop", Placements: map[string]*delivery.Placement{"laptop": {Node: "anchor"}}}); err == nil {
+		t.Error("a given placement naming another node was taken")
+	}
+
+	// ADR 0555 §6: Export is Input's inverse for what a person decides: the store's input exported, node by node, is the
+	// placement the bus holds, and read back it is the store's input again.
+	for node, placed := range mk().placements {
+		got, err := Export(want, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if gj, _ := delivery.EncodePlacement(got); !delivery.SamePlacement(got, placed) {
+			pj, _ := delivery.EncodePlacement(placed)
+			t.Errorf("%s exported as %s, want %s", node, gj, pj)
+		}
+	}
+	if _, err := Export(want, "stranger"); err == nil {
+		t.Error("a node the input lacks was exported")
+	}
+
+	b = mk()
+	if every, err := Input(ctx, b, Mesh{}, Scope{Every: true}); err != nil || every.OwnSecrets != nil {
+		t.Fatalf("composing every node: %v, own secrets %v (the vault answers a node about itself alone)", err, every.OwnSecrets)
+	}
+	if !reflect.DeepEqual(b.valuesRead, []string{"anchor." + overlay.Name, "laptop." + overlay.Name, "laptop.xterm", "laptop.media"}) {
+		// Every node's placed modules, and nothing placed nowhere: anchor places no xterm.
+		t.Errorf("the check read %v", b.valuesRead)
+	}
+
+	// A node none of whose modules declares an own secret composes without asking the vault (the review of L2: a node
+	// with no secret composed nothing while the vault did not answer); one whose module does, refuses without it.
+	quiet := mk()
+	quiet.ownErr = errors.New("no responders")
+	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "anchor"}); err != nil {
+		t.Errorf("anchor, with no own secret, needed the vault: %v", err)
+	}
+	if _, err := Input(ctx, quiet, Mesh{}, Scope{Node: "laptop"}); err == nil {
+		t.Error("laptop's media, which declares an own secret, composed without the vault")
+	}
+
+	// A module the node's want keeps at another build than the trunk's composes from that build's manifest, resolved with
+	// what it made (issue 1126), on the composing node alone.
+	kept := mk()
+	oldXterm := []byte(`{"module":"xterm","version":"1","resources":[{"id":"tools","type":"process","name":"xterm-tools",` +
+		`"artifact":"tools","run":["./xterm-tools"]}],"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"go","system":"arch","from":"cmd/xterm-tools","binary":"xterm-tools"}]}}`)
+	kept.manifests["old"] = oldXterm
+	oldFP := "src2:" + strings.Repeat("9", 64)
+	toolsRef := "artifact-store://xterm/tools/blobs/sha256:" + strings.Repeat("1", 64)
+	kept.builds = map[string]*delivery.BuilderBuild{"xterm " + oldFP: {State: delivery.BuildDone, Manifest: "old",
+		Artifacts: []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}}}}
+	parsedOld, err := catalogue.Decode(oldXterm)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keptBuilt, err := parsedOld.Resolve([]catalogue.Built{{Name: "tools", Kind: "bundle", Reference: toolsRef, Digest: "sha256:" + strings.Repeat("1", 64)}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	in, err := Input(ctx, kept, Mesh{}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": oldFP}})
+	if err != nil || !reflect.DeepEqual(in.Nodes[1].Kept, map[string]catalogue.Manifest{"xterm": keptBuilt}) || in.Nodes[0].Kept != nil {
+		t.Errorf("the want's build is kept on the composing node alone: %v, %v", in.Nodes, err)
+	}
+
+	// Issue 1126, the seed's refusals. restic and the provisioner's client as the catalogue holds them (mesh-catalog
+	// c05aa5e6), restic moved with an own secret the vault leaves out (it hands it to the client, mesh-vault ownnode.go
+	// handed): composed from the indexer's manifest restic is not handed and stands in for that secret, as novox's,
+	// ace's, g14's and shanks's answers refused; composed from its build, it is handed, its templates archive read
+	// where the node reaches the artifact store, and the composition is the one the controller's take-in gives.
+	resticRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientRaw, err := os.ReadFile("testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	store := []byte(`{"module":"store","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],` +
+		`"serves":{"artifact-store":{"port":5000}}}`)
+	texts := map[string]string{}
+	var packed bytes.Buffer
+	zw := gzip.NewWriter(&packed)
+	tw := tar.NewWriter(zw)
+	for _, f := range []string{"backups.conf", "data.conf", "retention.conf"} {
+		text, err := os.ReadFile("testdata/catalogue-c05aa5e6-restic.files/" + f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		texts[f] = string(text)
+		if err := tw.WriteHeader(&tar.Header{Name: "./" + f, Mode: 0o644, Size: int64(len(text)), Typeflag: tar.TypeReg}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := tw.Write(text); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	archiveDigest := delivery.ManifestDigest(packed.Bytes())
+	digestOf := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
+	movedFps := map[string]string{"restic": "src2:" + strings.Repeat("3", 64), "mesh-provisioner-client": "src2:" + strings.Repeat("4", 64),
+		"store": "src2:" + strings.Repeat("5", 64)}
+	resticArtifacts := []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Reference: "artifact-store://restic/tools/blobs/" + digestOf("6"), Digest: digestOf("6")},
+		{Name: "files", Kind: "archive", Reference: "artifact-store://restic/files/blobs/" + archiveDigest, Digest: archiveDigest}}
+	clientArtifacts := []delivery.BuiltArtifact{{Name: "client", Kind: "bundle", Reference: "artifact-store://mesh-provisioner-client/client/blobs/" + digestOf("7"), Digest: digestOf("7")}}
+	movedMesh := func(built bool) *bus {
+		b := one()
+		p := b.placements["n1"]
+		p.Modules = []delivery.PlacedModule{{Module: "store"}, {Module: "mesh-provisioner-client"}, {Module: "restic"}}
+		p.Decided.Account, p.Decided.AccountHome = "operator", "/home/operator"
+		b.placements["n1"] = p
+		rec := b.records["n1"]
+		rec.Contract, rec.Capabilities = compose.HandedContract, []string{"systemd", "package-manager"}
+		b.records["n1"] = rec
+		b.modules = map[string]delivery.Module{}
+		b.manifests = map[string][]byte{}
+		for module, raw := range map[string][]byte{"restic": resticRaw, "mesh-provisioner-client": clientRaw, "store": store} {
+			b.modules[module] = delivery.Module{FP2: movedFps[module], Manifest: delivery.ManifestDigest(raw)}
+			b.manifests[delivery.ManifestDigest(raw)] = raw
+		}
+		// The vault's own answer: the client's own secret; restic's is the client's to ask, so own leaves it out.
+		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "mesh-provisioner-client", Name: "provisioner-broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
+		if built {
+			b.builds = map[string]*delivery.BuilderBuild{
+				"restic " + movedFps["restic"]:                                   {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(resticRaw), Artifacts: resticArtifacts},
+				"mesh-provisioner-client " + movedFps["mesh-provisioner-client"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(clientRaw), Artifacts: clientArtifacts},
+				"store " + movedFps["store"]:                                     {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(store)},
+			}
+			b.archives = map[string][]byte{archiveDigest: packed.Bytes()}
+		}
+		return b
+	}
+	if out, _, held, err := Compose(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], `restic needs a secret called "repository"`) {
+		t.Errorf("restic composed from the indexer's manifest: %v %v, want its own secret refusing restic alone", err, held)
+	} else {
+		for key, c := range out {
+			if c.Module == "restic" {
+				// Its stub's composition, applied, would remove what restic runs: a held module keeps its last one.
+				t.Errorf("held restic is composed as %s, want none of its own composition handed", key)
+			}
+		}
+	}
+	builtBus := movedMesh(true)
+	fromBuild, _, held, err := Compose(ctx, builtBus, Mesh{}, Scope{Node: "n1"}, movedFps)
+	if err == nil && len(held) > 0 {
+		err = fmt.Errorf("modules held: %v", held)
+	}
+	if err != nil {
+		t.Fatalf("restic composed from its build: %v", err)
+	}
+	if !reflect.DeepEqual(builtBus.fetched, []string{"http://127.0.0.1:5000/v2/restic/files/blobs/" + archiveDigest}) {
+		t.Errorf("the templates archive was read at %v", builtBus.fetched)
+	}
+	resticKey, _ := delivery.ComposedKey("n1", "restic", movedFps["restic"])
+	if c := fromBuild[resticKey]; len(c.Filled) != 4 { // its three templated files and its own secret
+		t.Errorf("restic is not handed to the provisioner: its filled files are %v", c.Filled)
+	}
+	// A done key an artifact of which names no reference is waited for, in the controller's words (ADR 0498 §8).
+	unreferenced := movedMesh(true)
+	unreferenced.builds["restic "+movedFps["restic"]].Artifacts = []delivery.BuiltArtifact{{Name: "tools", Kind: "bundle", Digest: digestOf("6")}, resticArtifacts[1]}
+	if _, _, held, err := Compose(ctx, unreferenced, Mesh{}, Scope{Node: "n1"}, movedFps); err != nil || !strings.Contains(held["restic"], "the build of restic is done and waits for the reference of tools") {
+		t.Errorf("a done key with an unreferenced artifact: %v %v, want restic held alone", err, held)
+	}
+	// A module the node runs inside its own composition (the fold) composes from the indexer's manifest though a done
+	// build of it is at the trunk's FP2: its build is not read.
+	folding := movedMesh(true)
+	foldIn, err := Input(ctx, folding, Mesh{}, Scope{Node: "n1", InOwn: []string{"mesh-provisioner-client"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	clientParsed, err := catalogue.Decode(clientRaw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if slices.Contains(folding.buildsRead, "mesh-provisioner-client") || !reflect.DeepEqual(foldIn.Catalogue["mesh-provisioner-client"], clientParsed) {
+		t.Errorf("a folded module was taken from its build: builds read %v", folding.buildsRead)
+	}
+	// The controller's: its take-in resolves each manifest with the key's artifacts and the archive's texts, and composes
+	// from those over the same input.
+	storeIn, err := Input(ctx, movedMesh(false), Mesh{}, Scope{Node: "n1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for module, built := range map[string][]catalogue.Built{
+		"restic": {{Name: "tools", Kind: "bundle", Reference: resticArtifacts[0].Reference, Digest: digestOf("6")},
+			{Name: "files", Kind: "archive", Reference: resticArtifacts[1].Reference, Digest: archiveDigest, Texts: texts}},
+		"mesh-provisioner-client": {{Name: "client", Kind: "bundle", Reference: clientArtifacts[0].Reference, Digest: digestOf("7")}},
+	} {
+		resolved, err := storeIn.Catalogue[module].Resolve(built)
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Kept as its bytes and read again, as the controller's store holds a build's manifest.
+		raw, _ := json.Marshal(resolved)
+		if storeIn.Catalogue[module], err = catalogue.Decode(raw); err != nil {
+			t.Fatal(err)
+		}
+	}
+	storeIn.OwnSecrets = movedMesh(true).own
+	fromStoreMoved, _, err := compose.Compositions(storeIn, "n1", movedFps, compose.Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(fromBuild, fromStoreMoved) {
+		gj, _ := json.MarshalIndent(fromBuild, "", " ")
+		wj, _ := json.MarshalIndent(fromStoreMoved, "", " ")
+		t.Errorf("composed from the build differs from the controller's take-in:\n got %s\nwant %s", gj, wj)
+	}
+	// ADR 0570 clause 2 (issue 1954 L6-P1): the seat mesh-provisioner's plans, composed from the bus alone and with no
+	// secret read (the Planning mode), are the controller's handedPlans over its own input, which holds its secrets
+	// (compose_sdk.go: Resolve, Render in Foreseeing, Generators, Plan.Compose), and restic, handed, has one.
+	noSecrets := movedMesh(true)
+	noSecrets.own = nil
+	seat, err := Plans(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
+	if err != nil {
+		t.Fatalf("the plans from the bus: %v", err)
+	}
+	controllers, err := plansIn(storeIn, "n1", compose.Foreseeing)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, handed := seat["restic"]; !handed || !reflect.DeepEqual(seat, controllers) {
+		gj, _ := json.MarshalIndent(seat, "", " ")
+		wj, _ := json.MarshalIndent(controllers, "", " ")
+		t.Errorf("the seat's plans differ from the controller's:\n got %s\nwant %s", gj, wj)
+	}
+	// ADR 0571 clause 3: the data items of n1's modules, placed, from the bus alone: what disk-load measures.
+	items, unplaced, err := DataItems(ctx, noSecrets, Mesh{}, Scope{Node: "n1"})
+	if err != nil || len(unplaced) > 0 || len(items) == 0 {
+		t.Errorf("the data items from the bus are %v, unplaced %v: %v", items, unplaced, err)
+	}
+	for module, its := range items {
+		for _, it := range its {
+			if it.Module != module || !strings.HasPrefix(it.Path, "/") || it.Measure == "" {
+				t.Errorf("%s's item %+v is not placed", module, it)
+			}
+		}
+	}
+	// And the same through StatesReader, over the fake's states as a module's runtime gives them (one reader for
+	// mesh-provisioner and disk-load, the lead 2026-10-29).
+	viaStates, _, err := DataItems(ctx, StatesReader(statesOf(t, ctx, noSecrets), func(_ context.Context, url string) ([]byte, error) {
+		for _, body := range noSecrets.archives {
+			return body, nil
+		}
+		return nil, errors.New("no archive")
+	}), Mesh{}, Scope{Node: "n1"})
+	if err != nil || !reflect.DeepEqual(viaStates, items) {
+		t.Errorf("through the states the data items are %v, %v; through the reader %v", viaStates, err, items)
+	}
+
+	// And what a provider on another node serves from its settings (mailu's smtp domain, issue 1126: shanks refused
+	// '${setting:domain} ... nothing sets "domain"'): read for that provider's served keys alone, through Served.
+	mailer := []byte(`{"module":"mailer","version":"1","config":{"domain":{"type":"string","description":"the mail domain","required":true}},` +
+		`"provides":[{"name":"smtp","scope":"mesh"}],"serves":{"smtp":{"port":587,"domain":"${config:domain}"}}}`)
+	withMailer := func(set bool) *bus {
+		b := mk()
+		p := b.placements["anchor"]
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: "mailer"})
+		b.placements["anchor"] = p
+		b.modules["mailer"] = delivery.Module{Manifest: delivery.ManifestDigest(mailer)}
+		b.manifests[delivery.ManifestDigest(mailer)] = mailer
+		if set {
+			b.served = map[string]map[string]any{"anchor.mailer": {"domain": "example.org"}}
+		}
+		return b
+	}
+	if _, _, _, err := Compose(ctx, withMailer(false), Mesh{}, Scope{Node: "laptop"}, fps); err == nil || !strings.Contains(err.Error(), `nothing sets "domain"`) {
+		t.Errorf("a provider's served setting nobody sets: %v", err)
+	}
+	served := withMailer(true)
+	if _, _, held, err := Compose(ctx, served, Mesh{}, Scope{Node: "laptop"}, fps); err != nil || len(held) > 0 {
+		t.Errorf("laptop with what anchor's mailer serves: %v %v", err, held)
+	}
+	if !reflect.DeepEqual(served.servedRead, []string{"anchor.mailer:domain"}) || slices.Contains(served.valuesRead, "anchor.mailer") {
+		t.Errorf("laptop read %v of other nodes (and %v of config values): the served keys of anchor's mailer alone", served.servedRead, served.valuesRead)
+	}
+
+	for name, c := range map[string]struct {
+		change func(*bus)
+		scope  Scope
+		says   string
+	}{
+		"no record":          {func(b *bus) { delete(b.records, "laptop") }, Scope{Node: "anchor"}, "laptop, whose agent has written no record"},
+		"no placement":       {func(b *bus) {}, Scope{Node: "stranger"}, "stranger has no placement"},
+		"a manifest unread":  {func(b *bus) { delete(b.manifests, digest) }, Scope{Node: "laptop"}, "the manifest of xterm"},
+		"a kept one unbuilt": {func(b *bus) {}, Scope{Node: "laptop", KeptAt: map[string]string{"xterm": "src2:gone"}}, "holds no done build"},
+	} {
+		b := mk()
+		c.change(b)
+		if _, err := Input(ctx, b, Mesh{}, c.scope); err == nil || !strings.Contains(err.Error(), c.says) {
+			t.Errorf("%s: %v, want it to say %q", name, err, c.says)
+		}
+	}
+}
+
+// mapStates are read states by name, key to value, as a module's runtime gives them.
+type mapStates map[string]map[string][]byte
+
+func (m mapStates) Get(state, key string) ([]byte, bool, error) {
+	v, ok := m[state][key]
+	return v, ok, nil
+}
+
+func (m mapStates) Keys(state string) ([]string, error) {
+	var out []string
+	for k := range m[state] {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// statesOf is b laid out as the states StatesReader reads.
+func statesOf(t *testing.T, ctx context.Context, b *bus) mapStates {
+	t.Helper()
+	out := mapStates{}
+	put := func(state, key string, raw []byte, err error) {
+		if err != nil {
+			t.Fatal(err)
+		}
+		if out[state] == nil {
+			out[state] = map[string][]byte{}
+		}
+		out[state][key] = raw
+	}
+	placements, _ := b.Placements(ctx)
+	for _, p := range placements {
+		values, err := delivery.PlacementValues(p)
+		for k, raw := range values {
+			put(PlacementRead, k, raw, err)
+		}
+	}
+	records, _ := b.Records(ctx)
+	for node, r := range records {
+		k, _ := delivery.HaveNodeKey(node)
+		rec := r
+		raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Record: &rec})
+		put(HaveRead, k, raw, err)
+	}
+	modules, _ := b.Modules(ctx)
+	for name, m := range modules {
+		raw, err := delivery.EncodeModule(m)
+		put(ModulesRead, name, raw, err)
+		var mf struct{ Module string }
+		_ = json.Unmarshal(b.manifests[m.Manifest], &mf)
+		k, _ := delivery.ManifestsKey(m.Manifest)
+		raw, err = delivery.EncodeManifest(delivery.Manifest{Module: mf.Module, JSON: string(b.manifests[m.Manifest])})
+		put(ManifestsRead, k, raw, err)
+	}
+	for key, build := range b.builds {
+		module, fp, _ := strings.Cut(key, " ")
+		k, _ := delivery.BuilderBuildKey(module, fp)
+		raw, err := delivery.EncodeBuilderBuild(*build)
+		put(BuildsRead, k, raw, err)
+	}
+	for nm, values := range b.values {
+		for k, v := range values {
+			value, _ := json.Marshal(v)
+			raw, err := json.Marshal(map[string]any{"value": json.RawMessage(value), "source": catalogue.SourceModule})
+			put(ResolvedRead, nm+"."+k, raw, err)
+		}
+	}
+	return out
+}
diff --git a/internal/compose/frombus/frombustest/frombustest.go b/internal/compose/frombus/frombustest/frombustest.go
new file mode 100644
index 0000000..a627e30
--- /dev/null
+++ b/internal/compose/frombus/frombustest/frombustest.go
@@ -0,0 +1,183 @@
+// Package frombustest is a bus in memory for frombus's Reader, and a mesh on it whose composition hands a module to the
+// provisioner with a provision to make, so a module that composes plans from the bus (mesh-provisioner, novox/hq ADR
+// 0570 clause 2) tests against a real plan rather than one written by hand. The manifests are the catalogue's (mesh-catalog
+// c05aa5e6: restic and the provisioner's client) as frombus's own tests read them, restic given one requirement more.
+package frombustest
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"embed"
+	"encoding/json"
+	"errors"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+)
+
+//go:embed testdata
+var testdata embed.FS
+
+// Bus is a frombus.Reader over values held in memory. A credential asked is answered held when Held is set.
+type Bus struct {
+	Placement map[string]delivery.Placement
+	Record    map[string]delivery.NodeRecord
+	Module    map[string]delivery.Module
+	Manifests map[string][]byte
+	Value     map[string]map[string]any // by node.module
+	Own       []compose.OwnSecretRow
+	Builds    map[string]*delivery.BuilderBuild // by "<module> <fp>"
+	Archives  map[string][]byte                 // by digest
+	Serves    map[string]map[string]any         // another node's values, by node.module
+	Held      bool
+}
+
+var _ frombus.Reader = (*Bus)(nil)
+
+func (b *Bus) Placements(context.Context) (map[string]delivery.Placement, error) {
+	return b.Placement, nil
+}
+func (b *Bus) Records(context.Context) (map[string]delivery.NodeRecord, error) { return b.Record, nil }
+func (b *Bus) Modules(context.Context) (map[string]delivery.Module, error)     { return b.Module, nil }
+func (b *Bus) VaultAuthority(context.Context) string                           { return "" }
+
+func (b *Bus) Manifest(_ context.Context, digest string) ([]byte, error) {
+	raw, ok := b.Manifests[digest]
+	if !ok {
+		return nil, errors.New("no such manifest")
+	}
+	return raw, nil
+}
+
+func (b *Bus) Values(_ context.Context, node, module string) (map[string]any, error) {
+	return b.Value[node+"."+module], nil
+}
+
+func (b *Bus) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) { return b.Own, nil }
+
+func (b *Bus) Credentials(_ context.Context, _ string, asConsumer, asProvider []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+	var out []compose.Credential
+	var issued []compose.Issued
+	for _, k := range append(append([]compose.CredentialKey{}, asConsumer...), asProvider...) {
+		if b.Held {
+			out = append(out, compose.Credential{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
+				Provider: k.Provider, Local: k.Local, State: compose.CredentialHeld, Sealed: `"box"`})
+			issued = append(issued, compose.Issued{Provision: k.Provision, Consumer: k.Consumer, ConsumerModule: k.ConsumerModule,
+				Provider: k.Provider, Local: k.Local, ForProvider: `"box"`})
+		}
+	}
+	return out, issued, nil
+}
+
+func (b *Bus) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+	return b.Builds[module+" "+fp], nil
+}
+
+func (b *Bus) Archive(_ context.Context, _, digest string) ([]byte, error) {
+	body, ok := b.Archives[digest]
+	if !ok {
+		return nil, errors.New("the store holds no such blob")
+	}
+	return body, nil
+}
+
+func (b *Bus) Served(_ context.Context, node, module string, keys []string) (map[string]any, error) {
+	out := map[string]any{}
+	for _, k := range keys {
+		if v, ok := b.Serves[node+"."+module][k]; ok {
+			out[k] = v
+		}
+	}
+	return out, nil
+}
+
+// Node is the one node of the mesh Provisioned composes.
+const Node = "n1"
+
+// Provisioned is one node, n1, that runs the artifact store, a postgres providing postgres-database, the provisioner's
+// client and restic: restic built and handed to the provisioner, and requiring postgres-database. Its plans (frombus.Plans
+// with Scope{Node: Node}) hand restic, whose plan names that provision with postgres on n1 as its provider.
+func Provisioned() (*Bus, error) {
+	read := func(name string) ([]byte, error) { return testdata.ReadFile("testdata/" + name) }
+	resticRaw, err := read("catalogue-c05aa5e6-restic.module.json")
+	if err != nil {
+		return nil, err
+	}
+	var restic map[string]any
+	if err := json.Unmarshal(resticRaw, &restic); err != nil {
+		return nil, err
+	}
+	restic["requires"] = []string{"postgres-database"}
+	if resticRaw, err = json.Marshal(restic); err != nil {
+		return nil, err
+	}
+	clientRaw, err := read("catalogue-c05aa5e6-mesh-provisioner-client.module.json")
+	if err != nil {
+		return nil, err
+	}
+	store := []byte(`{"module":"store","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],` +
+		`"serves":{"artifact-store":{"port":5000}}}`)
+	postgres := []byte(`{"module":"postgres","version":"1","provides":[{"name":"postgres-database","scope":"mesh"}],` +
+		`"serves":{"postgres-database":{"port":5432}}}`)
+
+	var packed bytes.Buffer
+	zw := gzip.NewWriter(&packed)
+	tw := tar.NewWriter(zw)
+	for _, f := range []string{"backups.conf", "data.conf", "retention.conf"} {
+		text, err := read("catalogue-c05aa5e6-restic.files/" + f)
+		if err != nil {
+			return nil, err
+		}
+		if err := tw.WriteHeader(&tar.Header{Name: "./" + f, Mode: 0o644, Size: int64(len(text)), Typeflag: tar.TypeReg}); err != nil {
+			return nil, err
+		}
+		if _, err := tw.Write(text); err != nil {
+			return nil, err
+		}
+	}
+	if err := tw.Close(); err != nil {
+		return nil, err
+	}
+	if err := zw.Close(); err != nil {
+		return nil, err
+	}
+	archive := delivery.ManifestDigest(packed.Bytes())
+	digestOf := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
+	fps := FPs()
+	b := &Bus{
+		Placement: map[string]delivery.Placement{Node: {Node: Node,
+			Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1", Account: "operator", AccountHome: "/home/operator"},
+			Modules: []delivery.PlacedModule{{Module: "store"}, {Module: "postgres"}, {Module: "mesh-provisioner-client"}, {Module: "restic"}}}},
+		Record: map[string]delivery.NodeRecord{Node: {Node: Node, TunnelKey: "dGVzdGtleXRlc3RrZXl0ZXN0a2V5dGVzdGtleXRlc3Q=",
+			SealingKey: "sk", Contract: compose.HandedContract, Capabilities: []string{"systemd", "package-manager"}}},
+		Module: map[string]delivery.Module{}, Manifests: map[string][]byte{},
+		Own: []compose.OwnSecretRow{{Node: Node, Module: "mesh-provisioner-client", Name: "provisioner-broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}},
+		Builds: map[string]*delivery.BuilderBuild{
+			"restic " + fps["restic"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(resticRaw), Artifacts: []delivery.BuiltArtifact{
+				{Name: "tools", Kind: "bundle", Reference: "artifact-store://restic/tools/blobs/" + digestOf("6"), Digest: digestOf("6")},
+				{Name: "files", Kind: "archive", Reference: "artifact-store://restic/files/blobs/" + archive, Digest: archive}}},
+			"mesh-provisioner-client " + fps["mesh-provisioner-client"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(clientRaw),
+				Artifacts: []delivery.BuiltArtifact{{Name: "client", Kind: "bundle",
+					Reference: "artifact-store://mesh-provisioner-client/client/blobs/" + digestOf("7"), Digest: digestOf("7")}}},
+			"store " + fps["store"]:       {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(store)},
+			"postgres " + fps["postgres"]: {State: delivery.BuildDone, Manifest: delivery.ManifestDigest(postgres)},
+		},
+		Archives: map[string][]byte{archive: packed.Bytes()},
+		Held:     true,
+	}
+	for module, raw := range map[string][]byte{"restic": resticRaw, "mesh-provisioner-client": clientRaw, "store": store, "postgres": postgres} {
+		b.Module[module] = delivery.Module{FP2: fps[module], Manifest: delivery.ManifestDigest(raw)}
+		b.Manifests[delivery.ManifestDigest(raw)] = raw
+	}
+	return b, nil
+}
+
+// FPs are the fingerprints Provisioned's modules are built at.
+func FPs() map[string]string {
+	return map[string]string{"restic": "src2:" + strings.Repeat("3", 64), "mesh-provisioner-client": "src2:" + strings.Repeat("4", 64),
+		"store": "src2:" + strings.Repeat("5", 64), "postgres": "src2:" + strings.Repeat("8", 64)}
+}
diff --git a/internal/compose/frombus/frombustest/frombustest_test.go b/internal/compose/frombus/frombustest/frombustest_test.go
new file mode 100644
index 0000000..e6a0311
--- /dev/null
+++ b/internal/compose/frombus/frombustest/frombustest_test.go
@@ -0,0 +1,272 @@
+package frombustest
+
+import (
+	"context"
+	"reflect"
+	"strings"
+	"testing"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+	"github.com/novox/mesh-host/internal/compose/fromruntime"
+)
+
+// ADR 0570 clause 2 (issue 1954; a3's H5): the in-memory mesh composes a plan from the bus that hands restic to the
+// provisioner and names its postgres-database, provided by postgres on n1. And one bad module must not drop its node
+// (issue 774): with a module placed beside it whose built manifest cannot be used, or whose plan refuses, PlansHeld
+// still hands restic's plan and names the bad one with why, where Plans refuses the whole node. A manifest the indexer
+// holds that the mesh refuses (power's bar item with attributes its bar places by none of, mesh-catalog ca8d6f33,
+// 2026-10-30) holds that module alone on its node, in the plans and in the node's composition (Compose), and on a node
+// it is not placed on holds nothing.
+func TestTheProvisionedMeshHandsAPlanWithItsProvision(t *testing.T) {
+	fp := "src2:" + strings.Repeat("9", 64)
+	for _, row := range []struct {
+		name string
+		bad  string // the indexer's manifest of a module "backup" placed on n1; empty places none
+		// built is the manifest backup's done build names; empty gives it no build
+		built string
+		why   string // words backup's hold says
+		// elsewhere leaves backup in the indexer's modules and places it on no node: nothing is held.
+		elsewhere bool
+		// refused is the indexer's verdict on bad, a problem its judge found (novox/hq ADR 0578 §1): Plans then holds
+		// backup too, and never ends the read.
+		refused string
+		// dataHeld says the data items' read holds backup too: a refusal it meets (a refused manifest, an unusable build,
+		// an item composition refuses), not one only a plan meets.
+		dataHeld bool
+		// dataOnly checks the data items' read alone: the other reads blame restic, whose templates collect the item.
+		dataOnly bool
+	}{
+		{name: "every module composes"},
+		{name: "a built manifest that cannot be used",
+			bad:   `{"module":"backup","version":"1","build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`,
+			built: `{"module":"backup","version":"1","requires":"amqp"}`, why: "backup", dataHeld: true},
+		{name: "a plan that refuses",
+			bad: `{"module":"backup","version":"1","resources":[{"id":"conf","type":"file","path":"/etc/backup.conf",` +
+				`"mode":"0600","content":"key=${secret:nope}"}]}`, why: "${secret:nope}"},
+		{name: "an indexer's manifest the mesh refuses", bad: unusableItem, why: `"shows" is none of them`,
+			refused: `"shows" is none of them`, dataHeld: true},
+		// ADR 0578 §3: an accepted manifest whose data item its composition refuses is held by the culprit rule, in every read.
+		{name: "a data item its composition refuses",
+			bad: `{"module":"backup","version":"1","data":{"own":[{"id":"d","path":"${dir:nope}","class":"cache"}]}}`,
+			why: "nope", dataHeld: true, dataOnly: true},
+		{name: "an indexer's manifest the mesh refuses, placed elsewhere", bad: unusableItem, elsewhere: true,
+			refused: `"shows" is none of them`},
+	} {
+		b, err := Provisioned()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row.bad != "" {
+			if !row.elsewhere {
+				p := b.Placement[Node]
+				p.Modules = append(p.Modules, delivery.PlacedModule{Module: "backup"})
+				b.Placement[Node] = p
+			}
+			digest := delivery.ManifestDigest([]byte(row.bad))
+			b.Manifests[digest] = []byte(row.bad)
+			b.Module["backup"] = delivery.Module{FP2: fp, Manifest: digest}
+			if row.refused != "" {
+				b.Module["backup"] = delivery.Module{FP2: fp, Manifest: digest, Verdict: delivery.VerdictRefused,
+					Problems: []string{row.refused}}
+			}
+			if row.built != "" {
+				builtDigest := delivery.ManifestDigest([]byte(row.built))
+				b.Manifests[builtDigest] = []byte(row.built)
+				b.Builds["backup "+fp] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: builtDigest,
+					Artifacts: []delivery.BuiltArtifact{{Name: "files", Kind: "archive", Reference: "artifact-store://backup/files/blobs/x", Digest: "sha256:x"}}}
+			}
+			if row.dataOnly {
+				items, _, iheld, err := frombus.DataItemsHeld(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node})
+				if why, ok := iheld["backup"]; err != nil || !ok || !strings.Contains(why, row.why) || len(items["restic"]) == 0 {
+					t.Errorf("%s: data items %v held %v: %v", row.name, items, iheld, err)
+				}
+				continue
+			}
+			plans, err := frombus.Plans(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node})
+			switch {
+			case row.refused != "" && (err != nil || !planned(plans, "restic") || planned(plans, "backup")):
+				t.Errorf("%s: Plans did not hold the refused manifest alone: %v %v", row.name, plans, err)
+			case row.refused == "" && err == nil && !row.elsewhere:
+				t.Errorf("%s: Plans composed the node; the row does not refuse it", row.name)
+			}
+		}
+		if row.why != "" || row.bad == "" {
+			// The node's own composition holds by the same rule: every other module composed, the bad one named.
+			fps := FPs()
+			if row.bad != "" {
+				fps["backup"] = fp
+			}
+			out, _, held, err := frombus.Compose(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node}, fps)
+			if err != nil {
+				t.Fatalf("%s: the node's composition: %v", row.name, err)
+			}
+			if key, _ := delivery.ComposedKey(Node, "restic", fps["restic"]); out[key].Module != "restic" {
+				t.Errorf("%s: restic is not composed (held %v)", row.name, held)
+			}
+			if why, ok := held["backup"]; (row.bad == "" && len(held) > 0) || (row.bad != "" && (!ok || !strings.Contains(why, row.why) || len(held) != 1)) {
+				t.Errorf("%s: the node's composition held %v, want backup alone, saying %q", row.name, held, row.why)
+			}
+		}
+		plans, held, err := frombus.PlansHeld(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node})
+		if err != nil {
+			t.Fatalf("%s: %v", row.name, err)
+		}
+		restic, handed := plans["restic"]
+		if !handed || len(restic.Provisions) != 1 || restic.Provisions[0].Provision != "postgres-database" ||
+			restic.Provisions[0].Provider != Node || restic.Provisions[0].ProviderModule != "postgres" {
+			t.Fatalf("%s: the plans are %+v (held %v)", row.name, plans, held)
+		}
+		// Issue 1954: the plans at the wanted builds and at the newest, over one read, are what PlansHeld answers for each,
+		// and where the time went is said by phase.
+		keptAt := FPs()
+		at, newest, took := frombus.PlansHeldTwice(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node, KeptAt: keptAt})
+		wantAt, heldAt, errAt := frombus.PlansHeld(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node, KeptAt: keptAt})
+		if !reflect.DeepEqual(at, frombus.HeldPlans{Plans: wantAt, Held: heldAt, Err: errAt}) ||
+			!reflect.DeepEqual(newest, frombus.HeldPlans{Plans: plans, Held: held}) {
+			t.Errorf("%s: twice composed %+v and %+v, want %v %v %v and %v %v", row.name, at, newest, wantAt, heldAt, errAt, plans, held)
+		}
+		if said := frombus.PhasesSaid(took); !strings.HasPrefix(said, "read ") || !strings.Contains(said, "plans at newest ") {
+			t.Errorf("%s: the phases are said as %q", row.name, said)
+		}
+		if row.bad == "" || row.elsewhere {
+			if len(held) > 0 {
+				t.Errorf("%s: held %v", row.name, held)
+			}
+			continue
+		}
+		if why, ok := held["backup"]; !ok || !strings.Contains(why, row.why) || len(held) != 1 {
+			t.Errorf("%s: held %v, want backup alone, saying %q", row.name, held, row.why)
+		}
+		if _, planned := plans["backup"]; planned {
+			t.Errorf("%s: the held module has a plan", row.name)
+		}
+		// The data items are read by the same rule (ADR 0578 §3: disk-load's read): the bad module held, the read whole.
+		items, _, iheld, err := frombus.DataItemsHeld(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node})
+		// A refusal only a plan meets (a file's secret) holds nothing here: data items render no such file.
+		mustHold := row.dataHeld
+		if why, ok := iheld["backup"]; err != nil || ok != mustHold || mustHold && !strings.Contains(why, row.why) || items["backup"] != nil {
+			t.Errorf("%s: data items %v held %v: %v", row.name, items, iheld, err)
+		}
+	}
+
+	// ADR 0580 clause 1: the watched reader reads a state it composes from out of the copy, a build by key each time it is
+	// asked, and a manifest once per digest.
+	byKey := map[string]int{}
+	ws := stdio.WatchedStatesOver(func(state string, handle func(stdio.StateChange) error) error {
+		byKey[state+" watched"]++
+		return handle(stdio.StateChange{Key: "placement." + Node, Op: stdio.OpPut, Value: []byte(`{}`), Current: true})
+	}, func(state, key string) ([]byte, bool, error) { byKey[state]++; return []byte(key), true, nil })
+	w := fromruntime.Watched{WatchedStates: ws}
+	for range 2 {
+		_, _, _ = w.Get(frombus.BuildsRead, "restic."+fp)
+		_, _, _ = w.Get(frombus.ManifestsRead, "sha256-d")
+		if _, found, _ := w.Get(frombus.PlacementRead, "placement."+Node); !found {
+			t.Error("the watched reader does not answer the placement from its copy")
+		}
+	}
+	if byKey[frombus.BuildsRead] != 2 || byKey[frombus.ManifestsRead] != 1 || byKey[frombus.PlacementRead] != 0 ||
+		byKey[frombus.PlacementRead+" watched"] != 1 {
+		t.Errorf("the watched reader read %v, want a build by key each time, a manifest once, the placement watched once", byKey)
+	}
+	fetched := 0
+	keep := fromruntime.KeptFetch(func(context.Context, string) ([]byte, error) { fetched++; return []byte("tar"), nil })
+	for range 2 {
+		if body, err := keep(context.Background(), "http://store/restic/files/blobs/sha256:a"); err != nil || string(body) != "tar" {
+			t.Fatalf("the kept fetch answered %q, %v", body, err)
+		}
+	}
+	if fetched != 1 {
+		t.Errorf("a templates archive was fetched %d times, want once", fetched)
+	}
+
+	// Issue 1954: the states reader takes a build in once per its content: composed again, its archive is not read again
+	// and the plans are the same.
+	b, err := Provisioned()
+	if err != nil {
+		t.Fatal(err)
+	}
+	reader, archives := frombus.StatesReader(statesOf(t, b), func(_ context.Context, url string) ([]byte, error) {
+		fetched++
+		_, digest, _ := strings.Cut(url, "/blobs/")
+		return b.Archives[digest], nil
+	}), fetched
+	var first map[string]catalogue.Plan
+	for i := range 2 {
+		plans, held, err := frombus.PlansHeld(context.Background(), reader, frombus.Mesh{}, frombus.Scope{Node: Node})
+		if err != nil || len(held) > 0 || (i == 1 && !reflect.DeepEqual(plans, first)) || !planned(plans, "restic") {
+			t.Fatalf("composed %v (held %v): %v", plans, held, err)
+		}
+		first = plans
+	}
+	if fetched-archives != 1 {
+		t.Errorf("restic's archive was read %d times over two compositions, want once", fetched-archives)
+	}
+}
+
+// statesOf is the bus b as a module's read states hold it.
+func statesOf(t *testing.T, b *Bus) frombus.States {
+	t.Helper()
+	s := states{}
+	put := func(state, key string, raw []byte, err error) {
+		if err != nil {
+			t.Fatal(err)
+		}
+		if s[state] == nil {
+			s[state] = map[string][]byte{}
+		}
+		s[state][key] = raw
+	}
+	for node, p := range b.Placement {
+		raw, err := delivery.EncodePlacement(p)
+		put(frombus.PlacementRead, "placement."+node, raw, err)
+	}
+	for node, rec := range b.Record {
+		raw, err := delivery.EncodeHaveNode(delivery.HaveNode{Record: &rec})
+		put(frombus.HaveRead, node+".node", raw, err)
+	}
+	for module, m := range b.Module {
+		key, _ := delivery.ModulesKey(module)
+		raw, err := delivery.EncodeModule(m)
+		put(frombus.ModulesRead, key, raw, err)
+	}
+	for digest, man := range b.Manifests {
+		key, _ := delivery.ManifestsKey(digest)
+		raw, err := delivery.EncodeManifest(delivery.Manifest{Module: "m", JSON: string(man)})
+		put(frombus.ManifestsRead, key, raw, err)
+	}
+	for at, build := range b.Builds {
+		module, fp, _ := strings.Cut(at, " ")
+		key, _ := delivery.BuilderBuildKey(module, fp)
+		raw, err := delivery.EncodeBuilderBuild(*build)
+		put(frombus.BuildsRead, key, raw, err)
+	}
+	return s
+}
+
+// states are read states in memory.
+type states map[string]map[string][]byte
+
+func (s states) Get(state, key string) ([]byte, bool, error) {
+	v, ok := s[state][key]
+	return v, ok, nil
+}
+
+func (s states) Keys(state string) ([]string, error) {
+	var keys []string
+	for k := range s[state] {
+		keys = append(keys, k)
+	}
+	return keys, nil
+}
+
+func planned[P any](plans map[string]P, module string) bool { _, ok := plans[module]; return ok }
+
+// unusableItem is a manifest the mesh refuses as the node-engine did power's at mesh-catalog ca8d6f33: a bar block item
+// with attributes its bar places by none of.
+const unusableItem = `{"module":"backup","version":"1","moved":true,` +
+	`"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},` +
+	`"items":[{"collection":"contribution:node-bar:block",` +
+	`"attributes":{"bar":"bottom","place":"status","shows":"state","state":"power.draw"},"template":"files/bar"}]}`
diff --git a/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json
new file mode 100644
index 0000000..095128a
--- /dev/null
+++ b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json
@@ -0,0 +1,60 @@
+{
+  "module": "mesh-provisioner-client",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-provisioner",
+      "scope": "node"
+    }
+  ],
+  "own-secrets": {
+    "provisioner-broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-provisioner-client",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-provisioner-client",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-provisioner-client"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-provisioner-client",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "client",
+      "type": "process",
+      "name": "mesh-provisioner-client",
+      "artifact": "client",
+      "run": [
+        "./mesh-provisioner-client"
+      ],
+      "env": {
+        "MESH_PROVISIONER_CREDENTIAL": "${dir:state}/broker",
+        "MESH_PROVISIONER_STATE": "${dir:state}"
+      },
+      "user": "mesh-provisioner-client",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "client",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-provisioner-client",
+        "binary": "mesh-provisioner-client"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/backups.conf b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/backups.conf
new file mode 100644
index 0000000..2f23f90
--- /dev/null
+++ b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/backups.conf
@@ -0,0 +1,2 @@
+# What the modules on this machine back up, composed by the mesh (novox/hq to-be 43). Do not edit.
+${backup:lines}
\ No newline at end of file
diff --git a/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/data.conf b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/data.conf
new file mode 100644
index 0000000..f19e849
--- /dev/null
+++ b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/data.conf
@@ -0,0 +1,2 @@
+# The data the modules on this machine declare, composed by the mesh (novox/hq ADR 0233). Do not edit.
+${backup:data}
\ No newline at end of file
diff --git a/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/retention.conf b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/retention.conf
new file mode 100644
index 0000000..cd7954c
--- /dev/null
+++ b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.files/retention.conf
@@ -0,0 +1,6 @@
+# How many restore points the night keeps, written by the mesh from this machine's settings keep-daily,
+# keep-weekly, keep-monthly (novox/hq issue 416) and keep-hand-taken-days (novox/hq issue 453). Replaced on every push; change the settings, never this file.
+daily=${config:keep-daily}
+weekly=${config:keep-weekly}
+monthly=${config:keep-monthly}
+hand=${config:keep-hand-taken-days}
diff --git a/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.module.json b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.module.json
new file mode 100644
index 0000000..ea5ec8b
--- /dev/null
+++ b/internal/compose/frombus/frombustest/testdata/catalogue-c05aa5e6-restic.module.json
@@ -0,0 +1,199 @@
+{
+  "module": "restic",
+  "version": "1",
+  "moved": true,
+  "claims": [
+    {
+      "name": "node-backup",
+      "scope": "node",
+      "serves": [
+        "backed-up",
+        "now",
+        "restore"
+      ]
+    }
+  ],
+  "emits": [
+    "backed-up"
+  ],
+  "tools": [
+    "backup_health",
+    "backup_delete_retired",
+    "backup_deleted"
+  ],
+  "own-secrets": {
+    "repository": "${dir:state}/repository.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "repository",
+        "path": "${dir:repository}",
+        "class": "rebuildable",
+        "backup": "none",
+        "why": "the restore points themselves: a copy of data kept elsewhere on this machine, never the only copy of anything; lost, the history goes and nothing live does"
+      },
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "cache",
+        "why": "what the last nights and measurements were; the next night writes it again"
+      }
+    ]
+  },
+    "config": {
+      "keep-daily": {
+        "type": "number",
+        "description": "How many nightly restore points are kept, a count from 1 to 9999: two weeks undo a mistake noticed within a fortnight. Read by the night, which thins nothing while it does not read (novox/hq issue 416); lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 14
+      },
+      "keep-weekly": {
+        "type": "number",
+        "description": "How many weekly restore points are kept behind the dailies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 8
+      },
+      "keep-monthly": {
+        "type": "number",
+        "description": "How many monthly restore points are kept behind the weeklies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 6
+      },
+      "keep-hand-taken-days": {
+        "type": "number",
+        "description": "How many days a restore point taken by hand (node-backup.now, or the mesh's before a module moves) is kept at least, a count from 1 to 9999; it is kept until a later good night of its module exists, and this many days in any case, so the next thinning never takes the one taken against a risky change (novox/hq issue 453). Lowering it lets go of the older ones taken by hand at the next thinning, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 7
+      }
+    },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "repository",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "declared",
+      "type": "file",
+      "path": "${dir:state}/backups.conf",
+      "mode": "0600",
+      "template": "files/backups.conf"
+    },
+    {
+      "id": "data-declared",
+      "type": "file",
+      "path": "${dir:state}/data.conf",
+      "mode": "0600",
+      "template": "files/data.conf"
+    },
+    {
+      "id": "retention",
+      "type": "file",
+      "path": "${dir:state}/retention.conf",
+      "mode": "0644",
+      "trusted": true,
+      "template": "files/retention.conf"
+    },
+    {
+      "id": "tool",
+      "type": "package",
+      "package": "restic"
+    },
+    {
+      "id": "sqlite",
+      "type": "package",
+      "package": "sqlite"
+    },
+    {
+      "id": "night",
+      "type": "process",
+      "name": "restic-night",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "night"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "tool",
+        "tool": "backup_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    },
+    {
+      "id": "measure",
+      "type": "process",
+      "name": "restic-measure",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "measure"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/restic-backups",
+        "binary": "restic-backups",
+        "loads": [
+          "restic-backups"
+        ],
+        "env": {
+          "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+          "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+          "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+          "MESH_BACKUP_STATE": "${dir:state}",
+          "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/held_rows_test.go b/internal/compose/frombus/held_rows_test.go
new file mode 100644
index 0000000..bc8fae7
--- /dev/null
+++ b/internal/compose/frombus/held_rows_test.go
@@ -0,0 +1,299 @@
+package frombus
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// aNode is a bus with n1 the hub, each of manifests placed on it and held at the indexer, in the order given.
+func aNode(t *testing.T, manifests ...string) (*bus, map[string]string) {
+	t.Helper()
+	p := delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"}}
+	b := &bus{records: map[string]delivery.NodeRecord{"n1": {Node: "n1", TunnelKey: publicKey(t), SealingKey: "sk", Capabilities: []string{"systemd"}}},
+		modules: map[string]delivery.Module{}, manifests: map[string][]byte{}, builds: map[string]*delivery.BuilderBuild{}}
+	fps := map[string]string{}
+	for i, raw := range manifests {
+		module := strings.SplitN(strings.TrimPrefix(raw, `{"module":"`), `"`, 2)[0]
+		p.Modules = append(p.Modules, delivery.PlacedModule{Module: module})
+		b.modules[module] = delivery.Module{Manifest: delivery.ManifestDigest([]byte(raw))}
+		b.manifests[delivery.ManifestDigest([]byte(raw))] = []byte(raw)
+		fps[module] = "src2:" + strings.Repeat(string(rune('1'+i)), 64)
+	}
+	b.placements = map[string]delivery.Placement{"n1": p}
+	return b, fps
+}
+
+// Issue 774, 2026-10-30 19:30: a node refused whole after holding a module says what it held and why, since the last
+// refusal can be of the held module's stub (node-tools held, then "its build produced 0 bundle(s)", its own why unsaid).
+func aNodeRefusedWholeSaysWhatItHeld(t *testing.T) {
+	refused := `{"module":"power","version":"1","items":[{"collection":"contribution:node-bar:block","attributes":{"shows":"state"},"template":"files/a"}]}`
+	needs := `{"module":"lamp","version":"1","requires":["nothing-provides-this"]}`
+	b, fps := aNode(t, refused, needs)
+	refuse(b, "power", `"shows" is none of them`)
+	_, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1"}, fps)
+	if err == nil || !strings.Contains(err.Error(), "nothing provides") || !strings.Contains(err.Error(), `held before: power: `) ||
+		!strings.Contains(err.Error(), `"shows" is none of them`) {
+		t.Errorf("the node refused whole with %v (held %v), want lamp's refusal and power held before, with its why", err, held)
+	}
+}
+
+// refuse writes the indexer's refusal of module's manifest into its modules value (novox/hq ADR 0578 §1).
+func refuse(b *bus, module string, problems ...string) {
+	m := b.modules[module]
+	m.Verdict, m.Problems = delivery.VerdictRefused, problems
+	b.modules[module] = m
+}
+
+// ADR 0578 §3: the bus reader never ends a whole read on a refused manifest. Input, Plans and DataItems compose the rest
+// and hold the refused module, named with the indexer's words in Refused; a field the decoder does not know is set aside
+// and named, and its module composed.
+func aRefusedManifestNeverEndsTheRead(t *testing.T) {
+	ok := `{"module":"lamp","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/lamp","mode":"0700"}],` +
+		`"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`
+	bad := `{"module":"power","version":"1","resources":[{"id":"d","type":"directory","path":"/srv/power","mode":"0700"}],` +
+		`"data":{"own":[{"id":"d","path":"${dir:d}","class":"valuable"}]}}`
+	later := `{"module":"later","version":"1","a-field-from-later":1}`
+	b, _ := aNode(t, ok, bad, later)
+	refuse(b, "power", "removes a stream it may not")
+	ctx := context.Background()
+	in, err := Input(ctx, b, Mesh{}, Scope{Node: "n1"})
+	if err != nil {
+		t.Fatalf("one refused manifest ended the read: %v", err)
+	}
+	if why := in.Refused["power"]; !strings.Contains(why, "refused the manifest of power: removes a stream it may not") ||
+		len(in.Refused) != 1 {
+		t.Fatalf("refused: %v", in.Refused)
+	}
+	if aside := in.SetAside["later"]; !strings.Contains(aside, "a-field-from-later") {
+		t.Fatalf("set aside: %v", in.SetAside)
+	}
+	if !in.Catalogue["power"].Stubbed || in.Catalogue["lamp"].Stubbed || in.Catalogue["later"].Module != "later" {
+		t.Fatalf("the catalogue: %+v", in.Catalogue)
+	}
+	if _, err := Plans(ctx, b, Mesh{}, Scope{Node: "n1"}); err != nil {
+		t.Fatalf("plans: %v", err)
+	}
+	items, _, held, err := DataItemsHeld(ctx, b, Mesh{}, Scope{Node: "n1"})
+	if err != nil || len(items["lamp"]) != 1 || items["power"] != nil || !strings.Contains(held["power"], "removes a stream") {
+		t.Fatalf("data items %v held %v: %v", items, held, err)
+	}
+}
+
+// Issue 774: the culprit rule takes a module whose stub composes or fails otherwise; the runtime only where its stub
+// composes, since its stub always fails otherwise.
+func theRuntimeIsBlamedOnlyWhereItsStubComposes(t *testing.T) {
+	err := errors.New("lamp refuses")
+	for _, row := range []struct {
+		module string
+		again  error
+		blamed bool
+	}{
+		{"lamp", nil, true},
+		{"lamp", errors.New("other"), true},
+		{"lamp", errors.New("lamp refuses"), false},
+		{catalogue.RuntimeModule, nil, true},
+		{catalogue.RuntimeModule, errors.New("node-tools is assigned to n1 and its build produced 0 bundle(s)"), false},
+		{catalogue.RuntimeModule, fmt.Errorf("compose: %w", &resolution.NoRuntimeToRunError{Held: true}), true},
+		{catalogue.RuntimeModule, &resolution.NoRuntimeToRunError{}, false},
+	} {
+		if got := blames(row.module, row.again, err); got != row.blamed {
+			t.Errorf("%s with %v: blamed %v, want %v", row.module, row.again, got, row.blamed)
+		}
+	}
+}
+
+// Issue 774, 2026-10-30 19:30: the trunk's node-tools moved to a build not yet done, and ace, g14 and shanks composed
+// it from the indexer's manifest, which names no bundle: "its build produced 0 bundle(s)", every module refused. A
+// module that runs is now held until its build lands, the runtime composed as what runs of it; and a module wanted at
+// another build than the trunk's is composed from the build its want names.
+func aRunningModuleWaitsForItsBuild(t *testing.T) {
+	dg := func(c string) string { return "sha256:" + strings.Repeat(c, 64) }
+	tools := `{"module":"node-tools","version":"1","own-secrets":{"broker":"/var/lib/mesh/node-tools/broker"},` +
+		`"build":{"artifacts":[{"name":"runtime","kind":"bundle","language":"go","system":"arch","from":"cmd/node-tools"}]}}`
+	lamp := `{"module":"lamp","version":"1","resources":[{"id":"service","type":"service","unit":"lamp.service","state":"running","boot":"enabled"}]}`
+	store := `{"module":"artifacts","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],"serves":{"artifact-store":{"port":5100}},` +
+		`"receives":{"artifact-store":"/var/lib/artifacts/received.json"}}`
+	old, next := "src2:"+strings.Repeat("a", 64), "src2:"+strings.Repeat("b", 64)
+	running := []delivery.Composed{{Node: "n1", Module: catalogue.RuntimeModule, FP: old, Resources: []json.RawMessage{
+		json.RawMessage(`{"id":"node-tools.runtime","module":"node-tools","type":"process","name":"node-tools","env":{"MESH_TOOL_MODULES":""}}`),
+		json.RawMessage(`{"id":"node-tools.bundle-runtime","module":"node-tools","type":"archive","source":"artifact-store://node-tools/runtime/blobs/` +
+			dg("1") + `","digest":"` + dg("1") + `","path":"` + resolution.BundlePath("node-tools", "runtime") + `"}`)}}}
+	for _, row := range []struct {
+		name   string
+		want   string // the build node-tools' want names
+		done   bool   // the trunk's build is done
+		held   string // words node-tools' hold says; empty: composed
+		digest string // the runtime bundle's digest composed
+	}{
+		{name: "the trunk's build not done yet", want: next, held: "no done build yet"},
+		{name: "wanted at the build that runs, the trunk's not done", want: old, digest: dg("1")},
+		{name: "the trunk's build done", want: next, done: true, digest: dg("2")},
+	} {
+		b, fps := aNode(t, store, tools, lamp)
+		b.held = true // every grant held, so a contribution's credential stands in for nothing
+		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "node-tools", Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
+		mod := b.modules["node-tools"]
+		mod.FP2 = next
+		b.modules["node-tools"] = mod
+		b.builds["node-tools "+old] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
+			Artifacts: []delivery.BuiltArtifact{{Name: "runtime", Kind: "bundle", Reference: "artifact-store://node-tools/runtime/blobs/" + dg("1"), Digest: dg("1")}}}
+		b.builds["node-tools "+next] = &delivery.BuilderBuild{State: "building", Manifest: mod.Manifest}
+		if row.done {
+			b.builds["node-tools "+next] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
+				Artifacts: []delivery.BuiltArtifact{{Name: "runtime", Kind: "bundle", Reference: "artifact-store://node-tools/runtime/blobs/" + dg("2"), Digest: dg("2")}}}
+		}
+		fps["node-tools"] = row.want
+		out, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1", Running: running}, fps)
+		if err != nil {
+			t.Errorf("%s: the node is refused: %v", row.name, err)
+			continue
+		}
+		if lampKey, _ := delivery.ComposedKey("n1", "lamp", fps["lamp"]); out[lampKey].Module != "lamp" {
+			t.Errorf("%s: lamp is not composed (held %v)", row.name, held)
+		}
+		if why := held["node-tools"]; (row.held == "") != (why == "") || !strings.Contains(why, row.held) {
+			t.Errorf("%s: node-tools held %q, want %q", row.name, why, row.held)
+		}
+		if row.digest != "" {
+			key, _ := delivery.ComposedKey("n1", "node-tools", row.want)
+			if c := out[key]; !strings.Contains(fmt.Sprint(rawStrings(c.Resources)), row.digest) {
+				t.Errorf("%s: node-tools is composed as %v, want its bundle %s", row.name, rawStrings(c.Resources), row.digest)
+			}
+		}
+	}
+}
+
+func rawStrings(rs []json.RawMessage) []string {
+	var out []string
+	for _, r := range rs {
+		out = append(out, string(r))
+	}
+	return out
+}
+
+// Issue 774: a refusal of a held module's stand-in leads with why the module was held, its first reason, as mesh-self-check's
+// on ace should have; a refusal naming no held module is as it was.
+func aHeldModulesFirstReasonLeads(t *testing.T) {
+	held := map[string]string{"mesh-self-check": "mesh-self-check on ace has no bus credential: nothing was issued for ace.mesh-self-check"}
+	for _, row := range []struct {
+		err, want string
+	}{
+		{"mesh-self-check runs as its own account and declares no own secret broker",
+			"mesh-self-check is held: mesh-self-check on ace has no bus credential: nothing was issued for ace.mesh-self-check; " +
+				"its stand-in is then refused: mesh-self-check runs as its own account and declares no own secret broker"},
+		{"ace is the hub and has no endpoint", "ace is the hub and has no endpoint"},
+	} {
+		err := errors.New(row.err)
+		got := firstReason(err, held)
+		if got.Error() != row.want || !errors.Is(got, err) {
+			t.Errorf("refused %q, want %q", got, row.want)
+		}
+	}
+}
+
+// Issue 774, 2026-10-30 21:04: mesh-conditions and mesh-healers on novox and mesh-self-check on ace were placed before their
+// bus accounts were issued. Held for "needs a secret called broker and none was made", each one's bare stub was then
+// refused as "runs as its own account and declares no own secret broker", and that refusal failed every module of the
+// node (79 on novox, 74 on ace). A held module's stand-in is never refused by a rule about its own runtime or its own
+// secrets: the node composes every other module, and the held one keeps the words it was first held for.
+func aHeldModuleOfItsOwnAccountNeverRefusesTheNode(t *testing.T) {
+	dg := "sha256:" + strings.Repeat("1", 64)
+	tools := `{"module":"node-tools","version":"1","own-secrets":{"broker":"/var/lib/mesh/node-tools/broker"},` +
+		`"build":{"artifacts":[{"name":"runtime","kind":"bundle","language":"go","system":"arch","from":"cmd/node-tools"}]}}`
+	own := func(name string) string {
+		return `{"module":"` + name + `","version":"1","runs-as":"` + name + `","secrets-owner":"` + name + `","tools":["status"],` +
+			`"own-secrets":{"broker":"/var/lib/` + name + `/broker"},"contributes":{"artifact-store":{"name":"` + name + `"}},` +
+			`"resources":[{"id":"account","type":"user","name":"` + name + `"}],` +
+			`"build":{"artifacts":[{"name":"tools","kind":"bundle","language":"typescript","entrypoints":["tools/index.js"]}]}}`
+	}
+	lamp := `{"module":"lamp","version":"1","resources":[{"id":"service","type":"service","unit":"lamp.service","state":"running","boot":"enabled"}]}`
+	store := `{"module":"artifacts","version":"1","provides":[{"name":"artifact-store","scope":"mesh"}],"serves":{"artifact-store":{"port":5100}},` +
+		`"receives":{"artifact-store":"/var/lib/artifacts/received.json"}}`
+	for _, row := range []struct {
+		name     string
+		issued   []string          // the own-account modules whose broker is issued
+		building bool              // node-tools' build is not done, and nothing of it runs
+		held     map[string]string // the modules held, each with words of the reason it was first held for
+		// ungranted gives the provider a grants file and no consumer's grant is issued yet (a newly placed module's
+		// usual state): a held module's contribution then stands in for its grant, and is left out (review round 1).
+		ungranted bool
+	}{
+		{name: "none issued", held: map[string]string{"check": "broker", "heal": "broker"}},
+		{name: "none issued, no grant issued", ungranted: true, held: map[string]string{"check": "broker", "heal": "broker"}},
+		{name: "one issued", issued: []string{"heal"}, held: map[string]string{"check": "broker"}},
+		{name: "both issued", issued: []string{"check", "heal"}},
+		// The runtime held: its stand-in is not refused for its bundle; the modules it would run are held, not the node.
+		{name: "the runtime's build not done", issued: []string{"check", "heal"}, building: true,
+			held: map[string]string{"node-tools": "its build produced 0 bundle(s)", "check": "not here to run it from", "heal": "not here to run it from"}},
+	} {
+		provider := store
+		if row.ungranted {
+			provider = strings.Replace(store, `"receives":`, `"grants":{"artifact-store":"/var/lib/artifacts/grants"},"receives":`, 1)
+		}
+		b, fps := aNode(t, provider, tools, own("check"), lamp, own("heal"))
+		// Every grant held, so the held modules' contributions are composed whole; the row ungranted issues none.
+		b.held = !row.ungranted
+		b.own = []compose.OwnSecretRow{{Node: "n1", Module: "node-tools", Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`}}
+		for _, m := range row.issued {
+			b.own = append(b.own, compose.OwnSecretRow{Node: "n1", Module: m, Name: "broker", Origin: "made", SealedTo: "sk", Sealed: `"box"`})
+		}
+		for _, m := range []string{"node-tools", "check", "heal"} {
+			name := "tools"
+			if m == "node-tools" {
+				name = "runtime"
+			}
+			mod := b.modules[m]
+			mod.FP2 = fps[m]
+			b.modules[m] = mod
+			b.builds[m+" "+fps[m]] = &delivery.BuilderBuild{State: delivery.BuildDone, Manifest: mod.Manifest,
+				Artifacts: []delivery.BuiltArtifact{{Name: name, Kind: "bundle", Reference: "artifact-store://" + m + "/" + name + "/blobs/" + dg, Digest: dg}}}
+			if m == "node-tools" && row.building {
+				b.builds[m+" "+fps[m]] = &delivery.BuilderBuild{State: "building", Manifest: mod.Manifest}
+			}
+		}
+		out, _, held, err := Compose(context.Background(), b, Mesh{}, Scope{Node: "n1"}, fps)
+		if err != nil {
+			t.Errorf("%s: the node is refused: %v", row.name, err)
+			continue
+		}
+		// A held module keeps what it contributes (issue 774, 2026-10-31: nextcloud held for its admin secret dropped out
+		// of postgres's received file, and postgres's helper would have locked its login): only its own secrets are left
+		// out of its stand-in, never its contributions, so the provider's received file names every consumer.
+		storeKey, _ := delivery.ComposedKey("n1", "artifacts", fps["artifacts"])
+		// And never a stand-in for a grant not yet issued: the provider is applied, so a held module whose grant is
+		// not issued is composed without that contribution, never with "foreseen: made by the next send".
+		for key, c := range out {
+			if got, _ := json.Marshal(c.Resources); strings.Contains(string(got), "foreseen") {
+				t.Errorf("%s: %s applies a stand-in: %s", row.name, key, got)
+			}
+		}
+		for _, m := range []string{"check", "heal"} {
+			if row.ungranted {
+				break
+			}
+			if got, _ := json.Marshal(out[storeKey].Resources); !strings.Contains(string(got), `\"from\": \"`+m+`\"`) {
+				t.Errorf("%s: the provider's received file drops %s's contribution: %s", row.name, m, got)
+			}
+		}
+		for _, m := range []string{"node-tools", "check", "lamp", "heal"} {
+			key, _ := delivery.ComposedKey("n1", m, fps[m])
+			_, composed := out[key]
+			why, isHeld := held[m]
+			want, wantHeld := row.held[m]
+			if isHeld != wantHeld || composed == wantHeld {
+				t.Errorf("%s: %s held %v (%q), composed %v; want held %v", row.name, m, isHeld, why, composed, wantHeld)
+			} else if isHeld && !strings.Contains(why, want) {
+				t.Errorf("%s: %s is held for %q, want its first reason, %q", row.name, m, why, want)
+			}
+		}
+	}
+}
diff --git a/internal/compose/frombus/states.go b/internal/compose/frombus/states.go
new file mode 100644
index 0000000..ca932f3
--- /dev/null
+++ b/internal/compose/frombus/states.go
@@ -0,0 +1,204 @@
+package frombus
+
+// **The bus read through a module's declared `reads`** (the lead, 2026-10-29: one reader in place of the copies in
+// mesh-provisioner and disk-load): a Reader over the states a module reads, by a runtime's Get and Keys (a bundle's
+// stdio.State, a process's own), for a holder that composes plans or data items and reads no value: placement, each
+// node's record in its own have key, the indexer's modules and manifests, the builder's builds and mesh-config's resolved
+// values. No own secret and no credential is read (compose.Planning). Pure as the rest of this package: a bundle's
+// runtime states and an HTTP fetch are compose/fromruntime's.
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// The states a module names in its manifest's `reads` to compose through StatesReader.
+const (
+	PlacementRead = delivery.PlacementRead
+	ModulesRead   = delivery.IndexerModule + ".modules"
+	ManifestsRead = delivery.IndexerModule + ".manifests"
+	BuildsRead    = delivery.BuilderModule + ".builds"
+	HaveRead      = "node-engine.have"
+	ResolvedRead  = "mesh-config.resolved"
+)
+
+// StatesReads are those reads, in a manifest's order.
+var StatesReads = []string{PlacementRead, ModulesRead, ManifestsRead, BuildsRead, HaveRead, ResolvedRead}
+
+// States is a module's read states as its runtime gives them: a key's value, false when it has none.
+type States interface {
+	Get(state, key string) (value []byte, found bool, err error)
+	Keys(state string) ([]string, error)
+}
+
+// Fetch reads an archive at a URL (fromruntime.HTTPFetch over HTTP).
+type Fetch func(ctx context.Context, url string) ([]byte, error)
+
+// StatesReader is the Reader over s; fetch reads a templates archive, nil for a holder that reads none.
+// It keeps what each build's take-in made, by the build's content (issue 1954), so a holder composing again and again
+// takes in only a build it has not seen.
+func StatesReader(s States, fetch Fetch) Reader {
+	return statesReader{s: s, fetch: fetch, kept: &keptTakeIns{}}
+}
+
+type statesReader struct {
+	s     States
+	fetch Fetch
+	kept  *keptTakeIns
+}
+
+func (r statesReader) takenIn(key string) ([]byte, bool) { return r.kept.takenIn(key) }
+
+func (r statesReader) keepTakenIn(key string, raw []byte) { r.kept.keepTakenIn(key, raw) }
+
+func (r statesReader) each(read string, visit func(key string, value []byte)) error {
+	keys, err := r.s.Keys(read)
+	if err != nil {
+		return fmt.Errorf("%s: %w", read, err)
+	}
+	for _, k := range keys {
+		v, found, err := r.s.Get(read, k)
+		if err != nil {
+			return fmt.Errorf("%s %s: %w", read, k, err)
+		}
+		if found {
+			visit(k, v)
+		}
+	}
+	return nil
+}
+
+func (r statesReader) Placements(context.Context) (map[string]delivery.Placement, error) {
+	keys := delivery.NewPlacementKeys()
+	err := r.each(PlacementRead, func(k string, v []byte) {
+		_, _ = keys.Put(k, v, 0, false) // a key that does not read places nothing, as before
+	})
+	return keys.All(), err
+}
+
+func (r statesReader) Records(context.Context) (map[string]delivery.NodeRecord, error) {
+	out := map[string]delivery.NodeRecord{}
+	err := r.each(HaveRead, func(k string, v []byte) {
+		if node, _, isNode, err := delivery.ParseHaveKey(k); err == nil && isNode {
+			if h, err := delivery.DecodeHaveNode(v); err == nil && h.Record != nil {
+				out[node] = *h.Record
+			}
+		}
+	})
+	return out, err
+}
+
+func (r statesReader) Modules(context.Context) (map[string]delivery.Module, error) {
+	out := map[string]delivery.Module{}
+	err := r.each(ModulesRead, func(k string, v []byte) {
+		if module, err := delivery.ParseModulesKey(k); err == nil {
+			if m, err := delivery.DecodeModule(v); err == nil {
+				out[module] = m
+			}
+		}
+	})
+	return out, err
+}
+
+func (r statesReader) Manifest(_ context.Context, digest string) ([]byte, error) {
+	key, err := delivery.ManifestsKey(digest)
+	if err != nil {
+		return nil, err
+	}
+	v, found, err := r.s.Get(ManifestsRead, key)
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, fmt.Errorf("the indexer holds no manifest %s", digest)
+	}
+	m, err := delivery.DecodeManifest(v)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(m.JSON), nil
+}
+
+func (r statesReader) Values(_ context.Context, node, module string) (map[string]any, error) {
+	var out map[string]any
+	prefix := node + "." + module + "."
+	err := r.each(ResolvedRead, func(k string, v []byte) {
+		name, ok := strings.CutPrefix(k, prefix)
+		if !ok || strings.Contains(name, ".") {
+			return
+		}
+		if value, laid := resolution.LaidValue(v); laid {
+			if out == nil {
+				out = map[string]any{}
+			}
+			out[name] = value
+		}
+	})
+	return out, err
+}
+
+func (statesReader) OwnSecrets(context.Context, string) ([]compose.OwnSecretRow, error) {
+	return nil, nil
+}
+
+func (statesReader) Credentials(context.Context, string, []compose.CredentialKey, []compose.CredentialKey) ([]compose.Credential, []compose.Issued, error) {
+	return nil, nil, nil
+}
+
+func (r statesReader) Build(_ context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+	key, err := delivery.BuilderBuildKey(module, fp)
+	if err != nil {
+		return nil, err
+	}
+	v, found, err := r.s.Get(BuildsRead, key)
+	if err != nil || !found {
+		return nil, err
+	}
+	b, err := delivery.DecodeBuilderBuild(v)
+	if err != nil {
+		return nil, err
+	}
+	return &b, nil
+}
+
+// archiveWithin bounds one read of a templates archive.
+const archiveWithin = 30 * time.Second
+
+func (r statesReader) Archive(ctx context.Context, url, digest string) ([]byte, error) {
+	if r.fetch == nil {
+		return nil, fmt.Errorf("this holder reads no archive (%s)", url)
+	}
+	fetching, cancel := context.WithTimeout(ctx, archiveWithin)
+	defer cancel()
+	body, err := r.fetch(fetching, url)
+	if err != nil {
+		return nil, err
+	}
+	sum := sha256.Sum256(body)
+	if got := hex.EncodeToString(sum[:]); got != strings.TrimPrefix(digest, "sha256:") {
+		return nil, fmt.Errorf("%s was recorded as %s and what arrived is %s", url, digest, got)
+	}
+	return body, nil
+}
+
+func (r statesReader) Served(ctx context.Context, node, module string, keys []string) (map[string]any, error) {
+	all, err := r.Values(ctx, node, module)
+	var out map[string]any
+	for _, k := range keys {
+		if v, ok := all[k]; ok {
+			if out == nil {
+				out = map[string]any{}
+			}
+			out[k] = v
+		}
+	}
+	return out, err
+}
diff --git a/internal/compose/frombus/testdata/catalogue-835bf22b-xterm.module.json b/internal/compose/frombus/testdata/catalogue-835bf22b-xterm.module.json
new file mode 100644
index 0000000..b65be8e
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-835bf22b-xterm.module.json
@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json b/internal/compose/frombus/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json
new file mode 100644
index 0000000..095128a
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-c05aa5e6-mesh-provisioner-client.module.json
@@ -0,0 +1,60 @@
+{
+  "module": "mesh-provisioner-client",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-provisioner",
+      "scope": "node"
+    }
+  ],
+  "own-secrets": {
+    "provisioner-broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-provisioner-client",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-provisioner-client",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-provisioner-client"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-provisioner-client",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "client",
+      "type": "process",
+      "name": "mesh-provisioner-client",
+      "artifact": "client",
+      "run": [
+        "./mesh-provisioner-client"
+      ],
+      "env": {
+        "MESH_PROVISIONER_CREDENTIAL": "${dir:state}/broker",
+        "MESH_PROVISIONER_STATE": "${dir:state}"
+      },
+      "user": "mesh-provisioner-client",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "client",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-provisioner-client",
+        "binary": "mesh-provisioner-client"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/backups.conf b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/backups.conf
new file mode 100644
index 0000000..2f23f90
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/backups.conf
@@ -0,0 +1,2 @@
+# What the modules on this machine back up, composed by the mesh (novox/hq to-be 43). Do not edit.
+${backup:lines}
\ No newline at end of file
diff --git a/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/data.conf b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/data.conf
new file mode 100644
index 0000000..f19e849
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/data.conf
@@ -0,0 +1,2 @@
+# The data the modules on this machine declare, composed by the mesh (novox/hq ADR 0233). Do not edit.
+${backup:data}
\ No newline at end of file
diff --git a/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/retention.conf b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/retention.conf
new file mode 100644
index 0000000..cd7954c
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.files/retention.conf
@@ -0,0 +1,6 @@
+# How many restore points the night keeps, written by the mesh from this machine's settings keep-daily,
+# keep-weekly, keep-monthly (novox/hq issue 416) and keep-hand-taken-days (novox/hq issue 453). Replaced on every push; change the settings, never this file.
+daily=${config:keep-daily}
+weekly=${config:keep-weekly}
+monthly=${config:keep-monthly}
+hand=${config:keep-hand-taken-days}
diff --git a/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.module.json b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.module.json
new file mode 100644
index 0000000..ea5ec8b
--- /dev/null
+++ b/internal/compose/frombus/testdata/catalogue-c05aa5e6-restic.module.json
@@ -0,0 +1,199 @@
+{
+  "module": "restic",
+  "version": "1",
+  "moved": true,
+  "claims": [
+    {
+      "name": "node-backup",
+      "scope": "node",
+      "serves": [
+        "backed-up",
+        "now",
+        "restore"
+      ]
+    }
+  ],
+  "emits": [
+    "backed-up"
+  ],
+  "tools": [
+    "backup_health",
+    "backup_delete_retired",
+    "backup_deleted"
+  ],
+  "own-secrets": {
+    "repository": "${dir:state}/repository.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "repository",
+        "path": "${dir:repository}",
+        "class": "rebuildable",
+        "backup": "none",
+        "why": "the restore points themselves: a copy of data kept elsewhere on this machine, never the only copy of anything; lost, the history goes and nothing live does"
+      },
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "cache",
+        "why": "what the last nights and measurements were; the next night writes it again"
+      }
+    ]
+  },
+    "config": {
+      "keep-daily": {
+        "type": "number",
+        "description": "How many nightly restore points are kept, a count from 1 to 9999: two weeks undo a mistake noticed within a fortnight. Read by the night, which thins nothing while it does not read (novox/hq issue 416); lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 14
+      },
+      "keep-weekly": {
+        "type": "number",
+        "description": "How many weekly restore points are kept behind the dailies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 8
+      },
+      "keep-monthly": {
+        "type": "number",
+        "description": "How many monthly restore points are kept behind the weeklies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 6
+      },
+      "keep-hand-taken-days": {
+        "type": "number",
+        "description": "How many days a restore point taken by hand (node-backup.now, or the mesh's before a module moves) is kept at least, a count from 1 to 9999; it is kept until a later good night of its module exists, and this many days in any case, so the next thinning never takes the one taken against a risky change (novox/hq issue 453). Lowering it lets go of the older ones taken by hand at the next thinning, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 7
+      }
+    },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "repository",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "declared",
+      "type": "file",
+      "path": "${dir:state}/backups.conf",
+      "mode": "0600",
+      "template": "files/backups.conf"
+    },
+    {
+      "id": "data-declared",
+      "type": "file",
+      "path": "${dir:state}/data.conf",
+      "mode": "0600",
+      "template": "files/data.conf"
+    },
+    {
+      "id": "retention",
+      "type": "file",
+      "path": "${dir:state}/retention.conf",
+      "mode": "0644",
+      "trusted": true,
+      "template": "files/retention.conf"
+    },
+    {
+      "id": "tool",
+      "type": "package",
+      "package": "restic"
+    },
+    {
+      "id": "sqlite",
+      "type": "package",
+      "package": "sqlite"
+    },
+    {
+      "id": "night",
+      "type": "process",
+      "name": "restic-night",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "night"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "tool",
+        "tool": "backup_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    },
+    {
+      "id": "measure",
+      "type": "process",
+      "name": "restic-measure",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "measure"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/restic-backups",
+        "binary": "restic-backups",
+        "loads": [
+          "restic-backups"
+        ],
+        "env": {
+          "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+          "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+          "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+          "MESH_BACKUP_STATE": "${dir:state}",
+          "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/testdata/de-spiegel-e25e1beb.module.json b/internal/compose/frombus/testdata/de-spiegel-e25e1beb.module.json
new file mode 100644
index 0000000..b4c4bd2
--- /dev/null
+++ b/internal/compose/frombus/testdata/de-spiegel-e25e1beb.module.json
@@ -0,0 +1,129 @@
+{
+  "module": "de-spiegel",
+  "version": "1",
+  "slug": "spiegel",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route",
+    "smtp"
+  ],
+  "contributes": {
+    "route": {
+      "site": {
+        "label": "de-spiegel",
+        "port": 35621
+      },
+      "praktijk": {
+        "name": "${config:praktijk-name}",
+        "port": 35621
+      },
+      "praktijk-www": {
+        "name": "${config:praktijk-www-name}",
+        "redirect": "https://${config:praktijk-name}"
+      },
+      "psychologie": {
+        "name": "${config:psychologie-name}",
+        "port": 35621
+      },
+      "psychologie-www": {
+        "name": "${config:psychologie-www-name}",
+        "redirect": "https://${config:psychologie-name}"
+      }
+    },
+    "smtp": {
+      "account": "de-spiegel"
+    }
+  },
+  "binds": {
+    "route": "/var/lib/de-spiegel/route.json",
+    "smtp": "/var/lib/de-spiegel/smtp.json"
+  },
+  "config": {
+    "praktijk-name": {
+      "type": "string",
+      "description": "The public name the practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
+      "trusted": true,
+      "required": true
+    },
+    "praktijk-www-name": {
+      "type": "string",
+      "description": "The public name that redirects to the practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
+      "trusted": true,
+      "required": true
+    },
+    "psychologie-name": {
+      "type": "string",
+      "description": "The public name the psychology practice's site is served on; the operator's, with no default (novox/hq ADR 0112).",
+      "trusted": true,
+      "required": true
+    },
+    "psychologie-www-name": {
+      "type": "string",
+      "description": "The public name that redirects to the psychology practice's site (its www form); the operator's, with no default (novox/hq ADR 0112).",
+      "trusted": true,
+      "required": true
+    }
+  },
+  "listens": [
+    {
+      "port": 35621,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the de-spiegel site and its /contact endpoint over http; the practice's three public names are route grants, and the proxy reaches every one of them here"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/de-spiegel",
+      "mode": "0700"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "/var/lib/de-spiegel/server.env",
+      "mode": "0600",
+      "content": "SMTP_HOST=${bound:smtp:at}\nSMTP_PORT=${bound:smtp:port}\nSMTP_AUTH_USER=de-spiegel@${bound:smtp:domain}\nSMTP_AUTH_PASS=${secret:smtp}\n"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "de-spiegel"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "de-spiegel",
+      "artifact": "site",
+      "network": "de-spiegel",
+      "env-file": [
+        "/var/lib/de-spiegel/server.env"
+      ],
+      "ports": [
+        "35621"
+      ],
+      "secrets-in-environment": "the application's own code reads SMTP_AUTH_USER/PASS from the environment (server/index.js); converting is this repository's change"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "NODE_BASE",
+        "image": "node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "site",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  },
+  "secrets": {
+    "smtp": "/var/lib/de-spiegel/smtp.secret"
+  }
+}
diff --git a/internal/compose/frombus/testdata/f1-circuits-c0ea2c94.module.json b/internal/compose/frombus/testdata/f1-circuits-c0ea2c94.module.json
new file mode 100644
index 0000000..8f2b612
--- /dev/null
+++ b/internal/compose/frombus/testdata/f1-circuits-c0ea2c94.module.json
@@ -0,0 +1,82 @@
+{
+  "module": "f1-circuits",
+  "slug": "f1",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "f1-circuits",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the track-layout CDN, the race posters and the Kometa metadata over http; its public name is a route grant and the proxy reaches it here. Kometa fetches the metadata and every poster by that public name"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "cache",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "site-env",
+      "type": "file",
+      "path": "${dir:state}/site.env",
+      "mode": "0644",
+      "content": "F1_CIRCUITS_BASE_URL=https://${bound:route:name}\n"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "f1-circuits",
+      "artifact": "cdn",
+      "ports": [
+        "8000"
+      ],
+      "env-file": [
+        "${dir:state}/site.env"
+      ],
+      "volumes": [
+        "${dir:cache}:/app/cache"
+      ],
+      "restart-on": [
+        "site-env"
+      ]
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "PYTHON_BASE",
+        "image": "python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "cdn",
+        "kind": "image",
+        "from": "service/Dockerfile"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/frombus/twice.go b/internal/compose/frombus/twice.go
new file mode 100644
index 0000000..cb133df
--- /dev/null
+++ b/internal/compose/frombus/twice.go
@@ -0,0 +1,147 @@
+package frombus
+
+// **A node's plans at two sets of builds, over one read** (issue 1954; novox/hq ADR 0570 clause 2, ADR 0580 clause 2):
+// the seat mesh-provisioner's holder composes each node at the builds its wants name and at the newest build of each
+// placed module. Both are composed from one read of the bus (placement, records, the indexer's modules and manifests,
+// values: base); only the builds the node's modules are composed from differ, each build read once for both, and a
+// build taken in once per content by a reader that keeps it (StatesReader). Where the time went is said by phase.
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// HeldPlans is one scope's plans, as PlansHeld answers them: err a refusal that is no single module's.
+type HeldPlans struct {
+	Plans map[string]catalogue.Plan
+	Held  map[string]string
+	Err   error
+}
+
+// Phase is one step of a composition and how long it took.
+type Phase struct {
+	Name string        `json:"phase"`
+	Took time.Duration `json:"took"`
+}
+
+// PlansHeldTwice is PlansHeld at s and at s with no kept builds (each placed module at its newest build), over one
+// read of the bus: what each answers is what PlansHeld answers for that scope. A read that fails is both scopes' err.
+// took names each phase in order: the read, then each scope's builds and its plans.
+func PlansHeldTwice(ctx context.Context, r Reader, mesh Mesh, s Scope) (at, newest HeldPlans, took []Phase) {
+	start := time.Now()
+	mark := func(name string) {
+		now := time.Now()
+		took = append(took, Phase{Name: name, Took: now.Sub(start)})
+		start = now
+	}
+	b, err := readBase(ctx, r, mesh, s)
+	mark("read")
+	builds := onceBuilds(r)
+	newestScope := s
+	newestScope.KeptAt = nil
+	for _, sc := range []struct {
+		scope Scope
+		into  *HeldPlans
+		name  string
+	}{{s, &at, "wanted"}, {newestScope, &newest, "newest"}} {
+		held := map[string]string{}
+		sc.into.Held = held
+		refuse := func(module string, err error) { held[module] = err.Error() }
+		b.refuseOwn(refuse)
+		if err != nil {
+			sc.into.Err = err
+			continue
+		}
+		in, err := b.finish(ctx, r, builds, mesh, sc.scope, b.cloned(), refuse, nil)
+		mark("builds at " + sc.name)
+		if err != nil {
+			sc.into.Err = err
+			continue
+		}
+		sc.into.Plans, sc.into.Err = plansHeldOf(in, s.Node, held)
+		mark("plans at " + sc.name)
+	}
+	return at, newest, took
+}
+
+// onceBuilds is r's Build, each module's build at a fingerprint read once: both scopes of one composition read the
+// builds of the same moment.
+func onceBuilds(r Reader) func(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+	type answer struct {
+		b   *delivery.BuilderBuild
+		err error
+	}
+	read := map[string]answer{}
+	return func(ctx context.Context, module, fp string) (*delivery.BuilderBuild, error) {
+		key := module + " " + fp
+		if a, ok := read[key]; ok {
+			return a.b, a.err
+		}
+		b, err := r.Build(ctx, module, fp)
+		read[key] = answer{b, err}
+		return b, err
+	}
+}
+
+// takenInKeeper is a Reader that keeps what a build's take-in made (StatesReader does): the resolved manifest's bytes,
+// by the content it was made from, so a composition made again on every change takes in only a build it has not seen.
+type takenInKeeper interface {
+	takenIn(key string) ([]byte, bool)
+	keepTakenIn(key string, raw []byte)
+}
+
+// takenInKey is what a take-in is made from: the artifact store's address and the build's record (its manifest's digest, its artifacts by digest), read
+// whole; an archive is checked against its digest on every read, so the same record takes in to the same bytes.
+func takenInKey(module, fp, address string, b delivery.BuilderBuild) (string, bool) {
+	raw, err := json.Marshal(b)
+	if err != nil {
+		return "", false
+	}
+	sum := sha256.Sum256(append([]byte(module+" "+fp+" "+address+" "), raw...))
+	return hex.EncodeToString(sum[:]), true
+}
+
+// takenInAtMost bounds the take-ins a reader keeps; past it they are emptied, which costs only a take-in again.
+const takenInAtMost = 512
+
+// keptTakeIns is a reader's kept take-ins.
+type keptTakeIns struct {
+	mu   sync.Mutex
+	kept map[string][]byte
+}
+
+func (k *keptTakeIns) takenIn(key string) ([]byte, bool) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	raw, ok := k.kept[key]
+	return raw, ok
+}
+
+func (k *keptTakeIns) keepTakenIn(key string, raw []byte) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	if k.kept == nil || len(k.kept) >= takenInAtMost {
+		k.kept = map[string][]byte{}
+	}
+	k.kept[key] = raw
+}
+
+// PhasesSaid says the phases in one line, each in milliseconds.
+func PhasesSaid(took []Phase) string {
+	out := ""
+	for i, p := range took {
+		if i > 0 {
+			out += ", "
+		}
+		out += fmt.Sprintf("%s %d ms", p.Name, p.Took.Milliseconds())
+	}
+	return out
+}
diff --git a/internal/compose/fromruntime/fromruntime.go b/internal/compose/fromruntime/fromruntime.go
new file mode 100644
index 0000000..b9fab99
--- /dev/null
+++ b/internal/compose/fromruntime/fromruntime.go
@@ -0,0 +1,101 @@
+// Package fromruntime is compose/frombus's StatesReader over a bundle's runtime (the lead, 2026-10-29): the states a
+// module's manifest names in `reads` (frombus.StatesReads), read through stdio.State, and a templates archive fetched
+// over HTTP. Apart from frombus so that frombus stays pure for the mesh-compose command.
+package fromruntime
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"sync"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+)
+
+// States are a bundle's read states through its runtime.
+type States struct{}
+
+// Get is a key's value, false when it has none.
+func (States) Get(state, key string) ([]byte, bool, error) {
+	e, err := stdio.State(state).Get(key)
+	if err != nil || e == nil {
+		return nil, false, err
+	}
+	return e.Value, true, nil
+}
+
+// Keys are a state's keys.
+func (States) Keys(state string) ([]string, error) { return stdio.State(state).Keys() }
+
+// Reader is frombus's Reader over this bundle's read states key by key, fetching archives over HTTP. A holder that
+// composes again and again reads through Watched instead (novox/hq ADR 0580).
+func Reader() frombus.Reader { return frombus.StatesReader(States{}, HTTPFetch) }
+
+// Watched is frombus's States over a watched copy (novox/hq ADR 0580 clause 1): the states a composition reads whole
+// (placement, haves, modules, resolved values) from the copy, a build by key when asked, a manifest once per digest.
+type Watched struct{ *stdio.WatchedStates }
+
+// Get is a key's value: a build read now, a manifest kept once read, any other state's from the copy.
+func (w Watched) Get(state, key string) ([]byte, bool, error) {
+	switch state {
+	case frombus.BuildsRead:
+		return w.Direct(state, key)
+	case frombus.ManifestsRead:
+		return w.Once(state, key)
+	}
+	return w.WatchedStates.Get(state, key)
+}
+
+// WatchedReader is frombus's Reader over w, fetching each templates archive over HTTP once (KeptFetch): a composition
+// made again on every change reads it again otherwise.
+func WatchedReader(w *stdio.WatchedStates) frombus.Reader {
+	return frombus.StatesReader(Watched{w}, KeptFetch(HTTPFetch))
+}
+
+// archivesAtMost bounds the archives KeptFetch keeps; past it they are emptied, which costs only a fetch again.
+const archivesAtMost = 64
+
+// KeptFetch is fetch kept once per URL: an archive's URL names its blob by digest, so its body never changes under it
+// (frombus checks the digest on every read). A failed fetch is not kept.
+func KeptFetch(fetch frombus.Fetch) frombus.Fetch {
+	var mu sync.Mutex
+	kept := map[string][]byte{}
+	return func(ctx context.Context, url string) ([]byte, error) {
+		mu.Lock()
+		body, ok := kept[url]
+		mu.Unlock()
+		if ok {
+			return body, nil
+		}
+		body, err := fetch(ctx, url)
+		if err != nil {
+			return nil, err
+		}
+		mu.Lock()
+		if len(kept) >= archivesAtMost {
+			clear(kept)
+		}
+		kept[url] = body
+		mu.Unlock()
+		return body, nil
+	}
+}
+
+// HTTPFetch reads an archive over HTTP, at most 256 MiB.
+func HTTPFetch(ctx context.Context, url string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s answered %s", url, resp.Status)
+	}
+	return io.ReadAll(io.LimitReader(resp.Body, 256<<20))
+}
diff --git a/internal/compose/input.go b/internal/compose/input.go
new file mode 100644
index 0000000..72aecf7
--- /dev/null
+++ b/internal/compose/input.go
@@ -0,0 +1,365 @@
+// Package compose is the controller's composition of a machine, as a function over a plain input (novox/hq ADR 0453
+// clause 3, ADR 0446 clause 4): what the rest of the mesh offers and holds, the private network's generator, one
+// node's resolution and, in the issues after, its rendering and its declaration.
+//
+// **It never allocates, makes, writes, logs or raises.** The controller composes with a store behind it; this
+// package is its Reading and Foreseeing modes over data. Everything the controller reads from its store is a field of
+// Input, and everything a send would make or record (a port, a credential, a seat passed on, a node left out) is
+// returned for the caller to act on, never done. Input is never changed by a call. No field holds a secret value
+// the composition needs: sealed values are optional inputs, and without them the composition uses stand-ins named
+// foreseen. The logic is the controller's, ported from mesh-controller cmd/mesh-controller at commit
+// 6c2a8d62100cb7d491f8eb9a623e1eeea5ec0de1 (plan.go, network.go, holdings.go, seat_pass.go), in the same order, with the
+// same refusals in the same words, so that a comparison node for node is a fair one.
+//
+// It imports the standard library and mesh-sdk's own packages only.
+// It reads no environment variable: the range the mesh allocates from and the suffix of its internal names are fields of Input.
+package compose
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Input is everything the composition reads. Each field is what one read of the controller's inventory answers, named
+// beside it; the controller's adapter fills it from its stores and the assigner from the mesh's facts and buckets
+// (ADR 0446 clause 2).
+type Input struct {
+	// Catalogue is the shelf: every module's manifest by name (inv.Catalogue), as it is to be composed. A recorded
+	// module kept at the build a machine runs (keepRecorded) is that node's Kept, applied to its own resolution only (never to the rest of the mesh).
+	Catalogue map[string]catalogue.Manifest
+	// Nodes is every node the mesh has (inv.Nodes and inv.Overlays together, one row per node).
+	Nodes []Node
+	// Holdings is every seat whose holder is on record (inv.Holdings).
+	Holdings []catalogue.Held
+	// Licences is every licence the mesh holds, with the machines that use it (open.Licences); none for a mesh with no
+	// licence.
+	Licences []Licence
+
+	// OverlayCIDR is the range the mesh allocates from when no tunnel was adopted, as genesis was told it (the
+	// controller's OverlayCIDRVar); empty means DefaultOverlayCIDR. The package reads no environment.
+	OverlayCIDR string
+	// InternalSuffix is what the mesh's internal names end in (the controller's MESH_INTERNAL_SUFFIX), with or without a leading
+	// dot; empty means overlay.DefaultSuffix. A fact of the whole mesh, so it is in the Input and never read from the environment.
+	InternalSuffix string
+	// Tunnels is, by node name, the found tunnel whose key is the node's overlay key (inv.Tunnels).
+	Tunnels map[string]FoundTunnel
+	// Adopted is the hub's found tunnel and the hub's name, whether or not the hub took it (inv.AdoptedTunnel); nil
+	// when no hub has one.
+	Adopted *AdoptedTunnel
+	// CarriedPeers is every peer of the adopted tunnel (inv.CarriedPeers).
+	CarriedPeers []CarriedPeer
+	// Joining is the nodes that hold a live enrolment token (inv.NodesWithALiveToken).
+	Joining []string
+
+	// Credentials is how each pair credential a node takes from elsewhere stands, never its value (what inv.SecretFor,
+	// SharedSecretFor and GivenPairSecret would answer): held, to be made by the next send, only a person's to give, or
+	// refused. A need with no entry here is one the next send would make.
+	Credentials []Credential
+
+	// Built is every repository the mesh has built (the keys of inv.Held): what tells a reference recorded with an address
+	// from an image a module runs straight from a public registry.
+	Built []string
+	// OperatorExport is every operator-sealed secret in the mesh, for a module that keeps them (inv.OperatorExport): sealed
+	// values the composition carries without opening. Nil when the mesh has no operator key.
+	OperatorExport *catalogue.KeptExport
+	// KeptRuns is, by node and module, the file of the export as that node runs it (its resource of a module's running
+	// composition): what a node composing its own carries where it holds no OperatorExport (catalogue.Rendering.KeptRuns,
+	// issue 1126, C6). Used only while OperatorExport is nil.
+	KeptRuns map[string]map[string]map[string]any
+
+	// Issued is the credentials made for the consumers of each provider (inv.SecretsFrom): one row for each pair credential
+	// that exists, by the provider node it is for. The grants a provider must create are read from these, so a credential not
+	// made yet has no grant until the send that makes it. An assigner fills it from the facts snapshot's Grants of each
+	// machine (go/facts, from format 2), which carry who each credential is for and never the credential.
+	Issued []Issued
+	// OwnSecrets is the own secrets held on each machine (the module_secret rows): who made each, and the key it is sealed to.
+	// Their sealed values are optional.
+	OwnSecrets []OwnSecretRow
+	// KeptCoreBoxes is the vault's box last kept for each core credential on each machine (inv.KeptCoreBoxes).
+	KeptCoreBoxes []CoreBox
+	// BusUsers is the bus's user list as the controller composes it from the bus records and the hashes it holds (composeBusUsers),
+	// for the machine that runs the bus: names and hashes, never passwords. Empty when the Input does not carry it, and then
+	// the composition uses a stand-in, named foreseen. BusMissing are the users left out of it for want of a credential.
+	BusUsers   string
+	BusMissing []string
+	// BusMinted are the bus users the mesh has minted a password hash for (inv.BusUserHash): `<node>.<module>` for a module and
+	// `provisioner.<node>` for a machine's provisioner client.
+	BusMinted []string
+	// BusMemberships is, by node, the membership sealed to it for the bus the mesh is moving to (inv.BusMemberships).
+	BusMemberships map[string]string
+	// Authority is the mesh's own certificate (identity.EstablishAuthority), public. Optional.
+	Authority string
+
+	// CurrentBuilds is, by module, the commit of the build the mesh holds for it (inv.CurrentBuilds, the commit it was built from);
+	// BuildIDs the build made from a commit of a module (inv.BuildOf), by module then commit. Read only to name the builds a
+	// declaration carries to a node-engine that reads them.
+	CurrentBuilds map[string]string
+	BuildIDs      map[string]map[string]string
+
+	// Refused is each module whose manifest the indexer's judge refused, or whose bytes do not decode, by module, with why
+	// (novox/hq ADR 0578 §3, §5): its verdict, carried in the plain input. Such a module stands in Catalogue as its stub
+	// (compose.Stub), so it is held: nothing of its own is composed, while what it provides and requires still shapes the
+	// rest. A module not named is accepted, a missing verdict included.
+	Refused map[string]string `json:",omitempty"`
+	// SetAside is each module whose manifest has a field the reader's decoder does not know, by module, with what was set
+	// aside (catalogue.Manifest.SetAside): the rest of it is composed, and the reader names it (ADR 0578 §6).
+	SetAside map[string]string `json:",omitempty"`
+}
+
+// Issued is one pair credential made for a consumer of a provider (inv.Secret): ForProvider is its copy sealed to the
+// provider, optional.
+type Issued struct {
+	Provision      string
+	Consumer       string
+	ConsumerModule string
+	Local          string
+	Provider       string
+	ForProvider    string
+}
+
+// OwnSecretRow is one own secret held on a machine: Origin is `made` (the mesh generated it) or `accepted` (a person gave it),
+// SealedTo the sealing key it is sealed to, and Sealed its value sealed to that key, optional.
+type OwnSecretRow struct {
+	Node     string
+	Module   string
+	Name     string
+	Origin   string
+	SealedTo string
+	Sealed   string
+}
+
+// CoreBox is the vault's box for one core credential of one machine, as last kept (inv.CoreBox).
+type CoreBox struct {
+	Node       string
+	Module     string
+	Name       string
+	Generation int
+	SealedTo   string
+	Box        json.RawMessage
+}
+
+// Node is one node of the mesh and what the composition reads about it.
+type Node struct {
+	Name string
+	// Place is where it is on the private network (inv.Overlays).
+	Place Place
+	// Assigned is the modules assigned to it, in the order the controller reads them (inv.Assigned).
+	Assigned []string
+	// Handed is, by module, whether the vault judged it handed to the provisioner when it answered this node's own
+	// secrets (catalogue.AssignmentHands of the plan in its assignment): the node's own composition hands exactly those
+	// (catalogue.Rendering.Assigned, issue 774). Nil where the vault said nothing of it, as for the controller.
+	Handed map[string]bool
+	// Capabilities are the ones present on it (inv.ProfileOf).
+	Capabilities map[string]bool
+	// PublicDomain is the domain it composes its routed names under (inv.PublicDomainOf).
+	PublicDomain string
+	// Account, AccountHome, AgentAccount and AgentAccountHome are its operator and agent logins (inv.NodeByName).
+	Account, AccountHome, AgentAccount, AgentAccountHome string
+	// Adopted is whether it is adopted rather than converged.
+	Adopted bool
+	// Pins is the provider each provision was pinned to for it (inv.PinsFor).
+	Pins map[string]catalogue.Chosen
+	// Bound is where each of its consumers of a provision that keeps data was last sent (inv.BindingsFor), by consumer
+	// module and provision. An assigner fills it from the facts snapshot's Bindings of the machine (go/facts, from format 2).
+	Bound map[string]map[string]catalogue.Chosen
+	// Settings is its settings layers by module (inv.SettingsFor); a module with none is absent.
+	Settings map[string][]catalogue.Layer
+	// Ports is the machine port each module's software port was given on it (inv.PortsFor), by module then port.
+	Ports map[string]map[int]int
+	// SealingKey is the public key its secrets are sealed to (inv.SealingKeyOf); empty when it has none. A public key, so
+	// nothing secret.
+	SealingKey string
+	// Taken is the modules taken on it, for an adopted node (inv.Taken).
+	Taken []string
+	// OutwardLinks are the links it reported as facing outside it (inv.OutwardLinksOf).
+	OutwardLinks []string
+	// Networks are the networks it reported being attached to, as link and network (inv.MachineOf); NetworksSaid is whether
+	// its node-engine said any at all, which is not the same as saying none.
+	Networks     []catalogue.AttachedNetwork
+	NetworksSaid bool
+	// ServingKey is the key the machine serves with, which a certificate is issued for (identity.ServingKeyOf); empty when it has
+	// never reported one. Certificate is the certificate the mesh issued for its internal name, public and optional.
+	ServingKey  string
+	Certificate string
+	// Sequence, Epoch and Generation are what the declaration is sent under (inv.Sequence, SentEpoch, SentGeneration): the order
+	// against every other send to the node, the lease epoch and the assignment generation it was last sent. Zero is not sent.
+	Sequence   int64
+	Epoch      uint64
+	Generation int64
+	// ReadsModules says its node-engine reads a module per resource and a build per module (inv.ReadsModules, issue 1145); only
+	// then are they sent. SentBuilds is the build of each module it was last sent, by module to commit, and SentKnown whether
+	// that is known at all (inv.SentBuilds); Runs is what each of its assignments runs (inv.AssignmentRuns), by module.
+	ReadsModules bool
+	SentBuilds   map[string]string
+	SentKnown    bool
+	Runs         map[string]Run
+	// Kept is, by module, the manifest of a recorded or core module kept at the build this machine runs (plan.go keepRecorded:
+	// the caller reads it with recordedKept and ManifestAt), and KeptBuilds the commit of that build. They apply to this node's
+	// own resolution only, never to another node's, and a declaration carries the kept commit for the module.
+	Kept       map[string]catalogue.Manifest
+	KeptBuilds map[string]string
+	// Contract is the contract of its node-engine's newest statement (inv.HealthOf); Stated is whether it ever stated one.
+	Contract int
+	Stated   bool
+	// InOwn is the modules it runs inside its own composition (`<node>.node`), not by a composition of their own, since
+	// no fingerprint of the new form names them where it runs them (novox/hq issue 1126): Compositions folds their
+	// resources into the node's own, as the controller's composed writer does, unless fps gives one of the new form.
+	// The private network's module (overlay.Name), which nobody builds, is folded whether or not it is named here.
+	InOwn map[string]bool
+	// RunsOwn is the node's own composition (`<node>.node`) as it runs, when the node composes itself: a module folded
+	// there (InOwn) whose manifest names a build (NamesBuild) runs a build of the old form only the controller holds,
+	// so it is left to the node: Compositions composes it as a stub (Stub) and carries its resources as they run, each
+	// after the resource it runs after (issue 1126). Nil composes every folded module from its manifest, as before.
+	RunsOwn *delivery.Composed
+	// Held is the modules refused alone on this node, each composed as what runs of it (Carried, in Kept; its Stub when
+	// nothing of it runs) so the rest is composed (novox/hq issue 1126): none of a held module's own composition is in what
+	// Compositions answers, so the node keeps what it last applied of it; one whose resources the node's own runs
+	// (RunsOwn), folded or leaving the fold, is carried there as it runs, whatever its manifest names, so the node's own
+	// never drops it.
+	Held map[string]bool
+	// RunsTools is, by module, the tools bundles the node's runtime serves of it as it runs (ToolsRunning of what the
+	// node runs); nil when not known. A module composed as what runs of it (its Stub or Carried: held, or folded at a
+	// build of the old form) contributes these to the runtime, never its manifest's: a manifest no build resolved has no
+	// bundles, and a held module's new build's bundles are not delivered (issue 1126, 2026-10-29: shanks's runtime lost
+	// the folded systemd-resolved, novox's the folded nats).
+	RunsTools map[string][]catalogue.Bundle
+}
+
+// Place is where a node is, as its placement says (inv.Overlay).
+type Place struct {
+	Key      string
+	Endpoint string
+	Site     string
+	Hub      bool
+	Address  string
+}
+
+// Reachable says whether the node can be dialled.
+func (p Place) Reachable() bool { return strings.TrimSpace(p.Endpoint) != "" }
+
+// Tunnel is a tunnel found on a node (inv.Tunnel).
+type Tunnel struct {
+	Interface string
+	Unit      string
+	Config    string
+	Port      int
+	MTU       int
+	// Address is the interface's own address with its prefix length, Range the network that prefix names.
+	Address   string
+	Range     string
+	PublicKey string
+	Peers     []TunnelPeer
+}
+
+// TunnelPeer is one peer of a found tunnel.
+type TunnelPeer struct {
+	PublicKey string
+	Address   string
+}
+
+// FoundTunnel is a node's tunnel and whether the node is adopted (inv.FoundTunnel).
+type FoundTunnel struct {
+	Tunnel
+	NodeAdopted bool
+}
+
+// AdoptedTunnel is the hub's tunnel, the hub's name, and whether the hub's overlay key is the tunnel's, which is
+// whether the private network took the tunnel over.
+type AdoptedTunnel struct {
+	Tunnel  Tunnel
+	Hub     string
+	Adopted bool
+}
+
+// CarriedPeer is a peer of the adopted tunnel (inv.CarriedPeer).
+type CarriedPeer struct {
+	PublicKey  string
+	Address    string
+	EnrolledAs string
+	Named      string
+}
+
+// Licence is one licence the mesh holds: its name, what a consumer may know of it, and the machines and modules
+// that use it.
+type Licence struct {
+	Name    string
+	Serves  map[string]any
+	Holders []Holder
+	// Keys is, by holder, the licence's key sealed to that holder's machine (held.KeyFor), empty where the mesh holds none:
+	// the plaintext was discarded when it was supplied. Optional: nil means not given, and the composition uses a stand-in named
+	// foreseen; given (even empty), a holder with no entry is one the mesh holds no key for.
+	Keys map[Holder]string
+	// Manager is the holder of a refreshable-grant licence that manages it (held.ManagerOf); the zero Holder when none.
+	Manager Holder
+}
+
+// Holder is a module on a node that uses a licence.
+type Holder struct {
+	Node   string
+	Module string
+}
+
+// ErrNoSuchNode is what the controller's inventory answers for a node it does not have.
+var ErrNoSuchNode = errors.New("no node of that name")
+
+// node is the node of that name, or the refusal the controller's inventory gives for one it does not have.
+func (in Input) node(name string) (Node, error) {
+	for _, n := range in.Nodes {
+		if n.Name == name {
+			return n, nil
+		}
+	}
+	return Node{}, fmt.Errorf("%w: %s", ErrNoSuchNode, name)
+}
+
+// sorted is the nodes by name, the order the controller reads them in.
+func (in Input) sorted() []Node {
+	out := append([]Node(nil), in.Nodes...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Name < out[j].Name })
+	return out
+}
+
+// CredentialState is how one pair credential stands.
+type CredentialState string
+
+const (
+	// CredentialHeld is a credential held for both ends as they stand now. Sealed, when given, is the consumer's copy; a held
+	// credential with no value is composed with a stand-in, named foreseen.
+	CredentialHeld CredentialState = "held"
+	// CredentialWouldMake is a credential none is held for: the next send makes it, and the composition uses a stand-in,
+	// named foreseen. It is also what a need with no entry is.
+	CredentialWouldMake CredentialState = "would-make"
+	// CredentialNotGiven is a credential only a person gives (novox/hq ADR 0337 clause 4) that nobody has given, or that was given
+	// under a key one end no longer has: the consumer still resolves, without it. Why is the controller's words for it.
+	CredentialNotGiven CredentialState = "not-given"
+	// CredentialRefused is a credential the send would refuse to make, for the reason Why gives in the controller's words: a
+	// value a person gave sealed to a key the machine no longer has, a machine with no sealing key.
+	CredentialRefused CredentialState = "refused"
+)
+
+// Credential is the state of one pair credential, by the ends it joins: the provision, the consumer's node and module, the
+// provider's node, and the local name where a module keeps several (inv.Secret's key).
+type Credential struct {
+	Provision      string
+	Consumer       string
+	ConsumerModule string
+	Provider       string
+	Local          string
+	State          CredentialState
+	// Sealed is the consumer's copy as it is sealed to the consumer's key; optional, and only the controller's adapter passes it.
+	Sealed string
+	// Why is the words of a CredentialNotGiven or CredentialRefused.
+	Why string
+}
+
+// Run is the build an assignment names: the commit it is of and the build made from it (chain.Ref).
+type Run struct {
+	Commit string
+	Build  string
+}
diff --git a/internal/compose/network.go b/internal/compose/network.go
new file mode 100644
index 0000000..4e11abf
--- /dev/null
+++ b/internal/compose/network.go
@@ -0,0 +1,308 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// The private network: who is on it, where, and what they are called. Ported from mesh-controller
+// cmd/mesh-controller/network.go at 6c2a8d62.
+
+// DefaultOverlayCIDR is the range the mesh allocates from when nothing says another.
+const DefaultOverlayCIDR = "10.42.0.0/16"
+
+// composer is one composition over an Input: it reads Input, changes nothing in it, and keeps what the controller
+// said on its standard error as lines to return.
+type composer struct {
+	in   Input
+	said []string
+	seen map[string]bool
+	// unhostable is, from the last look at the rest of the mesh, each module assigned to another node that this
+	// composition finds that node cannot run: what it would have offered is missing here (issue 1126, probe #532).
+	unhostable []string
+
+	// What one composition looks at again and again, each worked out once over its Input, which it never changes (issue
+	// 1954: a node's plans resolved every machine of the mesh some two hundred times, 11.7 s of CPU for novox): who is
+	// on the private network, and the rest of the mesh as each node sees it.
+	onNetwork    []Node
+	onNetworkSet bool
+	rest         map[string]restOf
+	plans        map[string]planOf
+}
+
+// restOf is theRestOfTheMesh's answer for one excluded node, kept: what it found unhostable beside it.
+type restOf struct {
+	world      catalogue.World
+	passes     Passes
+	left       []LeftOut
+	unhostable []string
+	err        error
+}
+
+func newComposer(in Input) *composer { return &composer{in: in, seen: map[string]bool{}} }
+
+// say keeps a line the controller would have written to its log, once.
+func (c *composer) say(format string, args ...any) {
+	line := fmt.Sprintf(format, args...)
+	if c.seen[line] {
+		return
+	}
+	c.seen[line] = true
+	c.said = append(c.said, line)
+}
+
+// suffix is what the mesh's internal names end in: the Input's, and overlay.DefaultSuffix when it gives none. The package never calls
+// overlay.Suffix or overlay.InternalName, which read the environment, so the assigner and the controller compose the same names
+// from the same Input.
+func (c *composer) suffix() string {
+	if v := strings.TrimPrefix(strings.TrimSpace(c.in.InternalSuffix), "."); v != "" {
+		return v
+	}
+	return overlay.DefaultSuffix
+}
+
+// internalName is a node's name inside the mesh.
+func (c *composer) internalName(node string) string { return node + "." + c.suffix() }
+
+// saidBeside is the lines already said and then every line the composer kept, once each, in the order they were found.
+func (c *composer) saidBeside(lines []string) []string {
+	for _, l := range c.said {
+		if !slices.Contains(lines, l) {
+			lines = append(lines, l)
+		}
+	}
+	return lines
+}
+
+// overlayRange is the range the mesh allocates node addresses from: the adopted tunnel's first (novox/hq ADR 0105),
+// then the range genesis was told, then the default.
+func (c *composer) overlayRange() string {
+	if a := c.in.Adopted; a != nil && a.Adopted {
+		return a.Tunnel.Range
+	}
+	if v := strings.TrimSpace(c.in.OverlayCIDR); v != "" {
+		return v
+	}
+	return DefaultOverlayCIDR
+}
+
+// network builds the private network over the machines that resolved the module for it. A machine is on it because it
+// was given the module, or because it is joining with a key and an address (novox/hq ADR 0169), or because its own set
+// could not be resolved and it holds a place (a key and an address): that place is its last good one on the network, and
+// it does not change because its modules failed, so every other machine keeps its path to it -- the hub above all -- and
+// only its own declaration is refused (issue 1833). A machine refused with no place is left off.
+func (c *composer) network(on map[string]bool, refused map[string]string) (*overlay.Generator, error) {
+	tunnels := c.in.Tunnels
+	carried := c.in.CarriedPeers
+	isJoining := map[string]bool{}
+	for _, name := range c.in.Joining {
+		isJoining[name] = true
+	}
+	var nodes []overlay.Node
+	for _, node := range c.in.sorted() {
+		p := node.Place
+		placed := p.Key != "" && p.Address != ""
+		_, wasRefused := refused[node.Name]
+		if !on[node.Name] && !((isJoining[node.Name] || wasRefused) && placed) {
+			continue
+		}
+		if !on[node.Name] && wasRefused && !isJoining[node.Name] {
+			c.say("%s could not be resolved and keeps its place on the private network at %s, so the others keep their path to it",
+				node.Name, p.Address)
+		}
+		n := overlay.Node{
+			Name: node.Name, Key: p.Key, Endpoint: p.Endpoint,
+			Site: p.Site, Hub: p.Hub, Address: p.Address,
+		}
+		if t, takes := tunnels[node.Name]; takes && t.NodeAdopted {
+			// Only an adopted node is told to take the found unit over. A hub whose placement disagrees with the tunnel is
+			// refused, not composed.
+			if wrong := disagrees(p, t.Tunnel); wrong != "" {
+				return nil, fmt.Errorf("%s takes over the tunnel on %s and its placement disagrees with it: %s. "+
+					"Re-place it — `overlay place %s --hub --endpoint <host>:%d …` — and push again; "+
+					"nothing was composed", node.Name, t.Interface, wrong, node.Name, t.Port)
+			}
+			n.TakesOver = &overlay.TakeOver{Interface: t.Interface, Unit: t.Unit, Config: t.Config, Port: t.Port, MTU: t.MTU}
+		}
+		if p.Hub {
+			for _, cp := range carried {
+				n.Carried = append(n.Carried, overlay.Carried{Key: cp.PublicKey, Address: cp.Address})
+			}
+		}
+		nodes = append(nodes, n)
+	}
+	if len(nodes) == 0 {
+		// Nobody was given it: an empty network is a legitimate mesh, not a broken one.
+		return overlay.Empty(), nil
+	}
+	g, err := overlay.From(nodes, c.overlayRange(), "")
+	if err != nil && len(refused) > 0 {
+		// The network is missing something, and some machines could not be resolved at all: almost always the same fact.
+		var who []string
+		for name, why := range refused {
+			who = append(who, fmt.Sprintf("  %s: %s", name, why))
+		}
+		sort.Strings(who)
+		return nil, fmt.Errorf("%w\n\nand %d node(s) could not be resolved at all, which is "+
+			"probably why:\n%s", err, len(refused), strings.Join(who, "\n"))
+	}
+	return g, err
+}
+
+// Graph is the whole mesh's network, for showing it: the nodes on it and each one's peers.
+func Graph(in Input) ([]overlay.Node, overlay.Graph, error) {
+	c := newComposer(in)
+	on, refused, err := c.whoResolves(overlay.Requirement)
+	if err != nil {
+		return nil, nil, err
+	}
+	g, err := c.network(on, refused)
+	if err != nil {
+		return nil, nil, err
+	}
+	return g.Nodes(), g.Graph(), nil
+}
+
+// whoResolves is the machines whose resolution answers a requirement, and why the others did not: by what a module
+// provides, not by its name, resolved rather than read from the assignments.
+func (c *composer) whoResolves(requirement string) (map[string]bool, map[string]string, error) {
+	on := map[string]bool{}
+	// Why a node could not be resolved, kept rather than raised: one broken node must not stop the rest being described.
+	refused := map[string]string{}
+	for _, n := range c.in.sorted() {
+		resolved, err := c.planFor(n.Name)
+		switch {
+		case unresolvable(err):
+			refused[n.Name] = err.Error()
+			continue
+		case err != nil:
+			// Not a node that does not resolve: a question that went unanswered.
+			return nil, nil, fmt.Errorf("whether %s answers %q cannot be read: %w", n.Name, requirement, err)
+		}
+		for _, m := range resolved.Plan.Modules {
+			for _, offered := range m.Offers() {
+				if offered == requirement {
+					on[n.Name] = true
+				}
+			}
+		}
+	}
+	return on, refused, nil
+}
+
+// Generators is what every node's declaration is composed with, over the whole mesh: the private network's generator
+// (one generator now; the names and a resolver's zone file are facts a module asks for in its manifest).
+func Generators(in Input) (map[string]catalogue.Generator, error) {
+	c := newComposer(in)
+	return c.generators()
+}
+
+func (c *composer) generators() (map[string]catalogue.Generator, error) {
+	on, refused, err := c.whoResolves(overlay.Addressing)
+	if err != nil {
+		return nil, err
+	}
+	net, err := c.network(on, refused)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]catalogue.Generator{overlay.Name: net}, nil
+}
+
+// disagrees says how a node's placement differs from the tunnel it takes over — its address not the tunnel's, its
+// endpoint not on the tunnel's port — or nothing when both agree.
+func disagrees(p Place, t Tunnel) string {
+	var wrong []string
+	want := t.Address
+	if i := strings.Index(want, "/"); i >= 0 {
+		want = want[:i]
+	}
+	if p.Address != want {
+		wrong = append(wrong, fmt.Sprintf("its address is %s and the tunnel's is %s", orNothing(p.Address), want))
+	}
+	if p.Reachable() && portOfEndpoint(p.Endpoint) != strconv.Itoa(t.Port) {
+		wrong = append(wrong, fmt.Sprintf("its endpoint %s is not on the tunnel's port %d", p.Endpoint, t.Port))
+	}
+	return strings.Join(wrong, "; ")
+}
+
+func orNothing(s string) string {
+	if s == "" {
+		return "unset"
+	}
+	return s
+}
+
+// portOfEndpoint is the port in host:port, or empty.
+func portOfEndpoint(endpoint string) string {
+	if i := strings.LastIndex(endpoint, ":"); i >= 0 {
+		return endpoint[i+1:]
+	}
+	return ""
+}
+
+// whereEveryoneIs is each machine's name on the private network, for the ones on it. Resolved without consulting the
+// rest of the mesh (it is called from that path), and refused without the catalogue.
+func (c *composer) whereEveryoneIs() (map[string]string, error) {
+	if c.in.Catalogue == nil {
+		return nil, errors.New("asked where everyone is without the catalogue, which cannot be answered")
+	}
+	out := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		out[p.Name] = c.internalName(p.Name)
+	}
+	return out, nil
+}
+
+// onTheNetwork is every placed machine that resolves the private network: has an address AND runs what puts it there
+// (novox/hq issue 079). A machine that does not resolve keeps its place when it holds one (a key and an address), by the
+// same rule as network(), so its name and its address stay where the tunnel to it does (issue 1833); one without is not
+// counted, and said.
+func (c *composer) onTheNetwork() []Node {
+	if !c.onNetworkSet {
+		c.onNetwork, c.onNetworkSet = c.onTheNetworkNow(), true
+	}
+	return slices.Clone(c.onNetwork)
+}
+
+// onTheNetworkNow is onTheNetwork worked out: every placed machine's set resolved.
+func (c *composer) onTheNetworkNow() []Node {
+	var out []Node
+	for _, n := range c.in.sorted() {
+		if n.Place.Address == "" {
+			continue
+		}
+		if len(n.Assigned) == 0 {
+			continue
+		}
+		got, err := resolution.Resolve(c.in.Catalogue, n.Assigned,
+			catalogue.Node{Name: n.Name, Site: n.Place.Site, Capabilities: n.Capabilities},
+			catalogue.World{Unchecked: true, Holdings: c.in.Holdings})
+		if err != nil {
+			if n.Place.Key != "" {
+				c.say("%s could not be resolved and keeps its place on the private network at %s, so the others keep their path to it",
+					n.Name, n.Place.Address)
+				out = append(out, n)
+				continue
+			}
+			c.say("%s is not counted as on the network: it does not resolve: %v", n.Name, err)
+			continue
+		}
+		for _, m := range got.Modules {
+			for _, offered := range m.Offers() {
+				if offered == overlay.Requirement {
+					out = append(out, n)
+				}
+			}
+		}
+	}
+	return out
+}
diff --git a/internal/compose/network_test.go b/internal/compose/network_test.go
new file mode 100644
index 0000000..2f924f9
--- /dev/null
+++ b/internal/compose/network_test.go
@@ -0,0 +1,306 @@
+package compose
+
+import (
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// onTheTunnel makes the hub of an Input what mesh-controller's network_test.go makes of anchor in
+// TestTheOverlaysRangeIsTheAdoptedTunnels: adopted, enrolled with the found tunnel's key, and presenting the tunnel
+// (Tunnel{wg0, wg-quick@wg0, port 51900, 192.0.2.1/24, range 192.0.2.0/24, one peer PEER-TWO}). Placed on it when
+// replaced is true: its address the tunnel's, its endpoint on the tunnel's port, as `overlay place anchor --endpoint
+// 198.51.100.10:51900 --site hosting --hub` leaves it.
+func onTheTunnel(t *testing.T, in *Input, replaced bool) {
+	t.Helper()
+	const key = "THE-TUNNELS-KEY========================="
+	tunnel := Tunnel{Interface: "wg0", Unit: "wg-quick@wg0", Config: "/etc/wireguard/wg0.conf", Port: 51900,
+		Address: "192.0.2.1/24", Range: "192.0.2.0/24", PublicKey: key,
+		Peers: []TunnelPeer{{PublicKey: "PEER-TWO", Address: "192.0.2.2"}}}
+	hub := nodeOf(t, in, "anchor")
+	hub.Adopted = true
+	hub.Place.Key = key
+	if replaced {
+		hub.Place.Address, hub.Place.Endpoint, hub.Place.Site = "192.0.2.1", "198.51.100.10:51900", "hosting"
+	}
+	in.Tunnels = map[string]FoundTunnel{"anchor": {Tunnel: tunnel, NodeAdopted: true}}
+	in.Adopted = &AdoptedTunnel{Tunnel: tunnel, Hub: "anchor", Adopted: true}
+	in.CarriedPeers = []CarriedPeer{{PublicKey: "PEER-TWO", Address: "192.0.2.2"}}
+}
+
+// novox/hq ADR 0105 (mesh-controller network_test.go TestTheOverlaysRangeIsTheAdoptedTunnels): the range every address is
+// composed from is the adopted tunnel's, read from the tunnel the hub holds, never stored anywhere else. The environment
+// value of the controller is Input.OverlayCIDR here.
+func TestTheOverlaysRangeIsTheAdoptedTunnels(t *testing.T) {
+	in := aMesh(t)
+	in.OverlayCIDR = "10.99.0.0/16"
+	if got := newComposer(in).overlayRange(); got != "10.99.0.0/16" {
+		t.Fatalf("without an adopted tunnel the range is not what genesis said: %q", got)
+	}
+	in.OverlayCIDR = ""
+	if got := newComposer(in).overlayRange(); got != DefaultOverlayCIDR {
+		t.Fatalf("with nothing said the range is %q, not the default", got)
+	}
+	in.OverlayCIDR = "10.99.0.0/16"
+	onTheTunnel(t, &in, true)
+	if got := newComposer(in).overlayRange(); got != "192.0.2.0/24" {
+		t.Fatalf("with an adopted tunnel the range is %q, not the tunnel's", got)
+	}
+	// A tunnel the hub found and did not take (its key is not the tunnel's) does not give its range.
+	in.Adopted.Adopted = false
+	if got := newComposer(in).overlayRange(); got != "10.99.0.0/16" {
+		t.Fatalf("a tunnel the hub did not take gave its range: %q", got)
+	}
+	in.Adopted.Adopted = true
+
+	// And the hub's declaration carries the peer and the takeover.
+	nodes, computed, err := Graph(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var hubNode overlay.Node
+	for _, n := range nodes {
+		if n.Name == "anchor" {
+			hubNode = n
+		}
+	}
+	if hubNode.TakesOver == nil || hubNode.TakesOver.Unit != "wg-quick@wg0" {
+		t.Errorf("the hub is not told to take over the found tunnel: %+v", hubNode)
+	}
+	carried := false
+	for _, p := range computed["anchor"] {
+		if p.Key == "PEER-TWO" && p.Allowed == "192.0.2.2/32" {
+			carried = true
+		}
+	}
+	if !carried {
+		t.Errorf("the hub's peer list does not carry the tunnel's peer: %+v", computed["anchor"])
+	}
+}
+
+// A takeover is composed only for a hub whose placement agrees with the tunnel (mesh-controller network_test.go
+// TestATakeoverIsNotComposedForAHubPlacedOffItsTunnel): an address or an endpoint port that differs would have the host stop
+// the found interface and raise the mesh's where no peer is listening.
+func TestATakeoverIsNotComposedForAHubPlacedOffItsTunnel(t *testing.T) {
+	in := aMesh(t)
+	onTheTunnel(t, &in, false)
+	// aMesh placed anchor at 10.77.0.1 on :51820, the record of a hub placed before it took the tunnel over.
+	_, _, err := Graph(in)
+	if err == nil {
+		t.Fatal("a takeover was composed for a hub whose address and port are not the tunnel's")
+	}
+	for _, want := range []string{"10.77.0.1", "192.0.2.1", "51820", "51900", "overlay place anchor"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not say %q: %v", want, err)
+		}
+	}
+	// Re-placed on the tunnel, it composes.
+	onTheTunnel(t, &in, true)
+	if _, _, err := Graph(in); err != nil {
+		t.Fatalf("re-placed on the tunnel, the graph still refuses: %v", err)
+	}
+}
+
+// 1360/AC2: the generator gives the addresses, peers and names of aMesh: anchor the hub at 10.77.0.1, laptop at 10.77.0.2
+// peering through it, both written for their machines.
+func TestTheGeneratorGivesTheMeshItsAddressesAndPeers(t *testing.T) {
+	in := aMesh(t)
+	gens, err := Generators(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g, ok := gens[overlay.Name].(*overlay.Generator)
+	if !ok {
+		t.Fatalf("the generator is %T", gens[overlay.Name])
+	}
+	addr := map[string]string{}
+	for _, n := range g.Nodes() {
+		addr[n.Name] = n.Address
+	}
+	if addr["anchor"] != "10.77.0.1" || addr["laptop"] != "10.77.0.2" || len(addr) != 2 {
+		t.Fatalf("the addresses are %v", addr)
+	}
+	peers := g.Graph()
+	if len(peers["laptop"]) != 1 || peers["laptop"][0].Name != "anchor" || peers["laptop"][0].Endpoint != "anchor.example:51820" {
+		t.Errorf("laptop's peers are %+v, want the hub", peers["laptop"])
+	}
+	if len(peers["anchor"]) != 1 || peers["anchor"][0].Name != "laptop" || peers["anchor"][0].Allowed != "10.77.0.2/32" {
+		t.Errorf("anchor's peers are %+v, want laptop", peers["anchor"])
+	}
+	for _, node := range []string{"anchor", "laptop"} {
+		res, on, err := g.Resources(node)
+		if err != nil || !on || len(res) == 0 {
+			t.Errorf("%s is given no network: %v %v %d", node, on, err, len(res))
+		}
+	}
+}
+
+// 1360/AC3: a node not on the private network (it runs nothing that puts it there) gets no address and no network, and the
+// one that stayed keeps its own.
+func TestANodeNotOnThePrivateNetworkGetsNoAddressAndNoNetwork(t *testing.T) {
+	in := aMesh(t)
+	nodeOf(t, &in, "laptop").Assigned = nil // it keeps its place and its address, and stops running the network
+	gens, err := Generators(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g := gens[overlay.Name].(*overlay.Generator)
+	if len(g.Nodes()) != 1 || g.Nodes()[0].Name != "anchor" {
+		t.Fatalf("the network is over %+v, want anchor alone", g.Nodes())
+	}
+	if res, on, err := g.Resources("laptop"); on || err != nil || len(res) != 0 {
+		t.Errorf("a machine that left the network is given one: %v %v %v", res, on, err)
+	}
+	if _, in := g.Graph()["laptop"]; in {
+		t.Error("a machine that left the network has peers")
+	}
+}
+
+// 1360/AC3: a node whose resolution is refused is said with today's words: the network missing its hub names the
+// machine that could not be resolved, which is almost always why. The hub here holds no complete place (no key): a refused
+// machine with one keeps it on the network (issue 1833), so only one without is missing from it.
+func TestARefusedNodeIsSaidWhenTheNetworkCannotBeComposed(t *testing.T) {
+	in := aMesh(t)
+	nodeOf(t, &in, "anchor").Place.Key = ""
+	one := catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	two := catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-one"], in.Catalogue["rival-two"] = one, two
+	hub := nodeOf(t, &in, "anchor")
+	hub.Assigned = append(hub.Assigned, "rival-one", "rival-two") // its own set is incoherent: the hub does not resolve
+	_, err := Generators(in)
+	if err == nil {
+		t.Fatal("a network without its hub was composed")
+	}
+	for _, want := range []string{overlay.ErrNoHub.Error(), "and 1 node(s) could not be resolved at all, which is probably why:", "  anchor: "} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not say %q:\n%v", want, err)
+		}
+	}
+}
+
+// 1360/AC4: Generators changes nothing in its Input.
+func TestGeneratorsChangesNothingInItsInput(t *testing.T) {
+	unchanged(t, func() Input {
+		in := aMesh(t)
+		onTheTunnel(t, &in, true)
+		in.Joining = []string{"laptop"}
+		return in
+	}, func(in Input) {
+		if _, err := Generators(in); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
+
+// Each field of Input that the network reads reaches the generator: change it and the generator changes.
+func TestEachFieldOfTheInputReachesTheGenerator(t *testing.T) {
+	addressesOf := func(in Input) map[string]string {
+		t.Helper()
+		gens, err := Generators(in)
+		if err != nil {
+			t.Fatalf("%v", err)
+		}
+		out := map[string]string{}
+		for _, n := range gens[overlay.Name].(*overlay.Generator).Nodes() {
+			out[n.Name] = n.Address
+		}
+		return out
+	}
+	base := addressesOf(aMesh(t))
+	if len(base) != 2 {
+		t.Fatalf("the base mesh has %v", base)
+	}
+	t.Run("Catalogue: without the module offering it nobody is on the network", func(t *testing.T) {
+		in := aMesh(t)
+		// The module stays known, so every machine still resolves: a machine that does not resolve keeps its place (issue 1833).
+		in.Catalogue = map[string]catalogue.Manifest{overlay.Name: {Module: overlay.Name, Version: "1"}}
+		if got := addressesOf(in); len(got) != 0 {
+			t.Errorf("got %v", got)
+		}
+	})
+	t.Run("Nodes.Place: an address", func(t *testing.T) {
+		in := aMesh(t)
+		nodeOf(t, &in, "laptop").Place.Address = "10.77.0.9"
+		if got := addressesOf(in); got["laptop"] != "10.77.0.9" {
+			t.Errorf("got %v", got)
+		}
+	})
+	t.Run("Nodes.Assigned", func(t *testing.T) {
+		in := aMesh(t)
+		nodeOf(t, &in, "laptop").Assigned = nil
+		if got := addressesOf(in); len(got) != 1 {
+			t.Errorf("got %v", got)
+		}
+	})
+	t.Run("Nodes.Capabilities: a capability the module needs", func(t *testing.T) {
+		in := aMesh(t)
+		m := in.Catalogue[overlay.Name]
+		m.Capabilities = []string{"wireguard"}
+		in.Catalogue[overlay.Name] = m
+		nodeOf(t, &in, "laptop").Capabilities = map[string]bool{}
+		got, err := Generators(in)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if n := got[overlay.Name].(*overlay.Generator).Nodes(); len(n) != 1 || n[0].Name != "anchor" {
+			t.Errorf("a machine without the capability is on the network: %+v", n)
+		}
+	})
+	t.Run("OverlayCIDR", func(t *testing.T) {
+		in := aMesh(t)
+		in.OverlayCIDR = "10.99.0.0/16"
+		_, graph, err := Graph(in)
+		if err != nil {
+			t.Fatal(err)
+		}
+		found := false
+		for _, p := range graph["laptop"] {
+			found = found || p.Allowed == "10.99.0.0/16"
+		}
+		if !found {
+			t.Errorf("the hub's route is not the range given: %+v", graph["laptop"])
+		}
+	})
+	t.Run("Tunnels and Adopted and CarriedPeers", func(t *testing.T) {
+		in := aMesh(t)
+		onTheTunnel(t, &in, true)
+		nodes, graph, err := Graph(in)
+		if err != nil || len(nodes) != 2 {
+			t.Fatalf("%v %v", nodes, err)
+		}
+		if len(graph["anchor"]) < 2 {
+			t.Errorf("the hub's peers do not include the carried one: %+v", graph["anchor"])
+		}
+	})
+	t.Run("Joining: a machine with a key and an address is on the network before it is anything else", func(t *testing.T) {
+		in := aMesh(t)
+		in.Nodes = append(in.Nodes, Node{Name: "newcomer", Place: Place{Key: keyOf(t, "newcomer"), Address: "10.77.0.3"}})
+		if got := addressesOf(in); got["newcomer"] != "" {
+			t.Fatalf("a machine that runs nothing is on the network: %v", got)
+		}
+		in.Joining = []string{"newcomer"}
+		if got := addressesOf(in); got["newcomer"] != "10.77.0.3" {
+			t.Errorf("a joining machine is not on the network: %v", got)
+		}
+	})
+	t.Run("Holdings: a holder on record settles a seat two assignments could hold", func(t *testing.T) {
+		withSeat(t)
+		in := aMesh(t)
+		for _, name := range []string{"holder-one", "holder-two"} {
+			in.Catalogue[name] = aBrokerClaiming(name)
+		}
+		laptop := nodeOf(t, &in, "laptop")
+		laptop.Assigned = append(laptop.Assigned, "holder-one", "holder-two")
+		// Without a key: a machine that does not resolve and holds a complete place keeps it on the network (issue 1833).
+		laptop.Place.Key = ""
+		if got := addressesOf(in); got["laptop"] != "" {
+			t.Fatalf("a machine whose set claims one seat twice is on the network: %v", got)
+		}
+		in.Holdings = []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "laptop", Module: "holder-one"}}
+		if got := addressesOf(in); got["laptop"] != "10.77.0.2" {
+			t.Errorf("a holder on record did not settle the seat: %v", got)
+		}
+	})
+}
diff --git a/internal/compose/node.go b/internal/compose/node.go
new file mode 100644
index 0000000..0aff1dc
--- /dev/null
+++ b/internal/compose/node.go
@@ -0,0 +1,352 @@
+package compose
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/validate"
+)
+
+// Declared is a declaration as a machine is sent it (the controller's sendable, sendable.go): its resources and, for an adopted
+// node, its mode and which modules were taken on it (novox/hq ADR 0100), with what the composition says beside it and never puts on
+// the wire.
+//
+// **Body is the only place the envelope is marshalled**, so the digest the mesh compares and the body validated are one.
+type Declared struct {
+	Resources []map[string]any
+	// Sequence, Epoch and Generation are what the Input gave the node: zero is not sent at all.
+	Sequence   int64
+	Epoch      uint64
+	Generation int64
+	// ReadsModules says the machine's node-engine reads a module per resource and a build per module (novox/hq issue 1145): only
+	// then are they sent. ModuleOf is the composer's owner of each resource id and BuildIDs the build each module carries.
+	ReadsModules bool
+	ModuleOf     map[string]string
+	BuildIDs     map[string]string
+	// Adoption is nil for a converged node, and then the body is byte for byte what it was before adoption existed.
+	Adoption *Adoption
+	// Filled is the path of every file this declaration hands to the provisioner, and Provisioner the account its client runs as
+	// (novox/hq ADR 0349): on the wire as `filled_files` and `provisioner_account`, both absent when nothing is handed.
+	Filled      []string
+	Provisioner string
+	// LeftOut is every module of the machine's set left out because a stored setting cannot compose with its definition (novox/hq
+	// ADR 0163, rule 6), sorted; LeftOutWhy is why each was.
+	LeftOut    []string
+	LeftOutWhy map[string]string
+
+	// Not on the wire:
+	Received map[string]map[string][]catalogue.Contribution
+	Mesh     []string
+	BusUsers string
+	// Modules are the modules this declaration names, sorted.
+	Modules []string
+	// LocalNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR 0340).
+	LocalNetwork []catalogue.LocalNetworkPort
+	Withheld     []catalogue.Overflow
+	Unbound      []catalogue.Unbound
+	Unplaced     []string
+	HandedOnly   []string
+	// RequiredBy is, for each handed module only pulled in by another, the module that requires it (issue 765).
+	RequiredBy map[string]string
+	// Foreseen is every own secret composed with a stand-in, as `module/name`; StoodIn is everything the composition stood in for
+	// (an own secret, a grant's sealed copy, the certificate, the bus's user list); ForeseenPorts the ports the mesh may assign that
+	// the Input holds none for. A declaration that has any is never sent: what a send would make, named, never invented.
+	Foreseen      []string
+	StoodIn       []string
+	ForeseenPorts []string
+	// CoreBoxesWanted are the core credentials whose box the send must ask the vault for and keep.
+	CoreBoxesWanted []CoreBoxWanted
+	// Passes are the seats the mesh would pass on, for the caller to record, and Said the lines found while composing.
+	Passes Passes
+	Said   []string
+}
+
+// Adoption is what an adopted node is told about its mode. Taken is every module taken on it that it runs; Untaken is, for every
+// module it runs that is not taken, the ids of every one of that module's resources: what the host keeps as found until the module
+// is taken (ADR 0103).
+type Adoption struct {
+	Taken   []string            `json:"taken"`
+	Untaken map[string][]string `json:"untaken,omitempty"`
+}
+
+// Body is the declaration's bytes, as sent and as digested.
+func (d Declared) Body() ([]byte, error) {
+	envelope := map[string]any{"declaration": 1, "resources": d.Resources}
+	if d.ReadsModules {
+		// The module of each resource the composer owns, and the build of each module (novox/hq issue 1145): to a machine that
+		// said it reads them, and no other.
+		named := make([]map[string]any, len(d.Resources))
+		for n, r := range d.Resources {
+			module, owned := d.ModuleOf[fmt.Sprint(r["id"])]
+			if !owned {
+				named[n] = r
+				continue
+			}
+			with := make(map[string]any, len(r)+1)
+			for k, v := range r {
+				with[k] = v
+			}
+			with["module"] = module
+			named[n] = with
+		}
+		envelope["resources"] = named
+		if len(d.BuildIDs) > 0 {
+			envelope["builds"] = d.BuildIDs
+		}
+	}
+	if d.Adoption != nil {
+		envelope["adoption"] = d.Adoption
+	}
+	if d.Sequence > 0 {
+		envelope["sequence"] = d.Sequence
+	}
+	if d.Epoch > 0 {
+		envelope["epoch"] = d.Epoch
+	}
+	if len(d.LeftOut) > 0 {
+		envelope["left_out"] = d.LeftOut
+	}
+	if d.Generation > 0 {
+		envelope["generation"] = d.Generation
+	}
+	if len(d.Filled) > 0 {
+		envelope["filled_files"] = d.Filled
+		envelope["provisioner_account"] = d.Provisioner
+	}
+	// An empty declaration is deliberate: the node owns nothing the mesh put there (novox/hq issue 127), and the host refuses an
+	// empty body unless it is told the emptiness is meant.
+	if len(d.Resources) == 0 {
+		envelope["owns_nothing"] = true
+	}
+	return json.Marshal(envelope)
+}
+
+// Refusals are the findings a check refuses a change for, beside the validator's problems: a consumer left out of the grants
+// because its identity overflows the provision's bound, and a credential bound to another consumer (novox/hq ADR 0446 clause 1).
+// Each names the consumer and the provision.
+func (d Declared) Refusals() []string {
+	var out []string
+	for _, o := range d.Withheld {
+		out = append(out, o.String())
+	}
+	for _, u := range d.Unbound {
+		out = append(out, u.String())
+	}
+	sort.Strings(out)
+	return out
+}
+
+// Compose composes one node's declaration (the issue calls it Node; the Input already has a type of that name) over an Input -- as a push would, without the sending (the controller's
+// composedAndValidated in the Foreseeing mode) -- and runs the node-engine's own validator over its body. An error is that the
+// node did not compose (a set that does not compose satisfies IsUnresolvable); problems are what the validator refuses, in the
+// node-engine's words. It allocates, makes, keeps and writes nothing, and names what a send would do as foreseen.
+func Compose(in Input, node string) (Declared, []string, error) {
+	return ComposeIn(in, node, Foreseeing)
+}
+
+// ComposeIn is Compose in a chosen mode.
+func ComposeIn(in Input, node string, mode Mode) (Declared, []string, error) {
+	c := newComposer(in)
+	d, err := c.declaration(node, mode)
+	if err != nil {
+		return Declared{}, nil, err
+	}
+	body, err := d.Body()
+	if err != nil {
+		return Declared{}, nil, err
+	}
+	return d, validate.Declaration(body), nil
+}
+
+// declaration is the controller's declarationWith over the plain Input.
+func (c *composer) declaration(nodeName string, mode Mode) (Declared, error) {
+	resolved, err := c.planFor(nodeName)
+	if err != nil {
+		return Declared{}, err
+	}
+	gens, err := c.generators()
+	if err != nil {
+		return Declared{}, err
+	}
+	rendered, err := c.render(nodeName, mode)
+	if err != nil {
+		return Declared{}, err
+	}
+	with := rendered.Rendering
+	with.Generators = gens
+	plan := resolved.Plan
+	composed, err := resolution.Compose(plan, with)
+	if err != nil {
+		return Declared{}, err
+	}
+	// Which ports the filter admits from the local network, and from which networks (novox/hq ADR 0340 clause 8): the same rules the
+	// composition rendered, never sent.
+	rules, err := resolution.Rules(plan, with)
+	if err != nil {
+		return Declared{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Declared{}, err
+	}
+	out := Declared{Resources: composed.Resources, Adoption: adoptionFor(plan, node, composed),
+		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
+		LeftOut: sortedKeysOf(composed.LeftOut), LeftOutWhy: composed.LeftOut,
+		Withheld: rendered.Withheld, Unbound: rendered.Unbound,
+		Foreseen: composed.Foreseen, StoodIn: rendered.Foreseen, ForeseenPorts: rendered.ForeseenPorts,
+		Unplaced: composed.Unplaced, HandedOnly: composed.HandedOnly, Modules: namedModules(plan, composed.LeftOut),
+		Filled: composed.Filled, LocalNetwork: resolution.LocalNetworkPorts(rules, with.LocalNetworks),
+		CoreBoxesWanted: rendered.CoreBoxesWanted, Said: rendered.Said,
+		Sequence: node.Sequence, Epoch: node.Epoch, Generation: node.Generation}
+	if len(composed.Filled) > 0 {
+		out.Provisioner = with.Provisioner
+	}
+	// A handed module only pulled in by another keeps what requires it, for its value of its own in the assignments mirror (issue 765).
+	for module := range composed.Plans {
+		if by := resolution.RequiredBy(plan, module); by != "" {
+			if out.RequiredBy == nil {
+				out.RequiredBy = map[string]string{}
+			}
+			out.RequiredBy[module] = by
+		}
+	}
+	// And the module of each resource and the build of each module, to a machine whose node-engine said it reads them (novox/hq issue
+	// 1145) and to no other.
+	if node.ReadsModules {
+		carried := c.carriedOn(node, plan, composed.LeftOut)
+		out.ReadsModules, out.ModuleOf, out.BuildIDs = true, composed.Owner, c.wireBuilds(carried, node.Runs)
+	}
+	_, passes, left, err := c.theRestOfTheMesh("")
+	if err != nil {
+		return Declared{}, err
+	}
+	out.Passes = passes
+	for _, l := range left {
+		out.Said = append(out.Said, l.String())
+	}
+	out.Said = c.saidBeside(out.Said)
+	return out, nil
+}
+
+// carriedOn is the build of each module a declaration for the node carries (plan.go carriedOn, in a question that sends nothing): the
+// module's current build for each module in it, and for a module left out of it the build it was last sent, since the machine keeps
+// that one -- or nothing, when that is not known.
+func (c *composer) carriedOn(node Node, plan catalogue.Resolution, leftOut map[string]string) map[string]string {
+	before := node.SentBuilds
+	if !node.SentKnown {
+		before = nil
+	}
+	out := map[string]string{}
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; left {
+			if was, kept := before[m.Module]; kept {
+				out[m.Module] = was
+			}
+			continue
+		}
+		out[m.Module] = c.in.CurrentBuilds[m.Module]
+		// A module kept at the build the machine runs is carried at that build (plan.go carriedOn).
+		if kept, ok := node.KeptBuilds[m.Module]; ok && kept != "" {
+			out[m.Module] = kept
+		}
+	}
+	return out
+}
+
+// wireBuilds is the build of each carried module that goes on the wire (novox/hq issue 1145): the build its assignment names when
+// that assignment is of the commit carried, else the build made from that commit; a module with neither is not named.
+func (c *composer) wireBuilds(carried map[string]string, runs map[string]Run) map[string]string {
+	out := map[string]string{}
+	for module, commit := range carried {
+		if commit == "" {
+			continue
+		}
+		if ref, ok := runs[module]; ok && ref.Commit == commit && ref.Build != "" {
+			out[module] = ref.Build
+			continue
+		}
+		if build := c.in.BuildIDs[module][commit]; build != "" {
+			out[module] = build
+		}
+	}
+	return out
+}
+
+// adoptionFor is the envelope computed from what was taken and who owns each resource: nil for a converged node. Every module the
+// node runs that is not taken is untaken -- including one pulled in by another rather than assigned.
+func adoptionFor(plan catalogue.Resolution, node Node, composed catalogue.Composed) *Adoption {
+	if !node.Adopted {
+		return nil
+	}
+	isTaken := map[string]bool{}
+	for _, m := range node.Taken {
+		isTaken[m] = true
+	}
+	out := &Adoption{Taken: []string{}}
+	runs := map[string]bool{}
+	for _, m := range plan.Modules {
+		runs[m.Module] = true
+		if isTaken[m.Module] {
+			out.Taken = append(out.Taken, m.Module)
+		}
+	}
+	sort.Strings(out.Taken)
+	for _, r := range composed.Resources {
+		id, _ := r["id"].(string)
+		module, owned := composed.Owner[id]
+		// Every kind, not only files and containers (novox/hq ADR 0103). What the mesh declares of its own is never held.
+		if !owned || !runs[module] || isTaken[module] || strings.HasPrefix(id, catalogue.AdoptionPrefix) {
+			continue
+		}
+		if out.Untaken == nil {
+			out.Untaken = map[string][]string{}
+		}
+		out.Untaken[module] = append(out.Untaken[module], id)
+	}
+	return out
+}
+
+// sortedKeysOf is a map's keys, sorted: so what a declaration says it left out does not move for a reordering nobody made.
+func sortedKeysOf(m map[string]string) []string {
+	if len(m) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// namedModules are the modules a declaration names: its machine's set, less what was left out of it.
+func namedModules(plan catalogue.Resolution, leftOut map[string]string) []string {
+	out := make([]string, 0, len(plan.Modules))
+	for _, m := range plan.Modules {
+		if _, left := leftOut[m.Module]; !left {
+			out = append(out, m.Module)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// DataItems is every data item the modules placed on a node declare, placed there (novox/hq ADR 0571 clause 3): what the
+// node-backup holder is handed as `${backup:data}`, composed over the Input as Compose composes the node, so disk-load
+// reads the list from the bus with no composed file. Unplaced names each item left out and why.
+func DataItems(in Input, node string) (map[string][]catalogue.PlacedDataItem, []string, error) {
+	c := newComposer(in)
+	resolved, err := c.planFor(node)
+	if err != nil {
+		return nil, nil, err
+	}
+	rendered, err := c.render(node, Planning)
+	if err != nil {
+		return nil, nil, err
+	}
+	return resolution.DataItems(resolved.Plan, rendered.Rendering)
+}
diff --git a/internal/compose/node_test.go b/internal/compose/node_test.go
new file mode 100644
index 0000000..5dcbee4
--- /dev/null
+++ b/internal/compose/node_test.go
@@ -0,0 +1,424 @@
+package compose
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+func resourceIDs(d Declared) []string {
+	var ids []string
+	for _, r := range d.Resources {
+		ids = append(ids, r["type"].(string)+":"+r["id"].(string))
+	}
+	return ids
+}
+
+func has(ids []string, want string) bool {
+	for _, id := range ids {
+		if id == want {
+			return true
+		}
+	}
+	return false
+}
+
+// aSmallMesh is three nodes, a provider and its consumer, a seat and the private network: aMesh with `ace` running a database and
+// a resolver holding the mesh's resolver seat on record (the providers and consumer of mesh-controller's facts_test.go
+// aMeshWithSecrets, the seat of bindings_test.go storeManifests).
+func aSmallMesh(t *testing.T) Input {
+	t.Helper()
+	in := threeNodes(t)
+	for _, m := range storeManifests() {
+		if m.Module == "resolver" {
+			in.Catalogue[m.Module] = m
+		}
+	}
+	ace := nodeOf(t, &in, "ace")
+	ace.Assigned = append(ace.Assigned, "resolver")
+	in.Holdings = []catalogue.Held{{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "ace", Module: "resolver", Site: "there"}}
+	return in
+}
+
+// 1298/AC1: each node of a small mesh composes, its body is accepted by the node-engine's validator, and it names the resources the
+// controller composes for the same case: the private network's files on the nodes that run it, the provider's received file, the
+// consumer's file.
+func TestEachNodeOfASmallMeshComposesAndItsBodyIsAcceptedByTheValidator(t *testing.T) {
+	in := aSmallMesh(t)
+	want := map[string][]string{
+		"anchor": {"package:mesh-wireguard.overlay-tools", "file:mesh-wireguard.overlay-config", "service:mesh-wireguard.overlay-up", "file:objects.received-s3-bucket"},
+		"laptop": {"package:mesh-wireguard.overlay-tools", "file:mesh-wireguard.overlay-config", "service:mesh-wireguard.overlay-up", "file:files.config"},
+		"ace":    nil,
+	}
+	for node, ids := range want {
+		d, problems, err := Compose(in, node)
+		if err != nil || len(problems) != 0 {
+			t.Fatalf("%s: %v %v", node, err, problems)
+		}
+		for _, id := range ids {
+			if !has(resourceIDs(d), id) {
+				t.Errorf("%s does not name %s: %v", node, id, resourceIDs(d))
+			}
+		}
+		body, err := d.Body()
+		if err != nil {
+			t.Fatal(err)
+		}
+		var parsed struct {
+			Declaration int              `json:"declaration"`
+			Resources   []map[string]any `json:"resources"`
+		}
+		if err := json.Unmarshal(body, &parsed); err != nil || parsed.Declaration != 1 || len(parsed.Resources) != len(d.Resources) {
+			t.Errorf("%s: body %s %v", node, body, err)
+		}
+	}
+	// ace runs a resolver and a database and nothing the mesh declares of its own: an empty declaration says it owns nothing.
+	d, _, _ := Compose(in, "ace")
+	if body, _ := d.Body(); !strings.Contains(string(body), `"owns_nothing":true`) {
+		t.Errorf("an empty declaration is not said to be deliberate: %s", body)
+	}
+}
+
+// 1298/AC2 (mesh-controller merge_gate_integration_test.go TestIssue236AManifestTheNodeEngineRefusesFailsThePullRequest, the manifest):
+// a service that omits its state is accepted by the catalogue's check and refused by the node-engine; Compose returns the validator's
+// problems in the node-engine's words and no error.
+func TestAManifestTheNodeEngineRefusesComesBackAsProblemsAndNoError(t *testing.T) {
+	in := aMesh(t)
+	var lemurs catalogue.Manifest
+	if err := json.Unmarshal([]byte(`{"module":"lemurs","version":"1","capabilities":["systemd"],
+		"resources":[{"id":"service","type":"service","unit":"lemurs.service","boot":"enabled"}]}`), &lemurs); err != nil {
+		t.Fatal(err)
+	}
+	in.Catalogue["lemurs"] = lemurs
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "lemurs")
+	d, problems, err := Compose(in, "laptop")
+	if err != nil {
+		t.Fatalf("a refusal of the validator is an error: %v", err)
+	}
+	if len(problems) == 0 || !strings.Contains(strings.Join(problems, "\n"), "lemurs.service") {
+		t.Fatalf("problems are %v", problems)
+	}
+	if !has(resourceIDs(d), "service:lemurs.service") {
+		t.Errorf("the declaration does not carry the resource: %v", resourceIDs(d))
+	}
+	// And the same, as the validator says it of the body.
+	body, _ := d.Body()
+	if again := strings.Join(problems, "\n"); again == "" || !strings.Contains(string(body), "lemurs.service") {
+		t.Errorf("the body does not name the service: %s", body)
+	}
+}
+
+// 1298/AC3: a node whose own set does not compose returns an error and no declaration, told apart from an unreadable Input.
+func TestANodeWhoseSetDoesNotComposeReturnsAnErrorAndNoDeclaration(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["rival-one"] = catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-two"] = catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "rival-one", "rival-two")
+	d, problems, err := Compose(in, "laptop")
+	if err == nil || !IsUnresolvable(err) || d.Resources != nil || problems != nil {
+		t.Fatalf("a set that does not compose: %v %v %v", d.Resources, problems, err)
+	}
+	if _, _, err := Compose(in, "nowhere"); err == nil || IsUnresolvable(err) {
+		t.Fatalf("a node the Input does not have: %v", err)
+	}
+}
+
+// 1298/AC4: composing the same Input twice gives byte-identical bodies, and the Input is unchanged.
+func TestComposingTwiceGivesTheSameBytesAndChangesNothing(t *testing.T) {
+	mk := func() Input {
+		in := aSmallMesh(t)
+		nodeOf(t, &in, "anchor").Account = "jochens"
+		nodeOf(t, &in, "laptop").Sequence = 7
+		return in
+	}
+	in := mk()
+	for _, node := range []string{"anchor", "laptop", "ace"} {
+		a, _, err := Compose(in, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		b, _, err := Compose(in, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ab, _ := a.Body()
+		bb, _ := b.Body()
+		if string(ab) != string(bb) {
+			t.Errorf("%s: two compositions differ:\n%s\n%s", node, ab, bb)
+		}
+	}
+	unchanged(t, mk, func(in Input) {
+		for _, node := range []string{"anchor", "laptop", "ace"} {
+			if _, _, err := Compose(in, node); err != nil {
+				t.Fatal(err)
+			}
+		}
+	})
+}
+
+// 1298/AC5: what a send would make is named in the result as foreseen and never invented: an own secret, a port, a core box, a grant's
+// sealed copy.
+func TestWhatASendWouldMakeIsNamedAsForeseenAndNeverInvented(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Issued[0].ForProvider = ""
+	in.Catalogue["assistant"] = anAssistant()
+	in.Catalogue["web"] = aWebModule()
+	in.Catalogue["nats"] = catalogue.Manifest{Module: "nats", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/var/lib/mesh/nats/broker", Taken: catalogue.TakenAtStart}}}
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "assistant", "web", "nats")
+	anchor.SealingKey = keyOf(t, "anchor")
+	anchor.Stated, anchor.Contract = true, VaultBoxContract
+	in.BusMinted = []string{"anchor.nats"}
+	d, problems, err := Compose(in, "anchor")
+	if err != nil || len(problems) != 0 {
+		t.Fatalf("%v %v", err, problems)
+	}
+	if !has(d.Foreseen, "assistant/password") || !has(d.Foreseen, "nats/broker") {
+		t.Errorf("own secrets foreseen: %v", d.Foreseen)
+	}
+	if len(d.ForeseenPorts) != 1 || d.ForeseenPorts[0] != "web:8080" {
+		t.Errorf("foreseen ports: %v", d.ForeseenPorts)
+	}
+	if len(d.CoreBoxesWanted) != 1 || d.CoreBoxesWanted[0].Module != "nats" {
+		t.Errorf("core boxes wanted: %v", d.CoreBoxesWanted)
+	}
+	if !has(d.StoodIn, "the grant of s3-bucket for files on laptop") {
+		t.Errorf("stood in for: %v", d.StoodIn)
+	}
+	body, _ := d.Body()
+	if strings.Contains(string(body), secretValue) {
+		t.Error("a secret value is in the body")
+	}
+}
+
+// 1298/AC6: the body carries the sequence, epoch and generation the Input gives, and the module of each resource and the carried builds
+// only to a node whose Input says it reads modules (novox/hq issue 1145).
+func TestTheBodyCarriesTheOrderTheInputGivesAndTheBuildsOnlyToAnEngineThatReadsThem(t *testing.T) {
+	in := aSmallMesh(t)
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Sequence, laptop.Epoch, laptop.Generation = 42, 57, 9
+	in.CurrentBuilds = map[string]string{"files": "commit-files", "mesh-wireguard": "commit-wg"}
+	in.BuildIDs = map[string]map[string]string{"files": {"commit-files": "build-7"}}
+	// An assignment of another commit than the one carried does not name the build; the build made from the commit carried does.
+	laptop.Runs = map[string]Run{"mesh-wireguard": {Commit: "commit-wg", Build: "build-9"}, "files": {Commit: "an-older-commit", Build: "build-6"}}
+	d, _, err := Compose(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := d.Body()
+	var got map[string]any
+	if err := json.Unmarshal(body, &got); err != nil {
+		t.Fatal(err)
+	}
+	if got["sequence"] != float64(42) || got["epoch"] != float64(57) || got["generation"] != float64(9) {
+		t.Errorf("the order is %v %v %v", got["sequence"], got["epoch"], got["generation"])
+	}
+	if _, there := got["builds"]; there {
+		t.Errorf("builds are sent to an engine that does not read them: %s", body)
+	}
+	for _, r := range got["resources"].([]any) {
+		if _, there := r.(map[string]any)["module"]; there {
+			t.Errorf("a module is named on a resource of an engine that does not read them: %v", r)
+		}
+	}
+	laptop.ReadsModules = true
+	d, _, err = Compose(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ = d.Body()
+	got = nil
+	if err := json.Unmarshal(body, &got); err != nil {
+		t.Fatal(err)
+	}
+	builds, _ := got["builds"].(map[string]any)
+	if builds["files"] != "build-7" || builds["mesh-wireguard"] != "build-9" {
+		t.Errorf("builds are %v", builds)
+	}
+	named := false
+	for _, r := range got["resources"].([]any) {
+		if r.(map[string]any)["id"] == "files.config" && r.(map[string]any)["module"] == "files" {
+			named = true
+		}
+	}
+	if !named {
+		t.Errorf("a resource is not named for its module: %s", body)
+	}
+	// Zero is not sent at all.
+	laptop.Sequence, laptop.Epoch, laptop.Generation = 0, 0, 0
+	d, _, _ = Compose(in, "laptop")
+	body, _ = d.Body()
+	for _, key := range []string{`"sequence"`, `"epoch"`, `"generation"`} {
+		if strings.Contains(string(body), key) {
+			t.Errorf("%s is sent as zero: %s", key, body)
+		}
+	}
+}
+
+// A module left out of a build set keeps the build it was last sent (novox/hq issue 259): the machine keeps that one.
+func TestAModuleLeftOutKeepsTheBuildItWasLastSent(t *testing.T) {
+	c := newComposer(Input{CurrentBuilds: map[string]string{"a": "new-a", "b": "new-b"}})
+	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "a"}, {Module: "b"}, {Module: "c"}}}
+	node := Node{SentBuilds: map[string]string{"b": "old-b", "c": "old-c"}, SentKnown: true}
+	got := c.carriedOn(node, plan, map[string]string{"b": "its settings cannot compose"})
+	if got["a"] != "new-a" || got["b"] != "old-b" || got["c"] != "" {
+		t.Errorf("carried builds are %v", got)
+	}
+	node.SentKnown = false
+	if got := c.carriedOn(node, plan, map[string]string{"b": "x"}); len(got) != 2 || got["b"] != "" {
+		t.Errorf("when what was sent is not known: %v", got)
+	}
+}
+
+// An adopted node is told which modules were taken and, for every module it runs that is not, the ids of its resources
+// (novox/hq ADR 0100 and 0103); a converged node is told nothing, and its body is as it was before adoption.
+func TestAnAdoptedNodeIsToldWhatWasTakenAndWhatIsKept(t *testing.T) {
+	in := aSmallMesh(t)
+	d, _, err := Compose(in, "laptop")
+	if err != nil || d.Adoption != nil {
+		t.Fatalf("a converged node: %v %v", d.Adoption, err)
+	}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Adopted, laptop.Taken = true, []string{"mesh-wireguard"}
+	d, problems, err := Compose(in, "laptop")
+	if err != nil || len(problems) != 0 {
+		t.Fatalf("%v %v", err, problems)
+	}
+	if d.Adoption == nil || len(d.Adoption.Taken) != 1 || d.Adoption.Taken[0] != "mesh-wireguard" ||
+		len(d.Adoption.Untaken["files"]) == 0 || d.Adoption.Untaken["mesh-wireguard"] != nil {
+		t.Fatalf("adoption is %+v", d.Adoption)
+	}
+	if body, _ := d.Body(); !strings.Contains(string(body), `"adoption"`) {
+		t.Errorf("the adoption is not on the wire: %s", body)
+	}
+}
+
+// Issue 263 (merge_gate_integration_test.go TestIssue263AnIdentityARealMachineNameOverflows...): a change makes the network manager
+// require the object store's provision; on a machine whose name is six characters its identity is 26 against a bound of 20. The
+// composition of the provider returns the refusal, naming the module and the provision.
+func TestIssue263AnIdentityARealMachineNameOverflowsIsARefusal(t *testing.T) {
+	in := aGrantMesh(t)
+	in.Catalogue["resolver"] = storeManifests()[1]
+	in.Catalogue["networkmanager"] = catalogue.Manifest{Module: "networkmanager", Version: "1", Requires: []string{"wildcard-resolution", "s3-bucket"}}
+	laptop, anchor := nodeOf(t, &in, "laptop"), nodeOf(t, &in, "anchor")
+	laptop.Assigned = append(laptop.Assigned, "networkmanager")
+	anchor.Assigned = append(anchor.Assigned, "resolver")
+	in.Holdings = []catalogue.Held{{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "resolver", Site: "here"}}
+	in.Issued = append(in.Issued, Issued{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "networkmanager", Provider: "anchor", ForProvider: "sealed"})
+	d, problems, err := Compose(in, "anchor")
+	if err != nil || len(problems) != 0 {
+		t.Fatalf("%v %v", err, problems)
+	}
+	refusals := strings.Join(d.Refusals(), "\n")
+	if !strings.Contains(refusals, "networkmanager") || !strings.Contains(refusals, "s3-bucket") || !strings.Contains(refusals, "laptop") {
+		t.Fatalf("the refusal does not name the module, the provision and the machine: %q", refusals)
+	}
+	// And the consumer that fits is granted.
+	if len(d.Withheld) != 1 || d.Withheld[0].Module != "networkmanager" {
+		t.Errorf("withheld %+v", d.Withheld)
+	}
+}
+
+// Round 1, finding 1 (plan.go keepRecorded): a recorded module kept at the build a machine runs is that machine's own resolution
+// and no other's; the commit carried for it is the kept one.
+func TestAKeptModuleChangesOnlyTheResolutionOfTheNodeThatKeepsIt(t *testing.T) {
+	in := aSmallMesh(t)
+	in.Catalogue["tool"] = catalogue.Manifest{Module: "tool", Version: "2"}
+	for _, name := range []string{"anchor", "laptop"} {
+		n := nodeOf(t, &in, name)
+		n.Assigned = append(n.Assigned, "tool")
+	}
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Kept = map[string]catalogue.Manifest{"tool": {Module: "tool", Version: "1"}}
+	versionOn := func(in Input, node string) string {
+		t.Helper()
+		got, err := Resolve(in, node)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, m := range got.Plan.Modules {
+			if m.Module == "tool" {
+				return m.Version
+			}
+		}
+		t.Fatalf("no tool on %s", node)
+		return ""
+	}
+	if v := versionOn(in, "anchor"); v != "1" {
+		t.Errorf("the node that keeps it runs version %s", v)
+	}
+	if v := versionOn(in, "laptop"); v != "2" {
+		t.Errorf("another node runs version %s: a kept build leaked", v)
+	}
+	if got := in.Catalogue["tool"].Version; got != "2" {
+		t.Errorf("the Input's catalogue was changed: %s", got)
+	}
+	// And the commit carried for it is the kept one.
+	c := newComposer(in)
+	plan := catalogue.Resolution{Modules: []catalogue.Manifest{{Module: "tool"}, {Module: "other"}}}
+	in.CurrentBuilds = map[string]string{"tool": "current", "other": "current-other"}
+	c = newComposer(in)
+	node := Node{KeptBuilds: map[string]string{"tool": "kept-commit"}}
+	if got := c.carriedOn(node, plan, nil); got["tool"] != "kept-commit" || got["other"] != "current-other" {
+		t.Errorf("carried builds are %v", got)
+	}
+}
+
+// Another node's kept build changes neither the rest of the mesh nor who is on the network: the controller reads both with the
+// current manifests, and only then keeps a recorded module for the node it composes (recorded_kept.go keepRecorded).
+func TestAnotherNodesKeptBuildDoesNotChangeTheRestOfTheMeshOrWhoIsOnTheNetwork(t *testing.T) {
+	in := threeNodes(t)
+	nodeOf(t, &in, "anchor").Kept = map[string]catalogue.Manifest{"objects": {Module: "objects", Version: "0"}, overlayName(): {Module: overlayName(), Version: "0"}}
+	w, _, _, err := TheRestOfTheMesh(in, "laptop")
+	if err != nil || len(providers(w, "s3-bucket")) != 1 {
+		t.Errorf("a kept build changed what anchor offers: %v %v", providers(w, "s3-bucket"), err)
+	}
+	where, err := newComposer(in).whereEveryoneIs()
+	if err != nil || where["anchor"] == "" {
+		t.Errorf("a kept build took anchor off the network: %v %v", where, err)
+	}
+}
+
+func overlayName() string { return overlay.Name }
+
+// Round 1, finding 6: the nodes the composition did not count as on the network are returned, said, not lost. laptop holds no
+// complete place (no key): one that does keeps it on the network (issue 1833) and is counted.
+func TestANodeNotCountedAsOnTheNetworkIsSaidInTheResult(t *testing.T) {
+	in := aMesh(t)
+	nodeOf(t, &in, "laptop").Place.Key = ""
+	in.Catalogue["rival-one"] = catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-two"] = catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "rival-one", "rival-two")
+	said := func(lines []string) bool {
+		for _, l := range lines {
+			if strings.HasPrefix(l, "laptop is not counted as on the network") {
+				return true
+			}
+		}
+		return false
+	}
+	got, err := Render(in, "anchor", Foreseeing)
+	if err != nil || !said(got.Said) {
+		t.Errorf("rendered: %v %v", got.Said, err)
+	}
+	d, _, err := Compose(in, "anchor")
+	if err != nil || !said(d.Said) {
+		t.Errorf("declared: %v %v", d.Said, err)
+	}
+	n := 0
+	for _, l := range d.Said {
+		if strings.HasPrefix(l, "laptop is not counted") {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("said %d times: %v", n, d.Said)
+	}
+}
diff --git a/internal/compose/one_machine_alone_test.go b/internal/compose/one_machine_alone_test.go
new file mode 100644
index 0000000..3c49abb
--- /dev/null
+++ b/internal/compose/one_machine_alone_test.go
@@ -0,0 +1,167 @@
+package compose
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// fourOnTheNetwork is aMesh and two more machines on the private network at the site `there`: `ace`, dialled at
+// ace.example:51820, at 10.77.0.3, and `box`, behind no endpoint, at 10.77.0.4. A module `office` requires
+// `document-server`, which nothing in the catalogue provides: the shape of issue 1833 (nextcloud on the hub wanting a
+// document server nobody offered).
+func fourOnTheNetwork(t *testing.T) Input {
+	t.Helper()
+	in := aMesh(t)
+	in.Catalogue["office"] = catalogue.Manifest{Module: "office", Version: "1", Requires: []string{"document-server"}}
+	caps := map[string]bool{"container-runtime": true, "wireguard": true, "systemd": true}
+	in.Nodes = append(in.Nodes,
+		Node{Name: "ace", Place: Place{Key: keyOf(t, "ace"), Endpoint: "ace.example:51820", Site: "there", Address: "10.77.0.3"},
+			Assigned: []string{overlay.Name}, Capabilities: caps},
+		Node{Name: "box", Place: Place{Key: keyOf(t, "box"), Site: "there", Address: "10.77.0.4"},
+			Assigned: []string{overlay.Name}, Capabilities: caps})
+	return in
+}
+
+// unresolvableBy makes one machine's own set fail to resolve: it is also given `office`, whose requirement nothing provides.
+func unresolvableBy(t *testing.T, in *Input, name string) {
+	t.Helper()
+	n := nodeOf(t, in, name)
+	n.Assigned = append(n.Assigned, "office")
+}
+
+// networkOf is the generator of an Input's private network, failing the test when it is not composed.
+func networkOf(t *testing.T, in Input) *overlay.Generator {
+	t.Helper()
+	gens, err := Generators(in)
+	if err != nil {
+		t.Fatalf("the private network was not composed: %v", err)
+	}
+	return gens[overlay.Name].(*overlay.Generator)
+}
+
+func placesOf(g *overlay.Generator) map[string]overlay.Node {
+	out := map[string]overlay.Node{}
+	for _, n := range g.Nodes() {
+		out[n.Name] = n
+	}
+	return out
+}
+
+// 1833/AC1: four machines, the hub's own set does not resolve; the other three compose their declarations, and the hub alone is
+// refused, with an error that is its own set failing and names what could not be resolved.
+func TestOneMachineThatDoesNotResolveIsRefusedAlone(t *testing.T) {
+	in := fourOnTheNetwork(t)
+	unresolvableBy(t, &in, "anchor")
+	for _, node := range []string{"laptop", "ace", "box"} {
+		d, problems, err := Compose(in, node)
+		if err != nil || len(problems) != 0 {
+			t.Errorf("%s does not compose because another machine does not resolve: %v %v", node, err, problems)
+			continue
+		}
+		if !has(resourceIDs(d), "file:mesh-wireguard.overlay-config") {
+			t.Errorf("%s is given no private network: %v", node, resourceIDs(d))
+		}
+	}
+	_, _, err := Compose(in, "anchor")
+	if err == nil || !IsUnresolvable(err) {
+		t.Fatalf("the machine that does not resolve is not refused as its own set failing: %v", err)
+	}
+	if !strings.Contains(err.Error(), `nothing provides "document-server", wanted by office`) {
+		t.Errorf("the refusal does not name what could not be resolved: %v", err)
+	}
+}
+
+// 1833/AC2: the private network is composed with every machine on it: the hub that does not resolve keeps its place (key,
+// address, endpoint, site, hub role), so every other machine keeps its path through it.
+func TestAMachineThatDoesNotResolveKeepsItsPlaceOnTheNetwork(t *testing.T) {
+	in := fourOnTheNetwork(t)
+	unresolvableBy(t, &in, "anchor")
+	got := placesOf(networkOf(t, in))
+	if len(got) != 4 {
+		t.Fatalf("the network is over %v, want all four machines", got)
+	}
+	hub := got["anchor"]
+	if !hub.Hub || hub.Key != keyOf(t, "anchor") || hub.Address != "10.77.0.1" || hub.Endpoint != "anchor.example:51820" || hub.Site != "here" {
+		t.Errorf("the hub did not keep its place: %+v", hub)
+	}
+	nodes, graph, err := Graph(in)
+	if err != nil || len(nodes) != 4 {
+		t.Fatalf("the graph is not shown with every machine: %v %v", nodes, err)
+	}
+	for _, node := range []string{"ace", "box"} {
+		through := false
+		for _, p := range graph[node] {
+			through = through || (p.Name == "anchor" && p.Endpoint == "anchor.example:51820")
+		}
+		if !through {
+			t.Errorf("%s has no path through the hub: %+v", node, graph[node])
+		}
+	}
+}
+
+// 1833/AC3: a machine that does not resolve and was never placed (a new machine: no key, no address) is left off the network,
+// which is composed from the rest -- here with the hub that does not resolve on its last place -- and that machine alone is refused.
+func TestANewMachineThatDoesNotResolveIsLeftOffAndRefusedAlone(t *testing.T) {
+	in := fourOnTheNetwork(t)
+	unresolvableBy(t, &in, "anchor")
+	in.Nodes = append(in.Nodes, Node{Name: "fresh", Place: Place{Site: "there"},
+		Assigned: []string{overlay.Name, "office"}, Capabilities: map[string]bool{"wireguard": true, "systemd": true}})
+	got := placesOf(networkOf(t, in))
+	if _, on := got["fresh"]; on || len(got) != 4 {
+		t.Fatalf("the network is over %v, want the four placed machines without fresh", got)
+	}
+	if _, _, err := Compose(in, "fresh"); err == nil || !IsUnresolvable(err) {
+		t.Errorf("the new machine is not refused as its own set failing: %v", err)
+	}
+	if _, problems, err := Compose(in, "box"); err != nil || len(problems) != 0 {
+		t.Errorf("another machine does not compose: %v %v", err, problems)
+	}
+}
+
+// 1833/AC4: a network that truly cannot be composed from what remains still fails: the hub does not resolve and has no
+// complete place (no key), so nothing is the hub; the refusal is today's, naming the machine that could not be resolved.
+func TestANetworkThatCannotBeComposedFromWhatRemainsStillFails(t *testing.T) {
+	in := fourOnTheNetwork(t)
+	unresolvableBy(t, &in, "anchor")
+	nodeOf(t, &in, "anchor").Place.Key = ""
+	_, err := Generators(in)
+	if err == nil {
+		t.Fatal("a network without a hub was composed")
+	}
+	for _, want := range []string{overlay.ErrNoHub.Error(), "and 1 node(s) could not be resolved at all, which is probably why:", "  anchor: "} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not say %q:\n%v", want, err)
+		}
+	}
+	if _, _, err := Compose(in, "laptop"); err == nil {
+		t.Error("a declaration was composed over a network that cannot be")
+	}
+}
+
+// 1833/AC2, a failure the composition's unchecked pass refuses too (two modules claiming one seat on the hub, the 1360/AC3
+// shape): the hub keeps its place in what every other machine is sent besides the tunnel -- its internal name and its address
+// among the sources "from the mesh" -- and another machine still composes.
+func TestAMachineThatDoesNotResolveKeepsItsNameAndItsAddressInTheMesh(t *testing.T) {
+	in := fourOnTheNetwork(t)
+	in.Catalogue["rival-one"] = catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-two"] = catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	hub := nodeOf(t, &in, "anchor")
+	hub.Assigned = append(hub.Assigned, "rival-one", "rival-two")
+	if _, err := Resolve(in, "anchor"); !IsUnresolvable(err) {
+		t.Fatalf("the hub is meant not to resolve: %v", err)
+	}
+	c := newComposer(in)
+	if got := c.namesInTheMesh()["anchor."+c.suffix()]; got != "10.77.0.1" {
+		t.Errorf("the hub's name is not in the mesh's names: %v", c.namesInTheMesh())
+	}
+	if got := c.onThePrivateNetwork(); !slices.Contains(got, "10.77.0.1") || len(got) != 4 {
+		t.Errorf("the sources from the mesh are %v, want all four machines with the hub", got)
+	}
+	if _, problems, err := Compose(in, "ace"); err != nil || len(problems) != 0 {
+		t.Errorf("another machine does not compose: %v %v", err, problems)
+	}
+}
diff --git a/internal/compose/render.go b/internal/compose/render.go
new file mode 100644
index 0000000..3354fad
--- /dev/null
+++ b/internal/compose/render.go
@@ -0,0 +1,150 @@
+package compose
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Rendered is everything a node's declaration is composed with (plan.go renderingFor), over an Input: the place half (Places)
+// and the credential half. Nothing was allocated, made, kept or written; what a send would do is returned for the caller to do.
+type Rendered struct {
+	Rendering catalogue.Rendering
+	// ForeseenPorts are the ports the mesh may assign that the Input holds none for ("<module>:<port>").
+	ForeseenPorts []string
+	// Foreseen are the stand-ins the composition used for what the Input does not hold: an own secret the next send makes
+	// ("<module>/<name>"), a grant's sealed copy, the certificate and the bus's user list.
+	Foreseen []string
+	// CoreBoxesWanted are the core credentials whose box the send must ask the vault for and keep.
+	CoreBoxesWanted []CoreBoxWanted
+	// Withheld are the consumers the grants leave out because their identity overflows the provision's bound (novox/hq ADR 0225),
+	// and Unbound those whose credential from this node is on record and whose own resolution binds them elsewhere (issue
+	// 274). The controller says them; a check refuses a change that adds one (ADR 0446 clause 1).
+	Withheld []catalogue.Overflow
+	Unbound  []catalogue.Unbound
+	// Said are the lines the controller says while composing (the bus users left out for want of a credential).
+	Said []string
+}
+
+// Render composes the rendering of a node: the grants it must create, where it puts its ports, its own secrets, the vault's boxes,
+// its certificate, the names of the mesh, the bus's user list and its membership. The refusals are the controller's, in its words;
+// where more than one fault stands, the first reported may differ from the controller's, which interleaves the halves.
+func Render(in Input, node string, mode Mode) (Rendered, error) {
+	return newComposer(in).render(node, mode)
+}
+
+// Composing is Resolve, Render and Generators of one node over one composition, which resolves each node of the mesh
+// once for all three (issue 1954: three compositions resolved the mesh again each, 11.7 s for one node's plans). Each
+// answers as it does alone; the first refusal ends it, in that order, with what follows it empty.
+func Composing(in Input, node string, mode Mode) (Resolved, Rendered, map[string]catalogue.Generator, error) {
+	c := newComposer(in)
+	resolved, err := c.planFor(node)
+	if err != nil {
+		return Resolved{}, Rendered{}, nil, err
+	}
+	rendered, err := c.render(node, mode)
+	if err != nil {
+		return resolved, Rendered{}, nil, err
+	}
+	gens, err := c.generators()
+	if err != nil {
+		return resolved, rendered, nil, err
+	}
+	return resolved, rendered, gens, nil
+}
+
+func (c *composer) render(nodeName string, mode Mode) (Rendered, error) {
+	resolved, err := c.planFor(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	plan := resolved.Plan
+	var out Rendered
+	foreseen := func(s string) { out.Foreseen = append(out.Foreseen, s) }
+
+	grants, withheld, unbound, grantsForeseen, err := c.grantsFor(nodeName)
+	if err != nil {
+		return Rendered{}, err
+	}
+	placed, err := c.places(nodeName, resolved)
+	if err != nil {
+		return Rendered{}, err
+	}
+	r := placed.Rendering
+	out.ForeseenPorts = placed.ForeseenPorts
+	// A plan carries its contributions' machine ports, refused where the placement assigned none (issue 774).
+	r.Planned = mode == Planning
+	r.Grants, r.Withheld, r.Unbound = grants, withheld, unbound
+	out.Withheld, out.Unbound = withheld, unbound
+	for _, g := range grantsForeseen {
+		foreseen(g)
+	}
+
+	// And each module's own secrets: a module handed to the provisioner has its secrets from the vault through the client.
+	handing := catalogue.Rendering{Hands: r.Hands, Provisioner: r.Provisioner, Assigned: r.Assigned}
+	needed, foreseenOwn, err := c.ownSecretsFor(node, plan, handing, mode)
+	if err != nil {
+		return Rendered{}, err
+	}
+	r.Needed = needed
+	if mode == Foreseeing || mode == Planning || len(foreseenOwn) > 0 {
+		r.Foreseen = foreseenOwn
+	}
+	var names []string
+	for module, secrets := range foreseenOwn {
+		for name := range secrets {
+			names = append(names, module+"/"+name)
+		}
+	}
+	sort.Strings(names)
+	for _, n := range names {
+		foreseen(n)
+	}
+
+	// The core's own credentials as the vault sealed them, for an engine that opens the vault's box.
+	if node.Stated && node.Contract >= VaultBoxContract {
+		sealed, notPlaced, wanted := c.coreBoxesFor(node, plan.Modules, handing)
+		r.VaultSealed, r.NotPlaced = sealed, notPlaced
+		out.CoreBoxesWanted = wanted
+	}
+
+	// And a certificate for this machine's name inside the mesh, when anything on it asks.
+	for _, m := range plan.Modules {
+		if m.Certificate == nil {
+			continue
+		}
+		certificate, authority, stood, err := c.certificateFor(node)
+		if err != nil {
+			return Rendered{}, err
+		}
+		r.Certificate, r.Authority = certificate, authority
+		if stood {
+			foreseen("the certificate and the authority of " + nodeName)
+		}
+		break
+	}
+
+	// The bus's user list, for the machine that runs the bus: names and hashes the Input carries, never passwords.
+	if holdsTheBus(plan.Modules) {
+		r.BusUsers = c.in.BusUsers
+		if r.BusUsers == "" {
+			r.BusUsers = ForeseenBusUsers
+			foreseen(BusUsersStandIn)
+		}
+		if len(c.in.BusMissing) > 0 {
+			out.Said = append(out.Said, fmt.Sprintf("the bus's user list leaves out %d user(s) the mesh has minted no credential "+
+				"for: %s. Each is a user that cannot connect until one is issued", len(c.in.BusMissing), strings.Join(c.in.BusMissing, ", ")))
+		}
+	}
+	r.BusMembership = c.in.BusMemberships[nodeName]
+	out.Rendering = r
+	// And what the composition found on the way, which the controller writes to its log: a machine not counted as on the network.
+	out.Said = c.saidBeside(out.Said)
+	return out, nil
+}
diff --git a/internal/compose/rendering.go b/internal/compose/rendering.go
new file mode 100644
index 0000000..c8db3e0
--- /dev/null
+++ b/internal/compose/rendering.go
@@ -0,0 +1,544 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// The contracts of the node-engine's statement that gate what a machine is sent, as the controller's link package names them
+// (mesh-controller internal/link/protocol.go at 6c2a8d62). An older engine parses strictly and refuses a field it does not
+// know, whole.
+const (
+	ReadinessContract = 2  // the engine reads a resource's `health` (novox/hq ADR 0240)
+	RootContract      = 3  // the engine judges a user's declared `root` (ADR 0266)
+	BusyContract      = 8  // the engine reads a container's `busy` (ADR 0335)
+	HandedContract    = 11 // the engine writes a filled file on the provisioner client's word alone
+	VaultBoxContract  = 12 // the engine opens the vault's box
+)
+
+// The provisioner client's seat and own secret (the controller's broker.NodeProvisionerSeat and ProvisionerSecret).
+const (
+	NodeProvisionerSeat = "node-provisioner"
+	ProvisionerSecret   = "provisioner-broker"
+)
+
+// ErrPortTaken is the controller's refusal for a machine port held twice on one machine.
+var ErrPortTaken = errors.New("that port is already held on this machine")
+
+// Placed is the place half of a rendering (plan.go renderingFor): where a machine puts what its modules need reachable, the
+// seats and who holds them, the names of the mesh, the networks, accounts and the operator's export. It is a catalogue.Rendering
+// with those fields set, and the ports it could not read named foreseen. Nothing was allocated.
+type Placed struct {
+	Rendering catalogue.Rendering
+	// ForeseenPorts are the ports the mesh may assign that the Input holds none for, as "<module>:<port>": composed with the
+	// manifest's own number as the Reading mode composes them, and never invented. The controller's adapter allocates and
+	// composes again.
+	ForeseenPorts []string
+}
+
+// Places composes the place half of the rendering for a node (the controller's renderingFor in the Reading and Foreseeing modes,
+// without the credentials): over an Input, allocating nothing and changing nothing in it. The refusals are the controller's,
+// in its words.
+func Places(in Input, node string) (Placed, error) {
+	c := newComposer(in)
+	resolved, err := c.planFor(node)
+	if err != nil {
+		return Placed{}, err
+	}
+	return c.places(node, resolved)
+}
+
+func (c *composer) places(nodeName string, resolved Resolved) (Placed, error) {
+	var out Placed
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return out, err
+	}
+	plan, settings := resolved.Plan, resolved.Settings
+	r := &out.Rendering
+
+	// Where this machine puts what each module needs reachable (novox/hq ADR 0038): what it was already given, and the ports
+	// it was given over those (ADR 0100).
+	given, err := c.portsFor(node, plan, settings, r, &out.ForeseenPorts)
+	if err != nil {
+		return out, err
+	}
+
+	// Hands: whether the engine writes a filled file on the provisioner client's word alone; engines older than a contract are
+	// not sent the field they would refuse.
+	r.Hands = takesHanded(node)
+	r.Provisioner = provisionerAccount(plan)
+	r.Assigned = node.Handed
+	r.ReadsHealth = node.Stated && node.Contract >= ReadinessContract
+	r.JudgesRoot = node.Stated && node.Contract >= RootContract
+	r.ReadsBusy = node.Stated && node.Contract >= BusyContract
+
+	// And who else is on the private network, which is what a rule saying "from the mesh" resolves to.
+	r.Mesh = c.onThePrivateNetwork()
+	// The private network's range, offered to a module as ${machine:mesh-range}.
+	r.MeshRange = c.overlayRange()
+
+	// The artifact store as this node reaches it now, with what the mesh has built.
+	store, err := c.artifactStoreAddress(nodeName)
+	if err != nil {
+		return out, err
+	}
+	r.ArtifactStore = store
+	r.Built = make(map[string]bool, len(c.in.Built))
+	for _, repository := range c.in.Built {
+		r.Built[repository] = true
+	}
+
+	// And every machine's name, so a container can reach one.
+	r.Names = c.namesInTheMesh()
+
+	// Each machine's operator account, so an ssh Host block can name the login for every node (novox/hq to-be 29).
+	r.Accounts = map[string]string{}
+	for _, n := range c.in.sorted() {
+		if n.Account != "" {
+			r.Accounts[n.Name] = n.Account
+		}
+	}
+
+	// The roster is the machines and nothing else (novox/hq ADR 0191).
+	r.Machines = make(map[string]string, len(r.Names))
+	for name, at := range r.Names {
+		r.Machines[name] = at
+	}
+
+	// And every zone a module in the mesh answers itself (novox/hq ADR 0199).
+	zones, err := c.zonesInTheMesh()
+	if err != nil {
+		return out, err
+	}
+	r.Zones = zones
+
+	// And who holds each replicated seat, where (novox/hq ADR 0223).
+	r.Holders = c.replicatedHolders()
+
+	r.Suffix, r.TunnelInterface = c.suffix(), overlay.Interface
+
+	// And, for a module that keeps them, every operator-sealed secret in the mesh (novox/hq ADR 0085, amended).
+	for _, m := range plan.Modules {
+		if m.Keeps == "" {
+			continue
+		}
+		r.Kept = c.in.OperatorExport
+		if r.Kept == nil {
+			r.KeptRuns = c.in.KeptRuns[node.Name]
+		}
+		break
+	}
+
+	// Whether this node is adopted (novox/hq ADR 0100), and which modules were taken there.
+	r.Adopted = node.Adopted
+	var taken map[string]bool
+	if node.Adopted {
+		taken = map[string]bool{}
+		for _, m := range node.Taken {
+			taken[m] = true
+		}
+	}
+	r.Taken = taken
+
+	// Where this node put the foundation's servers (novox/hq 04-ISSUES/102).
+	seats, err := c.seatsOn(node, plan.Modules, node.Adopted, taken)
+	if err != nil {
+		return out, err
+	}
+	r.Seats = seats
+
+	// Which of this machine's links face outside (novox/hq ADR 0140), and which of its networks count as its local network
+	// (ADR 0340).
+	r.OutwardLinks = node.OutwardLinks
+	r.LocalNetworks = resolution.CountedLocalNetworks(localNetworksOf(node))
+
+	// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR 0222).
+	if store != "" {
+		r.SeatReach = map[string]string{"mesh-artifact-store": store}
+	}
+	r.Settings = settings
+	r.Given = given
+	return out, nil
+}
+
+// takesHanded says whether a machine's newest statement is of an engine that writes a filled file on the provisioner client's
+// word alone.
+func takesHanded(n Node) bool { return n.Stated && n.Contract >= HandedContract }
+
+// provisionerAccount is the account the provisioner's client runs as on this machine (novox/hq ADR 0349 clause 4): the user
+// the process of the module running it runs as, empty where no such module is on the machine.
+func provisionerAccount(plan catalogue.Resolution) string {
+	for _, m := range plan.Modules {
+		if !runsTheProvisionerClient(m) {
+			continue
+		}
+		for _, r := range m.Resources {
+			if r["type"] == "process" {
+				if user, _ := r["user"].(string); user != "" && user != "root" {
+					return user
+				}
+			}
+		}
+	}
+	return ""
+}
+
+// runsTheProvisionerClient says a module runs its machine's provisioner client: it claims the seat and declares the own
+// secret that account is delivered in.
+func runsTheProvisionerClient(m catalogue.Manifest) bool {
+	_, reads := m.OwnSecrets[ProvisionerSecret]
+	return reads && m.ClaimsSeat(NodeProvisionerSeat)
+}
+
+// portsFor is where a node puts what each module needs reachable, in the Reading mode: the ports it was given win, then the
+// ones the mesh assigned, and a port the Input holds none for is composed as the manifest says and named foreseen. One holder
+// per machine port across the node's modules: settings written before this was refused are refused here.
+func (c *composer) portsFor(node Node, plan catalogue.Resolution, settings catalogue.SettingsBy, r *catalogue.Rendering,
+	foreseen *[]string) (map[string]map[int]int, error) {
+	already := node.Ports
+
+	given := map[string]map[int]int{}
+	for _, m := range plan.Modules {
+		g, err := resolution.GivenPorts(m, settings[m.Module])
+		if err != nil {
+			// A given port its definition no longer publishes: the module is left out of the declaration, by name, when it is
+			// composed (novox/hq ADR 0163, rule 6) -- never the machine refused here for it.
+			continue
+		}
+		if g != nil {
+			given[m.Module] = g
+		}
+	}
+	holders := map[int]string{}
+	for _, m := range plan.Modules {
+		for _, at := range given[m.Module] {
+			if other, twice := holders[at]; twice && other != m.Module {
+				return nil, fmt.Errorf("%w: %s and %s are both given machine port %d on %s", ErrPortTaken, other, m.Module,
+					at, node.Name)
+			}
+			holders[at] = m.Module
+		}
+	}
+
+	ports := map[string]map[int]int{}
+	for _, m := range plan.Modules {
+		for _, l := range m.Listens {
+			if at, isGiven := given[m.Module][l.Port]; isGiven {
+				if ports[m.Module] == nil {
+					ports[m.Module] = map[int]int{}
+				}
+				ports[m.Module][l.Port] = at
+				continue
+			}
+			// Only a port the module actually publishes is the mesh's to move. Recorded either way, because this map means where
+			// this module's port is on this machine.
+			where, mayAssign := m.MachineSide(l.Port)
+			if mayAssign {
+				// Whatever was chosen last time, and nothing if there was no last time.
+				if at, known := already[m.Module][l.Port]; known {
+					where = at
+				} else {
+					*foreseen = append(*foreseen, fmt.Sprintf("%s:%d", m.Module, l.Port))
+				}
+			}
+			if ports[m.Module] == nil {
+				ports[m.Module] = map[int]int{}
+			}
+			ports[m.Module][l.Port] = where
+		}
+	}
+	r.Ports = ports
+	return given, nil
+}
+
+// onThePrivateNetwork is every node's address on the private network, sorted: the same set the names mean by it, so a rule
+// saying "from the mesh" admits exactly the machines the mesh names. A node with no address is left out, not rendered as an
+// empty source.
+func (c *composer) onThePrivateNetwork() []string {
+	var out []string
+	for _, p := range c.onTheNetwork() {
+		if strings.TrimSpace(p.Place.Address) != "" {
+			out = append(out, p.Place.Address)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// namesInTheMesh is every machine's internal name and the address behind it, for every machine on the private network, and
+// the carried peers the operator has named (novox/hq issue 112).
+func (c *composer) namesInTheMesh() map[string]string {
+	out := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		out[c.internalName(p.Name)] = p.Place.Address
+	}
+	for _, p := range c.in.CarriedPeers {
+		if p.Named == "" || p.EnrolledAs != "" {
+			continue
+		}
+		if _, taken := out[c.internalName(p.Named)]; taken {
+			continue // a node of the mesh owns the name; the stale statement loses
+		}
+		out[c.internalName(p.Named)] = p.Address
+	}
+	return out
+}
+
+// artifactStoreOnNetwork is the machine on this network that offers the artifact store, and the port that machine put it on.
+func (c *composer) artifactStoreOnNetwork(on map[string]bool) (node, port string, found bool, err error) {
+	providers := map[string]catalogue.Manifest{}
+	for name, m := range c.in.Catalogue {
+		if _, offers := m.Serves[catalogue.ArtifactStoreProvision]; offers {
+			providers[name] = m
+		}
+	}
+	if len(providers) == 0 {
+		return "", "", false, nil
+	}
+	// In a stated order, so two machines offering it would always answer the same one.
+	machines := make([]string, 0, len(on))
+	for machine := range on {
+		machines = append(machines, machine)
+	}
+	sort.Strings(machines)
+	for _, machine := range machines {
+		n, err := c.in.node(machine)
+		if err != nil {
+			return "", "", false, fmt.Errorf("reading what %s is assigned: %w", machine, err)
+		}
+		for _, a := range n.Assigned {
+			m, offers := providers[a]
+			if !offers {
+				continue
+			}
+			serves, _, err := c.servedOnNode(machine, m, catalogue.ArtifactStoreProvision)
+			if err != nil {
+				return "", "", false, fmt.Errorf("reading where %s puts the artifact store: %w", machine, err)
+			}
+			if p, ok := serves["port"]; ok {
+				return machine, fmt.Sprintf("%v", p), true, nil
+			}
+		}
+	}
+	return "", "", false, nil
+}
+
+// ArtifactStoreAddress is the artifact store as node reaches it, by the rule its composition routes every kept reference
+// with (artifactStoreAddress): empty when node reaches none. A node composing its own modules reads a templates archive
+// there (issue 1126).
+func ArtifactStoreAddress(in Input, node string) (string, error) {
+	return newComposer(in).artifactStoreAddress(node)
+}
+
+// artifactStoreAddress is the artifact store as `forNode` reaches it: `<node>.internal:<port>` over the private network, or
+// `127.0.0.1:<port>` for the node that holds the store itself when nothing is on the network yet, and empty for any other
+// (novox/hq 04-ISSUES/102).
+func (c *composer) artifactStoreAddress(forNode string) (string, error) {
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return "", err
+	}
+	on := map[string]bool{}
+	for name := range onNetwork {
+		on[name] = true
+	}
+	node, port, found, err := c.artifactStoreOnNetwork(on)
+	if err != nil {
+		return "", err
+	}
+	if found {
+		return c.internalName(node) + ":" + port, nil
+	}
+	all := map[string]bool{}
+	for _, n := range c.in.Nodes {
+		all[n.Name] = true
+	}
+	holder, port, found, err := c.artifactStoreOnNetwork(all)
+	if err != nil || !found || holder != forNode {
+		return "", err
+	}
+	return "127.0.0.1:" + port, nil
+}
+
+// zonesInTheMesh is every zone a module in the mesh declares, where the mesh placed it (novox/hq ADR 0199): the zone settled
+// from that node's settings, the node's private address, the port the answering listen is published on there. A node whose set
+// does not compose declares nothing and is passed over; what the mesh refuses about the zones together is refused, by name.
+func (c *composer) zonesInTheMesh() ([]catalogue.ZoneAt, error) {
+	address := map[string]string{}
+	for _, n := range c.in.sorted() {
+		if strings.TrimSpace(n.Place.Address) != "" {
+			address[n.Name] = n.Place.Address
+		}
+	}
+	var zones []catalogue.ZoneAt
+	var public []string
+	for _, n := range c.in.sorted() {
+		resolved, err := c.planFor(n.Name)
+		switch {
+		case unresolvable(err):
+			continue
+		case err != nil:
+			return nil, fmt.Errorf("the zones %s answers cannot be read: %w", n.Name, err)
+		}
+		plan := resolved.Plan
+		if plan.PublicDomain != "" {
+			public = append(public, plan.PublicDomain)
+		}
+		for _, m := range plan.Modules {
+			if m.Zone == nil {
+				continue
+			}
+			at := address[n.Name]
+			if at == "" {
+				// Not on the private network yet: nothing could reach its answerer.
+				continue
+			}
+			published, layers, err := c.portsGivenOn(n.Name, m)
+			if err != nil {
+				return nil, fmt.Errorf("the zone %s declares on %s cannot be read: %w", m.Module, n.Name, err)
+			}
+			z, err := resolution.ZoneOn(m, layers, published, n.Name, at)
+			if err != nil {
+				return nil, err
+			}
+			zones = append(zones, *z)
+		}
+	}
+	if problems := resolution.ZonesProblems(zones, c.suffix(), public); len(problems) > 0 {
+		return nil, fmt.Errorf("the mesh's zones cannot be forwarded:\n  - %s", strings.Join(problems, "\n  - "))
+	}
+	return zones, nil
+}
+
+// replicatedHolders is, for each replicated mesh seat, every machine on the private network holding it, by internal name at its
+// private address (novox/hq ADR 0223): the holders on record, and only the sole claimant when there are none. A holder off
+// the private network is left out.
+func (c *composer) replicatedHolders() map[string]map[string]string {
+	var replicated []catalogue.Seat
+	for _, s := range catalogue.Seats() {
+		if s.Replicated && s.Scope == catalogue.ScopeMesh {
+			replicated = append(replicated, s)
+		}
+	}
+	if len(replicated) == 0 {
+		return nil
+	}
+	address := map[string]string{}
+	for _, p := range c.onTheNetwork() {
+		address[p.Name] = p.Place.Address
+	}
+	// Every module of the catalogue with the nodes it is assigned on, sorted, as the controller's Catalogued answers.
+	on := map[string][]string{}
+	for _, n := range c.in.sorted() {
+		for _, module := range n.Assigned {
+			on[module] = append(on[module], n.Name)
+		}
+	}
+	names := make([]string, 0, len(c.in.Catalogue))
+	for name := range c.in.Catalogue {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	out := map[string]map[string]string{}
+	for _, seat := range replicated {
+		var nodes []string
+		for _, h := range c.in.Holdings {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope {
+				nodes = append(nodes, h.Node)
+			}
+		}
+		if len(nodes) == 0 {
+			var derived []string
+			for _, name := range names {
+				for _, cl := range c.in.Catalogue[name].Claims {
+					if cs, ok := catalogue.SeatNamed(cl.Name); ok && cs.Name == seat.Name && cl.At() == seat.Scope {
+						derived = append(derived, on[name]...)
+					}
+				}
+			}
+			if len(derived) == 1 {
+				nodes = derived
+			}
+		}
+		at := map[string]string{}
+		for _, n := range nodes {
+			if address[n] != "" {
+				at[c.internalName(n)] = address[n]
+			}
+		}
+		out[seat.Name] = at
+	}
+	return out
+}
+
+// seatsOn is where a node put the holder of each mesh-scoped seat, by seat and by the port the holder's software uses: what
+// ${seat:...} answers with (novox/hq 04-ISSUES/102). Read for every module in the catalogue that claims a seat, in this node's set
+// or not; a holder in this node's set wins over one that is not.
+func (c *composer) seatsOn(node Node, inSet []catalogue.Manifest, adopted bool, taken map[string]bool) (map[string]map[int]int, error) {
+	assigned := map[string]bool{}
+	for _, m := range inSet {
+		assigned[m.Module] = true
+	}
+	names := make([]string, 0, len(c.in.Catalogue))
+	for name := range c.in.Catalogue {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	seats := map[string]map[int]int{}
+	for _, name := range names {
+		m := c.in.Catalogue[name]
+		var claims []string
+		for _, cl := range m.Claims {
+			if cl.At() == catalogue.ScopeMesh {
+				claims = append(claims, cl.Name)
+			}
+		}
+		if len(claims) == 0 {
+			continue
+		}
+		// Only a port the node was given or the mesh assigned, never the manifest's own number. And on an adopted node a holder
+		// assigned but not yet taken is the found container, so its mesh-assigned ports do not count there; a given port does.
+		ports, _, err := c.portsGivenOn(node.Name, m)
+		if err != nil {
+			return nil, err
+		}
+		if adopted && !taken[name] {
+			layers := node.Settings[m.Module]
+			ports = map[int]int{}
+			if given, err := resolution.GivenPorts(m, layers); err == nil {
+				ports = given
+			}
+		}
+		if len(ports) == 0 {
+			continue
+		}
+		for _, seat := range claims {
+			if seats[seat] == nil {
+				seats[seat] = map[int]int{}
+			}
+			for wanted, at := range ports {
+				if _, said := seats[seat][wanted]; said && !assigned[name] {
+					continue
+				}
+				seats[seat][wanted] = at
+			}
+		}
+	}
+	return seats, nil
+}
+
+// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local network, from what it
+// last said of itself and the links it said face outside it. A machine that has said none judges to nothing.
+func localNetworksOf(n Node) []catalogue.LocalNetwork {
+	if !n.NetworksSaid {
+		return nil
+	}
+	return resolution.JudgeLocalNetworks(n.Networks, n.OutwardLinks, overlay.Interface)
+}
diff --git a/internal/compose/rendering_test.go b/internal/compose/rendering_test.go
new file mode 100644
index 0000000..54b9c71
--- /dev/null
+++ b/internal/compose/rendering_test.go
@@ -0,0 +1,329 @@
+package compose
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// aWebModule publishes one port in the short form, which the mesh is free to move (MachineSide).
+func aWebModule() catalogue.Manifest {
+	return catalogue.Manifest{Module: "web", Version: "1",
+		Listens: []catalogue.Listening{{Name: "http", Port: 8080, From: catalogue.FromMesh}},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "web", "ports": []any{"8080"},
+			"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)}}}
+}
+
+// aStoreModule is mesh-controller's sendable_integration_test.go TestConsumersAreToldTheGivenPort store (cmd/mesh-controller
+// at 6c2a8d62): publishing 5432:5432, offering a database to the mesh.
+func aStoreModule() catalogue.Manifest {
+	return catalogue.Manifest{Module: "store", Version: "1",
+		Provides: []catalogue.Offer{{Name: "database", Scope: catalogue.ScopeMesh}},
+		Listens:  []catalogue.Listening{{Port: 5432, From: catalogue.FromMesh}},
+		Guards:   []int{5432},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
+			"ports": []any{"5432:5432"},
+			"image": "registry.example/pg@sha256:" + strings.Repeat("b", 64)}}}
+}
+
+func placed(t *testing.T, in Input, node string) Placed {
+	t.Helper()
+	got, err := Places(in, node)
+	if err != nil {
+		t.Fatalf("%v", err)
+	}
+	return got
+}
+
+// 1363/AC1 and AC2: a port the Input holds as allocated on the node is the one composed; with none, no number is invented: the
+// manifest's own is composed and the port is named foreseen, as the Foreseeing mode does.
+func TestAnAllocatedPortIsComposedAndAnUnallocatedOneIsNamedForeseenNotInvented(t *testing.T) {
+	mk := func() Input {
+		in := aMesh(t)
+		in.Catalogue["web"] = aWebModule()
+		nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "web")
+		return in
+	}
+	in := mk()
+	got := placed(t, in, "laptop")
+	if p := got.Rendering.Ports["web"][8080]; p != 8080 {
+		t.Errorf("a port nobody allocated is composed as %d, not as the manifest's own", p)
+	}
+	if len(got.ForeseenPorts) != 1 || got.ForeseenPorts[0] != "web:8080" {
+		t.Errorf("foreseen ports are %v", got.ForeseenPorts)
+	}
+	nodeOf(t, &in, "laptop").Ports = map[string]map[int]int{"web": {8080: 20123}}
+	got = placed(t, in, "laptop")
+	if p := got.Rendering.Ports["web"][8080]; p != 20123 || len(got.ForeseenPorts) != 0 {
+		t.Errorf("the allocated port is composed as %d (foreseen %v)", p, got.ForeseenPorts)
+	}
+	// A port the module does not publish is not the mesh's to move, so it is never foreseen.
+	m := aWebModule()
+	m.Resources = nil
+	in.Catalogue["web"] = m
+	nodeOf(t, &in, "laptop").Ports = nil
+	got = placed(t, in, "laptop")
+	if got.Rendering.Ports["web"][8080] != 8080 || len(got.ForeseenPorts) != 0 {
+		t.Errorf("an unpublished port: %v foreseen %v", got.Rendering.Ports, got.ForeseenPorts)
+	}
+	unchanged(t, mk, func(in Input) { placed(t, in, "laptop") })
+	// Only a composition for plans refuses a contribution whose port the module does not listen on (issue 774).
+	for _, mode := range []Mode{Reading, Foreseeing, Planning} {
+		if got := rendered(t, mk(), "laptop", mode).Rendering; got.Planned != (mode == Planning) {
+			t.Errorf("mode %d composes with Planned %v", mode, got.Planned)
+		}
+	}
+}
+
+// 1363/AC3: a port the operator gave is used, over the allocated one, and a consumer elsewhere is told it
+// (mesh-controller sendable_integration_test.go TestConsumersAreToldTheGivenPort).
+func TestAPortTheOperatorGaveIsUsedAndNotReallocated(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["store"] = aStoreModule()
+	in.Catalogue["app"] = catalogue.Manifest{Module: "app", Version: "1", Requires: []string{"database"}}
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "store")
+	nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "app")
+	anchor.Ports = map[string]map[int]int{"store": {5432: 20999}}
+	anchor.Settings = map[string][]catalogue.Layer{"store": {{From: "anchor",
+		Placement: map[string]any{catalogue.PortsSetting: map[string]any{"5432": 5433}}}}}
+
+	got := placed(t, in, "anchor")
+	if p := got.Rendering.Ports["store"][5432]; p != 5433 {
+		t.Errorf("the store is on %d, not the port it was given", p)
+	}
+	if g := got.Rendering.Given["store"][5432]; g != 5433 {
+		t.Errorf("the given port is %d", g)
+	}
+	if len(got.ForeseenPorts) != 0 {
+		t.Errorf("a given port is foreseen: %v", got.ForeseenPorts)
+	}
+	resolved, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if told := need(t, resolved.Plan, "app", "database").Serves["port"]; told != 5433 {
+		t.Errorf("the consumer is told the store is on %v", told)
+	}
+
+	// One holder per machine port across the node's modules: two given the same refused, in the controller's words.
+	in.Catalogue["store2"] = func() catalogue.Manifest {
+		m := aStoreModule()
+		m.Module, m.Provides = "store2", nil
+		m.Resources = []map[string]any{{"id": "server", "type": "container", "name": "other", "ports": []any{"5432:5432"},
+			"image": "registry.example/pg@sha256:" + strings.Repeat("c", 64)}}
+		return m
+	}()
+	anchor.Assigned = append(anchor.Assigned, "store2")
+	anchor.Settings["store2"] = []catalogue.Layer{{From: "anchor",
+		Placement: map[string]any{catalogue.PortsSetting: map[string]any{"5432": 5433}}}}
+	_, err = Places(in, "anchor")
+	if err == nil || !errors.Is(err, ErrPortTaken) || !strings.Contains(err.Error(), "store and store2 are both given machine port 5433 on anchor") &&
+		!strings.Contains(err.Error(), "store2 and store are both given machine port 5433 on anchor") {
+		t.Fatalf("two modules given one machine port: %v", err)
+	}
+}
+
+// 1363/AC4: the seats held and taken reach the Rendering: where each mesh-scoped seat's holder put its ports, from the node's
+// given and assigned ports, never the manifest's own; and on an adopted node a holder assigned but not taken counts only by its
+// given ports (novox/hq ADR 0100).
+func TestSeatsHeldAndTakenReachTheRendering(t *testing.T) {
+	in := aMesh(t)
+	holder := aStoreModule()
+	holder.Claims = []catalogue.Claim{{Name: "mesh-store", Scope: catalogue.ScopeMesh}}
+	in.Catalogue["store"] = holder
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "store")
+	// The shelf is read whole, in this node's set or not: laptop, running none, is told where the anchor's store is only by the
+	// settings and ports of its own machine, which it has none of.
+	anchor.Ports = map[string]map[int]int{"store": {5432: 20999}}
+	got := placed(t, in, "anchor")
+	if at := got.Rendering.Seats["mesh-store"][5432]; at != 20999 {
+		t.Errorf("the seat's holder is told to be on %d", at)
+	}
+	if len(placed(t, in, "laptop").Rendering.Seats) != 0 {
+		t.Errorf("laptop is told of a holder it has no port for: %v", placed(t, in, "laptop").Rendering.Seats)
+	}
+	// Adopted, and the holder assigned but not taken: the found container's ports, not the mesh's assignment.
+	anchor.Adopted = true
+	if len(placed(t, in, "anchor").Rendering.Seats) != 0 {
+		t.Errorf("an untaken holder on an adopted node counts by the mesh's assignment: %v", placed(t, in, "anchor").Rendering.Seats)
+	}
+	anchor.Taken = []string{"store"}
+	got = placed(t, in, "anchor")
+	if at := got.Rendering.Seats["mesh-store"][5432]; at != 20999 || !got.Rendering.Adopted || !got.Rendering.Taken["store"] {
+		t.Errorf("a taken holder: seats %v adopted %v taken %v", got.Rendering.Seats, got.Rendering.Adopted, got.Rendering.Taken)
+	}
+}
+
+// 1363/AC4: local networks and outward links (mesh-controller local_network_test.go TestNodeShowsWhichAttachedNetworksCountAndWhy,
+// the values): a private network on a link facing outside counts, a public subnet and the private network's own link never do; a
+// machine that said none judges to nothing.
+func TestLocalNetworksAndOutwardLinksReachTheRendering(t *testing.T) {
+	in := aMesh(t)
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.OutwardLinks = []string{"eth0", "eth1"}
+	laptop.Networks = []catalogue.AttachedNetwork{
+		{Link: "eth0", Network: "192.168.1.10/24"}, {Link: "eth1", Network: "203.0.113.7/24"}, {Link: overlay.Interface, Network: "10.10.0.4/24"}}
+	laptop.NetworksSaid = true
+	got := placed(t, in, "laptop").Rendering
+	if len(got.LocalNetworks) != 1 || got.LocalNetworks[0] != "192.168.1.0/24" {
+		t.Errorf("the local networks are %v", got.LocalNetworks)
+	}
+	if len(got.OutwardLinks) != 2 || got.OutwardLinks[0] != "eth0" {
+		t.Errorf("the outward links are %v", got.OutwardLinks)
+	}
+	laptop.NetworksSaid = false
+	if got := placed(t, in, "laptop").Rendering; len(got.LocalNetworks) != 0 {
+		t.Errorf("a machine that never reported has local networks %v", got.LocalNetworks)
+	}
+}
+
+// 1363/AC4: accounts, the names of the mesh, the mesh range and the operator's export reach the Rendering.
+func TestAccountsNamesAndTheOperatorsExportReachTheRendering(t *testing.T) {
+	in := aMesh(t)
+	nodeOf(t, &in, "anchor").Account = "jochens"
+	in.OperatorExport = &catalogue.KeptExport{}
+	in.OverlayCIDR = "10.99.0.0/16"
+	got := placed(t, in, "anchor").Rendering
+	if got.Accounts["anchor"] != "jochens" || len(got.Accounts) != 1 {
+		t.Errorf("accounts are %v", got.Accounts)
+	}
+	if got.Names["anchor.internal"] != "10.77.0.1" || got.Names["laptop.internal"] != "10.77.0.2" || len(got.Names) != 2 {
+		t.Errorf("names are %v", got.Names)
+	}
+	if len(got.Machines) != 2 || got.Machines["laptop.internal"] != "10.77.0.2" {
+		t.Errorf("machines are %v", got.Machines)
+	}
+	if len(got.Mesh) != 2 || got.Mesh[0] != "10.77.0.1" || got.Mesh[1] != "10.77.0.2" {
+		t.Errorf("the mesh's addresses are %v", got.Mesh)
+	}
+	if got.MeshRange != "10.99.0.0/16" || got.Suffix != "internal" || got.TunnelInterface != overlay.Interface {
+		t.Errorf("range %q suffix %q tunnel %q", got.MeshRange, got.Suffix, got.TunnelInterface)
+	}
+	if got.Kept != nil {
+		t.Error("the operator's export reaches a node where nothing keeps it")
+	}
+	keeper := catalogue.Manifest{Module: "keeper", Version: "1", Keeps: "/var/lib/keeper/export.json"}
+	in.Catalogue["keeper"] = keeper
+	nodeOf(t, &in, "anchor").Assigned = append(nodeOf(t, &in, "anchor").Assigned, "keeper")
+	if got := placed(t, in, "anchor").Rendering; got.Kept != in.OperatorExport {
+		t.Errorf("a module that keeps the export is not given it: %v", got.Kept)
+	}
+	// And the names of a machine that left the network leave with it.
+	nodeOf(t, &in, "laptop").Assigned = nil
+	if got := placed(t, in, "anchor").Rendering; len(got.Names) != 1 || got.Names["laptop.internal"] != "" {
+		t.Errorf("a machine off the network is named: %v", got.Names)
+	}
+}
+
+// The names the operator gave to peers of an adopted tunnel answer until they enrol (novox/hq issue 112); a node of the mesh owns
+// its name.
+func TestACarriedPeerIsNamedUntilItEnrols(t *testing.T) {
+	in := aMesh(t)
+	in.CarriedPeers = []CarriedPeer{{PublicKey: "K1", Address: "192.0.2.5", Named: "printer"},
+		{PublicKey: "K2", Address: "192.0.2.6", Named: "laptop"}, {PublicKey: "K3", Address: "192.0.2.7", Named: "late", EnrolledAs: "late"}}
+	got := placed(t, in, "anchor").Rendering
+	if got.Names["printer.internal"] != "192.0.2.5" || got.Names["laptop.internal"] != "10.77.0.2" || got.Names["late.internal"] != "" {
+		t.Errorf("names are %v", got.Names)
+	}
+}
+
+// A node-engine older than a contract is not sent the field it would refuse (novox/hq ADR 0240 and after).
+func TestTheNodeEnginesContractGatesWhatItIsSent(t *testing.T) {
+	in := aMesh(t)
+	laptop := nodeOf(t, &in, "laptop")
+	if r := placed(t, in, "laptop").Rendering; r.ReadsHealth || r.JudgesRoot || r.ReadsBusy || r.Hands {
+		t.Errorf("an engine that never stated anything reads %+v", r)
+	}
+	laptop.Stated, laptop.Contract = true, ReadinessContract
+	if r := placed(t, in, "laptop").Rendering; !r.ReadsHealth || r.JudgesRoot || r.ReadsBusy || r.Hands {
+		t.Errorf("an engine at the readiness contract reads %+v", r)
+	}
+	laptop.Contract = HandedContract
+	if r := placed(t, in, "laptop").Rendering; !r.ReadsHealth || !r.JudgesRoot || !r.ReadsBusy || !r.Hands {
+		t.Errorf("an engine at the handed contract reads %+v", r)
+	}
+}
+
+// The artifact store as a node reaches it: over the private network by its holder's name and the port it put it on, or on loopback
+// for the holder alone while nothing is on the network (novox/hq 04-ISSUES/102).
+func TestTheArtifactStoreIsReachedOverTheNetworkOrOnLoopbackForItsHolder(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["artifacts"] = catalogue.Manifest{Module: "artifacts", Version: "1",
+		Serves: map[string]map[string]any{catalogue.ArtifactStoreProvision: {"port": 5100}}}
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "artifacts")
+	if got := placed(t, in, "laptop").Rendering.ArtifactStore; got != "anchor.internal:5100" {
+		t.Errorf("laptop reaches the store at %q", got)
+	}
+	nodeOf(t, &in, "laptop").Assigned = nil
+	anchor.Assigned = []string{"artifacts"} // off the network: the holder alone reaches it
+	if got := placed(t, in, "anchor").Rendering.ArtifactStore; got != "127.0.0.1:5100" {
+		t.Errorf("the holder reaches the store at %q", got)
+	}
+	if got := placed(t, in, "laptop").Rendering.ArtifactStore; got != "" {
+		t.Errorf("a machine off the network reaches the store at %q", got)
+	}
+	in.Built = []string{"mesh-sdk"}
+	if got := placed(t, in, "anchor").Rendering.Built; !got["mesh-sdk"] {
+		t.Errorf("built is %v", got)
+	}
+}
+
+// A zone a module declares is placed where the mesh put it: settled from that node's settings, at the node's private address, on
+// the port the answering listen is published on there (novox/hq ADR 0199); the same zone declared twice is refused, by name.
+func TestAZoneIsPlacedWhereTheMeshPutItAndTheSameZoneTwiceIsRefused(t *testing.T) {
+	in := aMesh(t)
+	lab := catalogue.Manifest{Module: "lab", Version: "1", Zone: &catalogue.Zone{Name: "${setting:zone}", Listen: "dns"},
+		Listens: []catalogue.Listening{{Name: "dns", Port: 53, Protocol: "udp", From: catalogue.FromMesh}}}
+	in.Catalogue["lab"] = lab
+	anchor := nodeOf(t, &in, "anchor")
+	anchor.Assigned = append(anchor.Assigned, "lab")
+	anchor.Settings = map[string][]catalogue.Layer{"lab": {{From: "anchor", Values: map[string]any{"zone": "Lab.Example."}}}}
+	anchor.Ports = map[string]map[int]int{"lab": {53: 5353}}
+	zones := placed(t, in, "laptop").Rendering.Zones
+	if len(zones) != 1 || zones[0] != (catalogue.ZoneAt{Zone: "lab.example", Node: "anchor", Module: "lab", Address: "10.77.0.1", Port: 5353}) {
+		t.Fatalf("zones are %+v", zones)
+	}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "lab")
+	laptop.Settings = map[string][]catalogue.Layer{"lab": {{From: "laptop", Values: map[string]any{"zone": "lab.example"}}}}
+	if _, err := Places(in, "laptop"); err == nil || !strings.Contains(err.Error(), "the mesh's zones cannot be forwarded") {
+		t.Fatalf("one zone declared twice: %v", err)
+	}
+}
+
+// Every holder of a replicated seat is listed by internal name at its private address (novox/hq ADR 0223): the holders on record,
+// and only the sole claimant when there are none; a holder off the private network is left out.
+func TestEveryHolderOfAReplicatedSeatIsListedOnTheNetwork(t *testing.T) {
+	in := aMesh(t)
+	resolver := catalogue.Manifest{Module: "resolver", Version: "1",
+		Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}},
+		Claims:   []catalogue.Claim{{Name: "mesh-dns-resolver", Scope: catalogue.ScopeMesh}}}
+	in.Catalogue["resolver"] = resolver
+	anchor, laptop := nodeOf(t, &in, "anchor"), nodeOf(t, &in, "laptop")
+	anchor.Assigned = append(anchor.Assigned, "resolver")
+	// One claimant and nothing on record: the sole claimant is listed.
+	if got := placed(t, in, "laptop").Rendering.Holders["mesh-dns-resolver"]; len(got) != 1 || got["anchor.internal"] != "10.77.0.1" {
+		t.Errorf("the sole claimant: %v", got)
+	}
+	// Both on record: both are listed (two claimants with nothing on record would be refused at resolution).
+	laptop.Assigned = append(laptop.Assigned, "resolver")
+	in.Holdings = []catalogue.Held{
+		{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "resolver"},
+		{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "laptop", Module: "resolver"}}
+	got := placed(t, in, "laptop").Rendering.Holders["mesh-dns-resolver"]
+	if len(got) != 2 || got["anchor.internal"] != "10.77.0.1" || got["laptop.internal"] != "10.77.0.2" {
+		t.Errorf("both holders on record: %v", got)
+	}
+	// A holder off the private network is left out: a resolver named at an address nothing answers waits out its timeout.
+	in.Nodes = append(in.Nodes, Node{Name: "ace", Place: Place{Address: "10.77.0.3"}, Assigned: []string{"resolver"}})
+	in.Holdings = append(in.Holdings, catalogue.Held{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "ace", Module: "resolver"})
+	if got := placed(t, in, "laptop").Rendering.Holders["mesh-dns-resolver"]; len(got) != 2 || got["ace.internal"] != "" {
+		t.Errorf("a holder off the network is listed: %v", got)
+	}
+}
diff --git a/internal/compose/resolution/a_service_process_test.go b/internal/compose/resolution/a_service_process_test.go
new file mode 100644
index 0000000..de7b3ac
--- /dev/null
+++ b/internal/compose/resolution/a_service_process_test.go
@@ -0,0 +1,10 @@
+package resolution
+
+func indexOf(out []map[string]any, id string) int {
+	for i, r := range out {
+		if r["id"] == id {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/internal/compose/resolution/accesses_test.go b/internal/compose/resolution/accesses_test.go
new file mode 100644
index 0000000..5bfc9f3
--- /dev/null
+++ b/internal/compose/resolution/accesses_test.go
@@ -0,0 +1,80 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The fault 04-ISSUES/036 records: a media stack is several modules — a library server, the
+// acquisition managers, a download client — that must share directories on one machine. Written
+// as owned `directory` resources, two of them on one node are refused as rivalrous owners, which
+// is right in general and wrong here: sharing those directories is the whole point of the stack.
+//
+// Declared as accesses to an operator-owned path (novox/hq ADR 0051), they co-resolve. An access
+// is not a resource and never enters the duplicate-owner map, so this is the exact case the
+// resolver refuses above when the same path is owned — and does not, when it is merely accessed.
+func TestTwoModulesAccessingOnePathCoResolve(t *testing.T) {
+	a := mod("a", nil, nil, nil)
+	a.Accesses = []mcat.Access{{Path: "/services/media/downloads", Mode: mcat.AccessReadWrite}}
+	b := mod("b", nil, nil, nil)
+	b.Accesses = []mcat.Access{{Path: "/services/media/downloads", Mode: mcat.AccessRead}}
+
+	got, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatalf("two modules accessing one operator-owned path were refused: %v", err)
+	}
+
+	// And each accessing module's grant reaches the machine as its own `access` resource, so the
+	// host can find the path present or refuse — both naming the one operator-owned path.
+	var accesses int
+	for _, r := range mustDeclare(t, got) {
+		if r["type"] == "access" && r["path"] == "/services/media/downloads" {
+			accesses++
+		}
+	}
+	if accesses != 2 {
+		t.Errorf("expected both modules' accesses in the declaration, got %d", accesses)
+	}
+}
+
+// The mirror of the case above, so the sharing vocabulary does not weaken the rule it sits beside:
+// two modules OWNING one path is still refused, exactly as before accesses existed.
+func TestTwoModulesOwningOnePathAreStillRefused(t *testing.T) {
+	a := mod("a", nil, nil, nil)
+	a.Resources = []map[string]any{
+		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
+	b := mod("b", nil, nil, nil)
+	b.Resources = []map[string]any{
+		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
+
+	_, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("two modules owning the same directory were both assigned")
+	}
+	if !strings.Contains(err.Error(), "/services/media/movies") {
+		t.Errorf("the refusal does not name the path: %v", err)
+	}
+}
+
+// Shared data is the operator's, owned by no module (novox/hq ADR 0051). A module owning the path
+// another module was told to expect the operator to provide would create and chown it — and the
+// two intentions cannot both hold, so it is refused by name. This is what keeps the distinction
+// machine-checkable rather than a convention nobody enforces.
+func TestAModuleMayNotOwnWhatAnotherAccesses(t *testing.T) {
+	owns := mod("owns", nil, nil, nil)
+	owns.Resources = []map[string]any{
+		{"id": "lib", "type": "directory", "path": "/services/media/movies", "mode": "0755"}}
+	uses := mod("uses", nil, nil, nil)
+	uses.Accesses = []mcat.Access{{Path: "/services/media/movies", Mode: mcat.AccessRead}}
+
+	_, err := Resolve(shelf(owns, uses), []string{"owns", "uses"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("a module owning a path another accesses was allowed")
+	}
+	if !strings.Contains(err.Error(), "/services/media/movies") ||
+		!strings.Contains(err.Error(), "the operator's") {
+		t.Errorf("the refusal does not explain the ownership conflict: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/adoption.go b/internal/compose/resolution/adoption.go
new file mode 100644
index 0000000..5017ab9
--- /dev/null
+++ b/internal/compose/resolution/adoption.go
@@ -0,0 +1,177 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// GuardID, GuardUnitID and GuardRunningID are the guard's resource identities. The installer
+// raises the same three on an adopted genesis, so the first push finds them already there.
+func GuardID() string { return mcat.AdoptionPrefix + "guard" }
+
+func GuardUnitID() string { return mcat.AdoptionPrefix + "guard-unit" }
+
+func GuardRunningID() string { return mcat.AdoptionPrefix + "guard-running" }
+
+// GuardPackageID is the tool that loads the guard, declared first: a node joining adopted has
+// no filter module and may have no nft at all, and a table nothing can load guards nothing.
+func GuardPackageID() string { return mcat.AdoptionPrefix + "guard-package" }
+
+// OpeningID is an opening's resource identity: its protocol, port and path say what it is.
+func OpeningID(protocol string, port int, path string) string {
+	return fmt.Sprintf("%sopening-%s-%d-%s", mcat.AdoptionPrefix, protocol, port, path)
+}
+
+// Openings are what the mesh needs reachable on an adopted node, from the same inputs as the
+// filter it would load were the node converged, each from where that filter would admit it.
+//
+// `rules` is Filtering's answer — every module's listens, the hub's port, the per-node exposure —
+// and `foundation` is the ports the mesh itself needs, from everywhere. A rule for this machine
+// only opens nothing. `published` maps a machine port a container publishes to the container's
+// port: a published port is forwarded, not received, so its opening names the forwarded path and
+// the port the packet is forwarded to.
+func Openings(rules []mcat.Rule, foundation []int, published map[string]map[int]int) []map[string]any {
+	type key struct {
+		protocol string
+		port     int
+	}
+	from := map[key]string{}
+	var order []key
+	widen := func(k key, f string) {
+		was, seen := from[k]
+		if !seen {
+			order = append(order, k)
+		}
+		if !seen || was != mcat.OpeningFromEverywhere {
+			from[k] = f
+		}
+	}
+	for _, rule := range rules {
+		switch rule.From {
+		case mcat.FromEverywhere:
+			widen(key{rule.Protocol, rule.Port}, mcat.OpeningFromEverywhere)
+		case mcat.FromMesh:
+			widen(key{rule.Protocol, rule.Port}, mcat.OpeningFromMesh)
+		case mcat.FromLocalNetwork:
+			// The private network's part only (novox/hq ADR 0340). An adopted node's found firewall
+			// stays, and it is what admits the machine's local network; an opening has no word for a
+			// local network, and widening it to everywhere would open the port to the internet.
+			widen(key{rule.Protocol, rule.Port}, mcat.OpeningFromMesh)
+		}
+	}
+	for _, port := range foundation {
+		widen(key{"tcp", port}, mcat.OpeningFromEverywhere)
+	}
+	sort.Slice(order, func(a, b int) bool {
+		if order[a].port != order[b].port {
+			return order[a].port < order[b].port
+		}
+		return order[a].protocol < order[b].protocol
+	})
+	out := make([]map[string]any, 0, len(order))
+	for _, k := range order {
+		opening := map[string]any{"type": "opening", "port": k.port, "protocol": k.protocol,
+			"from": from[k]}
+		if to, forwarded := published[k.protocol][k.port]; forwarded {
+			opening["id"] = OpeningID(k.protocol, k.port, mcat.PathForwarded)
+			opening["path"] = mcat.PathForwarded
+			opening["to"] = to
+		} else {
+			opening["id"] = OpeningID(k.protocol, k.port, mcat.PathIncoming)
+			opening["path"] = mcat.PathIncoming
+		}
+		out = append(out, opening)
+	}
+	return out
+}
+
+// AsGuard renders the mesh's refusal-only table for the given machine ports.
+//
+// It passes everything by default and holds nothing but a refusal, so it cannot close anything
+// the machine serves; and it is the mesh's own table, so the found firewall reloading does not
+// touch it. It refuses only packets addressed to this machine, and the ports except from the
+// machine itself — its loopback and the container runtime's own networks — and from the private
+// network, known by the interface a packet arrives on and never by its source address. At
+// prerouting, ahead of the runtime's destination translation, so it matches the port the packet
+// was sent to; in the inet family, so both address families.
+//
+// **The machine's own interfaces are named, where the derived filter names address ranges.** The
+// filter accepts the container runtime's networks by CIDR; this excludes its bridges by name — lo,
+// docker0, the br-* a compose network gets, and the mesh's own mesh0. A runtime whose bridge is
+// named anything else (a podman or libvirt bridge, or a docker network created with a fixed name)
+// would have its containers' traffic to a guarded port refused, which reads as the port being
+// down. Names rather than addresses is deliberate: a source address can be claimed by whoever
+// sends the packet, and this table exists to refuse what the found firewall never sees. Widening
+// it means adding names here and in the installer's copy together, which the golden test holds to
+// one text.
+//
+// The same text the installer raises on an adopted genesis; a test holds both to it.
+func AsGuard(ports []int) string {
+	sorted := append([]int{}, ports...)
+	sort.Ints(sorted)
+	listed := make([]string, len(sorted))
+	for i, p := range sorted {
+		listed[i] = strconv.Itoa(p)
+	}
+	var b strings.Builder
+	b.WriteString("table inet mesh_guard {}\n")
+	b.WriteString("delete table inet mesh_guard\n")
+	b.WriteString("table inet mesh_guard {\n")
+	b.WriteString("\tchain prerouting {\n")
+	b.WriteString("\t\ttype filter hook prerouting priority raw; policy accept;\n")
+	// Only packets addressed to this machine: traffic it routes for others — a predecessor's hub,
+	// say — is never the guard's business (novox/hq ADR 0103).
+	fmt.Fprintf(&b, "\t\tfib daddr type local iifname != \"lo\" iifname != \"docker0\" "+
+		"iifname != \"br-*\" iifname != \"mesh0\" tcp dport { %s } drop\n",
+		strings.Join(listed, ", "))
+	b.WriteString("\t}\n")
+	b.WriteString("}\n")
+	return b.String()
+}
+
+// GuardUnitText is the unit that loads the guard. Stopping it deletes only its own table: never
+// a flush, which would take the container runtime's rules and the found firewall with it.
+func GuardUnitText() string {
+	return "[Unit]\n" +
+		"Description=The mesh's guard: refuses its own ports from outside (novox/hq ADR 0100)\n" +
+		// Early, before the network is up, and without the default dependencies that would
+		// order it after the network; stopped at shutdown like any unit.
+		"DefaultDependencies=no\n" +
+		"Wants=network-pre.target\n" +
+		"Before=network-pre.target shutdown.target\n" +
+		"Conflicts=shutdown.target\n" +
+		"\n" +
+		"[Service]\n" +
+		"Type=oneshot\n" +
+		"RemainAfterExit=yes\n" +
+		"ExecStart=nft -f " + mcat.GuardPath + "\n" +
+		"ExecReload=nft -f " + mcat.GuardPath + "\n" +
+		"ExecStop=nft delete table inet mesh_guard\n" +
+		"\n" +
+		"[Install]\n" +
+		"WantedBy=multi-user.target\n"
+}
+
+// GuardResources are the guard as four resources of the existing kinds: the tool that loads it,
+// the table, the unit, and the unit running — reloaded when the table changes, so the new table
+// replaces the old in one `nft -f` through the unit's ExecReload with no moment unguarded, and
+// restarted only when the unit itself changes. Nothing when there is nothing to guard: an empty
+// set is not a table nft loads.
+func GuardResources(ports []int) []map[string]any {
+	if len(ports) == 0 {
+		return nil
+	}
+	return []map[string]any{
+		{"id": GuardPackageID(), "type": "package", "package": mcat.GuardPackage},
+		{"id": GuardID(), "type": "file", "path": mcat.GuardPath, "content": AsGuard(ports),
+			"mode": "0644"},
+		{"id": GuardUnitID(), "type": "file", "path": mcat.GuardUnitPath, "content": GuardUnitText(),
+			"mode": "0644"},
+		{"id": GuardRunningID(), "type": "service", "unit": mcat.GuardUnit, "state": "running",
+			"boot": "enabled", "restart-on": []any{GuardUnitID()}, "reload-on": []any{GuardID()}},
+	}
+}
diff --git a/internal/compose/resolution/adoption_test.go b/internal/compose/resolution/adoption_test.go
new file mode 100644
index 0000000..d704884
--- /dev/null
+++ b/internal/compose/resolution/adoption_test.go
@@ -0,0 +1,629 @@
+package resolution
+
+import (
+	"encoding/json"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// hub is the private network's generator on the hub: it opens the hub's port from anywhere.
+type hub struct{}
+
+func (hub) Resources(string) ([]map[string]any, bool, error) {
+	return []map[string]any{{"id": "config", "type": "file", "path": "/etc/wireguard/mesh0.conf",
+		"content": "[Interface]\n"}}, true, nil
+}
+
+func (hub) Listens(string) ([]mcat.Listening, error) {
+	return []mcat.Listening{{Port: 51820, Protocol: "udp", From: mcat.FromEverywhere}}, nil
+}
+
+// anAdoptedAnchor is the control-node's set: the store, the bus, the registry, the private network,
+// a served module and the filter module.
+func anAdoptedAnchor() mcat.Resolution {
+	return mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{
+		{Module: "network", Computed: "overlay"},
+		{Module: "postgres", Guards: []int{5432},
+			Listens: []mcat.Listening{{Port: 5432, From: mcat.FromMesh}},
+			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
+				"ports": []any{"5432:5432"}}}},
+		{Module: "lavinmq", Guards: []int{15672},
+			Listens: []mcat.Listening{{Port: 5671, From: mcat.FromMesh}, {Port: 5672, From: mcat.FromMesh}},
+			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
+				"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}}}},
+		{Module: "distribution",
+			Listens: []mcat.Listening{{Port: 5000, From: mcat.FromMesh}},
+			Resources: []map[string]any{{"id": "store", "type": "container", "name": "registry",
+				"ports": []any{"5000"}}}},
+		{Module: "hello-web",
+			Listens: []mcat.Listening{{Port: 8080, From: mcat.FromEverywhere}},
+			Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
+				"ports": []any{"8080"}}}},
+		{Module: "helper", Listens: []mcat.Listening{{Port: 9000, From: mcat.FromMachine}}},
+		{Module: "nftables", Filtering: &mcat.Filtering{Into: "/etc/nftables.conf"},
+			Resources: []map[string]any{{"id": "load", "type": "service", "unit": "mesh-filter.service",
+				"state": "running", "restart-on": []any{"filtering"}}}},
+	}}
+}
+
+func anchorRendering(adopted bool) mcat.Rendering {
+	return mcat.Rendering{
+		Generators: map[string]mcat.Generator{"overlay": hub{}},
+		Ports:      map[string]map[int]int{"distribution": {5000: 5000}, "hello-web": {8080: 20001}},
+		Settings: mcat.SettingsBy{"distribution": {{From: "node anchor",
+			Placement: map[string]any{mcat.ExposeSetting: map[string]any{"5000": mcat.FromEverywhere}}}}},
+		Mesh:       []string{"10.42.0.1"},
+		Foundation: []int{5671},
+		// What the machine reported faces outside, which every rule in the filter is written
+		// around (novox/hq ADR 0140).
+		OutwardLinks:    []string{"eth0"},
+		TunnelInterface: "mesh0",
+		Adopted:         adopted,
+		// Genesis takes the foundation's modules.
+		Taken: map[string]bool{"postgres": true, "lavinmq": true},
+	}
+}
+
+func byID(resources []map[string]any) map[string]map[string]any {
+	out := map[string]map[string]any{}
+	for _, r := range resources {
+		out[r["id"].(string)] = r
+	}
+	return out
+}
+
+func TestAnAdoptedNodeIsDeclaredOpeningsFromTheSameInputsAsTheFilter(t *testing.T) {
+	composed, err := Compose(anAdoptedAnchor(), anchorRendering(true))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := byID(composed.Resources)
+	want := map[string]map[string]any{
+		// The hub's port, from anywhere, received.
+		"adoption.opening-udp-51820-incoming": {"port": 51820, "protocol": "udp",
+			"from": "everywhere", "path": "incoming"},
+		// The store's port from the private network only, and forwarded: a container publishes it.
+		"adoption.opening-tcp-5432-forwarded": {"port": 5432, "protocol": "tcp", "from": "mesh",
+			"path": "forwarded", "to": 5432},
+		// The bus from anywhere: a node enrols over it before it has a private address.
+		"adoption.opening-tcp-5671-forwarded": {"port": 5671, "protocol": "tcp",
+			"from": "everywhere", "path": "forwarded", "to": 5671},
+		"adoption.opening-tcp-5672-forwarded": {"port": 5672, "protocol": "tcp", "from": "mesh",
+			"path": "forwarded", "to": 5672},
+		// The registry from anywhere, by its node's exposure setting.
+		"adoption.opening-tcp-5000-forwarded": {"port": 5000, "protocol": "tcp",
+			"from": "everywhere", "path": "forwarded", "to": 5000},
+		// A published port names the machine port and the container port it is forwarded to.
+		"adoption.opening-tcp-20001-forwarded": {"port": 20001, "protocol": "tcp",
+			"from": "everywhere", "path": "forwarded", "to": 8080},
+	}
+	for id, fields := range want {
+		opening, ok := got[id]
+		if !ok {
+			t.Errorf("no %s among %v", id, keys(got))
+			continue
+		}
+		if opening["type"] != "opening" {
+			t.Errorf("%s is a %v", id, opening["type"])
+		}
+		for k, v := range fields {
+			if opening[k] != v {
+				t.Errorf("%s: %s is %v, want %v", id, k, opening[k], v)
+			}
+		}
+	}
+	for id := range got {
+		if strings.HasPrefix(id, "adoption.opening-") && want[id] == nil {
+			t.Errorf("an opening nothing asked for: %s", id)
+		}
+	}
+	// A port for this machine only opens nothing, and the management port is not opened at all.
+	for id := range got {
+		if strings.Contains(id, "-9000-") || strings.Contains(id, "-15672-") {
+			t.Errorf("%s is opened", id)
+		}
+	}
+
+	// And openings come first, in the order the machine applies them.
+	if !strings.HasPrefix(composed.Resources[0]["id"].(string), "adoption.opening-") {
+		t.Errorf("openings are not first: %v", composed.Resources[0]["id"])
+	}
+}
+
+func TestAnAdoptedNodeLoadsNoFilterOfTheMeshs(t *testing.T) {
+	composed, err := Compose(anAdoptedAnchor(), anchorRendering(true))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range composed.Resources {
+		if r["path"] == "/etc/nftables.conf" || strings.HasPrefix(r["id"].(string), "nftables.") {
+			t.Fatalf("an adopted node is declared the filter module's %v", r["id"])
+		}
+		if content, _ := r["content"].(string); strings.Contains(content, "policy drop") {
+			t.Fatalf("an adopted node is declared a table that drops by default: %v", r["id"])
+		}
+		// Nothing but refusals: the only accept in the guard is its policy.
+		if content, _ := r["content"].(string); r["id"] == GuardID() &&
+			strings.Count(content, "accept") != 1 {
+			t.Fatalf("the guard holds an accept:\n%s", content)
+		}
+	}
+	got := byID(composed.Resources)
+	guard := got[GuardID()]
+	if guard == nil || got[GuardUnitID()] == nil || got[GuardRunningID()] == nil {
+		t.Fatalf("no guard: %v", keys(got))
+	}
+	if guard["content"] != AsGuard([]int{5432, 5672, 15672}) {
+		t.Fatalf("the guard does not guard the store, the broker and its management port:\n%s",
+			guard["content"])
+	}
+	// The tool that loads it comes first, and the table after it: a node joining adopted has no
+	// filter module and may have no nft.
+	pkg, table := -1, -1
+	for i, r := range composed.Resources {
+		switch r["id"] {
+		case GuardPackageID():
+			pkg = i
+			if r["type"] != "package" || r["package"] != "nftables" {
+				t.Fatalf("the guard's package is %v", r)
+			}
+		case GuardID():
+			table = i
+		}
+	}
+	if pkg < 0 || pkg > table {
+		t.Fatalf("nftables is not declared before the guard's table (%d, %d)", pkg, table)
+	}
+	// A changed table is reloaded — one `nft -f`, atomic — never restarted, which would delete the
+	// table and leave the ports unguarded until it is loaded again. Only a changed unit restarts.
+	if !reflect.DeepEqual(got[GuardRunningID()]["reload-on"], []any{GuardID()}) ||
+		!reflect.DeepEqual(got[GuardRunningID()]["restart-on"], []any{GuardUnitID()}) {
+		t.Fatalf("the guard is not reloaded on its table and restarted on its unit: %v",
+			got[GuardRunningID()])
+	}
+	// Nothing of the mesh's own is anybody's to hold.
+	for id, module := range composed.Owner {
+		if strings.HasPrefix(id, mcat.AdoptionPrefix) {
+			t.Fatalf("%s is owned by %s", id, module)
+		}
+	}
+}
+
+func TestAConvergedNodeIsDeclaredItsFilterAndNoOpenings(t *testing.T) {
+	composed, err := Compose(anAdoptedAnchor(), anchorRendering(false))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := byID(composed.Resources)
+	if got["nftables.filtering"] == nil || got["nftables.load"] == nil {
+		t.Fatalf("a converged node lost its filter: %v", keys(got))
+	}
+	for id := range got {
+		if strings.HasPrefix(id, mcat.AdoptionPrefix) {
+			t.Fatalf("a converged node is declared %s", id)
+		}
+	}
+	plain, err := Declaration(anAdoptedAnchor(), anchorRendering(false))
+	if err != nil {
+		t.Fatal(err)
+	}
+	a, _ := json.Marshal(plain)
+	b, _ := json.Marshal(composed.Resources)
+	if string(a) != string(b) {
+		t.Fatal("Compose and Declaration disagree on a converged node")
+	}
+}
+
+// The table the installer raises and the controller declares, character for character.
+func TestTheGuardIsExactlyThisTable(t *testing.T) {
+	const golden = `table inet mesh_guard {}
+delete table inet mesh_guard
+table inet mesh_guard {
+	chain prerouting {
+		type filter hook prerouting priority raw; policy accept;
+		fib daddr type local iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
+	}
+}
+`
+	if got := AsGuard([]int{15672, 5432}); got != golden {
+		t.Fatalf("the guard changed:\n%s", got)
+	}
+	const unit = `[Unit]
+Description=The mesh's guard: refuses its own ports from outside (novox/hq ADR 0100)
+DefaultDependencies=no
+Wants=network-pre.target
+Before=network-pre.target shutdown.target
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=nft -f /etc/mesh/guard.nft
+ExecReload=nft -f /etc/mesh/guard.nft
+ExecStop=nft delete table inet mesh_guard
+
+[Install]
+WantedBy=multi-user.target
+`
+	if got := GuardUnitText(); got != unit {
+		t.Fatalf("the guard's unit changed:\n%s", got)
+	}
+	if GuardResources(nil) != nil {
+		t.Fatal("a guard with nothing to guard is an empty set nft refuses to load")
+	}
+}
+
+func keys[V any](m map[string]V) []string {
+	return sortedKeys(m)
+}
+
+// novox/hq ADR 0100: the foundation's ports are the node's. Given 5433 for the store, every place
+// that uses the port reads it from there: the container, the filter, the openings, the guard.
+func TestAGivenPortIsUsedEverywhereThePortIs(t *testing.T) {
+	given := map[string]map[int]int{"postgres": {5432: 5433}, "lavinmq": {15672: 15673}}
+	for _, adopted := range []bool{true, false} {
+		with := anchorRendering(adopted)
+		with.Given = given
+		with.Ports["postgres"] = map[int]int{5432: 5433}
+		composed, err := Compose(anAdoptedAnchor(), with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := byID(composed.Resources)
+		if ports := got["postgres.server"]["ports"]; !reflect.DeepEqual(ports, []any{"5433:5432"}) {
+			t.Fatalf("the store's container publishes %v", ports)
+		}
+		if ports := got["lavinmq.server"]["ports"]; !reflect.DeepEqual(ports,
+			[]any{"5671:5671", "5672:5672", "127.0.0.1:15673:15672"}) {
+			t.Fatalf("the broker's container publishes %v", ports)
+		}
+		if !adopted {
+			filter, _ := got["nftables.filtering"]["content"].(string)
+			if !strings.Contains(filter, "tcp dport 5433 accept") || strings.Contains(filter, "5432") {
+				t.Fatalf("the filter does not use the given port:\n%s", filter)
+			}
+			continue
+		}
+		if o := got["adoption.opening-tcp-5433-forwarded"]; o == nil || o["to"] != 5432 {
+			t.Fatalf("no opening for the given port: %v", keys(got))
+		}
+		if guard := got[GuardID()]["content"]; guard != AsGuard([]int{5433, 5672, 15673}) {
+			t.Fatalf("the guard does not guard the given ports:\n%s", guard)
+		}
+	}
+}
+
+// novox/hq ADR 0103: the guard is derived, and from taken modules only — every machine port a taken
+// module publishes that the filter admits from the private network only, and the ports its
+// manifest guards. A module assigned but not taken is not guarded: its port may still be the
+// predecessor's.
+func TestTheGuardIsDerivedFromTakenModulesOnly(t *testing.T) {
+	guardOf := func(with mcat.Rendering) string {
+		t.Helper()
+		composed, err := Compose(anAdoptedAnchor(), with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		content, _ := byID(composed.Resources)[GuardID()]["content"].(string)
+		return content
+	}
+
+	// The broker taken, the store not: the broker's plain port follows from its listens (from
+	// the mesh, published), its management port from its manifest; the store is not guarded, and
+	// neither is the bus, which the mesh needs from everywhere.
+	with := anchorRendering(true)
+	with.Taken = map[string]bool{"lavinmq": true}
+	if got := guardOf(with); got != AsGuard([]int{5672, 15672}) {
+		t.Fatalf("the guard is not the taken broker's ports:\n%s", got)
+	}
+
+	// A taken module publishing a port admitted from everywhere is not guarded; one admitted from
+	// the mesh is. The registry is exposed everywhere on this node, and hello-web listens from
+	// everywhere.
+	with.Taken = map[string]bool{"distribution": true, "hello-web": true}
+	if got := guardOf(with); got != "" {
+		t.Fatalf("a port admitted from everywhere is guarded:\n%s", got)
+	}
+	with.Settings = nil
+	if got := guardOf(with); got != AsGuard([]int{5000}) {
+		t.Fatalf("the registry, from the mesh only, is not guarded:\n%s", got)
+	}
+
+	// Nothing taken, nothing guarded — and no guard at all rather than an empty set.
+	with = anchorRendering(true)
+	with.Taken = nil
+	if got := guardOf(with); got != "" {
+		t.Fatalf("an untaken store is guarded:\n%s", got)
+	}
+
+	// A given port is followed: where the machine put it is what is refused.
+	with = anchorRendering(true)
+	with.Given = map[string]map[int]int{"lavinmq": {5672: 5682, 15672: 15673}}
+	with.Ports["lavinmq"] = map[int]int{5671: 5671, 5672: 5682}
+	if got := guardOf(with); got != AsGuard([]int{5432, 5682, 15673}) {
+		t.Fatalf("the guard does not follow the given ports:\n%s", got)
+	}
+}
+
+// novox/hq ADR 0038: only a published port is the mesh's to move. A module that binds the machine
+// itself listens where its software was told to, so giving it a machine port is refused.
+func TestAGivenPortIsRefusedForAPortNoContainerPublishes(t *testing.T) {
+	onTheMachine := mcat.Manifest{Module: "daemon",
+		Listens: []mcat.Listening{{Port: 9000, From: mcat.FromMesh}}, Guards: []int{9000}}
+	layers := []mcat.Layer{{From: "node anchor",
+		Placement: map[string]any{mcat.PortsSetting: map[string]any{"9000": float64(9100)}}}}
+	_, err := GivenPorts(onTheMachine, layers)
+	if err == nil || !strings.Contains(err.Error(), "does not publish") {
+		t.Fatalf("a port no container publishes was given: %v", err)
+	}
+}
+
+// novox/hq ADR 0103: a guarded port this node is told to open to everyone is opened, not guarded.
+// An opening from everywhere beside a guard dropping it is one statement refusing the other.
+func TestAGuardedPortOpenedToEveryoneIsNotGuarded(t *testing.T) {
+	with := anchorRendering(true)
+	with.Settings["postgres"] = []mcat.Layer{{From: "node anchor",
+		Placement: map[string]any{mcat.ExposeSetting: map[string]any{"5432": mcat.FromEverywhere}}}}
+	composed, err := Compose(anAdoptedAnchor(), with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := byID(composed.Resources)
+	if o := got["adoption.opening-tcp-5432-forwarded"]; o == nil || o["from"] != mcat.OpeningFromEverywhere {
+		t.Fatalf("the store's port is not opened to everyone: %v", o)
+	}
+	if guard, _ := got[GuardID()]["content"].(string); guard != AsGuard([]int{5672, 15672}) {
+		t.Fatalf("a port opened to everyone is still guarded:\n%s", guard)
+	}
+}
+
+// A module that publishes its ssh port the long way — `2222:22`, because the machine's own daemon
+// holds 22 — and says it listens on the machine side of that mapping, which is what anything
+// reaching it dials.
+func aForge() mcat.Manifest {
+	return mcat.Manifest{Module: "forge",
+		Provides: []mcat.Offer{{Name: "git-over-ssh", Scope: mcat.ScopeMesh}},
+		Serves:   map[string]map[string]any{"git-over-ssh": {"port": 2222}},
+		Listens:  []mcat.Listening{{Port: 3000, From: mcat.FromMesh}, {Port: 2222, From: mcat.FromMesh}},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "forge",
+			"ports": []any{"3000", "2222:22"}}}}
+}
+
+// portsAsThePlanWould is where this machine puts each of a module's ports, derived the way
+// cmd/mesh-controller/plan.go derives it: a given port first, looked up by the port the module
+// says it listens on, and otherwise wherever the manifest's own mapping already put it. Written
+// here because everything below — the filter, the openings, the guard, what a consumer is told —
+// reads that map, and a given port that the lookup does not find moves the container's mapping
+// and nothing else.
+//
+// It stands in for the plan only where the plan does not allocate: a port the manifest already
+// placed, or one a node was given. For a short form with no given port the real plan asks the
+// inventory for a machine port and may come back with one from the pool, which needs a store and
+// is what cmd/mesh-controller's own tests exercise. So an assertion here about such a port asserts
+// this helper, not the mesh; keep the assertions to the ports under test.
+func portsAsThePlanWould(m mcat.Manifest, given map[int]int) map[int]int {
+	out := map[int]int{}
+	for _, l := range m.Listens {
+		if at, is := given[l.Port]; is {
+			out[l.Port] = at
+			continue
+		}
+		at, _ := m.MachineSide(l.Port)
+		out[l.Port] = at
+	}
+	return out
+}
+
+// novox/hq ADR 0100 and 0038: the machine side of a long-form mapping is a port the module
+// publishes, so a node may move it — and a module may name a mapping by either end.
+func TestAGivenPortNamesEitherEndOfWhatTheModulePublishes(t *testing.T) {
+	forge := aForge()
+	node := func(v any) []mcat.Layer {
+		return []mcat.Layer{{From: "node anchor", Placement: map[string]any{mcat.PortsSetting: v}}}
+	}
+
+	// The machine side — the number this module says it listens on, and the one the predecessor
+	// had somewhere else. Answered under 2222, the end the module itself names, which is what
+	// every reader of this map asks for. One entry, not two: a second key for the same answer is
+	// an entry another mapping's reader could find instead.
+	given, err := GivenPorts(forge, node(map[string]any{"2222": float64(222)}))
+	if err != nil {
+		t.Fatalf("the machine side of a mapping cannot be given a port: %v", err)
+	}
+	if want := map[int]int{2222: 222}; !reflect.DeepEqual(given, want) {
+		t.Fatalf("the forge was given %v; the mapping it names is filed under %v", given, want)
+	}
+
+	// The container's own port names the same mapping and means the same thing — and is filed
+	// under the same name, because the module's name for it has not changed.
+	if inside, err := GivenPorts(forge, node(map[string]any{"22": float64(222)})); err != nil ||
+		!reflect.DeepEqual(inside, map[int]int{2222: 222}) {
+		t.Fatalf("the container's end of the mapping was given %v: %v", inside, err)
+	}
+
+	// A short form is published on the number it names, and is unchanged by any of this.
+	if short, err := GivenPorts(forge, node(map[string]any{"3000": float64(2999)})); err != nil ||
+		short[3000] != 2999 {
+		t.Fatalf("the short form was given %v: %v", short, err)
+	}
+
+	// A port no container publishes is still refused, in the same words.
+	if _, err := GivenPorts(forge, node(map[string]any{"9000": float64(9100)})); err == nil ||
+		!strings.Contains(err.Error(), "does not publish") {
+		t.Fatalf("a port the forge does not publish was given: %v", err)
+	}
+
+	// And the two ends of one mapping given two different numbers is one setting contradicting
+	// the other: the machine publishes it once.
+	if _, err := GivenPorts(forge, node(map[string]any{
+		"2222": float64(222), "22": float64(300)})); err == nil ||
+		!strings.Contains(err.Error(), "one mapping") {
+		t.Fatalf("the two ends of one mapping were given different ports: %v", err)
+	}
+	// Said at both ends with the same number, it is still said twice, and refused where every
+	// other repeated machine port is — as the inventory refuses it when the setting is stored,
+	// which is the layer that sees it first.
+	if _, err := GivenPorts(forge, node(map[string]any{
+		"2222": float64(222), "22": float64(222)})); err == nil ||
+		!strings.Contains(err.Error(), "to both its 22 and its 2222") {
+		t.Fatalf("one mapping given one machine port at both ends: %v", err)
+	}
+	// A number that names two different mappings names neither: which one to move is not said.
+	twice := aForge()
+	twice.Resources[0]["ports"] = []any{"22", "2222:22"}
+	if _, err := GivenPorts(twice, node(map[string]any{"22": float64(222)})); err == nil ||
+		!strings.Contains(err.Error(), "twice") {
+		t.Fatalf("a number naming two of the module's mappings was accepted: %v", err)
+	}
+
+	// And the same refusal when the number naming two mappings is not the one the setting used
+	// but the one the answer would be filed under. Here `80` is the module's own name for a
+	// mapping, and two mappings wear it; filing an answer there is one container's port standing
+	// where the other's is read, and both containers then publish it.
+	shared := mcat.Manifest{Module: "gallery",
+		Listens: []mcat.Listening{{Port: 80, From: mcat.FromMesh}},
+		Resources: []map[string]any{
+			{"id": "a", "type": "container", "name": "a", "ports": []any{"4001:80"}},
+			{"id": "b", "type": "container", "name": "b", "ports": []any{"4002:80"}}}}
+	if _, err := GivenPorts(shared, node(map[string]any{"4001": float64(1234)})); err == nil ||
+		!strings.Contains(err.Error(), "twice") {
+		t.Fatalf("two containers were put on one machine port: %v", err)
+	}
+
+	// A module whose mappings chain — one's machine side is another's container port — keeps them
+	// apart, because each is filed under the port the module names it by and neither name is
+	// shared. Given both, each moves on its own and neither overwrites the other.
+	chained := mcat.Manifest{Module: "chain",
+		Listens: []mcat.Listening{{Port: 80, From: mcat.FromMesh}, {Port: 9090, From: mcat.FromMesh}},
+		Resources: []map[string]any{{"id": "server", "type": "container", "name": "chain",
+			"ports": []any{"8080:80", "9090:8080"}}}}
+	both, err := GivenPorts(chained, node(map[string]any{"80": float64(1234), "9090": float64(5678)}))
+	if err != nil || !reflect.DeepEqual(both, map[int]int{80: 1234, 9090: 5678}) {
+		t.Fatalf("chained mappings were given %v: %v", both, err)
+	}
+	if moved := givenOuter("8080:80", both); moved != "1234:80" {
+		t.Fatalf("the first mapping moved to %q, and it was given 1234", moved)
+	}
+	if moved := givenOuter("9090:8080", both); moved != "5678:8080" {
+		t.Fatalf("the second mapping moved to %q, and it was given 5678", moved)
+	}
+}
+
+// And the number reaches everything derived from it. The fault this is written against moved the
+// container's mapping alone: the filter opened the port the software had left, the adopted node's
+// opening named it too, the guard refused it, and a consumer was sent to it.
+func TestAGivenMachineSideReachesTheFilterTheOpeningAndTheConsumer(t *testing.T) {
+	forge := aForge()
+	given, err := GivenPorts(forge, []mcat.Layer{{From: "node anchor",
+		Placement: map[string]any{mcat.PortsSetting: map[string]any{"2222": float64(222)}}}})
+	if err != nil {
+		t.Fatalf("the machine side of a mapping cannot be given a port: %v", err)
+	}
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{forge}}
+	with := mcat.Rendering{
+		Ports:           map[string]map[int]int{"forge": portsAsThePlanWould(forge, given)},
+		Given:           map[string]map[int]int{"forge": given},
+		Mesh:            []string{"10.77.0.1"},
+		Adopted:         true,
+		OutwardLinks:    []string{"eth0"},
+		TunnelInterface: "mesh0",
+		Taken:           map[string]bool{"forge": true},
+	}
+
+	// What the runtime is handed: the machine's own port on the outside, the container's within.
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatalf("the forge does not compose: %v", err)
+	}
+	got := byID(composed.Resources)
+	if ports := got["forge.server"]["ports"]; !reflect.DeepEqual(ports, []any{"3000:3000", "222:22"}) {
+		t.Fatalf("the forge's container publishes %v", ports)
+	}
+
+	// What the filter would open, were the node converged.
+	rules, err := Rules(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var opened []int
+	for _, rule := range rules {
+		opened = append(opened, rule.Port)
+	}
+	// Only the moved port is asserted: the forge's other port is a short form the real plan would
+	// allocate rather than read off the manifest, so its number here is portsAsThePlanWould's and
+	// not the mesh's.
+	if !slices.Contains(opened, 222) || slices.Contains(opened, 2222) {
+		t.Fatalf("the filter opens %v, not where the machine puts the forge", opened)
+	}
+
+	// And what it is declared instead, adopted: an opening on the machine's port, naming the
+	// container's port on the forwarded path — a published port is forwarded, never received.
+	opening := got[OpeningID("tcp", 222, mcat.PathForwarded)]
+	if opening == nil || opening["to"] != 22 || opening["from"] != mcat.OpeningFromMesh {
+		t.Fatalf("no opening for the port this node gave the forge: %v", keys(got))
+	}
+	for id := range got {
+		if strings.HasPrefix(id, "adoption.opening-tcp-2222-") {
+			t.Errorf("an opening for the port the forge was moved off: %s", id)
+		}
+	}
+
+	// The guard refuses it where the machine put it, and nothing where it used to be.
+	guard, _ := got[GuardID()]["content"].(string)
+	if !strings.Contains(guard, "222") || strings.Contains(guard, "2222") {
+		t.Fatalf("the guard does not follow the given port:\n%s", guard)
+	}
+
+	// And a consumer is sent to the same number, which is read from what the module serves.
+	if told := ServedOn(forge, "git-over-ssh", with.Ports["forge"])["port"]; told != 222 {
+		t.Fatalf("a consumer is told the forge answers on %v", told)
+	}
+}
+
+// And the mapping itself moves under either name, because Rendering.Given is a map anybody
+// composing a declaration hands in: keyed by the machine side, which is what a module declaring
+// 2222 calls its port, only the outside moves and the container's own port stays as written.
+func TestAMappingIsMovedUnderEitherOfItsNames(t *testing.T) {
+	for _, c := range []struct {
+		written string
+		given   map[int]int
+		want    string
+	}{
+		{"2222:22", map[int]int{2222: 222}, "222:22"},
+		{"2222:22", map[int]int{22: 222}, "222:22"},
+		{"127.0.0.1:15672:15672/tcp", map[int]int{15672: 15673}, "127.0.0.1:15673:15672/tcp"},
+		{"2222:22", map[int]int{3000: 2999}, "2222:22"},
+		{"2222:22", nil, "2222:22"},
+	} {
+		if got := givenOuter(c.written, c.given); got != c.want {
+			t.Errorf("%s given %v is published as %s, want %s", c.written, c.given, got, c.want)
+		}
+	}
+}
+
+// The same on a node that was given nothing, which is where the derivation was never at fault:
+// a long-form mapping is published where the manifest put it, and an adopted node opens that port
+// on the forwarded path like any other. What broke it was the number reaching only the mapping.
+func TestALongFormPortIsOpenedWhereTheManifestPublishesIt(t *testing.T) {
+	forge := aForge()
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{forge}}
+	composed, err := Compose(r, mcat.Rendering{
+		Ports:           map[string]map[int]int{"forge": portsAsThePlanWould(forge, nil)},
+		Mesh:            []string{"10.77.0.1"},
+		Adopted:         true,
+		OutwardLinks:    []string{"eth0"},
+		TunnelInterface: "mesh0",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := byID(composed.Resources)
+	opening := got[OpeningID("tcp", 2222, mcat.PathForwarded)]
+	if opening == nil || opening["to"] != 22 {
+		t.Fatalf("no opening for the forge's published ssh port: %v", keys(got))
+	}
+}
diff --git a/internal/compose/resolution/agent_account_test.go b/internal/compose/resolution/agent_account_test.go
new file mode 100644
index 0000000..a54e628
--- /dev/null
+++ b/internal/compose/resolution/agent_account_test.go
@@ -0,0 +1,83 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTheAgentAccountFactFallsBackToTheOperatorAndIsNeverRootOnlyWhenItsOwn(t *testing.T) {
+	facts := machineFacts(mcat.Resolution{Node: "anchor", Account: "ops"}, nil, "")
+	if facts["agent-account"] != "ops" || facts["agent-home"] != "/home/ops" || facts["agent-root"] != "" {
+		t.Errorf("with no agent account named, agents run as the operator: %v", facts)
+	}
+	facts = machineFacts(mcat.Resolution{Node: "anchor", Account: "ops", AccountHome: "/srv/ops"}, nil, "")
+	if facts["agent-home"] != "/srv/ops" {
+		t.Errorf("the operator's stated home is the agent's home when they are one account: %v", facts)
+	}
+	facts = machineFacts(mcat.Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent"}, nil, "")
+	if facts["agent-account"] != "agent" || facts["agent-home"] != "/home/agent" || facts["agent-root"] != mcat.RootNever {
+		t.Errorf("a named agent account is the agents', never root: %v", facts)
+	}
+	if facts["account"] != "ops" {
+		t.Errorf("the operator account is still the operator's: %v", facts)
+	}
+	facts = machineFacts(mcat.Resolution{Node: "anchor", AgentAccount: "agent", AgentAccountHome: "/var/lib/agent"}, nil, "")
+	if facts["agent-home"] != "/var/lib/agent" || facts["agent-root"] != mcat.RootNever {
+		t.Errorf("an agent account with a stated home on a machine with no operator: %v", facts)
+	}
+	if _, has := machineFacts(mcat.Resolution{Node: "anchor"}, nil, "")["agent-account"]; has {
+		t.Error("a machine with no account at all names an agent account")
+	}
+}
+
+// The agent's module, in the shape the catalogue's declares it: the account, never root where it is its
+// own; its directory under that home, owned by it.
+const agentModule = `{"module": "agent", "version": "1", "resources": [
+  {"id": "account", "type": "user", "name": "${machine:agent-account}", "home": "${machine:agent-home}",
+   "root": "${machine:agent-root}"},
+  {"id": "home", "type": "directory", "path": "${machine:agent-home}/.agent", "mode": "0700",
+   "owner": "${machine:agent-account}"}
+]}`
+
+func TestTheAgentAccountIsDeclaredNeverRootOnlyToAnEngineThatJudgesIt(t *testing.T) {
+	m, err := decodeForTest([]byte(agentModule))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := func(r mcat.Resolution, with mcat.Rendering) (user, home map[string]any) {
+		t.Helper()
+		r.Node, r.Modules = "anchor", []mcat.Manifest{m}
+		out, err := Declaration(r, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return fileNamed(out, "agent.account"), fileNamed(out, "agent.home")
+	}
+
+	user, home := compose(mcat.Resolution{Account: "ops", AgentAccount: "agent"}, mcat.Rendering{JudgesRoot: true})
+	if user["name"] != "agent" || user[mcat.RootField] != mcat.RootNever || user["home"] != "/home/agent" {
+		t.Errorf("an engine that judges root is sent the agent account never to become root: %v", user)
+	}
+	if home["path"] != "/home/agent/.agent" || home["owner"] != "agent" {
+		t.Errorf("the agent's directory is under its own home, its own: %v", home)
+	}
+
+	user, _ = compose(mcat.Resolution{Account: "ops", AgentAccount: "agent", AgentAccountHome: "/srv/agent"}, mcat.Rendering{JudgesRoot: true})
+	if user["home"] != "/srv/agent" {
+		t.Errorf("an agent account named with a home of its own is made there: %v", user)
+	}
+
+	user, _ = compose(mcat.Resolution{Account: "ops", AgentAccount: "agent"}, mcat.Rendering{})
+	if _, sent := user[mcat.RootField]; sent || user["name"] != "agent" {
+		t.Errorf("an older engine, which parses strictly, is sent root: %v", user)
+	}
+
+	user, home = compose(mcat.Resolution{Account: "ops"}, mcat.Rendering{JudgesRoot: true})
+	if _, sent := user[mcat.RootField]; sent || user["name"] != "ops" {
+		t.Errorf("where agents run as the operator, root asserts nothing and is not sent: %v", user)
+	}
+	if home["path"] != "/home/ops/.agent" || home["owner"] != "ops" {
+		t.Errorf("with no agent account, the agent's directory is the operator's: %v", home)
+	}
+}
diff --git a/internal/compose/resolution/artifact_store_seat_test.go b/internal/compose/resolution/artifact_store_seat_test.go
new file mode 100644
index 0000000..ebe2ce2
--- /dev/null
+++ b/internal/compose/resolution/artifact_store_seat_test.go
@@ -0,0 +1,40 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The artifact store's seat is one per mesh, read from the catalogue beside this checkout.
+//
+// **A second store anywhere is refused by name, not discovered as a consumer failure.** The seat
+// was node-scoped, so a second `distribution` on another machine resolved cleanly there — and a
+// node-scoped requirement with one candidate installs that candidate on the node, so anything that
+// required the store's presence beside it would have raised a fresh, empty store on the wrong
+// machine. Only afterwards did the mesh notice: `artifact-store` offered by two nodes, and every
+// consumer elsewhere refusing to choose. The claim says it first, where the second store is
+// assigned.
+func TestASecondArtifactStoreAnywhereIsRefusedByName(t *testing.T) {
+	store := catalogueManifest(t, "distribution")
+
+	// The first store resolves as it always has.
+	if _, err := Resolve(shelf(store), []string{"distribution"}, workstation(), mcat.World{}); err != nil {
+		t.Fatalf("the store alone does not resolve: %v", err)
+	}
+
+	// A second one, on any other machine, is refused — and the refusal names the seat.
+	elsewhere := mcat.World{Held: []mcat.Held{{Claim: "mesh-artifact-store", Scope: mcat.ScopeMesh,
+		Node: "anchor", Module: "distribution"}}}
+	other := workstation()
+	other.Name = "laptop"
+	_, err := Resolve(shelf(store), []string{"distribution"}, other, elsewhere)
+	if err == nil {
+		t.Fatal("a second store was accepted on another machine; it would offer artifact-store a " +
+			"second time and every consumer elsewhere would refuse to choose")
+	}
+	if !strings.Contains(err.Error(), "mesh-artifact-store") || !strings.Contains(err.Error(), "one per mesh") {
+		t.Fatalf("refused without naming the seat: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/artifact_sweep_seat.go b/internal/compose/resolution/artifact_sweep_seat.go
new file mode 100644
index 0000000..98888e7
--- /dev/null
+++ b/internal/compose/resolution/artifact_sweep_seat.go
@@ -0,0 +1,43 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// artifactSweepVerbs are the seat's verbs, with the controller's arguments so a caller changes only the seat it asks.
+func artifactSweepVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "artifacts", Description: "Every artifact the mesh made that lives in its artifact store, each with its " +
+			"repository, digest, kind (image or archive) and state: kept, and why (a want names it, or one of the five " +
+			"newest builds of its module in the builder's log), eligible (made, kept for no reason, not yet let go), or " +
+			"unrecorded (in the store and named by nothing the mesh made: never removed). Reads only.",
+			Input: schema(map[string]string{
+				"repository": "only this repository's references, as <module>/<artifact> (the counts stay whole)",
+				"collected":  "\"true\": list the collected references too (counted always)",
+			}, nil, "collected")},
+		{Name: "held", Description: "Whether the artifact store holds each reference given, asked with one HEAD each: " +
+			"held, gone (the store answered 404) or unknown with why. The builder asks it before it reuses a done key. " +
+			"Reads only.",
+			Input: listed(schema(map[string]string{
+				"references": "the artifacts' references, artifact-store://<module>/<artifact>/blobs/sha256:<hex>: a list, " +
+					"or one text separated by commas",
+			}, []string{"references"}), "references")},
+		{Name: "collect", Description: "The artifact store's sweep, now: what is eligible is let go of. Without confirm a " +
+			"dry run: what would be let go, nothing held or deleted. With confirm and why: every kept archive held first, " +
+			"then each eligible artifact let go of, oldest first, an index with the platform manifests no kept index " +
+			"names, each deletion recorded in the hand-act log. Bounded by most (500 by default, at most 5000) and 45 " +
+			"seconds; what is left is said. Never touches a digest the mesh did not make.",
+			Input: schema(map[string]string{
+				"confirm": "\"true\": let go of what is eligible (needs why); without it nothing is done",
+				"why":     "with confirm: why, required and recorded",
+				"most":    "let go of at most this many (500 by default, at most 5000)",
+			}, nil, "confirm")},
+		{Name: "mirrors", Description: "The bases the mesh copied into its artifact store, each kept (a kept build stood on " +
+			"it), eligible (only builds no longer kept stood on it) or unrecorded (no build the builder's log holds stood on " +
+			"it: never removed), by what the builder's log says each build stood on. Records nothing by hand.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "images", Description: "Every container image one machine's want and have name, each with the resources " +
+			"naming it: what the machine keeps when it prunes its images. Reads only.",
+			Input: schema(map[string]string{"node": "the machine's name"}, []string{"node"})},
+	}
+}
diff --git a/internal/compose/resolution/artifacts.go b/internal/compose/resolution/artifacts.go
new file mode 100644
index 0000000..559ac1b
--- /dev/null
+++ b/internal/compose/resolution/artifacts.go
@@ -0,0 +1,65 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// artifactsInto composes the artifact store's address into a resource's `image` and `source`.
+//
+// **Composed here, at the last moment before a machine, and stored nowhere.** A kept reference is
+// routed through the store as this network reaches it now. A reference recorded with an address
+// before references were kept without one is re-routed the same way — but only when the mesh
+// built it (`with.Built` names every `<module>/<artifact>` it has), because a module may run an
+// image from a public registry under its own name and that one is exactly where it says.
+//
+// A kept reference with no store to route it through is refused: sent as it is, the runtime would
+// refuse the scheme on the machine, one push away from the reason.
+//
+// **What this does not reach: the images genesis pinned.** The installer builds the control plane
+// and the builder before the mesh exists, pushes them itself and pins their manifests to
+// `<registry>:<port>/mesh-controller@…` and `<registry>:<port>/mesh-builder@…` — single-segment
+// repositories with no build record, so `with.Built` does not name them and they are left as
+// written until each is rebuilt through the mesh, which records it by digest and path. Until then
+// a registry that moves strands exactly those two on a recreate, and the control plane's is the
+// one that cannot be repaired through the mesh. Rebuild both through `build` before moving the
+// store (novox/hq 04-ISSUES/102, finding F4).
+func artifactsInto(resource map[string]any, module string, with mcat.Rendering) error {
+	for _, key := range []string{"image", "source"} {
+		written, ok := resource[key].(string)
+		if !ok {
+			continue
+		}
+		if _, kept := mcat.InArtifactStore(written); kept {
+			if with.ArtifactStore == "" {
+				return fmt.Errorf(
+					"%s's %v names %s, which is in the mesh's artifact store, and this mesh has no "+
+						"artifact store on its network to fetch it from — nothing assigned offers "+
+						"%s, or the machine offering it is not on the private network",
+					module, resource["id"], written, mcat.ArtifactStoreProvision)
+			}
+			resource[key] = mcat.Routed(written, with.ArtifactStore)
+			continue
+		}
+		if with.ArtifactStore == "" {
+			continue
+		}
+		recorded := mcat.Recorded(written)
+		if recorded == written {
+			continue
+		}
+		path, _ := mcat.InArtifactStore(recorded)
+		repository := path
+		if at := strings.IndexAny(path, "@"); at >= 0 {
+			repository = path[:at]
+		} else if blobs := strings.Index(path, "/blobs/"); blobs >= 0 {
+			repository = path[:blobs]
+		}
+		if with.Built[repository] {
+			resource[key] = mcat.Routed(recorded, with.ArtifactStore)
+		}
+	}
+	return nil
+}
diff --git a/internal/compose/resolution/artifacts_test.go b/internal/compose/resolution/artifacts_test.go
new file mode 100644
index 0000000..e9ab076
--- /dev/null
+++ b/internal/compose/resolution/artifacts_test.go
@@ -0,0 +1,102 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+var digest = "sha256:" + strings.Repeat("d", 64)
+
+// **The address is composed into a declaration, and the record never carries it.**
+func TestAnImageTheMeshBuiltIsRoutedThroughTheStoreWhenDeclared(t *testing.T) {
+	m := mcat.Manifest{Module: "gitea", Version: "1", Resources: []map[string]any{
+		{"id": "server", "type": "container", "name": "mesh-gitea", "artifact": "server"},
+		{"id": "config", "type": "archive", "path": "/etc/gitea", "artifact": "config"},
+		{"id": "cache", "type": "container", "name": "mesh-gitea-cache", "image": "valkey/valkey@" + digest},
+	}, Build: &mcat.Build{Artifacts: []mcat.Artifact{
+		{Name: "server", Kind: mcat.ArtifactImage, From: "Dockerfile"},
+		{Name: "config", Kind: mcat.ArtifactArchive, From: "config"},
+	}}}
+	resolved, err := m.Resolve([]mcat.Built{
+		{Name: "server", Kind: mcat.ArtifactImage, Reference: mcat.ArtifactStoreScheme + "gitea/server@" + digest},
+		{Name: "config", Kind: mcat.ArtifactArchive, Reference: mcat.ArtifactStoreScheme + "gitea/config/blobs/" + digest, Digest: digest},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{resolved}}
+
+	out, err := Declaration(r, mcat.Rendering{ArtifactStore: "anchor.internal:5101"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fileNamed(out, "gitea.server")["image"]; got != "anchor.internal:5101/gitea/server@"+digest {
+		t.Errorf("the image the mesh built is fetched as %v", got)
+	}
+	if got := fileNamed(out, "gitea.config")["source"]; got != "http://anchor.internal:5101/v2/gitea/config/blobs/"+digest {
+		t.Errorf("the archive the mesh built is fetched from %v", got)
+	}
+	if got := fileNamed(out, "gitea.cache")["image"]; got != "valkey/valkey@"+digest {
+		t.Errorf("an image from a public registry was routed through the store: %v", got)
+	}
+	// The manifest the mesh holds still says what it is, not where it was fetched from.
+	if got := resolved.Resources[0]["image"]; got != mcat.ArtifactStoreScheme+"gitea/server@"+digest {
+		t.Errorf("composing wrote the address into the catalogue's copy: %v", got)
+	}
+
+	// And the store moves: the same record, another address, without a rebuild.
+	out, err = Declaration(r, mcat.Rendering{ArtifactStore: "laptop.internal:5000"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fileNamed(out, "gitea.server")["image"]; got != "laptop.internal:5000/gitea/server@"+digest {
+		t.Errorf("after the store moved, the image is still fetched as %v", got)
+	}
+}
+
+func TestAnImageInTheStoreWithNoStoreToFetchItFromIsRefused(t *testing.T) {
+	m := mcat.Manifest{Module: "gitea", Version: "1", Resources: []map[string]any{
+		{"id": "server", "type": "container", "name": "mesh-gitea",
+			"image": mcat.ArtifactStoreScheme + "gitea/server@" + digest},
+	}}
+	_, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m}}, mcat.Rendering{})
+	if err == nil || !strings.Contains(err.Error(), "no artifact store") {
+		t.Fatalf("a reference nothing can fetch was sent to a machine: %v", err)
+	}
+}
+
+// **A reference recorded with an address before this follows the store too** — when the mesh
+// built it. A module running an image straight from a public registry under its own name is left
+// exactly where it says: `quay.io/keycloak/keycloak` is not the mesh's, whatever it is called.
+func TestAReferenceRecordedWithAnAddressFollowsTheStoreWhenTheMeshBuiltIt(t *testing.T) {
+	m := mcat.Manifest{Module: "keycloak", Version: "1", Resources: []map[string]any{
+		{"id": "server", "type": "container", "name": "mesh-keycloak",
+			"image": "anchor.internal:5100/keycloak/server@" + digest},
+		{"id": "upstream", "type": "container", "name": "mesh-keycloak-upstream",
+			"image": "quay.io/keycloak/keycloak@" + digest},
+	}}
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m}}
+	out, err := Declaration(r, mcat.Rendering{
+		ArtifactStore: "anchor.internal:5101",
+		Built:         map[string]bool{"keycloak/server": true},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fileNamed(out, "keycloak.server")["image"]; got != "anchor.internal:5101/keycloak/server@"+digest {
+		t.Errorf("an image the mesh built, recorded with the old address, is fetched as %v", got)
+	}
+	if got := fileNamed(out, "keycloak.upstream")["image"]; got != "quay.io/keycloak/keycloak@"+digest {
+		t.Errorf("a public image was re-routed through the store: %v", got)
+	}
+	// Nothing known to be built: nothing re-routed, nothing refused.
+	out, err = Declaration(r, mcat.Rendering{ArtifactStore: "anchor.internal:5101"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fileNamed(out, "keycloak.server")["image"]; got != "anchor.internal:5100/keycloak/server@"+digest {
+		t.Errorf("with no build record, a reference was rewritten: %v", got)
+	}
+}
diff --git a/internal/compose/resolution/backup_placement.go b/internal/compose/resolution/backup_placement.go
new file mode 100644
index 0000000..46156a9
--- /dev/null
+++ b/internal/compose/resolution/backup_placement.go
@@ -0,0 +1,46 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofBackup is where a holder places them: ${backup:<key>}. Loose inside the braces, so a misspelt key is found and
+// refused rather than written out as text.
+var ofBackup = regexp.MustCompile(`\$\{backup:([^}]*)\}`)
+
+// backupKinds is the contribution kind each key of the backup placement renders.
+var backupKinds = map[string]string{"lines": mcat.BackupKindBackup, "data": mcat.BackupKindData}
+
+// backupPlacer is the machine's modules the backup placement is composed over, as the old contributions are.
+type backupPlacer struct {
+	modules  []mcat.Manifest
+	with     mcat.Rendering
+	facts    map[string]string
+	caps     map[string]bool
+	unplaced *[]string
+}
+
+// placed is the text of one key for a holder, or what is wrong with naming it.
+func (b backupPlacer) placed(holder mcat.Manifest, key string, item bool) (string, string) {
+	kind, known := backupKinds[key]
+	switch {
+	case item:
+		return "", "an item is kept per item; the machine's backup lines are placed only in a file"
+	case !known:
+		return "", fmt.Sprintf("the backup placement has `lines` and `data`, not %q", key)
+	case !holder.ClaimsSeat(mcat.BackupSeat):
+		return "", fmt.Sprintf("%s does not claim %s; the machine's backup lines are placed by its holder alone "+
+			"(novox/hq ADR 0212)", holder.Module, mcat.BackupSeat)
+	}
+	text, left, err := seatContributions(b.modules, holder, mcat.BackupSeat+":"+kind, b.with, b.facts, b.caps)
+	if b.unplaced != nil {
+		*b.unplaced = append(*b.unplaced, left...)
+	}
+	if err != nil {
+		return "", err.Error()
+	}
+	return text, ""
+}
diff --git a/internal/compose/resolution/backup_placement_test.go b/internal/compose/resolution/backup_placement_test.go
new file mode 100644
index 0000000..9035fc1
--- /dev/null
+++ b/internal/compose/resolution/backup_placement_test.go
@@ -0,0 +1,114 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const oldBackupText = "# lines\n${contribution:node-backup:backup}"
+
+const oldDataText = "# data\n${contribution:node-backup:data}"
+
+const placedBackupTxt = "# lines\n${backup:lines}"
+
+const placedDataTxt = "# data\n${backup:data}"
+
+const backupHolder = `{"module":"restic","version":"1","moved":true,"claims":[{"name":"node-backup","scope":"node"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[{"id":"declared","type":"file","path":"/etc/backups.conf","template":"files/backups"},
+               {"id":"data-declared","type":"file","path":"/etc/data.conf","template":"files/data"}]}`
+
+func dataModule(name string) string {
+	return `{"module":"` + name + `","version":"1","resources":[{"id":"d","type":"directory","mode":"0700"}],
+  "data":{"own":[{"id":"d","path":"${dir:d}","class":"irreplaceable","why":"the ` + name + ` data"}]}}`
+}
+
+// backupsOn is a machine of a holder whose files say these texts and the modules that declare data.
+func backupsOn(t *testing.T, lines, data string, modules ...string) mcat.Resolution {
+	t.Helper()
+	all := []mcat.Manifest{held(t, backupHolder, builtWith("restic", map[string]string{"backups": lines, "data": data}))}
+	names := []string{"restic"}
+	for _, name := range modules {
+		all = append(all, mustParse(t, dataModule(name)))
+		names = append(names, name)
+	}
+	r, err := Resolve(shelf(all...), names, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	return r
+}
+
+var backupModules = []string{"alpha", "beta", "gamma"}
+
+// gammaLeftOut is a machine whose gamma does not place: its lines are kept, best effort.
+func gammaLeftOut(with mcat.Rendering) mcat.Rendering {
+	with.NotPlaced = map[string]string{"gamma": "its placement setting does not read"}
+	return with
+}
+
+func TestTheBackupPlacementIsTheTextTheOldPlaceholdersRender(t *testing.T) {
+	// The old form is an unmoved holder: its placeholders are the controller's alone.
+	oldHolder := strings.Replace(backupHolder, `"moved":true,`, "", 1)
+	all := []mcat.Manifest{held(t, oldHolder, builtWith("restic", map[string]string{"backups": oldBackupText, "data": oldDataText}))}
+	for _, name := range backupModules {
+		all = append(all, mustParse(t, dataModule(name)))
+	}
+	old, err := Resolve(shelf(all...), append([]string{"restic"}, backupModules...), workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	old.Account = "op"
+	wantLines, wantData := fileOf(t, old, gammaLeftOut(mcat.Rendering{}), "restic.declared"), fileOf(t, old, gammaLeftOut(mcat.Rendering{}), "restic.data-declared")
+	if !strings.Contains(wantLines, "# alpha\npath ") || !strings.Contains(wantLines, "# gamma\n") || !strings.Contains(wantData, "item d") {
+		t.Fatalf("the old form renders\n%s\n%s", wantLines, wantData)
+	}
+	moved := backupsOn(t, placedBackupTxt, placedDataTxt, backupModules...)
+	// Not handed: the controller fills the new placeholders with the old text.
+	if got := fileOf(t, moved, gammaLeftOut(mcat.Rendering{}), "restic.declared"); got != wantLines {
+		t.Errorf("not handed, the lines are\n%s\nwant\n%s", got, wantLines)
+	}
+	if got := fileOf(t, moved, gammaLeftOut(mcat.Rendering{}), "restic.data-declared"); got != wantData {
+		t.Errorf("not handed, the data is\n%s\nwant\n%s", got, wantData)
+	}
+	// Handed: the plan carries the same text as placement, and the files are the client's.
+	c, _ := composeWith(t, moved, gammaLeftOut(handingTo("store:5000")))
+	p := c.Plans["restic"].Placement
+	if got := "# lines\n" + p["backup:lines"]; got != wantLines {
+		t.Errorf("handed, the plan's lines are\n%s\nwant\n%s", got, wantLines)
+	}
+	if got := "# data\n" + p["backup:data"]; got != wantData {
+		t.Errorf("handed, the plan's data is\n%s\nwant\n%s", got, wantData)
+	}
+	if len(p) != 2 {
+		t.Errorf("the plan's placement is %v", p)
+	}
+}
+
+func TestAnUnknownBackupKeyIsRefused(t *testing.T) {
+	r := backupsOn(t, "${backup:rows}", placedDataTxt, backupModules...)
+	if _, err := Compose(r, handingTo("store:5000")); err == nil || !strings.Contains(err.Error(), "backup:rows") {
+		t.Errorf("handed, an unknown key is %v", err)
+	}
+	if _, err := Declaration(r, mcat.Rendering{}); err == nil || !strings.Contains(err.Error(), "backup:rows") {
+		t.Errorf("not handed, an unknown key is %v", err)
+	}
+}
+
+func fileOf(t *testing.T, r mcat.Resolution, with mcat.Rendering, id string) string {
+	t.Helper()
+	out, err := Declaration(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range out {
+		if res["id"] == id {
+			return res["content"].(string)
+		}
+	}
+	t.Fatalf("%s was not composed", id)
+	return ""
+}
diff --git a/internal/compose/resolution/backup_test.go b/internal/compose/resolution/backup_test.go
new file mode 100644
index 0000000..6583285
--- /dev/null
+++ b/internal/compose/resolution/backup_test.go
@@ -0,0 +1,37 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A module on the shelf from before ADR 0233, which writes its backup lines by hand and declares no
+// data, is still backed up: its lines are placed as written, each module's under a comment naming it.
+func TestHandWrittenBackupLinesOfAnOlderModuleArePlaced(t *testing.T) {
+	pg, err := decodeForTest([]byte(`{"module":"pg","version":"1",
+		"resources":[{"id":"dumps","type":"directory","path":"/srv/pg/dumps","mode":"0700"}],
+		"contributions":[{"seat":"node-backup","kind":"backup","content":"run pg-dump-all\npath ${dir:dumps}"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	mail, err := decodeForTest([]byte(`{"module":"mail","version":"1",
+		"resources":[{"id":"spool","type":"directory","mode":"0700"}],
+		"contributions":[{"seat":"node-backup","kind":"backup","content":"path ${dir:spool}"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	placed, _, err := seatContributions([]mcat.Manifest{pg, mail}, mcat.Manifest{}, mcat.BackupSeat+":"+"backup", mcat.Rendering{}, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"# pg\nrun pg-dump-all\npath /srv/pg/dumps\n", "# mail\npath /var/lib/mail/spool\n"} {
+		if !strings.Contains(placed, want) {
+			t.Errorf("placed contributions lack %q:\n%s", want, placed)
+		}
+	}
+	if strings.Contains(placed, "${dir:") {
+		t.Errorf("a directory reached the holder unfilled:\n%s", placed)
+	}
+}
diff --git a/internal/compose/resolution/bound.go b/internal/compose/resolution/bound.go
new file mode 100644
index 0000000..bf7b620
--- /dev/null
+++ b/internal/compose/resolution/bound.go
@@ -0,0 +1,117 @@
+package resolution
+
+import (
+	"fmt"
+	"slices"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// keepBound holds every need for a provision that keeps its consumers' data at the provider its
+// consumer was bound to, where the resolution chose another.
+//
+// A need with no record is a binding being made, and is left as resolved: it is recorded when it is
+// first sent. A pin naming the provider the resolution chose is a person moving it, and is left too.
+// Otherwise the recorded provider answers, if it still provides the provision — beside the consumer,
+// or offered from elsewhere — and the move is returned as kept. **One that no longer does is refused,
+// never answered by the provider chosen**: answering it there is exactly the silent move this exists
+// to stop, and the consumer's data is still wherever it was.
+func keepBound(needs []mcat.Needed, catalogue map[string]mcat.Manifest, node mcat.Node, world mcat.World,
+	keeps map[string]bool, here func(string) bool) ([]mcat.Needed, []mcat.KeptBinding, []string) {
+	var kept []mcat.KeptBinding
+	var problems []string
+	refused := map[[2]string]bool{}
+	out := make([]mcat.Needed, 0, len(needs))
+	for _, n := range needs {
+		if n.ByRecord || !keeps[n.Name] {
+			out = append(out, n)
+			continue
+		}
+		n.KeepsData = true
+		bound, recorded := world.Bound[n.For][n.Name]
+		chose := mcat.Chosen{Node: n.From, Module: n.Module}
+		if !recorded || sameProvider(bound, chose) {
+			out = append(out, n)
+			continue
+		}
+		if pin, pinned := world.Pinned[n.Name]; pinned && chosenMatches(pin, mcat.Provider{Node: chose.Node, Module: chose.Module}) {
+			out = append(out, n)
+			continue
+		}
+		held, ok, why := boundNeed(n, bound, catalogue, node, world, here)
+		if !ok {
+			if key := [2]string{n.For, n.Name}; !refused[key] {
+				refused[key] = true
+				problems = append(problems, fmt.Sprintf(
+					"%s on %s is bound to %s for %q, which keeps its data, and %s — it would move to %s, "+
+						"which holds none of it. Move its data and say so with `pin %s %s %s %s`, or give "+
+						"%s back what it provided",
+					n.For, node.Name, bound, n.Name, why, chose, node.Name, n.Name, chose.Node, chose.Module,
+					bound.Node))
+			}
+			continue
+		}
+		out = append(out, held)
+		kept = append(kept, mcat.KeptBinding{Machine: node.Name, Consumer: n.For, Provision: n.Name, Bound: bound, Would: chose})
+	}
+	return out, kept, problems
+}
+
+// sameProvider is whether a recorded provider is the one chosen. A record naming no module (none
+// is written without one, but a person's hand might) matches any module on its node.
+func sameProvider(bound, chose mcat.Chosen) bool {
+	return bound.Node == chose.Node && (bound.Module == "" || bound.Module == chose.Module)
+}
+
+// boundNeed is the need answered by the recorded provider, or why it cannot be.
+func boundNeed(n mcat.Needed, bound mcat.Chosen, catalogue map[string]mcat.Manifest, node mcat.Node, world mcat.World,
+	here func(string) bool) (mcat.Needed, bool, string) {
+	held := mcat.Needed{Name: n.Name, For: n.For, Local: n.Local, KeepsData: true}
+	if bound.Node == node.Name {
+		m, known := catalogue[bound.Module]
+		if !known || !here(bound.Module) || !providesAt(m, n.Name, mcat.ScopeMesh) {
+			return mcat.Needed{}, false, fmt.Sprintf("%s no longer runs on %s", bound.Module, node.Name)
+		}
+		at := node.At
+		if at == "" {
+			at = "127.0.0.1"
+		}
+		held.From, held.At, held.Module = node.Name, at, m.Module
+		held.Serves, held.SharedOwn, held.Identity = servedByOne(m, n.Name), sharedByOne(m, n.Name), m.IdentityBoundOf(n.Name)
+		held.CredentialForm, held.CredentialTool = m.CredentialFormOf(n.Name), m.CredentialToolOf(n.Name)
+		return held, true, ""
+	}
+	matching := chosenAmong(bound, world.Offered[n.Name])
+	if len(matching) != 1 {
+		return mcat.Needed{}, false, fmt.Sprintf("%s no longer provides it", bound)
+	}
+	p := matching[0]
+	if node.At == "" || p.At == "" {
+		return mcat.Needed{}, false, fmt.Sprintf("%s and %s are not both on the private network", node.Name, p.Node)
+	}
+	identity := mcat.DefaultIdentityBound
+	if pm, known := catalogue[p.Module]; known {
+		held.SharedOwn, _ = pm.SharedCredentialOf(n.Name)
+		held.CredentialForm, held.CredentialTool = pm.CredentialFormOf(n.Name), pm.CredentialToolOf(n.Name)
+		identity = pm.IdentityBoundOf(n.Name)
+	}
+	held.From, held.At, held.Module, held.Serves, held.Identity = p.Node, p.At, p.Module, p.Serves, identity
+	held.LeftOut = p.LeftOut
+	return held, true, ""
+}
+
+// BindsFrom is the providers this resolution binds a pair credential's need to — the provision, the
+// module that requires it and the credential's local name — answered by a machine rather than by a
+// record. None means this machine states no such binding.
+func BindsFrom(r mcat.Resolution, provision, module, local string) []string {
+	var from []string
+	for _, n := range r.Needs {
+		if n.ByRecord || n.Name != provision || n.For != module || n.Local != local {
+			continue
+		}
+		if !slices.Contains(from, n.From) {
+			from = append(from, n.From)
+		}
+	}
+	return from
+}
diff --git a/internal/compose/resolution/bound_into_files.go b/internal/compose/resolution/bound_into_files.go
new file mode 100644
index 0000000..d27401e
--- /dev/null
+++ b/internal/compose/resolution/bound_into_files.go
@@ -0,0 +1,176 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// bound is where a module says a value from one of its bindings belongs:
+// ${bound:<provision>:<key>}, and for an optional requirement the value it takes while absent,
+// ${bound:<provision>:<key>|default:<value>} (novox/hq ADR 0330 §4). A default is never empty: an
+// absent requirement is never rendered as an empty string.
+var bound = regexp.MustCompile(`\$\{bound:([a-z0-9][a-z0-9.-]*[a-z0-9]):([a-z0-9][a-z0-9_-]*)(?:\|default:([^}\n]+))?\}`)
+
+// knownFor is everything a module may name from one of its bindings.
+//
+// Three facts the mesh states about any provision, plus whatever the provider said it serves. A
+// module may not reach a binding it does not have — the same boundary as a secret, for the same
+// reason.
+func knownFor(m mcat.Manifest, needs []mcat.Needed, node string) (map[string]map[string]string, error) {
+	out := map[string]map[string]string{}
+	for _, want := range m.Wants() {
+		for i := range needs {
+			n := needs[i]
+			if n.Name != want || n.For != m.Module {
+				continue
+			}
+			as := mcat.ConsumerIdentity(node, mcat.IdentitySource(m.Slug, m.Module))
+			values := map[string]string{
+				"at":   n.At,
+				"from": n.From,
+				"as":   as,
+			}
+			// What the provider derives for this consumer rather than for all of them
+			// (novox/hq ADR 0202). Filled here, the one place a provision and the module
+			// requiring it are both in hand.
+			served, err := ServedTo(n.Serves, as)
+			if err != nil {
+				return nil, fmt.Errorf("%s requires %s: %w", m.Module, want, err)
+			}
+			for key, value := range served {
+				// The provider's own vocabulary. Rendered plainly: a port is 5432, not 5432.000000,
+				// which is what a float would write and what a connection string would refuse.
+				values[key] = plainly(value)
+			}
+			out[want] = values
+		}
+	}
+	return out, nil
+}
+
+// withOwnNames adds a module's own composed names to what it may name from one binding:
+// `${bound:<provision>:name}` and `:internal-name`, and for several contributions to one requirement
+// `:name-<local>` / `:internal-name-<local>`. Set over anything the provider serves under those keys:
+// what the module is called is the mesh's statement, not the provider's.
+func withOwnNames(values map[string]string, own map[string]any) {
+	for _, key := range []string{"name", "internal-name"} {
+		if v, ok := own[key].(string); ok {
+			values[key] = v
+		}
+	}
+	many, _ := own["names"].(map[string]any)
+	for local, raw := range many {
+		names, _ := raw.(map[string]any)
+		for _, key := range []string{"name", "internal-name"} {
+			if v, ok := names[key].(string); ok {
+				values[key+"-"+local] = v
+			}
+		}
+	}
+}
+
+// plainly renders a served value as a program would expect to read it.
+func plainly(value any) string {
+	switch v := value.(type) {
+	case string:
+		return v
+	case float64:
+		if v == float64(int64(v)) {
+			return fmt.Sprintf("%d", int64(v))
+		}
+		return strings.TrimRight(strings.TrimRight(fmt.Sprintf("%f", v), "0"), ".")
+	case bool:
+		return fmt.Sprintf("%t", v)
+	case nil:
+		return ""
+	default:
+		return fmt.Sprint(v)
+	}
+}
+
+// boundInto replaces a file's ${bound:…} placeholders with what the mesh knows.
+//
+// A placeholder naming something the module does not require, or a key the provider does not
+// serve, is refused. Left as it was, the literal `${bound:x:y}` would be written into a
+// configuration file and read as a value — a connection to a host called `${bound:x:y}`, failing
+// somewhere that names neither the module nor the mesh.
+//
+// **An optional requirement left absent takes the default its placeholder names** (novox/hq ADR
+// 0330 §4), and one that names none is refused rather than rendered empty. The module check refuses
+// that already; this is the same rule where the file is made, for a manifest registered before it.
+func boundInto(resource map[string]any, known map[string]map[string]string, module string, absent map[string]bool) error {
+	if fmt.Sprint(resource["type"]) != "file" {
+		return nil
+	}
+	content, ok := resource["content"].(string)
+	if !ok {
+		return nil
+	}
+	var refused error
+	filled := bound.ReplaceAllStringFunc(content, func(token string) string {
+		if refused != nil {
+			return token
+		}
+		m := bound.FindStringSubmatch(token)
+		provision, key, fallback := m[1], m[2], m[3]
+		values, has := known[provision]
+		if !has {
+			if absent[provision] {
+				if fallback != "" {
+					return fallback
+				}
+				refused = fmt.Errorf(
+					"%s has a file that says ${bound:%s:%s}, and %q is optional and absent here: it names no "+
+						"value for then (${bound:%s:%s|default:<value>}), so it would be written empty "+
+						"(novox/hq ADR 0330 §4)", module, provision, key, provision, provision, key)
+				return token
+			}
+			refused = fmt.Errorf(
+				"%s has a file that says ${bound:%s:%s}, and %s does not require %q. It may name %s",
+				module, provision, key, module, provision, orNothing(namesOfBindings(known)))
+			return token
+		}
+		value, said := values[key]
+		if !said {
+			refused = fmt.Errorf(
+				"%s asks its %s binding for %q, and what answers it says %s",
+				module, provision, key, orNothing(namesOfKeys(values)))
+			return token
+		}
+		return value
+	})
+	if refused != nil {
+		return refused
+	}
+	resource["content"] = filled
+	return nil
+}
+
+func namesOfBindings(known map[string]map[string]string) []string {
+	var names []string
+	for name := range known {
+		names = append(names, fmt.Sprintf("%q", name))
+	}
+	sort.Strings(names)
+	return names
+}
+
+func namesOfKeys(values map[string]string) []string {
+	var names []string
+	for key := range values {
+		names = append(names, fmt.Sprintf("%q", key))
+	}
+	sort.Strings(names)
+	return names
+}
+
+func orNothing(names []string) string {
+	if len(names) == 0 {
+		return "nothing"
+	}
+	return join(names)
+}
diff --git a/internal/compose/resolution/bound_into_files_test.go b/internal/compose/resolution/bound_into_files_test.go
new file mode 100644
index 0000000..0da5176
--- /dev/null
+++ b/internal/compose/resolution/bound_into_files_test.go
@@ -0,0 +1,246 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A consumer writes its own connection string (novox/hq 04-ISSUES/023).
+//
+// Everything needed for one now reaches the file that needs it: the address and port from what the
+// provider serves, the name to present from what the mesh decided, the database name from what the
+// module itself contributed, and the password through the sealed hole the host fills.
+func TestAConsumerCanWriteAConnectionString(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "workstation",
+		Modules: []mcat.Manifest{{
+			Module:   "keycloak",
+			Requires: []string{"postgres-database"},
+			Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
+			Resources: []map[string]any{{
+				"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
+				"mode": "0600",
+				"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:" +
+					"${bound:postgres-database:port}/keycloak\n" +
+					"KC_DB_USERNAME=${bound:postgres-database:as}\n" +
+					"KC_DB_PASSWORD=${secret:postgres-database}\n",
+			}},
+		}},
+		Needs: []mcat.Needed{{
+			Name: "postgres-database", From: "anchor", At: "anchor.internal", For: "keycloak",
+			Sealed: "sealed-db", Serves: map[string]any{"port": float64(5432)},
+		}},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "keycloak.dbenv")
+	if file == nil {
+		t.Fatalf("no file in %v", out)
+	}
+	got := file["content"].(string)
+
+	want := "KC_DB_URL=jdbc:postgresql://anchor.internal:5432/keycloak\n" +
+		"KC_DB_USERNAME=mesh_workstation_keycloak\n" +
+		"KC_DB_PASSWORD=${secret:postgres-database}\n"
+	if got != want {
+		t.Errorf("the consumer cannot connect with what it was given:\n got %q\nwant %q", got, want)
+	}
+	// The password is still a hole. Only the host may fill that one, and only on the machine.
+	if sealed, _ := file["secrets"].(map[string]any); sealed["postgres-database"] != "sealed-db" {
+		t.Errorf("the credential did not travel with the file: %v", file)
+	}
+}
+
+// A provider answered on its consumer's own machine is announced at the port the machine PUBLISHES
+// it on, not the port the module declared (novox/hq 04-ISSUES/038).
+//
+// Issue 018 made the same-node provider announced at all; this is the promise after it — that the
+// port a co-located consumer is told is the one actually listening at the address it is handed. The
+// mesh assigns a bare `ports` mapping a host port (here the container's 5432 becomes 15432 on this
+// machine), and it must announce 15432, or the consumer dials workstation.internal:5432 where the
+// provider is not published. Cross-node consumers already got this (the plan re-derives the served
+// facts with the provider's assignment); the same-node need was settled before the assignment and
+// carried the declared port until now.
+func TestASameNodeProviderIsAnnouncedAtThePortItIsPublishedOn(t *testing.T) {
+	provider := mcat.Manifest{
+		Module: "postgres", Version: "1",
+		Provides: mcat.FromAnywhere("postgres-database"),
+		Listens:  []mcat.Listening{{Port: 5432, Protocol: "tcp", From: "mesh"}},
+		Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "postgres",
+			"ports": []any{"5432"},
+		}},
+	}
+	consumer := mcat.Manifest{
+		Module: "keycloak", Version: "1", Requires: []string{"postgres-database"},
+		Resources: []map[string]any{{
+			"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env", "mode": "0600",
+			"content": "KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:" +
+				"${bound:postgres-database:port}/keycloak\n",
+		}},
+	}
+	r, err := Resolve(shelf(provider, consumer),
+		[]string{"postgres", "keycloak"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The mesh assigned the container's 5432 to 15432 on this machine.
+	out, err := Declaration(r, mcat.Rendering{Ports: map[string]map[int]int{"postgres": {5432: 15432}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Where the provider is actually published: the assigned host port, on the machine at large.
+	server := fileNamed(out, "postgres.server")
+	if server == nil {
+		t.Fatalf("the provider container is not in the declaration: %v", out)
+	}
+	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "15432:5432") {
+		t.Fatalf("the provider was not published on the assigned port: %v", server["ports"])
+	}
+
+	// What the consumer was told to dial: the SAME port, at the announced address — not the 5432 the
+	// module declared, which is closed on that address.
+	dbenv := fileNamed(out, "keycloak.dbenv")
+	if dbenv == nil {
+		t.Fatalf("the consumer's binding file is not in the declaration: %v", out)
+	}
+	got := dbenv["content"].(string)
+	want := "KC_DB_URL=jdbc:postgresql://workstation.internal:15432/keycloak\n"
+	if got != want {
+		t.Errorf("the consumer dials a port the provider does not listen on:\n got %q\nwant %q",
+			got, want)
+	}
+}
+
+// A port is 5432, not 5432.000000 — which is what a number decoded from JSON would write, and what
+// every connection string in the world would refuse.
+func TestAPortIsWrittenAsAPort(t *testing.T) {
+	if got := plainly(float64(5432)); got != "5432" {
+		t.Errorf("a port was rendered as %q", got)
+	}
+	if got := plainly("postgres"); got != "postgres" {
+		t.Errorf("a string was rendered as %q", got)
+	}
+}
+
+// The name the provider will create is the name the consumer is told to present. One derivation,
+// so the two agree by construction rather than by two conventions written on the same day.
+func TestTheProviderAndTheConsumerAgreeOnTheName(t *testing.T) {
+	provider, err := Resolve(shelf(mcat.Manifest{
+		Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database"),
+		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
+		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
+	}), []string{"postgres"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(provider, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "postgres-database", Consumer: "workstation", From: "keycloak",
+		Values: map[string]any{"name": "keycloak"}, Sealed: "sealed",
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var told string
+	for _, res := range out {
+		if res["path"] == "/var/lib/postgres/grants/mesh.json" {
+			told = res["content"].(string)
+		}
+	}
+	if !strings.Contains(told, `"as": "mesh_workstation_keycloak"`) {
+		t.Errorf("the provider was not told what to call the login: %s", told)
+	}
+	if told == "" {
+		t.Fatal("the provider was told nothing at all")
+	}
+	// Which is exactly what the consumer, on its own machine, is told to present.
+	if mcat.ConsumerIdentity("workstation", "keycloak") != "mesh_workstation_keycloak" {
+		t.Errorf("got %q", mcat.ConsumerIdentity("workstation", "keycloak"))
+	}
+}
+
+// A binding the module does not have is a typo, refused where it was written.
+func TestAFileCannotNameABindingTheModuleDoesNotHave(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "workstation",
+		Modules: []mcat.Manifest{{
+			Module: "keycloak", Requires: []string{"postgres-database"},
+			Resources: []map[string]any{{
+				"id": "conf", "type": "file", "path": "/etc/keycloak.conf",
+				"content": "host=${bound:s3-bucket:at}\n",
+			}},
+		}},
+		Needs: []mcat.Needed{{Name: "postgres-database", From: "anchor", At: "a", For: "keycloak"}},
+	}
+	_, err := Declaration(r, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module read a binding it does not have")
+	}
+	if !strings.Contains(err.Error(), "postgres-database") {
+		t.Errorf("the refusal does not say what it could have named: %v", err)
+	}
+}
+
+// A key the provider does not serve is refused too. Written through, the literal placeholder
+// becomes a hostname, and the failure names neither the module nor the mesh.
+func TestAKeyTheProviderDoesNotServeIsRefused(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "workstation",
+		Modules: []mcat.Manifest{{
+			Module: "keycloak", Requires: []string{"postgres-database"},
+			Resources: []map[string]any{{
+				"id": "conf", "type": "file", "path": "/etc/keycloak.conf",
+				"content": "sock=${bound:postgres-database:socket}\n",
+			}},
+		}},
+		Needs: []mcat.Needed{{
+			Name: "postgres-database", From: "anchor", At: "a", For: "keycloak",
+			Serves: map[string]any{"port": float64(5432)},
+		}},
+	}
+	_, err := Declaration(r, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module read a key nothing serves, and the placeholder became a value")
+	}
+	if !strings.Contains(err.Error(), `"port"`) {
+		t.Errorf("the refusal does not say what is served: %v", err)
+	}
+}
+
+// A machine's resolver configuration must name its resolver by address — it cannot resolve the name
+// of the thing it resolves names with (novox/hq ADR 0194). So a binding offers the providing
+// machine's private address beside its name, and only when the machine has one.
+func TestABindingOffersTheProvidersAddress(t *testing.T) {
+	consumer := func() mcat.Resolution {
+		return mcat.Resolution{
+			Node: "workstation",
+			Modules: []mcat.Manifest{{
+				Module:   "resolv-conf",
+				Requires: []string{"wildcard-resolution"},
+				Resources: []map[string]any{{
+					"id": "resolv", "type": "file", "path": "/etc/resolv.conf", "mode": "0644",
+					"content": "nameserver ${bound:wildcard-resolution:address}\n",
+				}},
+			}},
+			Needs: []mcat.Needed{{Name: "wildcard-resolution", From: "anchor", At: "anchor.internal", For: "resolv-conf"}},
+		}
+	}
+	out, err := Declaration(consumer(), mcat.Rendering{Machines: map[string]string{"anchor.internal": "10.77.0.1"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := fileNamed(out, "resolv-conf.resolv")["content"]; got != "nameserver 10.77.0.1\n" {
+		t.Fatalf("the resolver is not named by its address: %q", got)
+	}
+	// A machine with no address yet: refused, never written with a blank where the address belongs.
+	if _, err := Declaration(consumer(), mcat.Rendering{}); err == nil {
+		t.Fatal("a file naming an address the mesh does not have was composed")
+	}
+}
diff --git a/internal/compose/resolution/bound_test.go b/internal/compose/resolution/bound_test.go
new file mode 100644
index 0000000..98df9cb
--- /dev/null
+++ b/internal/compose/resolution/bound_test.go
@@ -0,0 +1,219 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+var incidentConsumers = []string{"board", "listings", "workflows", "agents", "game"}
+
+func storeMesh() map[string]mcat.Manifest {
+	shelf := map[string]mcat.Manifest{
+		"store": {Module: "store", Version: "1",
+			Provides: []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeMesh}},
+			Claims:   []mcat.Claim{{Name: "mesh-store", Scope: mcat.ScopeMesh}},
+			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+			Grants:   map[string]string{"postgres-database": "/grants"}},
+		"resolver": {Module: "resolver", Version: "1",
+			Provides: []mcat.Offer{{Name: "wildcard-resolution", Scope: mcat.ScopeMesh}},
+			Claims:   []mcat.Claim{{Name: "mesh-dns-resolver", Scope: mcat.ScopeMesh}}},
+		"network": {Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
+	}
+	for _, c := range incidentConsumers {
+		shelf[c] = mcat.Manifest{Module: c, Version: "1", Requires: []string{"postgres-database"}}
+	}
+	return shelf
+}
+
+// storeWorld is the rest of the mesh as the home server's plan sees it: the anchor runs a store and a
+// resolver and holds both seats; the home server runs its own of each.
+func storeWorld() mcat.World {
+	w := mcat.World{Offered: map[string][]mcat.Provider{
+		"postgres-database": {
+			{Node: "anchor", At: "anchor.internal", Module: "store", Serves: map[string]any{"port": 5432}},
+			{Node: "home", At: "home.internal", Module: "store", Serves: map[string]any{"port": 5434}},
+		},
+		"wildcard-resolution": {
+			{Node: "anchor", At: "anchor.internal", Module: "resolver"},
+			{Node: "home", At: "home.internal", Module: "resolver"},
+		},
+	}}
+	w.Held = []mcat.Held{
+		{Claim: "mesh-store", Scope: mcat.ScopeMesh, Node: "anchor", Module: "store"},
+		{Claim: "mesh-dns-resolver", Scope: mcat.ScopeMesh, Node: "anchor", Module: "resolver"},
+	}
+	w.Holdings = w.Held
+	return w
+}
+
+var home = mcat.Node{Name: "home", At: "home.internal"}
+
+func homeAssigned() []string {
+	return append([]string{"store", "resolver", "network"}, incidentConsumers...)
+}
+
+func boundFrom(t *testing.T, r mcat.Resolution, consumer, provision string) mcat.Needed {
+	t.Helper()
+	for _, n := range r.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("no binding of %s for %s: %+v", consumer, provision, r.Needs)
+	return mcat.Needed{}
+}
+
+func TestTheIncidentAMachinesOwnStoreKeepsItsConsumersWhenTheSeatIsHeldElsewhere(t *testing.T) {
+	got, err := Resolve(storeMesh(), homeAssigned(), home, storeWorld())
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range incidentConsumers {
+		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" || n.Module != "store" {
+			t.Errorf("%s bound to %s/%s; its data is on the store beside it (issue 273)", c, n.From, n.Module)
+		}
+	}
+	// And the resolver, which keeps nothing of anybody's, still answers from the seat's holder (258).
+	if n := boundFrom(t, got, "network", "wildcard-resolution"); n.From != "anchor" {
+		t.Errorf("the resolver bound to %s; the seat is held on anchor (issue 258)", n.From)
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("nothing was moved, and %d kept: %+v", len(got.Kept), got.Kept)
+	}
+}
+
+func TestTheIncidentWithEveryConsumerOnRecordStillMovesNothing(t *testing.T) {
+	w := storeWorld()
+	w.Bound = map[string]map[string]mcat.Chosen{}
+	for _, c := range incidentConsumers {
+		w.Bound[c] = map[string]mcat.Chosen{"postgres-database": {Node: "home", Module: "store"}}
+	}
+	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range incidentConsumers {
+		if n := boundFrom(t, got, c, "postgres-database"); n.From != "home" {
+			t.Errorf("%s bound to %s", c, n.From)
+		}
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("kept %+v", got.Kept)
+	}
+}
+
+func TestAPinElsewhereStillMovesAStoresConsumers(t *testing.T) {
+	w := storeWorld()
+	w.Pinned = map[string]mcat.Chosen{"postgres-database": {Node: "anchor", Module: "store"}}
+	w.Bound = map[string]map[string]mcat.Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	got, err := Resolve(storeMesh(), homeAssigned(), home, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" || n.Module != "store" {
+		t.Errorf("bound to %s/%s; a person pinned it to anchor", n.From, n.Module)
+	}
+	if len(got.Kept) != 0 {
+		t.Errorf("a pin is a person's move, not one to keep: %+v", got.Kept)
+	}
+}
+
+// A consumer on a machine with no store of its own, bound to one store, when the seat moves to
+// another: the holder would answer, and the binding stays.
+func laptopWorld(holder string) mcat.World {
+	w := storeWorld()
+	w.Held = []mcat.Held{{Claim: "mesh-store", Scope: mcat.ScopeMesh, Node: holder, Module: "store"}}
+	w.Holdings = w.Held
+	return w
+}
+
+var laptop = mcat.Node{Name: "laptop", At: "laptop.internal"}
+
+func TestABoundConsumerStaysWhenTheSeatsHolderChanges(t *testing.T) {
+	w := laptopWorld("home")
+	w.Bound = map[string]map[string]mcat.Chosen{"board": {"postgres-database": {Node: "anchor", Module: "store"}}}
+	got, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := boundFrom(t, got, "board", "postgres-database")
+	if n.From != "anchor" || n.At != "anchor.internal" || n.Serves["port"] != 5432 {
+		t.Fatalf("bound to %s at %s %v; its data is on anchor", n.From, n.At, n.Serves)
+	}
+	if len(got.Kept) != 1 {
+		t.Fatalf("the move was not said: %+v", got.Kept)
+	}
+	k := got.Kept[0]
+	if k.Bound != (mcat.Chosen{Node: "anchor", Module: "store"}) || k.Would != (mcat.Chosen{Node: "home", Module: "store"}) || k.Consumer != "board" {
+		t.Fatalf("kept %+v", k)
+	}
+	for _, want := range []string{"would move board's postgres-database from anchor/store to home/store",
+		"its data is on anchor/store", "pin laptop postgres-database home store", "move the data first"} {
+		if !strings.Contains(k.String(), want) {
+			t.Errorf("%q does not say %q", k.String(), want)
+		}
+	}
+	// Without a record it is a binding being made, and the holder answers it as before.
+	w.Bound = nil
+	got, err = Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "home" {
+		t.Errorf("a new consumer bound to %s; the seat is held on home", n.From)
+	}
+}
+
+func TestABoundConsumerWhoseProviderIsGoneIsRefusedNotMoved(t *testing.T) {
+	w := laptopWorld("anchor")
+	w.Offered["postgres-database"] = w.Offered["postgres-database"][:1] // only anchor's store is left
+	w.Bound = map[string]map[string]mcat.Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	_, err := Resolve(storeMesh(), []string{"board"}, laptop, w)
+	if err == nil {
+		t.Fatal("bound to home's store, which is gone, and answered by anchor's — the silent move")
+	}
+	for _, want := range []string{"board on laptop is bound to home/store", "home/store no longer provides it",
+		"pin laptop postgres-database anchor store"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("%q does not say %q", err, want)
+		}
+	}
+}
+
+func TestAMachinesOwnStoreUnassignedRefusesItsBoundConsumers(t *testing.T) {
+	w := storeWorld()
+	w.Bound = map[string]map[string]mcat.Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	_, err := Resolve(storeMesh(), []string{"board"}, home, w)
+	if err == nil || !strings.Contains(err.Error(), "store no longer runs on home") {
+		t.Fatalf("got %v", err)
+	}
+}
+
+// The first pass asks only what a machine offers, and is never refused by a binding.
+func TestTheFirstPassKeepsNoBinding(t *testing.T) {
+	w := storeWorld()
+	w.Unchecked = true
+	w.Bound = map[string]map[string]mcat.Chosen{"board": {"postgres-database": {Node: "gone", Module: "store"}}}
+	if _, err := Resolve(storeMesh(), []string{"board"}, laptop, w); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// An offer saying it keeps nothing is answered by the seat's holder as the resolver is, even where it
+// grants a credential.
+func TestAStoreSayingItKeepsNothingFollowsTheSeat(t *testing.T) {
+	shelf := storeMesh()
+	no := false
+	s := shelf["store"]
+	s.Provides = []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeMesh, KeepsConsumerData: &no}}
+	shelf["store"] = s
+	got, err := Resolve(shelf, homeAssigned(), home, storeWorld())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "board", "postgres-database"); n.From != "anchor" {
+		t.Errorf("bound to %s; it keeps nothing, and the seat is held on anchor", n.From)
+	}
+}
diff --git a/internal/compose/resolution/broker_seat_test.go b/internal/compose/resolution/broker_seat_test.go
new file mode 100644
index 0000000..524f390
--- /dev/null
+++ b/internal/compose/resolution/broker_seat_test.go
@@ -0,0 +1,49 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The mesh's bus is one per mesh, read from the catalogue beside this checkout.
+//
+// **This is step 2's claim, and it is checked here rather than in a bed** (novox/hq ADR 0116):
+// adoption puts the NATS server into the `mesh-broker` seat on a mesh that is already running,
+// and the property that matters is that a second one anywhere is refused *when it is assigned*,
+// not discovered later as two servers holding different halves of the mesh's traffic. A second
+// bus is not a degraded mesh; it is two meshes that both believe they are the one.
+func TestASecondMeshBusAnywhereIsRefusedByName(t *testing.T) {
+	nats := catalogueManifest(t, "nats")
+
+	if _, err := Resolve(shelf(nats), []string{"nats"}, workstation(), mcat.World{}); err != nil {
+		t.Fatalf("the bus alone does not resolve: %v", err)
+	}
+
+	elsewhere := mcat.World{Held: []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh,
+		Node: "anchor", Module: "nats"}}}
+	other := workstation()
+	other.Name = "laptop"
+	_, err := Resolve(shelf(nats), []string{"nats"}, other, elsewhere)
+	if err == nil {
+		t.Fatal("a second bus was accepted on another machine")
+	}
+	if !strings.Contains(err.Error(), "mesh-broker") || !strings.Contains(err.Error(), "one per mesh") {
+		t.Fatalf("refused without naming the seat: %v", err)
+	}
+}
+
+// The seat is the server's role, not the product's name (novox/hq ADR 0079). A different
+// implementation of the bus claims the same seat, and the mesh refuses it for the same reason —
+// which is the property that lets the bus be replaced at all.
+func TestTheSeatRefusesADifferentBusToo(t *testing.T) {
+	nats := catalogueManifest(t, "nats")
+	held := mcat.World{Held: []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh,
+		Node: "anchor", Module: "some-other-broker"}}}
+	other := workstation()
+	other.Name = "laptop"
+	if _, err := Resolve(shelf(nats), []string{"nats"}, other, held); err == nil {
+		t.Fatal("the seat admitted a second holder because the module's name differed")
+	}
+}
diff --git a/internal/compose/resolution/brokered_test.go b/internal/compose/resolution/brokered_test.go
new file mode 100644
index 0000000..2932a08
--- /dev/null
+++ b/internal/compose/resolution/brokered_test.go
@@ -0,0 +1,255 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// onNetwork is a set of providers, all of them reachable. Written as a helper because a machine
+// that cannot reach the one answering its requirement is its own case, tested separately.
+// reachable is this machine, on the private network.
+func reachable() mcat.Node {
+	n := workstation()
+	n.At = "workstation.internal"
+	return n
+}
+
+func onNetwork(nodes ...string) map[string][]mcat.Provider {
+	out := make([]mcat.Provider, 0, len(nodes))
+	for _, n := range nodes {
+		out = append(out, mcat.Provider{Node: n, At: n + ".internal", Module: "postgres"})
+	}
+	return map[string][]mcat.Provider{"postgres-database": out}
+}
+
+func brokeredShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database")}, mcat.Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}})
+}
+
+func TestADatabaseIsNotInstalledOnEveryMachineThatUsesOne(t *testing.T) {
+	// The fault this whole distinction exists for.
+	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: onNetwork("anchor")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if have := strings.Join(names(got), " "); strings.Contains(have, "postgres") {
+		t.Fatalf("using a database installed one here: %s", have)
+	}
+}
+
+func TestWhatAMachineTakesFromElsewhereIsRecorded(t *testing.T) {
+	// It is the only part of a node's set that stops working when a *different* machine goes
+	// away, and it is where a credential will have to be handed back.
+	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: onNetwork("anchor")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 {
+		t.Fatalf("got %v", got.Needs)
+	}
+	if got.Needs[0].Name != "postgres-database" || got.Needs[0].From != "anchor" {
+		t.Fatalf("got %v", got.Needs[0])
+	}
+	if got.Needs[0].For != "meshboard" {
+		t.Fatalf("it does not say what wanted it: %v", got.Needs[0])
+	}
+}
+
+func TestNothingInTheMeshProvidingItIsRefusedWithSomewhereToPutIt(t *testing.T) {
+	// Refused rather than installed here. Choosing a machine to put a database on is a decision
+	// with consequences, and nothing resolving a web application should make it silently.
+	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("a database was found in a mesh that has none")
+	}
+	if !strings.Contains(err.Error(), "assign") || !strings.Contains(err.Error(), "postgres") {
+		t.Fatalf("the refusal does not say what to do: %v", err)
+	}
+}
+
+func TestTwoNodesProvidingItIsRefusedRatherThanPicked(t *testing.T) {
+	// Same rule as everywhere else. Picking one would be a guess about which database a person
+	// meant, and the wrong guess is somebody's data in the wrong place.
+	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: onNetwork("anchor", "archive")})
+	if err == nil {
+		t.Fatal("one of two databases was picked silently")
+	}
+	for _, want := range []string{"anchor", "archive", "pin"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+func TestSayingWhichOneSettlesIt(t *testing.T) {
+	got, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{
+		Offered: onNetwork("anchor", "archive"),
+		Pinned:  map[string]mcat.Chosen{"postgres-database": {Node: "archive", Module: "postgres"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 || got.Needs[0].From != "archive" {
+		t.Fatalf("the choice was not taken: %v", got.Needs)
+	}
+}
+
+func TestBeingPointedAtAMachineThatDoesNotProvideItIsRefused(t *testing.T) {
+	// Rather than falling back to one that does. A fallback would quietly move somebody's data to
+	// a machine they did not choose, which is the whole reason the question is asked.
+	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{
+		Offered: onNetwork("anchor", "archive"),
+		Pinned:  map[string]mcat.Chosen{"postgres-database": {Node: "somewhere-else", Module: "postgres"}},
+	})
+	if err == nil {
+		t.Fatal("a machine was silently given a different database from the one chosen")
+	}
+	if !strings.Contains(err.Error(), "somewhere-else") {
+		t.Fatalf("the refusal does not say what was chosen: %v", err)
+	}
+}
+
+func TestOneProviderDoesNotOverruleAChoice(t *testing.T) {
+	// A single answer is normally taken silently. Not when somebody said they wanted a different
+	// one -- that is the mesh overruling a person, which it does nowhere else.
+	_, err := Resolve(brokeredShelf(), []string{"meshboard"}, reachable(), mcat.World{
+		Offered: onNetwork("anchor"),
+		Pinned:  map[string]mcat.Chosen{"postgres-database": {Node: "archive", Module: "postgres"}},
+	})
+	if err == nil {
+		t.Fatal("the only database was used although another was chosen")
+	}
+	if !strings.Contains(err.Error(), "only anchor/postgres provides it") {
+		t.Fatalf("the refusal does not say what is available: %v", err)
+	}
+}
+
+func TestACatalogueThatDisagreesAboutScopeIsRefused(t *testing.T) {
+	// If one module says a database is local and another says it is anywhere, the same
+	// requirement means two things depending on which one happens to answer it.
+	_, err := Resolve(shelf(mcat.Manifest{Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database")}, mcat.Manifest{Module: "sqlite", Version: "1", Provides: mcat.Offers("postgres-database")}, mcat.Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"}}), []string{"meshboard"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("a catalogue that disagrees about where a database lives was accepted")
+	}
+	if !strings.Contains(err.Error(), "two things") {
+		t.Fatalf("unhelpful refusal: %v", err)
+	}
+}
+
+func TestALocalRequirementIsStillAnsweredLocally(t *testing.T) {
+	// The change must not have made everything brokered. A shell is still installed here.
+	got, err := Resolve(shelf(mcat.Manifest{Module: "zsh", Version: "1", Provides: mcat.Offers("shell")}, mcat.Manifest{Module: "tools", Version: "1", Requires: []string{"shell"}}), []string{"tools"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if have := strings.Join(names(got), " "); !strings.Contains(have, "zsh") {
+		t.Fatalf("a shell was not installed on the machine that needs one: %s", have)
+	}
+}
+
+func boundShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database"),
+		Serves: map[string]map[string]any{"postgres-database": {"port": 5432, "driver": "postgres"}}}, mcat.Manifest{Module: "meshboard", Version: "1", Requires: []string{"postgres-database"},
+		Binds: map[string]string{"postgres-database": "/etc/meshboard/database.json"}},
+	)
+}
+
+func binding(t *testing.T, out []map[string]any) map[string]any {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] != "/etc/meshboard/database.json" {
+			continue
+		}
+		var parsed map[string]any
+		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
+			t.Fatalf("what the app is told is not readable: %v", err)
+		}
+		return parsed
+	}
+	t.Fatalf("the app was told nothing: %v", out)
+	return nil
+}
+
+func TestAnAppIsToldWhereItsDatabaseIs(t *testing.T) {
+	// Knowing it needs the anchor's database is useless to the program that needs it unless the
+	// program is told. This is the whole point of the field.
+	got, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: map[string][]mcat.Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal",
+		Serves: map[string]any{"port": 5432, "driver": "postgres"}}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	told := binding(t, mustDeclare(t, got))
+	if told["from"] != "anchor" || told["at"] != "anchor.internal" {
+		t.Fatalf("it was not told where: %v", told)
+	}
+	serves, _ := told["serves"].(map[string]any)
+	if serves["port"] != float64(5432) || serves["driver"] != "postgres" {
+		t.Fatalf("it was not told how: %v", serves)
+	}
+}
+
+func TestItSaysWhereTheCredentialIsInstead(t *testing.T) {
+	// A missing field looks like a bug; a stated absence looks like a boundary. Somebody wiring
+	// this up must not spend an afternoon looking for the password field.
+	//
+	// It used to say only that the mesh had no way to issue one, which stopped being true when
+	// 021 was fixed. A stated absence is only useful while it is accurate — once it is not, it
+	// sends the reader somewhere there is nothing to find.
+	got, _ := Resolve(boundShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: map[string][]mcat.Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
+	told := binding(t, mustDeclare(t, got))
+	note, _ := told["generated"].(string)
+	if !strings.Contains(note, "not here") || !strings.Contains(note, "secrets") {
+		t.Fatalf("the file does not say where the credential is instead: %v", note)
+	}
+	for key := range told {
+		if strings.Contains(key, "password") || strings.Contains(key, "secret") {
+			t.Fatalf("something that looks like a credential appeared: %q", key)
+		}
+	}
+}
+
+func TestTwoMachinesThatCannotReachEachOtherAreRefused(t *testing.T) {
+	// An app on one machine and a database on another that share no private network is a mesh
+	// that reports itself configured and does not work. Said here rather than discovered as a
+	// connection timing out.
+	_, err := Resolve(boundShelf(), []string{"meshboard"}, workstation(), mcat. // not on the network
+											World{Offered: map[string][]mcat.Provider{"postgres-database": {{Node: "anchor", At: "anchor.internal"}}}})
+	if err == nil {
+		t.Fatal("an app was pointed at a database it has no path to")
+	}
+	if !strings.Contains(err.Error(), "private network") {
+		t.Fatalf("the refusal does not say what is wrong: %v", err)
+	}
+	if !strings.Contains(err.Error(), meshNetwork) {
+		t.Fatalf("the refusal does not say what to assign: %v", err)
+	}
+}
+
+func TestTheProviderBeingOffTheNetworkIsAlsoRefused(t *testing.T) {
+	// Both directions, because the failure is identical from either end and the remedy differs.
+	_, err := Resolve(boundShelf(), []string{"meshboard"}, reachable(), mcat.World{Offered: map[string][]mcat.Provider{"postgres-database": {{Node: "anchor"}}}})
+	if err == nil {
+		t.Fatal("an app was pointed at a database that is not on the private network")
+	}
+	if !strings.Contains(err.Error(), "anchor") {
+		t.Fatalf("the refusal does not name the unreachable end: %v", err)
+	}
+}
+
+func TestBindingSomethingAnsweredHereWritesNothing(t *testing.T) {
+	// A file saying "it is on this node" is a fact nobody needs and one more thing to keep true.
+	got, err := Resolve(shelf(mcat.Manifest{Module: "zsh", Version: "1", Provides: mcat.Offers("shell")}, mcat.Manifest{Module: "tools", Version: "1", Requires: []string{"shell"},
+		Binds: map[string]string{"shell": "/etc/tools/shell.json"}},
+	), []string{"tools"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range mustDeclare(t, got) {
+		if r["path"] == "/etc/tools/shell.json" {
+			t.Fatalf("a binding was written for something on this machine: %v", r)
+		}
+	}
+}
diff --git a/internal/compose/resolution/bucket_shares.go b/internal/compose/resolution/bucket_shares.go
new file mode 100644
index 0000000..0ada52a
--- /dev/null
+++ b/internal/compose/resolution/bucket_shares.go
@@ -0,0 +1,48 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// sortedShares is a requirement's shares as they are handed to the provider: sorted by `to` (a file whose lines move
+// looks changed), each entry's methods sorted, and a copy so the manifest is not reordered.
+func sortedShares(shares []mcat.BucketShare) []mcat.BucketShare {
+	out := make([]mcat.BucketShare, 0, len(shares))
+	for _, s := range shares {
+		methods := append([]string(nil), s.Methods...)
+		sort.Strings(methods)
+		out = append(out, mcat.BucketShare{To: s.To, Methods: methods})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].To < out[j].To })
+	return out
+}
+
+// withShares adds this module's shares of the requirement to the values it gives the provider. A module whose own
+// `contributes` already names `shares` is refused: the field is the only way to say it (ADR 0468 §8).
+func withShares(m mcat.Manifest, requirement string, values map[string]any) (map[string]any, error) {
+	shares := m.RequireShares[requirement]
+	if _, named := values[mcat.SharesValue]; named && requirement == mcat.BucketRequirement {
+		return nil, fmt.Errorf("%s contributing to %s names `shares`; write it on its requirement instead (novox/hq ADR 0468 §8)",
+			m.Module, requirement)
+	}
+	if len(shares) == 0 {
+		return values, nil
+	}
+	out := make(map[string]any, len(values)+1)
+	for k, v := range values {
+		out[k] = v
+	}
+	listed := []any{}
+	for _, s := range sortedShares(shares) {
+		methods := []any{}
+		for _, method := range s.Methods {
+			methods = append(methods, method)
+		}
+		listed = append(listed, map[string]any{"to": s.To, "methods": methods})
+	}
+	out[mcat.SharesValue] = listed
+	return out, nil
+}
diff --git a/internal/compose/resolution/bucket_shares_test.go b/internal/compose/resolution/bucket_shares_test.go
new file mode 100644
index 0000000..4c5a2cc
--- /dev/null
+++ b/internal/compose/resolution/bucket_shares_test.go
@@ -0,0 +1,105 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const filesWithShares = `{"module":"files","version":"1","requires":["shell",
+	{"name":"s3-bucket","shares":[{"to":"seat:node-files","methods":["put"]},{"to":"print-and-scan","methods":["get","put"]}]}]}`
+
+func minioLike() mcat.Manifest {
+	return mcat.Manifest{Module: "minio", Version: "1", Provides: mcat.Offers("s3-bucket"),
+		Receives: map[string]string{"s3-bucket": "/grants/mesh.json"}}
+}
+
+func givenToMinio(t *testing.T, out []map[string]any) []mcat.Contribution {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] != "/grants/mesh.json" {
+			continue
+		}
+		var parsed struct {
+			Given []mcat.Contribution `json:"given"`
+		}
+		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
+			t.Fatal(err)
+		}
+		return parsed.Given
+	}
+	t.Fatalf("minio was given no file: %v", out)
+	return nil
+}
+
+func sharesOf(t *testing.T, values map[string]any) string {
+	t.Helper()
+	raw, err := json.Marshal(values["shares"])
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(raw)
+}
+
+const sortedSharesJSON = `[{"methods":["get","put"],"to":"print-and-scan"},{"methods":["put"],"to":"seat:node-files"}]`
+
+// 1591/AC3: the values a consumer gives carry the shares sorted by `to`, remote (grant) and co-located alike.
+func TestTheGrantCarriesTheSharesSorted(t *testing.T) {
+	m := mustParse(t, filesWithShares)
+	remote := mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m}}
+	values, asks, err := ContributionsFrom(remote, "s3-bucket", "files", mcat.SettingsBy{})
+	if err != nil || !asks {
+		t.Fatalf("asks %v, err %v", asks, err)
+	}
+	if got := sharesOf(t, values); got != sortedSharesJSON {
+		t.Fatalf("the grant values carry %s", got)
+	}
+	// As the provider's file shows it, through a grant.
+	provider, err := Resolve(shelf(minioLike()), []string{"minio"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(provider, mcat.Rendering{Grants: []mcat.Grant{{Provision: "s3-bucket", Consumer: "laptop", From: "files", Values: values}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := givenToMinio(t, out)
+	if len(given) != 1 || sharesOf(t, given[0].Values) != sortedSharesJSON {
+		t.Fatalf("the remote consumer's shares did not reach the file: %+v", given)
+	}
+
+	// Co-located: the consumer contributes to s3-bucket too, and no grant is passed.
+	co := mustParse(t, `{"module":"files","version":"1","contributes":{"s3-bucket":{"name":"files"}},
+		"requires":[{"name":"s3-bucket","shares":[{"to":"seat:node-files","methods":["put"]},{"to":"print-and-scan","methods":["put","get"]}]}]}`)
+	both, err := Resolve(shelf(minioLike(), co), []string{"files"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err = Declaration(both, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given = givenToMinio(t, out)
+	if len(given) != 1 || sharesOf(t, given[0].Values) != sortedSharesJSON || given[0].Values["name"] != "files" {
+		t.Fatalf("the co-located consumer's shares did not reach the file: %+v", given)
+	}
+}
+
+// 1591/AC5: a consumer whose contributes to s3-bucket names `shares` itself is refused.
+func TestAConsumerCannotContributeSharesItself(t *testing.T) {
+	_, err := decodeForTest([]byte(`{"module":"files","version":"1",
+		"contributes":{"s3-bucket":{"shares":"x"}},
+		"requires":[{"name":"s3-bucket","shares":[{"to":"a","methods":["get"]}]}]}`))
+	if err == nil || !strings.Contains(err.Error(), "ADR 0468 §8") {
+		t.Errorf("both written, accepted: %v", err)
+	}
+	// Without the field the grant is still refused, so the provider is never told something the manifest did not say.
+	m := mcat.Manifest{Module: "files", Requires: []string{"s3-bucket"},
+		Contributes: map[string]map[string]any{"s3-bucket": {"shares": "x"}}}
+	r := mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m}}
+	if _, _, err := ContributionsFrom(r, "s3-bucket", "files", mcat.SettingsBy{}); err == nil {
+		t.Error("a contributed `shares` reached the grant")
+	}
+}
diff --git a/internal/compose/resolution/build.go b/internal/compose/resolution/build.go
new file mode 100644
index 0000000..08bfe76
--- /dev/null
+++ b/internal/compose/resolution/build.go
@@ -0,0 +1,20 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// runByAResource is the artifacts one of a module's own resources names — a process that runs it,
+// a step, an archive that unpacks it — by name.
+func runByAResource(m mcat.Manifest) map[string]bool {
+	named := map[string]bool{}
+	for _, r := range m.Resources {
+		if a, ok := r["artifact"].(string); ok && a != "" {
+			named[a] = true
+		}
+	}
+	return named
+}
+
+// RunByAResource is the bundles of m one of its own resources runs (its service, not its tools).
+func RunByAResource(m mcat.Manifest) map[string]bool { return runByAResource(m) }
diff --git a/internal/compose/resolution/busy.go b/internal/compose/resolution/busy.go
new file mode 100644
index 0000000..d27ba08
--- /dev/null
+++ b/internal/compose/resolution/busy.go
@@ -0,0 +1,20 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// busyInto composes a container's `busy` into the node-engine's words, or takes it away: for an engine that
+// reads it, the command and its timeout written out; for one that does not, the field is not sent, and the
+// container is replaced at once, as before.
+func busyInto(resource map[string]any, with mcat.Rendering) {
+	if _, has := resource[mcat.BusyField]; !has {
+		return
+	}
+	if !with.ReadsBusy {
+		delete(resource, mcat.BusyField)
+		return
+	}
+	b, _, _ := mcat.ReadBusy(resource)
+	resource[mcat.BusyField] = map[string]any{"command": b.Command, "timeout": b.Timeout.String()}
+}
diff --git a/internal/compose/resolution/busy_test.go b/internal/compose/resolution/busy_test.go
new file mode 100644
index 0000000..8940b78
--- /dev/null
+++ b/internal/compose/resolution/busy_test.go
@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	"encoding/json"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func busyManifest(t *testing.T, on string, busy any) []byte {
+	t.Helper()
+	extra := map[string]any{"id": "agent", "type": "container", "name": "app-agent",
+		"image": "registry.example/app" + healthDigest}
+	var m map[string]any
+	if err := json.Unmarshal(healthManifest(t, "", nil, extra), &m); err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range m["resources"].([]any) {
+		if r := r.(map[string]any); r["id"] == on {
+			r[mcat.BusyField] = busy
+		}
+	}
+	out, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+func TestABusyIsSentOnlyToAnEngineThatReadsIt(t *testing.T) {
+	m, err := decodeForTest(busyManifest(t, "agent", map[string]any{"command": "mesh-builder busy"}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := func(with mcat.Rendering) []map[string]any {
+		out, err := Declaration(mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m}}, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return out
+	}
+	older := compose(mcat.Rendering{})
+	if b, sent := older[indexOfID(older, "app.agent")][mcat.BusyField]; sent {
+		t.Fatalf("busy was sent to an engine that does not read it: %v", b)
+	}
+	newer := compose(mcat.Rendering{ReadsBusy: true})
+	got, _ := newer[indexOfID(newer, "app.agent")][mcat.BusyField].(map[string]any)
+	if got["command"] != "mesh-builder busy" || got["timeout"] != "10s" {
+		t.Fatalf("busy composed as %v", got)
+	}
+	if _, has := m.Resources[len(m.Resources)-1][mcat.BusyField].(map[string]any)["timeout"]; has {
+		t.Error("composing wrote the timeout into the catalogue's own manifest")
+	}
+}
diff --git a/internal/compose/resolution/catalogue_check_test.go b/internal/compose/resolution/catalogue_check_test.go
new file mode 100644
index 0000000..3e75f08
--- /dev/null
+++ b/internal/compose/resolution/catalogue_check_test.go
@@ -0,0 +1,46 @@
+package resolution
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// TestEveryCatalogueManifestParses runs the real catalogue through the real gate.
+//
+// Not a fixture: the point is whether the manifests as written are accepted by the control plane that
+// will read them, and a copy of one manifest proves nothing about the other seventy-one.
+// catalogueRoot is the catalogue these checks run over: in a merge check the clone the build seat put
+// beside this one, elsewhere the copy captured in testdata/beside (internal/beside). A check that only
+// ran when somebody remembered a variable was a check nobody ran (novox/hq issue 134), and one that read
+// whatever checkout sat beside judged the machine, not the change (novox/hq issue 432): it never skips.
+func catalogueRoot(t *testing.T) string {
+	t.Helper()
+	return beside.Dir(t, "mesh-catalog")
+}
+
+func TestEveryCatalogueManifestParses(t *testing.T) {
+	_, found := catalogueManifests(t)
+	named, routed := 0, 0
+	for _, r := range found {
+		m, err := r.manifest, r.err
+		if err != nil {
+			t.Errorf("%s: %v", filepath.Base(filepath.Dir(r.path)), err)
+			continue
+		}
+		for _, l := range m.Listens {
+			if l.Name != "" {
+				named++
+			}
+		}
+		for port := range RoutedPorts(m) {
+			_ = port
+			routed++
+		}
+	}
+	t.Logf("%d manifests, %d named endpoints, %d routed endpoints resolved", len(found), named, routed)
+	if named == 0 {
+		t.Fatal("no endpoint in the catalogue is named, so this proved nothing")
+	}
+}
diff --git a/internal/compose/resolution/catalogue_read_test.go b/internal/compose/resolution/catalogue_read_test.go
new file mode 100644
index 0000000..08bd7c2
--- /dev/null
+++ b/internal/compose/resolution/catalogue_read_test.go
@@ -0,0 +1,46 @@
+package resolution
+
+import (
+	"path/filepath"
+	"sync"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// readManifest is one manifest of the catalogue as ReadTreeManifest read it.
+type readManifest struct {
+	path     string // the module.json
+	manifest mcat.Manifest
+	err      error
+}
+
+var readOnce sync.Once
+
+var readAll []readManifest
+
+var readRoot string
+
+// catalogueManifests is every manifest of the catalogue (catalogueRoot), read through ReadTreeManifest once
+// per test binary and not once per test: the checks over the real catalogue each read and parsed every
+// manifest again, and together took 1.5 s of mesh-sdk's unit bound of 2 s (issue 1756). What it returns is
+// shared and read-only: a test that changes a manifest copies it first.
+func catalogueManifests(t *testing.T) (string, []readManifest) {
+	t.Helper()
+	root := catalogueRoot(t)
+	readOnce.Do(func() {
+		readRoot = root
+		found, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
+		if err != nil {
+			return
+		}
+		for _, p := range found {
+			m, err := mcat.ReadTreeManifest(root, filepath.Dir(p))
+			readAll = append(readAll, readManifest{path: p, manifest: m, err: err})
+		}
+	})
+	if len(readAll) == 0 {
+		t.Fatalf("no manifests under %s", root)
+	}
+	return readRoot, readAll
+}
diff --git a/internal/compose/resolution/catrust_manifest_test.go b/internal/compose/resolution/catrust_manifest_test.go
new file mode 100644
index 0000000..67a3a8c
--- /dev/null
+++ b/internal/compose/resolution/catrust_manifest_test.go
@@ -0,0 +1,70 @@
+package resolution
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// **A machine trusts the mesh's authority because a module put its root there** (novox/hq ADR
+// 0147, issue 129). The module carries a shell script and a unit, and both are worthless unless
+// the mesh fills in where the authority is — which is the one thing about it the manifest cannot
+// state, because the authority's address is a fact about the mesh and not about the module.
+//
+// So what is checked here is the rendering, not the parsing: the script the machine will run
+// names the authority it was bound to, and the unit runs that script both ways. The verification
+// itself — a plain client trusting an internal name on a machine holding this, and failing on one
+// that does not — is the lab's, and cannot be had here.
+func TestCaTrustRendersTheAuthorityItWasBoundTo(t *testing.T) {
+	m, err := mcat.ReadTreeManifest(beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), "ca-trust"))
+	if err != nil {
+		t.Fatalf("the trust module does not parse:\n%v", err)
+	}
+
+	r := mcat.Resolution{
+		Node:    "workstation",
+		Modules: []mcat.Manifest{m},
+		Needs: []mcat.Needed{{
+			Name: "internal-acme-ca", From: "anchor", At: "anchor.internal", For: "ca-trust",
+			Serves: map[string]any{
+				"port": float64(9000), "path": "/acme/acme/directory", "roots": "/roots.pem",
+			},
+		}},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("the trust module could not be composed for a machine: %v", err)
+	}
+
+	script := fileNamed(out, "ca-trust.anchor")
+	if script == nil {
+		t.Fatalf("nothing writes the script the unit runs: %v", out)
+	}
+	body, _ := script["content"].(string)
+	if !strings.Contains(body, "https://anchor.internal:9000/roots.pem") {
+		t.Errorf("the script does not fetch from the authority it was bound to:\n%s", body)
+	}
+	if script["mode"] != "0755" {
+		t.Errorf("the script is written %v, which systemd cannot execute", script["mode"])
+	}
+
+	unit := fileNamed(out, "ca-trust.unit")
+	if unit == nil {
+		t.Fatalf("no unit: %v", out)
+	}
+	text, _ := unit["content"].(string)
+	// Both halves. A unit that only installs the anchor leaves a machine trusting an authority
+	// nobody assigned it to any more, which is the half issue 129 asked for by name.
+	for _, want := range []string{
+		"ExecStart=" + script["path"].(string) + " install",
+		"ExecStop=" + script["path"].(string) + " remove",
+		"RemainAfterExit=yes",
+	} {
+		if !strings.Contains(text, want) {
+			t.Errorf("the unit does not say %q:\n%s", want, text)
+		}
+	}
+}
diff --git a/internal/compose/resolution/checker_seat.go b/internal/compose/resolution/checker_seat.go
new file mode 100644
index 0000000..337ffa9
--- /dev/null
+++ b/internal/compose/resolution/checker_seat.go
@@ -0,0 +1,33 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// checkerVerbs are the checker seat's verbs: ask a try, read one, end one by hand. Optional until the checker serves them
+// everywhere.
+func checkerVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "try", Optional: true, Description: "Try a pushed head before its pull request is opened: the checker " +
+			"judges it as it judges a pull request's head, merged onto its trunk's head, its unit and integration " +
+			"levels through the build modules, and owes the forge nothing. Answers the try's id at once; try-read " +
+			"reads where it stands. A try of the same head that waits or runs is the answer to a second ask; at most " +
+			"4 wait or run at once, mesh-wide.",
+			Input: schema(map[string]string{"repository": "<owner>/<name>",
+				"head":  "the full commit to try, 40 or 64 hex digits",
+				"trunk": "the trunk commit to merge it onto, or the trunk's branch for its head now; the trunk's head when absent",
+				"tests": "a go test -run pattern: only those tests run, and nothing is kept",
+				"level": "unit or integration: only this level; both when absent"},
+				[]string{"repository", "head"}),
+			Replaces: []string{"sh merge-check.sh", "docker run postgres"}},
+		{Name: "try-read", Optional: true, Description: "Where a try stands, as stored: queued, running, or its end " +
+			"(pass, fail, or error when it could not run), with what was said of it, the head and the trunk commit " +
+			"it was merged onto, the time it took and what failed first. Read-only.",
+			Input: schema(map[string]string{"id": "the try's id, try-<digits>"}, []string{"id"})},
+		{Name: "try-end", Optional: true, Description: "End a try that waits or runs, as error, by hand: say why (kept in " +
+			"what it says). Its place among the tries is free at once and the next try of its head asks anew with a new " +
+			"id. A try that ended already is refused.",
+			Input: schema(map[string]string{"id": "the try's id, try-<digits>", "why": "why it is ended, in words"},
+				[]string{"id", "why"})},
+	}
+}
diff --git a/internal/compose/resolution/chosen.go b/internal/compose/resolution/chosen.go
new file mode 100644
index 0000000..fffdd19
--- /dev/null
+++ b/internal/compose/resolution/chosen.go
@@ -0,0 +1,86 @@
+package resolution
+
+import (
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// matches is whether this provider is the one chosen.
+func chosenMatches(c mcat.Chosen, p mcat.Provider) bool {
+	return p.Node == c.Node && (c.Module == "" || p.Module == c.Module)
+}
+
+// among is every offered provider the choice names — one, when the choice is whole.
+func chosenAmong(c mcat.Chosen, where []mcat.Provider) []mcat.Provider {
+	var out []mcat.Provider
+	for _, p := range where {
+		if chosenMatches(c, p) {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// nameOf is how a refusal names a provider: the node and the module on it.
+func nameOf(p mcat.Provider) string {
+	return mcat.Chosen{Node: p.Node, Module: p.Module}.String()
+}
+
+// providerNames is every provider named, sorted, for a refusal to list.
+func providerNames(where []mcat.Provider) []string {
+	out := make([]string, 0, len(where))
+	for _, p := range where {
+		out = append(out, nameOf(p))
+	}
+	sort.Strings(out)
+	return out
+}
+
+// providersHere is which modules in this node's own set offer a provision, sorted.
+func providersHere(catalogue map[string]mcat.Manifest, here func(string) bool, want string) []string {
+	var out []string
+	for name, m := range catalogue {
+		if !here(name) {
+			continue
+		}
+		for _, o := range m.Offers() {
+			if o == want {
+				out = append(out, name)
+				break
+			}
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// servedByOne is what one provider beside the consumer says a consumer needs to know, or nothing.
+//
+// Serving is *whether* a need is created at all when the provider is on this same machine (novox/hq
+// 04-ISSUES/038's sibling): a need never created is a binding the consumer never gets. The manifest
+// alone answers that; the values are settled later, with the node's settings.
+func servedByOne(m mcat.Manifest, want string) map[string]any {
+	if _, ok := m.Serves[want]; ok {
+		return ServedOn(m, want, nil)
+	}
+	return nil
+}
+
+// sharedByOne is the own secret that provider names as its credential (ADR 0158), or "" when it
+// gives each consumer its own.
+func sharedByOne(m mcat.Manifest, want string) string {
+	if own, shared := m.SharedCredentialOf(want); shared {
+		return own
+	}
+	return ""
+}
+
+func oneOf(list []string, s string) bool {
+	for _, x := range list {
+		if x == s {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/compose/resolution/co_located_test.go b/internal/compose/resolution/co_located_test.go
new file mode 100644
index 0000000..0b39a17
--- /dev/null
+++ b/internal/compose/resolution/co_located_test.go
@@ -0,0 +1,306 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A root certificate, as a certificate authority serves one: a real, self-signed one made for these tests (its key
+// thrown away), because the one setting that may hold lines must parse as a certificate (novox/hq issue 339).
+const servedRoot = `-----BEGIN CERTIFICATE-----
+MIIBPjCB8aADAgECAhRZG3p93hUUB5bz00uxhYo/nJnTQjAFBgMrZXAwFDESMBAG
+A1UEAwwJdGVzdCByb290MCAXDTI2MTAwODIyMjE0NloYDzIxMjYwOTE0MjIyMTQ2
+WjAUMRIwEAYDVQQDDAl0ZXN0IHJvb3QwKjAFBgMrZXADIQA0pt/ld+W0MXwBhPfO
+cuAt56kIW6Qcn+4vqWpuvHTiqaNTMFEwHQYDVR0OBBYEFIjgaLk4OVGIOeZQiqnN
+p9vhciFjMB8GA1UdIwQYMBaAFIjgaLk4OVGIOeZQiqnNp9vhciFjMA8GA1UdEwEB
+/wQFMAMBAf8wBQYDK2VwA0EAl9uWeSM2XAV8u0reyV3BLRxNVik+4FCRO1QKPs2k
+IlB1rK9oAOYManH+VFuBMI/JJ31ajSti81q4E0CSw8r5DQ==
+-----END CERTIFICATE-----
+`
+
+// stepCA is an internal ACME authority: it answers `acme-ca` from anywhere in the mesh, and what a
+// consumer must know is the directory URL and the root to trust. **The root is not knowable when
+// the module is written** — it exists only once the CA has been initialised — so the manifest
+// declares the key and the operator supplies the value as a setting, which is exactly the shape the
+// cross-node path settles and the same-node path did not.
+func stepCA() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "step-ca", Version: "1",
+		Provides: mcat.FromAnywhere("acme-ca"),
+		Listens:  []mcat.Listening{{Port: 9000, Protocol: "tcp", From: mcat.FromMesh}},
+		Serves: map[string]map[string]any{"acme-ca": {
+			"directory": "https://anchor.internal/acme/acme/directory",
+			// Declared empty: a manifest is the same on every mesh, and this mesh's root is not.
+			"root": "",
+		}},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "step-ca", "ports": []any{"9000"},
+		}},
+	}
+}
+
+// stepCAWithItsRoot is the authority whose root the operator supplies: the served key asks for it as
+// `${setting:root}` (ADR 0155), the only way a setting reaches what a provider serves since a layer
+// stopped replacing a served key (novox/hq issue 696; before it, the empty `root` was replaced whole).
+func stepCAWithItsRoot() mcat.Manifest {
+	m := stepCA()
+	m.Serves["acme-ca"]["root"] = "${setting:root}"
+	return m
+}
+
+// routeProxy issues from that authority, so it must be told the root to verify it with.
+func routeProxy() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "route-proxy", Version: "1",
+		Requires: []string{"acme-ca"},
+		Provides: mcat.FromAnywhere("route"),
+		Binds:    map[string]string{"acme-ca": "/var/lib/route-proxy/acme-ca.json"},
+		Receives: map[string]string{"route": "/var/lib/route-proxy/routes.json"},
+		Resources: []map[string]any{{
+			"id": "bundle", "type": "file", "path": "/var/lib/route-proxy/ca.pem", "mode": "0644",
+			"content": "${bound:acme-ca:root}",
+		}},
+	}
+}
+
+// A co-located provider's served VALUES reach its consumer, not just its served keys.
+//
+// The mesh walks a provider on ANOTHER machine and settles what it serves with that node's settings
+// layers before offering it (cmd/mesh-controller plan.go, theRestOfTheMesh). A provider on the
+// consumer's own machine was never settled at all: resolve.go's servedHere and declaration.go's
+// here() both read the manifest and stop there. So a served value the operator supplied — the one
+// kind of value a manifest cannot carry, because it is different on every mesh — arrived as the
+// manifest's empty default.
+//
+// The consequence is silent and total: route-proxy wrote an empty CA bundle, fell back to the
+// system trust store, could not verify the internal authority, and no certificate was ever issued.
+func TestACoLocatedProvidersServedValuesReachItsConsumer(t *testing.T) {
+	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
+		[]string{"step-ca", "route-proxy"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// What the operator set on the provider, on this node — the CA's root, which only exists once
+	// the CA has been initialised.
+	out, err := Declaration(r, mcat.Rendering{Settings: mcat.SettingsBy{
+		"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bundle := fileNamed(out, "route-proxy.bundle")
+	if bundle == nil {
+		t.Fatalf("the consumer was given no bundle at all: %v", out)
+	}
+	if got := bundle["content"]; got != servedRoot {
+		t.Errorf("the co-located consumer was not told the root it must trust:\n got %q\nwant %q",
+			got, servedRoot)
+	}
+}
+
+// And the binding file says the same thing, for a consumer that reads the binding rather than a
+// substituted placeholder. The two are one fact and must not be able to disagree.
+func TestACoLocatedConsumersBindingCarriesTheSettledValues(t *testing.T) {
+	r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()),
+		[]string{"step-ca", "route-proxy"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{
+		Settings: mcat.SettingsBy{
+			"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
+		},
+		// And the machine moved the provider's port while it was at it, so both halves of the
+		// cross-node derivation are exercised at once.
+		Ports: map[string]map[int]int{"step-ca": {9000: 19000}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	binding := fileNamed(out, "route-proxy.bound-acme-ca")
+	if binding == nil {
+		t.Fatalf("the consumer was given no binding at all: %v", out)
+	}
+	var said struct {
+		Serves map[string]any `json:"serves"`
+	}
+	if err := json.Unmarshal([]byte(binding["content"].(string)), &said); err != nil {
+		t.Fatal(err)
+	}
+	if said.Serves["root"] != servedRoot {
+		t.Errorf("the binding does not carry the settled root: %q", said.Serves["root"])
+	}
+	if port, _ := asPort(said.Serves["port"]); port != 19000 {
+		t.Errorf("the binding does not carry the port the machine publishes: %v", said.Serves["port"])
+	}
+}
+
+// A provider PULLED IN rather than assigned is settled the same way.
+//
+// The resolver's same-node need is built during the walk, from whichever modules had been chosen by
+// the time the requirement came up — so which path a co-located binding took depended on the order
+// a person happened to assign things in. Settling after the closure is known removes that: both
+// orders now produce the same file.
+func TestACoLocatedProviderIsSettledWhicheverWayItWasPulledIn(t *testing.T) {
+	for _, assigned := range [][]string{
+		{"step-ca", "route-proxy"},
+		{"route-proxy", "step-ca"},
+	} {
+		r, err := Resolve(shelf(stepCAWithItsRoot(), routeProxy()), assigned, reachable(), mcat.World{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		out, err := Declaration(r, mcat.Rendering{Settings: mcat.SettingsBy{
+			"step-ca": {{From: "the operator", Values: map[string]any{"root": servedRoot}}},
+		}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		bundle := fileNamed(out, "route-proxy.bundle")
+		if bundle == nil || bundle["content"] != servedRoot {
+			t.Errorf("assigned %v: the consumer was not told the root", assigned)
+		}
+	}
+}
+
+// A same-node contribution names the port the MACHINE publishes, not the one the module declared.
+//
+// 04-ISSUES/038 fixed this for what a consumer is TOLD about a provider. This is the other
+// direction: what a workload TELLS the provider about itself. gitea declares a bare container port
+// 3000, the mesh publishes it as 20000:3000 — and gitea's route contribution still said 3000, so
+// the proxy beside it dialled a port nothing listens on and answered 502 for every request.
+//
+// The redirect uses the CONTRIBUTING module's assignment: the port belongs to the workload, and
+// using the provider's map would move it to wherever the proxy happens to be published.
+func TestASameNodeContributionNamesThePortTheMachinePublishes(t *testing.T) {
+	gitea := mcat.Manifest{
+		Module: "gitea", Version: "1",
+		Listens:     []mcat.Listening{{Port: 3000, Protocol: "tcp", From: mcat.FromMesh}},
+		Contributes: map[string]map[string]any{"route": {"label": "git", "port": 3000}},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "gitea", "ports": []any{"3000"},
+		}},
+	}
+	r, err := Resolve(shelf(gitea, routeProxy(), stepCA()),
+		[]string{"gitea", "route-proxy", "step-ca"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{
+		// The machine put gitea's 3000 on 20000, and published it that way.
+		Ports: map[string]map[int]int{"gitea": {3000: 20000}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Where the workload is actually published.
+	server := fileNamed(out, "gitea.server")
+	if published := strings.Join(asStrings(server["ports"]), ","); published != "20000:3000" {
+		t.Fatalf("the workload was not published on the assigned port: %v", server["ports"])
+	}
+
+	// What the proxy beside it was told to dial: the SAME port.
+	routes := fileNamed(out, "route-proxy.received-route")
+	if routes == nil {
+		t.Fatalf("the proxy was given no routes file at all: %v", out)
+	}
+	var given struct {
+		Given []mcat.Contribution `json:"given"`
+	}
+	if err := json.Unmarshal([]byte(routes["content"].(string)), &given); err != nil {
+		t.Fatal(err)
+	}
+	if len(given.Given) != 1 {
+		t.Fatalf("expected one route, got %v", given.Given)
+	}
+	port, ok := asPort(given.Given[0].Values["port"])
+	if !ok || port != 20000 {
+		t.Errorf("the proxy was told to dial a port nothing listens on: %v",
+			given.Given[0].Values["port"])
+	}
+}
+
+// A contribution from ANOTHER machine is left exactly as it was.
+//
+// Its port belongs to that machine's assignment, which this node's map knows nothing about —
+// applying this node's map to it would move a remote workload's port to wherever a local module of
+// the same name happens to be published, which is worse than the fault being fixed.
+func TestAContributionFromAnotherMachineKeepsItsOwnPort(t *testing.T) {
+	r, err := Resolve(shelf(routeProxy(), stepCA()),
+		[]string{"route-proxy", "step-ca"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{
+		// A same-named module on this machine, moved. The grant below is a laptop's, and must not
+		// be dragged along with it.
+		Ports: map[string]map[int]int{"gitea": {3000: 20000}},
+		Grants: []mcat.Grant{{
+			Provision: "route", Consumer: "laptop", From: "gitea", At: "laptop.internal",
+			Values: map[string]any{"name": "git.example", "port": 3000},
+		}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	routes := fileNamed(out, "route-proxy.received-route")
+	var given struct {
+		Given []mcat.Contribution `json:"given"`
+	}
+	if err := json.Unmarshal([]byte(routes["content"].(string)), &given); err != nil {
+		t.Fatal(err)
+	}
+	if len(given.Given) != 1 {
+		t.Fatalf("expected one route, got %v", given.Given)
+	}
+	if port, _ := asPort(given.Given[0].Values["port"]); port != 3000 {
+		t.Errorf("another machine's contribution was rewritten with this machine's ports: %v",
+			given.Given[0].Values["port"])
+	}
+}
+
+// The cross-node half of the same fault: a grant assembled on the providing machine carries the
+// consumer's declared port until the CONSUMER's machine's assignments are applied to it. The
+// declaration layer cannot do it — those assignments are not this machine's, which is the line the
+// test above holds — so the grant layer is handed them and does it there.
+func TestAContributionIsRedirectedToWhereItsOwnMachinePublishedIt(t *testing.T) {
+	published := map[int]int{3000: 20000}
+
+	got := AtPublishedPort(map[string]any{"name": "git.example.tld", "port": 3000}, "forge", published)
+	if port, _ := asPort(got["port"]); port != 20000 {
+		t.Errorf("the proxy would dial a port that machine never published: %v", got["port"])
+	}
+	if got["name"] != "git.example.tld" {
+		t.Errorf("redirecting the port disturbed the rest of the contribution: %v", got)
+	}
+
+	// Idempotent, and silent about a port nobody moved: a module that pinned its own mapping has no
+	// assignment, and must come back exactly as it was written.
+	again := AtPublishedPort(got, "forge", published)
+	if port, _ := asPort(again["port"]); port != 20000 {
+		t.Errorf("applying it twice moved the port again: %v", again["port"])
+	}
+	pinned := AtPublishedPort(map[string]any{"port": 9070}, "office", published)
+	if port, _ := asPort(pinned["port"]); port != 9070 {
+		t.Errorf("a port the mesh never assigned was rewritten: %v", pinned["port"])
+	}
+}
+
+func asStrings(v any) []string {
+	listed, ok := v.([]any)
+	if !ok {
+		return nil
+	}
+	out := make([]string, 0, len(listed))
+	for _, one := range listed {
+		out = append(out, strings.TrimSpace(plainly(one)))
+	}
+	return out
+}
diff --git a/internal/compose/resolution/collections.go b/internal/compose/resolution/collections.go
new file mode 100644
index 0000000..472fc46
--- /dev/null
+++ b/internal/compose/resolution/collections.go
@@ -0,0 +1,312 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func itemKey(it mcat.Item) string { return mcat.ItemKey(it.Collection, it.Name) }
+
+// order is the item's place among the items of one placeholder: its `order` attribute, or OrderDefault.
+func itemOrder(it mcat.Item) int {
+	if n, err := strconv.Atoi(it.Attributes[mcat.OrderAttribute]); err == nil && n >= 0 && n <= 99 {
+		return n
+	}
+	return mcat.OrderDefault
+}
+
+// matches is whether the item's attributes carry every pair of the selector.
+func itemMatches(it mcat.Item, where map[string]string) bool {
+	for k, v := range where {
+		if got, has := it.Attributes[k]; !has || got != v {
+			return false
+		}
+	}
+	return true
+}
+
+// itemsInOrder is the module's items by order, then name; the order the old form placed a module's pieces in.
+func itemsInOrder(items []mcat.Item) []mcat.Item {
+	out := append([]mcat.Item(nil), items...)
+	sort.SliceStable(out, func(a, b int) bool {
+		if oa, ob := itemOrder(out[a]), itemOrder(out[b]); oa != ob {
+			return oa < ob
+		}
+		return out[a].Name < out[b].Name
+	})
+	return out
+}
+
+// oldCollectionNamespaces are the namespaces read as collections of their own name.
+var oldCollectionNamespaces = []string{"shell", "environment", "contribution"}
+
+// ofCollected is where a collector places a collection. Loose inside the braces, so a misspelt name is refused.
+var ofCollected = regexp.MustCompile(`\$\{collected:([^}]*)\}`)
+
+var attributeKey = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
+
+var attributeValue = regexp.MustCompile(`^[a-z0-9][a-z0-9_.-]*$`)
+
+// splitSelector is a placeholder's name without its selector, and the selector: `widgets:bar=top,place=left` is
+// `widgets` and `bar=top,place=left`. A collection's name holds no `=`, so the selector begins at the last colon
+// before the first one.
+func splitSelector(name string) (collection, selector string) {
+	eq := strings.Index(name, "=")
+	if eq < 0 {
+		return name, ""
+	}
+	colon := strings.LastIndex(name[:eq], ":")
+	if colon < 0 {
+		return name, ""
+	}
+	return name[:colon], name[colon+1:]
+}
+
+// selectorOf is a selector's pairs, or why it is none.
+func selectorOf(selector string) (map[string]string, error) {
+	out := map[string]string{}
+	if selector == "" {
+		return out, nil
+	}
+	for _, pair := range strings.Split(selector, ",") {
+		k, v, ok := strings.Cut(pair, "=")
+		switch {
+		case !ok || !attributeKey.MatchString(k) || !attributeValue.MatchString(v):
+			return nil, fmt.Errorf("%q in %q is not <attribute>=<value>", pair, selector)
+		case out[k] != "":
+			return nil, fmt.Errorf("%q names %s twice", selector, k)
+		}
+		out[k] = v
+	}
+	return out, nil
+}
+
+// collectionOfPlaceholder is the collection a placeholder's namespace and key name, and whether they name one.
+func collectionOfPlaceholder(namespace, key string) (string, bool) {
+	key, _ = splitSelector(key)
+	switch {
+	case namespace == mcat.CollectedNamespace && strings.HasPrefix(key, mcat.EnvironmentCollection+":"):
+		// The environment is one collection, and the rest of the name picks the rendering (issue 795).
+		return mcat.EnvironmentCollection, true
+	case namespace == mcat.CollectedNamespace:
+		return key, true
+	case namespace == "environment":
+		return mcat.EnvironmentCollection, true
+	case slices.Contains(oldCollectionNamespaces, namespace):
+		return namespace + ":" + key, true
+	}
+	return "", false
+}
+
+// oldCollection is an old namespace's collection by its name: its comment, or why no item may be contributed to it.
+// ok is false for a name that is not an old namespace's.
+//
+// forItem is whether an item is to be contributed to it: an item may be contributed to a kind received as data,
+// which a collector may place as a collection only where its shape says its pieces are text (design 57 L3).
+func oldCollection(name string, forItem bool) (comment string, old bool, wrong error) {
+	namespace, key, _ := strings.Cut(name, ":")
+	if !slices.Contains(oldCollectionNamespaces, namespace) {
+		return "", false, nil
+	}
+	switch namespace {
+	case "shell":
+		target, slot, two := strings.Cut(key, ":")
+		if !two || !oneOf(contributionTargets(), target) || !oneOf(knownSlots, slot) {
+			return "", true, fmt.Errorf("%s is no slot: shell code is shell:<shell>:<slot>, the shell one of %s, "+
+				"the session's file one of %s or the power moment one of %s, and the slot one of %s", name,
+				strings.Join(knownShells, ", "), strings.Join(sessionFiles, ", "), strings.Join(powerMoments, ", "),
+				strings.Join(knownSlots, ", "))
+		}
+		// shellCode's line before each module's code.
+		return "#", true, nil
+	case "environment":
+		if key == "" {
+			// The collection itself, which an item is contributed to; a placeholder names a rendering.
+			return "#", true, nil
+		}
+		if key != mcat.EnvironmentPOSIX && key != mcat.EnvironmentSystemd {
+			return "", true, fmt.Errorf("%s is no format: the environment is environment:%s or environment:%s",
+				name, mcat.EnvironmentPOSIX, mcat.EnvironmentSystemd)
+		}
+		return "#", true, nil
+	}
+	seat, kind, _ := strings.Cut(key, ":")
+	s, r, ok := receivable(seat, kind)
+	switch {
+	case !ok && s.Name == "":
+		return "", true, fmt.Errorf("%s names the seat %q, which the mesh does not define", name, seat)
+	case !ok:
+		return "", true, fmt.Errorf("%s: %s; %s", name, s.Name, kindsOf(s))
+	case r.Shape != nil && (forItem || collectableAsText(r)):
+		return r.Comment, true, nil
+	case r.Shape != nil:
+		return "", true, fmt.Errorf("%s is received by %s as data in its own shape, which no item of text is "+
+			"(novox/hq ADR 0255)", name, s.Name)
+	case r.Dirs:
+		return "", true, fmt.Errorf("%s names its contributors' directories, which the holder reads as paths "+
+			"the controller fills; it is not yet a collection (design 57 L1)", name)
+	case s.Name != canonicalSeat(seat):
+		return "", true, fmt.Errorf("%s names the seat by another name; a collection names it %s", name, s.Name)
+	}
+	return r.Comment, true, nil
+}
+
+// isOld is whether a collection's name is an old namespace's.
+func isOld(name string) bool {
+	_, old, _ := oldCollection(name, true)
+	return old
+}
+
+// collectedPlaceholderProblems is what is wrong with one resource's ${collected:…}: placed only in a file's content,
+// and naming a collection the module declares it collects.
+func collectedPlaceholderProblems(m mcat.Manifest, r map[string]any) []string {
+	var problems []string
+	for _, field := range sortedKeys(r) {
+		v, ok := r[field].(string)
+		if !ok {
+			continue
+		}
+		for _, f := range ofCollected.FindAllStringSubmatch(v, -1) {
+			base, selector := splitSelector(f[1])
+			if _, err := selectorOf(selector); err != nil {
+				problems = append(problems, fmt.Sprintf("%s's resource %v names %s: %v", m.Module, r["id"], f[0], err))
+				continue
+			}
+			switch {
+			case field != "content":
+				problems = append(problems, fmt.Sprintf("%s's resource %v names %s in its %s; a collection is placed "+
+					"only in a file's content", m.Module, r["id"], f[0], field))
+			case isOld(base):
+				if _, _, wrong := oldCollection(base, false); wrong != nil {
+					problems = append(problems, fmt.Sprintf("%s's resource %v names %s: %v", m.Module, r["id"], f[0], wrong))
+				}
+			case !slices.ContainsFunc(m.Collections, func(c mcat.Collection) bool { return c.Name == base }):
+				problems = append(problems, fmt.Sprintf("%s's resource %v names %s, and %s does not collect %q: "+
+					"declare it under collections (novox/hq ADR 0349 §13)", m.Module, r["id"], f[0], m.Module, base))
+			}
+		}
+	}
+	return problems
+}
+
+// collectionComment is the comment of a collection a module's file names: declared, or the old namespace's.
+func collectionComment(m mcat.Manifest, name string) (string, error) {
+	if comment, old, wrong := oldCollection(name, false); old {
+		return comment, wrong
+	}
+	for _, c := range m.Collections {
+		if c.Name == name {
+			return c.Comment, nil
+		}
+	}
+	return "", fmt.Errorf("%s names ${collected:%s} and does not collect it", m.Module, name)
+}
+
+// itemsLeftOutFor is itemsLeftOut for a placeholder that selects by attributes (where), on a machine with these
+// capabilities: an item the selector does not take, or whose capability the machine lacks, is not left out but not
+// wanted here.
+func itemsLeftOutFor(modules []mcat.Manifest, holder mcat.Manifest, collection string, where map[string]string,
+	facts map[string]string, caps map[string]bool) []string {
+	var out []string
+	for _, m := range inModuleOrder(modules) {
+		for _, it := range itemsInOrder(m.Items) {
+			if it.Collection != collection || !itemMatches(it, where) || (it.IfCapability != "" && !caps[it.IfCapability]) {
+				continue
+			}
+			if _, rendered := heldText(it, facts); rendered && renderedOldWay(collection) {
+				continue
+			}
+			out = append(out, fmt.Sprintf("%s's item of %s is not placed: %s is filled the old way on this "+
+				"machine, from contributions, and an item only by the provisioner's client (design 57 L1)",
+				m.Module, itemKey(it), holder.Module))
+		}
+	}
+	return out
+}
+
+// oldFormsLeftOut says each piece of an old form a handed collector's collections would have held: the collector is
+// filled from items alone, and the piece's module contributes none (ADR 0349 clause 17).
+func oldFormsLeftOut(modules []mcat.Manifest, holder mcat.Manifest, collections []mcat.PlanCollection) []string {
+	var out []string
+	for _, c := range collections {
+		namespace, key, _ := strings.Cut(c.Name, ":")
+		for _, m := range inModuleOrder(modules) {
+			old := false
+			switch namespace {
+			case "shell":
+				target, slot, _ := strings.Cut(key, ":")
+				old = slices.ContainsFunc(m.Shell, func(s mcat.ShellCode) bool { return s.For == target && s.Slot == slot })
+			case "environment":
+				old = m.Environment != nil && (len(m.Environment.Variables) > 0 || len(m.Environment.Path) > 0)
+			case "contribution":
+				seat, kind, _ := strings.Cut(key, ":")
+				old = slices.ContainsFunc(manifestAllContributions(m), func(s mcat.SeatContribution) bool {
+					return canonicalSeat(s.Seat) == canonicalSeat(seat) && s.Kind == kind
+				})
+			}
+			if old {
+				out = append(out, fmt.Sprintf("%s's %s is not placed: %s is filled by the provisioner's client on "+
+					"this machine, from items, and %s contributes it the old way (design 57 L1)", m.Module, c.Name,
+					holder.Module, m.Module))
+			}
+		}
+	}
+	return out
+}
+
+// renderedOldWay is whether the controller renders a collection's items into a collector not handed.
+func renderedOldWay(collection string) bool {
+	namespace, _, _ := strings.Cut(collection, ":")
+	return namespace == "shell" || namespace == "contribution" || namespace == mcat.EnvironmentCollection
+}
+
+// heldItem is one item of a module rendered the old way.
+type heldItem struct {
+	item mcat.Item
+	text string
+}
+
+// heldItems is a module's items of the collection that the selector takes and the machine's capabilities allow, by
+// order then name, each rendered as heldText does; the ones it cannot render are left out (itemsLeftOutFor says so).
+func heldItems(m mcat.Manifest, collection string, where map[string]string, facts map[string]string,
+	caps map[string]bool) []heldItem {
+	if !renderedOldWay(collection) {
+		return nil
+	}
+	var out []heldItem
+	for _, it := range itemsInOrder(m.Items) {
+		if it.Collection != collection || !itemMatches(it, where) || (it.IfCapability != "" && !caps[it.IfCapability]) {
+			continue
+		}
+		if text, ok := heldText(it, facts); ok {
+			out = append(out, heldItem{item: it, text: text})
+		}
+	}
+	return out
+}
+
+// heldText is an item's text with the machine's facts filled, ending its line; false for an item whose text the mesh
+// does not hold or which names anything but a machine fact this machine has.
+func heldText(it mcat.Item, facts map[string]string) (string, bool) {
+	if it.Content == "" {
+		return "", false
+	}
+	text := it.Content
+	for _, f := range templatePlaceholder.FindAllStringSubmatch(text, -1) {
+		value, has := facts[f[2]]
+		if f[1] != "machine" || !has {
+			return "", false
+		}
+		text = strings.ReplaceAll(text, f[0], value)
+	}
+	if !strings.HasSuffix(text, "\n") {
+		text += "\n"
+	}
+	return text, true
+}
diff --git a/internal/compose/resolution/collections_bar_test.go b/internal/compose/resolution/collections_bar_test.go
new file mode 100644
index 0000000..c00debd
--- /dev/null
+++ b/internal/compose/resolution/collections_bar_test.go
@@ -0,0 +1,110 @@
+package resolution
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const collectedBarsText = "top\n${collected:contribution:node-bar:block:bar=top,place=status}" +
+	"bottom\n${collected:contribution:node-bar:block:bar=bottom,place=status}"
+
+const collectedBars = `{"module":"bars","version":"1","moved":true,
+  "claims":[{"name":"node-bar","scope":"node","renders":{"block":"{{.shows}}"}}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[{"id":"conf","type":"file","path":"/etc/bars.conf","template":"files/bars"}]}`
+
+const itemsOfPower = `{"module":"power","version":"1","moved":true,
+  "items":[{"collection":"contribution:node-bar:block","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"40"},"template":"files/battery"},
+           {"collection":"contribution:node-bar:block","name":"draw","attributes":{"bar":"bottom","place":"status","order":"45"},"template":"files/draw"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
+
+func collectedBarsOn(t *testing.T, caps map[string]bool) mcat.Resolution {
+	t.Helper()
+	bars := held(t, collectedBars, builtWith("bars", map[string]string{"bars": collectedBarsText}))
+	power := held(t, itemsOfPower, builtWith("power", map[string]string{"battery": "B\n", "draw": "D ${machine:name}\n"}))
+	r, err := Resolve(shelf(bars, power), []string{"bars", "power"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account, r.Capabilities = "op", caps
+	return r
+}
+
+func TestACollectorMayNameTheBarsBlocksAsACollectionAndNoOtherDataKind(t *testing.T) {
+	bars := held(t, collectedBars, builtWith("bars", map[string]string{"bars": collectedBarsText}))
+	if _, err := Compose(collectedBarsOn(t, nil), handingTo("store:5000")); err != nil {
+		t.Fatalf("the handed collector is refused: %v", err)
+	}
+	if got := collectedPlaceholderProblems(bars, map[string]any{"id": "x",
+		"content": "${collected:contribution:node-bar:block:bar=top,place=status}"}); len(got) != 0 {
+		t.Fatalf("the check refuses it: %v", got)
+	}
+	// A data kind whose shape does not say its items are text stays refused.
+	_, plain, _ := receivable(mcat.BarSeat, mcat.BarKindBlock)
+	plain.Shape = &mcat.Shape{}
+	if collectableAsText(plain) {
+		t.Fatal("a shape not marked as text is collectable")
+	}
+	if _, _, err := oldCollection("contribution:node-bar:block", false); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// The bars of the catalogue's i3status-rust, with the blocks of power's items, compose to the files the old shaped
+// contribution made (issue 781). testdata/bars holds the catalogue's bars and block texts as of the move and the bars as
+// composed before it, for a machine with neither capability, the battery, the power meter and both. Where the
+// collector is not handed the controller fills the files; where it is, it names the items for the client, which
+// fills the same files (mesh-catalog's provisioner client holds that half against the same golden files).
+func TestTheBarsOfTheCatalogueAreTheSameHandedOrNot(t *testing.T) {
+	read := func(name string) string {
+		b, err := os.ReadFile(filepath.Join("testdata", "bars", name))
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	collector := `{"module":"bars","version":"1","moved":true,"claims":[{"name":"node-bar","scope":"node"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[{"id":"top","type":"file","path":"/t","template":"files/top"},
+               {"id":"bottom","type":"file","path":"/b","template":"files/bottom"}]}`
+	power := `{"module":"power","version":"1","moved":true,
+  "items":[{"collection":"contribution:node-bar:block","name":"battery","if-capability":"battery","attributes":{"bar":"bottom","place":"status","order":"40"},"template":"files/battery"},
+           {"collection":"contribution:node-bar:block","name":"power-draw","if-capability":"power-meter","attributes":{"bar":"bottom","place":"status","order":"45"},"template":"files/draw"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]}}`
+	for name, caps := range map[string]map[string]bool{"none": nil, "battery": {"battery": true},
+		"power-meter": {"power-meter": true}, "both": {"battery": true, "power-meter": true}} {
+		bars := held(t, collector, builtWith("bars", map[string]string{"top": read("top-bar.toml"), "bottom": read("bottom-bar.toml")}))
+		blocks := held(t, power, builtWith("power", map[string]string{"battery": read("bar-battery"), "draw": read("bar-power-draw")}))
+		r, err := Resolve(shelf(bars, blocks), []string{"bars", "power"}, workstation(), mcat.World{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		r.Account, r.Capabilities = "op", caps
+		// Not handed: the controller fills them.
+		for id, which := range map[string]string{"bars.top": "top", "bars.bottom": "bottom"} {
+			if got := composedFile(t, r, id); got != read(name+"."+which+"-bar.toml") {
+				t.Errorf("%s, %s bar, not handed:\n%s\nwant\n%s", name, which, got, read(name+"."+which+"-bar.toml"))
+			}
+		}
+		// Handed: the plan names the items the machine's capabilities allow, for the client to fill.
+		c, _ := composeWith(t, r, handingTo("store:5000"))
+		var names []string
+		for _, it := range c.Plans["power"].Items {
+			names = append(names, it.Name)
+		}
+		want := []string{}
+		if caps["battery"] {
+			want = append(want, "battery")
+		}
+		if caps["power-meter"] {
+			want = append(want, "power-draw")
+		}
+		if !reflect.DeepEqual(append([]string{}, names...), want) {
+			t.Errorf("%s: the plan names %v, want %v", name, names, want)
+		}
+	}
+}
diff --git a/internal/compose/resolution/collections_l2_test.go b/internal/compose/resolution/collections_l2_test.go
new file mode 100644
index 0000000..cda4d55
--- /dev/null
+++ b/internal/compose/resolution/collections_l2_test.go
@@ -0,0 +1,57 @@
+package resolution
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func l2Moved(t *testing.T, parts ...string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join(append([]string{"testdata", "l2-moved"}, parts...)...))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(raw)
+}
+
+func TestTheCollectorsL2MovedComposeAsBeforeWhereNothingIsHanded(t *testing.T) {
+	// Each moved contributor, its items read back from its templates archive as the mesh holds them.
+	items := map[string][]string{
+		"asus-zephyrus-g14":       {"shell:after-wake:normal", "contribution:node-hotkeys:trigger"},
+		"claude-code":             {"shell:zsh:normal"},
+		"mesh-cli":                {"shell:zsh:normal"},
+		"powerlevel10k":           {"shell:zsh:normal"},
+		"zsh-autosuggestions":     {"shell:zsh:normal"},
+		"zsh-syntax-highlighting": {"shell:zsh:last"},
+	}
+	var modules []mcat.Manifest
+	for _, module := range sortedKeys(items) {
+		m := mcat.Manifest{Module: module, Moved: true}
+		for _, collection := range items[module] {
+			m.Items = append(m.Items, mcat.Item{Collection: collection,
+				Content: l2Moved(t, "items", module+"."+strings.ReplaceAll(collection, ":", "-"))})
+		}
+		modules = append(modules, m)
+	}
+	for _, c := range []struct{ module, seat string }{{"zsh", mcat.LoginShellSeat}, {"triggerhappy", mcat.HotkeysSeat},
+		{"power", mcat.PowerSeat}} {
+		holder := mcat.Manifest{Module: c.module, Moved: true, Claims: []mcat.Claim{{Name: c.seat}}}
+		resource := map[string]any{"id": "file", "type": "file", "path": "/etc/" + c.module,
+			"content": l2Moved(t, "templates", c.module)}
+		var unplaced []string
+		if err := contributionsInto(resource, holder, append([]mcat.Manifest{holder}, modules...),
+			map[string]string{"name": "g14"}, mcat.Rendering{}, map[string]bool{}, &unplaced); err != nil {
+			t.Fatalf("%s: %v", c.module, err)
+		}
+		if got, want := resource["content"], l2Moved(t, "want", c.module); got != want {
+			t.Errorf("%s's file is not what the old forms made:\n%s\nwant:\n%s", c.module, got, want)
+		}
+		if len(unplaced) != 0 {
+			t.Errorf("%s: unplaced %v", c.module, unplaced)
+		}
+	}
+}
diff --git a/internal/compose/resolution/collections_l3_test.go b/internal/compose/resolution/collections_l3_test.go
new file mode 100644
index 0000000..8b66048
--- /dev/null
+++ b/internal/compose/resolution/collections_l3_test.go
@@ -0,0 +1,36 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const barCollector = `{"module":"bars","version":"1","moved":true,
+  "collections":[{"name":"blocks","comment":"#"}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[{"id":"conf","type":"file","path":"/etc/bars.conf","template":"files/bars"}]}`
+
+func TestASelectorIsRefusedWhenMalformedOrNamingACollectionNotCollected(t *testing.T) {
+	for placeholder, want := range map[string]string{
+		"${collected:blocks:bar}":                "", // no equals sign: a collection named blocks:bar
+		"${collected:blocks:bar=top,bar=bottom}": "names bar twice",
+		"${collected:blocks:bar=}":               "is not <attribute>=<value>",
+		"${collected:other:bar=top}":             `does not collect "other"`,
+	} {
+		raw := strings.Replace(barCollector, `"template":"files/bars"`, `"content":"`+placeholder+`"`, 1)
+		raw = strings.Replace(raw, `"build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},`, "", 1)
+		raw = strings.Replace(raw, `"moved":true,`, "", 1)
+		m, err := decodeForTest([]byte(raw))
+		if err == nil {
+			_, err = Declaration((mcat.Resolution{Node: "n", Modules: []mcat.Manifest{m}}), mcat.Rendering{})
+		}
+		if want == "" {
+			continue
+		}
+		if err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", placeholder, err, want)
+		}
+	}
+}
diff --git a/internal/compose/resolution/collections_test.go b/internal/compose/resolution/collections_test.go
new file mode 100644
index 0000000..006624d
--- /dev/null
+++ b/internal/compose/resolution/collections_test.go
@@ -0,0 +1,13 @@
+package resolution
+
+import (
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func builtWith(module string, texts map[string]string) []mcat.Built {
+	return []mcat.Built{{Name: "files", Kind: mcat.ArtifactArchive,
+		Reference: mcat.ArtifactStoreScheme + module + "/files/blobs/sha256:" + strings.Repeat("e", 64),
+		Digest:    "sha256:" + strings.Repeat("e", 64), Texts: texts}}
+}
diff --git a/internal/compose/resolution/computed_test.go b/internal/compose/resolution/computed_test.go
new file mode 100644
index 0000000..ed7e4f7
--- /dev/null
+++ b/internal/compose/resolution/computed_test.go
@@ -0,0 +1,184 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+type fake struct {
+	on    map[string]bool
+	asked []string
+	err   error
+}
+
+func (f *fake) Resources(node string) ([]map[string]any, bool, error) {
+	f.asked = append(f.asked, node)
+	if f.err != nil {
+		return nil, false, f.err
+	}
+	if !f.on[node] {
+		return nil, false, nil
+	}
+	return []map[string]any{{"id": "peers", "type": "file", "path": "/etc/x.conf",
+		"merge": mcat.MergeJSON, "content": `{"peer":"` + node + `"}`}}, true, nil
+}
+
+func computedShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "mesh-network", Computed: "mesh-network",
+		Provides: mcat.Offers("private-network")})
+}
+
+func TestAComputedModuleIsAskedAboutTheNodeItIsFor(t *testing.T) {
+	// The generator gets a node name, not a plan. Everything it needs is the whole mesh, which
+	// it was built with — this is the one thing a node could never work out for itself.
+	got, err := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := Declaration(got, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(gen.asked) != 1 || gen.asked[0] != "workstation" {
+		t.Fatalf("asked about %v, wanted workstation once", gen.asked)
+	}
+	if len(out) != 1 || !strings.Contains(out[0]["content"].(string), `"peer": "workstation"`) {
+		t.Fatalf("got %v", out)
+	}
+}
+
+func TestAMachineNobodyGaveItGetsNothing(t *testing.T) {
+	// The whole point of making the network a module. Before this, every machine with an address
+	// was on the private network and there was no way to say one should stay off.
+	got, err := Resolve(computedShelf(), nil, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := Declaration(got, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out) != 0 {
+		t.Fatalf("a machine that was assigned nothing got %d resource(s)", len(out))
+	}
+	if len(gen.asked) != 0 {
+		t.Fatalf("the generator was asked about %v, and nobody had asked for it", gen.asked)
+	}
+}
+
+func TestAssignedAndNotYetPartOfItIsNotAFailure(t *testing.T) {
+	// A machine given the network module before it has a place on it. Brief and ordinary — the
+	// answer is "nothing yet", and treating it as an error would make an ordering a fault.
+	got, _ := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), mcat.World{})
+	gen := &fake{on: map[string]bool{}}
+	out, err := Declaration(got, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatalf("refused a node that is not on the network yet: %v", err)
+	}
+	if len(out) != 0 {
+		t.Fatalf("got %v", out)
+	}
+}
+
+func TestAGeneratorThisControlPlaneDoesNotHaveIsRefused(t *testing.T) {
+	// Sending a machine a module with no files would look like it worked. Named in the message,
+	// because the only fix is a control plane that has it.
+	got, _ := Resolve(shelf(mcat.Manifest{Module: "weather", Computed: "the-weather"}), []string{"weather"}, workstation(), mcat.World{})
+
+	_, err := Declaration(got, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": &fake{}}})
+	if err == nil {
+		t.Fatal("a module computed by nothing was accepted")
+	}
+	if !strings.Contains(err.Error(), "the-weather") {
+		t.Fatalf("the refusal does not name what is missing: %v", err)
+	}
+}
+
+func TestSettingsApplyToAComputedModuleToo(t *testing.T) {
+	// Being computed is about where the files come from, not about whether they are configurable.
+	// A line drawn there would be arbitrary and nobody could predict it.
+	got, _ := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), mcat.World{})
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := Declaration(got, mcat.Rendering{
+		Generators: map[string]mcat.Generator{"mesh-network": gen},
+		Settings: mcat.SettingsBy{"mesh-network": {{From: "the mesh",
+			Values: map[string]any{"keepalive": 25}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	content := out[0]["content"].(string)
+	if !strings.Contains(content, `"keepalive": 25`) {
+		t.Fatalf("the setting did not reach a computed file: %s", content)
+	}
+	if !strings.Contains(content, `"peer": "workstation"`) {
+		t.Fatalf("the setting replaced what the generator computed: %s", content)
+	}
+}
+
+func TestTwoWaysToBeOnAPrivateNetworkRefuseAndNameBoth(t *testing.T) {
+	// WireGuard is one way. The refusing rule is what makes a second one safe to add: assigning
+	// both is caught rather than producing a machine on two networks that each half-work.
+	_, err := Resolve(shelf(mcat.Manifest{Module: "mesh-network", Computed: "mesh-network",
+		Provides: mcat.Offers("private-network")}, mcat.Manifest{Module: "tailscale", Provides: mcat.Offers("private-network")}, mcat.Manifest{Module: "backups", Requires: []string{"private-network"}},
+	), []string{"backups"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("two answers to one requirement were taken silently")
+	}
+	for _, want := range []string{"mesh-network", "tailscale", "private-network"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+// reloading answers the runtime's trust as the networking module once did (novox/hq ADR 0102; it no
+// longer does, ADR 0222 — and beside the runtime's module it is refused, generated_collision_test): a file
+// written into, and the runtime reloaded on it.
+type reloading struct{}
+
+func (reloading) Resources(node string) ([]map[string]any, bool, error) {
+	return []map[string]any{
+		{"id": "registry-trust", "type": "file", "path": "/etc/docker/daemon.json",
+			"merge": mcat.MergeJSON, "into": "json", "content": `{"insecure-registries":["r:5000"]}`},
+		{"id": "registry-trust-reload", "type": "service", "unit": "docker.service",
+			"state": "running", "reload-on": []string{"registry-trust"}},
+	}, true, nil
+}
+
+func TestWhatAServiceIsReloadedOnIsNamedAsTheHostWillSeeIt(t *testing.T) {
+	// Ids are prefixed with their module on the way out. An unprefixed reload-on would name a
+	// resource the host never sees, and the runtime would never be reloaded for its trust.
+	got, err := Resolve(computedShelf(), []string{"mesh-network"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": reloading{}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var file, service map[string]any
+	for _, r := range out {
+		switch r["type"] {
+		case "file":
+			file = r
+		case "service":
+			service = r
+		}
+	}
+	if file == nil || service == nil {
+		t.Fatalf("got %v", out)
+	}
+	if file["into"] != "json" {
+		t.Errorf("into did not reach the host: %v", file)
+	}
+	if want := "[" + file["id"].(string) + "]"; fmt.Sprint(service["reload-on"]) != want {
+		t.Errorf("reload-on names %v, the file is %v", service["reload-on"], file["id"])
+	}
+}
diff --git a/internal/compose/resolution/config_test.go b/internal/compose/resolution/config_test.go
new file mode 100644
index 0000000..d731c9d
--- /dev/null
+++ b/internal/compose/resolution/config_test.go
@@ -0,0 +1,181 @@
+package resolution
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// inConfigForm is a module in the config form that registers: every value typed, described, defaulted or
+// required, placed in a file or read at runtime, and its mergeable file naming its keys.
+func inConfigForm() map[string]any {
+	return map[string]any{
+		"module":  "notifier",
+		"version": "1",
+		"config": map[string]any{
+			"font-size": map[string]any{"type": "number", "description": "the notification's font size, in points",
+				"minimum": 6, "maximum": 40, "default": 10},
+			"width": map[string]any{"type": "number", "description": "the notification's width, in pixels",
+				"default": 250},
+			"position": map[string]any{"type": "string", "description": "the corner it shows in, a word",
+				"enum": []any{"top-right", "top-left"}, "default": "top-right"},
+			"theme": map[string]any{"type": "string", "description": "the colour theme, a lower-case name",
+				"pattern": "[a-z]+", "default": "dark"},
+			"history": map[string]any{"type": "number", "description": "how many notifications it keeps, a count",
+				"default": 20, "runtime": true},
+			"sender": map[string]any{"type": "string", "description": "the address it mails a digest from",
+				"required": true},
+		},
+		"resources": []any{
+			map[string]any{"id": "configuration", "type": "file", "path": "/x/notifierrc",
+				"content": "font = Inter ${config:font-size}\nwidth = ${config:width}\nfrom = ${config:sender}\n"},
+			map[string]any{"id": "rules", "type": "file", "path": "/x/rules.json", "merge": "json",
+				"takes-config": []any{"position", "theme"}, "content": "{\"position\": \"top-right\"}\n"},
+			map[string]any{"id": "notifier", "type": "service", "unit": "notifier.service",
+				"reload-on": []any{"configuration"}, "restart-on": []any{"rules"}},
+		},
+	}
+}
+
+func parseRaw(t *testing.T, m map[string]any) (mcat.Manifest, error) {
+	t.Helper()
+	raw, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return decodeForTest(raw)
+}
+
+// settingsDunst is the dunst module as it is written today; configDunst the same module rewritten from settings to
+// config.
+const settingsDunst = `{"module": "dunst", "version": "1",
+  "settings": {
+    "font-size": {"kind": "preference", "default": 10, "why": "10 points of Inter reads well on a screen of about 100 DPI"},
+    "width": {"kind": "preference", "default": 250, "why": "250 pixels fits a title of about forty characters at 10 points"}
+  },
+  "resources": [
+    {"id": "package", "type": "package", "package": "dunst"},
+    {"id": "configuration", "type": "file", "path": "/home/me/.config/dunst/dunstrc", "mode": "0644",
+     "content": "[global]\n    font = Inter ${setting:font-size}\n    width = ${setting:width}\n"},
+    {"id": "rules", "type": "file", "path": "/home/me/.config/dunst/rules.json", "merge": "json",
+     "takes-settings": [], "content": "{\"urgency\": \"low\"}\n"},
+    {"id": "notifier", "type": "service", "unit": "dunst.service", "reload-on": ["configuration"]}
+  ]}`
+
+const configDunst = `{"module": "dunst", "version": "1",
+  "config": {
+    "font-size": {"type": "number", "description": "the font size of a notification, in points", "minimum": 6,
+                  "maximum": 40, "default": 10},
+    "width": {"type": "number", "description": "the width of a notification, in pixels", "minimum": 100,
+              "default": 250}
+  },
+  "resources": [
+    {"id": "package", "type": "package", "package": "dunst"},
+    {"id": "configuration", "type": "file", "path": "/home/me/.config/dunst/dunstrc", "mode": "0644",
+     "content": "[global]\n    font = Inter ${config:font-size}\n    width = ${config:width}\n"},
+    {"id": "rules", "type": "file", "path": "/home/me/.config/dunst/rules.json", "merge": "json",
+     "takes-config": [], "content": "{\"urgency\": \"low\"}\n"},
+    {"id": "notifier", "type": "service", "unit": "dunst.service", "reload-on": ["configuration"]}
+  ]}`
+
+// ${config:<key>} fills exactly as ${setting:<key>} does: the module rewritten from settings to config composes
+// to the same bytes, with no layer, with the node's, and with the mesh's under the node's.
+func TestAModuleRewrittenFromSettingsToConfigComposesByteIdentically(t *testing.T) {
+	composed := func(manifest string, layers []mcat.Layer) []byte {
+		t.Helper()
+		m, err := decodeForTest([]byte(manifest))
+		if err != nil {
+			t.Fatal(err)
+		}
+		r := anAdoptedAnchor()
+		r.Modules = append(r.Modules, m)
+		with := anchorRendering(false)
+		if layers != nil {
+			with.Settings["dunst"] = layers
+		}
+		c, err := Compose(r, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if why, left := c.LeftOut["dunst"]; left {
+			t.Fatalf("dunst was left out: %s", why)
+		}
+		raw, err := json.Marshal(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return raw
+	}
+	for _, layers := range [][]mcat.Layer{
+		nil,
+		{{From: "anchor", Values: map[string]any{"font-size": float64(13)}}},
+		{{From: mcat.MeshWideLayer, Values: map[string]any{"width": float64(300)}},
+			{From: "anchor", Values: map[string]any{"font-size": float64(12), "width": float64(320)}}},
+	} {
+		was, is := composed(settingsDunst, layers), composed(configDunst, layers)
+		if !bytes.Equal(was, is) {
+			t.Fatalf("composed differently with %v:\nsettings: %s\nconfig:   %s", layers, was, is)
+		}
+		if !strings.Contains(string(is), "font = Inter 1") || strings.Contains(string(is), "${config:") {
+			t.Fatalf("not filled: %s", is)
+		}
+	}
+}
+
+// A required value nothing sets is refused at composition in the config form's words: ${config:<key>} and the
+// config verb, never `settings set` (review of mesh-controller#320). The settings form's words are unchanged.
+func TestAnUnsetRequiredValueIsRefusedInTheConfigFormsWords(t *testing.T) {
+	m, err := parseRaw(t, inConfigForm())
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, m)
+	composed, err := Compose(r, anchorRendering(false))
+	if err != nil {
+		t.Fatal(err)
+	}
+	why, left := composed.LeftOut["notifier"]
+	if !left {
+		t.Fatal("a module whose required value nothing sets was not left out")
+	}
+	for _, said := range []string{"${config:sender}", `required config value "sender"`, "config verb"} {
+		if !strings.Contains(why, said) {
+			t.Fatalf("left out without %q: %s", said, why)
+		}
+	}
+	for _, unsaid := range []string{"${setting:", "settings set"} {
+		if strings.Contains(why, unsaid) {
+			t.Fatalf("left out in the settings form's words (%q): %s", unsaid, why)
+		}
+	}
+	var unset *UnsetSettingError
+	if err := unsetInConfigWords(settingInto(map[string]any{"type": "file", "content": "${setting:sender}"}, nil,
+		"notifier"), m); !errors.As(err, &unset) || unset.Setting != "sender" {
+		t.Fatalf("not typed as a value nobody gave: %v", err)
+	}
+
+	// A contribution's value too (issue 1126, seed-8: de-spiegel's route names were refused with ${setting:…}).
+	withRoute := inConfigForm()
+	withRoute["contributes"] = map[string]any{"route": map[string]any{"site": map[string]any{"name": "${config:sender}", "port": 80}}}
+	routed, err := parseRaw(t, withRoute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = resolutionComposed(mcat.Resolution{}, routed, "route", routed.ContributesMany["route"]["site"], nil, "notifier contributing site to route")
+	if !errors.As(err, &unset) || unset.Module != "notifier" || !strings.Contains(err.Error(),
+		`notifier has a contribution site to route, in "name", that says ${config:sender}`) || strings.Contains(err.Error(), "${setting:") {
+		t.Fatalf("a contribution's unset value is not said in the config form's words: %v", err)
+	}
+
+	settingsForm := notifier()
+	settingsForm.Resources[0]["content"] = "from = ${setting:domain}\n"
+	err = unsetInConfigWords(settingInto(settingsForm.Resources[0], nil, "notifier"), settingsForm)
+	if err == nil || !strings.Contains(err.Error(), "`settings set notifier <file>`") {
+		t.Fatalf("the settings form's refusal changed: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/consumer_into_serves.go b/internal/compose/resolution/consumer_into_serves.go
new file mode 100644
index 0000000..abaaf55
--- /dev/null
+++ b/internal/compose/resolution/consumer_into_serves.go
@@ -0,0 +1,267 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// consumerFact is `${consumer:<fact>}` or `${consumer:<fact>:<alphabet>}`.
+var consumerFact = regexp.MustCompile(`\$\{consumer:([a-z][a-z0-9-]*)(?::([a-z][a-z0-9-]*))?\}`)
+
+// consumerFacts are what a served value may name about the consumer it is being derived for.
+// One entry, deliberately: the identity is the one thing about a consumer the mesh itself chose,
+// so it is the one thing the mesh can hand to a provider without either end guessing.
+var consumerFacts = []string{"as"}
+
+// consumerAlphabets are the ways the mesh will write that identity. `dns` is the mesh's own
+// identifier with its separator written `-` instead of `_` — the whole of the difference between
+// the alphabet the mesh mints in and the one buckets, vhosts and hostnames accept.
+var consumerAlphabets = []string{"dns"}
+
+// ServedTo fills a provider's served values for one consumer.
+//
+// `as` is the identity the mesh minted for that consumer — the same string it is told to present
+// as a login. Values with no placeholder are returned exactly as they were, and a block with no
+// placeholder at all is returned unchanged, so this costs nothing for the providers that derive
+// nothing.
+//
+// Only strings carry placeholders. A number, a boolean or a nested object is a value the provider
+// stated outright, and is left alone.
+func ServedTo(serves map[string]any, as string) (map[string]any, error) {
+	if len(serves) == 0 {
+		return serves, nil
+	}
+	var out map[string]any
+	for _, key := range sortedAnyKeys(serves) {
+		text, ok := serves[key].(string)
+		if !ok || !strings.Contains(text, "${consumer:") {
+			continue
+		}
+		filled, err := consumerInto(text, as)
+		if err != nil {
+			return nil, fmt.Errorf("the value served as %q: %w", key, err)
+		}
+		if out == nil {
+			// Copied only once something actually changes: the caller's map is the manifest's,
+			// and a provider that derives nothing must not have it rewritten underneath it.
+			out = make(map[string]any, len(serves))
+			for k, v := range serves {
+				out[k] = v
+			}
+		}
+		out[key] = filled
+	}
+	if out == nil {
+		return serves, nil
+	}
+	return out, nil
+}
+
+// consumerInto replaces every `${consumer:…}` in one value.
+//
+// **A fact or an alphabet the mesh does not have is refused, not left standing.** Written through,
+// the literal `${consumer:as}` would reach a configuration file and be read as a bucket name,
+// failing somewhere that names neither the module nor the mesh — the same reasoning `${bound:…}`
+// is refused by (boundInto).
+func consumerInto(value, as string) (string, error) {
+	var failed error
+	out := consumerFact.ReplaceAllStringFunc(value, func(match string) string {
+		parts := consumerFact.FindStringSubmatch(match)
+		fact, alphabet := parts[1], parts[2]
+		if fact != "as" {
+			if failed == nil {
+				failed = fmt.Errorf(
+					"says %s, and the mesh states %s about a consumer", match, orNothing(consumerFacts))
+			}
+			return match
+		}
+		switch alphabet {
+		case "":
+			return as
+		case "dns":
+			return asDNSLabel(as)
+		default:
+			if failed == nil {
+				failed = fmt.Errorf(
+					"says %s, and the mesh writes an identity as %s", match, orNothing(consumerAlphabets))
+			}
+			return match
+		}
+	})
+	if failed != nil {
+		return "", failed
+	}
+	return out, nil
+}
+
+// asDNSLabel writes a minted identity as a DNS label.
+//
+// The mesh's identities are already lower-case letters, digits and `_` (ConsumerIdentity), and
+// already inside the bound of the provision serving them: a provider that serves one as a DNS label
+// bounds it at 63 or less (CheckServes, novox/hq ADR 0225), and one that serves it at all without
+// saying is held to twenty (IdentityBoundOf). So
+// this is the separator and nothing else — no lower-casing of what is already lower case, no
+// truncation to a limit the identity is already inside, no padding of a name that is already long
+// enough. Each of those would be the mesh guessing at a rule it has not been given.
+func asDNSLabel(as string) string {
+	return strings.ReplaceAll(as, "_", "-")
+}
+
+func sortedAnyKeys(values map[string]any) []string {
+	out := make([]string, 0, len(values))
+	for k := range values {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// derivedFor is what the provider on this machine derives for one consumer of one provision
+// (novox/hq ADR 0202).
+//
+// Settled first, then derived: an operator may set a prefix on what the provider serves and the
+// mesh still fills the consumer's half of it ([ADR 0174]). Only the keys that actually name the
+// consumer are returned — the rest of a `serves` block is the same for every consumer and is
+// already in the provider's own definition, so repeating it here would be a second copy to go
+// stale.
+//
+// The first module in the resolved order that says it serves the provision answers, which is the
+// choice servedOnThisMachine makes for the consumer's half. Nothing serving it on this machine is
+// not an error: a contribution can reach a machine whose provider is a record or an adapter, and
+// then there is nothing derived to tell.
+func resolutionDerivedFor(r mcat.Resolution, provision, as, consumer, local string, settings mcat.SettingsBy) (map[string]any, error) {
+	for _, m := range r.Modules {
+		serves, said := m.Serves[provision]
+		if !said {
+			continue
+		}
+		var names map[string]any
+		for key, value := range serves {
+			if text, ok := value.(string); ok && strings.Contains(text, "${consumer:") {
+				if names == nil {
+					names = map[string]any{}
+				}
+				names[key] = value
+			}
+		}
+		if names == nil {
+			return nil, nil
+		}
+		// **A consumer that keeps several holders of this provision is refused** — this is issue
+		// 124's own failure one case to the side, and it would be just as quiet.
+		//
+		// Each holder gets its own login, `…_<local>` (ADR 0094), and a provider derives from the
+		// login, so it would make one resource per holder. The consumer's side has no such
+		// dimension: one binding file per provision, one `${bound:<provision>:<key>}`, both
+		// derived from the un-suffixed identity. So the provider would create the holder's
+		// resource and the consumer would be configured against a name nothing made — it would
+		// authenticate successfully and be refused on every object, which reads like a credential
+		// fault and is not one.
+		//
+		// Lifting this means giving the consumer's side a local dimension. That is a decision,
+		// not an omission, and until it is taken the mesh says so rather than guessing.
+		if local != "" {
+			return nil, fmt.Errorf(
+				"%s keeps several holders of %s (this one is %q), and %s derives %s for each "+
+					"consumer from the login the mesh minted. Each holder has its own login, and a "+
+					"consumer is told one value per requirement — so the two ends would name "+
+					"different things and nothing would compare them (novox/hq ADR 0202)",
+				consumer, local, provision, m.Module, orNothing(sortedAnyKeys(names)))
+		}
+		settled, err := Settle(names, WithDefaults(m, settings[m.Module]))
+		if err != nil {
+			return nil, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
+		}
+		derived, err := ServedTo(settled, as)
+		if err != nil {
+			return nil, fmt.Errorf("%s serving %s to %s: %w", m.Module, provision, as, err)
+		}
+		return derived, nil
+	}
+	return nil, nil
+}
+
+// notTranscribed refuses a consumer's file that writes out the value its provider derives for it,
+// instead of asking for it (novox/hq ADR 0202, issue 124).
+//
+// **What would have caught the one wrong instance.** The object store's three consumers each wrote
+// their bucket into their own configuration by hand. One of them named a predecessor's bucket, and
+// nothing compared it to what the provider would actually create: the module would have
+// authenticated successfully and been refused on every object, which reads like a credential fault
+// and is not one. It looked authoritative for months.
+//
+// The test is exact and costs one string search: a definition whose file already contains the
+// value the mesh is about to derive for it has written down somebody else's rule. It cannot be a
+// coincidence — a derived value carries the identity the mesh minted for this very consumer on
+// this very machine, which nothing else would spell out — and it cannot be checked afterwards,
+// because after substitution every consumer's file contains it legitimately.
+//
+// Only values that actually name the consumer are judged. A provider that serves a constant under
+// the same key serves the same constant to everyone, and a consumer repeating it is redundant
+// rather than wrong.
+func notTranscribed(resource map[string]any, known map[string]map[string]string, module string) error {
+	if fmt.Sprint(resource["type"]) != "file" {
+		return nil
+	}
+	content, ok := resource["content"].(string)
+	if !ok || content == "" {
+		return nil
+	}
+	for _, provision := range sortedKnown(known) {
+		values := known[provision]
+		identity := values["as"]
+		if identity == "" {
+			continue
+		}
+		for _, key := range sortedStringKeys(values) {
+			if key == "as" {
+				// The login is not derived from itself, and a consumer that must present it in a
+				// connection string legitimately has it from `${bound:…}` — which is what it will
+				// be after substitution, so this would judge the substitution, not the module.
+				continue
+			}
+			value := values[key]
+			if value == "" || !namesTheConsumer(value, identity) {
+				continue
+			}
+			if !strings.Contains(content, value) {
+				continue
+			}
+			return fmt.Errorf(
+				"%s writes %q into %v, and that is exactly what %s derives for it — a definition "+
+					"keeping its own copy of somebody else's naming rule is one that can disagree "+
+					"with it, silently. Say ${bound:%s:%s} and be told",
+				module, value, resource["id"], provision, provision, key)
+		}
+	}
+	return nil
+}
+
+// namesTheConsumer is whether a derived value was built from this consumer's identity — in the
+// alphabet it was minted in, or as a DNS label. A value that does not contain it was not derived
+// from it, whatever else it may be.
+func namesTheConsumer(value, identity string) bool {
+	return strings.Contains(value, identity) || strings.Contains(value, asDNSLabel(identity))
+}
+
+func sortedKnown(known map[string]map[string]string) []string {
+	out := make([]string, 0, len(known))
+	for k := range known {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func sortedStringKeys(values map[string]string) []string {
+	out := make([]string, 0, len(values))
+	for k := range values {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/internal/compose/resolution/consumers.go b/internal/compose/resolution/consumers.go
new file mode 100644
index 0000000..b74e74f
--- /dev/null
+++ b/internal/compose/resolution/consumers.go
@@ -0,0 +1,100 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"slices"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofConsumers is where a provider places its consumers' credentials. Loose inside the braces, so a misspelt name is
+// refused rather than passed over.
+var ofConsumers = regexp.MustCompile(`\$\{consumers:([^}]*)\}`)
+
+// consumersPlaceholderProblems is what is wrong with one resource's ${consumers:…}: placed only in a file's content,
+// for a provision the module provides, in a file only the provider reads and the client writes back.
+func consumersPlaceholderProblems(m mcat.Manifest, r map[string]any) []string {
+	var problems []string
+	for _, field := range sortedKeys(r) {
+		v, ok := r[field].(string)
+		if !ok {
+			continue
+		}
+		for _, f := range ofConsumers.FindAllStringSubmatch(v, -1) {
+			switch {
+			case field != "content" || fmt.Sprint(r["type"]) != "file":
+				problems = append(problems, fmt.Sprintf("%s's resource %v names %s in its %s; a provider's consumers "+
+					"are placed only in a file's content (novox/hq ADR 0373)", m.Module, r["id"], f[0], field))
+				continue
+			case !slices.ContainsFunc(m.Provides, func(o mcat.Offer) bool { return o.Name == f[1] }):
+				problems = append(problems, fmt.Sprintf("%s's resource %v names %s, and %s does not provide %q: only a "+
+					"provider's template holds its consumers' credentials (novox/hq ADR 0373)", m.Module, r["id"], f[0],
+					m.Module, f[1]))
+			}
+			if mode := fmt.Sprint(r["mode"]); mode != "0600" && mode != "0400" {
+				problems = append(problems, fmt.Sprintf("%s's resource %v holds its consumers' credentials (%s) with "+
+					"mode %q: the provider alone reads it, 0600 or 0400 (novox/hq ADR 0373)", m.Module, r["id"], f[0],
+					r["mode"]))
+			}
+			if owner := ownershipOf(r); owner != mcat.RuntimeOwned {
+				problems = append(problems, fmt.Sprintf("%s's resource %v holds its consumers' credentials (%s) and is "+
+					"%s at runtime: it is owned, written back whenever it differs (novox/hq ADR 0373)", m.Module,
+					r["id"], f[0], owner))
+			}
+		}
+	}
+	return problems
+}
+
+// consumersHandedOnly says what a file naming ${consumers:…} is where it would be written the old way: the provisioner's
+// client alone fills it, so on a machine that does not hand the module it is **left out** of the declaration, never
+// written as that text or as an empty list the provider would read as no consumers, and never the reason the module is
+// refused: a provider not handed there keeps working as it did, from its grant files (novox/hq ADR 0373, issue 780).
+// A moved module judged from its repository's tree (WithTemplatesFrom: `module check`), on a machine
+// that would hand it, has no templates archive to hand and is judged as it composes; there the placeholder is judged
+// and taken out of the text, since what is composed so is never sent (judged answers whether the file is so judged).
+func consumersHandedOnly(m mcat.Manifest, r map[string]any, with mcat.Rendering) (judged, leftOut bool) {
+	content, _ := r["content"].(string)
+	switch {
+	case ofConsumers.FindString(content) == "":
+		return false, false
+	case m.Moved && m.Handed == nil && with.Hands && with.Provisioner != "":
+		return true, false
+	}
+	return false, true
+}
+
+// consumersLeftOutLine is the plan's one line for a file left out because the module is not handed.
+func consumersLeftOutLine(m mcat.Manifest, r map[string]any) string {
+	return fmt.Sprintf("%s's %v names ${consumers:…}, which the provisioner's client alone fills: left out, handed only "+
+		"(novox/hq ADR 0373)", m.Module, r["id"])
+}
+
+// consumersNotHanded is consumersHandedOnly as a refusal, for a caller that has no way to leave the file out.
+func consumersNotHanded(m mcat.Manifest, r map[string]any, with mcat.Rendering) (judged bool, err error) {
+	judged, left := consumersHandedOnly(m, r, with)
+	if left {
+		return false, fmt.Errorf("%s's resource %v names %s, which the provisioner's client alone fills, and %s is not "+
+			"handed to it on this machine: it would be written as that text, or empty, and the provider would read no "+
+			"consumers (novox/hq ADR 0373)", m.Module, r["id"], ofConsumers.FindString(fmt.Sprint(r["content"])), m.Module)
+	}
+	return judged, nil
+}
+
+// consumersOfTemplate is what is wrong with a handed file's template naming ${consumers:…}, judged on the file's
+// resource as if its text were inline.
+func consumersOfTemplate(m mcat.Manifest, id, text string) []string {
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["id"]) != id {
+			continue
+		}
+		withText := map[string]any{}
+		for k, v := range r {
+			withText[k] = v
+		}
+		withText["content"] = text
+		return consumersPlaceholderProblems(m, withText)
+	}
+	return nil
+}
diff --git a/internal/compose/resolution/contributes_test.go b/internal/compose/resolution/contributes_test.go
new file mode 100644
index 0000000..44f9b9c
--- /dev/null
+++ b/internal/compose/resolution/contributes_test.go
@@ -0,0 +1,311 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func published(module, host string, port int) mcat.Manifest {
+	return mcat.Manifest{Module: module, Version: "1",
+		Contributes: map[string]map[string]any{
+			"reverse-proxy": {"host": host, "port": port},
+		}}
+}
+
+func proxy() mcat.Manifest {
+	return mcat.Manifest{Module: "traefik", Version: "1",
+		Provides: mcat.Offers("reverse-proxy"),
+		Receives: map[string]string{"reverse-proxy": "/etc/traefik/mesh.json"},
+		Resources: []map[string]any{
+			{"id": "up", "type": "service", "unit": "traefik", "state": "running",
+				"restart-on": []any{mcat.ReceivedID("reverse-proxy")}},
+		}}
+}
+
+// received digs the delivered contributions back out of a declaration.
+func received(t *testing.T, out []map[string]any) []mcat.Contribution {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] != "/etc/traefik/mesh.json" {
+			continue
+		}
+		body := r["content"].(string)
+		var parsed struct {
+			Requirement string              `json:"requirement"`
+			Given       []mcat.Contribution `json:"given"`
+		}
+		if err := json.Unmarshal([]byte(body), &parsed); err != nil {
+			t.Fatalf("the file the proxy is given is not readable: %v\n%s", err, body)
+		}
+		if parsed.Requirement != "reverse-proxy" {
+			t.Fatalf("the file does not say what it is about: %q", parsed.Requirement)
+		}
+		return parsed.Given
+	}
+	t.Fatalf("the provider was given no file at all: %v", out)
+	return nil
+}
+
+func TestTheFileTheProviderGetsIsMachineReadable(t *testing.T) {
+	// It is written for a program, and the first version put a `//` header above the JSON — a
+	// file that says "do not edit" to a person and fails to parse for the thing meant to read it.
+	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	for _, r := range mustDeclare(t, got) {
+		if r["path"] != "/etc/traefik/mesh.json" {
+			continue
+		}
+		var any map[string]any
+		if err := json.Unmarshal([]byte(r["content"].(string)), &any); err != nil {
+			t.Fatalf("the file is not parseable: %v\n%s", err, r["content"])
+		}
+		if note, _ := any["generated"].(string); !strings.Contains(note, "do not edit") {
+			// Inside the document rather than above it, so it reaches a person without
+			// breaking the parse.
+			t.Fatalf("the file does not say it is generated: %v", any["generated"])
+		}
+		return
+	}
+	t.Fatal("no received file")
+}
+
+func TestAModuleTellsItsProviderWhatItNeeds(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, out)
+	if len(given) != 1 || given[0].From != "board" {
+		t.Fatalf("the proxy was not told about board: %v", given)
+	}
+	if given[0].Values["host"] != "board" || given[0].Values["port"] != float64(8080) {
+		t.Fatalf("the contribution did not survive: %v", given[0].Values)
+	}
+}
+
+func TestContributingToSomethingIsRequiringIt(t *testing.T) {
+	// Asking to be published means a publisher must exist. A module that had to say both would
+	// eventually say one, and the failure would be a machine where nothing serves the route.
+	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(strings.Join(names(got), " "), "traefik") {
+		t.Fatalf("contributing to reverse-proxy did not bring one in: %v", names(got))
+	}
+}
+
+func TestNothingToContributeToIsRefused(t *testing.T) {
+	_, err := Resolve(shelf(published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("a module was published through a proxy that does not exist")
+	}
+	if !strings.Contains(err.Error(), "reverse-proxy") {
+		t.Fatalf("the refusal does not name what is missing: %v", err)
+	}
+}
+
+func TestEveryPublisherOnTheMachineIsInOneFile(t *testing.T) {
+	got, err := Resolve(shelf(proxy(),
+		published("board", "board", 8080),
+		published("archive", "archive", 9000),
+	), []string{"board", "archive"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 2 {
+		t.Fatalf("the proxy was told about %d of 2: %v", len(given), given)
+	}
+	// Ordered by module, because this becomes a file and a file whose lines move about looks
+	// changed when nothing changed — which would restart the proxy for ever.
+	if given[0].From != "archive" || given[1].From != "board" {
+		t.Fatalf("the order is not stable: %v", given)
+	}
+}
+
+func TestAProviderWithNoConsumersStillGetsTheFile(t *testing.T) {
+	// Empty rather than absent. A provider that finds no file cannot tell "nothing asked for me"
+	// from "the mesh never wrote it", and those want completely different responses — the same
+	// rule the host follows about a service that does not exist.
+	got, err := Resolve(shelf(proxy()), []string{"traefik"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if given := received(t, mustDeclare(t, got)); len(given) != 0 {
+		t.Fatalf("got %v", given)
+	}
+}
+
+func TestTheProviderCanReloadWhenTheRoutesChange(t *testing.T) {
+	// A proxy that got a new route and did not reload is a route that silently does not work.
+	// The same fault the private network had when a peer list changed under a running interface,
+	// which is why the received file has a name a module can point at.
+	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	out := mustDeclare(t, got)
+	for _, r := range out {
+		if r["type"] != "service" {
+			continue
+		}
+		reflects, ok := r["restart-on"].([]any)
+		if !ok || len(reflects) != 1 {
+			t.Fatalf("the proxy does not reflect anything: %v", r)
+		}
+		if reflects[0] != "traefik."+mcat.ReceivedID("reverse-proxy") {
+			t.Fatalf("it reflects %v, which is not the file it was given", reflects[0])
+		}
+		return
+	}
+	t.Fatal("no service in the declaration")
+}
+
+func TestARouteCanBeSetPerMesh(t *testing.T) {
+	// The hostname is exactly the kind of thing that differs between one mesh and the next. A
+	// module whose route could not be set would have to be edited to be reused anywhere.
+	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	out, err := Declaration(got, mcat.Rendering{Settings: mcat.SettingsBy{
+		"board": {{From: "the mesh", Values: map[string]any{"host": "dashboard"}}},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, out)
+	if given[0].Values["host"] != "dashboard" {
+		t.Fatalf("the setting did not reach the route: %v", given[0].Values)
+	}
+	if given[0].Values["port"] != float64(8080) {
+		t.Fatalf("setting the host dropped the port: %v", given[0].Values)
+	}
+}
+
+func TestASettingReachesAContributionOnlyWhereItDeclaresTheKey(t *testing.T) {
+	// novox/hq 04-ISSUES/173: the mail module's site name, set so its environment file could read
+	// it, arrived in every route it contributed. A setting overrides a key the contribution
+	// declares and adds none — the provider reads the contribution as a contract.
+	got, _ := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+
+	out, err := Declaration(got, mcat.Rendering{Settings: mcat.SettingsBy{
+		"board": {{From: "the mesh", Values: map[string]any{"host": "dashboard", "sitename": "Board"}}},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, out)
+	if given[0].Values["host"] != "dashboard" {
+		t.Fatalf("the setting did not override the route's host: %v", given[0].Values)
+	}
+	if _, leaked := given[0].Values["sitename"]; leaked {
+		t.Fatalf("a setting the route never declared reached the proxy: %v", given[0].Values)
+	}
+}
+
+func provider() mcat.Manifest {
+	return mcat.Manifest{Module: "postgres", Version: "1",
+		Provides: mcat.FromAnywhere("postgres-database"),
+		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
+		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
+	}
+}
+
+func grantedTo(t *testing.T, out []map[string]any) []mcat.Contribution {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
+			continue
+		}
+		var parsed struct {
+			Given []mcat.Contribution `json:"given"`
+		}
+		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
+			t.Fatal(err)
+		}
+		return parsed.Given
+	}
+	t.Fatalf("the provider was given no manifest: %v", out)
+	return nil
+}
+
+func TestAConsumersOwnContributionsAreStillThere(t *testing.T) {
+	// Cross-node grants are merged in with this machine's own, because from the provider's side
+	// they are the same thing — somebody wanting something — and a provider that had to read two
+	// lists would read one of them.
+	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)),
+		[]string{"board"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 1 || given[0].Node != "" {
+		t.Fatalf("a local contribution grew a node: %v", given)
+	}
+}
+
+func TestARequireOnlyConsumerOfAParameterlessProvisionStillAsks(t *testing.T) {
+	// A consumer that requires a parameterless provision (one whose serves names no consumer key —
+	// redis-cache, amqp) contributes no payload, but it still ASKS for the provision and must be
+	// granted a credential. Keying "asks" on contributions alone gave its grant From="" — read as
+	// withdrawn — so the provider never created the account and the consumer authenticated nowhere.
+	r := mcat.Resolution{
+		Node: "laptop",
+		Modules: []mcat.Manifest{{
+			Module:   "amqp-ping",
+			Requires: []string{"amqp"},
+		}},
+	}
+	values, asks, err := ContributionsFrom(r, "amqp", "amqp-ping", mcat.SettingsBy{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !asks {
+		t.Fatal("a require-only consumer was treated as not asking; its grant would be withdrawn and it would never be provisioned")
+	}
+	if values == nil {
+		t.Fatalf("asks is true but values is nil; expected an empty contribution, got %v", values)
+	}
+}
+
+func TestAConsumerThatStoppedAskingIsWithdrawn(t *testing.T) {
+	// Withdrawal is how a credential is taken away. The provisioner removes what nobody asks for,
+	// and it can only do that if the mesh stops asking — a consumer that was unassigned would
+	// otherwise keep a working login for ever, and nothing would say so.
+	//
+	// A grant with no asking module is exactly that state: the mesh still holds the secret,
+	// because it is sealed and unusable to the mesh anyway, and the machine no longer wants it.
+	got, err := Resolve(shelf(provider()), []string{"postgres"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Grants: []mcat.Grant{
+		{Provision: "postgres-database", Consumer: "still-here", From: "meshboard",
+			Values: map[string]any{"name": "meshboard"}, Sealed: "c2VhbGVk"},
+		{Provision: "postgres-database", Consumer: "gone-away", Sealed: "c3RhbGU="},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	given := grantedTo(t, out)
+	if len(given) != 1 || given[0].Node != "still-here" {
+		t.Fatalf("the provider is still told about a machine that stopped asking: %v", given)
+	}
+	// And no credential is written for it either, or the provisioner would find a file for a
+	// consumer its manifest does not mention and have to guess what that means.
+	for _, r := range out {
+		if path, _ := r["path"].(string); strings.Contains(path, "gone-away") {
+			t.Fatalf("a withdrawn consumer's credential is still delivered: %v", r)
+		}
+	}
+}
diff --git a/internal/compose/resolution/contribution_dependencies_test.go b/internal/compose/resolution/contribution_dependencies_test.go
new file mode 100644
index 0000000..10fd91d
--- /dev/null
+++ b/internal/compose/resolution/contribution_dependencies_test.go
@@ -0,0 +1,58 @@
+package resolution
+
+import (
+	"reflect"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestAContributionDependsOnTheSeatThatPlacesIt(t *testing.T) {
+	env := mod("theme", nil, nil, nil)
+	env.Environment = &mcat.Environment{Variables: map[string]string{"GTK_THEME": "Adwaita:dark"}}
+	path := mod("toolchain", nil, nil, nil)
+	path.Environment = &mcat.Environment{Path: []mcat.PathEntry{{Entry: "/opt/x/bin"}}}
+	shell := mod("prompt", nil, nil, nil)
+	shell.Shell = []mcat.ShellCode{{For: "zsh", Slot: "first", Code: "true"}}
+	session := mod("wallpaper", nil, nil, nil)
+	session.Shell = []mcat.ShellCode{{For: "xinitrc", Slot: "normal", Code: "true"}}
+	resources := mod("bar", nil, nil, nil)
+	resources.Shell = []mcat.ShellCode{{For: "xresources", Slot: "normal", Code: "x: y"}}
+	empty := mod("nothing", nil, nil, nil)
+	empty.Environment = &mcat.Environment{}
+
+	cases := map[string]struct {
+		m    mcat.Manifest
+		want []string
+	}{
+		"a variable":                {env, []string{mcat.EnvironmentSeat}},
+		"a path entry":              {path, []string{mcat.EnvironmentSeat}},
+		"shell code":                {shell, []string{mcat.LoginShellSeat}},
+		"the session's start":       {session, []string{mcat.DisplayServerSeat}},
+		"the session's X resources": {resources, []string{mcat.DisplayServerSeat}},
+		"an empty environment":      {empty, nil},
+	}
+	for name, c := range cases {
+		got := DependsOn(nil, c.m)
+		if len(got) == 0 {
+			got = nil
+		}
+		if !reflect.DeepEqual(got, c.want) {
+			t.Errorf("%s depends on %v, want %v", name, got, c.want)
+		}
+	}
+}
+
+func TestAHolderMeetsItsOwnContribution(t *testing.T) {
+	// The display server's module contributes nothing to its own seat today, but the zsh module's
+	// environment contributions do go to another seat: a claim meets only the seat it names.
+	zsh := mod("zsh", nil, nil, nil, mcat.Claim{Name: mcat.LoginShellSeat})
+	zsh.Shell = []mcat.ShellCode{{For: "zsh", Slot: "normal", Code: "true"}}
+	zsh.Environment = &mcat.Environment{Variables: map[string]string{"EDITOR": "vim"}}
+	catalogue := map[string]mcat.Manifest{"zsh": zsh,
+		"node-env": mod("node-env", nil, nil, nil, mcat.Claim{Name: mcat.EnvironmentSeat})}
+	unheld := UnheldDependencies(catalogue, "laptop", []mcat.Manifest{zsh}, nil)
+	if len(unheld) != 1 || unheld[0].Seat != mcat.EnvironmentSeat {
+		t.Errorf("zsh alone: unheld %v, want only %s (its shell code is its own seat's)", unheld, mcat.EnvironmentSeat)
+	}
+}
diff --git a/internal/compose/resolution/control_records_seats.go b/internal/compose/resolution/control_records_seats.go
new file mode 100644
index 0000000..d3b53f1
--- /dev/null
+++ b/internal/compose/resolution/control_records_seats.go
@@ -0,0 +1,52 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// controlRecordsDecision is the record that made the two seats.
+const controlRecordsDecision = "novox/hq ADR 0565"
+
+// wantsVerbs are the assigner's verbs on mesh-wants (ADR 0565 clauses 7, 8, 9, 15).
+func wantsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "upgrade", Description: "Whether each module's new builds wait for a person: its policy (roll, together or record) " +
+			"and where it comes from (a person, the module, the bus, its irreplaceable data, the default); the bus is never " +
+			"rolled. With module, that one; with module, policy and why, a person's choice for it, recorded as a hand act; " +
+			"with policy default, the choice taken back. With compare, each node's own composition and the assigner's findings.",
+			Input: schema(map[string]string{
+				"module":  "one module",
+				"policy":  "with module: roll, together, record, or default to take a person's choice back",
+				"why":     "with policy: why, required and kept",
+				"compare": "\"true\": each node's own composition, by its digest, and the assigner's findings",
+			}, nil, "compare")},
+		{Name: "bus", Description: "What a bus upgrade would do: the fingerprint of the bus module each node runs against the " +
+			"indexer's newest, and the last bus steps from the hand-act log and the assigner's puts of the bus. Read-only: " +
+			"the step itself is the put on the operator's warrant.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}
+
+// handActsVerbs are mesh-hand-acts' verbs (ADR 0565 clause 10), as the controller's took them.
+func handActsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "hand-act", Description: "Record one act done by hand: what, why, its cause in a word or a condition's kind " +
+			"(the word a second act for the same reason uses) and the condition it addresses. Who did it is the caller the " +
+			"runtime proves, never said by the caller. Said as act-recorded.",
+			Input: schema(map[string]string{
+				"what":      "what was done, in a line",
+				"why":       "why it had to be done by hand",
+				"cause":     "the cause in a word, or a condition's kind",
+				"condition": "the key of the condition it addressed, if any (optional)",
+				"verb":      "the act's verb in the log: a repair when absent, `hand-act drill` for a drill, or a recorder's own",
+			}, []string{"what", "why"})},
+		{Name: "hand-acts", Description: "What was done by hand lately, over this log and the controller's: who, why and the " +
+			"cause of each, and the causes recorded twice within a fortnight (a healer is wanted).",
+			Input: schema(map[string]string{"days": "how many days back (default 14)", "cause": "only this cause",
+				"who": "only acts whose who contains this", "warrants": "\"true\": every warrant recorded"}, nil, "warrants")},
+		{Name: "warranted", Description: "Record what a module did on the operator's warrant: who chose, through which channel, " +
+			"with which proofs and which answer read from the router's own record of that module's ask, never from the " +
+			"caller; once per ask. Refused for an ask still open, ended without a choice, or not that module's.",
+			Input: schema(map[string]string{"asker": "the module that asked", "ask": "its ask's id"}, []string{"asker", "ask"})},
+	}
+}
diff --git a/internal/compose/resolution/core_credentials.go b/internal/compose/resolution/core_credentials.go
new file mode 100644
index 0000000..6b667f3
--- /dev/null
+++ b/internal/compose/resolution/core_credentials.go
@@ -0,0 +1,19 @@
+package resolution
+
+import (
+	"encoding/json"
+	"slices"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// CarriesVaultSealed says whether module's own secrets are the core's credentials.
+func CarriesVaultSealed(module string) bool {
+	return slices.Contains(mcat.CoreCredentialModules, module)
+}
+
+// vaultSealedOf is the vault's box for one of module's own secrets, if the rendering was given one.
+func renderingVaultSealedOf(with mcat.Rendering, module, name string) (json.RawMessage, bool) {
+	box, ok := with.VaultSealed[module][name]
+	return box, ok && len(box) > 0
+}
diff --git a/internal/compose/resolution/core_credentials_test.go b/internal/compose/resolution/core_credentials_test.go
new file mode 100644
index 0000000..6c7ffd2
--- /dev/null
+++ b/internal/compose/resolution/core_credentials_test.go
@@ -0,0 +1,24 @@
+package resolution
+
+import (
+	"reflect"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTheCoresOwnCredentialsAreTheBusTheProvisionerAndItsClient(t *testing.T) {
+	if want := []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}; !reflect.DeepEqual(mcat.CoreCredentialModules, want) {
+		t.Fatalf("the core's modules are %v, want %v (mesh-vault's CoreModules is the same list)", mcat.CoreCredentialModules, want)
+	}
+	for _, m := range []string{"nats", "mesh-provisioner", "mesh-provisioner-client"} {
+		if !CarriesVaultSealed(m) {
+			t.Errorf("%s is not on the list", m)
+		}
+	}
+	for _, m := range []string{"postgres", "mesh-vault", "mesh-controller", ""} {
+		if CarriesVaultSealed(m) {
+			t.Errorf("%s is on the list", m)
+		}
+	}
+}
diff --git a/internal/compose/resolution/data.go b/internal/compose/resolution/data.go
new file mode 100644
index 0000000..1d81163
--- /dev/null
+++ b/internal/compose/resolution/data.go
@@ -0,0 +1,77 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// derivedContributions is what a module's data section gives the backup holder: its backup lines and
+// its items. Every item is listed, so a valuable one on a machine is measured whether or not it is
+// copied; a cache is listed and not measured.
+func manifestDerivedContributions(m mcat.Manifest) []mcat.SeatContribution {
+	items := m.DataItems()
+	if len(items) == 0 {
+		return nil
+	}
+	var lines []string
+	kept := map[string]bool{}
+	keep := func(path string) {
+		if !kept[path] {
+			kept[path] = true
+			lines = append(lines, "path "+path)
+		}
+	}
+	for _, it := range items {
+		if !it.BackedUp() {
+			continue
+		}
+		if it.Backup.IsDump() {
+			lines = append(lines, "run "+strings.TrimSpace(it.Backup.Dump))
+			if into, ok := m.DataItem(it.Backup.Into); ok {
+				keep(into.Path)
+			}
+			continue
+		}
+		keep(it.Path)
+	}
+	var described []string
+	for _, it := range items {
+		covered := "-"
+		switch {
+		case it.Backup.IsDump():
+			if into, ok := m.DataItem(it.Backup.Into); ok {
+				covered = into.Path
+			}
+		case it.BackedUp():
+			covered = it.Path
+		}
+		described = append(described, fmt.Sprintf("item %s %s %s %s %s %s", it.ID, it.Class, it.Path, covered,
+			it.Protection(), it.MeasuredBy()))
+	}
+	var out []mcat.SeatContribution
+	if len(lines) > 0 {
+		out = append(out, mcat.SeatContribution{Seat: mcat.BackupSeat, Kind: mcat.BackupKindBackup, Content: strings.Join(lines, "\n") + "\n"})
+	}
+	return append(out, mcat.SeatContribution{Seat: mcat.BackupSeat, Kind: mcat.BackupKindData, Content: strings.Join(described, "\n") + "\n"})
+}
+
+// allContributions is every contribution a module makes to a seat's holder: what it wrote, and what
+// its data section derives. **One list**: a module that declares its data has its backup lines
+// composed from it, and a backup line it still writes by hand is not placed — the catalogue check
+// refuses it — so the holder never copies two lists that disagree.
+func manifestAllContributions(m mcat.Manifest) []mcat.SeatContribution {
+	if m.Data == nil {
+		return m.Contributions
+	}
+	derived := manifestDerivedContributions(m)
+	out := make([]mcat.SeatContribution, 0, len(m.Contributions)+len(derived))
+	for _, c := range m.Contributions {
+		if s, known := mcat.SeatNamed(c.Seat); known && s.Name == mcat.BackupSeat {
+			continue
+		}
+		out = append(out, c)
+	}
+	return append(out, derived...)
+}
diff --git a/internal/compose/resolution/data_placed.go b/internal/compose/resolution/data_placed.go
new file mode 100644
index 0000000..d1a17ee
--- /dev/null
+++ b/internal/compose/resolution/data_placed.go
@@ -0,0 +1,31 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// DataItems is every data item the resolution's modules declare, placed on its node with the rendering given: the text
+// the node-backup holder is handed, read. A module left out of the node's declaration keeps its items, as its data is
+// still on the node (ADR 0262); an item that cannot be placed is said in unplaced and left out.
+func DataItems(r mcat.Resolution, with mcat.Rendering) (items map[string][]mcat.PlacedDataItem, unplaced []string, err error) {
+	left := LeftOut(r, with.Settings, with.Adopted)
+	for module, why := range with.NotPlaced {
+		if _, already := left[module]; !already {
+			left[module] = why
+		}
+	}
+	modules := make([]mcat.Manifest, 0, len(r.Modules))
+	for _, m := range r.Modules {
+		if _, isLeft := left[m.Module]; isLeft {
+			m = backupView(m)
+		}
+		modules = append(modules, m)
+	}
+	text, unplaced, err := seatContributions(modules, mcat.Manifest{}, mcat.BackupSeat+":"+mcat.BackupKindData, with,
+		machineFacts(r, with.Names, with.MeshRange), r.Capabilities)
+	if err != nil {
+		return nil, unplaced, err
+	}
+	items, err = mcat.ParseDataItems(text)
+	return items, unplaced, err
+}
diff --git a/internal/compose/resolution/data_test.go b/internal/compose/resolution/data_test.go
new file mode 100644
index 0000000..29731f7
--- /dev/null
+++ b/internal/compose/resolution/data_test.go
@@ -0,0 +1,16 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func mustParse(t *testing.T, raw string) mcat.Manifest {
+	t.Helper()
+	m, err := decodeForTest([]byte(raw))
+	if err != nil {
+		t.Fatalf("refused: %v", err)
+	}
+	return m
+}
diff --git a/internal/compose/resolution/declaration.go b/internal/compose/resolution/declaration.go
new file mode 100644
index 0000000..3a774e3
--- /dev/null
+++ b/internal/compose/resolution/declaration.go
@@ -0,0 +1,2522 @@
+package resolution
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// rootInto composes a user's `root` for the node-engine: taken away when it asserts nothing (empty — a
+// machine where agents run as the operator) or when the engine is older than the field and parses
+// strictly; kept as "never" otherwise.
+func rootInto(resource map[string]any, with mcat.Rendering) {
+	if resource["type"] != "user" {
+		return
+	}
+	value, has := resource[mcat.RootField]
+	if !has {
+		return
+	}
+	if s, _ := value.(string); s == "" || !with.JudgesRoot {
+		delete(resource, mcat.RootField)
+	}
+}
+
+// machinePort is where a module's port lives on this machine, or the port itself when the mesh has
+// not been asked. Unassigned is not an error here: a module with no `listens` never needed one,
+// and a caller composing a declaration without a store still gets something coherent.
+func renderingMachinePort(r mcat.Rendering, module string, wanted int) int {
+	if at, given := r.Given[module][wanted]; given {
+		return at
+	}
+	if at, known := r.Ports[module][wanted]; known {
+		return at
+	}
+	return wanted
+}
+
+// Declaration is everything the resolved modules put on the node, with settings applied.
+//
+// Resource identities are prefixed with the module they came from. Two modules may reasonably
+// both call something "config", and without this the second would silently replace the first —
+// the node applying one of them and reporting success.
+func Declaration(r mcat.Resolution, with mcat.Rendering) ([]map[string]any, error) {
+	composed, err := Compose(r, with)
+	if err != nil {
+		return nil, err
+	}
+	return composed.Resources, nil
+}
+
+// NotMadeError is a module's own secret the composition was given no value for (novox/hq issue 275):
+// typed, so that a caller can tell "a send would make this, and none has yet" from a composition that
+// fails for any other reason without reading the words.
+type NotMadeError struct {
+	Module, Name string
+}
+
+func (e *NotMadeError) Error() string {
+	return fmt.Sprintf("%s needs a secret called %q and none was made for it", e.Module, e.Name)
+}
+
+// LeftOut is which of this machine's modules a declaration composed with these settings leaves
+// out, and why (novox/hq ADR 0163, rule 6): each whose stored settings its definition can no longer
+// compose. Empty when every module composes. The same judgement SetSettings makes before storing.
+func LeftOut(r mcat.Resolution, settings mcat.SettingsBy, adopted bool) map[string]string {
+	out := map[string]string{}
+	for module, why := range LeftOutBecause(r, settings, adopted) {
+		out[module] = why.Error()
+	}
+	return out
+}
+
+// LeftOutBecause is LeftOut with each reason as the error it was, so a reader can tell a setting nobody
+// gave (an *UnsetSettingError) from any other cause and say it as the operator's to give (novox/hq issue
+// 380). An UnreadManifestError for a stored manifest this controller cannot read whole.
+func LeftOutBecause(r mcat.Resolution, settings mcat.SettingsBy, adopted bool) map[string]error {
+	out := map[string]error{}
+	for _, m := range r.Modules {
+		if why := UnknownFieldReason(m); why != "" {
+			out[m.Module] = &UnreadManifestError{Module: m.Module, said: why}
+			continue
+		}
+		if err := JudgeSettings(m, settings[m.Module], adopted); err != nil {
+			out[m.Module] = err
+		}
+	}
+	return out
+}
+
+// UnreadManifestError is a module left out because its stored manifest has a key this controller does not know
+// (novox/hq ADR 0262): said once for the whole mesh, by the catalogue's own condition, not per machine.
+type UnreadManifestError struct {
+	Module string
+	said   string
+}
+
+func (e *UnreadManifestError) Error() string { return e.said }
+
+// Compose is Declaration with the owner of every resource said.
+func Compose(r mcat.Resolution, with mcat.Rendering) (mcat.Composed, error) {
+	owner := map[string]string{}
+	received := map[string]map[string][]mcat.Contribution{}
+	leftOut := map[string]string{}
+	var foreseen, unplaced, handedOnly []string
+	handed := &handedFiles{plans: map[string]mcat.Plan{}}
+	resources, err := resolutionCompose(r, with, owner, received, leftOut, &foreseen, &unplaced, &handedOnly, handed)
+	if err != nil {
+		return mcat.Composed{}, err
+	}
+	sort.Strings(foreseen)
+	if with.BusMembership != "" {
+		// The machine's own, not any module's: how it reaches the mesh from now on. Sealed like a
+		// secret and placed where the host looks for exactly this (design 28, task 5.2).
+		resources = append(resources, map[string]any{
+			"id": BusMembershipID(), "type": "file", "path": mcat.BusMembershipPath,
+			"sealed": with.BusMembership, "mode": "0600",
+		})
+	}
+	sort.Strings(unplaced)
+	sort.Strings(handedOnly)
+	out := mcat.Composed{Resources: resources, Owner: owner, Received: received, LeftOut: leftOut,
+		Foreseen: foreseen, Unplaced: unplaced, HandedOnly: handedOnly, Filled: handed.paths}
+	if plans := handed.finished(r.Needs); len(plans) > 0 {
+		out.Plans = plans
+	}
+	return out, nil
+}
+
+// BusMembershipID names the resource carrying a machine's membership for the new bus, and
+// BusMembershipPath is where the host reads it — the same constant on both sides.
+func BusMembershipID() string { return "bus-membership" }
+
+func resolutionCompose(r mcat.Resolution, with mcat.Rendering, owner map[string]string,
+	received map[string]map[string][]mcat.Contribution, leftOut map[string]string,
+	foreseen, unplaced, handedOnly *[]string, handed *handedFiles) ([]map[string]any, error) {
+	// **A setting is judged where it is stored, and an impossible one costs a module, not a
+	// machine** (novox/hq ADR 0163, rule 6). A definition that moved under a stored setting makes
+	// this module uncomposable; it is left out of the declaration — its held things kept, its
+	// containers untouched, the machine told so by name — and the machine is told everything else.
+	// Before placing, because a placement is a setting too.
+	left := LeftOut(r, with.Settings, with.Adopted)
+	kept := make([]mcat.Manifest, 0, len(r.Modules))
+	var stillBackedUp []mcat.Manifest
+	for module, why := range with.NotPlaced {
+		if _, already := left[module]; !already {
+			left[module] = why
+		}
+	}
+	for _, m := range r.Modules {
+		if why, isLeft := left[m.Module]; isLeft {
+			if leftOut != nil {
+				leftOut[m.Module] = why
+			}
+			// **Its data is still copied** (novox/hq ADR 0262): a module left out runs nothing new, and
+			// the data it already holds on the machine is the reason to keep copying it. Only its data,
+			// as the backup holder's lines are derived from it, and the directories they name.
+			stillBackedUp = append(stillBackedUp, backupView(m))
+			continue
+		}
+		kept = append(kept, m)
+	}
+	r.Modules = kept
+
+	// Every manifest is placed first (novox/hq ADR 0112): the maps naming where its bindings,
+	// credentials and contributions land are resolved against this node's directories, so every
+	// reader below — the binding files, the sealed secrets, the grant paths a contribution
+	// names — sees a concrete place and none learns the vocabulary.
+	// Into a fresh slice, never the caller's: one resolution may compose for many nodes, and a
+	// slice element written in place would carry the first node's places into the second's.
+	placed := make([]mcat.Manifest, len(r.Modules))
+	for i, m := range r.Modules {
+		var err error
+		if placed[i], err = placedManifest(m, with); err != nil {
+			return nil, err
+		}
+	}
+	r.Modules = placed
+
+	// Where each provision's credentials land, so a contribution can name the file rather than
+	// carry a value the mesh does not have.
+	directories := map[string]string{}
+	for _, m := range r.Modules {
+		for provision, where := range m.Grants {
+			directories[provision] = where
+		}
+	}
+	given, err := resolutionContributions(r, with.Settings, with.Grants, directories)
+	if err != nil {
+		return nil, err
+	}
+
+	// A workload on THIS machine contributes the port it declared, and the machine may have
+	// published it somewhere else (novox/hq ADR 0066). The mirror of the redirect below: 038 fixed
+	// what a consumer is TOLD about a provider, and this is what a workload TELLS the provider about
+	// itself — gitea declaring 3000, published as 20000:3000, and the co-located proxy dialling 3000,
+	// where nothing listens, for every request.
+	//
+	// **The contributing module's assignment, never the provider's.** The port belongs to the
+	// workload; using the map of whatever answers the requirement would move a route to wherever the
+	// proxy happens to be published. A contribution carried here from another machine is left exactly
+	// as it is — its port is that machine's to assign, and this map knows nothing about it.
+	for provision := range given {
+		for i := range given[provision] {
+			said := &given[provision][i]
+			if said.Node != "" && said.Node != r.Node {
+				continue
+			}
+			said.Values = atMachinePort(said.Values, said.From, with.Ports)
+		}
+	}
+
+	// A provider answered on this same machine never passed through the walk that works out what a
+	// provider on ANOTHER machine serves (novox/hq 04-ISSUES/038, ADR 0066). That walk does two
+	// things — it derives the served facts with the provider node's port assignments, and it settles
+	// them with that node's settings layers — and the same-node paths (resolve.go's servedHere, and
+	// here() below) did neither, because both run while resolving, before either is known.
+	//
+	// The port was the first half to be noticed (038). The second half is worse and quieter: a served
+	// value the OPERATOR supplied — a certificate authority's root, which is the one kind of value a
+	// manifest cannot carry, because it differs on every mesh — arrived as the manifest's empty
+	// default. A proxy then wrote an empty CA bundle, fell back to the system trust store, could not
+	// verify the internal authority, and stopped issuing with nothing saying why.
+	//
+	// So it is re-derived here, in full, exactly as the cross-node path derives it. **After the
+	// closure is known**, which also removes an order dependence: the resolver built these needs
+	// mid-walk from whichever modules had been chosen by then, so what a co-located binding carried
+	// depended on the order somebody happened to assign things in.
+	for i := range r.Needs {
+		if r.Needs[i].ByRecord || r.Needs[i].From != r.Node {
+			continue
+		}
+		serves, answered, err := resolutionServedOnThisMachine(r, r.Needs[i].Name, with)
+		if err != nil {
+			return nil, err
+		}
+		if answered {
+			r.Needs[i].Serves = serves
+		}
+	}
+
+	// Once, from every module's listens -- not per module. A module receiving only its own ports
+	// would write a rule set that closed every other module on the machine. Each module's per-node
+	// exposure settings override its listens' source first (novox/hq ADR 0046).
+	rules, err := Rules(r, with)
+	if err != nil {
+		return nil, err
+	}
+	// **A machine that has not said which links face outside is sent no filter** (novox/hq ADR
+	// 0140). The whole chain is written around those links: with none, the rule that lets this
+	// machine's own guests keep working would name an empty set, which nftables refuses, and a rule
+	// set that does not load is a machine filtering nothing while its unit reports success. Refused
+	// here, where a person reads it, rather than on the machine — and the machine keeps the filter
+	// it already has.
+	if filters := resolutionFiltersHere(r); filters != "" && len(with.OutwardLinks) == 0 {
+		return nil, fmt.Errorf(
+			"%s cannot be sent a filter: it has not reported which of its links face outside, and "+
+				"every rule in the chain is written around them. It reports that on each apply; "+
+				"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
+				"keeps the filter it has", r.Node, r.Node, filters)
+	}
+	filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
+		with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
+
+	// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
+	// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
+	// be the moment two modules are found to disagree about it.
+	if err := variablesSetOnce(r.Modules); err != nil {
+		return nil, err
+	}
+
+	generated, err := resolutionGeneratedHere(r, with)
+	if err != nil {
+		return nil, err
+	}
+
+	var out []map[string]any
+	for _, m := range r.Modules {
+		if with.Adopted && m.Filtering != nil {
+			// Nothing of a module that loads a filter, on an adopted node: its table would drop
+			// by default and hold accepts, and the found firewall stays in force. Every resource,
+			// not only the rule set — its service must not run, and a node returned to adopted
+			// stops it by the ordinary removal of what is no longer declared.
+			continue
+		}
+		resources := m.Resources
+
+		// What the mesh computes for this module goes FIRST, before the module's own resources.
+		//
+		// **Order is stated, not derived — the host does not sort** (novox/hq ADR 0005), so
+		// whatever the mesh writes down is the order a machine applies. A module's service or
+		// container routinely depends on one of these files; nothing here ever depends on a
+		// module's resources, because none of it is computed from them.
+		//
+		// Appended, this was wrong in a way that only showed on the first apply and then healed:
+		// the service started before its certificate or its rule set existed, failed, and the next
+		// reconcile fixed it. A fault that repairs itself on the second attempt is worse than one
+		// that does not, because what gets remembered is that it works.
+		var first []map[string]any
+		if f := m.Filtering; f != nil {
+			first = append(first, map[string]any{
+				"id": mcat.FilteringID(), "type": "file", "path": f.Into,
+				"content": filtering, "mode": "0600",
+			})
+		}
+		// The node's fail2ban jails, composed from every module it runs (novox/hq to-be 31), written
+		// where the intrusion-prevention holder owns them. Like the rule set above: gathered from all
+		// modules, written by the one that holds the role.
+		if j := m.Jailing; j != nil {
+			first = append(first, jailsInto(r.Modules, j)...)
+		}
+		if c := m.Certificate; c != nil {
+			if with.Certificate == "" {
+				// Asked for and not issued. Refused rather than skipped: a module that serves TLS
+				// with no certificate does not start, and the reason is somewhere else entirely.
+				return nil, fmt.Errorf(
+					"%s wants a certificate for this machine and none was issued", m.Module)
+			}
+			first = append(first, map[string]any{
+				"id": mcat.CertificateID(), "type": "file", "path": c.Into,
+				// Public. It travels in the open like any other file, because it is a statement
+				// about a key rather than the key.
+				"content": with.Certificate, "mode": "0644",
+			})
+			if c.Authority != "" {
+				first = append(first, map[string]any{
+					"id": mcat.AuthorityID(), "type": "file", "path": c.Authority,
+					"content": with.Authority, "mode": "0644",
+				})
+			}
+		}
+		if m.BusUsers != "" {
+			// **The claim authorises it, not the field.** This file holds every user's password
+			// hash, so a module that could ask for it could read every credential on the bus.
+			// Checked from this manifest alone, which is the cheapest check there is: whether some
+			// other module also claims the seat is resolution's business elsewhere, and one holder
+			// mesh-wide is already guaranteed.
+			if !m.ClaimsSeat("mesh-broker") {
+				return nil, fmt.Errorf(
+					"%s asks for the mesh's user list and does not claim mesh-broker. That file "+
+						"holds every user's password hash, so the seat is what authorises it",
+					m.Module)
+			}
+			if with.BusUsers == "" {
+				// Asked for and not composed. Refused rather than skipped, for the reason a
+				// certificate is: a bus with no user list refuses every connection in the mesh, and
+				// an empty file would look like a configuration problem on the machine.
+				return nil, fmt.Errorf(
+					"%s holds mesh-broker and the mesh composed no user list, so the bus would "+
+						"refuse every connection", m.Module)
+			}
+			first = append(first, map[string]any{
+				"id": mcat.BusUsersID(), "type": "file", "path": m.BusUsers,
+				"content": with.BusUsers,
+				// Readable by the server and nothing else. Hashes rather than passwords, so this is
+				// not a set of working credentials — but a list of every user in the mesh is worth
+				// keeping to the one process that needs it.
+				"mode": "0600",
+			})
+		}
+		// **A secret family's members, as given** (novox/hq ADR 0283): one file each at the family's path, and
+		// nothing for a member not given — the mesh never makes one, and the module says it waits for it.
+		for _, name := range sortedKeys(with.Needed[m.Module]) {
+			own, family, ok := m.OwnSecrets.Lookup(name)
+			if !ok || family == "" || with.Needed[m.Module][name] == "" {
+				continue
+			}
+			// A per-secret owner (novox/hq ADR 0436 §1) stands in for the module's secrets-owner, when
+			// the manifest named one for this secret (or the family it belongs to).
+			owner := m.SecretsOwner
+			if own.Owner != "" {
+				owner = own.Owner
+			}
+			first = append(first, ownedBy(owner, map[string]any{
+				"id": mcat.NeedID(name), "type": "file", "path": own.Path, "sealed": with.Needed[m.Module][name],
+			}))
+		}
+		// **A handed module's own secrets are the vault's** (design 57 V4, issue 647): each file holding one is
+		// declared placed and without a value, filled by the machine's provisioner client from the vault; the
+		// controller makes and seals none of them here.
+		handsSecrets := Handing(with, m)
+		for _, name := range sortedKeys(m.OwnSecrets.Plain()) {
+			if handsSecrets {
+				owner := resolutionOwnSecretOwner(r, m, name)
+				first = append(first, ownedBy(owner, map[string]any{
+					"id": mcat.NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, mcat.HandedSecretField: name,
+				}))
+				continue
+			}
+			// **A core credential is the vault's box** (ADR 0349 §16, issue 755): carried as the vault sealed it to this
+			// machine, which the controller cannot open; the controller's own sealed value is not sent with it.
+			if box, ok := renderingVaultSealedOf(with, m.Module, name); ok {
+				if string(box) == string(mcat.ForeseenVaultBox) {
+					*foreseen = append(*foreseen, m.Module+"/"+name)
+				}
+				owner := resolutionOwnSecretOwner(r, m, name)
+				first = append(first, ownedBy(owner, map[string]any{
+					"id": mcat.NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, mcat.VaultSealedField: box,
+				}))
+				continue
+			}
+			sealed := with.Needed[m.Module][name]
+			if sealed == "" && with.Foreseen[m.Module][name] {
+				// Not made, and the next send makes it: composed with a stand-in so that whatever
+				// else this composition would refuse is still found (novox/hq issue 275).
+				sealed = mcat.ForeseenSealed
+				*foreseen = append(*foreseen, m.Module+"/"+name)
+			}
+			if sealed == "" && m.OwnSecrets[name].IssuedBy == mcat.IssuedOutside {
+				// **Not given, and the mesh never makes it** (novox/hq issue 401, ADR 0228): no file, as for a
+				// family's member (ADR 0283), so the module reads its absence as not given.
+				continue
+			}
+			if sealed == "" {
+				// Declared and not made. Refused rather than skipped: a module whose own
+				// credential is silently absent starts, fails to authenticate, and the reason is
+				// three layers away from the machine reporting it.
+				return nil, &NotMadeError{Module: m.Module, Name: name}
+			}
+			// The runtime's credential belongs to the account the runtime runs as (novox/hq ADR 0175,
+			// to-be 38 WP3): its process is composed `user: <account>` where the node has one, and a
+			// root-owned 0600 file is one that process cannot read. Composed here rather than said in
+			// the manifest, because a manifest cannot say ${machine:account} safely — a node with no
+			// account has nothing to resolve it to, and then the runtime runs as root and the file
+			// stays root's.
+			first = append(first, ownedBy(resolutionOwnSecretOwner(r, m, name), map[string]any{
+				"id": mcat.NeedID(name), "type": "file", "path": m.OwnSecrets[name].Path, "sealed": sealed,
+			}))
+		}
+		// This module's tools bundles, where the machine runs the node's tool runtime (novox/hq
+		// ADR 0175, to-be 38 WP2). Mesh-computed like everything above it, and before the module's
+		// own resources for the same reason: the runtime's process names the files inside these
+		// and is restarted when one changes, so they are on the machine before it is.
+		if resolutionRuntimeHere(r) {
+			first = append(first, bundleArchives(m)...)
+		}
+		// Operator-owned paths this module is granted use of (novox/hq ADR 0051). Written before
+		// the module's own resources, and so before the container that mounts them: the host must
+		// find each present — refusing clearly if the operator has not provided it — before it
+		// starts anything that depends on it. The mesh creates, chowns and reconciles none of it;
+		// an `access` resource says only *this path must exist, and this module reaches it*.
+		// Where each is on THIS machine is the assignment's (novox/hq issue 153): placed by id
+		// where the operator said, the definition's default otherwise, refused where neither.
+		accesses, accessPaths, err := accessesFor(m, with.Settings[m.Module])
+		if err != nil {
+			return nil, err
+		}
+		for _, a := range accesses {
+			first = append(first, map[string]any{
+				"id": mcat.AccessID(a.Path), "type": "access", "path": a.Path, "mode": a.Mode,
+			})
+		}
+		for _, to := range m.SecretRequirements() {
+			for _, file := range m.SecretFiles(to) {
+				var found *mcat.Needed
+				for i, n := range r.Needs {
+					// **This module's need, not the provision's** (novox/hq 04-ISSUES/022). Matching
+					// on the name alone, every consumer of a provision took whichever credential
+					// happened to be last in the list — so on a node with two of them, one module
+					// would be given the other's password and fail to authenticate with a valid
+					// credential belonging to somebody else. And this file's local name, where the
+					// module keeps several (ADR 0094).
+					if n.Name == to && n.For == m.Module && n.Local == file.Local {
+						found = &r.Needs[i]
+					}
+				}
+				// **A credential the vault keeps for this holder alone** (issue 757): where the module is handed, its
+				// file is declared placed and without a value, and the machine's client fills it from the vault.
+				if found != nil && found.IssuedToHolder && Handing(with, m) {
+					first = append(first, ownedBy(m.SecretsOwner, map[string]any{
+						"id": mcat.SecretID(mcat.SecretLocal(to, file.Local)), "type": "file", "path": file.Path, mcat.HandedProvisionField: mcat.PlanProvision{Name: mcat.SecretLocal(to, file.Local), Provision: to,
+							Local: file.Local, Provider: found.From, ProviderModule: found.Module},
+					}))
+					continue
+				}
+				if found != nil && found.ByRecord && found.Sealed == "" && !found.Manager {
+					// Answered by a record whose key has not been supplied since this consumer was
+					// put on it. **Refused, not skipped.** The mesh discarded the plaintext when the
+					// key was accepted and cannot seal another, so a machine that resolved cleanly
+					// would receive no file at all and fail at whatever tried to read it — which is
+					// the outcome ADR 0024 exists to avoid, arrived at politely.
+					//
+					// The manager holder is the one exception (novox/hq ADR 0050): an empty refresh token
+					// is a licence whose manager has not adopted one yet, a real waiting state rather than
+					// a lost key. It falls through to the skip below — its bound facts (carrying the
+					// manager's public key) are still delivered, which is what adoption needs to seal the
+					// first refresh token.
+					return nil, fmt.Errorf(
+						"%s on this machine uses the licence %q and no key has been sealed to it. "+
+							"The mesh cannot make one; supply it again with `licence key %s`",
+						m.Module, found.From, found.From)
+				}
+				if found == nil || found.Sealed == "" {
+					// Answered on this machine, or answered by a node the mesh could not seal to.
+					// Nothing to write either way, and writing an empty credential file would be
+					// worse than none: something would read it and fail authenticating.
+					continue
+				}
+				first = append(first, ownedBy(m.SecretsOwner, map[string]any{
+					"id": mcat.SecretID(mcat.SecretLocal(to, file.Local)), "type": "file", "path": file.Path,
+					"sealed": found.Sealed,
+				}))
+			}
+		}
+		for _, to := range sortedKeys(m.Grants) {
+			for _, g := range with.Grants {
+				if g.Provision != to {
+					continue
+				}
+				if g.From == "" {
+					// Nothing on that machine asks for this any more. Skipped here rather than
+					// where grants are gathered, so the rule holds whoever gathers them.
+					//
+					// **This is how a credential is withdrawn.** The provisioner removes what
+					// nobody asks for, and it can only do that if the mesh stops asking — a
+					// consumer that was unassigned would otherwise keep a working login for ever,
+					// and nothing would say so.
+					continue
+				}
+				if g.Sealed == "" {
+					// Its offer presents no credential (form none, issue 1126): nothing to write, and an empty credential
+					// file would be read as one that failed. Who asked still reaches the provider in its contributions.
+					continue
+				}
+				first = append(first, ownedBy(resolutionProvisionsAs(r, m), map[string]any{
+					// One file per holder — the consumer's module with its local name after it
+					// where it keeps several (ADR 0094); the lab found two files with one id.
+					"id":     mcat.GrantID(to, g.Consumer+"."+holderAs(g.From, g.Local)),
+					"type":   "file",
+					"path":   grantPath(m.Grants[to], g.Consumer, holderAs(g.From, g.Local)),
+					"sealed": g.Sealed,
+				}))
+			}
+		}
+		for _, to := range sortedKeys(m.Binds) {
+			var found *mcat.Needed
+			for i, n := range r.Needs {
+				if n.Name == to && n.For == m.Module {
+					found = &r.Needs[i]
+				}
+			}
+			if found == nil {
+				// Answered on this same machine rather than from elsewhere in the mesh.
+				//
+				// **Still written.** It used to be skipped, reasoning that "it is on this node"
+				// is a fact nobody needs — and that is true of the *location* and false of
+				// everything beside it. A binding also carries what the provider said a consumer
+				// must know, which is the port; a consumer cannot invent that, and got an absent
+				// file with no explanation. A build machine sharing a node with the registry it
+				// pushes to sat in a loop saying it could not read its own binding.
+				here, err := here(r, to, with)
+				if err != nil {
+					return nil, err
+				}
+				if here == nil {
+					// Nothing in this node's set offers it either, so there is genuinely nothing
+					// to say. Resolution has already refused anything unanswerable, so this is a
+					// requirement met by the module itself.
+					continue
+				}
+				found = here
+			}
+			own, err := resolutionOwnNames(r, m, to, with.Settings[m.Module])
+			if err != nil {
+				return nil, err
+			}
+			as := mcat.ConsumerIdentity(r.Node, mcat.IdentitySource(m.Slug, m.Module))
+			// What the provider derives for THIS consumer, filled here where the consumer is
+			// known (novox/hq ADR 0202). The same fill knownFor does below, so the binding file
+			// and the module's `${bound:…}` substitutions cannot say different things.
+			told := *found
+			told.Serves, err = ServedTo(told.Serves, as)
+			if err != nil {
+				return nil, fmt.Errorf("%s is told about %s: %w", m.Module, to, err)
+			}
+			file, err := boundFile(told, m.Binds[to], as, own)
+			if err != nil {
+				return nil, err
+			}
+			first = append(first, file)
+		}
+		for _, to := range sortedKeys(m.Receives) {
+			file, err := receivedFile(to, m.Receives[to], given[to])
+			if err != nil {
+				return nil, err
+			}
+			first = append(first, file)
+			if received[m.Module] == nil {
+				received[m.Module] = map[string][]mcat.Contribution{}
+			}
+			// Empty rather than absent when nobody contributed, for the reason the file is
+			// written empty: "nothing asked" and "never told" want different responses.
+			received[m.Module][to] = append([]mcat.Contribution{}, given[to]...)
+		}
+		if m.Keeps != "" && with.Kept != nil {
+			file, err := keptFile(m.Keeps, with.Kept)
+			if err != nil {
+				return nil, err
+			}
+			// Read by the module as its secrets' owner when it names one: the vault, as its own account (issue 723).
+			first = append(first, ownedBy(m.SecretsOwner, file))
+		} else if runs, ok := with.KeptRuns[m.Module]; m.Keeps != "" && ok {
+			file := make(map[string]any, len(runs))
+			for k, v := range runs {
+				file[k] = v
+			}
+			file["id"] = KeptID()
+			delete(file, "module")
+			first = append(first, file)
+		}
+		if m.Computed != "" {
+			mine, part := generated[m.Module]
+			if !part {
+				// Assigned, and not yet part of what this generates. Nothing to put on the
+				// machine, which is different from an error: a node given the network module
+				// before it has an address is in exactly that state, briefly.
+				continue
+			}
+			resources = mine
+		}
+
+		// Now, and not before: a module whose resources are computed replaces them wholesale, and
+		// merging earlier would throw away the files it still needs.
+		//
+		// **Except the module's own accounts, which go before even those** (novox/hq issue 213). What
+		// the mesh computes may belong to one: a module whose code runs as an account it declares has
+		// its secrets written owned by that account, and a file given to a user the machine does not
+		// have yet fails — so on the first apply the secrets were refused, the process started without
+		// them, and the second apply healed it, which is the fault the paragraph above describes.
+		// An account depends on nothing the mesh computes.
+		accounts, rest := accountsFirst(resources)
+		resources = append(append(accounts, first...), rest...)
+		// **A file delivered only while its optional requirement is bound is left out while it is
+		// absent** (novox/hq ADR 0330 §5), and the field is dropped from the rest: the node-engine
+		// parses strictly and knows no such field.
+		absent := AbsentFor(r, m.Module)
+		resources = withoutAbsent(resources, absent)
+
+		// No container is given the mesh's names (novox/hq ADR 0148). It used to be: every
+		// container got the whole roster as `--add-host` entries at creation, and a name that
+		// moved afterwards was wrong inside it for as long as it ran (issues 109, 135) — and once
+		// the roster was made part of a container's identity so that could be caught, one name
+		// moving anywhere replaced every container in the mesh (issue 151). A container resolves a
+		// mesh name through its machine's resolver at the moment it asks, which the runtime is
+		// told once per machine, as a file, by the resolver's own module. The names a module
+		// declares for itself are its own and stay exactly as written: they are part of what the
+		// module is, and the mesh does not know what they mean.
+		// What this module may name from inside one of its own files. Gathered once per module
+		// rather than per file, because it is a fact about the module.
+		sealed, err := sealedFor(m, r.Needs, with)
+		if err != nil {
+			return nil, err
+		}
+		// And what its bindings say, for the half of a connection that is not secret.
+		known, err := knownFor(m, r.Needs, r.Node)
+		if err != nil {
+			return nil, err
+		}
+		// A requirement answered on this same machine is not in r.Needs — its binding file is
+		// written from `here` (above) — and so `${bound:…}` could not name it, though the file
+		// beside it said the same facts. Filled from the same answer, so the two cannot disagree.
+		for _, want := range m.Wants() {
+			if _, has := known[want]; has {
+				continue
+			}
+			answered, err := here(r, want, with)
+			if err != nil {
+				return nil, err
+			}
+			if answered == nil {
+				continue
+			}
+			local := *answered
+			local.For = m.Module
+			here, err := knownFor(m, []mcat.Needed{local}, r.Node)
+			if err != nil {
+				return nil, err
+			}
+			for provision, values := range here {
+				known[provision] = values
+			}
+		}
+		// And the providing machine's private address, beside its name (novox/hq ADR 0194). A name is
+		// what nearly every consumer wants; the one that cannot use it is a machine's resolver
+		// configuration, which must reach the resolver before it can resolve anything — the resolver's
+		// own name included. Absent when the machine has no address yet, so a file naming it is refused
+		// rather than written with a blank where an address belongs.
+		for _, values := range known {
+			if address := with.Machines[values["at"]]; address != "" {
+				values["address"] = address
+			}
+		}
+		// And what the module is called through each requirement it contributes to (novox/hq
+		// 04-ISSUES/122) — the same composition its binding file carries.
+		for provision, values := range known {
+			own, err := resolutionOwnNames(r, m, provision, with.Settings[m.Module])
+			if err != nil {
+				return nil, err
+			}
+			withOwnNames(values, own)
+		}
+		// And where this node places the directories the module declared without a path
+		// (novox/hq ADR 0112) — resolved once per module, named by ${dir:…} from any resource.
+		// — and, on an adopted machine, where the assignment says they already are, with the
+		// owner the data already has (novox/hq issue 153). Malformed placements are refused here.
+		placed, err := mcat.Places(m, with.Settings[m.Module])
+		if err != nil {
+			return nil, err
+		}
+		dirs := dirsFor(m, with)
+		// And the machine underneath, which no binding of its own can tell it.
+		thisMachine := machineFacts(r, with.Names, with.MeshRange)
+
+		// **A definition that already holds the answer transcribed it** (novox/hq ADR 0202).
+		// Judged over what the module itself declares, and before anything is substituted: the
+		// mesh's own generated files — the binding, the contributions — legitimately carry the
+		// derived value, and after substitution so does every consumer's file, so this is the one
+		// moment the two can be told apart.
+		for _, own := range m.Resources {
+			if err := notTranscribed(own, known, m.Module); err != nil {
+				return nil, err
+			}
+		}
+		// **And every placeholder no pass fills where it stands is refused** (novox/hq issue 231):
+		// judged here, over the definition as written and before any pass, by the function the
+		// catalogue check runs — so a manifest registered by an older binary is judged too, and
+		// what a setting or a binding later puts into a file is its software's text, never swept.
+		for _, own := range m.Resources {
+			if problems := unconsumedPlaceholders(m.Module, own); len(problems) > 0 {
+				return nil, fmt.Errorf("%s", problems[0])
+			}
+		}
+
+		// Which of this module's files carry a secret, for the rule that a container may not read
+		// one of them as its environment without saying so (ADR 0086, issue 041).
+		secretFiles := secretFilesOf(resources)
+
+		// Which of this module's resources its preparation runs before, if it prepares anything.
+		prepareBefore := preparationTarget(m)
+
+		// Which found networks this machine's setting keeps for each of its containers (novox/hq
+		// ADR 0163, rule 4); judged above, so an invalid one is not here.
+		keptNetworks, _ := KeptNetworks(m, with.Settings[m.Module], with.Adopted)
+
+		// **A moved module's templated files are the provisioner's** (novox/hq ADR 0349 §4, §6, design 57 P6): on a
+		// machine that can take them, each is declared placed and without its text, and no pass below fills it.
+		handing, err := handed.begin(r.Node, m, dirs, accessPaths, thisMachine, with, r.Capabilities, r.Needs,
+			backupPlacer{append(append([]mcat.Manifest(nil), r.Modules...), stillBackedUp...), with, thisMachine, r.Capabilities,
+				unplaced})
+		if err != nil {
+			return nil, err
+		}
+		// **A plan for what the seat keys of it all the same** (catalogue.Keyed, issue 774): a module not handed whose
+		// provider's helper answers a provision of it, its route the commonest, has that provision in a plan of its own,
+		// so the seat keys it and the helper hears it.
+		keyedOnly := handing == nil && handed.keyed(r.Node, m, r.Needs)
+		if _, ok := handed.plans[m.Module]; ok && (handing != nil || keyedOnly) {
+			for _, to := range requirementsContributedTo(m) {
+				own, err := resolutionOwnNames(r, m, to, with.Settings[m.Module])
+				if err != nil {
+					return nil, err
+				}
+				handed.name(m.Module, to, own)
+				contributed, err := resolutionContributedOf(r, m, to, with)
+				if err != nil {
+					return nil, err
+				}
+				handed.contribute(m.Module, to, contributed)
+			}
+		}
+		// A handed collector is filled from items alone: each old form its collections would have held is said
+		// (design 57 L1).
+		if plan, ok := handed.plans[m.Module]; ok && handing != nil && len(plan.Collections) > 0 {
+			*unplaced = append(*unplaced, oldFormsLeftOut(append(append([]mcat.Manifest(nil), r.Modules...),
+				stillBackedUp...), m, plan.Collections)...)
+		}
+		for _, unsettled := range resources {
+			if pr, ok := unsettled[mcat.HandedProvisionField].(mcat.PlanProvision); ok {
+				if handing == nil && m.Stubbed {
+					continue // held: its credential file is what runs of it, left out (issue 1126)
+				}
+				if handing == nil {
+					return nil, fmt.Errorf("%s: its credential of %s is handed to the provisioner and the module is "+
+						"not: nothing would fill it", m.Module, pr.Provision)
+				}
+				marked := map[string]any{}
+				for k, v := range unsettled {
+					marked[k] = v
+				}
+				delete(marked, mcat.HandedProvisionField)
+				marked[mcat.HandedSecretField] = pr.Name
+				file, sec, err := handedSecretFile(marked, m, dirs, accessPaths, thisMachine, placed)
+				if err != nil {
+					return nil, err
+				}
+				file["id"] = m.Module + "." + fmt.Sprint(unsettled["id"])
+				owner[fmt.Sprint(file["id"])] = m.Module
+				pr.Path = sec.Path
+				if err := handed.addProvisionFile(m.Module, pr); err != nil {
+					return nil, err
+				}
+				out = append(out, file)
+				continue
+			}
+			if unsettled[mcat.HandedSecretField] != nil {
+				if handing == nil && m.Stubbed {
+					continue // held: its own secret's file is what runs of it, left out (issue 1126)
+				}
+				if handing == nil {
+					return nil, fmt.Errorf("%s: its own secret %v is handed to the provisioner and the module is "+
+						"not: nothing would fill it", m.Module, unsettled[mcat.HandedSecretField])
+				}
+				file, sec, err := handedSecretFile(unsettled, m, dirs, accessPaths, thisMachine, placed)
+				if err != nil {
+					return nil, err
+				}
+				file["id"] = m.Module + "." + fmt.Sprint(unsettled["id"])
+				owner[fmt.Sprint(file["id"])] = m.Module
+				if err := handed.addSecretFile(m.Module, sec); err != nil {
+					return nil, err
+				}
+				out = append(out, file)
+				continue
+			}
+			if handing != nil && fmt.Sprint(unsettled["type"]) == "file" {
+				if text, _ := unsettled["content"].(string); len(secretsUsed(text)) > 0 &&
+					!handing[fmt.Sprint(unsettled["id"])] {
+					return nil, fmt.Errorf("%s: its file %v names a secret in its text, and a handed module's "+
+						"secrets reach only the files its provisioner client fills: keep it in a template "+
+						"(design 57 V4)", m.Module, unsettled["id"])
+				}
+			}
+			if handing[fmt.Sprint(unsettled["id"])] {
+				file, line, err := handedFile(unsettled, m, dirs, accessPaths, thisMachine, placed, with)
+				if err != nil {
+					return nil, err
+				}
+				file["id"] = m.Module + "." + fmt.Sprint(unsettled["id"])
+				owner[fmt.Sprint(file["id"])] = m.Module
+				if err := handed.add(m.Module, line); err != nil {
+					return nil, err
+				}
+				out = append(out, file)
+				continue
+			}
+			if fmt.Sprint(unsettled["type"]) == "file" {
+				if _, left := consumersHandedOnly(m, unsettled, with); left {
+					*handedOnly = append(*handedOnly, consumersLeftOutLine(m, unsettled))
+					continue
+				}
+			}
+			resource, err := ApplySettings(unsettled, with.Settings[m.Module])
+			if err != nil {
+				return nil, err
+			}
+			copied := map[string]any{}
+			for k, v := range resource {
+				copied[k] = v
+			}
+			if networks, keeps := keptNetworks[fmt.Sprint(copied["id"])]; keeps {
+				// The container also joins the found network the setting names, so a neighbour
+				// that resolves it there keeps resolving it. Passed to the host as its own field,
+				// which it joins after the container is made.
+				joins := make([]any, 0, len(networks))
+				for _, n := range networks {
+					joins = append(joins, n)
+				}
+				copied["networks"] = joins
+			}
+			if err := refuseSecretsInEnvironment(copied, secretFiles, m.Module); err != nil {
+				return nil, err
+			}
+			// Said in the catalogue, not on the machine: the host parses strictly and knows no
+			// such field, and the reason is for a reader of the manifest.
+			delete(copied, mcat.SecretsInEnvironment)
+			delete(copied, mcat.NamesOnPurpose)
+			delete(copied, mcat.TrustedField)
+			// A process's bus stays controller-side (novox/hq ADR 0436 §1): never composed onto the
+			// node-engine's process resource, whose wire declaration is mesh-host's own, vendored, with a
+			// strict decoder that refuses an unknown key.
+			delete(copied, mcat.ProcessBusField)
+			// **An operator's value, from the assignment** (novox/hq ADR 0112, ADR 0155): what a
+			// definition may not carry because it is true of one installation only. Filled from
+			// the same layers a mergeable file takes, and refused when no layer set it.
+			if err := unsetInConfigWords(settingInto(copied, WithDefaults(m, with.Settings[m.Module]), m.Module), m); err != nil {
+				return nil, err
+			}
+			// **Placed before anything reads a path.** A pathless directory receives the path
+			// this node resolves for it, and every ${dir:…} — in paths, mounts, content and
+			// environment — becomes that path, so what follows sees only concrete places
+			// (novox/hq ADR 0112). The host receives paths exactly as it always has.
+			if err := dirInto(copied, dirs, m.Module); err != nil {
+				return nil, err
+			}
+			// The operator's data the same way: ${access:…} becomes where this node keeps it,
+			// and a placed directory takes the owner the assignment said (issue 153).
+			if err := accessInto(copied, accessPaths, m.Module); err != nil {
+				return nil, err
+			}
+			ownerInto(copied, placed)
+			// **After settings, and that is the whole reason it is here.** A module's file
+			// content is where a setting lands, so a placeholder may only exist once the setting
+			// has been put in — filling secrets first would look at content that is not yet what
+			// the machine receives.
+			if err := intoFile(copied, sealed, outsideNotGiven(m, with.Needed[m.Module]), m.Module); err != nil {
+				return nil, err
+			}
+			// **Substituted here, not on the machine.** A bound value is not secret — the mesh
+			// holds it in the clear — so there is nothing for the host to be the only witness of,
+			// and sending it already filled in means the host learns no new field.
+			if err := boundInto(copied, known, m.Module, absent); err != nil {
+				return nil, err
+			}
+			// And what the module could not have written: the machine it turned out to be
+			// assigned to. Beside the bound values because it is the same kind of fact — the
+			// mesh's own, held in the clear — and because a module that must name itself to
+			// something else has no binding to learn it from (novox/hq ADR 0066).
+			// Which port this machine gave it, for a module that binds directly rather than
+			// through a runtime that can remap (ADR 0038). Applied before the machine's facts so
+			// a refusal names the port rather than whatever came after it.
+			if err := portInto(copied, m.Module, m.Listens, with); err != nil {
+				return nil, err
+			}
+			// And where this machine put the foundation's servers, for the one module that
+			// reaches them by seat rather than by binding (novox/hq 04-ISSUES/102).
+			if err := seatInto(copied, m.Module, with); err != nil {
+				return nil, err
+			}
+			if err := machineInto(copied, thisMachine, m.Module); err != nil {
+				return nil, err
+			}
+			if err := pinned(copied, m.Module); err != nil {
+				return nil, err
+			}
+			// And the other half of the same question: an image nobody has published yet is named
+			// by an artifact rather than by a placeholder digest, and is just as unrunnable.
+			if err := built(copied, m.Module); err != nil {
+				return nil, err
+			}
+			// What the mesh built is kept by digest and path; the store's address is this
+			// network's now, composed here and never recorded (novox/hq 04-ISSUES/102).
+			if err := artifactsInto(copied, m.Module, with); err != nil {
+				return nil, err
+			}
+			publishedOn(copied, m.Module, with)
+			// How it is ready, in the node-engine's words: its endpoint as the port this machine
+			// published it on — or not sent at all to an engine older than the field (ADR 0240).
+			healthInto(copied, m, with)
+			// And whether it is busy (novox/hq ADR 0335): sent only to an engine that asks it.
+			busyInto(copied, with)
+			// And a user's `root` (novox/hq ADR 0266): sent only when it asserts something, to an engine
+			// that judges it.
+			rootInto(copied, with)
+			// The account's environment and every module's shell code, where this module holds the
+			// seat that places them (novox/hq ADR 0203, ADR 0204). Gathered from every module on
+			// the node, as the jails are, and **last of every placeholder pass**: shell code is a
+			// shell's own syntax, full of `${…}` no pass above should ever be shown.
+			contributing := append(append([]mcat.Manifest(nil), r.Modules...), stillBackedUp...)
+			if err := contributionsInto(copied, m, contributing, thisMachine, with, r.Capabilities, unplaced); err != nil {
+				return nil, err
+			}
+			copied["id"] = m.Module + "." + fmt.Sprint(resource["id"])
+			// A service saying what it reflects names resources within its own module, so those
+			// are prefixed too or they would point at nothing.
+			//
+			// **Unless it already names one.** A module may reflect a file another module put on
+			// the machine — the case this exists for is a resolver restarting when the mesh
+			// rewrites the names, which are computed by the mesh and belong to its module, not to
+			// the daemon's. Written `<module>.<id>`, and a dot is what marks it as already
+			// answered: prefixing it again would point at nothing, silently, and the daemon would
+			// serve the old names for ever while everything reported success.
+			if renamed := reflectsRenamed(m.Module, resource["restart-on"]); renamed != nil {
+				copied["restart-on"] = renamed
+			}
+			// And what it is reloaded on, by the same rule (novox/hq ADR 0102): an id left
+			// unprefixed matches nothing, and the service is never reloaded.
+			if renamed := reflectsRenamed(m.Module, resource["reload-on"]); renamed != nil {
+				copied["reload-on"] = renamed
+			}
+			// And which of its module's containers a scheduled step holds still (novox/hq ADR 0189).
+			// **The loudest of the three when it is missed.** An unprefixed `restart-on` matches
+			// nothing and a service quietly never restarts; an unprefixed `while-stopped` names a
+			// container the declaration does not contain, and the host refuses the whole
+			// declaration — so the machine takes nothing at all, for every push, until this is
+			// right. That is what it did on the control node (2026-10-04).
+			if renamed := reflectsRenamed(m.Module, resource[mcat.WhileStopped]); renamed != nil {
+				copied[mcat.WhileStopped] = renamed
+			}
+			// And what a process replaces (novox/hq issue 213): a resource of this module's that it
+			// no longer declares, named as the host recorded it, or the host hands nothing over and
+			// removes it first.
+			if renamed := reflectsRenamed(m.Module, resource["replaces"]); renamed != nil {
+				copied["replaces"] = renamed
+			}
+			// **What reads one of this module's own secrets is restarted when it changes** (novox/hq
+			// issue 203, issue 206). A credential is re-issued by the mesh, and a container that
+			// mounted the old file keeps the old one open: the build machine ran for an hour on a
+			// credential the mesh had replaced, because its manifest restarted it on its
+			// environment file and nobody had thought to name the credential too. Composed here so
+			// no manifest has to say it, for a container or a daemon that names the secret's path.
+			if reads := secretsReadBy(copied, m, with.Needed[m.Module]); len(reads) > 0 {
+				copied["restart-on"] = withRestartOn(copied["restart-on"], reads)
+			}
+			// **A version prepares its state before it runs** (novox/hq ADR 0135). Derived from the
+			// module's own resource rather than declared beside it: what prepares the state is the
+			// module's own code, so what it is given has to be what that code is given — and a
+			// second resource written by hand is a second copy to drift from the first. Placed
+			// immediately before it, because a run-once step stops everything the declaration
+			// places after it (ADR 0052), which is how a version whose preparation failed does not
+			// serve.
+			if prepareBefore != "" && fmt.Sprint(resource["id"]) == prepareBefore {
+				step := prepared(copied)
+				owner[fmt.Sprint(step["id"])] = m.Module
+				out = append(out, step)
+			}
+			owner[fmt.Sprint(copied["id"])] = m.Module
+			out = append(out, copied)
+		}
+
+		// **What only the mesh knows, where this module asked for it.** The graph is the control
+		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
+		// this module's name, so they are applied, reported and removed exactly as anything else
+		// it declares.
+		// The resolver file is the node-resolver holder's where one is held here, and the uplink's
+		// holder steps back from it (novox/hq ADR 0247).
+		given, err := FactsFrom(stepsBack(m, r.Modules), r, with)
+		if err != nil {
+			return nil, err
+		}
+		for _, fact := range given {
+			fact["id"] = m.Module + "." + fmt.Sprint(fact["id"])
+			owner[fmt.Sprint(fact["id"])] = m.Module
+			out = append(out, fact)
+		}
+	}
+	// The node's tool runtime, last (novox/hq ADR 0175, to-be 38 WP2.3): one process loading every
+	// bundle delivered above and holding the credential sealed above, so both exist before it starts
+	// — the order written here is the order the machine applies.
+	if resolutionRuntimeHere(r) {
+		process, err := resolutionRuntimeProcess(r, with)
+		if err != nil {
+			return nil, err
+		}
+		if process != nil { // none for a held runtime's stand-in: what runs of it is carried
+			owner[fmt.Sprint(process["id"])] = mcat.RuntimeModule
+			out = append(out, process)
+		}
+		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
+		owns, err := resolutionOwnRuntimes(r, with)
+		if err != nil {
+			return nil, err
+		}
+		for _, p := range owns {
+			id := fmt.Sprint(p["id"])
+			owner[id] = strings.TrimSuffix(id, "."+mcat.OwnRuntimeID())
+			out = append(out, p)
+		}
+		// What each module's bundles are given is read as the account the runtime runs as — not what a
+		// module of its own account is given, which its own account reads.
+		words := map[string]map[string]string{}
+		for _, m := range r.Modules {
+			if m.RunsAs != "" {
+				continue
+			}
+			w, err := bundleWords(m, with)
+			if err != nil {
+				return nil, err
+			}
+			words[m.Module] = w
+		}
+		// And a file a module's words name is one the runtime is restarted for when it changes.
+		if named := givenTo(out, owner, words, r.Account); len(named) > 0 && process != nil {
+			restarts, _ := process["restart-on"].([]any)
+			seen := map[string]bool{}
+			for _, id := range restarts {
+				seen[fmt.Sprint(id)] = true
+			}
+			for _, id := range named {
+				if !seen[id] {
+					restarts = append(restarts, id)
+					seen[id] = true
+				}
+			}
+			process["restart-on"] = restarts
+		}
+		// **And what a module of its own account is given, its own account reads** (issue 723): the files and
+		// directories its words name that say no owner, given to the account it runs as, never the operator's.
+		for _, m := range r.Modules {
+			if m.RunsAs == "" {
+				continue
+			}
+			w, err := bundleWords(m, with)
+			if err != nil {
+				return nil, err
+			}
+			givenTo(out, owner, map[string]map[string]string{m.Module: w}, m.RunsAs)
+		}
+	}
+	if with.Adopted {
+		// First, before anything a module declares: what the mesh needs reachable, then its guard.
+		// The order a machine applies is the order written here.
+		ours := Openings(rules, with.Foundation, mcat.Published(out))
+		ours = append(ours, GuardResources(resolutionGuarded(r, out, owner, rules, with))...)
+		out = append(ours, out...)
+	}
+	return out, nil
+}
+
+// guarded is what the mesh's guard refuses on an adopted node (novox/hq ADR 0103): derived, and
+// for taken modules only.
+//
+// For each taken module, every machine port its containers publish that the filter would admit
+// from the private network only — a published port is forwarded, not received, so a found
+// firewall filtering only what it receives never sees it — together with the ports the module's
+// manifest guards explicitly (the store's port, the broker's management port), wherever the
+// machine put them. A port of a module assigned but not taken is not guarded: it may still be the
+// predecessor's, serving the predecessor's other machines. The foundation's ports are admitted
+// from everywhere and are never guarded.
+func resolutionGuarded(r mcat.Resolution, out []map[string]any, owner map[string]string, rules []mcat.Rule,
+	with mcat.Rendering) []int {
+	meshOnly := map[int]bool{}
+	fromEverywhere := map[int]bool{}
+	for _, rule := range rules {
+		if rule.Protocol != "tcp" {
+			continue
+		}
+		switch rule.From {
+		case mcat.FromMesh:
+			meshOnly[rule.Port] = true
+		case mcat.FromEverywhere:
+			fromEverywhere[rule.Port] = true
+		}
+	}
+	for _, port := range with.Foundation {
+		delete(meshOnly, port)
+		fromEverywhere[port] = true
+	}
+	seen := map[int]bool{}
+	var ports []int
+	guard := func(at int) {
+		if !seen[at] {
+			seen[at] = true
+			ports = append(ports, at)
+		}
+	}
+	for _, m := range r.Modules {
+		if !with.Taken[m.Module] {
+			continue
+		}
+		var mine []map[string]any
+		for _, resource := range out {
+			if owner[fmt.Sprint(resource["id"])] == m.Module {
+				mine = append(mine, resource)
+			}
+		}
+		for outer := range mcat.Published(mine)["tcp"] {
+			if meshOnly[outer] {
+				guard(outer)
+			}
+		}
+		for _, want := range m.Guards {
+			at := renderingMachinePort(with, m.Module, want)
+			for _, resource := range mine {
+				if fmt.Sprint(resource["type"]) != "container" {
+					continue
+				}
+				listed, _ := resource["ports"].([]any)
+				for _, entry := range listed {
+					outer, inner, _, ok := mapping(fmt.Sprint(entry))
+					if ok && inner == want {
+						at = outer
+					}
+				}
+			}
+			// Not what this node is told to open to everyone: a per-node exposure setting that
+			// widens a guarded port is the operator saying so, and declaring an opening for it
+			// and a guard dropping it would be one statement refusing the other.
+			if !fromEverywhere[at] {
+				guard(at)
+			}
+		}
+	}
+	sort.Ints(ports)
+	return ports
+}
+
+// mapping reads a container's port mapping — `[address:]outer:inner[/protocol]`, the address
+// possibly an IPv6 one in brackets — indexing from the end, so an address's own colons never
+// shift the ports. Not ok for a short form or anything that is not a mapping.
+func mapping(written string) (outer, inner int, address string, ok bool) {
+	written = strings.TrimSpace(written)
+	if cut := strings.LastIndex(written, "/"); cut >= 0 {
+		written = written[:cut]
+	}
+	parts := strings.Split(written, ":")
+	if len(parts) < 2 {
+		return 0, 0, "", false
+	}
+	inner, err := strconv.Atoi(parts[len(parts)-1])
+	if err != nil {
+		return 0, 0, "", false
+	}
+	outer, err = strconv.Atoi(parts[len(parts)-2])
+	if err != nil {
+		return 0, 0, "", false
+	}
+	return outer, inner, strings.Join(parts[:len(parts)-2], ":"), true
+}
+
+// filtersHere is the module on this node that loads the machine's packet filter, or empty when none
+// does. Named rather than counted: a refusal that says which module is one step from acted on.
+func resolutionFiltersHere(r mcat.Resolution) string {
+	for _, m := range r.Modules {
+		if m.Filtering != nil {
+			return m.Module
+		}
+	}
+	return ""
+}
+
+// Rules is the rule set this node's filter is derived from: every module's listens, what was
+// computed for this machine, and each module's per-node exposure. The same answer whether the node
+// is adopted or converged — the one loads it as a filter, the other declares it as openings.
+func Rules(r mcat.Resolution, with mcat.Rendering) ([]mcat.Rule, error) {
+	// A module whose settings cannot compose is left out of the declaration (novox/hq ADR 0163,
+	// rule 6), and out of the filter with it: nothing of it is declared, so nothing of it is let
+	// through.
+	left := LeftOut(r, with.Settings, with.Adopted)
+	exposure := map[string]map[int]string{}
+	for _, m := range r.Modules {
+		if _, isLeft := left[m.Module]; isLeft {
+			continue
+		}
+		e, err := Exposure(m, with.Settings[m.Module])
+		if err != nil {
+			return nil, err
+		}
+		// And how far each endpoint reaches, which says the same thing to the filter and more
+		// besides (novox/hq ADR 0138). Folded in here rather than beside: the filter has one
+		// question — from where — and a reach answers it, so giving it two inputs would let them
+		// disagree. Reaches refuses a port that both name, so this cannot silently prefer one.
+		reaches, err := Reaches(m, with.Settings[m.Module])
+		if err != nil {
+			return nil, err
+		}
+		// **Only for an endpoint the proxy does not serve.** A routed endpoint's port is how the
+		// proxy reaches it and nothing else (ADR 0045), so `public` there asks for a public name and
+		// says nothing about the port — opening it to the world as well would undo the arrangement
+		// the proxy exists for, and would silently reopen a port an operator had narrowed.
+		//
+		// Found by trying to express a real module: one whose routed name must be public and whose
+		// machine-side port must not be. Under one value for both, there was no way to say it.
+		routed := RoutedPorts(m)
+		for port, reach := range reaches {
+			if routed[port] {
+				continue
+			}
+			source, ok := FilterSource(reach)
+			if !ok {
+				return nil, fmt.Errorf("%s: %q is not a reach the filter can read", m.Module, reach)
+			}
+			if e == nil {
+				e = map[int]string{}
+			}
+			e[port] = source
+		}
+		if e != nil {
+			exposure[m.Module] = e
+		}
+	}
+	return Filtering(r, with.Generators, with.Ports, exposure)
+}
+
+// provisionsAs is the account that reads what the mesh writes for this provider: the one secret
+// per consumer it must open to set that consumer's password (novox/hq issue 225).
+//
+// **A root-owned 0600 file is one that process cannot read**, which is the same sentence already
+// written above for a module's own secrets — and the grant secret is the other kind of secret
+// the mesh writes for a module, so it is the same rule.
+//
+// Which account depends on where the module's code runs. A module whose code is a bundle is run
+// by the node's tool runtime, as the node's account ([ADR 0198](0198)); one still in a container
+// is whatever it declares as its secrets owner. Nothing names these paths, so the rule that
+// claims a bundle's other files by the words that name them (givenTo) cannot reach them: the
+// harness composes a grant secret's path from the contributions file, not from a word.
+//
+// Empty is root, which is what it was and what a module with no bundle and no declared owner
+// still wants.
+func resolutionProvisionsAs(r mcat.Resolution, m mcat.Manifest) string {
+	// A module of its own account reads them as that account (ADR 0259 §8, issue 723).
+	if m.RunsAs != "" {
+		return m.RunsAs
+	}
+	if len(m.Bundles) > 0 && r.Account != "" {
+		return r.Account
+	}
+	return m.SecretsOwner
+}
+
+// ownSecretOwner is who one of a module's own secret files belongs to: the account the manifest names for it, else the
+// runtime's account for the runtime's own credential and for a tools bundle's bus account (ToolsBusSecret; novox/hq ADR
+// 0564 Limits 4), which the runtime runs that bundle as, else the module's secrets-owner (root when none).
+func resolutionOwnSecretOwner(r mcat.Resolution, m mcat.Manifest, name string) string {
+	if o := m.OwnSecrets[name].Owner; o != "" {
+		return o
+	}
+	if r.Account != "" && (m.Module == mcat.RuntimeModule || ToolsBusSecret(m, name)) {
+		return r.Account
+	}
+	return m.SecretsOwner
+}
+
+// grantPath is where one consumer's sealed credential lands on the providing machine.
+//
+// Suffixed, so the directory can also hold whatever the module writing it keeps there and so a
+// node named like something else in that directory cannot collide with it.
+// One file per consumer, and a consumer is a module on a machine (novox/hq 04-ISSUES/022).
+//
+// Named after both. Named after the machine alone, two modules on one node wrote to one path: the
+// second overwrote the first, and the provisioner — reading a directory — saw one consumer where
+// there were two.
+// reflectsRenamed is a resource's restart-on list under the module's prefix, or nil when it has
+// none. It reads both the shape JSON parsing produces ([]any) and the shape code composing
+// resources natively produces ([]string): a reference that was skipped because its list arrived
+// in the other shape would point at nothing — silently, with the service never restarting and
+// every check passing, which is how a runtime kept serving without the registry trust its
+// daemon file already carried.
+func reflectsRenamed(module string, reflects any) []any {
+	var names []string
+	switch v := reflects.(type) {
+	case []any:
+		for _, id := range v {
+			names = append(names, fmt.Sprint(id))
+		}
+	case []string:
+		names = v
+	}
+	if names == nil {
+		return nil
+	}
+	var renamed []any
+	for _, named := range names {
+		if strings.Contains(named, ".") {
+			renamed = append(renamed, named)
+			continue
+		}
+		renamed = append(renamed, module+"."+named)
+	}
+	return renamed
+}
+
+func grantPath(directory, consumer, module string) string {
+	return strings.TrimRight(directory, "/") + "/" + consumer + "." + module + ".secret"
+}
+
+// holderAs is a consumer's name at the provider with a local name after it, where it keeps several
+// credentials for one provision (ADR 0094); the name alone otherwise.
+func holderAs(as, local string) string {
+	if local == "" {
+		return as
+	}
+	return as + "_" + local
+}
+
+// contributions collects what every module in this set contributes, by requirement.
+//
+// Ordered by contributing module, because the result becomes a file on a machine and a file whose
+// lines move about is a file that looks changed when nothing changed.
+func resolutionContributions(r mcat.Resolution, settings mcat.SettingsBy, grants []mcat.Grant,
+	directories map[string]string) (map[string][]mcat.Contribution, error) {
+	out := map[string][]mcat.Contribution{}
+	modules := append([]mcat.Manifest{}, r.Modules...)
+	sort.Slice(modules, func(i, j int) bool { return modules[i].Module < modules[j].Module })
+
+	// What consumers on other machines asked for. Merged in with this machine's own, because from
+	// the provider's side they are the same thing — somebody wanting something — and a provider
+	// that had to read two lists would be a provider that reads one of them.
+	sorted := append([]mcat.Grant{}, grants...)
+	sort.Slice(sorted, func(i, j int) bool {
+		if sorted[i].Provision != sorted[j].Provision {
+			return sorted[i].Provision < sorted[j].Provision
+		}
+		if sorted[i].Consumer != sorted[j].Consumer {
+			return sorted[i].Consumer < sorted[j].Consumer
+		}
+		if sorted[i].From != sorted[j].From {
+			return sorted[i].From < sorted[j].From
+		}
+		return sorted[i].Local < sorted[j].Local
+	})
+	// A consumer already carried by the grants loop, keyed (provision, module). When provider and
+	// consumer are co-located, `grantsFor` enumerates the same-node consumer too, so without this the
+	// module would be emitted a second time by the m.Contributes loop below — once full (with the
+	// grant's secret/as) and once partial — which is the duplicate seen in a co-located mesh.json.
+	granted := map[string]map[string]bool{}
+	for _, g := range sorted {
+		if g.From == "" {
+			// As above: nothing on that machine asks for this any more, so the provider is not
+			// told about it and withdraws the login on its next pass.
+			continue
+		}
+		as := holderAs(mcat.ConsumerIdentity(g.Consumer, mcat.IdentitySource(g.Slug, g.From)), g.Local)
+		derived, err := resolutionDerivedFor(r, g.Provision, as, g.From, g.Local, settings)
+		if err != nil {
+			return nil, err
+		}
+		out[g.Provision] = append(out[g.Provision], mcat.Contribution{
+			From: g.From, Node: g.Consumer, At: g.At, Values: g.Values, Derived: derived,
+			// One holder per local name: the identity the consumer is known by, and the local name
+			// after it where the module keeps several (ADR 0094). Not a login any backend checks —
+			// a secret is not a login — so the identity limit does not apply to the suffix.
+			As:     as,
+			Secret: grantPath(directories[g.Provision], g.Consumer, holderAs(g.From, g.Local)),
+		})
+		if granted[g.Provision] == nil {
+			granted[g.Provision] = map[string]bool{}
+		}
+		granted[g.Provision][g.From] = true
+	}
+	for _, m := range modules {
+		for _, to := range sortedKeys(m.Contributes) {
+			// The grants loop already emitted this module's contribution to this provision, with its
+			// minted secret — emitting the partial copy again would duplicate it. A contribution with
+			// no grant (a reverse-proxy route names a host, not a credential) is not in `granted`, so
+			// it still reaches the provider from here.
+			if granted[to][m.Module] {
+				continue
+			}
+			// Settings reach a contribution the same way they reach a file. A route's hostname is
+			// exactly the kind of thing that differs between one mesh and the next, and a module
+			// that could not have it set would have to be edited to be reused.
+			values, err := resolutionComposed(r, m, to, m.Contributes[to], settings[m.Module],
+				m.Module+" contributing to "+to)
+			if err != nil {
+				return nil, err
+			}
+			// What the module shares of its bucket reaches the provider with the rest (novox/hq ADR 0468 §8).
+			if values, err = withShares(m, to, values); err != nil {
+				return nil, err
+			}
+			out[to] = append(out[to], mcat.Contribution{From: m.Module, Values: values})
+		}
+		// Several contributions to one requirement (ADR 0094's sibling for `contributes`): an
+		// object store's data API and its console are two different public names from one module,
+		// not one. Never in `granted` — a route names a host, not a credential — so every local
+		// name always reaches the provider from here.
+		for _, to := range sortedKeys(m.ContributesMany) {
+			for _, local := range sortedKeys(m.ContributesMany[to]) {
+				values, err := resolutionComposed(r, m, to, m.ContributesMany[to][local], settings[m.Module],
+					m.Module+" contributing "+local+" to "+to)
+				if err != nil {
+					return nil, err
+				}
+				out[to] = append(out[to], mcat.Contribution{From: m.Module, Values: values})
+			}
+		}
+	}
+	return out, nil
+}
+
+// contributedOf is each contribution m makes to one requirement, composed as its provider receives it in a received
+// file (contributions: the one of `contributes` with what the module shares of its bucket, then each of several by
+// local name), with where m's machine is, encoded for PlanProvision.Contributed (issue 774): one composition, so a
+// plan and a file cannot say different things. Nil where m contributes nothing to it.
+//
+// **Its port is the one the machine published** (atAssignedPort): a plan is read on whatever machine its provider runs,
+// which cannot redirect the number as a received file on this machine is redirected (atMachinePort), so the plan
+// carries the machine port already. route-proxy dialled gitea's 3000 for git (published at 20000) and grafana's 3000
+// on another machine (published at 20012) until it did (2026-10-31).
+func resolutionContributedOf(r mcat.Resolution, m mcat.Manifest, to string, with mcat.Rendering) (json.RawMessage, error) {
+	layers := with.Settings[m.Module]
+	form := mcat.ContributedForm{At: r.At}
+	add := func(local string, values map[string]any) error {
+		values, err := resolutionAtAssignedPort(r, m, to, values, with)
+		if err != nil {
+			return err
+		}
+		raw, err := json.Marshal(values)
+		if err != nil {
+			return fmt.Errorf("%s contributing to %s: %w", m.Module, to, err)
+		}
+		form.Each = append(form.Each, mcat.ContributedOne{Local: local, Values: raw})
+		return nil
+	}
+	if raw, ok := m.Contributes[to]; ok {
+		values, err := resolutionComposed(r, m, to, raw, layers, m.Module+" contributing to "+to)
+		if err != nil {
+			return nil, err
+		}
+		if values, err = withShares(m, to, values); err != nil {
+			return nil, err
+		}
+		if err := add("", values); err != nil {
+			return nil, err
+		}
+	}
+	for _, local := range sortedKeys(m.ContributesMany[to]) {
+		values, err := resolutionComposed(r, m, to, m.ContributesMany[to][local], layers, m.Module+" contributing "+local+" to "+to)
+		if err != nil {
+			return nil, err
+		}
+		if err := add(local, values); err != nil {
+			return nil, err
+		}
+	}
+	if len(form.Each) == 0 {
+		return nil, nil
+	}
+	return EncodeContributed(form)
+}
+
+// atAssignedPort is a contribution of m with its port where this machine publishes it for m: the number
+// `${port:<software port>}` gives m itself and its declaration publishes (machinePort, port_into.go), the placement's
+// assignment where it holds one and the software's own number where it holds none (a bare port not yet moved, a fixed
+// mapping, the host's network). What its provider dials, on this machine over loopback and from another at m's address.
+//
+// **Refused where a plan carries a port m does not listen on** (with.Planned): no machine port stands for it, so the
+// provider would dial a number nothing on the machine is known to publish. Elsewhere (a declaration, a composition
+// with no ports) such a port is left as it is, as machinePort leaves it.
+func resolutionAtAssignedPort(r mcat.Resolution, m mcat.Manifest, to string, values map[string]any, with mcat.Rendering) (map[string]any, error) {
+	number, ok := asPort(values["port"])
+	if !ok {
+		return values, nil
+	}
+	_, given := with.Given[m.Module][number]
+	_, placed := with.Ports[m.Module][number]
+	if !given && !placed {
+		if with.Planned {
+			return nil, fmt.Errorf("%s contributing to %s: its port %d on %s is none of the ports it listens on, so no "+
+				"machine port stands for it", m.Module, to, number, r.Node)
+		}
+		return values, nil
+	}
+	return atMachinePort(values, m.Module, map[string]map[int]int{m.Module: {number: renderingMachinePort(with, m.Module, number)}}), nil
+}
+
+// composed is one contribution as its provider receives it: settled with this node's settings, its
+// endpoint's port filled in, and its names composed from the label.
+//
+// **One function, because two readers must agree.** The provider is told the names in its received
+// file; the contributing module is told the same names in its own binding (novox/hq 04-ISSUES/122).
+// Composing them twice, in two places, is how the proxy would come to serve one name while the
+// module wrote another into its configuration.
+func resolutionComposed(r mcat.Resolution, m mcat.Manifest, to string, raw map[string]any, layers []mcat.Layer, what string) (
+	map[string]any, error) {
+	// Overridden, not merged: a setting changes a key the contribution declares and adds none.
+	// The provider reads the contribution as a contract, and a setting made for one of this
+	// module's files is no part of it (novox/hq 04-ISSUES/173).
+	values, err := overridden(raw, WithDefaults(m, layers), what)
+	if err != nil {
+		// A required value nothing sets is said in the words of the module's form, as a file's, a unit's and an owner's
+		// are (issue 1126, seed-8: de-spiegel in the config form was refused with ${setting:…} and `settings set`).
+		var unset *UnsetSettingError
+		if errors.As(err, &unset) && unset.Module == "" {
+			unset.Module = m.Module
+			unset.where = fmt.Sprintf("a contribution%s, in %q,", strings.TrimPrefix(what, m.Module+" contributing"), unset.field)
+		}
+		return nil, unsetInConfigWords(fmt.Errorf("%s: %w", what, err), m)
+	}
+	reaches, err := Reaches(m, layers)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", what, err)
+	}
+	blocks, err := mcat.Endpoints(m, layers)
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", what, err)
+	}
+	portOfEndpoint(values, endpointPorts(m))
+	composeName(values, r.PublicDomain, servingAt(r, to), reaches, endpointPorts(m), blocks)
+	return values, nil
+}
+
+// ownNames is what a module is known by through what it contributes to one requirement — the names
+// the mesh composed for it, and nothing else of the contribution.
+//
+// **The half a module could not learn** (novox/hq 04-ISSUES/122). A module contributes a label, the
+// mesh joins it with this node's domains, and the provider serves the result — and the module itself
+// was never told. Software that must know its own address (a login redirect, a canonical URL, an
+// issuer) had it written into the manifest as a literal, which is a domain in a definition and wrong
+// on every other machine. `${bound:<requirement>:name}` is the answer, from the same composition the
+// provider receives.
+//
+// Several contributions to one requirement are keyed by their local name under `names`.
+func resolutionOwnNames(r mcat.Resolution, m mcat.Manifest, to string, layers []mcat.Layer) (map[string]any, error) {
+	pick := func(values map[string]any) map[string]any {
+		names := map[string]any{}
+		for _, key := range []string{"name", "internal-name"} {
+			if v, ok := values[key].(string); ok && v != "" {
+				names[key] = v
+			}
+		}
+		return names
+	}
+	out := map[string]any{}
+	if raw, ok := m.Contributes[to]; ok {
+		values, err := resolutionComposed(r, m, to, raw, layers, m.Module+" contributing to "+to)
+		if err != nil {
+			return nil, err
+		}
+		for k, v := range pick(values) {
+			out[k] = v
+		}
+	}
+	if locals := m.ContributesMany[to]; len(locals) > 0 {
+		many := map[string]any{}
+		for _, local := range sortedKeys(locals) {
+			values, err := resolutionComposed(r, m, to, locals[local], layers,
+				m.Module+" contributing "+local+" to "+to)
+			if err != nil {
+				return nil, err
+			}
+			if names := pick(values); len(names) > 0 {
+				many[local] = names
+			}
+		}
+		if len(many) > 0 {
+			out["names"] = many
+		}
+	}
+	return out, nil
+}
+
+// composeName joins a contribution's label with a node's public domain, and separately with its
+// private one, in place (novox/hq ADR 0056).
+//
+// **The whole of what the mesh does with a route's name: join two given strings — twice.** A
+// contribution carries a `label` — the subdomain its operator chose — and the node carries its
+// public domain and its own private-network address; the granted names are `<label>.<public-domain>`
+// and `<label>.<internal-domain>`, and the mesh interprets none of the halves. It runs on any
+// contribution carrying a label, not only a route's, because the mesh does not know what a
+// provision means — a name it can compose from parts it was given is the point, whatever the
+// provision is called.
+//
+// **The internal name is not a security boundary.** A predecessor proxy that answered both a
+// public and a private-network hostname for the same route did so as a convenience — reaching a
+// service over the VPN without a public TLS round trip — not as an access control, and composing
+// the same alias here restores that convenience rather than adding one. A route with no internal
+// domain to compose against (a node not on the private network) gets no internal name, the same as
+// it gets no public one with no public domain.
+//
+// **Additive, so an unmigrated catalogue still works.** A contribution that already carries a full
+// `name` and no `label` is left exactly as it is: the catalogue can migrate module by module while
+// the running mesh keeps serving the full names it has. And a labelled contribution on a node with
+// no public domain composes nothing — there is nothing to join it to — which reads downstream as a
+// route that named no host, the same as it would have before this existed.
+func composeName(values map[string]any, publicDomain, internalDomain string, reaches map[int]string,
+	ports map[string]int, blocks map[string]mcat.Endpoint) {
+	if values == nil {
+		return
+	}
+	// **The subdomain an assignment gave this endpoint**, before the name is joined (novox/hq ADR
+	// 0138). The module contributes a label because it names its own parts; an assignment may say a
+	// different one, because where a thing lives under a domain is the operator's to choose and used
+	// to require editing the module to change.
+	if name, ok := values[mcat.RouteEndpoint].(string); ok {
+		if ep, said := blocks[strings.TrimSpace(name)]; said && ep.Label != "" {
+			values["label"] = ep.Label
+		}
+	}
+	// **How far the endpoint this route serves reaches decides which names exist** (novox/hq ADR
+	// 0138). Both were composed whenever the node had both domains, so every routed module got a
+	// public name and an internal one whether anybody wanted them or not — and a certificate for
+	// each, because the proxy certifies the names it is given.
+	//
+	// Joined by the port: a route entry names the port it serves and the module declares a listen on
+	// it. An entry with no port is not an endpoint's route but a rule about a name — a path-level
+	// refusal shadowing another route — and it inherits whatever that route's names turned out to
+	// be, which is why it is left alone here.
+	//
+	// Nothing said is both names, as before. That is what keeps every mesh already running identical
+	// until an assignment speaks.
+	wantPublic, wantInternal := true, true
+	if port, ok := endpointPortOf(values, ports); ok {
+		if reach, said := reaches[port]; said {
+			wantPublic, wantInternal = WantsPublicName(reach), WantsInternalName(reach)
+		}
+	}
+	if !wantPublic {
+		publicDomain = ""
+	}
+	if !wantInternal {
+		internalDomain = ""
+	}
+	if _, already := values["name"]; already {
+		// A full name was given rather than a label. Left as-is: this is the legacy shape, and the
+		// point of the label is to not have to write the full name — a contribution that wrote both
+		// has said what it wants and the mesh does not second-guess it.
+		return
+	}
+	label, ok := values["label"].(string)
+	if !ok || strings.TrimSpace(label) == "" {
+		return
+	}
+	trimmed := strings.TrimSpace(label)
+	if trimmed == "@" {
+		// The apex: a module served at the bare domain, no subdomain — the zone-file convention
+		// `@`. Composes to the domain itself, so a node's own site is a label like any other rather
+		// than the one route that must still carry a full name.
+		if publicDomain != "" {
+			values["name"] = publicDomain
+		}
+		if internalDomain != "" {
+			values["internal-name"] = internalDomain
+		}
+		return
+	}
+	if publicDomain != "" {
+		values["name"] = trimmed + "." + publicDomain
+	}
+	if internalDomain != "" {
+		values["internal-name"] = trimmed + "." + internalDomain
+	}
+}
+
+// servingAt is the private-network name of the node a contribution to `to` arrives at: the
+// provider's, when the provision is answered elsewhere, and this machine's own when it is answered
+// here or not yet settled.
+//
+// A route's internal name is composed under it (novox/hq ADR 0151, issue 139). `<label>.<node>.internal`
+// is answered by every machine's resolver as *anything under that node's name goes to that node* —
+// so the node in the name has to be the one whose proxy answers, or the name sends a client to a
+// machine with nothing listening while the public name, published at the serving node's address,
+// works. Where the proxy runs beside the module the two are the same machine and nothing changes.
+func servingAt(r mcat.Resolution, to string) string {
+	for _, n := range r.Needs {
+		if n.Name == to && n.At != "" {
+			return n.At
+		}
+	}
+	return r.At
+}
+
+// receivedFile is the file a provider is given its consumers' contributions in.
+func receivedFile(requirement, path string, given []mcat.Contribution) (map[string]any, error) {
+	if given == nil {
+		// Nobody contributed. The file is still written, empty, rather than left absent: a
+		// provider that finds no file cannot tell "nothing asked for me" from "the mesh never
+		// wrote it", and the two want completely different responses.
+		given = []mcat.Contribution{}
+	}
+	// The note goes *inside* the document, not above it. The first version wrote a `//` header
+	// and produced a file that says "do not edit" to a person and fails to parse for the program
+	// meant to read it — which is the whole audience.
+	body, err := json.MarshalIndent(map[string]any{
+		"contributions": 1,
+		"requirement":   requirement,
+		"generated": "by the mesh — do not edit; replaced whenever a module contributing to " +
+			requirement + " arrives or leaves",
+		"given": given,
+	}, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{
+		"id": mcat.ReceivedID(requirement), "type": "file", "path": path, "mode": "0644",
+		"content": string(body) + "\n",
+	}, nil
+}
+
+// KeptID is the resource that carries the export to a module that keeps it.
+func KeptID() string { return "kept" }
+
+// keptFile is the export, written where the module said. Ciphertext throughout — see Keeps.
+func keptFile(dir string, kept *mcat.KeptExport) (map[string]any, error) {
+	body, err := json.MarshalIndent(kept, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{
+		"id": KeptID(), "type": "file", "path": strings.TrimRight(dir, "/") + "/export.json",
+		"mode": "0600", "content": string(body) + "\n",
+	}, nil
+}
+
+// ownedBy gives a secret file the owner the module named, when it named one (Manifest.SecretsOwner).
+func ownedBy(owner string, file map[string]any) map[string]any {
+	if owner != "" {
+		file["owner"] = owner
+	}
+	return file
+}
+
+// sortedKeys is map iteration made repeatable, which everything written to a machine needs.
+func sortedKeys[V any](m map[string]V) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// boundFile is what a module is told about something it requires from another machine.
+//
+// Where it is and what the providing module said about using it. **No credential**, and the file
+// says so rather than leaving a reader to wonder whether one was meant to be there — a missing
+// field looks like a bug, and a stated absence looks like a boundary.
+func boundFile(n mcat.Needed, path, as string, own map[string]any) (map[string]any, error) {
+	// A record has no machine and no address. Saying so is the difference between a reader
+	// concluding "somewhere with no address" and concluding the mesh failed to fill something in.
+	where := any(n.At)
+	if n.ByRecord {
+		where = "a record in this mesh, not a machine"
+	}
+	doc := map[string]any{
+		"binding":   1,
+		"provision": n.Name,
+		"from":      n.From,
+		"at":        where,
+		// Who this module is at the other end. **The half that was missing** (novox/hq
+		// 04-ISSUES/023): a consumer was told the address, the port and where its password is,
+		// and not the name it must present — which the provisioner had invented.
+		"as":     as,
+		"serves": n.Serves,
+		// **Where the credential is, not what it is.** It stopped being true that the mesh
+		// cannot issue one when 021 was fixed, and a comment asserting a fact about the mesh that
+		// has become false is worse than none — somebody reads it and stops looking.
+		"generated": "by the mesh — do not edit; replaced whenever this changes. " +
+			"The credential is not here: it is sealed, in the file this module's manifest " +
+			"names under `secrets`",
+	}
+	// **What this module is called through what it contributes here** (novox/hq 04-ISSUES/122):
+	// `name`, `internal-name`, or `names` by local name — composed exactly as the provider receives
+	// them. Absent when the module contributes nothing named, rather than written empty.
+	for key, value := range own {
+		doc[key] = value
+	}
+	body, err := json.MarshalIndent(doc, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{
+		"id": mcat.BoundID(n.Name), "type": "file", "path": path, "mode": "0644",
+		"content": string(body) + "\n",
+	}, nil
+}
+
+// ContributionsFrom is what one module on this node asked of one requirement, settled.
+//
+// Exported because a provider's grants are assembled from its consumers' resolutions, one machine
+// at a time, and the alternative was for the control plane to reimplement settling.
+//
+// **One module, not one machine** (novox/hq 04-ISSUES/022). This used to take a requirement alone
+// and refuse whenever two modules wanted it — correctly, given what it had: the credential was
+// keyed by node, so the two would have shared one, and sharing is worse than refusing. But the
+// arrangement refused is the ordinary one. A node running eight services against one database is
+// not an edge case; it is what a machine looks like. Now each consumer has its own credential and
+// there is nothing left to refuse.
+//
+// **One credential, even where a module contributes several times.** A module may answer one
+// requirement more than once (ADR 0094's sibling for `contributes`) — an object store's data API
+// and its console are two different names, not one. There is still only one `Needed` for it, one
+// credential minted, one grant to settle: a pair credential is not a place to put a label or a
+// port. So where several of this module's contributions reach the same requirement, none of them
+// is "the" value — settling to the first, arbitrarily, would hand the grant one contribution's
+// values under a credential the OTHER contribution's consumer never sees, and would collide with
+// that contribution's own entry from contributions() besides. Empty values, still granted: the
+// module asked, gets its credential, and each named contribution reaches the provider on its own.
+func ContributionsFrom(r mcat.Resolution, requirement, module string, settings mcat.SettingsBy) (
+	map[string]any, bool, error) {
+	all, err := resolutionContributions(r, settings, nil, nil)
+	if err != nil {
+		return nil, false, err
+	}
+	var mine []map[string]any
+	for _, g := range all[requirement] {
+		if g.From == module {
+			mine = append(mine, g.Values)
+		}
+	}
+	var asker mcat.Manifest
+	for _, m := range r.Modules {
+		if m.Module == module {
+			asker = m
+		}
+	}
+	if len(mine) == 1 {
+		// Its shares are already in, put there where its contribution was composed (contributions).
+		return mine[0], true, nil
+	}
+	if len(mine) > 1 {
+		values, err := withShares(asker, requirement, map[string]any{})
+		return values, err == nil, err
+	}
+	// It contributes no payload — but a require-only consumer of a parameterless provision (one whose
+	// `serves` names no consumer-supplied key: `redis-cache`, `amqp`) still ASKS for it and must be
+	// granted a credential. Keying "asks" on contributions alone marked those grants withdrawn
+	// (From=""), so the provider never created the account and the consumer authenticated nowhere. A
+	// module asks iff it still requires the provision, whether or not it hands anything up with it.
+	for _, m := range r.Modules {
+		if m.Module != module {
+			continue
+		}
+		for _, req := range m.Requires {
+			if req == requirement {
+				values, err := withShares(m, requirement, map[string]any{})
+				return values, err == nil, err
+			}
+		}
+	}
+	// Nothing on that machine asks for this any more. Said as "not found" rather than as an
+	// error: it is how a credential is withdrawn, and the provider removes what nobody asks for.
+	return nil, false, nil
+}
+
+// here is the module on this same machine that answers a requirement, as a binding.
+//
+// **Only when the provider said something a consumer must know.** That is the line: the original
+// reasoning — a file saying "it is on this node" is a fact nobody needs — is right about the
+// location and wrong about everything beside it. A shell is answered here and there is nothing to
+// say about it. A registry is answered here and the consumer still cannot guess the port.
+//
+// The address is this machine's own name on the private network when it has one, and loopback
+// when it does not — a machine not on the network still reaches itself, and naming it by a name
+// nothing resolves would be worse than naming it by an address that always works.
+func here(r mcat.Resolution, requirement string, with mcat.Rendering) (*mcat.Needed, error) {
+	serves, answered, err := resolutionServedOnThisMachine(r, requirement, with)
+	if err != nil || !answered {
+		return nil, err
+	}
+	at := r.At
+	if at == "" {
+		at = "127.0.0.1"
+	}
+	return &mcat.Needed{Name: requirement, From: r.Node, At: at, Serves: serves}, nil
+}
+
+// servedOnThisMachine is what a provider in this node's own set says a consumer must know —
+// derived exactly as the mesh derives it for a provider on any OTHER machine.
+//
+// **The one derivation, so the two arrangements cannot disagree.** For a provider elsewhere the
+// control plane walks that node, reads its manifest with that machine's port assignments, and
+// settles the result with that node's settings layers before offering it (cmd/mesh-controller plan.go,
+// theRestOfTheMesh). A provider on the consumer's own machine never passes through that walk, so
+// every step of it has to be repeated here — and each step that was not repeated was a promise the
+// co-located arrangement quietly broke: first the port (novox/hq 04-ISSUES/038), then the settled
+// values (ADR 0066, an internal CA's root arriving empty).
+//
+// Here rather than in the resolver, because here is the first moment both halves exist: resolving
+// runs before a machine's ports are assigned and knows nothing of settings.
+//
+// The first module in the resolved order that says it serves the provision answers, which is the
+// same choice here() has always made and is stable — providersFirst orders the slice, and nothing
+// downstream depends on a map's iteration.
+func resolutionServedOnThisMachine(r mcat.Resolution, provision string, with mcat.Rendering) (map[string]any, bool, error) {
+	for _, m := range r.Modules {
+		if _, said := m.Serves[provision]; !said {
+			continue
+		}
+		serves := ServedOn(m, provision, with.Ports[m.Module])
+		if len(serves) == 0 {
+			// It named the provision and said nothing about it, which is the same as not answering:
+			// there is no fact for a consumer to be given. Another module in the set may still have
+			// one, so keep looking rather than concluding from the first.
+			continue
+		}
+		settled, err := Settle(serves, WithDefaults(m, with.Settings[m.Module]))
+		if err != nil {
+			return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
+		}
+		// And the provider's own names, as this machine composes them (novox/hq ADR 0346); one it does
+		// not compose leaves its key out, said by the plan on this machine (ServedLeftOut).
+		named, _, err := ServedOwnNames(r, m, provision, settled, WithDefaults(m, with.Settings[m.Module]))
+		if err != nil {
+			return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
+		}
+		return named, true, nil
+	}
+	return nil, false, nil
+}
+
+// pinned refuses an image that is not really pinned, on its way to a machine.
+//
+// **Here and not at parse** (novox/hq 04-ISSUES/025). A manifest in a repository names artifacts
+// and the manifest the mesh holds names digests — they are deliberately not the same document, so
+// a file awaiting a pin is legitimate exactly as the bundle's is. What must never happen is a
+// placeholder reaching a machine, and this is the last moment before one does.
+//
+// The host checks only the *shape* of a reference, and cannot do more: verifying a digest exists
+// means reaching a registry, which is the one thing a host must never have to do. So sixty-four
+// zeros satisfies every gate in the system and stops on the machine at `docker pull` — which is
+// how eighteen of them shipped across five modules that parse, resolve and compose cleanly.
+func pinned(resource map[string]any, module string) error {
+	image, ok := resource["image"].(string)
+	if !ok {
+		return nil
+	}
+	_, digest, found := strings.Cut(image, "@")
+	if !found || strings.Trim(strings.TrimPrefix(digest, "sha256:"), "0") != "" {
+		return nil
+	}
+	return fmt.Errorf(
+		"%s would send %v to a machine pinned to a placeholder digest, which is never a real "+
+			"image — it would be fetched and fail there. Resolve the tag to a digest first",
+		module, resource["id"])
+}
+
+// built refuses a container that still names an artifact nobody has made.
+//
+// **Said here, by the thing that knows what "artifact" means.** A container naming an artifact is
+// a module saying "the mesh builds this"; the field is resolved into an image when a build
+// publishes one, and until then there is nothing to run. A host receiving it refuses the whole
+// declaration — correctly, since its language has no such field — but what it can say is that a
+// container does not use "artifact", which tells a reader the manifest is malformed. It is not:
+// it is unbuilt, which is a different problem with a different fix, and only the mesh is in a
+// position to tell them apart (novox/hq ADR 0073).
+func built(resource map[string]any, module string) error {
+	if fmt.Sprint(resource["type"]) != "container" {
+		return nil
+	}
+	artifact, ok := resource["artifact"].(string)
+	if !ok || artifact == "" {
+		return nil
+	}
+	return fmt.Errorf(
+		"%s has not been built for this mesh: %v is its %q artifact, and no build has published "+
+			"one. Build it — `build <repository> --path <path>` — and the module will name what "+
+			"came out instead",
+		module, resource["id"], artifact)
+}
+
+// publishedOn puts the machine's own port on the outside of a container's mapping.
+//
+// **A module writes the port the software uses; the mesh says where the machine puts it**
+// (novox/hq ADR 0038). So `"5432"` means *publish what the software calls 5432*, and this fills in
+// the half only the mesh can know.
+//
+// A mapping written the long way — `"5433:5432"` — is left exactly as it is. Some things genuinely
+// must be pinned down by hand, and quietly overruling somebody who wrote both halves would be
+// worse than not offering the short form at all.
+func publishedOn(resource map[string]any, module string, with mcat.Rendering) {
+	if fmt.Sprint(resource["type"]) != "container" {
+		return
+	}
+	listed, ok := resource["ports"].([]any)
+	if !ok {
+		return
+	}
+	out := make([]any, 0, len(listed))
+	for _, entry := range listed {
+		written := fmt.Sprint(entry)
+		if strings.Contains(written, ":") {
+			// Written the long way, and left alone — unless this node was given a machine port for
+			// it (novox/hq ADR 0100): the foundation's ports are the node's, and a manifest's
+			// number is only the default. The outer port only; an address and the software's
+			// port stay as written.
+			out = append(out, givenOuter(written, with.Given[module]))
+			continue
+		}
+		// A short form may carry the protocol — `"3478/udp"` — and the number is what the mesh
+		// assigns for; the protocol rides along. Read as one token, the `/udp` made the whole
+		// entry "not a port", and passing it through let the runtime publish it wherever it
+		// liked: unifi's STUN and discovery landed on random machine ports while every TCP pin
+		// beside them held.
+		mapping, protocol := written, ""
+		if cut := strings.LastIndex(written, "/"); cut >= 0 {
+			mapping, protocol = written[:cut], written[cut:]
+		}
+		wanted, err := strconv.Atoi(strings.TrimSpace(mapping))
+		if err != nil {
+			// Not a port at all. Passed through, so the host refuses it with its own words rather
+			// than this quietly dropping something somebody meant.
+			out = append(out, written)
+			continue
+		}
+		out = append(out, fmt.Sprintf("%d:%d%s", renderingMachinePort(with, module, wanted), wanted, protocol))
+	}
+	resource["ports"] = out
+}
+
+// givenOuter rewrites the machine side of a long-form mapping to the port this node was given for
+// it, when it was given one.
+//
+// **Under either of the mapping's names.** A node gives a port by the number the module names it
+// by, and a module publishing `"2222:22"` may say it listens on 22 or on 2222 — GivenPorts accepts
+// both and answers to both, so looking the machine side up first and the container's port second
+// finds the same number either way. Read only by the container's port, this moved nothing for the
+// module that declares the machine side, and the setting was refused before it got here.
+func givenOuter(written string, given map[int]int) string {
+	if len(given) == 0 {
+		return written
+	}
+	mapping, protocol := written, ""
+	if cut := strings.LastIndex(written, "/"); cut >= 0 {
+		mapping, protocol = written[:cut], written[cut:]
+	}
+	parts := strings.Split(mapping, ":")
+	if len(parts) < 2 {
+		return written
+	}
+	inner, err := strconv.Atoi(strings.TrimSpace(parts[len(parts)-1]))
+	if err != nil {
+		return written
+	}
+	at, ok := given[inner]
+	if outer, err := strconv.Atoi(strings.TrimSpace(parts[len(parts)-2])); err == nil {
+		if machine, named := given[outer]; named {
+			at, ok = machine, true
+		}
+	}
+	if !ok {
+		return written
+	}
+	parts[len(parts)-2] = strconv.Itoa(at)
+	return strings.Join(parts, ":") + protocol
+}
+
+// ServedOn is what a provider tells a consumer, with the port that machine actually uses.
+//
+// **The module writes the port once, in `listens`** (novox/hq ADR 0038). It used to write it three
+// times — for the rule set, for what a consumer is told, and for what the runtime publishes — and
+// nothing checked that the three agreed. This is what fills the second in.
+//
+// The assignment wins when there is one, and the declared port stands in when there is not: a
+// caller composing without a store still gets something coherent, and a mesh that has assigned one
+// tells the truth about where it put it.
+//
+// Only when the module offers exactly one port. A module offering several has not said which
+// belongs to which provision, and guessing would give a consumer a port that answers something
+// else — so it keeps whatever the manifest said, which may be nothing.
+func ServedOn(m mcat.Manifest, provision string, ports map[int]int) map[string]any {
+	serves := m.Serves[provision]
+
+	out := make(map[string]any, len(serves)+1)
+	for k, v := range serves {
+		out[k] = v
+	}
+	if _, said := out["port"]; said {
+		// Written by hand. Redirected to wherever the machine put it, and otherwise left alone.
+		if number, ok := asPort(out["port"]); ok {
+			if at, known := ports[number]; known {
+				out["port"] = at
+			}
+		}
+		return out
+	}
+	if len(m.Listens) != 1 {
+		return out
+	}
+	wanted := m.Listens[0].Port
+	if at, known := ports[wanted]; known {
+		out["port"] = at
+	} else {
+		out["port"] = wanted
+	}
+	return out
+}
+
+func asPort(v any) (int, bool) {
+	switch n := v.(type) {
+	case int:
+		return n, true
+	case float64:
+		return int(n), true
+	}
+	return 0, false
+}
+
+// atMachinePort redirects a `port` written by a module on this machine to where this machine
+// actually published it (novox/hq 04-ISSUES/038, ADR 0066).
+//
+// **A module writes the port its software uses; only the mesh knows where the machine put it.** A
+// bare `ports` mapping is assigned a host port when the declaration is composed, which is after
+// everything a module wrote has been read — so any number carried out of a manifest is the declared
+// one until it passes through here. Both directions need it: what a co-located consumer is TOLD
+// about a provider, and what a co-located workload TELLS a provider about itself.
+//
+// Named by the module the port belongs to, which is not always the one being talked about: a route
+// contribution's port is the contributing workload's, never the proxy's.
+//
+// A fresh map when it changes anything, so the manifest-derived value handed back by the resolver —
+// or by a grant gathered elsewhere — is never mutated under a caller that still holds it. Keyed by
+// the *declared* port, so applying it a second time is a no-op: once redirected the value is the
+// machine port, which is not itself a key.
+func atMachinePort(serves map[string]any, module string, ports map[string]map[int]int) map[string]any {
+	number, ok := asPort(serves["port"])
+	if !ok {
+		return serves
+	}
+	at, known := ports[module][number]
+	if !known || at == number {
+		return serves
+	}
+	copied := make(map[string]any, len(serves))
+	for k, v := range serves {
+		copied[k] = v
+	}
+	copied["port"] = at
+	return copied
+}
+
+// AtPublishedPort redirects a contribution's port to where the CONSUMER's own machine published it.
+//
+// The same redirection as [atMachinePort], for the one caller that cannot reach it. A grant is
+// assembled on the providing machine out of a consumer that lives on another one, so that
+// consumer's assignments are fetched there and handed in, rather than looked for here where they
+// are not. Without it a proxy told to reach a workload on another machine is told the port the
+// workload's *software* uses, and dials a number that machine never published — the same fault as
+// novox/hq 04-ISSUES/038, one node over.
+func AtPublishedPort(values map[string]any, module string, published map[int]int) map[string]any {
+	return atMachinePort(values, module, map[string]map[int]int{module: published})
+}
+
+// preparationTarget is the resource a module's preparation runs before: its own workload.
+//
+// The first container carrying an artifact this module built, and not itself a step — that is the
+// thing that runs the module's code, and therefore the thing whose state must be ready. Empty when
+// the module prepares nothing, or when nothing it declares could run its code.
+//
+// **A module with two own workloads gates the first of them.** Five modules in the catalogue declare
+// more than one container of their own, none of them preparing anything today. If one ever does and
+// its second workload shares the state, the gate is in front of the first — stated here because the
+// alternative is a field asking an author to restate what the mesh can see.
+func preparationTarget(m mcat.Manifest) string {
+	if !m.Prepares {
+		return ""
+	}
+	for _, r := range m.Resources {
+		// A container, or a process the host runs from a bundle the module built (novox/hq issue
+		// 213): the same program in the same context, hosted as a unit rather than a container.
+		kind := fmt.Sprint(r["type"])
+		if (kind != "container" && kind != "process") || !ownArtifact(r, m.Module) {
+			continue
+		}
+		if once, _ := r["run-once"].(bool); once {
+			continue
+		}
+		if r["schedule"] != nil {
+			continue
+		}
+		return fmt.Sprint(r["id"])
+	}
+	return ""
+}
+
+// ownArtifact is whether a resource runs something this module built, in either spelling a manifest
+// may be in: naming the artifact, before a build resolved it, or carrying the reference a build
+// recorded — this mesh's own store, under this module's name.
+func ownArtifact(resource map[string]any, module string) bool {
+	if named, _ := resource["artifact"].(string); named != "" {
+		return true
+	}
+	image, _ := resource["image"].(string)
+	// A process or an archive carries what was built as its source (novox/hq issue 213).
+	source, _ := resource["source"].(string)
+	return strings.HasPrefix(image, mcat.ArtifactStoreScheme+module+"/") ||
+		strings.HasPrefix(source, mcat.ArtifactStoreScheme+module+"/")
+}
+
+// prepared is the module's own resource as the step that prepares its state: the same image, the same
+// context, run to completion with the mesh's preparation argument.
+//
+// Three things are taken away rather than copied, each because the step runs while the version it
+// prepares for is still running. A published port cannot be bound twice, and a step that tried would
+// fail for a reason that has nothing to do with the state. A fixed address cannot be held twice, for
+// the same reason. And a cadence is what a step is the opposite of: a container runs once and gates,
+// or on a schedule, or stays up, never two (ADR 0053).
+func prepared(from map[string]any) map[string]any {
+	step := map[string]any{}
+	for k, v := range from {
+		step[k] = v
+	}
+	// **A hyphen, not a dot.** A resource's id is `<module>.<its own id>`, and a module's name may
+	// itself contain a dot (`novox.be`), so the module is everything before the *last* dot — which
+	// only works if what the mesh derives adds no dot of its own.
+	step["id"] = fmt.Sprint(from["id"]) + "-prepare"
+	step["name"] = fmt.Sprint(from["name"]) + "-prepare"
+	step["run-once"] = true
+	if fmt.Sprint(from["type"]) == "process" {
+		// A process says its whole command: the program, then its arguments. The step is the same
+		// program asked to prepare (novox/hq issue 213). It replaces nothing — what the process
+		// replaces is handed over to the process, never to the step that runs before it — and a
+		// step is not restarted, it runs again when what it reads changed, which `restart-on` says.
+		run := stringsIn(from["run"])
+		if len(run) > 0 {
+			step["run"] = []any{run[0], mcat.PreparationArgument}
+		}
+		delete(step, "replaces")
+	} else {
+		step["args"] = []any{mcat.PreparationArgument}
+	}
+	delete(step, "ports")
+	delete(step, "ip")
+	delete(step, "schedule")
+	delete(step, "reload-on")
+	return step
+}
+
+// endpointPortOf is the port the endpoint a route serves listens on: looked up by the name the route
+// gives, or read from the port it repeats (novox/hq ADR 0138).
+//
+// `ports` maps this module's endpoint names to their ports, computed once per module rather than
+// re-scanned per contribution.
+func endpointPortOf(values map[string]any, ports map[string]int) (int, bool) {
+	if name, ok := values[mcat.RouteEndpoint].(string); ok {
+		if port, found := ports[strings.TrimSpace(name)]; found {
+			return port, true
+		}
+	}
+	return asPort(values["port"])
+}
+
+// endpointPorts is a module's endpoint names against the ports they listen on.
+func endpointPorts(m mcat.Manifest) map[string]int {
+	out := map[string]int{}
+	for _, l := range m.Listens {
+		if name := strings.TrimSpace(l.Name); name != "" {
+			out[name] = l.Port
+		}
+	}
+	return out
+}
+
+// portOfEndpoint fills in the port of the endpoint a contribution names, in place.
+//
+// **A contribution that names an endpoint must still carry that endpoint's port**, because everything
+// downstream reads the port: the provider is told where to reach the consumer, and the machine-side
+// redirection that turns a declared port into the number the machine published is keyed on it
+// (atMachinePort). A route that named only its endpoint left the proxy with no port at all, and a
+// proxy with no port has nothing to dial.
+//
+// Found before it shipped and after the catalogue had already been changed to name endpoints — the
+// manifests were merged and the mesh had not yet picked them up, so nothing was broken yet. The
+// declared port, not the machine one: the redirection happens later and is keyed on the declared
+// number, so filling in the machine port here would be redirected a second time or not at all.
+func portOfEndpoint(values map[string]any, ports map[string]int) {
+	if values == nil {
+		return
+	}
+	if _, already := values["port"]; already {
+		// A route that says both is its own answer; the older shape repeated the port and is still read.
+		return
+	}
+	name, ok := values[mcat.RouteEndpoint].(string)
+	if !ok {
+		return
+	}
+	if port, found := ports[strings.TrimSpace(name)]; found {
+		values["port"] = port
+	}
+}
+
+// secretsReadBy is the file resources of this module's own secrets that a container or a daemon reads
+// — named in its volumes, its environment or its env-files by the secret's placed path — as
+// restart-on ids. Nothing for other shapes, and nothing for a scheduled or run-once process, which
+// the host refuses a restart-on for (it runs again anyway, and reads the file afresh).
+//
+// **A member of a secret family given here is read the same way** (novox/hq issue 405, ADR 0283 decision 6):
+// it is an own secret placed at its own path, and a container that mounted it would keep the value it
+// started with when the operator gives it again. given is the module's own secrets sealed to this
+// machine; a member not given is no file, so nothing restarts on it.
+func secretsReadBy(resource map[string]any, m mcat.Manifest, given map[string]string) []string {
+	kind := fmt.Sprint(resource["type"])
+	if kind != "container" && kind != "process" {
+		return nil
+	}
+	if resource["schedule"] != nil || resource["run-once"] == true {
+		return nil
+	}
+	var mentioned []string
+	for _, key := range []string{"volumes", "env", "env-file"} {
+		mentioned = append(mentioned, stringsIn(resource[key])...)
+	}
+	paths := map[string]string{}
+	for name, own := range m.OwnSecrets.Plain() {
+		if own.IssuedBy == mcat.IssuedOutside && given[name] == "" {
+			continue // not given, so not placed: nothing to restart on (novox/hq issue 401)
+		}
+		paths[name] = own.Path
+	}
+	for name, sealed := range given {
+		if own, family, ok := m.OwnSecrets.Lookup(name); ok && family != "" && sealed != "" {
+			paths[name] = own.Path
+		}
+	}
+	var out []string
+	for _, name := range sortedKeys(paths) {
+		path := paths[name]
+		if path == "" {
+			continue
+		}
+		for _, s := range mentioned {
+			// A volume is `source:destination[:mode]`; an env value or an env-file is the path itself.
+			if s == path || strings.HasPrefix(s, path+":") {
+				out = append(out, m.Module+"."+mcat.NeedID(name))
+				break
+			}
+		}
+	}
+	return out
+}
+
+// stringsIn is every string in a list or a map's values; nothing for anything else.
+func stringsIn(v any) []string {
+	switch x := v.(type) {
+	case []any:
+		var out []string
+		for _, item := range x {
+			if s, ok := item.(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	case []string:
+		return x
+	case map[string]any:
+		var out []string
+		for _, k := range sortedKeys(x) {
+			if s, ok := x[k].(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	case map[string]string:
+		var out []string
+		for _, k := range sortedKeys(x) {
+			out = append(out, x[k])
+		}
+		return out
+	}
+	return nil
+}
+
+// withRestartOn is a resource's restart-on list with these ids added once each.
+func withRestartOn(have any, add []string) []any {
+	var out []any
+	seen := map[string]bool{}
+	for _, id := range reflectsRenamed("", have) {
+		s := fmt.Sprint(id)
+		if !seen[s] {
+			seen[s] = true
+			out = append(out, s)
+		}
+	}
+	for _, id := range add {
+		if !seen[id] {
+			seen[id] = true
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// accountsFirst splits a module's resources into its accounts and everything else, each in the order
+// written.
+//
+// **An account declared only to be put in groups keeps its written place** (novox/hq ADR 0252). It is not
+// the module's own account — that one says how it logs in or where it lives — but one the module needs in
+// a group: the operator's, in the group of a daemon the module installs. The group is made by the package
+// that installs the daemon, so put first, the account was put in a group the machine did not have yet, and
+// only the next apply healed it. Written after its packages, it is applied after them.
+func accountsFirst(resources []map[string]any) (accounts, rest []map[string]any) {
+	for _, r := range resources {
+		if fmt.Sprint(r["type"]) == "user" && !onlyGroups(r) {
+			accounts = append(accounts, r)
+			continue
+		}
+		rest = append(rest, r)
+	}
+	return accounts, rest
+}
+
+// onlyGroups is a user resource that names groups and nothing else of the account: no shell, home or
+// lingering.
+func onlyGroups(r map[string]any) bool {
+	for _, field := range []string{"shell", "home", "linger"} {
+		if v, ok := r[field]; ok && v != nil && v != "" {
+			return false
+		}
+	}
+	return len(stringsIn(r["groups"])) > 0
+}
+
+// generatedHere is what each computed module's generator answers for this machine, by module —
+// absent for a module whose machine is not yet part of what it generates — held to the rule every
+// module is held to: no two modules on a machine declare one path, unit or name, nor one package present
+// and absent (novox/hq issue 190, step 5; ADR 0222, ADR 0303).
+//
+// Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
+// resources it will declare — they exist only once its generator has answered for this machine,
+// here — so a generated resource writing into another module's file was never seen. That is how
+// the private network came to declare the container runtime's daemon file and service beside the
+// runtime's own module. Asked once, so what is checked is exactly what is declared.
+func resolutionGeneratedHere(r mcat.Resolution, with mcat.Rendering) (map[string][]map[string]any, error) {
+	generated := map[string][]map[string]any{}
+	placed := make([]mcat.Manifest, 0, len(r.Modules))
+	for _, m := range r.Modules {
+		if m.Computed == "" {
+			placed = append(placed, m)
+			continue
+		}
+		generator, known := with.Generators[m.Computed]
+		if !known {
+			return nil, fmt.Errorf(
+				"%s says its resources are computed by %q, and this control plane has no %q",
+				m.Module, m.Computed, m.Computed)
+		}
+		resources, part, err := generator.Resources(r.Node)
+		if err != nil {
+			return nil, err
+		}
+		computed := m
+		computed.Resources = nil
+		if part {
+			generated[m.Module] = resources
+			computed.Resources = resources
+		}
+		placed = append(placed, computed)
+	}
+	if len(generated) == 0 {
+		return generated, nil // nothing resolution has not already judged
+	}
+	if problems := checkResources(placed); len(problems) > 0 {
+		return nil, fmt.Errorf("what the mesh computes for this machine collides with a module's own: %s",
+			strings.Join(problems, "; "))
+	}
+	return generated, nil
+}
diff --git a/internal/compose/resolution/declaration_test.go b/internal/compose/resolution/declaration_test.go
new file mode 100644
index 0000000..3c51ce3
--- /dev/null
+++ b/internal/compose/resolution/declaration_test.go
@@ -0,0 +1,84 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The mesh's user list reaches the module holding the bus, and nothing else.
+//
+// Three refusals and one delivery, because each of the refusals would be silent in a different way:
+// a module that asked and was given it could read every credential on the bus; a bus given an empty
+// file refuses every connection in the mesh and looks like a machine problem; and a bus that never
+// asked gets nothing rather than a file it does not read.
+func TestTheMeshsUserListGoesOnlyToTheModuleHoldingTheBus(t *testing.T) {
+	theBus := func() mcat.Manifest {
+		return mcat.Manifest{
+			Module: "nats", Version: "1",
+			Claims:    []mcat.Claim{{Name: "mesh-broker", Scope: mcat.ScopeMesh}},
+			BusUsers:  "/var/lib/nats-module/conf/accounts.conf",
+			Resources: []map[string]any{},
+		}
+	}
+
+	on := func(t *testing.T, m mcat.Manifest, with mcat.Rendering) ([]map[string]any, error) {
+		t.Helper()
+		return Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m}}, with)
+	}
+
+	t.Run("the holder is given it", func(t *testing.T) {
+		resources, err := on(t, theBus(), mcat.Rendering{BusUsers: "accounts { MESH { users = [] } }"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		// Prefixed with the module it came from, like every resource: two modules may reasonably
+		// both call something "config", and without the prefix the second would silently replace
+		// the first.
+		var found map[string]any
+		for _, r := range resources {
+			if r["id"] == "nats."+mcat.BusUsersID() {
+				found = r
+			}
+		}
+		if found == nil {
+			t.Fatalf("the bus was given no user list: %+v", resources)
+		}
+		if found["path"] != "/var/lib/nats-module/conf/accounts.conf" {
+			t.Errorf("written to %v rather than where the module asked", found["path"])
+		}
+		if found["mode"] != "0600" {
+			t.Errorf("mode %v: a list of every user in the mesh belongs to the one process that "+
+				"needs it", found["mode"])
+		}
+	})
+
+	t.Run("a module that does not claim the seat is refused", func(t *testing.T) {
+		m := theBus()
+		m.Claims = nil
+		if _, err := on(t, m, mcat.Rendering{BusUsers: "accounts {}"}); err == nil {
+			t.Fatal("a module that claims nothing was handed every user's password hash")
+		}
+	})
+
+	t.Run("the holder with nothing composed is refused", func(t *testing.T) {
+		if _, err := on(t, theBus(), mcat.Rendering{}); err == nil {
+			t.Fatal("the bus was given an empty user list, so it would refuse every connection in " +
+				"the mesh and look like a machine problem")
+		}
+	})
+
+	t.Run("a module that did not ask gets nothing", func(t *testing.T) {
+		m := theBus()
+		m.BusUsers = ""
+		resources, err := on(t, m, mcat.Rendering{BusUsers: "accounts {}"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, r := range resources {
+			if r["id"] == "nats."+mcat.BusUsersID() {
+				t.Fatal("a module that asked for no user list was given one")
+			}
+		}
+	})
+}
diff --git a/internal/compose/resolution/decode_for_test_test.go b/internal/compose/resolution/decode_for_test_test.go
new file mode 100644
index 0000000..74ce872
--- /dev/null
+++ b/internal/compose/resolution/decode_for_test_test.go
@@ -0,0 +1,9 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// decodeForTest builds a manifest for a test as every reader reads one (Decode); the judge's own tests are in
+// mesh-delivery's judge (novox/hq ADR 0578 §4).
+func decodeForTest(raw []byte) (mcat.Manifest, error) { return mcat.Decode(raw) }
diff --git a/internal/compose/resolution/delivery_seat.go b/internal/compose/resolution/delivery_seat.go
new file mode 100644
index 0000000..a7353da
--- /dev/null
+++ b/internal/compose/resolution/delivery_seat.go
@@ -0,0 +1,74 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// deliveryRemovedInR6 is the row of a verb release 6 removed from the delivery seat.
+func deliveryRemovedInR6(name string) mcat.Verb {
+	return mcat.Verb{Name: name, Description: "Removed in R6 (ADR 0539): refused by name, naming its replacement: " + mcat.RemovedDeliveryVerbs[name], Input: schema(nil, nil), Optional: true}
+}
+
+// deliveryVerbs are the delivery seat's tools: what reads the merges and checks, and the acts of a person and healer H2
+// on a merge (ADR 0539 clause 17).
+func deliveryVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "deliveries", Description: "Every delivery not final, and those that ended in the last day, one line " +
+			"each: its id (owner/repository@commit), its state, its group, what it waits for and since when. Narrowed " +
+			"by state, repository or group.",
+			Input: schema(map[string]string{"state": "one state, e.g. delivering or held",
+				"repository": "owner/repository", "group": "a group's id (its branch name)",
+				"all": "\"true\": the final ones of the last thirty days too"}, nil, "all")},
+		deliveryRemovedInR6("times"),
+		{Name: "show", Description: "One delivery or group whole: its delivery plan (what it builds, what each " +
+			"machine receives, what is not an ordinary send), every transition with when and why, the machine " +
+			"steps of its walk, its group and its order.",
+			Input: schema(map[string]string{"id": "a delivery's id, or a group's"}, []string{"id"})},
+		{Name: "groups", Description: "Every delivery group: its members in order, why each pair is ordered " +
+			"(declared, built by, version skew, engine before controller, by name), its composed check and its " +
+			"state, derived from its members.",
+			Input: schema(map[string]string{"all": "\"true\": the groups that ended too"}, nil, "all")},
+		deliveryRemovedInR6("what-if"),
+		{Name: "checks", Description: "What the mesh's checks said of a pull request's head or of one commit: each " +
+			"of the commit's mesh statuses (mesh/check, the one a main requires from R4e, hq's mesh/repo-check, " +
+			"mesh/delivery, …) with its state, " +
+			"description and when it was set; the merge check's full verdict as the controller said it — each " +
+			"layer's summary, the machine that ran it, when, its build id and its report; and whether the branch's " +
+			"protection would let it merge, every required status being success.",
+			Input: schema(map[string]string{"repository": "owner/repository",
+				"number": "a pull request's number: its head is read",
+				"commit": "a commit's sha, or the start of one, instead of a pull request"}, []string{"repository"}),
+			// Added after the seat's first holder shipped: optional until mesh-delivery serves it everywhere.
+			Optional: true},
+		{Name: "table", Description: "The state table every delivery runs by: each transition with its guard, " +
+			"each state's bound and what healer H2 may do once it has passed; and the machine steps' table.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "stalled", Description: "Every delivery held past its state's bound, with the transition the table " +
+			"lets healer H2 take for it, or none.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "recheck", Description: "Check a rejected or ready delivery again: it goes back to proposed and the " +
+			"controller is asked for its check. With why.",
+			Input: schema(map[string]string{"id": "the delivery's id", "why": "why, kept with the transition"},
+				[]string{"id", "why"})},
+		deliveryRemovedInR6("release"),
+		deliveryRemovedInR6("stop"),
+		{Name: "close", Description: "Healer H2's verb: take the one transition the table names for a delivery held " +
+			"past its bound. Refused for any other.",
+			Input: schema(map[string]string{"id": "the delivery's id", "why": "the condition it answers"},
+				[]string{"id", "why"})},
+		deliveryRemovedInR6("retire-history"),
+		{Name: "settle", Description: "Ask the operator to settle deliveries held because their merge reached the " +
+			"trunk without a passing check: one ask on the operator's channel for all of them, as an Approve is asked. " +
+			"The verb moves nothing; on the operator's answer each goes to merged, and whether it is on the machines " +
+			"is derived as for any merge (novox/hq ADR 0556). Refused for a delivery not held, or held for another " +
+			"reason, naming why.",
+			Input: map[string]any{"type": "object", "additionalProperties": false, "required": []string{"ids", "why"},
+				"properties": map[string]any{
+					"ids": map[string]any{"type": "array", "items": map[string]any{"type": "string"}, "minItems": 1,
+						"description": "the held deliveries' ids (owner/repository@commit)"},
+					"why": map[string]any{"type": "string", "description": "why they may be settled, shown to the operator"},
+				}},
+			// Added after the seat's release 6 holder shipped: optional until the gate serves it everywhere.
+			Optional: true},
+	}
+}
diff --git a/internal/compose/resolution/derived_for_consumer_test.go b/internal/compose/resolution/derived_for_consumer_test.go
new file mode 100644
index 0000000..f2e5860
--- /dev/null
+++ b/internal/compose/resolution/derived_for_consumer_test.go
@@ -0,0 +1,312 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// store is an object store in the shape minio has: it serves a region and a port to everyone, and
+// a bucket named for whoever is asking.
+func store() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "store", Version: "1",
+		Provides: mcat.FromAnywhere("s3-bucket"),
+		Listens:  []mcat.Listening{{Port: 9000, Protocol: "tcp", From: mcat.FromMesh}},
+		Serves: map[string]map[string]any{"s3-bucket": {
+			"region": "eu-west",
+			"bucket": "${consumer:as:dns}",
+		}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/store/grants/mesh.json"},
+		Grants:   map[string]string{"s3-bucket": "/var/lib/store/grants"},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "store", "ports": []any{"9000"},
+		}},
+	}
+}
+
+// files is a consumer that writes the bucket into its own configuration — which is the thing it
+// could not do before, and had to transcribe.
+func files() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "files", Version: "1", Slug: "files",
+		Requires: []string{"s3-bucket"},
+		Binds:    map[string]string{"s3-bucket": "/var/lib/files/store.json"},
+		Secrets:  map[string]string{"s3-bucket": "/var/lib/files/store.secret"},
+		Resources: []map[string]any{{
+			"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
+			"content": "BUCKET=${bound:s3-bucket:bucket}\nREGION=${bound:s3-bucket:region}\n",
+		}},
+	}
+}
+
+// pics is a second consumer of the same provider on the same machine: two derivations, neither
+// the other's.
+func pics() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "pics", Version: "1", Slug: "pics",
+		Requires: []string{"s3-bucket"},
+		Binds:    map[string]string{"s3-bucket": "/var/lib/pics/store.json"},
+		Secrets:  map[string]string{"s3-bucket": "/var/lib/pics/store.secret"},
+		Resources: []map[string]any{{
+			"id": "env", "type": "file", "path": "/var/lib/pics/env", "mode": "0600",
+			"content": "BUCKET=${bound:s3-bucket:bucket}\n",
+		}},
+	}
+}
+
+// The three places the derived value lands must agree, because agreeing is the whole point: the
+// consumer's own file, the binding it reads as JSON, and the provider's contributions entry.
+func TestADerivedValueReachesBothEndsAndAgrees(t *testing.T) {
+	r, err := Resolve(shelf(store(), files()), []string{"store", "files"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+		Values: map[string]any{}, Sealed: "c2VhbGVk",
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The mesh minted this identity for the consumer; the bucket is that identity as a DNS label.
+	// Derived here with the mesh's own function, so the test cannot agree with a wrong rule.
+	as := mcat.ConsumerIdentity("workstation", mcat.IdentitySource("files", "files"))
+	want := strings.ReplaceAll(as, "_", "-")
+	if want == as || !strings.Contains(as, "_") {
+		t.Fatalf("the mesh's identity %q has no separator to rewrite; this test proves nothing", as)
+	}
+
+	env := fileNamed(out, "files.env")
+	if env == nil {
+		t.Fatalf("the consumer was given no file: %v", out)
+	}
+	if got := env["content"].(string); !strings.Contains(got, "BUCKET="+want+"\n") {
+		t.Errorf("the consumer's own file was not told the bucket:\n%s\nwant BUCKET=%s", got, want)
+	}
+
+	binding := fileNamed(out, "files.bound-s3-bucket")
+	if binding == nil {
+		t.Fatalf("the consumer was given no binding: %v", out)
+	}
+	var said struct {
+		Serves map[string]any `json:"serves"`
+	}
+	if err := json.Unmarshal([]byte(binding["content"].(string)), &said); err != nil {
+		t.Fatal(err)
+	}
+	if said.Serves["bucket"] != want {
+		t.Errorf("the binding says the bucket is %q, want %q", said.Serves["bucket"], want)
+	}
+	// And what is the same for everybody is still the same for everybody.
+	if said.Serves["region"] != "eu-west" {
+		t.Errorf("the binding lost what the provider serves to all: %v", said.Serves)
+	}
+
+	given := storeGrants(t, out)
+	if len(given) != 1 {
+		t.Fatalf("the provider was told about %d consumer(s): %v", len(given), given)
+	}
+	if given[0].Derived["bucket"] != want {
+		t.Errorf("the provider was told the bucket is %v, and the consumer was told %q — "+
+			"the two ends disagree, which is the whole failure", given[0].Derived["bucket"], want)
+	}
+	// Only the per-consumer half. The region is the same for everyone and is already in the
+	// provider's own definition; repeating it here would be a copy to go stale.
+	if _, carried := given[0].Derived["region"]; carried {
+		t.Errorf("the provider was handed back what it already says for everyone: %v", given[0].Derived)
+	}
+}
+
+// Two consumers of one provider on one machine get two buckets, and neither gets the other's.
+func TestTwoConsumersOfOneProviderGetTheirOwnDerivation(t *testing.T) {
+	r, err := Resolve(shelf(store(), files(), pics()),
+		[]string{"store", "files", "pics"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{
+		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+			Values: map[string]any{}, Sealed: "c2VhbGVk"},
+		{Provision: "s3-bucket", Consumer: "workstation", From: "pics", Slug: "pics",
+			Values: map[string]any{}, Sealed: "c2VhbGVk"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	forFiles := strings.ReplaceAll(mcat.ConsumerIdentity("workstation", mcat.IdentitySource("files", "files")), "_", "-")
+	forPics := strings.ReplaceAll(mcat.ConsumerIdentity("workstation", mcat.IdentitySource("pics", "pics")), "_", "-")
+	if forFiles == forPics {
+		t.Fatal("the two consumers were given the same identity; this test proves nothing")
+	}
+	if got := fileNamed(out, "files.env")["content"].(string); !strings.Contains(got, "BUCKET="+forFiles+"\n") {
+		t.Errorf("files was not given its own bucket:\n%s", got)
+	}
+	if got := fileNamed(out, "pics.env")["content"].(string); !strings.Contains(got, "BUCKET="+forPics+"\n") {
+		t.Errorf("pics was not given its own bucket:\n%s", got)
+	}
+	var buckets []any
+	for _, g := range storeGrants(t, out) {
+		buckets = append(buckets, g.Derived["bucket"])
+	}
+	if len(buckets) != 2 || buckets[0] == buckets[1] {
+		t.Errorf("the provider was told %v; it must be told one bucket per consumer", buckets)
+	}
+}
+
+// An operator may still set what the provider serves where its definition asks (${setting:…}), and
+// the mesh still derives the rest: the setting is filled first, then the consumer's half. (Until
+// novox/hq issue 696 the layer replaced the served bucket whole; a layer replaces no served key now.)
+func TestASettingComposesWithADerivedValue(t *testing.T) {
+	prefixed := store()
+	prefixed.Serves["s3-bucket"]["bucket"] = "${setting:bucket-prefix}${consumer:as:dns}"
+	r, err := Resolve(shelf(prefixed, files()), []string{"store", "files"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{
+		Settings: mcat.SettingsBy{"store": {{From: "the operator",
+			Values: map[string]any{"bucket-prefix": "team-"}}}},
+		Grants: []mcat.Grant{{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+			Values: map[string]any{}, Sealed: "c2VhbGVk"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := "team-" + strings.ReplaceAll(mcat.ConsumerIdentity("workstation", mcat.IdentitySource("files", "files")), "_", "-")
+	if got := fileNamed(out, "files.env")["content"].(string); !strings.Contains(got, "BUCKET="+want+"\n") {
+		t.Errorf("the operator's prefix did not survive the derivation:\n%s\nwant BUCKET=%s", got, want)
+	}
+	if given := storeGrants(t, out); given[0].Derived["bucket"] != want {
+		t.Errorf("the provider was told %v, the consumer %q", given[0].Derived["bucket"], want)
+	}
+}
+
+// `dns` is checked against an identity the mesh actually mints, not an invented string.
+func TestTheDNSAlphabetIsTheMintedIdentityWithItsSeparatorRewritten(t *testing.T) {
+	as := mcat.ConsumerIdentity("anchor", mcat.IdentitySource("ncloud", "nextcloud"))
+	if err := mcat.CheckIdentity("anchor", mcat.IdentitySource("ncloud", "nextcloud")); err != nil {
+		t.Fatalf("the mesh would not mint this identity at all: %v", err)
+	}
+	label := asDNSLabel(as)
+	if strings.Contains(label, "_") {
+		t.Errorf("%q is not a DNS label", label)
+	}
+	if strings.ReplaceAll(label, "-", "_") != as {
+		t.Errorf("%q is not %q with its separator rewritten", label, as)
+	}
+}
+
+// The check that would have caught the one wrong instance: a consumer that writes the derived
+// value into its own definition instead of asking for it is refused, whether it transcribed the
+// right answer or a predecessor's.
+func TestAConsumerThatTranscribesWhatItsProviderDerivesIsRefused(t *testing.T) {
+	as := mcat.ConsumerIdentity("workstation", mcat.IdentitySource("files", "files"))
+	transcribed := strings.ReplaceAll(as, "_", "-")
+
+	m := files()
+	m.Resources = []map[string]any{{
+		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
+		// Exactly what the provider will create — correct today, and a copy of a rule that is
+		// not this module's.
+		"content": "BUCKET=" + transcribed + "\n",
+	}}
+	r, err := Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+		Values: map[string]any{}, Sealed: "c2VhbGVk",
+	}}})
+	if err == nil {
+		t.Fatal("a definition holding its own copy of the provider's naming rule was accepted")
+	}
+	if !strings.Contains(err.Error(), "${bound:s3-bucket:bucket}") {
+		t.Errorf("the refusal does not say what to write instead: %v", err)
+	}
+
+	// And a constant the provider serves to everyone is not a transcription: repeating it is
+	// redundant, not wrong, and refusing it would be the mesh policing style.
+	m.Resources = []map[string]any{{
+		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
+		"content": "REGION=eu-west\n",
+	}}
+	r, err = Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+		Values: map[string]any{}, Sealed: "c2VhbGVk",
+	}}}); err != nil {
+		t.Errorf("a value the provider serves to everyone was judged a transcription: %v", err)
+	}
+}
+
+func storeGrants(t *testing.T, out []map[string]any) []mcat.Contribution {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] != "/var/lib/store/grants/mesh.json" {
+			continue
+		}
+		var parsed struct {
+			Given []mcat.Contribution `json:"given"`
+		}
+		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
+			t.Fatal(err)
+		}
+		return parsed.Given
+	}
+	t.Fatalf("the provider was given no contributions file: %v", out)
+	return nil
+}
+
+// A consumer that keeps SEVERAL holders of one provision is refused, rather than told one thing
+// while its provider is told another.
+//
+// **This is issue 124's own failure, one case to the side.** The mesh gives each holder its own
+// login — `mesh_node_mod_<local>` (ADR 0094) — and the provider derives from the login, so it
+// would make one resource per holder. The consumer's side has no such dimension: there is one
+// binding file per provision and one `${bound:<provision>:<key>}`, both derived from the
+// un-suffixed identity. So the provider would create `…-mod-cold` and the consumer would be
+// configured against `…-mod`: it would authenticate successfully and be refused on every object,
+// which is exactly the fault this whole record exists to end.
+//
+// Refused, loudly, at the one place that can see both halves. Lifting it means giving the
+// consumer's side a local dimension, which is a decision and not an omission.
+func TestAConsumerWithSeveralHoldersOfADerivingProviderIsRefused(t *testing.T) {
+	m := files()
+	// Two holders of the one provision, the shape ADR 0094 gives a module that keeps several.
+	m.Secrets = nil
+	m.SecretsMany = map[string]map[string]string{"s3-bucket": {
+		"hot":  "/var/lib/files/hot.secret",
+		"cold": "/var/lib/files/cold.secret",
+	}}
+	m.Resources = []map[string]any{{
+		"id": "env", "type": "file", "path": "/var/lib/files/env", "mode": "0600",
+		"content": "BUCKET=${bound:s3-bucket:bucket}\n",
+	}}
+	r, err := Resolve(shelf(store(), m), []string{"store", "files"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = Declaration(r, mcat.Rendering{Grants: []mcat.Grant{
+		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+			Local: "hot", Values: map[string]any{}, Sealed: "c2VhbGVk"},
+		{Provision: "s3-bucket", Consumer: "workstation", From: "files", Slug: "files",
+			Local: "cold", Values: map[string]any{}, Sealed: "c2VhbGVk"},
+	}})
+	if err == nil {
+		t.Fatal("a consumer with several holders of a deriving provider was accepted; " +
+			"its two ends would have disagreed in silence")
+	}
+	for _, want := range []string{"files", "s3-bucket", "bucket"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %q: %v", want, err)
+		}
+	}
+}
diff --git a/internal/compose/resolution/dir_into.go b/internal/compose/resolution/dir_into.go
new file mode 100644
index 0000000..f460e7c
--- /dev/null
+++ b/internal/compose/resolution/dir_into.go
@@ -0,0 +1,239 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// defaultDataRoot is where module data lands when a node states no root of its own.
+const defaultDataRoot = "/var/lib"
+
+// placeOwn is the assignment's own root, <root>/<module> — to-be 27's one directory per
+// assignment, which every other placed thing of the module sits beneath.
+const placeOwn = "."
+
+// placeMesh is where the mesh keeps what it writes for the module, <root>/mesh/<module>.
+const placeMesh = "mesh"
+
+// dirRef is how a module names one of its placed directories: ${dir:<id>}.
+var dirRef = regexp.MustCompile(`\$\{dir:([a-z0-9][a-z0-9-]*)\}`)
+
+// dataRoot is the root this node keeps placed directories under.
+func dataRoot(with mcat.Rendering) string {
+	if root := strings.TrimRight(strings.TrimSpace(with.DataRoot), "/"); root != "" {
+		return root
+	}
+	return defaultDataRoot
+}
+
+// dirsFor is every placed directory of a module, id → the path it resolves to on this node.
+//
+// A pathless directory saying `"place": "."` is the assignment's own root, <root>/<module>; one
+// saying `"place": "mesh"` is the mesh's directory for the module, <root>/mesh/<module>; one
+// saying neither is <root>/<module>/<id>. At most one of each place makes sense; nothing enforces
+// one, because two ids resolving to one path is a mistake the module's own files make visible
+// immediately.
+//
+// A stated path may itself begin with a placed reference — `${dir:mesh-state}/state` — and is
+// filled after the directories it can name are resolved; one level, because a directory beneath
+// a placed one is the whole of what an adopted layout needs (issue 174's `state` and `out`).
+func dirsFor(m mcat.Manifest, with mcat.Rendering) map[string]string {
+	dirs := map[string]string{}
+	var beneath []map[string]any
+	// The assignment's placement wins over both (novox/hq issue 153). Refused elsewhere when
+	// malformed; here an invalid setting simply places nothing.
+	placed, _ := mcat.Places(m, with.Settings[m.Module])
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "directory" {
+			continue
+		}
+		id := fmt.Sprint(r["id"])
+		if p, said := placed[id]; said {
+			dirs[id] = p.Path
+			continue
+		}
+		if path, stated := r["path"].(string); stated && path != "" {
+			if strings.HasPrefix(path, "${dir:") {
+				beneath = append(beneath, r)
+				continue
+			}
+			dirs[id] = strings.TrimRight(path, "/")
+			continue
+		}
+		switch place, _ := r["place"].(string); place {
+		case placeOwn:
+			dirs[id] = dataRoot(with) + "/" + m.Module
+		case placeMesh:
+			dirs[id] = dataRoot(with) + "/mesh/" + m.Module
+		default:
+			dirs[id] = dataRoot(with) + "/" + m.Module + "/" + id
+		}
+	}
+	for _, r := range beneath {
+		path := strings.TrimRight(r["path"].(string), "/")
+		// A reference to no directory is left as written and refused where the resource is
+		// placed (dirInto), with the message that names what exists.
+		filled, _ := dirFill(path, dirs, m.Module)
+		dirs[fmt.Sprint(r["id"])] = filled
+	}
+	return dirs
+}
+
+// dirFill resolves every ${dir:…} in one string, or refuses a reference naming no directory.
+func dirFill(s string, dirs map[string]string, module string) (string, error) {
+	var missing error
+	out := dirRef.ReplaceAllStringFunc(s, func(ref string) string {
+		id := dirRef.FindStringSubmatch(ref)[1]
+		path, has := dirs[id]
+		if !has {
+			missing = fmt.Errorf(
+				"%s says ${dir:%s}, and %s declares no directory %q. It declares %s",
+				module, id, module, id, orNothing(namesOfDirs(dirs)))
+			return ref
+		}
+		return path
+	})
+	return out, missing
+}
+
+// placedManifest is the manifest with every path the mesh resolves already resolved: the maps
+// naming where bindings, credentials and contributions land are filled against this node's
+// placed directories, so everything downstream — the generated binding files, the sealed
+// secrets, the grant directories — reads a concrete place and learns nothing new.
+func placedManifest(m mcat.Manifest, with mcat.Rendering) (mcat.Manifest, error) {
+	dirs := dirsFor(m, with)
+	fillMap := func(in map[string]string) (map[string]string, error) {
+		if len(in) == 0 {
+			return in, nil
+		}
+		out := make(map[string]string, len(in))
+		for key, value := range in {
+			filled, err := dirFill(value, dirs, m.Module)
+			if err != nil {
+				return nil, err
+			}
+			out[key] = filled
+		}
+		return out, nil
+	}
+	var err error
+	if m.Receives, err = fillMap(m.Receives); err != nil {
+		return m, err
+	}
+	if m.Binds, err = fillMap(m.Binds); err != nil {
+		return m, err
+	}
+	if m.Secrets, err = fillMap(m.Secrets); err != nil {
+		return m, err
+	}
+	if len(m.OwnSecrets) > 0 {
+		own := make(mcat.OwnSecrets, len(m.OwnSecrets))
+		for name, s := range m.OwnSecrets {
+			filled, err := dirFill(s.Path, dirs, m.Module)
+			if err != nil {
+				return m, err
+			}
+			own[name] = mcat.OwnSecret{Path: filled, Taken: s.Taken, IssuedBy: s.IssuedBy, Prompt: s.Prompt, Owner: s.Owner}
+		}
+		m.OwnSecrets = own
+	}
+	if m.Grants, err = fillMap(m.Grants); err != nil {
+		return m, err
+	}
+	if len(m.SecretsMany) > 0 {
+		many := make(map[string]map[string]string, len(m.SecretsMany))
+		for to, locals := range m.SecretsMany {
+			if many[to], err = fillMap(locals); err != nil {
+				return m, err
+			}
+		}
+		m.SecretsMany = many
+	}
+	return m, nil
+}
+
+// dirInto places a resource: a pathless directory is given the path the mesh resolved for it,
+// and every ${dir:…} the resource carries — in its path, its content, its mounts, its
+// environment and its env-files — becomes that path.
+//
+// A reference naming no directory of this module is refused. Left as written, the literal
+// `${dir:x}` would reach the machine as a path, and the runtime would create and mount a
+// directory called `${dir:x}` — real, wrong, and named after the mistake.
+func dirInto(resource map[string]any, dirs map[string]string, module string) error {
+	fill := func(s string) (string, error) { return dirFill(s, dirs, module) }
+
+	if fmt.Sprint(resource["type"]) == "directory" {
+		id := fmt.Sprint(resource["id"])
+		if path, stated := resource["path"].(string); !stated || path == "" {
+			resource["path"] = dirs[id]
+		}
+		// Said in the catalogue, not on the machine: the host parses strictly and knows no
+		// such field — resolved, the place IS the path.
+		delete(resource, "place")
+	}
+
+	var err error
+	if path, ok := resource["path"].(string); ok {
+		if resource["path"], err = fill(path); err != nil {
+			return err
+		}
+	}
+	if content, ok := resource["content"].(string); ok {
+		if resource["content"], err = fill(content); err != nil {
+			return err
+		}
+	}
+	// Nested values are rebuilt, never written into: the resource is a shallow copy of the
+	// manifest's own map, and the manifest is composed once per node — a fill written in place
+	// would leave the first node's paths inside every later composition.
+	if volumes, ok := resource["volumes"].([]any); ok {
+		filled := make([]any, len(volumes))
+		for i, v := range volumes {
+			filled[i] = v
+			if mount, ok := v.(string); ok {
+				if filled[i], err = fill(mount); err != nil {
+					return err
+				}
+			}
+		}
+		resource["volumes"] = filled
+	}
+	if env, ok := resource["env"].(map[string]any); ok {
+		filled := make(map[string]any, len(env))
+		for key, v := range env {
+			filled[key] = v
+			if value, ok := v.(string); ok {
+				if filled[key], err = fill(value); err != nil {
+					return err
+				}
+			}
+		}
+		resource["env"] = filled
+	}
+	if files, ok := resource["env-file"].([]any); ok {
+		filled := make([]any, len(files))
+		for i, v := range files {
+			filled[i] = v
+			if path, ok := v.(string); ok {
+				if filled[i], err = fill(path); err != nil {
+					return err
+				}
+			}
+		}
+		resource["env-file"] = filled
+	}
+	return nil
+}
+
+func namesOfDirs(dirs map[string]string) []string {
+	var names []string
+	for id := range dirs {
+		names = append(names, fmt.Sprintf("%q", id))
+	}
+	sort.Strings(names)
+	return names
+}
diff --git a/internal/compose/resolution/dir_into_test.go b/internal/compose/resolution/dir_into_test.go
new file mode 100644
index 0000000..4f897a8
--- /dev/null
+++ b/internal/compose/resolution/dir_into_test.go
@@ -0,0 +1,271 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func placedModule() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "photos",
+		Resources: []map[string]any{
+			{"id": "data", "type": "directory", "mode": "0700"},
+			{"id": "server-env", "type": "file", "path": "${dir:data}/server.env",
+				"content": "STORE=${dir:data}/objects\n"},
+			{"id": "server", "type": "container", "name": "photos-server",
+				"volumes":  []any{"${dir:data}:/data"},
+				"env":      map[string]any{"DATA": "${dir:data}/objects"},
+				"env-file": []any{"${dir:data}/server.env"}},
+		},
+	}
+}
+
+func TestAPathlessDirectoryResolvesUnderTheNodesRoot(t *testing.T) {
+	m := placedModule()
+	dirs := dirsFor(m, mcat.Rendering{})
+	if dirs["data"] != "/var/lib/photos/data" {
+		t.Fatalf("the default root is /var/lib and the shape is <root>/<module>/<id>; got %q", dirs["data"])
+	}
+	dirs = dirsFor(m, mcat.Rendering{DataRoot: "/tank/nox/"})
+	if dirs["data"] != "/tank/nox/photos/data" {
+		t.Fatalf("a node's own root is honoured, trailing slash and all; got %q", dirs["data"])
+	}
+}
+
+func TestDirReferencesBecomeThePlaceInEveryField(t *testing.T) {
+	m := placedModule()
+	dirs := dirsFor(m, mcat.Rendering{})
+
+	directory := shallowCopy(m.Resources[0])
+	if err := dirInto(directory, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if directory["path"] != "/var/lib/photos/data" {
+		t.Fatalf("a pathless directory receives its resolved path; got %v", directory["path"])
+	}
+
+	file := shallowCopy(m.Resources[1])
+	if err := dirInto(file, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if file["path"] != "/var/lib/photos/data/server.env" {
+		t.Fatalf("a file's path names the place; got %v", file["path"])
+	}
+	if file["content"] != "STORE=/var/lib/photos/data/objects\n" {
+		t.Fatalf("a file's content names the place; got %v", file["content"])
+	}
+
+	container := shallowCopy(m.Resources[2])
+	if err := dirInto(container, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if container["volumes"].([]any)[0] != "/var/lib/photos/data:/data" {
+		t.Fatalf("a mount names the place; got %v", container["volumes"])
+	}
+	if container["env"].(map[string]any)["DATA"] != "/var/lib/photos/data/objects" {
+		t.Fatalf("an environment value names the place; got %v", container["env"])
+	}
+	if container["env-file"].([]any)[0] != "/var/lib/photos/data/server.env" {
+		t.Fatalf("an env-file names the place; got %v", container["env-file"])
+	}
+}
+
+func TestAStatedPathIsThePlacementAndStillAnswersByName(t *testing.T) {
+	m := placedModule()
+	// The adopted-machine case: data that must sit where the predecessor already put it.
+	m.Resources[0]["path"] = "/services/mssql/data/"
+	dirs := dirsFor(m, mcat.Rendering{})
+	if dirs["data"] != "/services/mssql/data" {
+		t.Fatalf("a stated path wins over the root, trimmed; got %q", dirs["data"])
+	}
+	container := shallowCopy(m.Resources[2])
+	if err := dirInto(container, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if container["volumes"].([]any)[0] != "/services/mssql/data:/data" {
+		t.Fatalf("references follow the placement; got %v", container["volumes"])
+	}
+}
+
+func TestFillingForOneNodeLeaksIntoNoOther(t *testing.T) {
+	m := placedModule()
+	first := shallowCopy(m.Resources[2])
+	if err := dirInto(first, dirsFor(m, mcat.Rendering{DataRoot: "/first"}), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	second := shallowCopy(m.Resources[2])
+	if err := dirInto(second, dirsFor(m, mcat.Rendering{DataRoot: "/second"}), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if got := second["volumes"].([]any)[0]; got != "/second/photos/data:/data" {
+		t.Fatalf("the second composition must see the manifest, not the first fill; got %v", got)
+	}
+	if m.Resources[2]["volumes"].([]any)[0] != "${dir:data}:/data" {
+		t.Fatalf("the manifest itself stays a template; got %v", m.Resources[2]["volumes"])
+	}
+}
+
+func TestAReferenceToNoDirectoryRefusesAtCompositionToo(t *testing.T) {
+	m := placedModule()
+	container := shallowCopy(m.Resources[2])
+	container["env"] = map[string]any{"DATA": "${dir:date}"}
+	err := dirInto(container, dirsFor(m, mcat.Rendering{}), m.Module)
+	if err == nil || !strings.Contains(err.Error(), `"date"`) || !strings.Contains(err.Error(), `"data"`) {
+		t.Fatalf("the refusal names the mistake and what exists; got %v", err)
+	}
+}
+
+func TestTheAssignmentsOwnRootIsAPlace(t *testing.T) {
+	m := mcat.Manifest{Module: "mailu", Resources: []map[string]any{
+		{"id": "state", "type": "directory", "place": ".", "mode": "0700"},
+		{"id": "data-mail", "type": "directory"},
+	}}
+	dirs := dirsFor(m, mcat.Rendering{})
+	if dirs["state"] != "/var/lib/mailu" {
+		t.Fatalf("place %q is the assignment's root; got %q", ".", dirs["state"])
+	}
+	if dirs["data-mail"] != "/var/lib/mailu/data-mail" {
+		t.Fatalf("everything else sits beneath it; got %q", dirs["data-mail"])
+	}
+	root := shallowCopy(m.Resources[0])
+	if err := dirInto(root, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if root["path"] != "/var/lib/mailu" {
+		t.Fatalf("the root receives its path; got %v", root["path"])
+	}
+	if _, still := root["place"]; still {
+		t.Fatal("place must never reach the host, which parses strictly")
+	}
+}
+
+func TestTheManifestsMapsArePlaced(t *testing.T) {
+	m := mcat.Manifest{
+		Module: "photos",
+		Resources: []map[string]any{
+			{"id": "state", "type": "directory", "place": "."},
+		},
+		Binds:      map[string]string{"route": "${dir:state}/route.json"},
+		Secrets:    map[string]string{"mongodb-database": "${dir:state}/database.secret"},
+		OwnSecrets: mcat.OwnSecrets{"admin-key": {Path: "${dir:state}/admin-key.secret"}},
+		Receives:   map[string]string{"route": "${dir:state}/grants/mesh.json"},
+	}
+	placed, err := placedManifest(m, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if placed.Binds["route"] != "/var/lib/photos/route.json" {
+		t.Fatalf("binds are placed; got %v", placed.Binds)
+	}
+	if placed.Secrets["mongodb-database"] != "/var/lib/photos/database.secret" {
+		t.Fatalf("secrets are placed; got %v", placed.Secrets)
+	}
+	if placed.OwnSecrets["admin-key"].Path != "/var/lib/photos/admin-key.secret" {
+		t.Fatalf("own-secrets are placed; got %v", placed.OwnSecrets)
+	}
+	if placed.Receives["route"] != "/var/lib/photos/grants/mesh.json" {
+		t.Fatalf("receives are placed; got %v", placed.Receives)
+	}
+	if m.Binds["route"] != "${dir:state}/route.json" {
+		t.Fatalf("the manifest itself stays a template; got %v", m.Binds)
+	}
+}
+
+func TestTheMeshsDirectoryForAModuleIsAPlace(t *testing.T) {
+	// novox/hq issue 174. What the mesh writes for a module — its bus credential, its bindings —
+	// is the mesh's plumbing under <root>/mesh/<module>, and the definition names it by id.
+	m := mcat.Manifest{Module: "umami",
+		Resources: []map[string]any{
+			{"id": "mesh-state", "type": "directory", "place": "mesh"},
+			{"id": "state", "type": "directory", "place": "."},
+			{"id": "server", "type": "container", "image": "x@sha256:aa",
+				"volumes": []any{"${dir:mesh-state}/broker:/run/secrets/broker:ro"}},
+		},
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "${dir:mesh-state}/broker"}},
+		Binds:      map[string]string{"route": "${dir:state}/route.json"},
+	}
+	dirs := dirsFor(m, mcat.Rendering{})
+	if dirs["mesh-state"] != "/var/lib/mesh/umami" || dirs["state"] != "/var/lib/umami" {
+		t.Fatalf("the mesh's directory sits beside the module's, not in it; got %v", dirs)
+	}
+	dirs = dirsFor(m, mcat.Rendering{DataRoot: "/srv"})
+	if dirs["mesh-state"] != "/srv/mesh/umami" {
+		t.Fatalf("a node's root moves the mesh's files with the module's; got %v", dirs)
+	}
+	placed, err := placedManifest(m, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if placed.OwnSecrets["broker"].Path != "/var/lib/mesh/umami/broker" {
+		t.Fatalf("own-secrets are placed under the mesh's directory; got %v", placed.OwnSecrets)
+	}
+	container := shallowCopy(m.Resources[2])
+	if err := dirInto(container, dirsFor(m, mcat.Rendering{}), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if container["volumes"].([]any)[0] != "/var/lib/mesh/umami/broker:/run/secrets/broker:ro" {
+		t.Fatalf("the mount's host side is placed; got %v", container["volumes"])
+	}
+}
+
+func TestTwoModulesPlacedRootsAreNoCollision(t *testing.T) {
+	a := mcat.Manifest{Module: "gitea", Resources: []map[string]any{
+		{"id": "state", "type": "directory", "place": "."},
+		{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
+	}}
+	b := mcat.Manifest{Module: "nextcloud", Resources: []map[string]any{
+		{"id": "state", "type": "directory", "place": "."},
+		{"id": "env", "type": "file", "path": "${dir:state}/server.env", "content": ""},
+	}}
+	if got := checkResources([]mcat.Manifest{a, b}); len(got) != 0 {
+		t.Fatalf("alike templates are different places; got %v", got)
+	}
+	// And the real collision is still caught: a module stating another's placed root.
+	c := mcat.Manifest{Module: "squatter", Resources: []map[string]any{
+		{"id": "nest", "type": "directory", "path": "/var/lib/gitea"},
+	}}
+	got := checkResources([]mcat.Manifest{a, c})
+	if len(got) != 1 || !strings.Contains(got[0], `"/var/lib/gitea"`) {
+		t.Fatalf("a stated path on a placed root collides; got %v", got)
+	}
+}
+
+func shallowCopy(resource map[string]any) map[string]any {
+	copied := map[string]any{}
+	for k, v := range resource {
+		copied[k] = v
+	}
+	return copied
+}
+
+func TestADirectoryBeneathAPlacedOneIsPlacedWithIt(t *testing.T) {
+	// An adopted layout keeps a subdirectory the predecessor made under the mesh's directory
+	// (issue 174: a forge's runtime state, a manager's output). Stated as beneath the placed one,
+	// it moves with it — a node's root moves both, and the definition names no host path.
+	m := mcat.Manifest{Module: "gitea", Resources: []map[string]any{
+		{"id": "mesh-state", "type": "directory", "place": "mesh"},
+		{"id": "runtime-state", "type": "directory", "path": "${dir:mesh-state}/state"},
+		{"id": "server", "type": "container", "image": "x@sha256:aa",
+			"volumes": []any{"${dir:runtime-state}:/data"}},
+	}}
+	dirs := dirsFor(m, mcat.Rendering{DataRoot: "/srv"})
+	if dirs["runtime-state"] != "/srv/mesh/gitea/state" {
+		t.Fatalf("the subdirectory follows the placed one; got %v", dirs)
+	}
+	sub := shallowCopy(m.Resources[1])
+	if err := dirInto(sub, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if sub["path"] != "/srv/mesh/gitea/state" {
+		t.Fatalf("the directory resource itself is resolved; got %v", sub["path"])
+	}
+	container := shallowCopy(m.Resources[2])
+	if err := dirInto(container, dirs, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if container["volumes"].([]any)[0] != "/srv/mesh/gitea/state:/data" {
+		t.Fatalf("a reference to the subdirectory resolves whole; got %v", container["volumes"])
+	}
+}
diff --git a/internal/compose/resolution/doc.go b/internal/compose/resolution/doc.go
new file mode 100644
index 0000000..4fbe81f
--- /dev/null
+++ b/internal/compose/resolution/doc.go
@@ -0,0 +1,7 @@
+// Package resolution is the node-engine's resolution and rendering of a machine's modules from their manifests: which
+// modules a node runs and why (Resolve), what each composes to (Compose, Declaration, DataItems), what is left out and
+// why, and every refusal of a composition, settings and templates included. It moved here from mesh-sdk's catalogue
+// package (novox/hq ADR 0593 §1, §7): only the node-engine composes, so mesh-sdk carries no composition rule. The
+// manifest's shapes and the indexer's judgement stay in mesh-sdk; a method of a mesh-sdk shape that composes is a
+// function here taking that shape first (Compose(r, with) for Resolution.Compose).
+package resolution
diff --git a/internal/compose/resolution/domain_test.go b/internal/compose/resolution/domain_test.go
new file mode 100644
index 0000000..12dbc59
--- /dev/null
+++ b/internal/compose/resolution/domain_test.go
@@ -0,0 +1,119 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func networkingShelf(extra ...mcat.Manifest) map[string]mcat.Manifest {
+	base := []mcat.Manifest{
+		{Module: "networking", Requires: []string{"private-network", "name-resolution"}},
+		{Module: "mesh-wireguard", Computed: "mesh-wireguard",
+			Provides: mcat.Offers("private-network", "mesh-addressing"),
+			Claims:   []mcat.Claim{{Name: "the-private-network", Scope: mcat.ScopeNode}}},
+		{Module: "mesh-names", Computed: "mesh-names",
+			Provides: mcat.Offers("name-resolution"), Requires: []string{"mesh-addressing"}},
+	}
+	return shelf(append(base, extra...)...)
+}
+
+func TestOneWordBringsUpTheNetwork(t *testing.T) {
+	// The case that has to stay easy. Nothing is asked, because with one answer to each
+	// requirement there was never a question.
+	got, err := Resolve(networkingShelf(), []string{"networking"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	have := strings.Join(names(got), " ")
+	for _, want := range []string{"networking", "mesh-wireguard", "mesh-names"} {
+		if !strings.Contains(have, want) {
+			t.Fatalf("assigning networking did not bring in %s: %s", want, have)
+		}
+	}
+}
+
+func TestASecondVPNTurnsItIntoAChoice(t *testing.T) {
+	// And the choice is offered rather than made. A default here would be the flavor field coming
+	// back under another name.
+	_, err := Resolve(networkingShelf(mcat.Manifest{Module: "tailscale", Provides: mcat.Offers("private-network"),
+		Claims: []mcat.Claim{{Name: "the-private-network", Scope: mcat.ScopeNode}}},
+	), []string{"networking"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("two VPNs and one was picked silently")
+	}
+	for _, want := range []string{"mesh-wireguard", "tailscale"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+func TestChoosingIsAssigning(t *testing.T) {
+	// No second verb. Assigning the one you want answers the requirement, and the bundle takes it.
+	got, err := Resolve(networkingShelf(mcat.Manifest{Module: "tailscale",
+		Provides: mcat.Offers("private-network", "name-resolution"),
+		Claims:   []mcat.Claim{{Name: "the-private-network", Scope: mcat.ScopeNode}}},
+	), []string{"networking", "tailscale"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	have := strings.Join(names(got), " ")
+	if !strings.Contains(have, "tailscale") {
+		t.Fatalf("the chosen VPN is not in the set: %s", have)
+	}
+	if strings.Contains(have, "mesh-wireguard") {
+		t.Fatalf("choosing tailscale still installed WireGuard: %s", have)
+	}
+}
+
+func TestChoosingOneVPNCannotDragTheOtherBackIn(t *testing.T) {
+	// This happened. The person chose tailscale; the names module required the mesh's own
+	// addressing; only WireGuard provides that; so both were installed and nobody was told.
+	//
+	// The claim is what catches it. Providing a private network is not the singular part — a
+	// machine could run two VPNs for two purposes — but being *the* one the mesh runs over is.
+	_, err := Resolve(networkingShelf(mcat.Manifest{Module: "tailscale", Provides: mcat.Offers("private-network"),
+		Claims: []mcat.Claim{{Name: "the-private-network", Scope: mcat.ScopeNode}}},
+	), []string{"networking", "tailscale"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("a machine was given two private networks without being told")
+	}
+	if !strings.Contains(err.Error(), "the-private-network") {
+		t.Fatalf("the refusal does not say what collided: %v", err)
+	}
+}
+
+func TestNamesNeedTheMeshsOwnAddresses(t *testing.T) {
+	// Names are computed from addresses the mesh handed out. Over a VPN that hands out its own,
+	// the mesh has nothing to write, so the names module requires the addressing rather than a
+	// private network in general — otherwise a machine gets a hosts file full of addresses that
+	// mean nothing on it.
+	_, err := Resolve(shelf(mcat.Manifest{Module: "mesh-names", Computed: "mesh-names",
+		Provides: mcat.Offers("name-resolution"), Requires: []string{"mesh-addressing"}}, mcat.Manifest{Module: "tailscale", Provides: mcat.Offers("private-network")},
+	), []string{"mesh-names", "tailscale"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("the mesh's names were installed over a VPN whose addresses it does not hand out")
+	}
+	if !strings.Contains(err.Error(), "mesh-addressing") {
+		t.Fatalf("the refusal does not say what is missing: %v", err)
+	}
+}
+
+func TestARequirementWantedTwiceIsReportedOnce(t *testing.T) {
+	// Two identical lines make a person hunt for the difference between them before realising
+	// there is none.
+	_, err := Resolve(shelf(mcat.Manifest{Module: "one", Requires: []string{"shell"}}, mcat.Manifest{Module: "two", Requires: []string{"shell"}}, mcat.Manifest{Module: "bash", Provides: mcat.Offers("shell")}, mcat.Manifest{Module: "zsh", Provides: mcat.Offers("shell")}), []string{"one", "two"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("two shells and one was picked silently")
+	}
+	if n := strings.Count(err.Error(), `"shell" is wanted by`); n != 1 {
+		t.Fatalf("the same requirement was reported %d times:\n%v", n, err)
+	}
+}
diff --git a/internal/compose/resolution/endpoint_test.go b/internal/compose/resolution/endpoint_test.go
new file mode 100644
index 0000000..ed009b9
--- /dev/null
+++ b/internal/compose/resolution/endpoint_test.go
@@ -0,0 +1,143 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// aMediaServer is the shape one port number per key cannot express: two endpoints of different kinds.
+// A web surface a proxy serves under a subdomain, and a protocol port clients dial directly because
+// the client expects that number.
+func aMediaServer() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "media",
+		Listens: []mcat.Listening{
+			{Name: "web", Port: 80, From: mcat.FromMesh, Why: "the app, behind the proxy"},
+			{Name: "stream", Port: 32400, From: mcat.FromEverywhere, Fixed: true,
+				Why: "the client dials this number; the protocol chose it"},
+		},
+		Contributes: map[string]map[string]any{
+			"route": {"label": "media", mcat.RouteEndpoint: "web"},
+		},
+		// Both endpoints are published by its container, which is what lets a machine port be given
+		// for either: the mesh moves a port the module publishes, never one it merely listens on.
+		Resources: []map[string]any{
+			{"id": "server", "type": "container", "name": "media",
+				"ports": []any{"80", "32400"}},
+		},
+	}
+}
+
+// And the routed set is read through the name, so the endpoint the proxy serves is known without a
+// reader joining two numbers.
+func TestTheRoutedEndpointIsFoundByName(t *testing.T) {
+	routed := RoutedPorts(aMediaServer())
+	if !routed[80] {
+		t.Fatalf("the routed endpoint was not found by name: %v", routed)
+	}
+	// And the directly-dialled one is not routed, which is what lets its reach govern its port.
+	if routed[32400] {
+		t.Fatalf("the endpoint clients dial directly reads as routed: %v", routed)
+	}
+}
+
+// **Two endpoints of different shapes, configured as themselves.** The web endpoint's reach asks for
+// names and leaves its port to the proxy; the stream endpoint's reach governs its port, because
+// clients dial it and there is no name.
+func TestTwoEndpointsOfDifferentShapesAreConfiguredSeparately(t *testing.T) {
+	m := aMediaServer()
+	settings := mcat.SettingsBy{"media": {{From: "node anchor", Values: map[string]any{mcat.ReachSetting: map[string]any{"80": mcat.ReachBoth, "32400": mcat.ReachPublic}}}}}
+
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	rules, err := Rules(r, mcat.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, rule := range rules {
+		switch rule.Port {
+		case 80:
+			if rule.From != mcat.FromMesh {
+				t.Fatalf("the routed endpoint's port opened to %q; the proxy is how it is reached",
+					rule.From)
+			}
+		case 32400:
+			if rule.From != mcat.FromEverywhere {
+				t.Fatalf("the directly-dialled endpoint's port is %q, want anywhere", rule.From)
+			}
+		}
+	}
+
+	// And the routed one carries both names, asked for by the same statement.
+	given, err := resolutionContributions(r, settings, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var public, internal string
+	for _, c := range given["route"] {
+		public, _ = c.Values["name"].(string)
+		internal, _ = c.Values["internal-name"].(string)
+	}
+	if public != "media.example.test" || internal != "media.anchor.internal" {
+		t.Fatalf("names are %q and %q, want both", public, internal)
+	}
+}
+
+// **A route that names an endpoint still carries that endpoint's port.**
+//
+// Everything downstream reads the port: the provider is told where to reach the consumer, and the
+// redirection that turns a declared port into the number the machine published is keyed on it. A route
+// naming only its endpoint left the proxy with no port, and a proxy with no port has nothing to dial.
+//
+// Caught after the catalogue had already been changed to name endpoints, and before the mesh picked
+// those manifests up — which is the only reason nothing broke.
+func TestARouteNamingAnEndpointStillCarriesItsPort(t *testing.T) {
+	m := aMediaServer()
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	given, err := resolutionContributions(r, nil, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var saw bool
+	for _, c := range given["route"] {
+		saw = true
+		port, ok := asPort(c.Values["port"])
+		if !ok {
+			t.Fatalf("the route carries no port, so the proxy has nothing to dial: %v", c.Values)
+		}
+		if port != 80 {
+			t.Fatalf("the route carries port %d, want the web endpoint's 80", port)
+		}
+	}
+	if !saw {
+		t.Fatal("the module contributed no route")
+	}
+}
+
+// And the declared port, not the machine one: the redirection to where the machine published it
+// happens later and is keyed on the declared number, so filling the machine port in here would be
+// redirected twice or not at all.
+func TestTheEndpointsDeclaredPortIsFilledInNotTheMachineOne(t *testing.T) {
+	m := aMediaServer()
+	values := map[string]any{mcat.RouteEndpoint: "web", "label": "media"}
+	portOfEndpoint(values, endpointPorts(m))
+	if got, _ := asPort(values["port"]); got != 80 {
+		t.Fatalf("filled in port %d, want the declared 80", got)
+	}
+	// Then the ordinary redirection puts it where the machine published it.
+	moved := atMachinePort(values, m.Module, map[string]map[int]int{"media": {80: 20009}})
+	if got, _ := asPort(moved["port"]); got != 20009 {
+		t.Fatalf("after redirection the port is %d, want the machine's 20009", got)
+	}
+}
+
+// A route that repeats a port keeps it, because that is the older shape and still read.
+func TestARouteThatRepeatsItsPortKeepsIt(t *testing.T) {
+	values := map[string]any{mcat.RouteEndpoint: "web", "port": 8080}
+	portOfEndpoint(values, map[string]int{"web": 80})
+	if got, _ := asPort(values["port"]); got != 8080 {
+		t.Fatalf("the port it stated was overwritten with %d", got)
+	}
+}
diff --git a/internal/compose/resolution/endpoints_setting_test.go b/internal/compose/resolution/endpoints_setting_test.go
new file mode 100644
index 0000000..dfce915
--- /dev/null
+++ b/internal/compose/resolution/endpoints_setting_test.go
@@ -0,0 +1,98 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func configured(block map[string]any) mcat.SettingsBy {
+	return mcat.SettingsBy{"media": {{From: "node anchor",
+		Placement: map[string]any{mcat.EndpointsSetting: block}}}}
+}
+
+// **One block per endpoint, saying all three things.** The machine port, the subdomain and the reach
+// were `ports`, the route's label and `reach`, each keyed by a port number, so configuring a module
+// with two endpoints of different shapes meant knowing which number was which.
+func TestAnEndpointsBlockSaysPortLabelAndReach(t *testing.T) {
+	m := aMediaServer()
+	// stream's reach NARROWS what the manifest says — the manifest has it from anywhere, the
+	// assignment says internal. Chosen deliberately: a reach that agrees with the manifest proves
+	// nothing about whether the block was read at all.
+	settings := configured(map[string]any{
+		"web":    map[string]any{"port": 20009, "label": "cinema", "reach": mcat.ReachBoth},
+		"stream": map[string]any{"reach": mcat.ReachInternal},
+	})
+
+	// The machine port, where the mapping is read.
+	given, err := GivenPorts(m, settings["media"])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if given[80] != 20009 {
+		t.Fatalf("the web endpoint is on machine port %d, want 20009: %v", given[80], given)
+	}
+
+	// The reach, where the filter reads it.
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	rules, err := Rules(r, mcat.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, rule := range rules {
+		if rule.Port == 32400 && rule.From != mcat.FromMesh {
+			t.Fatalf("the directly-dialled endpoint is %q; the assignment narrowed it to the private "+
+				"network and the manifest's 'anywhere' should not win", rule.From)
+		}
+		if rule.Port == 80 && rule.From != mcat.FromMesh {
+			t.Fatalf("the routed endpoint's port opened to %q; the proxy is how it is reached", rule.From)
+		}
+	}
+
+	// And the subdomain, where the name is composed — the assignment's, not the module's.
+	nodes, err := resolutionContributions(r, settings, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range nodes["route"] {
+		if got, _ := c.Values["name"].(string); got != "cinema.example.test" {
+			t.Fatalf("the public name is %q, want the label the assignment gave", got)
+		}
+		if got, _ := c.Values["internal-name"].(string); got != "cinema.anchor.internal" {
+			t.Fatalf("the internal name is %q, want the label the assignment gave", got)
+		}
+	}
+}
+
+// A block that says only a reach leaves the port to the mesh and the label to the module, which is the
+// ordinary case and must not require writing the other two.
+func TestABlockMaySayOnlyAReach(t *testing.T) {
+	m := aMediaServer()
+	settings := configured(map[string]any{"web": map[string]any{"reach": mcat.ReachInternal}})
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	nodes, err := resolutionContributions(r, settings, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range nodes["route"] {
+		if got, _ := c.Values["name"].(string); got != "" {
+			t.Fatalf("an internal endpoint composed the public name %q", got)
+		}
+		// The module's own label, untouched.
+		if got, _ := c.Values["internal-name"].(string); got != "media.anchor.internal" {
+			t.Fatalf("the internal name is %q, want the module's own label", got)
+		}
+	}
+}
+
+// **Two places giving one endpoint a machine port is the confusion this key exists to end.**
+func TestAnEndpointGivenAPortTwiceIsRefused(t *testing.T) {
+	m := aMediaServer()
+	_, err := GivenPorts(m, []mcat.Layer{{From: "node anchor", Placement: map[string]any{mcat.EndpointsSetting: map[string]any{"web": map[string]any{"port": 20009}}, mcat.PortsSetting: map[string]any{"80": 30000}}}})
+	if err == nil || !strings.Contains(err.Error(), "published once") {
+		t.Fatalf("an endpoint given two machine ports was accepted: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/engine_seat.go b/internal/compose/resolution/engine_seat.go
new file mode 100644
index 0000000..58408be
--- /dev/null
+++ b/internal/compose/resolution/engine_seat.go
@@ -0,0 +1,11 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// engineSeat is the seat's row in the closed set.
+func engineSeat() mcat.Seat {
+	return mcat.Seat{Name: mcat.EngineSeat, Scope: mcat.ScopeNode, Serves: mcat.EngineVerbs(), Emits: append([]string(nil), mcat.EngineEvents...),
+		HeldByTheEngine: true, Decision: "novox/hq ADR 0563"}
+}
diff --git a/internal/compose/resolution/enrolment_seat.go b/internal/compose/resolution/enrolment_seat.go
new file mode 100644
index 0000000..1d30161
--- /dev/null
+++ b/internal/compose/resolution/enrolment_seat.go
@@ -0,0 +1,67 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// enrolmentDecision is the record that made the seat.
+const enrolmentDecision = "novox/hq ADR 0587"
+
+// enrolmentVerbs are the seat's verbs: what reads all it holds and does by hand all it does (ADR 0587 §8). Not optional:
+// the seat is new with its holder, so no holder of before serves fewer.
+func enrolmentVerbs() []mcat.Verb {
+	str := func(description string) map[string]any {
+		return map[string]any{"type": "string", "description": description}
+	}
+	return []mcat.Verb{
+		{Name: mcat.EnrolmentVerbIssue, Description: "Issue a one-time token for a new machine, on the operator's Approve: " +
+			"refused at once, naming every finding, for a name that is not a node name or that a node record, a placement " +
+			"key or an open enrolment holds, and for every call before the controller's lease is handed away. Otherwise " +
+			"reserves the lowest free private-network address, asks the operator under the seat's own name and, on the " +
+			"warrant, adds the node to placement with its tunnel key, asks the vault for the token and says enrolment-issued. " +
+			"The token itself is read only through tokens.",
+			Input: schema(map[string]string{
+				"node":    "the new machine's name in the mesh",
+				"why":     "why it joins, shown to the operator with the ask",
+				"expires": "how long the token lasts, a duration such as 1h or 24h: one hour when not given, at most 24 hours",
+				// The operator's decision of 2026-11-02 01:05: the tunnel key is given at issue, so on the Approve the node
+				// enters placement with it and the hub peers it before redeem.
+				"overlay_key": "the new machine's private network (tunnel) public key, as `nox-mesh-host key` prints it",
+			}, []string{"node", "why", "overlay_key"})},
+		{Name: mcat.EnrolmentVerbRedeem, Description: "Spend a token: asked by a joining node-engine dialled as enrol.<node> " +
+			"alone, with the public halves of its keys and its identity key's proof over them. Spends the token, asks the " +
+			"vault for the node's account and certificate, writes the node into placement, and answers the account sealed " +
+			"to the node, its certificate and the vault's public half, signed by the vault. Asked again with the same keys " +
+			"it finishes what is not done and answers the same; with other keys it is refused.",
+			Input: map[string]any{"type": "object", "additionalProperties": false,
+				"required": []string{"node", "public_key", "sealing_key", "proof"},
+				"properties": map[string]any{
+					"node":        str("the node the token was issued for"),
+					"public_key":  str("the identity key's public half, base64"),
+					"overlay_key": str("the private network key's public half"),
+					"sealing_key": str("the sealing key's public half, which the account is sealed to"),
+					"serving_key": str("the serving key's public half, which the certificate binds"),
+					"profile":     map[string]any{"type": "object", "description": "what the machine is, as its record says it"},
+					"tunnel":      map[string]any{"type": "object", "description": "a tunnel found on the machine: everything but its private key"},
+					"proof":       str("the identity key's signature over the redeem's proof bytes (delivery.RedeemProof), base64"),
+				}}},
+		{Name: mcat.EnrolmentVerbConfirm, Description: "Confirm an enrolment: asked by the node-engine dialled as its own " +
+			"node login alone, the runtime's proof of that caller being the confirmation. Says node-enrolled and ends the " +
+			"enrolment.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: mcat.EnrolmentVerbRevoke, Description: "End an enrolment at any stage, with why, without an Approve: withdraws " +
+			"an open ask, deletes the node's key and its address, has the vault retire an account it already minted for " +
+			"it, records the act as a hand act and says enrolment-revoked.",
+			Input: schema(map[string]string{"node": "the node", "why": "why, recorded with the hand act"},
+				[]string{"node", "why"})},
+		{Name: mcat.EnrolmentVerbTokens, Description: "Read every open enrolment, or one: its stage, expiry, ask and revision, " +
+			"the bucket's fill against its cap. For a node at live, its " +
+			"token sealed to the operator key, asked of the vault at that moment and relayed as the vault sealed it. With " +
+			"history, the ended enrolments from the seat's events, as far back as the events are kept.",
+			Input: schema(map[string]string{"node": "one node", "history": "\"true\": the ended enrolments too"},
+				nil, "history")},
+		{Name: mcat.EnrolmentVerbAgain, Description: "Raise an issue's ask again when the operator's channel does not hold it, " +
+			"and nothing more.",
+			Input: schema(map[string]string{"node": "the node whose ask is raised again"}, []string{"node"})},
+	}
+}
diff --git a/internal/compose/resolution/environment_into.go b/internal/compose/resolution/environment_into.go
new file mode 100644
index 0000000..9904cef
--- /dev/null
+++ b/internal/compose/resolution/environment_into.go
@@ -0,0 +1,554 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+var knownShells = []string{"zsh", "bash", "fish"}
+
+var knownSlots = []string{"first", "normal", "last"}
+
+// sessionFiles are the two files of the graphical session's start that read no directory, so a
+// contribution to them is a slot rather than a drop-in (novox/hq ADR 0208 §4): `xinitrc` is POSIX
+// code the session's start runs, `xresources` X resources merged at its start. Placed by the
+// display server's holder, as a shell's slots are placed by the login shell's.
+var sessionFiles = []string{"xinitrc", "xresources"}
+
+// powerMoments are the moments of a machine's power a module may run code at (novox/hq ADR
+// 0211 §3): POSIX code run as root by node-power's holder, in module order, each piece bounded.
+var powerMoments = []string{"after-boot", "before-sleep", "after-wake", "before-shutdown", "on-mains", "on-battery"}
+
+// contributionTargets is every name a contribution's `for` may take.
+func contributionTargets() []string {
+	out := append(append([]string(nil), knownShells...), sessionFiles...)
+	return append(out, powerMoments...)
+}
+
+// placerOf is the seat whose holder places a contribution for this target (novox/hq ADR 0204,
+// ADR 0208 §4).
+func placerOf(target string) string {
+	if oneOf(sessionFiles, target) {
+		return mcat.DisplayServerSeat
+	}
+	if oneOf(powerMoments, target) {
+		return mcat.PowerSeat
+	}
+	return mcat.LoginShellSeat
+}
+
+var ofEnvironment = regexp.MustCompile(`\$\{environment:([^}]*)\}`)
+
+var ofShell = regexp.MustCompile(`\$\{shell:([^}]*)\}`)
+
+// ofContributed is either kind of contributed text, matched together so both fill in one pass.
+var ofContributed = regexp.MustCompile(`\$\{(shell|contribution|backup):([^}]*)\}`)
+
+// literalRule is why a value must be literal, said with every refusal of one.
+const literalRule = "a value is literal, so a POSIX shell and the service manager read it alike, and " +
+	"names the machine only through the mesh's own ${machine:…} facts (novox/hq ADR 0203)"
+
+// literalProblem is why a value cannot be written, unquoted by either reader, as the same string in
+// both formats — or nothing. A `$` would expand differently in each; a quote or a backslash is
+// quoting in one and a character in the other; a line break ends the line in both.
+func literalProblem(v string) string {
+	switch {
+	case strings.ContainsAny(v, `'"`):
+		return "holds a quote"
+	case strings.Contains(v, `\`):
+		return "holds a backslash"
+	case strings.ContainsAny(v, "\n\r"):
+		return "holds a line break"
+	case strings.ContainsRune(v, 0):
+		return "holds a NUL"
+	case strings.Contains(ofMachine.ReplaceAllString(v, ""), "$"):
+		return "holds a $ that is not one of the machine's ${machine:…} facts"
+	}
+	return ""
+}
+
+// placeholderProblems is what is wrong with one resource's ${environment:…} and ${shell:…}.
+//
+// **The seat authorises it, not the placeholder** (novox/hq ADR 0203 §5, ADR 0204 §3), as the seat
+// authorises the bus's user list: a module that does not hold the account's environment writing it
+// would be a second writer of a file there is one of, and a module that does not hold the login
+// shell writing every module's shell code would be a second shell.
+func placeholderProblems(m mcat.Manifest, r map[string]any) []string {
+	var problems []string
+	for _, field := range sortedKeys(r) {
+		s, ok := r[field].(string)
+		if !ok {
+			continue
+		}
+		env := ofEnvironment.FindAllStringSubmatch(s, -1)
+		code := ofShell.FindAllStringSubmatch(s, -1)
+		if len(env)+len(code) == 0 {
+			continue
+		}
+		if field != "content" {
+			// Placed only where a file's bytes are, which is where every one of them is meant to go:
+			// a path or an owner holding several lines of shell is nothing the host could act on.
+			problems = append(problems, fmt.Sprintf(
+				"%s's resource %v names %s in its %s; the environment and the shell's code are placed "+
+					"only in a file's content", m.Module, r["id"], placeholderOf(env, code), field))
+			continue
+		}
+		for _, e := range env {
+			if e[1] != mcat.EnvironmentPOSIX && e[1] != mcat.EnvironmentSystemd {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s; the environment is ${environment:%s} or ${environment:%s}",
+					m.Module, r["id"], e[0], mcat.EnvironmentPOSIX, mcat.EnvironmentSystemd))
+			}
+		}
+		if len(env) > 0 && !m.ClaimsSeat(mcat.EnvironmentSeat) {
+			problems = append(problems, fmt.Sprintf(
+				"%s's resource %v names %s and %s does not claim %s; the account's environment is "+
+					"written by that seat's holder alone (novox/hq ADR 0203)",
+				m.Module, r["id"], env[0][0], m.Module, mcat.EnvironmentSeat))
+		}
+		// Each placeholder judged by its own target: a shell's code is the login shell's holder's to
+		// place (ADR 0204), the session's files the display server's (ADR 0208 §4) — and a holder of
+		// one placing the other's would be a second writer of a file there is one of.
+		refusedFor := map[string]bool{}
+		for _, c := range code {
+			target, slot, two := strings.Cut(c[1], ":")
+			if !two || !oneOf(contributionTargets(), target) || !oneOf(knownSlots, slot) {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s; shell code is ${shell:<shell>:<slot>}, the shell one of "+
+						"%s, the session's file one of %s or the power moment one of %s, and the slot one of %s",
+					m.Module, r["id"], c[0], strings.Join(knownShells, ", "), strings.Join(sessionFiles, ", "),
+					strings.Join(powerMoments, ", "), strings.Join(knownSlots, ", ")))
+				continue
+			}
+			seat := placerOf(target)
+			if m.ClaimsSeat(seat) || refusedFor[seat] {
+				continue
+			}
+			refusedFor[seat] = true
+			if seat == mcat.PowerSeat {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s and %s does not claim %s; every module's code for a power "+
+						"moment is placed by the power seat's holder alone (novox/hq ADR 0211)",
+					m.Module, r["id"], c[0], m.Module, seat))
+				continue
+			}
+			if seat == mcat.DisplayServerSeat {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s and %s does not claim %s; every module's %s is placed by "+
+						"the display server's holder alone (novox/hq ADR 0208)",
+					m.Module, r["id"], c[0], m.Module, seat, target))
+				continue
+			}
+			problems = append(problems, fmt.Sprintf(
+				"%s's resource %v names %s and %s does not claim %s; every module's shell code is "+
+					"placed by the login shell's holder alone (novox/hq ADR 0204)",
+				m.Module, r["id"], c[0], m.Module, seat))
+		}
+	}
+	return problems
+}
+
+func placeholderOf(env, code [][]string) string {
+	if len(env) > 0 {
+		return env[0][0]
+	}
+	return code[0][0]
+}
+
+// contributedEnvironment is one node's environment, gathered and in the order it is written.
+type contributedEnvironment struct {
+	// variables is by module in name order, each module's sorted by name.
+	variables []setBy
+	// start and end are PATH's entries in their final order, each once.
+	start, end []placedOn
+}
+
+type setBy struct {
+	module string
+	names  []string
+	values map[string]string
+}
+
+type placedOn struct {
+	module, entry string
+}
+
+// inModuleOrder is the modules sorted by name — the order contributions are written in (novox/hq
+// ADR 0203, ADR 0204), so the same set composes byte for byte whatever order they were assigned in.
+func inModuleOrder(modules []mcat.Manifest) []mcat.Manifest {
+	out := append([]mcat.Manifest(nil), modules...)
+	sort.SliceStable(out, func(a, b int) bool { return out[a].Module < out[b].Module })
+	return out
+}
+
+// variablesSetOnce refuses a variable two modules on one node both set (novox/hq ADR 0203 §5),
+// naming both. Neither is chosen: whichever was written last would win in one reader and not
+// necessarily in the other, and the module that lost would not be told.
+func variablesSetOnce(modules []mcat.Manifest) error {
+	setter := map[string]string{}
+	for _, m := range inModuleOrder(modules) {
+		e := environmentOf(m)
+		if e == nil {
+			continue
+		}
+		for _, n := range sortedKeys(e.Variables) {
+			if first, taken := setter[n]; taken {
+				return fmt.Errorf(
+					"%s and %s both set %s on this machine; the account has one environment, so one "+
+						"of them must stop setting it (novox/hq ADR 0203)", first, m.Module, n)
+			}
+			setter[n] = m.Module
+		}
+	}
+	return nil
+}
+
+// environmentOn gathers every module's environment on a node, with the machine's facts in place.
+//
+// A PATH entry two modules both add is written once, where the first puts it: two toolchains
+// sharing ~/.local/bin is ordinary, and nothing about it is in conflict.
+func environmentOn(modules []mcat.Manifest, facts map[string]string) (contributedEnvironment, error) {
+	var env contributedEnvironment
+	if err := variablesSetOnce(modules); err != nil {
+		return env, err
+	}
+	placed := map[string]bool{}
+	for _, m := range inModuleOrder(modules) {
+		e := environmentOf(m)
+		if e == nil {
+			continue
+		}
+		if len(e.Variables) > 0 {
+			set := setBy{module: m.Module, values: map[string]string{}}
+			for _, n := range sortedKeys(e.Variables) {
+				v, err := factsIn(e.Variables[n], facts, m.Module, n)
+				if err != nil {
+					return env, err
+				}
+				set.names = append(set.names, n)
+				set.values[n] = v
+			}
+			env.variables = append(env.variables, set)
+		}
+		for _, p := range e.Path {
+			entry, err := factsIn(p.Entry, facts, m.Module, "a PATH entry")
+			if err != nil {
+				return env, err
+			}
+			if strings.Contains(entry, ":") {
+				return env, fmt.Errorf("%s puts %q on PATH on this machine, which holds a colon, PATH's own separator",
+					m.Module, entry)
+			}
+			if placed[entry] {
+				continue
+			}
+			placed[entry] = true
+			if p.At == mcat.PathAtEnd {
+				env.end = append(env.end, placedOn{m.Module, entry})
+			} else {
+				env.start = append(env.start, placedOn{m.Module, entry})
+			}
+		}
+	}
+	return env, nil
+}
+
+// environmentOf is a module's environment as the old form and the items of the environment collection say it: an
+// item's template is the variable's value or the PATH entry, and its attributes the kind, the name and where on PATH
+// (design 57 L3, issue 795). A moved contributor's items are rendered here into a collector not handed, as the
+// provisioner's client renders them into one that is. An item whose text the mesh does not hold is not here; it is
+// said as not placed (itemsLeftOutFor).
+func environmentOf(m mcat.Manifest) *mcat.Environment {
+	var out *mcat.Environment
+	if m.Environment != nil {
+		out = &mcat.Environment{Variables: map[string]string{}, Path: append([]mcat.PathEntry(nil), m.Environment.Path...)}
+		for k, v := range m.Environment.Variables {
+			out.Variables[k] = v
+		}
+	}
+	for _, it := range itemsInOrder(m.Items) {
+		if it.Collection != mcat.EnvironmentCollection || it.Content == "" {
+			continue
+		}
+		if out == nil {
+			out = &mcat.Environment{Variables: map[string]string{}}
+		}
+		value := strings.TrimSuffix(it.Content, "\n")
+		switch it.Attributes["kind"] {
+		case "variable":
+			out.Variables[it.Attributes["name"]] = value
+		case "path":
+			out.Path = append(out.Path, mcat.PathEntry{Entry: value, At: it.Attributes["at"]})
+		}
+	}
+	return out
+}
+
+// factsIn resolves a contributed value's ${machine:…} facts with this machine's — first, before
+// either format is written, so both say the same thing (novox/hq ADR 0203).
+func factsIn(v string, facts map[string]string, module, what string) (string, error) {
+	for _, key := range machineUsed(v) {
+		value, has := facts[key]
+		if !has {
+			return "", fmt.Errorf("%s sets %s to a value that says ${machine:%s}, and this machine says %s",
+				module, what, key, orNothing(namesOfFacts(facts)))
+		}
+		v = strings.ReplaceAll(v, fmt.Sprintf("${machine:%s}", key), value)
+	}
+	// Judged again once filled: a fact is the mesh's, and still has to be a literal both readers
+	// take alike.
+	if why := literalProblem(v); why != "" {
+		return "", fmt.Errorf("%s sets %s to %q on this machine, which %s — %s", module, what, v, why, literalRule)
+	}
+	return v, nil
+}
+
+// posix is the environment as lines a POSIX shell sources (novox/hq ADR 0203 §3): every variable
+// exported, every PATH entry added only when it is missing, so sourcing the file twice — a login
+// shell that starts another — changes nothing. POSIX sh only, because sh, bash and zsh all read it.
+//
+// The start entries are written last-first: each is put in front of PATH, so the last written ends
+// up first, and the result reads in module order, then the order each module declared.
+func (e contributedEnvironment) posix() string {
+	var b strings.Builder
+	for _, set := range e.variables {
+		fmt.Fprintf(&b, "# %s\n", set.module)
+		for _, n := range set.names {
+			fmt.Fprintf(&b, "export %s='%s'\n", n, set.values[n])
+		}
+	}
+	named := ""
+	for i := len(e.start) - 1; i >= 0; i-- {
+		p := e.start[i]
+		if p.module != named {
+			fmt.Fprintf(&b, "# %s\n", p.module)
+			named = p.module
+		}
+		fmt.Fprintf(&b, "case \":${PATH}:\" in *':%s:'*) ;; *) PATH='%s'\"${PATH:+:${PATH}}\" ;; esac\n",
+			p.entry, p.entry)
+	}
+	named = ""
+	for _, p := range e.end {
+		if p.module != named {
+			fmt.Fprintf(&b, "# %s\n", p.module)
+			named = p.module
+		}
+		fmt.Fprintf(&b, "case \":${PATH}:\" in *':%s:'*) ;; *) PATH=\"${PATH:+${PATH}:}\"'%s' ;; esac\n",
+			p.entry, p.entry)
+	}
+	if len(e.start)+len(e.end) > 0 {
+		b.WriteString("export PATH\n")
+	}
+	return b.String()
+}
+
+// systemd is the same environment as the service manager's environment.d reads it (novox/hq ADR
+// 0203 §3), for the account's user manager and so for everything a graphical session starts. Read
+// once per manager start, so it needs no guard against running twice; the account's existing PATH
+// sits between the start and the end entries.
+func (e contributedEnvironment) systemd() string {
+	var b strings.Builder
+	for _, set := range e.variables {
+		fmt.Fprintf(&b, "# %s\n", set.module)
+		for _, n := range set.names {
+			fmt.Fprintf(&b, "%s=%s\n", n, set.values[n])
+		}
+	}
+	if len(e.start) > 0 {
+		fmt.Fprintf(&b, "# %s\nPATH=%s${PATH:+:$PATH}\n", modulesOf(e.start), entriesOf(e.start))
+	}
+	if len(e.end) > 0 {
+		fmt.Fprintf(&b, "# %s\nPATH=${PATH:+$PATH:}%s\n", modulesOf(e.end), entriesOf(e.end))
+	}
+	return b.String()
+}
+
+// modulesOf names who contributed a line holding several modules' entries, in the order they appear.
+func modulesOf(entries []placedOn) string {
+	var names []string
+	seen := map[string]bool{}
+	for _, p := range entries {
+		if !seen[p.module] {
+			seen[p.module] = true
+			names = append(names, p.module)
+		}
+	}
+	return strings.Join(names, ", ")
+}
+
+func entriesOf(entries []placedOn) string {
+	out := make([]string, len(entries))
+	for i, p := range entries {
+		out[i] = p.entry
+	}
+	return strings.Join(out, ":")
+}
+
+// oldFormOfCollected is a file's text with each `${collected:contribution:<seat>:<kind>:…}` of a kind received as data
+// read as the old `${contribution:<seat>:<kind>:…}`: where the collector is not handed, the controller renders the
+// kind's items as it rendered its contributions, so the two forms place the same text (design 57 L3, issue 781).
+func oldFormOfCollected(content string) string {
+	return ofCollected.ReplaceAllStringFunc(content, func(placeholder string) string {
+		name := ofCollected.FindStringSubmatch(placeholder)[1]
+		base, _ := splitSelector(name)
+		if format, is := strings.CutPrefix(base, mcat.EnvironmentCollection+":"); is {
+			return "${environment:" + format + "}"
+		}
+		if !strings.HasPrefix(base, "contribution:") {
+			return placeholder
+		}
+		seat, kind, _ := strings.Cut(strings.TrimPrefix(base, "contribution:"), ":")
+		if _, r, ok := receivable(seat, kind); !ok || !collectableAsText(r) {
+			return placeholder
+		}
+		return "${" + name + "}"
+	})
+}
+
+// shellCodeFor is shellCodeOn on a machine with these capabilities, which an item's `if-capability` is judged by. The
+// pieces are placed by order (an item's `order` attribute, the default for the old form), then module, as the
+// provisioner's client places them.
+func shellCodeFor(modules []mcat.Manifest, shell, slot string, facts map[string]string, caps map[string]bool) string {
+	var blocks []textBlock
+	for _, m := range inModuleOrder(modules) {
+		var old strings.Builder
+		for _, c := range m.Shell {
+			if c.For != shell || c.Slot != slot {
+				continue
+			}
+			if old.Len() == 0 {
+				fmt.Fprintf(&old, "# %s\n", m.Module)
+			}
+			old.WriteString(c.Code)
+			if !strings.HasSuffix(c.Code, "\n") {
+				old.WriteString("\n")
+			}
+		}
+		blocks = append(blocks, moduleBlocks(m, "#", old.String(), heldItems(m, "shell:"+shell+":"+slot, nil, facts, caps))...)
+	}
+	return joinBlocks(blocks)
+}
+
+// textBlock is a stretch of a collector's text and the order it is placed by.
+type textBlock struct {
+	order int
+	text  string
+}
+
+// moduleBlocks is one module's pieces of a placeholder: what its old form made (placed by the default order), and
+// each of its held items under a line naming the module, as the provisioner's client writes one per item. An item
+// of the default order that follows the old form's text shares its line, as a module's item always did.
+func moduleBlocks(m mcat.Manifest, comment, old string, items []heldItem) []textBlock {
+	var blocks []textBlock
+	if old != "" {
+		blocks = append(blocks, textBlock{mcat.OrderDefault, old})
+	}
+	for i, h := range items {
+		text := h.text
+		if i == 0 && old != "" && itemOrder(h.item) == mcat.OrderDefault {
+			blocks[0].text += text
+			continue
+		}
+		blocks = append(blocks, textBlock{itemOrder(h.item), fmt.Sprintf("%s %s\n", comment, m.Module) + text})
+	}
+	return blocks
+}
+
+// joinBlocks is the blocks by order, those of one order in the order given (module order).
+func joinBlocks(blocks []textBlock) string {
+	sort.SliceStable(blocks, func(a, b int) bool { return blocks[a].order < blocks[b].order })
+	var b strings.Builder
+	for _, blk := range blocks {
+		b.WriteString(blk.text)
+	}
+	return b.String()
+}
+
+// contributionsInto fills a holder's file with the node's environment and its shell code.
+//
+// **Last, after every other placeholder pass, and in one pass each.** Shell code is contributed text
+// in a shell's own syntax — `${XDG_CACHE_HOME:-$HOME/.cache}`, `${(%):-%n}` — and the rendered
+// environment holds `${PATH:+…}`: a scanner for the mesh's own placeholders that ran after these
+// were in place would read the shell's expansions as the mesh's and refuse them, or fill a
+// `${machine:…}` some module wrote for its shell to see. So nothing runs after them, the environment
+// is filled before the shell's code is, and each is replaced in a single pass over what the holder
+// wrote, so a contributed piece is never scanned again.
+func contributionsInto(resource map[string]any, m mcat.Manifest, modules []mcat.Manifest, facts map[string]string, with mcat.Rendering, caps map[string]bool, unplaced *[]string) error {
+	problems := append(placeholderProblems(m, resource), seatPlaceholderProblems(m, resource)...)
+	if problems = append(problems, collectedPlaceholderProblems(m, resource)...); len(problems) > 0 {
+		return fmt.Errorf("%s", problems[0])
+	}
+	judged, err := consumersNotHanded(m, resource, with)
+	if err != nil {
+		return err
+	}
+	if judged {
+		resource["content"] = ofConsumers.ReplaceAllString(fmt.Sprint(resource["content"]), "")
+	}
+	content, ok := resource["content"].(string)
+	if !ok {
+		return nil
+	}
+	content = oldFormOfCollected(content)
+	// **An item is the provisioner client's** (design 57 L1): a collector filled here, the old way, holds the old
+	// forms alone, and each item of its collections is said as not placed. A collection of the new form is empty.
+	if unplaced != nil {
+		for _, f := range templatePlaceholder.FindAllStringSubmatch(content, -1) {
+			if collection, is := collectionOfPlaceholder(f[1], f[2]); is {
+				_, selector := splitSelector(f[2])
+				where, _ := selectorOf(selector)
+				*unplaced = append(*unplaced, itemsLeftOutFor(modules, m, collection, where, facts, caps)...)
+			}
+		}
+	}
+	content = ofCollected.ReplaceAllString(content, "")
+	if ofEnvironment.MatchString(content) {
+		env, err := environmentOn(modules, facts)
+		if err != nil {
+			return err
+		}
+		content = ofEnvironment.ReplaceAllStringFunc(content, func(placeholder string) string {
+			if ofEnvironment.FindStringSubmatch(placeholder)[1] == mcat.EnvironmentSystemd {
+				return env.systemd()
+			}
+			return env.posix()
+		})
+	}
+	// Shell code and seat contributions in one pass (novox/hq ADR 0212): both are contributed text
+	// the controller does not read, so neither may be scanned after the other is in place — a
+	// contributed line that happened to spell the other's placeholder would be filled.
+	if ofContributed.MatchString(content) {
+		var failed error
+		content = ofContributed.ReplaceAllStringFunc(content, func(placeholder string) string {
+			found := ofContributed.FindStringSubmatch(placeholder)
+			first, second, _ := strings.Cut(found[2], ":")
+			if found[1] == mcat.BackupNamespace {
+				placed, problem := backupPlacer{modules, with, facts, caps, unplaced}.placed(m, found[2], false)
+				if problem != "" && failed == nil {
+					failed = fmt.Errorf("%s names %s: %s", m.Module, placeholder, problem)
+				}
+				return placed
+			}
+			if found[1] == "contribution" {
+				placed, left, err := seatContributions(modules, m, found[2], with, facts, caps)
+				if err != nil && failed == nil {
+					failed = err
+				}
+				if unplaced != nil {
+					*unplaced = append(*unplaced, left...)
+				}
+				return placed
+			}
+			return shellCodeFor(modules, first, second, facts, caps)
+		})
+		if failed != nil {
+			return failed
+		}
+	}
+	resource["content"] = content
+	return nil
+}
diff --git a/internal/compose/resolution/environment_into_integration_test.go b/internal/compose/resolution/environment_into_integration_test.go
new file mode 100644
index 0000000..d63fa7e
--- /dev/null
+++ b/internal/compose/resolution/environment_into_integration_test.go
@@ -0,0 +1,91 @@
+//go:build integration
+
+package resolution
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestThePOSIXEnvironmentSourcedTwiceLeavesPATHAsOnce(t *testing.T) {
+	sh, err := exec.LookPath("sh")
+	if err != nil {
+		t.Skip("no sh on this machine")
+	}
+	script := "PATH=/usr/bin:/bin\n" + composedPOSIX + "once=$PATH\n" + composedPOSIX +
+		`[ "$PATH" = "$once" ] || { echo "changed: $once -> $PATH"; exit 1; }` + "\n" +
+		`echo "$PATH"; echo "$GOPATH"`
+	out, err := exec.Command(sh, "-c", script).CombinedOutput()
+	if err != nil {
+		t.Fatalf("sourcing twice: %v\n%s", err, out)
+	}
+	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+	want := "/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts"
+	if lines[0] != want {
+		t.Fatalf("PATH is %s, not %s", lines[0], want)
+	}
+	if lines[1] != "/home/op/go" {
+		t.Fatalf("GOPATH was not exported: %q", lines[1])
+	}
+	// And an entry the account already has stays where it is, and once.
+	out, err = exec.Command(sh, "-c", "PATH=/opt/scripts:/usr/bin\n"+composedPOSIX+`echo "$PATH"`).CombinedOutput()
+	if err != nil {
+		t.Fatalf("%v\n%s", err, out)
+	}
+	if got := strings.TrimSpace(string(out)); got !=
+		"/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/opt/scripts:/usr/bin:/opt/agent/bin" {
+		t.Fatalf("an entry already on PATH was added again or moved: %s", got)
+	}
+}
+
+func TestTheServiceManagerReadsTheSystemdRenderingAsMeant(t *testing.T) {
+	generator := "/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator"
+	if _, err := os.Stat(generator); err != nil {
+		t.Skip("NOT JUDGED: no environment.d generator on this machine, so the service manager's reading " +
+			"of the rendering is judged only where systemd runs; the rendering itself is held byte for byte " +
+			"by TestTheEnvironmentRendersForTheServiceManagerByteForByte")
+	}
+	const base = "/usr/bin:/bin"
+	read := func(conf string) map[string]string {
+		t.Helper()
+		config := t.TempDir()
+		if err := os.MkdirAll(filepath.Join(config, "environment.d"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if conf != "" {
+			if err := os.WriteFile(filepath.Join(config, "environment.d", "50-mesh.conf"), []byte(conf), 0o644); err != nil {
+				t.Fatal(err)
+			}
+		}
+		cmd := exec.Command(generator)
+		cmd.Env = []string{"PATH=" + base, "HOME=" + config, "XDG_CONFIG_HOME=" + config}
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			t.Fatalf("%v\n%s", err, out)
+		}
+		vars := map[string]string{}
+		for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+			if k, v, ok := strings.Cut(line, "="); ok {
+				vars[k] = v
+			}
+		}
+		return vars
+	}
+	machine, read50 := read(""), read(composedSystemd)
+
+	// What the machine's own files do to PATH: nothing, or append to it. One that replaces or prepends
+	// leaves nothing this test can say about the mesh's file, and says so rather than guess.
+	added, ok := strings.CutPrefix(machine["PATH"], base)
+	if machine["PATH"] != "" && !ok {
+		t.Skipf("NOT JUDGED: this machine's own environment.d sets PATH to %s, not %s with something after it, so "+
+			"what the mesh's file adds cannot be told apart from it", machine["PATH"], base)
+	}
+	want := "/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin:/usr/bin:/bin:/opt/agent/bin:/opt/scripts" + added
+	if read50["PATH"] != want || read50["GOPATH"] != "/home/op/go" {
+		t.Fatalf("the service manager read PATH=%s GOPATH=%s, not PATH=%s GOPATH=/home/op/go (the machine's own "+
+			"files add %q to PATH)", read50["PATH"], read50["GOPATH"], want, added)
+	}
+}
diff --git a/internal/compose/resolution/environment_into_test.go b/internal/compose/resolution/environment_into_test.go
new file mode 100644
index 0000000..f4ef2bc
--- /dev/null
+++ b/internal/compose/resolution/environment_into_test.go
@@ -0,0 +1,238 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// contributors is a fixed set of contributions, in no particular order: what the renderings are
+// asserted against byte for byte. go-toolchain and zsh both put ~/.local/bin on PATH, which is the
+// ordinary case of two modules sharing a directory, and is written once.
+func contributors() []mcat.Manifest {
+	return []mcat.Manifest{
+		{Module: "zsh", Environment: &mcat.Environment{
+			Variables: map[string]string{"XDG_CONFIG_HOME": "${machine:account-home}/.config", "EDITOR": "vim"},
+			Path: []mcat.PathEntry{
+				{Entry: "${machine:account-home}/.local/bin", At: mcat.PathAtStart},
+				{Entry: "${machine:account-home}/bin", At: mcat.PathAtStart},
+				{Entry: "/opt/scripts", At: mcat.PathAtEnd},
+			},
+		}},
+		{Module: "go-toolchain", Environment: &mcat.Environment{
+			Variables: map[string]string{"GOPATH": "${machine:account-home}/go"},
+			Path: []mcat.PathEntry{
+				{Entry: "${machine:account-home}/go/bin", At: mcat.PathAtStart},
+				{Entry: "/usr/local/go/bin", At: mcat.PathAtStart},
+				{Entry: "${machine:account-home}/.local/bin", At: mcat.PathAtStart},
+			},
+		}},
+		{Module: "agent", Environment: &mcat.Environment{
+			Variables: map[string]string{"DISABLE_AUTOUPDATER": "1"},
+			Path:      []mcat.PathEntry{{Entry: "/opt/agent/bin", At: mcat.PathAtEnd}},
+		}},
+		// A module contributing nothing is in the set and writes nothing.
+		{Module: "postgres"},
+	}
+}
+
+var operatorFacts = map[string]string{"name": "workstation", "account": "op", "account-home": "/home/op"}
+
+// The final PATH this set composes, around whatever the account had: the start entries in module
+// order and then declared order, the account's own, then the end entries.
+const composedPOSIX = `# agent
+export DISABLE_AUTOUPDATER='1'
+# go-toolchain
+export GOPATH='/home/op/go'
+# zsh
+export EDITOR='vim'
+export XDG_CONFIG_HOME='/home/op/.config'
+# zsh
+case ":${PATH}:" in *':/home/op/bin:'*) ;; *) PATH='/home/op/bin'"${PATH:+:${PATH}}" ;; esac
+# go-toolchain
+case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/usr/local/go/bin:'*) ;; *) PATH='/usr/local/go/bin'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/home/op/go/bin:'*) ;; *) PATH='/home/op/go/bin'"${PATH:+:${PATH}}" ;; esac
+# agent
+case ":${PATH}:" in *':/opt/agent/bin:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/agent/bin' ;; esac
+# zsh
+case ":${PATH}:" in *':/opt/scripts:'*) ;; *) PATH="${PATH:+${PATH}:}"'/opt/scripts' ;; esac
+export PATH
+`
+
+const composedSystemd = `# agent
+DISABLE_AUTOUPDATER=1
+# go-toolchain
+GOPATH=/home/op/go
+# zsh
+EDITOR=vim
+XDG_CONFIG_HOME=/home/op/.config
+# go-toolchain, zsh
+PATH=/home/op/go/bin:/usr/local/go/bin:/home/op/.local/bin:/home/op/bin${PATH:+:$PATH}
+# agent, zsh
+PATH=${PATH:+$PATH:}/opt/agent/bin:/opt/scripts
+`
+
+func TestTheEnvironmentRendersForAPOSIXShellByteForByte(t *testing.T) {
+	env, err := environmentOn(contributors(), operatorFacts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := env.posix(); got != composedPOSIX {
+		t.Fatalf("the POSIX rendering is\n%s\nnot\n%s", got, composedPOSIX)
+	}
+}
+
+func TestTheEnvironmentRendersForTheServiceManagerByteForByte(t *testing.T) {
+	env, err := environmentOn(contributors(), operatorFacts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := env.systemd(); got != composedSystemd {
+		t.Fatalf("the environment.d rendering is\n%s\nnot\n%s", got, composedSystemd)
+	}
+}
+
+// Nothing contributed renders nothing, in both formats — not an empty `export PATH`.
+func TestNoContributionsRenderNothing(t *testing.T) {
+	env, err := environmentOn([]mcat.Manifest{{Module: "postgres"}}, operatorFacts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if env.posix() != "" || env.systemd() != "" {
+		t.Fatalf("an empty environment rendered %q and %q", env.posix(), env.systemd())
+	}
+}
+
+// A ${machine:…} fact the machine does not have is refused naming the module, as a file's is.
+func TestAContributedFactTheMachineLacksIsRefused(t *testing.T) {
+	_, err := environmentOn(contributors(), map[string]string{"name": "server"})
+	if err == nil || !strings.Contains(err.Error(), "go-toolchain sets GOPATH") ||
+		!strings.Contains(err.Error(), "${machine:account-home}") {
+		t.Fatalf("a missing account home was not refused by name: %v", err)
+	}
+}
+
+// ADR 0203 §5: two modules setting one variable are refused, both named — neither silently wins.
+func TestAVariableTwoModulesSetIsRefusedNamingBoth(t *testing.T) {
+	modules := append(contributors(), mcat.Manifest{Module: "neovim", Environment: &mcat.Environment{
+		Variables: map[string]string{"EDITOR": "nvim"}}})
+	_, err := environmentOn(modules, operatorFacts)
+	if err == nil || err.Error() != "neovim and zsh both set EDITOR on this machine; the account has one "+
+		"environment, so one of them must stop setting it (novox/hq ADR 0203)" {
+		t.Fatalf("a variable set twice was not refused naming both: %v", err)
+	}
+	// And at composition, whether or not the node holds the environment.
+	r := mcat.Resolution{Node: "workstation", Account: "op", Modules: modules}
+	if _, err := Declaration(r, mcat.Rendering{}); err == nil || !strings.Contains(err.Error(), "neovim and zsh both set EDITOR") {
+		t.Fatalf("composition accepted a variable set twice: %v", err)
+	}
+}
+
+// shells contributes code for several shells and slots, in no order.
+func shells() []mcat.Manifest {
+	return []mcat.Manifest{
+		{Module: "zsh-syntax-highlighting", Shell: []mcat.ShellCode{
+			{For: "zsh", Slot: "last", Code: "source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"},
+		}},
+		{Module: "powerlevel10k", Shell: []mcat.ShellCode{
+			{For: "zsh", Slot: "first", Code: "if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
+				"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n"},
+			{For: "zsh", Slot: "normal", Code: "source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme"},
+			{For: "zsh", Slot: "normal", Code: "[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh"},
+		}},
+		{Module: "zsh-autosuggestions", Shell: []mcat.ShellCode{
+			{For: "zsh", Slot: "normal", Code: "source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh"},
+			{For: "bash", Slot: "normal", Code: "echo not for zsh"},
+		}},
+		{Module: "direnv", Shell: []mcat.ShellCode{
+			{For: "fish", Slot: "last", Code: "direnv hook fish | source"},
+			{For: "bash", Slot: "last", Code: "eval \"$(direnv hook bash)\""},
+		}},
+	}
+}
+
+// The holder of node-login-shell, as WP3's zsh module writes its block, with its own zsh around the
+// slots — which holds `${…}` of the shell's own that no mesh pass may touch either.
+func zshHolder() mcat.Manifest {
+	return mcat.Manifest{Module: "zsh", Claims: []mcat.Claim{{Name: mcat.LoginShellSeat, Scope: mcat.ScopeNode}},
+		Resources: []map[string]any{
+			{"id": "zshrc", "type": "file", "path": "${machine:account-home}/.zshrc", "content": "" +
+				"${shell:zsh:first}" +
+				"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
+				"${shell:zsh:normal}" +
+				"alias ll='ls -l'\n" +
+				"${shell:zsh:last}"},
+		}}
+}
+
+// The case the ordering exists for: contributed zsh code full of `${…}` reaches the file byte for
+// byte, because the shell's code is placed after every other placeholder pass and in one pass — a
+// scanner for the mesh's placeholders that ran after it would read `${XDG_CACHE_HOME:-…}` and
+// `${(%):-%n}` as the mesh's, or fill a `${machine:…}` some module wrote for its shell to see.
+func TestShellCodeReachesTheHoldersFileByteForByte(t *testing.T) {
+	modules := append(shells(), zshHolder(), mcat.Manifest{Module: "sly", Shell: []mcat.ShellCode{
+		{For: "zsh", Slot: "last", Code: "echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}"},
+	}})
+	r := mcat.Resolution{Node: "workstation", Account: "op", Modules: modules}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var zshrc map[string]any
+	for _, res := range out {
+		if res["id"] == "zsh.zshrc" {
+			zshrc = res
+		}
+	}
+	if zshrc == nil {
+		t.Fatalf("the holder's file was not composed: %v", out)
+	}
+	if zshrc["path"] != "/home/op/.zshrc" {
+		t.Fatalf("the holder's own placeholders were not filled first: %v", zshrc["path"])
+	}
+	want := "# powerlevel10k\n" +
+		"if [[ -r \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\" ]]; then\n" +
+		"  source \"${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh\"\nfi\n" +
+		"PROMPT='%n@%m ${PWD/#$HOME/~} '\n" +
+		"# powerlevel10k\n" +
+		"source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme\n" +
+		"[[ -f ~/.local/share/powerlevel10k/p10k.zsh ]] && source ~/.local/share/powerlevel10k/p10k.zsh\n" +
+		"# zsh-autosuggestions\n" +
+		"source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh\n" +
+		"alias ll='ls -l'\n" +
+		"# sly\n" +
+		"echo ${machine:account-home} ${secret:x} ${shell:zsh:first} ${environment:posix}\n" +
+		"# zsh-syntax-highlighting\n" +
+		"source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh\n"
+	if got := zshrc["content"]; got != want {
+		t.Fatalf("the holder's .zshrc is\n%s\nnot\n%s", got, want)
+	}
+}
+
+// The holder of node-environment places both renderings, and they are the same as rendered alone.
+func TestTheEnvironmentHolderPlacesBothRenderings(t *testing.T) {
+	holder := mcat.Manifest{Module: "node-env", Claims: []mcat.Claim{{Name: mcat.EnvironmentSeat, Scope: mcat.ScopeNode}},
+		Resources: []map[string]any{
+			{"id": "posix", "type": "file", "path": "${machine:account-home}/.config/mesh/environment.sh",
+				"content": "# The mesh's environment.\n${environment:posix}"},
+			{"id": "systemd", "type": "file", "path": "${machine:account-home}/.config/environment.d/50-mesh.conf",
+				"content": "${environment:systemd}"},
+		}}
+	r := mcat.Resolution{Node: "workstation", Account: "op", Modules: append(contributors(), holder)}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	by := map[string]any{}
+	for _, res := range out {
+		by[res["id"].(string)] = res["content"]
+	}
+	if by["node-env.posix"] != "# The mesh's environment.\n"+composedPOSIX {
+		t.Fatalf("the POSIX file is\n%v", by["node-env.posix"])
+	}
+	if by["node-env.systemd"] != composedSystemd {
+		t.Fatalf("the environment.d file is\n%v", by["node-env.systemd"])
+	}
+}
diff --git a/internal/compose/resolution/environment_items_test.go b/internal/compose/resolution/environment_items_test.go
new file mode 100644
index 0000000..fa45167
--- /dev/null
+++ b/internal/compose/resolution/environment_items_test.go
@@ -0,0 +1,19 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTwoModulesSettingOneVariableAreRefused(t *testing.T) {
+	// A module that sets a variable twice, in two modules, is refused as the old form refused it.
+	a := mcat.Manifest{Module: "a", Items: []mcat.Item{{Collection: "environment", Content: "1\n",
+		Attributes: map[string]string{"kind": "variable", "name": "X"}}}}
+	b := mcat.Manifest{Module: "b", Items: []mcat.Item{{Collection: "environment", Content: "2\n",
+		Attributes: map[string]string{"kind": "variable", "name": "X"}}}}
+	if err := variablesSetOnce([]mcat.Manifest{a, b}); err == nil || !strings.Contains(err.Error(), "both set X") {
+		t.Errorf("two modules setting X: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/files.go b/internal/compose/resolution/files.go
new file mode 100644
index 0000000..3b20ba9
--- /dev/null
+++ b/internal/compose/resolution/files.go
@@ -0,0 +1,152 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const filesAsAccount = "as the node's operator account, through sudo -n where its rights do not reach; a place a " +
+	"secret is kept, or a known credential file, is refused by name"
+
+const overrideWord = "a reason, to change a path a module owns anyway (optional)"
+
+// filesVerbs is the contract every holder of node-files serves (novox/hq ADR 0394 §1): the reads of node-reads,
+// with their descriptions restated for the operator's account, and the writes.
+func filesVerbs() []mcat.Verb {
+	var verbs []mcat.Verb
+	for _, v := range readsVerbs() {
+		v.Description = strings.Replace(v.Description,
+			"Read as the holder's own account, which holds no secret: a component it may not reach says so.",
+			"", 1)
+		v.Description = strings.TrimSpace(v.Description) + " Read " + filesAsAccount + "."
+		verbs = append(verbs, v)
+	}
+	write := func(name, description string, in map[string]string, required []string, optional []string, replaces ...string) mcat.Verb {
+		in["reason"] = "why the file is changed, for the audit trail"
+		in["override"] = overrideWord
+		return mcat.Verb{Name: name, Description: description + " Refuses a path a module owns " +
+			"unless override names a reason; done as the node's operator account, through sudo -n where its rights do not reach.",
+			Input: schema(in, append(required, "reason"), append(optional, "override")...), Replaces: replaces}
+	}
+	return append(verbs,
+		write("write", "Write one text file whole, replacing what it holds; the old content goes to the node's trash.",
+			map[string]string{"path": "an absolute path", "content": "the text to write",
+				"mode": "the file's mode, such as 0644 (optional)"},
+			[]string{"path", "content"}, []string{"mode"}, "tee", ">"),
+		write("copy", "Copy a file or directory to a path on this node. A target on another node (<node>:/path) is "+
+			"refused: copying between nodes comes in step 2 (issue 903). An existing target is overwritten, the old one "+
+			"kept in the node's trash for 7 days.",
+			map[string]string{"from": "an absolute path", "to": "an absolute path on this node"},
+			[]string{"from", "to"}, nil, "cp", "cp -a", "ssh <node> cp"),
+		write("move", "Move or rename a file or directory. A target on another node is refused: copying between nodes "+
+			"comes in step 2 (issue 903). An existing target is overwritten, the old one kept in the node's trash for 7 days.",
+			map[string]string{"from": "an absolute path", "to": "an absolute path"},
+			[]string{"from", "to"}, nil, "mv"),
+		write("delete", "Delete a file or directory into the node's trash, where restore can bring it back.",
+			map[string]string{"path": "an absolute path", "recursive": "\"true\": delete a directory with what it holds"},
+			[]string{"path"}, []string{"recursive"}, "rm", "rm -r"),
+		write("mkdir", "Make a directory.",
+			map[string]string{"path": "an absolute path", "parents": "\"true\": make the missing parents too"},
+			[]string{"path"}, []string{"parents"}, "mkdir", "mkdir -p"),
+		write("chmod", "Change the mode of a file or directory.",
+			map[string]string{"path": "an absolute path", "mode": "the mode, such as 0644 or u+x",
+				"recursive": "\"true\": also everything under a directory"},
+			[]string{"path", "mode"}, []string{"recursive"}, "chmod"),
+		write("chown", "Change the owner and group of a file or directory.",
+			map[string]string{"path": "an absolute path", "owner": "an account's name or number",
+				"group": "a group's name or number (optional)", "recursive": "\"true\": also everything under a directory"},
+			[]string{"path", "owner"}, []string{"group", "recursive"}, "chown", "chgrp"), mcat.Verb{Name: "upload", Description: "Send one file of this node into a bucket of the object store, over a short signed link " +
+			"and never over the bus; answers the key (the file's SHA-256 when none is given), the size and the SHA-256. " +
+			"At most 100 MiB. A place a secret is kept, a known credential file, or a link to one is refused by name, " +
+			"before anything is sent. Read " + filesAsAccount + ".",
+			Input: schema(map[string]string{"path": "an absolute path to a file", "bucket": "the bucket the file goes into",
+				"key": "the object's key (optional; the file's SHA-256 when not given)"}, []string{"path", "bucket"})}, mcat.
+			// download is a plain Verb, not through write(): write() types its optional arguments as true/false
+			// switches, which a hash and a reason are not (issue 1719).
+			Verb{Name: "download", Description: "Write one object of a bucket to a file of this node, over a short signed link and " +
+			"never over the bus; the old file goes to the node's trash. At most 100 MiB. The bytes must hash to sha256, or to " +
+			"the key when the key is a SHA-256; otherwise no file is written. Refuses a path a module owns " +
+			"unless override names a reason; done as the node's operator account, through sudo -n where its rights do not reach.",
+			Input: schema(map[string]string{"bucket": "the bucket", "key": "the object's key", "path": "an absolute path",
+				"sha256":   "the SHA-256 the bytes must have (optional; the key when that is a SHA-256)",
+				"reason":   "why the file is changed, for the audit trail",
+				"override": overrideWord}, []string{"bucket", "key", "path", "reason"})}, mcat.Verb{Name: "trash", Description: "What the node's trash holds: each deleted or replaced item with its id, " +
+			"original path and when it went.",
+			Input: schema(map[string]string{}, nil), Replaces: []string{"ls ~/.local/share/Trash"}}, write("restore", "Put an item of the node's trash back where it was; refuses when something is there now.",
+			map[string]string{"id": "an id from trash"}, []string{"id"}, nil, "trash-restore"),
+	)
+}
+
+// ownedPaths is every path a module owns on this node, as the holder is told (novox/hq ADR 0394 §5): the
+// paths every seat declares (ADR 0287) with the module holding the seat here, and the paths and files each
+// module's manifest places (declaredPaths). A seat's path wins where both name one.
+func resolutionOwnedPaths(r mcat.Resolution) map[string]string {
+	owned := map[string]string{}
+	for _, m := range r.Modules {
+		for _, p := range sortedKeys(declaredPaths(m)) {
+			owned[p] = m.Module + " (its own tools)"
+		}
+	}
+	for _, s := range mcat.Seats() {
+		for _, sp := range s.Paths {
+			for _, m := range r.Modules {
+				if m.ClaimsSeat(s.Name) && declaresPath(m, path.Clean(sp.Path)) && !resolutionStepsBackHere(r, m, sp) {
+					owned[sp.Path] = m.Module + " (" + s.Name + ")"
+				}
+			}
+		}
+	}
+	return owned
+}
+
+// stepsBackHere says m's seat path steps back on this machine (novox/hq ADR 0287): it names a seat whose holder here
+// declares the path too, so that holder owns it, as stepsBack leaves m's own rendering of it out. Without it the owner
+// told was the last seat in the order of the seat table, which the controller reads sorted by name and a node in the
+// order compiled (issue 1126, C3: /etc/resolv.conf, node-uplink against node-resolver).
+func resolutionStepsBackHere(r mcat.Resolution, m mcat.Manifest, sp mcat.SeatPath) bool {
+	if sp.StepsBackFor == "" {
+		return false
+	}
+	for _, o := range r.Modules {
+		if o.Module != m.Module && holdsSeat(o, sp.StepsBackFor) && declaresPath(o, path.Clean(sp.Path)) {
+			return true
+		}
+	}
+	return false
+}
+
+// filesWords is what the holder of node-files is given beside its own words: the node's secret places and the
+// paths modules own here.
+func resolutionFilesWords(r mcat.Resolution, m mcat.Manifest, words map[string]string, with mcat.Rendering) (map[string]string, error) {
+	if !m.ClaimsSeat(mcat.FilesSeat) {
+		return words, nil
+	}
+	places, err := resolutionSecretPlaces(r, with)
+	if err != nil {
+		return nil, err
+	}
+	places2, err := json.Marshal(places)
+	if err != nil {
+		return nil, err
+	}
+	owned, err := json.Marshal(resolutionOwnedPaths(r))
+	if err != nil {
+		return nil, err
+	}
+	if words == nil {
+		words = map[string]string{}
+	}
+	for _, w := range []string{mcat.ReadsSecretPlaces, mcat.FilesOwnedPaths} {
+		if _, has := words[w]; has {
+			return nil, fmt.Errorf("%s gives its own %s; the node's secret places and owned paths are the mesh's to "+
+				"say (novox/hq ADR 0394 §5)", m.Module, w)
+		}
+	}
+	words[mcat.ReadsSecretPlaces] = string(places2)
+	words[mcat.FilesOwnedPaths] = string(owned)
+	return words, nil
+}
diff --git a/internal/compose/resolution/files_test.go b/internal/compose/resolution/files_test.go
new file mode 100644
index 0000000..4d8ed14
--- /dev/null
+++ b/internal/compose/resolution/files_test.go
@@ -0,0 +1,75 @@
+package resolution
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// issue 900, ADR 0394 §4: the holder is told the secret places and the paths modules own on its node.
+func TestTheHolderOfNodeFilesIsToldSecretPlacesAndOwnedPaths(t *testing.T) {
+	files := mcat.Manifest{Module: "files", Version: "1", Claims: []mcat.Claim{{Name: mcat.FilesSeat}},
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/files/broker"}}}
+	host := mcat.Manifest{Module: "hostnames", Version: "1", Claims: []mcat.Claim{{Name: "node-hostname"}},
+		Resources: []map[string]any{{"id": "hosts", "type": "file", "path": "/etc/hosts"}}}
+	app := mcat.Manifest{Module: "app", Version: "1",
+		Resources: []map[string]any{{"id": "conf", "type": "file", "path": "/etc/app/app.conf"}}}
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{files, host, app}}
+	words, err := resolutionFilesWords(r, files, nil, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var places []string
+	if err := json.Unmarshal([]byte(words[mcat.ReadsSecretPlaces]), &places); err != nil || len(places) == 0 {
+		t.Errorf("no secret places: %v %v", err, words)
+	}
+	var owned map[string]string
+	if err := json.Unmarshal([]byte(words[mcat.FilesOwnedPaths]), &owned); err != nil {
+		t.Fatalf("no owned paths: %v (%v)", err, words)
+	}
+	if !strings.HasPrefix(owned["/etc/hosts"], "hostnames") {
+		t.Errorf("/etc/hosts is owned by %q, want hostnames", owned["/etc/hosts"])
+	}
+	if !strings.HasPrefix(owned["/etc/app/app.conf"], "app") {
+		t.Errorf("a placed file is owned by %q, want app", owned["/etc/app/app.conf"])
+	}
+	// Issue 1126, C3: a seat path that steps back for a seat held here is that holder's, whatever the order of the seat
+	// table (the controller reads it sorted by name, a node in the order compiled).
+	resolver := mcat.Manifest{Module: "systemd-resolved", Version: "1", Claims: []mcat.Claim{{Name: mcat.ResolverSeat}},
+		Resources: []map[string]any{{"id": "stub", "type": "file", "path": mcat.ResolverFile}}}
+	uplink := mcat.Manifest{Module: "networkmanager", Version: "1", Claims: []mcat.Claim{{Name: "node-uplink"}},
+		Resources: []map[string]any{{"id": "resolv", "type": "file", "path": mcat.ResolverFile}}}
+	compiled := seats
+	t.Cleanup(func() { seats = compiled })
+	for _, order := range []string{"compiled", "reversed"} {
+		if order == "reversed" {
+			seats = append([]mcat.Seat(nil), compiled...)
+			slices.Reverse(seats)
+		}
+		both := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{files, uplink, resolver}}
+		w, err := resolutionFilesWords(both, files, nil, mcat.Rendering{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var o map[string]string
+		if err := json.Unmarshal([]byte(w[mcat.FilesOwnedPaths]), &o); err != nil || o[mcat.ResolverFile] != "systemd-resolved ("+mcat.ResolverSeat+")" {
+			t.Errorf("seat table %s: %s is owned by %q, want systemd-resolved (%s)", order, mcat.ResolverFile, o[mcat.ResolverFile], mcat.ResolverSeat)
+		}
+	}
+	seats = compiled
+	// Issue 1126, C5 and seed-8: a module carried as it runs (compose.Carried) owns its manifest's paths (OwnsPaths), as
+	// the controller tells them, and not the paths its running resources are at (a directory the mesh placed).
+	carried := mcat.Manifest{Module: "de-spiegel", Version: "1", OwnsPaths: []string{"/var/lib/de-spiegel/server.env"},
+		Resources: []map[string]any{{"id": "state", "type": "directory", "path": "/var/lib/de-spiegel"}}}
+	w, err := resolutionFilesWords(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{files, carried}}, files, nil, mcat.Rendering{})
+	if err != nil || !strings.Contains(w[mcat.FilesOwnedPaths], `"/var/lib/de-spiegel/server.env":"de-spiegel (its own tools)"`) ||
+		strings.Contains(w[mcat.FilesOwnedPaths], `"/var/lib/de-spiegel":`) {
+		t.Errorf("a carried module does not own its manifest's paths alone: %v %v", w[mcat.FilesOwnedPaths], err)
+	}
+	if w, _ := resolutionFilesWords(r, app, nil, mcat.Rendering{}); w[mcat.FilesOwnedPaths] != "" {
+		t.Error("a module not holding node-files is told the owned paths")
+	}
+}
diff --git a/internal/compose/resolution/filtering.go b/internal/compose/resolution/filtering.go
new file mode 100644
index 0000000..4d99f25
--- /dev/null
+++ b/internal/compose/resolution/filtering.go
@@ -0,0 +1,894 @@
+package resolution
+
+import (
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Filtering is the whole rule set for the node this resolved for.
+//
+// **Derived from what is assigned here, and from the overlay's shape** — a node's open ports are
+// a consequence of what runs on it, not a second list kept in step by hand. Nothing else opens a
+// port: **what is not declared is closed**, which is the property that makes the derivation worth
+// having rather than merely tidy.
+func Filtering(r mcat.Resolution, computed map[string]mcat.Generator, ports map[string]map[int]int, exposure map[string]map[int]string) ([]mcat.Rule, error) {
+	// Keyed by what actually distinguishes an opening. Two modules wanting :443 from the mesh is
+	// one rule with two sources; one wanting it from the mesh and another from anywhere is two,
+	// and they are collapsed below -- deliberately, and only in the widening direction.
+	type opening struct {
+		port     int
+		protocol string
+		from     string
+	}
+	found := map[opening]*mcat.Rule{}
+	for _, m := range r.Modules {
+		// What a module says, and what was computed for it on this machine. The second is how a
+		// hub's own port is derived: it is a fact about this machine's place in the mesh, which
+		// the module cannot know and the mesh cannot avoid knowing.
+		opens := m.Listens
+		if m.Computed != "" {
+			if generator, known := computed[m.Computed].(mcat.OpensPorts); known {
+				also, err := generator.Listens(r.Node)
+				if err != nil {
+					// **Refused, not treated as nothing.** A generator that cannot say what a
+					// machine opens is not one that says it opens nothing, and closing a port on
+					// the evidence of a failure to look is how a machine is severed by a fault
+					// somewhere else entirely.
+					return nil, fmt.Errorf(
+						"%s could not say what %s opens, so no rule set can be computed for it: %w",
+						m.Module, r.Node, err)
+				}
+				opens = append(append([]mcat.Listening{}, opens...), also...)
+			}
+		}
+		for _, l := range opens {
+			// **The port the machine actually publishes on** (novox/hq ADR 0038). A module says
+			// the port its software uses; the mesh chooses where the machine puts it. A rule
+			// naming the first would open a port nothing listens on and leave the real one shut,
+			// which is a firewall that reports success and blocks the service.
+			port := l.Port
+			if at, known := ports[m.Module][l.Port]; known {
+				port = at
+			}
+			// The source, with any per-node exposure setting applied. The override names the port
+			// the module declares, so it travels with that port to wherever the machine publishes
+			// it (novox/hq ADR 0046): the same module is internal on one node and public on another.
+			from := l.From
+			if override, set := exposure[m.Module][l.Port]; set {
+				from = override
+			}
+			at := opening{port: port, protocol: l.At(), from: from}
+			rule, seen := found[at]
+			if !seen {
+				rule = &mcat.Rule{Port: port, Protocol: l.At(), From: from}
+				found[at] = rule
+			}
+			rule.Because = append(rule.Because, m.Module)
+			rule.Why = append(rule.Why, l.Why)
+		}
+	}
+
+	out := make([]mcat.Rule, 0, len(found))
+	for _, rule := range found {
+		out = append(out, *rule)
+	}
+	// By port, then protocol, then source. A rule set that reorders itself between two runs of an
+	// unchanged mesh is a diff nobody can read, and every consumer of this compares one to the
+	// last.
+	sort.Slice(out, func(a, b int) bool {
+		if out[a].Port != out[b].Port {
+			return out[a].Port < out[b].Port
+		}
+		if out[a].Protocol != out[b].Protocol {
+			return out[a].Protocol < out[b].Protocol
+		}
+		return out[a].From < out[b].From
+	})
+	return widest(out), nil
+}
+
+// Exposure reads a module's per-node exposure overrides from its settings: declared-port → source.
+//
+// It refuses an override for a port the module does not listen on, or to a source that is not a
+// real one — an exposure setting that reaches no port, or names a source nothing enforces, is the
+// "reads as a restriction and is none" fault this whole mechanism exists to prevent (novox/hq
+// ADR 0043/0045). A module with no `expose` setting yields nothing and keeps its manifest defaults.
+func Exposure(m mcat.Manifest, layers []mcat.Layer) (map[int]string, error) {
+	listened := make(map[int]bool, len(m.Listens))
+	for _, l := range m.Listens {
+		listened[l.Port] = true
+	}
+
+	out := map[int]string{}
+	for _, layer := range layers {
+		raw, ok := layer.Placement[mcat.ExposeSetting]
+		if !ok {
+			continue
+		}
+		entries, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { port: source } map, and %q set it to something else",
+				m.Module, mcat.ExposeSetting, layer.From)
+		}
+		for portText, value := range entries {
+			port, err := strconv.Atoi(portText)
+			if err != nil {
+				return nil, fmt.Errorf("%s exposes %q, which is not a port", m.Module, portText)
+			}
+			if !listened[port] {
+				return nil, fmt.Errorf(
+					"%s exposes port %d, which it does not listen on — the setting reaches nothing",
+					m.Module, port)
+			}
+			source, ok := value.(string)
+			if !ok || (source != mcat.FromMesh && source != mcat.FromEverywhere && source != mcat.FromMachine &&
+				source != mcat.FromLocalNetwork) {
+				return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q, %q or %q",
+					m.Module, port, value, mcat.FromMesh, mcat.FromEverywhere, mcat.FromMachine, mcat.FromLocalNetwork)
+			}
+			out[port] = source
+		}
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// widest drops a rule that another already covers.
+//
+// A port open to anywhere is not additionally restricted by a second rule opening it to the mesh:
+// keeping both would render two lines where the narrower one restricts nothing, which is exactly
+// the appearance-of-restriction this mechanism exists to remove. The narrower rule's sources are
+// carried onto the wider one, so the module that wanted it is still named.
+func widest(rules []mcat.Rule) []mcat.Rule {
+	// The local network is the private network and the machine's own local networks (novox/hq ADR
+	// 0340 §4), so it covers `mesh` and is covered by `anywhere`.
+	reach := map[string]int{mcat.FromMachine: 0, mcat.FromMesh: 1, mcat.FromLocalNetwork: 2, mcat.FromEverywhere: 3}
+	var out []mcat.Rule
+	for _, rule := range rules {
+		covered := false
+		for i := range out {
+			if out[i].Port != rule.Port || out[i].Protocol != rule.Protocol {
+				continue
+			}
+			if reach[out[i].From] >= reach[rule.From] {
+				out[i].Because = append(out[i].Because, rule.Because...)
+				out[i].Why = append(out[i].Why, rule.Why...)
+				covered = true
+				break
+			}
+			// The other way round: this one is wider, so it replaces what is there and takes its
+			// sources with it.
+			rule.Because = append(rule.Because, out[i].Because...)
+			rule.Why = append(rule.Why, out[i].Why...)
+			out = append(out[:i], out[i+1:]...)
+			break
+		}
+		if !covered {
+			out = append(out, rule)
+		}
+	}
+	return out
+}
+
+// AsNftablesWithLocal is AsNftables with the machine's local networks: the networks it reported on a
+// link facing outside that count (novox/hq ADR 0340, JudgeLocalNetworks), which a rule from
+// `local-network` admits on its own port alone, beside the private network. None is not widened to
+// anywhere and not dropped silently: the rule set says the port wanted the local network and found none.
+func AsNftablesWithLocal(rules []mcat.Rule, mesh []string, outward bool, foundation []int,
+	outwardLinks []string, tunnel string, local []string) string {
+	// The links that are not this machine's own: the ones facing outside, and the mesh's tunnel.
+	// Traffic arriving on any of them is admitted only by a rule below; traffic arriving anywhere
+	// else is this machine's own guest and is not something the mesh has a position on.
+	//
+	// The tunnel is named here deliberately. Treating it as "not outside" would make a port nothing
+	// declares reachable from every machine in the mesh, which is the derivation abandoned.
+	quoted := make([]string, 0, len(outwardLinks)+1)
+	for _, link := range outwardLinks {
+		quoted = append(quoted, fmt.Sprintf("%q", link))
+	}
+	if tunnel != "" {
+		quoted = append(quoted, fmt.Sprintf("%q", tunnel))
+	}
+	inward := strings.Join(quoted, ", ")
+
+	var b strings.Builder
+	b.WriteString("# Computed by the mesh from what is assigned to this node.\n")
+	b.WriteString("# Edits are lost on the next declaration; change a module's listens instead.\n\n")
+	// Replacing this table and nothing else, every time it is loaded. Declared as an empty table
+	// first so the delete cannot fail on a machine that has never loaded one — the alternative
+	// idiom, `flush ruleset`, empties every table on the machine, including the ones the container
+	// runtime writes for its bridges. Reloading the mesh's rules must not stop every container.
+	b.WriteString("table inet mesh {}\ndelete table inet mesh\n\n")
+	b.WriteString("table inet mesh {\n")
+	b.WriteString("\tchain input {\n")
+	// Dropping by default is the whole point, and the three lines under it are what keep dropping
+	// by default from meaning "unreachable": a reply to something this node started, its own
+	// loopback, and the diagnostic that tells an operator the machine is up and refusing rather
+	// than gone.
+	b.WriteString("\t\ttype filter hook input priority filter; policy drop;\n")
+	b.WriteString("\t\tct state established,related accept\n")
+	b.WriteString("\t\tct state invalid drop\n")
+	b.WriteString("\t\tiif lo accept\n")
+	// **Anything on this machine may call anything on this machine.**
+	//
+	// Local is not a boundary this mesh draws. A service running here is callable by everything else
+	// running here, whatever form either takes — a package with a unit, a binary, a container. Whether
+	// a caller sits in a container was never meant to change the answer, and the only reason it did was
+	// that this chain asked about addresses: a caller on the machine carries the machine's address, a
+	// caller in one of its containers carries a bridge address, and a rule naming the former silently
+	// refused the latter.
+	//
+	// Measured: a module reaching its database on this machine's own name timed out for eleven hours
+	// while the machine itself could reach it, and the mesh called the machine healthy throughout
+	// (novox/hq 04-ISSUES/145).
+	//
+	// Asked by the link it arrives on rather than the address it comes from: anything that did not
+	// arrive from outside this machine, and did not arrive over the private network, is this machine's
+	// own. One rule for every service here, in place of a line per port that only ever covered the
+	// ports somebody remembered to think about.
+	if inward != "" {
+		b.WriteString(fmt.Sprintf("\t\tiifname != { %s } accept\n", inward))
+	}
+	b.WriteString("\t\ticmp type echo-request accept\n")
+	b.WriteString("\t\ticmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert } accept\n")
+
+	// **What this machine's own guests must be able to ask it** (novox/hq ADR 0140). A guest gets
+	// its address and its names from this machine, over the link it is on, and those two questions
+	// arrive at the input chain like any other. Denied, the guest never gets an address and never
+	// resolves a name — which is not "a closed port" but a network that does not work at all, and it
+	// is this machine's own guest asking.
+	//
+	// Asked for by the link it arrives on rather than by the address it comes from, for the reason
+	// the forward chain below no longer names an address: a range describes one machine and goes
+	// stale in silence. Anything arriving from outside, or over the tunnel, is not a guest of this
+	// machine and asks through a port somebody declared, like everything else.
+	if len(inward) > 0 {
+		b.WriteString("\t\t# this machine's own guests asking it for an address and for names\n")
+		b.WriteString(fmt.Sprintf("\t\tiifname != { %s } udp dport { 53, 67 } accept\n", inward))
+		b.WriteString(fmt.Sprintf("\t\tiifname != { %s } tcp dport 53 accept\n", inward))
+	}
+
+	// **ssh, always, and not because a module asked.**
+	//
+	// Every other line in this chain is derived from what is assigned here, which is the whole
+	// point of the mechanism. This one is not, and the exception is deliberate: the rules are
+	// computed from what the mesh knows, a mesh part-way through adopting a machine knows almost
+	// nothing, and the first port to close is the one used to fix it. The session that loads these
+	// rules survives on conntrack until it drops, and then the machine is reached from a rescue
+	// console (novox/hq issue 047).
+	//
+	// From the private network always, because that is how machines reach each other. From
+	// everywhere when this machine faces outward, because that is the only way in on the day the
+	// private network is what broke.
+	if four, six := byFamily(mesh); len(four) > 0 || len(six) > 0 {
+		b.WriteString("\n\t\t# ssh, from the mesh — never derived, never closed\n")
+		if len(four) > 0 {
+			b.WriteString(fmt.Sprintf("\t\tip saddr { %s } tcp dport %d accept\n",
+				strings.Join(four, ", "), mcat.SSHPort))
+		}
+		if len(six) > 0 {
+			b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } tcp dport %d accept\n",
+				strings.Join(six, ", "), mcat.SSHPort))
+		}
+	}
+	// From everywhere when this machine faces outward — and also when the mesh has no addresses to
+	// name yet.
+	//
+	// **A machine early in being adopted is the one this matters most for, and the one where the
+	// rule above emits nothing.** Before the private network exists there is no mesh address to
+	// allow from, so restricting to it restricts to nothing: the chain drops by default and ssh is
+	// simply shut. That is the first machine anybody adopts, reached over the network, with the
+	// port needed to fix it closed by the act of adopting it. Never leaving this chain without an
+	// ssh rule is worth more than the narrower rule it would have had.
+	if four, six := byFamily(mesh); outward || (len(four) == 0 && len(six) == 0) {
+		why := "and from outside, because this machine faces it"
+		if !outward {
+			why = "and from anywhere, because this mesh has no addresses to narrow it to yet"
+		}
+		b.WriteString("\t\t# " + why + "\n")
+		b.WriteString(fmt.Sprintf("\t\ttcp dport %d accept\n", mcat.SSHPort))
+	}
+
+	// The mesh's own ports, from anywhere.
+	//
+	// Not narrowed to the private network, because the machines that need this most are the ones
+	// not on it yet: a node enrols BEFORE it has an address here, over the ordinary network, and a
+	// rule allowing only the private network would close the door being knocked on.
+	if len(foundation) > 0 {
+		b.WriteString("\n\t\t# the mesh's own — never derived, never closed\n")
+		for _, port := range foundation {
+			b.WriteString(fmt.Sprintf("\t\ttcp dport %d accept\n", port))
+		}
+	}
+
+	if len(rules) > 0 {
+		b.WriteString("\n")
+	}
+	for _, rule := range rules {
+		for i, module := range rule.Because {
+			why := ""
+			if i < len(rule.Why) && rule.Why[i] != "" {
+				why = " — " + rule.Why[i]
+			}
+			b.WriteString(fmt.Sprintf("\t\t# %s%s\n", module, why))
+		}
+		switch rule.From {
+		case mcat.FromMachine:
+			// Nothing. A port bound for something else on the same machine is reached over
+			// loopback, which is already accepted above -- and rendering a rule for it would open
+			// it to the network, which is the opposite of what the manifest asked for.
+			b.WriteString(fmt.Sprintf("\t\t# %s/%d is this machine only; loopback already covers it\n",
+				rule.Protocol, rule.Port))
+		case mcat.FromMesh:
+			if len(mesh) == 0 {
+				// Said, and impossible to render. Left as a comment rather than silently widened
+				// to anywhere or silently dropped: one of those opens a port nobody asked to
+				// open, and the other closes one somebody did.
+				b.WriteString(fmt.Sprintf(
+					"\t\t# %s/%d wanted the mesh, and this node knows no mesh addresses; closed\n",
+					rule.Protocol, rule.Port))
+				break
+			}
+			four, six := byFamily(mesh)
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
+					strings.Join(four, ", "), rule.Protocol, rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
+					strings.Join(six, ", "), rule.Protocol, rule.Port))
+			}
+		case mcat.FromLocalNetwork:
+			// The private network and the machine's own local networks, on this port alone (novox/hq
+			// ADR 0340 §5).
+			four, six := byFamily(mesh)
+			lfour, lsix := byFamily(local)
+			four, six = append(four, lfour...), append(six, lsix...)
+			if len(lfour) == 0 && len(lsix) == 0 {
+				b.WriteString(fmt.Sprintf(
+					"\t\t# %s/%d wanted the local network, and this machine reported no private network "+
+						"on a link facing outside; admitted from no local network\n", rule.Protocol, rule.Port))
+			}
+			if len(four) == 0 && len(six) == 0 {
+				b.WriteString(fmt.Sprintf(
+					"\t\t# %s/%d wanted the local network, and this node knows neither mesh addresses nor a "+
+						"local network; closed\n", rule.Protocol, rule.Port))
+				break
+			}
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
+					strings.Join(four, ", "), rule.Protocol, rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
+					strings.Join(six, ", "), rule.Protocol, rule.Port))
+			}
+		case mcat.FromEverywhere:
+			b.WriteString(fmt.Sprintf("\t\t%s dport %d accept\n", rule.Protocol, rule.Port))
+		}
+	}
+
+	b.WriteString("\t}\n")
+	// Nothing this node sends is filtered, and it is stated rather than left to nftables' default
+	// so that reading this file answers the question instead of requiring the reader to know it.
+	b.WriteString("\tchain output {\n\t\ttype filter hook output priority filter; policy accept;\n\t}\n")
+
+	// **A forward chain, because without one this firewall does not cover container ports.**
+	//
+	// It used to have none, on the reasoning that a drop here would drop container traffic the
+	// runtime explicitly allowed and stop every container on the node. The first half of that is
+	// true. The conclusion was not: a published port is redirected and then *forwarded*, so it
+	// never reaches the input chain above, and a firewall with no forward chain says nothing at all
+	// about the ports most worth protecting. Rehearsed on three machines: loading these rules
+	// refused a port on the host and left a published container port reachable (novox/hq issue 047).
+	//
+	// **What it constrains is traffic arriving from OUTSIDE this machine, and nothing else**
+	// (novox/hq ADR 0140).
+	//
+	// It used to deny everything here and then allow the machine's own containers back by naming
+	// the address ranges they sit on — two ranges fixed in this file and the rest recorded per
+	// machine. Every way of keeping that list correct failed. A constant describes one machine. A
+	// recorded range goes stale in silence and cannot tell a network the mesh made from one a
+	// predecessor left behind. Generating it from the modules would have put half this rule set on
+	// the machine.
+	//
+	// The list should not exist, because the mesh has no position on a container reaching outward:
+	// that is not a port opened to anybody. So traffic that did not arrive from outside is accepted
+	// in one line, and what did arrive from outside is allowed only where a rule below admits it.
+	//
+	// The tunnel is not "not outside". Accepting everything off it would make a port nothing
+	// declares reachable from any machine in the mesh, which is the derivation abandoned — so it is
+	// named here beside the outward links, and traffic arriving on it meets the rules below like
+	// anything else.
+	b.WriteString("\tchain forward {\n")
+	b.WriteString("\t\ttype filter hook forward priority filter; policy drop;\n")
+	b.WriteString("\t\tct state established,related accept\n")
+	b.WriteString("\t\tct state invalid drop\n")
+	b.WriteString("\n")
+	// Only when there is a link to name. An empty set is a line nftables refuses, and a rule set
+	// that does not load is a machine filtering nothing while its unit reports success — so the
+	// chain denies rather than renders nonsense. Composing a declaration for a machine that has
+	// named none is refused upstream, so this is a floor and not a path anything travels.
+	if inward != "" {
+		b.WriteString("\t\t# this machine's own guests reaching outward: not a port opened to anybody\n")
+		b.WriteString(fmt.Sprintf("\t\tiifname != { %s } accept\n", inward))
+	}
+	// **The mesh passing through, not arriving.** A machine the mesh routes through — the hub, for
+	// every path between machines that are not co-located (novox/hq ADR 0007) — relays a packet that
+	// came in on the tunnel and leaves on it again, addressed to another machine of the mesh. That is
+	// no port of this machine's: the machine it is for filters it against its own rules. Without
+	// this, the chain below judged a relayed packet by this machine's own published ports, so two
+	// machines behind the hub reached each other only on ports the hub happened to publish for itself
+	// (novox/hq issue 196). In and out on the tunnel both: a packet off the tunnel for this machine's
+	// own containers leaves by a bridge, and still meets the rules below.
+	if tunnel != "" {
+		b.WriteString("\t\t# the mesh passing through to another of its machines, which filters it itself\n")
+		b.WriteString(fmt.Sprintf("\t\tiifname %q oifname %q accept\n", tunnel, tunnel))
+	}
+
+	if len(rules) > 0 {
+		b.WriteString("\n")
+	}
+	for _, rule := range rules {
+		for i, module := range rule.Because {
+			why := ""
+			if i < len(rule.Why) && rule.Why[i] != "" {
+				why = " — " + rule.Why[i]
+			}
+			b.WriteString(fmt.Sprintf("\t\t# %s%s\n", module, why))
+		}
+		// **Matched on where the packet was originally addressed, not where it is going now.**
+		// By the time a packet reaches this chain the runtime has already rewritten its
+		// destination to the container's own port, so matching the port a rule names would match
+		// nothing. Conntrack remembers what was asked for, which is the port the machine
+		// publishes and the only one a client ever knew.
+		switch rule.From {
+		case mcat.FromMachine:
+			b.WriteString(fmt.Sprintf("\t\t# %s/%d is this machine only, and is not forwarded\n",
+				rule.Protocol, rule.Port))
+		case mcat.FromMesh:
+			four, six := byFamily(mesh)
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(four, ", "), rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(six, ", "), rule.Port))
+			}
+		case mcat.FromLocalNetwork:
+			four, six := byFamily(mesh)
+			lfour, lsix := byFamily(local)
+			four, six = append(four, lfour...), append(six, lsix...)
+			if len(four) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(four, ", "), rule.Port))
+			}
+			if len(six) > 0 {
+				b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
+					strings.Join(six, ", "), rule.Port))
+			}
+		case mcat.FromEverywhere:
+			b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", rule.Port))
+		}
+	}
+
+	// The foundation ports, forwarded — for the same reason they are in the input chain, and the
+	// same reason the module rules above are here too: the broker is a published container port,
+	// so a cross-node dial to it is redirected and *forwarded*, never reaching the input chain
+	// (novox/hq issue 047's lesson, applied to the foundation this time). Without this a joined
+	// node reaches the broker only while its first connection's conntrack entry survives — and a
+	// broker restart, which adopting the foundation's own broker causes, drops the entry and the
+	// node can never receive another declaration (novox/hq issue 063). From anywhere, matching
+	// the input rule: a node enrolling has no overlay address yet.
+	if len(foundation) > 0 {
+		b.WriteString("\n\t\t# the mesh's own — never derived, never closed\n")
+		for _, port := range foundation {
+			b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", port))
+		}
+	}
+	b.WriteString("\t}\n")
+	b.WriteString("}\n")
+	return b.String()
+}
+
+// byFamily splits addresses into the two nftables understands separately.
+//
+// `ip saddr` and `ip6 saddr` are different matches, and one set holding both families is a syntax
+// error — which means the whole file fails to load and the machine filters nothing while the
+// service reports a configuration fault. A mesh that is entirely one family renders one line, and
+// a mixed one renders both rather than dropping half its nodes.
+func byFamily(addresses []string) (four []string, six []string) {
+	for _, a := range addresses {
+		if strings.Contains(a, ":") {
+			six = append(six, a)
+			continue
+		}
+		four = append(four, a)
+	}
+	return four, six
+}
+
+// GivenPorts reads a module's given machine ports from its settings: software port → machine port.
+//
+// Refused from a mesh-wide layer — a port is a fact about one machine, and one number for every
+// machine is the collision this exists to avoid — and for a port the module's containers do not
+// publish.
+//
+// **Only a published port is the mesh's to move** (novox/hq ADR 0038). A container's mapping is
+// what translates; a module binding the machine's network directly binds the number its software
+// was configured with, and moving that number would put it in the filter, in the openings and in
+// what consumers are told while the software still listens on the old one — a port that reads as
+// moved and is not.
+//
+// **Either name of a mapping names it; the module's own name answers.** A short form publishes one
+// number, which is the container's port and the machine's at once. A mapping written the long way
+// — `"2222:22"` — has two, and a module reasonably declares it listens on either: the port its
+// software uses, or the port the machine already serves on. A setting may name either end, because
+// both are true of the same mapping. The answer comes back under the end the **module** names in
+// its `listens`, which is the number every reader of this map holds: the ports map, the filter, the
+// openings, what a consumer is told, and the mapping the runtime is handed. Keyed one way and read
+// the other, the setting moved the container's mapping and nothing else — a firewall, a set of
+// openings and a consumer all pointing at a port the software had left.
+//
+// One entry per mapping, never two. A second key for the same answer is not a convenience: where
+// two mappings share a number, it is an entry one of them writes over the other's, and the reader
+// that finds the survivor disagrees with the reader that recomputes it.
+func GivenPorts(m mcat.Manifest, layers []mcat.Layer) (map[int]int, error) {
+	// An endpoint's own block may put it on a machine port, which is the same thing `ports` says about
+	// the number rather than about the endpoint (novox/hq ADR 0138). Collected first and then let the
+	// older key be read, which refuses a port said twice.
+	byName, err := mcat.Endpoints(m, layers)
+	if err != nil {
+		return nil, err
+	}
+	named := map[int]int{}
+	for name, ep := range byName {
+		if ep.Port == 0 {
+			continue
+		}
+		named[endpointPorts(m)[name]] = ep.Port
+	}
+
+	// Every name a setting may use, and the mapping it names.
+	names := map[int][]publishing{}
+	for _, p := range publishedPorts(m) {
+		names[p.inner] = append(names[p.inner], p)
+		if p.machine != p.inner {
+			names[p.machine] = append(names[p.machine], p)
+		}
+	}
+	// And the names the module itself uses. A mapping's answer is filed under these, because they
+	// are what every reader asks for; a mapping the module names at neither end is filed under its
+	// machine side, where nothing looks, which is correct — nothing serves it.
+	declares := map[int]bool{}
+	for _, l := range m.Listens {
+		declares[l.Port] = true
+	}
+	chose := map[int]int{} // the port a setting named → the machine port it gave it
+	out := map[int]int{}   // the port the module names → the machine port it is on
+	by := map[int]int{}    // and which of the setting's ports put it there, for the refusal
+	for _, layer := range layers {
+		raw, ok := layer.Placement[mcat.PortsSetting]
+		if !ok {
+			continue
+		}
+		if layer.From == mcat.MeshWideLayer {
+			return nil, fmt.Errorf("%s: %s is given per node — a port is a fact about one "+
+				"machine; set it with --node", m.Module, mcat.PortsSetting)
+		}
+		entries, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { port: machine-port } map, and %q set it to "+
+				"something else", m.Module, mcat.PortsSetting, layer.From)
+		}
+		for portText, value := range entries {
+			port, err := strconv.Atoi(portText)
+			if err != nil {
+				return nil, fmt.Errorf("%s gives %q a port, which is not a port", m.Module, portText)
+			}
+			publishes, known := names[port]
+			if !known {
+				return nil, fmt.Errorf("%s gives port %d a machine port, and no container of its "+
+					"publishes %d — the mesh cannot move a port the module does not publish; the "+
+					"software would go on listening where it was told to", m.Module, port, port)
+			}
+			if err := oneMapping(m.Module, port, publishes); err != nil {
+				return nil, err
+			}
+			at, ok := asPort(value)
+			if !ok || at < 1 || at > 65535 {
+				return nil, fmt.Errorf("%s gives port %d the machine port %v, which is not a port",
+					m.Module, port, value)
+			}
+			if at == mcat.SSHPort {
+				return nil, fmt.Errorf("%s gives port %d the machine port %d, which is ssh's — the "+
+					"one port a machine may never lose", m.Module, port, at)
+			}
+			chose[port] = at
+		}
+	}
+	// One holder per machine port, within the module too.
+	holder := map[int]int{}
+	for _, port := range sortedPorts(chose) {
+		at := chose[port]
+		if other, twice := holder[at]; twice {
+			return nil, fmt.Errorf("%s gives machine port %d to both its %d and its %d", m.Module,
+				at, min(port, other), max(port, other))
+		}
+		holder[at] = port
+	}
+	// Filed under the module's own names for the mapping — every one it uses, so a module that
+	// says it listens on both ends is answered at both, and under the machine side when it names
+	// neither.
+	for _, port := range sortedPorts(chose) {
+		at, mapping := chose[port], names[port][0]
+		keys := []int{}
+		for _, end := range []int{mapping.machine, mapping.inner} {
+			if declares[end] && !slices.Contains(keys, end) {
+				keys = append(keys, end)
+			}
+		}
+		if len(keys) == 0 {
+			keys = []int{mapping.machine}
+		}
+		for _, key := range keys {
+			// The key must name this mapping and no other, or the entry is one mapping's answer
+			// standing where another's is read.
+			if err := oneMapping(m.Module, key, names[key]); err != nil {
+				return nil, err
+			}
+			// And one machine port per mapping: `{"22": 222, "2222": 300}` is two numbers for the
+			// one thing the machine publishes, and neither is more right.
+			if was, twice := out[key]; twice && was != at {
+				return nil, fmt.Errorf("%s gives %s the machine ports %d and %d — its %d and its "+
+					"%d are the two ends of one mapping, and it is published once", m.Module,
+					mapping, min(was, at), max(was, at), min(by[key], port), max(by[key], port))
+			}
+			out[key], by[key] = at, port
+		}
+	}
+	// And what the endpoints' own blocks put them on. Refused rather than merged where both keys name
+	// one endpoint: two places giving a port is the confusion this key exists to end.
+	for wanted, at := range named {
+		if was, twice := out[wanted]; twice && was != at {
+			return nil, fmt.Errorf(
+				"%s puts its port %d on %d through %s and on %d through %s — one endpoint, two "+
+					"machine ports, and it is published once. Keep the endpoint's own block",
+				m.Module, wanted, at, mcat.EndpointsSetting, was, mcat.PortsSetting)
+		}
+		out[wanted] = at
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// oneMapping refuses a number that names two of a module's mappings — `"22"` beside `"2222:22"`,
+// say, or `"4001:80"` beside `"4002:80"` read by their shared `80`. Refused rather than picked:
+// moving one of them and leaving the other is a mapping the operator did not ask for and cannot
+// see, and the two readings differ.
+func oneMapping(module string, port int, publishes []publishing) error {
+	for _, other := range publishes[1:] {
+		if other != publishes[0] {
+			return fmt.Errorf("%s gives port %d a machine port, and its containers publish %d "+
+				"twice — as %s and as %s; which one to move is not said", module, port, port,
+				publishes[0], other)
+		}
+	}
+	return nil
+}
+
+// publishing is one mapping a module's container writes: the port the container itself uses, and
+// the machine port the manifest put it on — the same number for a short form, which the runtime
+// publishes on the port it names.
+type publishing struct{ machine, inner int }
+
+func (p publishing) String() string {
+	if p.machine == p.inner {
+		return strconv.Itoa(p.inner)
+	}
+	return fmt.Sprintf("%d:%d", p.machine, p.inner)
+}
+
+// publishedPorts is every mapping a module's containers publish, whichever form it is written in.
+func publishedPorts(m mcat.Manifest) []publishing {
+	var out []publishing
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) != "container" {
+			continue
+		}
+		listed, _ := r["ports"].([]any)
+		for _, entry := range listed {
+			written := strings.TrimSpace(fmt.Sprint(entry))
+			if machine, inner, _, ok := mapping(written); ok {
+				out = append(out, publishing{machine: machine, inner: inner})
+				continue
+			}
+			if cut := strings.LastIndex(written, "/"); cut >= 0 {
+				written = written[:cut]
+			}
+			if n, err := strconv.Atoi(strings.TrimSpace(written)); err == nil {
+				out = append(out, publishing{machine: n, inner: n})
+			}
+		}
+	}
+	return out
+}
+
+// sortedPorts is a settings map's ports in order, so a refusal reads the same on every run.
+func sortedPorts(of map[int]int) []int {
+	out := make([]int, 0, len(of))
+	for port := range of {
+		out = append(out, port)
+	}
+	sort.Ints(out)
+	return out
+}
+
+// reaches is every value, in the order a refusal lists them.
+var reaches = []string{mcat.ReachMachine, mcat.ReachInternal, mcat.ReachPublic, mcat.ReachBoth, mcat.ReachLocalNetwork}
+
+// RoutedPorts are the ports a module serves through a proxy, taken from its route contributions.
+//
+// **A routed endpoint's port is how the proxy reaches it, and nothing else.** That is ADR 0045's
+// decision and it is older than reach: a public service listens `from: mesh`, only the proxy reaches
+// it, and it is exposed by name. So `public` on a routed endpoint asks for a public *name*; opening
+// that port to the world as well would undo the arrangement the proxy exists for.
+//
+// Measured before this was written, not reasoned: a module's routed name answered from the internet
+// over TLS while its machine-side port was refused from the same place. The port is not the path.
+func RoutedPorts(m mcat.Manifest) map[int]bool {
+	out := map[int]bool{}
+	note := func(values map[string]any) {
+		// **The endpoint it serves, by name where it says one.** A route repeating a port number is
+		// the older shape and still read: 35 of the catalogue's 36 route entries name a port their
+		// module declares a listen on (novox/hq ADR 0138).
+		if name, ok := values[mcat.RouteEndpoint].(string); ok {
+			if port, found := mcat.EndpointPort(m, name); found {
+				out[port] = true
+				return
+			}
+		}
+		if port, ok := asPort(values["port"]); ok {
+			out[port] = true
+		}
+	}
+	if values, ok := m.Contributes["route"]; ok {
+		note(values)
+	}
+	for _, values := range m.ContributesMany["route"] {
+		note(values)
+	}
+	return out
+}
+
+// FilterSource is the source a reach means to the packet filter.
+//
+// `public` and `both` are the same here. A reach that opened a port to the mesh and not to the world
+// would be `internal`; there is no reach that opens it to the world and *not* to the mesh, because a
+// filter cannot express "everyone except these" and nobody has asked for it.
+func FilterSource(reach string) (string, bool) {
+	switch reach {
+	case mcat.ReachMachine:
+		return mcat.FromMachine, true
+	case mcat.ReachInternal:
+		return mcat.FromMesh, true
+	case mcat.ReachPublic, mcat.ReachBoth:
+		return mcat.FromEverywhere, true
+	case mcat.ReachLocalNetwork:
+		return mcat.FromLocalNetwork, true
+	default:
+		return "", false
+	}
+}
+
+// WantsPublicName is whether a reach asks for the route's public name to be composed.
+func WantsPublicName(reach string) bool { return reach == mcat.ReachPublic || reach == mcat.ReachBoth }
+
+// WantsInternalName is whether a reach asks for the route's internal name to be composed.
+func WantsInternalName(reach string) bool {
+	return reach == mcat.ReachInternal || reach == mcat.ReachBoth || reach == mcat.ReachLocalNetwork
+}
+
+// Reaches reads a module's per-node reach settings: declared port → how far it reaches.
+//
+// It refuses a reach for a port the module does not listen on, or a value that is not one of the
+// four — the "reads as a restriction and is none" fault this whole mechanism exists to prevent
+// (novox/hq ADR 0043/0045). It also refuses a port that `expose` names as well: the two say the same
+// thing in different words, and a module whose reach and exposure disagree would have the filter
+// following one and the names following the other, which is the very confusion ADR 0138 removes.
+//
+// A module with no `reach` setting yields nothing, and everything behaves exactly as before: the
+// filter follows the manifest's `from`, and both names are composed. That is what keeps every machine
+// already running unchanged until an assignment says otherwise.
+func Reaches(m mcat.Manifest, layers []mcat.Layer) (map[int]string, error) {
+	listened := make(map[int]bool, len(m.Listens))
+	for _, l := range m.Listens {
+		listened[l.Port] = true
+	}
+
+	exposed, err := Exposure(m, layers)
+	if err != nil {
+		return nil, err
+	}
+
+	out := map[int]string{}
+	// What an endpoint's own block says, which is the same statement in the shape that names the
+	// endpoint rather than its port (novox/hq ADR 0138). Read first so the older key, which says less,
+	// cannot quietly win over the newer one that says more.
+	blocks, err := mcat.Endpoints(m, layers)
+	if err != nil {
+		return nil, err
+	}
+	declared := endpointPorts(m)
+	for name, ep := range blocks {
+		if ep.Reach == "" {
+			continue
+		}
+		out[declared[name]] = ep.Reach
+	}
+	for _, layer := range layers {
+		raw, ok := layer.Placement[mcat.ReachSetting]
+		if !ok {
+			continue
+		}
+		entries, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { port: reach } map, and %q set it to something else",
+				m.Module, mcat.ReachSetting, layer.From)
+		}
+		for portText, value := range entries {
+			port, err := strconv.Atoi(portText)
+			if err != nil {
+				return nil, fmt.Errorf("%s says how far %q reaches, which is not a port", m.Module, portText)
+			}
+			if !listened[port] {
+				return nil, fmt.Errorf(
+					"%s says how far port %d reaches, which it does not listen on — the setting "+
+						"reaches nothing", m.Module, port)
+			}
+			reach, ok := value.(string)
+			if !ok || !slices.Contains(reaches, reach) {
+				return nil, fmt.Errorf("%s says port %d reaches %v; a reach is %s",
+					m.Module, port, value, strings.Join(reaches, ", "))
+			}
+			if _, both := exposed[port]; both {
+				return nil, fmt.Errorf(
+					"%s sets both %s and %s for port %d. They say the same thing in different "+
+						"words, and the filter would follow one while its names followed the other "+
+						"— which is what %s exists to stop. Keep %s",
+					m.Module, mcat.ReachSetting, mcat.ExposeSetting, port, mcat.ReachSetting, mcat.ReachSetting)
+			}
+			out[port] = reach
+		}
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// spokenEndpoints is what a module's endpoints are called, as a refusal lists them — so a reader who
+// named one wrongly is one edit from right, and a module that has named none is told so.
+func spokenEndpoints(m mcat.Manifest) string {
+	names := make([]string, 0, len(m.Listens))
+	for _, l := range m.Listens {
+		if name := strings.TrimSpace(l.Name); name != "" {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return "no endpoints by name"
+	}
+	sort.Strings(names)
+	return strings.Join(names, ", ")
+}
diff --git a/internal/compose/resolution/filtering_test.go b/internal/compose/resolution/filtering_test.go
new file mode 100644
index 0000000..e8976c1
--- /dev/null
+++ b/internal/compose/resolution/filtering_test.go
@@ -0,0 +1,379 @@
+package resolution
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A machine that has not said which links face outside is sent no filter, and the refusal names the
+// module that would have loaded it so the reader knows what is being withheld.
+func TestAMachineThatNamedNoOutwardLinkIsSentNoFilter(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{
+		{Module: "nftables", Filtering: &mcat.Filtering{Into: "/etc/mesh/filter.nft"}},
+		{Module: "web", Listens: []mcat.Listening{{Port: 443, From: mcat.FromEverywhere}}},
+	}}
+	_, err := Declaration(r, mcat.Rendering{Mesh: []string{"198.51.100.2"}, TunnelInterface: "mesh0"})
+	if err == nil {
+		t.Fatal("a machine that named no outward link was sent a filter written around none")
+	}
+	for _, want := range []string{"anchor", "nftables", "face outside"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal does not say %q: %v", want, err)
+		}
+	}
+}
+
+// And a machine that names none but loads no filter is not refused: there is nothing to write.
+func TestAMachineWithNoFilterModuleIsNotRefused(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{
+		{Module: "web", Listens: []mcat.Listening{{Port: 443, From: mcat.FromEverywhere}}},
+	}}
+	if _, err := Declaration(r, mcat.Rendering{Mesh: []string{"198.51.100.2"}}); err != nil {
+		t.Fatalf("a machine that loads no filter was refused one: %v", err)
+	}
+}
+
+// The rule set is the machine's, not the asking module's.
+func TestTheModuleAskingForTheRuleSetGetsEveryModulesPorts(t *testing.T) {
+	r := mcat.Resolution{Modules: []mcat.Manifest{
+		{Module: "firewall", Filtering: &mcat.Filtering{Into: "/etc/mesh/filter.nft"}},
+		{Module: "web", Listens: []mcat.Listening{{Port: 443, From: mcat.FromEverywhere}}},
+	}}
+	out, err := Declaration(r, mcat.Rendering{Mesh: []string{"198.51.100.2"},
+		OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"})
+	if err != nil {
+		t.Fatalf("declaration: %v", err)
+	}
+	var content string
+	for _, res := range out {
+		if res["path"] == "/etc/mesh/filter.nft" {
+			content, _ = res["content"].(string)
+		}
+	}
+	if content == "" {
+		t.Fatal("the module that asked for the rule set did not receive one")
+	}
+	if !strings.Contains(content, "dport 443 accept") {
+		t.Fatalf("the rule set holds only the asking module's ports:\n%s", content)
+	}
+}
+
+// The host does not sort, so the order the mesh writes is the order a machine applies.
+//
+// A module's service or container routinely depends on a file the mesh computed — a certificate,
+// a credential, a rule set. Written after the service, the service is applied first, fails, and
+// the next reconcile fixes it. A fault that repairs itself on the second attempt is worse than one
+// that does not: what gets remembered is that it works.
+func TestWhatTheMeshComputesIsAppliedBeforeWhatTheModuleDeclared(t *testing.T) {
+	r := mcat.Resolution{Modules: []mcat.Manifest{{
+		Module:    "firewall",
+		Filtering: &mcat.Filtering{Into: "/etc/nftables.conf"},
+		Resources: []map[string]any{
+			{"id": "load", "type": "service", "unit": "nftables.service", "state": "running",
+				"restart-on": []any{"filtering"}},
+		},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{Mesh: []string{"198.51.100.2"},
+		OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"})
+	if err != nil {
+		t.Fatalf("declaration: %v", err)
+	}
+	var order []string
+	for _, res := range out {
+		order = append(order, fmt.Sprint(res["id"]))
+	}
+	if len(order) != 2 {
+		t.Fatalf("expected the rule set and the service, got %v", order)
+	}
+	if order[0] != "firewall.filtering" {
+		t.Fatalf("the service is applied before the file it reflects: %v", order)
+	}
+}
+
+// The same, for a module whose resources are computed elsewhere — that branch replaces the
+// module's resources wholesale, and merging in the wrong place would throw away its credentials.
+func TestAComputedModuleStillGetsWhatTheMeshMadeForIt(t *testing.T) {
+	r := mcat.Resolution{Modules: []mcat.Manifest{{
+		Module: "networking", Computed: "mesh-network",
+		OwnSecrets: mcat.OwnSecrets{"key": {Path: "/var/lib/mesh/key"}},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{
+		Needed:     map[string]map[string]string{"networking": {"key": "sealed"}},
+		Generators: map[string]mcat.Generator{"mesh-network": computedOnce{}},
+	})
+	if err != nil {
+		t.Fatalf("declaration: %v", err)
+	}
+	var ids []string
+	for _, res := range out {
+		ids = append(ids, fmt.Sprint(res["id"]))
+	}
+	if len(ids) == 0 || ids[0] != "networking."+mcat.NeedID("key") {
+		t.Fatalf("a computed module lost the secret the mesh made for it, or applies it late: %v", ids)
+	}
+}
+
+type computedOnce struct{}
+
+func (computedOnce) Resources(string) ([]map[string]any, bool, error) {
+	return []map[string]any{{"id": "wg", "type": "file", "path": "/etc/wireguard/wg0.conf",
+		"content": "x", "mode": "0600"}}, true, nil
+}
+
+// A consumer bound to something answered on its own machine still has to be told where it is.
+//
+// The location is a fact nobody needs — "it is here" — and everything beside it is not: the
+// binding carries what the provider said a consumer must know, which is the port. A build machine
+// sharing a node with the registry it pushes to sat in a loop saying it could not read its own
+// binding, because none was written.
+func TestSomethingAnsweredOnThisMachineIsStillBound(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "anchor", At: "anchor.internal",
+		Modules: []mcat.Manifest{
+			{Module: "registry", Provides: []mcat.Offer{{Name: "artifact-store", Scope: mcat.ScopeMesh}},
+				Serves: map[string]map[string]any{"artifact-store": {"port": 5000}}},
+			{Module: "builder", Requires: []string{"artifact-store"},
+				Binds: map[string]string{"artifact-store": "/var/lib/builder/store.json"}},
+		},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("declaration: %v", err)
+	}
+	var content string
+	for _, res := range out {
+		if res["path"] == "/var/lib/builder/store.json" {
+			content, _ = res["content"].(string)
+		}
+	}
+	if content == "" {
+		t.Fatal("nothing was written, so the consumer cannot find a provider on its own machine")
+	}
+	if !strings.Contains(content, "5000") {
+		t.Fatalf("the binding does not carry the port, which is the part nobody can guess:\n%s", content)
+	}
+	if !strings.Contains(content, "anchor.internal") {
+		t.Fatalf("the binding does not say where to reach it:\n%s", content)
+	}
+}
+
+// And a machine not on the private network still reaches itself.
+func TestAMachineOffTheNetworkIsBoundToItselfByAnAddressThatWorks(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "alone",
+		Modules: []mcat.Manifest{
+			{Module: "registry", Provides: []mcat.Offer{{Name: "artifact-store", Scope: mcat.ScopeMesh}},
+				Serves: map[string]map[string]any{"artifact-store": {"port": 5000}}},
+			{Module: "builder", Requires: []string{"artifact-store"},
+				Binds: map[string]string{"artifact-store": "/var/lib/builder/store.json"}},
+		},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("declaration: %v", err)
+	}
+	for _, res := range out {
+		if res["path"] != "/var/lib/builder/store.json" {
+			continue
+		}
+		content, _ := res["content"].(string)
+		if !strings.Contains(content, "127.0.0.1") {
+			t.Fatalf("bound by a name nothing on this machine resolves:\n%s", content)
+		}
+		return
+	}
+	t.Fatal("nothing was written")
+}
+
+// cannotSay is a generator that does not know what a machine opens.
+type cannotSay struct{}
+
+func (cannotSay) Resources(string) ([]map[string]any, bool, error) { return nil, true, nil }
+
+func (cannotSay) Listens(string) ([]mcat.Listening, error) {
+	return nil, errors.New("this machine's endpoint has no port in it")
+}
+
+// A generator that cannot say is refused, not read as silence.
+//
+// Closing a port on the evidence of a failure to look is how a machine is severed by a fault
+// somewhere else entirely — and the machine it would sever is the hub.
+func TestAGeneratorThatCannotSayRefusesTheRuleSet(t *testing.T) {
+	_, err := Filtering(mcat.Resolution{Node: "anchor",
+		Modules: []mcat.Manifest{{Module: "networking", Computed: "mesh-network"}},
+	}, map[string]mcat.Generator{"mesh-network": cannotSay{}}, nil, nil)
+	if err == nil {
+		t.Fatal("a machine whose open ports could not be computed was given a rule set anyway")
+	}
+	if !strings.Contains(err.Error(), "anchor") {
+		t.Fatalf("the refusal does not name the machine: %v", err)
+	}
+}
+
+// A module may reflect a file another module put on the machine.
+//
+// The case this exists for: a resolver restarting when the mesh rewrites the names. Those are
+// computed by the mesh and belong to its module, not to the daemon's — so without this the
+// daemon would serve the names it started with for ever, while every check reported success.
+func TestAServiceCanReflectAnotherModulesFile(t *testing.T) {
+	out, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+		Module: "dnsmasq",
+		Resources: []map[string]any{
+			{"id": "config", "type": "file", "path": "/etc/dnsmasq.conf",
+				"content": "x", "mode": "0644"},
+			{"id": "run", "type": "service", "unit": "dnsmasq.service", "state": "running",
+				"restart-on": []any{"config", "mesh-resolver.nodes"}},
+		},
+	}}}, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if r["type"] != "service" {
+			continue
+		}
+		reflects := r["restart-on"].([]any)
+		var own, other bool
+		for _, id := range reflects {
+			switch id.(string) {
+			case "dnsmasq.config":
+				own = true
+			case "mesh-resolver.nodes":
+				other = true
+			}
+		}
+		if !own {
+			t.Fatalf("its own file was not prefixed with its module: %v", reflects)
+		}
+		if !other {
+			t.Fatalf("a file it named in full was prefixed again and now points at nothing: %v",
+				reflects)
+		}
+		return
+	}
+	t.Fatal("no service in the declaration")
+}
+
+// What answers a requirement is applied before what asked for it.
+//
+// The host does not sort, so the order written here is the order a machine applies. Selection
+// walks outward from what was assigned, which puts a consumer first — and a service that reads a
+// file another module writes then starts before the file exists, fails, and is fixed by the next
+// reconcile. That is the worst shape a fault can take: what gets remembered is that it works.
+func TestWhatAnsweredARequirementIsAppliedFirst(t *testing.T) {
+	got, err := Resolve(map[string]mcat.Manifest{
+		"dnsmasq": {Module: "dnsmasq", Requires: []string{"resolver-data"}},
+		"data":    {Module: "data", Provides: []mcat.Offer{{Name: "resolver-data"}}},
+	}, []string{"dnsmasq"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Modules[0].Module != "data" {
+		t.Fatalf("the consumer is applied before what it requires: %v", named(got))
+	}
+}
+
+// Through a chain, not only one step: a machine applies what the thing it needs needs, first.
+func TestAChainOfRequirementsIsAppliedFromTheBottom(t *testing.T) {
+	got, err := Resolve(map[string]mcat.Manifest{
+		"top":    {Module: "top", Requires: []string{"middle-thing"}},
+		"middle": {Module: "middle", Provides: []mcat.Offer{{Name: "middle-thing"}}, Requires: []string{"bottom-thing"}},
+		"bottom": {Module: "bottom", Provides: []mcat.Offer{{Name: "bottom-thing"}}},
+	}, []string{"top"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	order := named(got)
+	if order[0] != "bottom" || order[1] != "middle" || order[2] != "top" {
+		t.Fatalf("a chain was not applied from the bottom: %v", order)
+	}
+}
+
+// Modules with no relation keep the order selection gave them — assigned first, then what they
+// pulled in. A sort that reshuffled unrelated modules would make every declaration's diff
+// unreadable for no gain.
+func TestUnrelatedModulesKeepTheirOrder(t *testing.T) {
+	got, err := Resolve(map[string]mcat.Manifest{
+		"one":   {Module: "one"},
+		"two":   {Module: "two"},
+		"three": {Module: "three"},
+	}, []string{"one", "two", "three"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	order := named(got)
+	if order[0] != "one" || order[1] != "two" || order[2] != "three" {
+		t.Fatalf("unrelated modules were reshuffled: %v", order)
+	}
+}
+
+// Two modules requiring each other are both applied rather than refused: a cycle here is not a
+// machine that cannot work, and refusing would make a cooperating pair impossible to assign.
+func TestTwoModulesRequiringEachOtherAreStillApplied(t *testing.T) {
+	got, err := Resolve(map[string]mcat.Manifest{
+		"a": {Module: "a", Provides: []mcat.Offer{{Name: "from-a"}}, Requires: []string{"from-b"}},
+		"b": {Module: "b", Provides: []mcat.Offer{{Name: "from-b"}}, Requires: []string{"from-a"}},
+	}, []string{"a"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Modules) != 2 {
+		t.Fatalf("a cooperating pair was not applied: %v", named(got))
+	}
+}
+
+func named(r mcat.Resolution) []string {
+	var out []string
+	for _, m := range r.Modules {
+		out = append(out, m.Module)
+	}
+	return out
+}
+
+// A port's source is a per-node setting, not a manifest constant: the same module is internal on
+// one machine and public on another (novox/hq ADR 0046). postgres listens from the mesh by default;
+// a setting on one node exposes it to anywhere, and the rule set follows.
+func TestExposureSettingOverridesAListensSource(t *testing.T) {
+	postgres := mcat.Manifest{Module: "postgres", Version: "1",
+		Listens: []mcat.Listening{{Port: 5432, From: mcat.FromMesh, Why: "the database"}}}
+
+	base, err := Filtering(mcat.Resolution{Node: "ace", Modules: []mcat.Manifest{postgres}}, nil, nil, nil)
+	if err != nil {
+		t.Fatalf("filtering: %v", err)
+	}
+	if len(base) != 1 || base[0].From != mcat.FromMesh {
+		t.Fatalf("without a setting, the default source is the mesh: %+v", base)
+	}
+
+	expose := map[string]map[int]string{"postgres": {5432: mcat.FromEverywhere}}
+	exposed, err := Filtering(mcat.Resolution{Node: "novox", Modules: []mcat.Manifest{postgres}}, nil, nil, expose)
+	if err != nil {
+		t.Fatalf("filtering: %v", err)
+	}
+	if len(exposed) != 1 || exposed[0].From != mcat.FromEverywhere {
+		t.Fatalf("the setting did not open the port to anywhere: %+v", exposed)
+	}
+}
+
+// Exposure refuses a setting that names a port the module does not listen on, or a source that is
+// not a real one — a setting reaching nothing is worse than none (novox/hq ADR 0043/0046).
+func TestExposureRefusesAPortNotListenedOnAndABadSource(t *testing.T) {
+	postgres := mcat.Manifest{Module: "postgres", Listens: []mcat.Listening{{Port: 5432, From: mcat.FromMesh}}}
+	layer := func(port, source string) []mcat.Layer {
+		return []mcat.Layer{{From: "node", Placement: map[string]any{mcat.ExposeSetting: map[string]any{port: source}}}}
+	}
+
+	if _, err := Exposure(postgres, layer("5432", mcat.FromEverywhere)); err != nil {
+		t.Fatalf("a valid exposure was refused: %v", err)
+	}
+	if _, err := Exposure(postgres, layer("6379", mcat.FromEverywhere)); err == nil {
+		t.Error("a port the module does not listen on was accepted")
+	}
+	if _, err := Exposure(postgres, layer("5432", "everyone")); err == nil {
+		t.Error("a source that is not mesh/anywhere/machine was accepted")
+	}
+}
diff --git a/internal/compose/resolution/foundation_manifests_test.go b/internal/compose/resolution/foundation_manifests_test.go
new file mode 100644
index 0000000..515f171
--- /dev/null
+++ b/internal/compose/resolution/foundation_manifests_test.go
@@ -0,0 +1,270 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// The catalogue's foundation modules as they are — in a merge check the catalogue cloned beside it,
+// elsewhere the copy captured in testdata/beside (internal/beside, novox/hq issue 432) — parsed by the
+// real parser (novox/hq ADR 0100):
+// the store and the broker say which of their ports the mesh guards on an adopted node, and the
+// filter module loads its table through a unit of its own whose stop deletes only that table.
+// moduleTree is where a module is read from: the catalogue beside, with the catalogue as the root. In
+// mesh-controller it first looked in the repository's own modules/<module>, where build-agent and
+// route-proxy live whole (novox/hq ADR 0420 §1, issue 1019); mesh-sdk has no such directory, and the
+// tests that read those two modules stay in mesh-controller (issue 1379).
+func moduleTree(t *testing.T, module string) (root, dir string) {
+	t.Helper()
+	return beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), module)
+}
+
+func catalogueManifest(t *testing.T, module string) mcat.Manifest {
+	t.Helper()
+	root, dir := moduleTree(t, module)
+	m, err := mcat.ReadTreeManifest(root, dir)
+	if err != nil {
+		t.Fatalf("%s does not parse:\n%v", module, err)
+	}
+	return m
+}
+
+func TestTheForgesPortIsGivenLikeAnyOtherProvidersPort(t *testing.T) {
+	forge := catalogueManifest(t, "gitea")
+
+	// The catalogue's number is a default and the node's setting moves it.
+	given, err := GivenPorts(forge, []mcat.Layer{{From: "anchor",
+		Placement: map[string]any{mcat.PortsSetting: map[string]any{"3000": float64(3100)}}}})
+	if err != nil {
+		t.Fatalf("the forge's port cannot be given on a node: %v", err)
+	}
+	if given[3000] != 3100 {
+		t.Fatalf("the forge was given %v", given)
+	}
+
+	// And every consumer of the package registry is told where the machine actually put it,
+	// because that is read from what the forge serves rather than written in the consumer.
+	if got := ServedOn(forge, "npm-package-registry", given)["port"]; got != 3100 {
+		t.Errorf("the package registry is served on %v, not the port this node gave it", got)
+	}
+	if got := ServedOn(forge, "npm-package-registry", nil)["port"]; got != float64(3000) {
+		t.Errorf("without a setting the forge serves %v, not the catalogue's port", got)
+	}
+	// And so is where a repository on it is cloned from (novox/hq ADR 0111), for the same reason:
+	// a build composes the URL from what the forge serves, so a given port is a followed port.
+	if got := ServedOn(forge, "git", given)["port"]; got != 3100 {
+		t.Errorf("git is served on %v, not the port this node gave the forge", got)
+	}
+}
+
+// The forge holds the seats it answers for (novox/hq ADR 0110, 0111), parsed by the real parser —
+// which refuses a delivering seat claimed by a module that does not provide what it delivers.
+func TestTheForgeHoldsTheNpmAndGitSeats(t *testing.T) {
+	forge := catalogueManifest(t, "gitea")
+	holds := map[string]bool{}
+	for _, c := range forge.Claims {
+		holds[c.Name] = true
+	}
+	for _, seat := range []string{"npm-package-registry", "git"} {
+		if !holds[seat] {
+			t.Errorf("gitea does not claim the %s seat: %+v", seat, forge.Claims)
+		}
+	}
+	git := ServedOn(forge, "git", nil)
+	if git["scheme"] != "http" || git["port"] != float64(3000) {
+		t.Errorf("gitea serves nothing a clone URL can be composed from: %v", git)
+	}
+	npm := ServedOn(forge, "npm-package-registry", nil)
+	if npm["npm-path"] != "/api/packages/novox/npm/" {
+		t.Errorf("gitea no longer says where its npm registry is: %v", npm)
+	}
+}
+
+// **And the forge's own address follows it**, composed from the manifest in the catalogue beside
+// this checkout (novox/hq 04-ISSUES/088).
+//
+// The forge is reached a third way that neither test above covers: by its own code, over the
+// machine's loopback, told where to go in its environment. The `2999:3000` mapping that lets the
+// forge go on binding 3000 does nothing for a caller dialling the machine — so a literal there is
+// wrong on every node whose assignment differs, and wrong for a second reason on a node given the
+// port (ADR 0100). Composed through the whole path, because what proves the placeholder resolves
+// in an `env` at all is a declaration, not a manifest.
+func TestTheForgesOwnAddressFollowsThePortTheNodeGaveIt(t *testing.T) {
+	forge, err := catalogueManifest(t, "gitea").Resolve(forgeBuilt(catalogueManifest(t, "gitea")))
+	if err != nil {
+		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
+	}
+	r := mcat.Resolution{Node: "anchor", Account: "op", PublicDomain: "example.org",
+		Modules: []mcat.Manifest{forge, theRuntime(t)}, Needs: []mcat.Needed{
+			{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
+				Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
+			{Name: "route", For: "gitea", From: "anchor"},
+			{Name: "secret", For: "gitea", From: "anchor", Local: "internal-token", Sealed: "sealed-token"},
+			{Name: "secret", For: "gitea", From: "anchor", Local: "admin", Sealed: "sealed-admin"},
+		}}
+
+	// The number this node was given for the forge — the one the machine it is about to run on
+	// already publishes.
+	out, err := Declaration(r, mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-broker"}},
+		Given:  map[string]map[int]int{"gitea": {3000: 2999}},
+	})
+	if err != nil {
+		t.Fatalf("the forge does not compose: %v", err)
+	}
+
+	// What the machine publishes, and what the forge's sidecar is told to dial: one number.
+	server := fileNamed(out, "gitea.server")
+	if server == nil {
+		t.Fatalf("the forge's own container is not in the declaration: %v", out)
+	}
+	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "2999:3000") {
+		t.Fatalf("the forge is not published on the port this node gave it: %v", server["ports"])
+	}
+	// The forge's own code runs in the node's runtime (novox/hq ADR 0198), given its words there.
+	runtime := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	if runtime == nil {
+		t.Fatalf("the node's runtime is not in the declaration: %v", ids(out))
+	}
+	env, _ := runtime["env"].(map[string]string)
+	var given map[string]map[string]string
+	if err := json.Unmarshal([]byte(env[mcat.RuntimeToolEnv]), &given); err != nil {
+		t.Fatalf("the runtime's %s is not JSON: %q", mcat.RuntimeToolEnv, env[mcat.RuntimeToolEnv])
+	}
+	if given["gitea"]["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
+		t.Fatalf("the forge's code dials %v while the machine publishes the forge on 2999 — "+
+			"whatever reads it dials a dead port", given["gitea"]["MESH_GITEA_URL"])
+	}
+}
+
+// gitea's own sshd is unmodified — the module's own internal port is 22, the number in
+// `listens`, the same convention every other module in the catalogue uses (its internal port,
+// not an invented identity). Composed from the manifest in the catalogue beside this checkout,
+// because what the mesh publishes is a fact about what the module actually writes.
+func declaredGiteaSsh(t *testing.T, given map[int]int) map[string]any {
+	t.Helper()
+	forge := catalogueManifest(t, "gitea")
+	resolved, err := forge.Resolve(forgeBuilt(forge))
+	if err != nil {
+		t.Fatalf("the forge's manifest does not resolve against its own build: %v", err)
+	}
+	r := mcat.Resolution{Node: "anchor", Account: "op", PublicDomain: "example.org",
+		Modules: []mcat.Manifest{resolved, theRuntime(t)}, Needs: []mcat.Needed{
+			{Name: "postgres-database", For: "gitea", From: "anchor", At: "127.0.0.1",
+				Serves: map[string]any{"port": float64(5432)}, Sealed: "sealed-db"},
+			{Name: "route", For: "gitea", From: "anchor"},
+			{Name: "secret", For: "gitea", From: "anchor", Local: "internal-token", Sealed: "sealed-token"},
+			{Name: "secret", For: "gitea", From: "anchor", Local: "admin", Sealed: "sealed-admin"},
+		}}
+	givenPorts := map[int]int{3000: 3000}
+	for k, v := range given {
+		givenPorts[k] = v
+	}
+	out, err := Declaration(r, mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-broker"}},
+		Ports:  map[string]map[int]int{"gitea": givenPorts},
+		Given:  map[string]map[int]int{"gitea": given},
+	})
+	if err != nil {
+		t.Fatalf("the forge does not compose: %v", err)
+	}
+	server := fileNamed(out, "gitea.server")
+	if server == nil {
+		t.Fatalf("the forge's own container is not in the declaration: %v", out)
+	}
+	return server
+}
+
+// **The forge publishes ssh at the mesh's own fixed convention by default** (novox/hq ADR 0100).
+//
+// `222` is the mesh's own public convention for the forge's ssh, written directly in the
+// manifest's `ports` — every node the forge has run on used the same number, so it needs no
+// per-node setting to reach it.
+func TestTheForgesSshPortIsTheMeshsFixedConventionByDefault(t *testing.T) {
+	forge := catalogueManifest(t, "gitea")
+	// Nothing was given — no node moved this port — which is the ordinary answer: the mesh only
+	// reports what a setting moved, and the manifest's own `222:22` needs no move to be reached.
+	given, err := GivenPorts(forge, nil)
+	if err != nil {
+		t.Fatalf("the forge's ssh port cannot be given on a node: %v", err)
+	}
+	if len(given) != 0 {
+		t.Fatalf("nothing moved the forge's ssh port, yet it was given %v", given)
+	}
+	server := declaredGiteaSsh(t, given)
+	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "222:22") {
+		t.Fatalf("the forge is published on %v, not its own fixed convention", server["ports"])
+	}
+}
+
+// **A node whose predecessor served git on a different number can still be told to leave it
+// there.** The setting names the port the module itself listens on — 22, gitea's own sshd, the
+// same number `listens` uses — not the mesh's own default machine-side number, so moving it does
+// not require guessing what the manifest happens to default to.
+func TestANodeMayGiveTheForgesSshPortADifferentNumber(t *testing.T) {
+	forge := catalogueManifest(t, "gitea")
+	given, err := GivenPorts(forge, []mcat.Layer{{From: "anchor",
+		Placement: map[string]any{mcat.PortsSetting: map[string]any{"22": float64(9022)}}}})
+	if err != nil {
+		t.Fatalf("the forge's ssh port cannot be moved on a node: %v", err)
+	}
+	if want := map[int]int{22: 9022}; !reflect.DeepEqual(given, want) {
+		t.Fatalf("the forge was given %v, and the setting named %v", given, want)
+	}
+	server := declaredGiteaSsh(t, given)
+	if published := fmt.Sprint(server["ports"]); !strings.Contains(published, "9022:22") ||
+		strings.Contains(published, "222:22") {
+		t.Fatalf("the forge is published on %v, not the port this node gave it", server["ports"])
+	}
+}
+
+// forgeBuilt is a build of every artifact the forge's manifest declares: its code bundle and, since the
+// catalogue added it (novox/hq ADR 0251 §4), its npm registry's. Named from the manifest, so a third
+// artifact does not break every forge test again.
+func forgeBuilt(forge mcat.Manifest) []mcat.Built {
+	var out []mcat.Built
+	for _, a := range forge.Build.Artifacts {
+		out = append(out, mcat.Built{Name: a.Name, Kind: mcat.ArtifactBundle,
+			Reference: mcat.ArtifactStoreScheme + "gitea/" + a.Name + "/blobs/" + bundleDigest, Digest: bundleDigest})
+	}
+	return out
+}
+
+// catalogueResolved is a catalogue module as the mesh holds it once built: the manifest as written, resolved against
+// what the build produced besides the archive its templates are packed into, which carries the text read back from the
+// module's files/ directory as the real build reads it (novox/hq ADR 0349 §2) — so a module whose file text moved into
+// templates composes with it, and one that did not is resolved as it was.
+func catalogueResolved(t *testing.T, module string, built ...mcat.Built) mcat.Manifest {
+	t.Helper()
+	root, dir := moduleTree(t, module)
+	m, err := mcat.ReadTreeManifestWritten(root, dir)
+	if err != nil {
+		t.Fatalf("%s does not parse:\n%v", module, err)
+	}
+	if name := mcat.TemplatesArtifact(m); name != "" {
+		read, err := mcat.ReadTemplates(m, dir)
+		if err != nil {
+			t.Fatalf("%s: %v", module, err)
+		}
+		// By the path inside the archive, as the build reads it back, not by the path in the module's directory.
+		texts := map[string]string{}
+		for path, text := range read {
+			texts[strings.TrimPrefix(path, m.TemplatesDir()+"/")] = text
+		}
+		built = append(built, mcat.Built{Name: name, Kind: mcat.ArtifactArchive,
+			Reference: mcat.ArtifactStoreScheme + module + "/" + name + "/blobs/" + bundleDigest, Digest: bundleDigest,
+			Texts: texts})
+	}
+	held, err := m.Resolve(built)
+	if err != nil {
+		t.Fatalf("%s does not resolve against its own build: %v", module, err)
+	}
+	return held
+}
diff --git a/internal/compose/resolution/generated_collision_test.go b/internal/compose/resolution/generated_collision_test.go
new file mode 100644
index 0000000..cd0c17c
--- /dev/null
+++ b/internal/compose/resolution/generated_collision_test.go
@@ -0,0 +1,81 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func runtimesOwn() mcat.Manifest {
+	return mcat.Manifest{Module: "docker", Resources: []map[string]any{
+		{"id": "daemon", "type": "file", "path": "/etc/docker/daemon.json", "into": "json",
+			"content": `{"live-restore": true}`},
+		{"id": "runtime", "type": "service", "unit": "docker.service", "state": "running",
+			"reload-on": []any{"daemon"}},
+	}}
+}
+
+func TestAGeneratedResourceCollidingWithAModulesIsRefused(t *testing.T) {
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: mcat.Offers("private-network")},
+		runtimesOwn(),
+	}}
+	_, err := Declaration(r, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": reloading{}}})
+	if err == nil {
+		t.Fatal("a generated resource declaring the runtime's file beside the runtime's module was accepted")
+	}
+	for _, want := range []string{"mesh-network", "docker", "/etc/docker/daemon.json", "docker.service"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+func TestAGeneratedResourceBesideAModulesOwnIsComposed(t *testing.T) {
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{
+		{Module: "mesh-network", Computed: "mesh-network", Provides: mcat.Offers("private-network")},
+		runtimesOwn(),
+	}}
+	gen := &fake{on: map[string]bool{"workstation": true}}
+	out, err := Declaration(r, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": gen}})
+	if err != nil {
+		t.Fatalf("disjoint resources were refused: %v", err)
+	}
+	if fileNamed(out, "docker.daemon") == nil {
+		t.Fatalf("the runtime's own file is missing: %v", out)
+	}
+	// And a machine not on the network yet generates nothing, which collides with nothing.
+	if _, err := Declaration(r, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-network": &fake{}}}); err != nil {
+		t.Fatalf("a machine off the network was refused: %v", err)
+	}
+}
+
+// The catalogue's container runtime module states the mesh's registry itself (ADR 0222).
+func TestTheRuntimesModuleTrustsTheMeshsRegistry(t *testing.T) {
+	docker := catalogueManifest(t, "docker")
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{docker}}
+	out, err := Declaration(r, mcat.Rendering{
+		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	daemon := fileNamed(out, "docker.daemon")
+	if daemon == nil || daemon["into"] != "json" {
+		t.Fatalf("the runtime's file is not written into: %v", daemon)
+	}
+	content, _ := daemon["content"].(string)
+	if !strings.Contains(content, `"insecure-registries": ["anchor.internal:5100"]`) ||
+		!strings.Contains(content, `"live-restore": true`) {
+		t.Fatalf("the runtime's file says %q", content)
+	}
+
+	out, err = Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if content, _ := fileNamed(out, "docker.daemon")["content"].(string); strings.Contains(content, "insecure-registries") {
+		t.Fatalf("with no store on the network, the runtime is told %q", content)
+	}
+}
diff --git a/internal/compose/resolution/grant_secret_owner_test.go b/internal/compose/resolution/grant_secret_owner_test.go
new file mode 100644
index 0000000..37f1142
--- /dev/null
+++ b/internal/compose/resolution/grant_secret_owner_test.go
@@ -0,0 +1,105 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// aProviderWithABundle is a provider whose code is a bundle the node's runtime runs — the shape
+// every TypeScript provisioner has since ADR 0198.
+func aProviderWithABundle() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "mongodb", Version: "1",
+		Provides: mcat.FromAnywhere("mongodb-database"),
+		Receives: map[string]string{"mongodb-database": "/var/lib/mongodb/grants/mesh.json"},
+		Grants:   map[string]string{"mongodb-database": "/var/lib/mongodb/grants"},
+		Bundles:  []mcat.Bundle{{Name: "code", Language: "typescript"}},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "mongodb-server",
+			"image": "mongo@sha256:" + strings.Repeat("a", 64),
+		}},
+	}
+}
+
+func TestAGrantSecretIsOwnedByTheAccountThatProvisions(t *testing.T) {
+	r, err := Resolve(shelf(aProviderWithABundle()), []string{"mongodb"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "operator"
+	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
+		Values: map[string]any{}, Sealed: "c2VhbGVk",
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var secret map[string]any
+	for _, res := range out {
+		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
+			secret = res
+		}
+	}
+	if secret == nil {
+		t.Fatalf("no grant secret was composed at all: %v", out)
+	}
+	if got := secret["owner"]; got != "operator" {
+		t.Fatalf("the grant secret at %v belongs to %v; the provisioner runs as %q and a "+
+			"root-owned 0600 file is one it cannot read — which is silent, because the harness "+
+			"calls it \"not readable yet\"", fmtPath(secret), got, "operator")
+	}
+	// A grant whose offer presents no credential (form none, issue 1126) carries nothing sealed: no secret file is
+	// written for it, as none is for a need with no credential, and the provider still learns who asked.
+	out, err = Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos", Values: map[string]any{}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	asked := false
+	for _, res := range out {
+		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
+			t.Errorf("a grant with no credential writes %v", res)
+		}
+		asked = asked || fmtPath(res) == "/var/lib/mongodb/grants/mesh.json"
+	}
+	if !asked {
+		t.Errorf("the provider no longer learns who asked: %v", out)
+	}
+}
+
+// And a provider whose code still runs in a container keeps the owner it declares, so this
+// changes nothing for the modules the runtime has not taken.
+func TestAContainerProvidersGrantSecretKeepsItsDeclaredOwner(t *testing.T) {
+	m := aProviderWithABundle()
+	m.Bundles = nil
+	m.SecretsOwner = "65534:65534"
+	r, err := Resolve(shelf(m), []string{"mongodb"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "operator"
+	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
+		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
+		Values: map[string]any{}, Sealed: "c2VhbGVk",
+	}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range out {
+		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
+			if got := res["owner"]; got != "65534:65534" {
+				t.Fatalf("a container provider's grant secret belongs to %v, not what it declares", got)
+			}
+			return
+		}
+	}
+	t.Fatal("no grant secret was composed")
+}
+
+func fmtPath(r map[string]any) string {
+	p, _ := r["path"].(string)
+	return p
+}
diff --git a/internal/compose/resolution/graphical_session.go b/internal/compose/resolution/graphical_session.go
new file mode 100644
index 0000000..059d9fd
--- /dev/null
+++ b/internal/compose/resolution/graphical_session.go
@@ -0,0 +1,228 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// graphicalSessionSeats are the eleven, in the order ADR 0208's table reads, each with the verbs
+// research 026/05 starts it with. Three have none yet: the bar (which receives blocks instead,
+// ADR 0255), the compositor and the secret
+// service are roles a second holder competes for, and nothing has needed to ask them anything.
+func graphicalSessionSeats() []mcat.Seat {
+	const decided = "novox/hq ADR 0208"
+	return []mcat.Seat{
+		{Name: mcat.LoginManagerSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "sessions", Description: "The sessions the login manager offers on this machine, and which " +
+				"one the operator account starts by default.",
+				Input: schema(map[string]string{}, nil)},
+		}},
+		{Name: mcat.DisplayServerSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "displays", Description: "The monitors connected now, each with its identity, its modes and " +
+				"where it is placed; and the layout profile in force, if one matches.",
+				Input: schema(map[string]string{}, nil)},
+			// Profiles are keyed by the monitors' identities and are the operator's data (ADR 0208 §6).
+			{Name: "layout", Description: "The monitor layout profiles, keyed by the connected monitors' " +
+				"identities: list them, save the current arrangement under a name, or apply one.",
+				Input: withEnum(schema(map[string]string{
+					"action": "list, save or apply",
+					"name":   "the profile to save or apply (save and apply only)",
+				}, []string{"action"}), "action", "list", "save", "apply")},
+		}},
+		// It receives window-manager configuration lines from every other module (novox/hq ADR 0212):
+		// bindings, start-up commands, rules — placed by the session's holder, never written into
+		// its directory by the contributor.
+		{Name: mcat.DisplaySessionSeat, Scope: mcat.ScopeNode, Decision: decided,
+			Receives: []mcat.Receivable{{Kind: "config", Comment: "#"}}, Serves: []mcat.Verb{
+				{Name: "reload", Description: "Reload the session's configuration in place, keeping its windows.",
+					Input: schema(map[string]string{}, nil)},
+				{Name: "workspaces", Description: "The session's workspaces: each one's name, output, and whether " +
+					"it is visible or focused.",
+					Input: schema(map[string]string{}, nil)},
+				{Name: "windows", Description: "The session's windows: each one's title, class, workspace and " +
+					"whether it has focus; narrowed to one workspace when named.",
+					Input: schema(map[string]string{"workspace": "one workspace (optional)"}, nil)},
+			}},
+		{Name: mcat.TerminalEmulatorSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "open", Description: "Open a terminal window in the operator's session, running a command " +
+				"or the login shell, in a directory or the account's home.",
+				Input: schema(map[string]string{
+					"command":   "what to run in it (optional; the login shell when absent)",
+					"directory": "where it starts (optional; the account's home when absent)",
+				}, nil)},
+		}},
+		{Name: mcat.LauncherSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "menu", Description: "Put a menu of choices in front of the operator and answer with the " +
+				"one chosen, or nothing when the menu was dismissed — the dmenu-compatible contract.",
+				Input: map[string]any{"type": "object", "required": []string{"choices"},
+					"properties": map[string]any{
+						"choices": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+							"description": "the lines to choose between, in order"},
+						"prompt": map[string]any{"type": "string", "description": "what the menu asks (optional)"},
+					}}},
+			// A value the operator types and nobody sees (novox/hq ADR 0259 §10): a hidden prompt whose answer
+			// is sealed to the asker's key, so it is never plaintext on the bus or in any call's record.
+			// **Optional while its holders catch up** (ADR 0246): rofi serves it once this is live.
+			{Name: "secret", Optional: true, Description: "Ask the operator for a value in a prompt that " +
+				"does not show what is typed, and answer it sealed to the key the asker gives — never in " +
+				"the clear — or cancelled when the prompt was dismissed or not answered in time.",
+				// By name, never by words (the review of 2026-10-09, M4): the holder writes the prompt from the
+				// module, the secret and the machine, and says the controller asks — the bus lets nobody else
+				// ask it (broker.ControllerOnly) — so no caller puts words of its own before the operator.
+				Input: schema(map[string]string{
+					"module":          "the module whose own secret is asked for",
+					"secret":          "the own secret's name",
+					"node":            "the machine the module runs on",
+					"seal_to":         "the asker's public sealing key: the answer is sealed to it",
+					"timeout_seconds": "give up after this long (optional)",
+				}, []string{"module", "secret", "node", "seal_to"})},
+		}},
+		{Name: mcat.NotifierSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "send", Description: "Show the operator a notification.",
+				Input: withEnum(schema(map[string]string{
+					"title":   "the notification's summary",
+					"body":    "its text (optional)",
+					"urgency": "low, normal (the default) or critical",
+				}, []string{"title"}), "urgency", "low", "normal", "critical")},
+			{Name: "history", Description: "The notifications shown lately, newest first.",
+				Input: schema(map[string]string{"limit": "how many (optional, default 20)"}, nil)},
+		}},
+		{Name: mcat.LockScreenSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "lock", Description: "Lock the operator's session now.",
+				Input: schema(map[string]string{}, nil)},
+		}},
+		{Name: mcat.ClipboardSeat, Scope: mcat.ScopeNode, Decision: decided, Serves: []mcat.Verb{
+			{Name: "history", Description: "What the clipboard held lately, newest first.",
+				Input: schema(map[string]string{"limit": "how many (optional, default 20)"}, nil)},
+			{Name: "copy", Description: "Put text on the operator's clipboard.",
+				Input: schema(map[string]string{"text": "the text"}, []string{"text"})},
+		}},
+		// It receives blocks as data (novox/hq ADR 0255): what a block shows, said for any bar, which
+		// the holder renders in its own grammar. A module that knows something about the machine — the
+		// power module its battery — gives the block; the bar knows no machine's hardware.
+		{Name: mcat.BarSeat, Scope: mcat.ScopeNode, Decision: decided,
+			Receives: []mcat.Receivable{{Kind: mcat.BarKindBlock, Comment: "#", Offered: true, Shape: barBlockShape()}}},
+		{Name: mcat.CompositorSeat, Scope: mcat.ScopeNode, Decision: decided},
+		{Name: mcat.SecretServiceSeat, Scope: mcat.ScopeNode, Decision: decided},
+	}
+}
+
+// withEnum narrows one string property of a schema to the values it may take, so a caller is told
+// the choices by the schema rather than by a refusal.
+func withEnum(s map[string]any, property string, values ...string) map[string]any {
+	props := s["properties"].(map[string]any)
+	p := props[property].(map[string]any)
+	p["enum"] = values
+	return s
+}
+
+// barShows is what a contributed block may show, and the options each takes — the bar-neutral
+// vocabulary every holder of node-bar renders. A new entry is a decision, and every holder's template
+// renders it (the shape's examples) before it is accepted.
+var barShows = map[string]map[string]barOption{
+	// The machine's battery: its charge, and how long it lasts or takes to fill.
+	"battery": {"device": {kind: "text"}},
+	// One line a command prints, run every interval seconds: what the bar cannot know itself.
+	"command": {"command": {kind: "text", required: true}, "interval": {kind: "seconds", required: true}},
+	// A value the contributor keeps on the bus (novox/hq ADR 0255): its state `<module>.<name>` and the
+	// key, this machine's name when absent. The value is an object whose `text` is what is shown. The
+	// holder is granted to read it and shows it however its bar shows a changing value; no file and
+	// no command passes between the two modules.
+	"state": {"state": {kind: "text", required: true}, "key": {kind: "text"}},
+}
+
+// barBlockReads is the state and key a block shows, if any; an empty key is the machine's own.
+func barBlockReads(data map[string]any) []mcat.StateRead {
+	if data["shows"] != "state" {
+		return nil
+	}
+	options, _ := data["options"].(map[string]any)
+	s, ok := options["state"].(string)
+	if !ok || s == "" {
+		return nil
+	}
+	key, _ := options["key"].(string)
+	return []mcat.StateRead{{Read: s, Key: key}}
+}
+
+type barOption struct {
+	kind     string // text, or seconds (a whole number from 1 to 86400)
+	required bool
+}
+
+// barBlockShape is the shape of a block (novox/hq ADR 0255): which bar, where on it, in what order,
+// what it shows, and that kind's options.
+//
+//   - bar: top or bottom;
+//   - place: resources (beside the processor, memory and disks) or status (beside the sound, before the
+//     clock) — the two places every holder keeps for contributed blocks;
+//   - order: 0–99 within the place, 50 when absent;
+//   - shows: battery or command; options: what that kind takes.
+func barBlockShape() *mcat.Shape {
+	return &mcat.Shape{
+		Text: true,
+		Places: []mcat.PlaceField{{Field: "bar", Values: []string{"bottom", "top"}},
+			{Field: "place", Values: []string{"resources", "status"}}},
+		Order: "order",
+		Check: barBlockProblems,
+		Reads: barBlockReads,
+		Examples: []map[string]any{
+			{"bar": "bottom", "place": "status", "shows": "battery"},
+			{"bar": "bottom", "place": "status", "shows": "battery", "options": map[string]any{"device": "BAT0"}},
+			{"bar": "bottom", "place": "status", "shows": "command",
+				"options": map[string]any{"command": "echo \"a line\"", "interval": float64(5)}},
+			{"bar": "bottom", "place": "status", "shows": "state", "options": map[string]any{"state": "power.draw"}},
+			{"bar": "bottom", "place": "status", "shows": "state",
+				"options": map[string]any{"state": "power.draw", "key": "a-machine"}},
+		},
+	}
+}
+
+func barBlockProblems(data map[string]any) []string {
+	var problems []string
+	for field := range data {
+		if !oneOf([]string{"bar", "place", "order", "shows", "options"}, field) {
+			problems = append(problems, fmt.Sprintf("a block has no field %q; it has bar, place, order, shows and options", field))
+		}
+	}
+	shows, _ := data["shows"].(string)
+	takes, known := barShows[shows]
+	if !known {
+		return append(problems, fmt.Sprintf("a block shows %v; it shows one of %s", data["shows"],
+			strings.Join(sortedKeys(barShows), ", ")))
+	}
+	options := map[string]any{}
+	if raw, has := data["options"]; has {
+		o, ok := raw.(map[string]any)
+		if !ok {
+			return append(problems, "a block's options are an object")
+		}
+		options = o
+	}
+	for name, v := range options {
+		opt, ok := takes[name]
+		if !ok {
+			problems = append(problems, fmt.Sprintf("a %s block has no option %q; it takes %s", shows, name,
+				orNothing(sortedKeys(takes))))
+			continue
+		}
+		switch opt.kind {
+		case "text":
+			if t, isText := v.(string); !isText || strings.TrimSpace(t) == "" {
+				problems = append(problems, fmt.Sprintf("a %s block's %s is text", shows, name))
+			}
+		case "seconds":
+			if _, whole := wholeIn(v, 1, 86400); !whole {
+				problems = append(problems, fmt.Sprintf("a %s block's %s is a whole number of seconds from 1 to 86400", shows, name))
+			}
+		}
+	}
+	for _, name := range sortedKeys(takes) {
+		if _, has := options[name]; takes[name].required && !has {
+			problems = append(problems, fmt.Sprintf("a %s block needs the option %s", shows, name))
+		}
+	}
+	return problems
+}
diff --git a/internal/compose/resolution/graphical_session_test.go b/internal/compose/resolution/graphical_session_test.go
new file mode 100644
index 0000000..a5d9446
--- /dev/null
+++ b/internal/compose/resolution/graphical_session_test.go
@@ -0,0 +1,74 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func displayServer(name, display string, claims ...string) mcat.Manifest {
+	m := mcat.Manifest{Module: name, Provides: []mcat.Offer{{Name: display, Reach: mcat.ReachMachine}}}
+	for _, c := range claims {
+		m.Claims = append(m.Claims, mcat.Claim{Name: c})
+	}
+	return m
+}
+
+func windowManager() mcat.Manifest {
+	return mcat.Manifest{Module: "i3", Requires: []string{"x11-display"}}
+}
+
+// §3: a display is resolved on the requiring module's own node.
+func TestAMachineReachRequirementResolvesToTheProviderOnItsOwnNode(t *testing.T) {
+	cat := shelf(windowManager(), displayServer("xorg", "x11-display", mcat.DisplayServerSeat))
+	got, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatalf("i3 beside xorg did not resolve: %v", err)
+	}
+	if !reflect.DeepEqual(names(got), []string{"xorg", "i3"}) && !reflect.DeepEqual(names(got), []string{"i3", "xorg"}) {
+		t.Errorf("resolved %v", names(got))
+	}
+}
+
+// §3: never answered by installing a provider, and never by another machine's.
+func TestAMachineReachRequirementIsNotPulledInNorAnsweredFromAnotherNode(t *testing.T) {
+	cat := shelf(windowManager(),
+		displayServer("xorg", "x11-display", mcat.DisplayServerSeat),
+		displayServer("xwayland", "x11-display"))
+	// Another machine runs xorg and says so to the world; it does not count.
+	world := mcat.World{Offered: map[string][]mcat.Provider{
+		"x11-display": {{Node: "laptop", At: "laptop.mesh", Module: "xorg"}}}}
+	_, err := Resolve(cat, []string{"i3"}, workstation(), world)
+	if err == nil {
+		t.Fatal("i3 resolved on a machine with no display of its own")
+	}
+	for _, want := range []string{
+		`"x11-display" is wanted by i3`, "usable only on the machine that provides it",
+		"assign one to workstation", "xorg (holds node-display-server)", "xwayland",
+	} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not say %q:\n%v", want, err)
+		}
+	}
+	// With a single provider in the catalogue too: one candidate is still not a choice to make
+	// for somebody, unlike a node-scoped provision without the machine's reach.
+	_, err = Resolve(shelf(windowManager(), displayServer("xorg", "x11-display", mcat.DisplayServerSeat)),
+		[]string{"i3"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("xorg was pulled in for i3")
+	}
+	// Not in the first pass, whose refusals take the machine off the network.
+	if _, err := Resolve(cat, []string{"i3"}, workstation(), mcat.World{Unchecked: true}); err != nil {
+		t.Errorf("the first pass refused: %v", err)
+	}
+}
+
+func TestACatalogueDisagreeingAboutAProvisionsReachIsRefused(t *testing.T) {
+	cat := shelf(windowManager(), displayServer("xorg", "x11-display"), mcat.Manifest{Module: "fake-x", Provides: mcat.Offers("x11-display")})
+	_, err := Resolve(cat, []string{"xorg", "i3"}, workstation(), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), `the catalogue disagrees about "x11-display"`) {
+		t.Fatalf("a provision with and without the machine's reach gave %v", err)
+	}
+}
diff --git a/internal/compose/resolution/groups_test.go b/internal/compose/resolution/groups_test.go
new file mode 100644
index 0000000..c1d299d
--- /dev/null
+++ b/internal/compose/resolution/groups_test.go
@@ -0,0 +1,127 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func aContainerWithGroups(groups ...any) map[string]any {
+	return map[string]any{"id": "server", "type": "container", "name": "n8n", "image": "x@sha256:" + strings.Repeat("a", 64),
+		"groups": groups}
+}
+
+// 1636/AC3: a manifest container with groups: ["${setting:media-gid}"] resolves to the number the setting says.
+func TestAContainersGroupIsFilledFromTheSetting(t *testing.T) {
+	r := aContainerWithGroups("${setting:media-gid}", float64(2001))
+	layers := []mcat.Layer{{From: "ace", Values: map[string]any{"media-gid": float64(2000)}}}
+	if err := settingInto(r, layers, "n8n"); err != nil {
+		t.Fatal(err)
+	}
+	if want := []any{2000, 2001}; !reflect.DeepEqual(r["groups"], want) {
+		t.Fatalf("composed as %#v, want %#v", r["groups"], want)
+	}
+	// A value the operator wrote as text is read as the number it spells.
+	r = aContainerWithGroups("${setting:media-gid}")
+	if err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"media-gid": "2000"}}}, "n8n"); err != nil {
+		t.Fatal(err)
+	}
+	if want := []any{2000}; !reflect.DeepEqual(r["groups"], want) {
+		t.Fatalf("composed as %#v, want %#v", r["groups"], want)
+	}
+}
+
+// 1636/AC3: an unset value refuses the module by name, and the key and the remedy are named; nothing is dropped.
+func TestAnUnsetGroupRefusesTheModuleByName(t *testing.T) {
+	r := aContainerWithGroups("${setting:media-gid}")
+	err := settingInto(r, nil, "n8n")
+	if err == nil || !strings.Contains(err.Error(), "n8n") || !strings.Contains(err.Error(), "media-gid") {
+		t.Fatalf("want a refusal naming n8n and media-gid, got %v", err)
+	}
+	if got, _ := r["groups"].([]any); len(got) != 1 || got[0] != "${setting:media-gid}" {
+		t.Fatalf("the resource was changed: %#v", r["groups"])
+	}
+}
+
+// 1636/AC2: a value that is not a whole number above zero cannot be a group.
+func TestAGroupThatIsNotAWholeNumberAboveZeroIsRefused(t *testing.T) {
+	for _, bad := range []any{"media", "-1", "0", float64(0), float64(2000.5), "2000:2000", "", true} {
+		r := aContainerWithGroups("${setting:media-gid}")
+		err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"media-gid": bad}}}, "n8n")
+		if err == nil || !strings.Contains(err.Error(), "media-gid") {
+			t.Errorf("value %#v: want a refusal naming the key, got %v", bad, err)
+		}
+	}
+}
+
+// 1636/AC3 composed for a machine, the way a push writes it: n8n's group is the number the machine's config value
+// says, written as a number, and the module is left out by name when the machine says none.
+func TestAComposedMachineGetsTheGroupTheConfigValueNames(t *testing.T) {
+	manifest, err := parseRaw(t, map[string]any{
+		"module": "n8n", "version": "1",
+		"config": map[string]any{"media-gid": map[string]any{"type": "number", "minimum": 1, "required": true,
+			"description": "the group that owns the media library on this machine"}},
+		"resources": []any{aContainerWithGroups("${config:media-gid}")},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, manifest)
+	with := anchorRendering(false)
+	with.Settings["n8n"] = []mcat.Layer{{From: "anchor", Values: map[string]any{"media-gid": float64(2000)}}}
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["n8n"]; left {
+		t.Fatalf("left out: %s", why)
+	}
+	if got := byID(composed.Resources)["n8n.server"]["groups"]; !reflect.DeepEqual(got, []any{2000}) {
+		t.Fatalf("composed groups %#v", got)
+	}
+
+	without := anchorRendering(false)
+	composed, err = Compose(r, without)
+	if err == nil {
+		why, left := composed.LeftOut["n8n"]
+		if !left || !strings.Contains(why, "media-gid") {
+			t.Fatalf("a machine that says no group kept n8n or left it out without the key: %q (%v)", why, left)
+		}
+	} else if !strings.Contains(err.Error(), "media-gid") {
+		t.Fatalf("refused without the key: %v", err)
+	}
+}
+
+// The node-engine reads a container's groups only when it reports the capability (novox/hq ADR 0480 clause 7, issue 1638):
+// a module with a container that names groups is hosted on a machine that reports container-groups, and left out of one
+// that does not, the capability named, so the field is never sent to an engine that would refuse it.
+func TestAModuleWhoseContainerNamesGroupsIsHeldOnAMachineThatDoesNotReadThem(t *testing.T) {
+	n8n := mcat.Manifest{Module: "n8n", Resources: []map[string]any{aContainerWithGroups("${config:media-gid}")}}
+	plain := mcat.Manifest{Module: "plain", Resources: []map[string]any{
+		{"id": "server", "type": "container", "name": "p", "image": "x@sha256:" + strings.Repeat("b", 64)}}}
+	for _, m := range []mcat.Manifest{n8n, plain} {
+		if got := impliedCapabilities(m); (m.Module == "n8n") != reflect.DeepEqual(got, []string{mcat.ContainerGroups}) {
+			t.Errorf("%s implies %v", m.Module, got)
+		}
+	}
+	shelf := shelf(n8n, plain)
+	reads := mcat.Node{Name: "ace", Capabilities: map[string]bool{"container-runtime": true, mcat.ContainerGroups: true}}
+	got, err := Resolve(shelf, []string{"n8n", "plain"}, reads, mcat.World{})
+	if err != nil || len(got.Unhostable) != 0 || len(got.Modules) != 2 {
+		t.Fatalf("a machine that reads groups: %v, held %+v, hosted %v", err, got.Unhostable, names(got))
+	}
+	old := mcat.Node{Name: "g14", Capabilities: map[string]bool{"container-runtime": true}}
+	got, err = Resolve(shelf, []string{"n8n", "plain"}, old, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Unhostable) != 1 || got.Unhostable[0].Module != "n8n" || !reflect.DeepEqual(got.Unhostable[0].Missing, []string{mcat.ContainerGroups}) {
+		t.Fatalf("n8n was not held, naming the capability: %+v", got.Unhostable)
+	}
+	if h := names(got); len(h) != 1 || h[0] != "plain" {
+		t.Errorf("the module without groups is not the one hosted: %v", h)
+	}
+}
diff --git a/internal/compose/resolution/handed.go b/internal/compose/resolution/handed.go
new file mode 100644
index 0000000..10eba58
--- /dev/null
+++ b/internal/compose/resolution/handed.go
@@ -0,0 +1,665 @@
+package resolution
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"maps"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// EncodeContributed is f as the bytes PlanProvision.Contributed carries, refused where DecodeContributed would refuse
+// them, so a plan never carries what its reader cannot take.
+func EncodeContributed(f mcat.ContributedForm) (json.RawMessage, error) {
+	f.V = mcat.ContributedVersion
+	raw, err := json.Marshal(f)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := mcat.DecodeContributed(raw); err != nil {
+		return nil, err
+	}
+	return raw, nil
+}
+
+// provisionsOf is, from a resolution's needs, each provision module requires and its provider, by provision then
+// local name. A need answered by a record (a licence) or by no module names no provider on a machine and is left
+// out: the vault has no provider's value to make for it.
+func provisionsOf(needs []mcat.Needed, module string, handed bool, as string, contributes map[string]map[string]any,
+	named map[string]bool) []mcat.PlanProvision {
+	var out []mcat.PlanProvision
+	for _, n := range needs {
+		// **The one rule** (Keyed, issue 774): what the seat keys and the want waits for.
+		if n.For != module || !Keyed(handed, n) {
+			continue
+		}
+		p := mcat.PlanProvision{Provision: n.Name, Local: n.Local, Provider: n.From, ProviderModule: n.Module,
+			CredentialForm: n.CredentialForm, CredentialTool: n.CredentialTool, Contributes: maps.Clone(contributes[n.Name]),
+			At: n.At, From: n.From, As: as}
+		// **A credential only a template names** (issue 788): named like a file's, so the client fills it from the
+		// vault's row for this holder.
+		if (named[n.Name] || named[mcat.SecretLocal(n.Name, n.Local)]) && n.IssuedToHolder {
+			p.Name = mcat.SecretLocal(n.Name, n.Local)
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// sortProvisions orders a plan's provisions by provision, then local name.
+func sortProvisions(ps []mcat.PlanProvision) {
+	sort.SliceStable(ps, func(i, j int) bool {
+		if ps[i].Provision != ps[j].Provision {
+			return ps[i].Provision < ps[j].Provision
+		}
+		return ps[i].Local < ps[j].Local
+	})
+}
+
+// ownershipOf is who owns a file at runtime, by its form, as the node-engine maps the old forms (mesh-host
+// declaration.File.Ownership): written into is managed, created once is a seed, any other is owned.
+func ownershipOf(r map[string]any) string {
+	switch {
+	case r["into"] != nil && fmt.Sprint(r["into"]) != "":
+		return mcat.RuntimeManaged
+	case r["create-once"] == true:
+		return mcat.RuntimeSeed
+	}
+	return mcat.RuntimeOwned
+}
+
+// takesOf is how the program reading a file takes a change, by what names the file among the module's resources:
+// restart-on wins over reload-on; empty when nothing names it (the program reads it when it uses it).
+func takesOf(m mcat.Manifest, id string) string {
+	takes := ""
+	for _, r := range m.Resources {
+		if slices.Contains(stringsIn(r["restart-on"]), id) {
+			return "restart-on"
+		}
+		if slices.Contains(stringsIn(r["reload-on"]), id) {
+			takes = "reload-on"
+		}
+	}
+	return takes
+}
+
+// handing is whether this composition hands the module's templated files to the provisioner: handed (Handing), with
+// the templates its build kept. A module the vault judged handed whose build kept none is refused where its secrets
+// are placed ("nothing would fill it"), never composed with values the vault does not answer.
+func renderingHanding(with mcat.Rendering, m mcat.Manifest) bool {
+	return Handing(with, m) && m.Handed != nil
+}
+
+// Handing is whether a machine composed with this rendering hands the module to the provisioner, its files and
+// its own secrets (design 57 P6, V4): a moved module there, assigned or only pulled in by another (issue 765), on a
+// machine that can take it. The controller makes and seals none of such a module's secrets for that machine: its
+// client asks the vault.
+//
+// **Where the vault judged the module, its word is the rule** (Rendering.Assigned, issue 774): the vault leaves a
+// module's own secrets out of `own` exactly when the plan in its assignment hands it (AssignmentHands), so a node
+// composing itself hands exactly those, whatever its own reading of the manifest and the machine says. On 2026-10-31
+// postgres on novox was held: its plan handed its secrets, the vault answered none of them, and the node, judging by
+// the manifest and the machine, composed them itself and refused for want of `reader`. Two readers, one rule.
+func Handing(with mcat.Rendering, m mcat.Manifest) bool {
+	if hands, judged := with.Assigned[m.Module]; judged {
+		return hands
+	}
+	return m.Moved && m.Handed != nil && with.Hands && with.Provisioner != ""
+}
+
+// requiredByWords begins why a module only pulled in by another is on a machine (Resolution.Because): `required by
+// <module>`.
+const requiredByWords = "required by "
+
+// RequiredBy is the module that requires module on this machine when nothing assigned it there, only pulled it in
+// (issue 765): what its value in the assignments mirror names. Empty for a module assigned there, or not there.
+func RequiredBy(r mcat.Resolution, module string) string {
+	by, _ := strings.CutPrefix(r.Because[module], requiredByWords)
+	if by == r.Because[module] {
+		return ""
+	}
+	return by
+}
+
+// handedSecretFile is a handed module's own secret file as the declaration carries it: placed, the secret's
+// alone (0600 unless the manifest says otherwise), owned at runtime, without a value; the client fills it from the
+// vault.
+func handedSecretFile(r map[string]any, m mcat.Manifest, dirs, accessPaths, facts map[string]string,
+	placed map[string]mcat.Placement) (map[string]any, mcat.PlanSecret, error) {
+	name := fmt.Sprint(r[mcat.HandedSecretField])
+	out := map[string]any{}
+	for k, v := range r {
+		out[k] = v
+	}
+	delete(out, mcat.HandedSecretField)
+	delete(out, "sealed")
+	if err := dirInto(out, dirs, m.Module); err != nil {
+		return nil, mcat.PlanSecret{}, err
+	}
+	if err := accessInto(out, accessPaths, m.Module); err != nil {
+		return nil, mcat.PlanSecret{}, err
+	}
+	ownerInto(out, placed)
+	if err := machineInto(out, facts, m.Module); err != nil {
+		return nil, mcat.PlanSecret{}, err
+	}
+	if out["mode"] == nil {
+		out["mode"] = "0600"
+	}
+	out[mcat.OwnerAtRuntimeField] = mcat.RuntimeOwned
+	return out, mcat.PlanSecret{Name: name, Path: fmt.Sprint(out["path"])}, nil
+}
+
+// templatePlaceholder is a placeholder as a template writes it: its namespace and its key.
+var templatePlaceholder = regexp.MustCompile(`\$\{([a-z][a-z-]*):([^}\s$]+)\}`)
+
+// configNamespaces are the namespaces the config domain answers: `config`, and `setting`, which the manifest's
+// reading writes it as (toSettingsForm).
+var configNamespaces = []string{"config", mcat.SettingField}
+
+// mergesFile is whether a file resource says `merge` or `takes-settings`: the layers' settings are merged into it.
+func mergesFile(r map[string]any) bool {
+	_, merges := r["merge"]
+	_, takes := r[mcat.TakesSettingsField]
+	return merges || takes
+}
+
+// mergingIn is whether the module's resource id is a merging file (mergesFile).
+func mergingIn(m mcat.Manifest, id string) bool {
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["id"]) == id {
+			return mergesFile(r)
+		}
+	}
+	return false
+}
+
+// handedFile is a moved module's templated file as a handing declaration carries it: placed (its path and owner
+// filled by placement alone), saying who owns it at runtime, without its text. And its line of the plan.
+func handedFile(r map[string]any, m mcat.Manifest, dirs, accessPaths, facts map[string]string, placed map[string]mcat.Placement,
+	with mcat.Rendering) (map[string]any, mcat.PlanFile, error) {
+	id := fmt.Sprint(r["id"])
+	out := map[string]any{}
+	for k, v := range r {
+		out[k] = v
+	}
+	// **No text, and nothing filled into it**: the client fills it from the template; the declaration says where
+	// it goes and how it is written.
+	delete(out, "content")
+	delete(out, mcat.TrustedField)
+	delete(out, mcat.NamesOnPurpose)
+	delete(out, mcat.SecretsInEnvironment)
+	if err := dirInto(out, dirs, m.Module); err != nil {
+		return nil, mcat.PlanFile{}, err
+	}
+	if err := accessInto(out, accessPaths, m.Module); err != nil {
+		return nil, mcat.PlanFile{}, err
+	}
+	ownerInto(out, placed)
+	if err := machineInto(out, facts, m.Module); err != nil {
+		return nil, mcat.PlanFile{}, err
+	}
+	out[mcat.OwnerAtRuntimeField] = ownershipOf(out)
+	path := fmt.Sprint(out["path"])
+	return out, mcat.PlanFile{ID: id, Path: path, Template: m.Handed.Templates[id],
+		OwnerAtRuntime: fmt.Sprint(out[mcat.OwnerAtRuntimeField]), Takes: takesOf(m, id)}, nil
+}
+
+// placementOf is the value of every placement placeholder the module's handed templates name, keyed as the
+// placeholder names it (`machine:account`), each filled by the same pass that fills it in a declaration. A
+// template naming a value only another domain answers — a secret, a binding, a contribution — is refused by
+// name: the client fills config and placement, and the rest move with their own packages (design 57).
+func placementOf(node string, m mcat.Manifest, texts, items map[string]string, dirs, accessPaths, facts map[string]string,
+	with mcat.Rendering, moved map[string]bool, backups backupPlacer) (map[string]string, []string, []string, []mcat.PlanCollection, error) {
+	out := map[string]string{}
+	var secrets, required []string
+	var problems []string
+	var collections []mcat.PlanCollection
+	all := map[string]string{}
+	templateOf := map[string]string{}
+	for id, text := range texts {
+		all[id], templateOf[id] = text, m.Handed.Templates[id]
+	}
+	for key, text := range items {
+		all["item:"+key], templateOf["item:"+key] = text, m.Handed.Items[key]
+	}
+	judgedConsumers := map[string]bool{}
+	for _, id := range sortedKeys(all) {
+		item := strings.HasPrefix(id, "item:")
+		for _, found := range templatePlaceholder.FindAllStringSubmatch(all[id], -1) {
+			kind, key := found[1], found[2]
+			if collection, is := collectionOfPlaceholder(kind, key); is {
+				// **A collection its file names, read by the client from the items there** (design 57 L1).
+				comment, err := collectionComment(m, collection)
+				_, selector := splitSelector(key)
+				_, selErr := selectorOf(selector)
+				switch {
+				case selErr != nil && !item:
+					problems = append(problems, fmt.Sprintf("%s: its template %s names %s: %v", m.Module,
+						templateOf[id], found[0], selErr))
+				case item:
+					problems = append(problems, fmt.Sprintf("%s: its item's template %s names %s: an item is not a "+
+						"collector", m.Module, templateOf[id], found[0]))
+				case err != nil:
+					problems = append(problems, fmt.Sprintf("%s: its template %s names %s: %v", m.Module,
+						templateOf[id], found[0], err))
+				case !slices.ContainsFunc(collections, func(c mcat.PlanCollection) bool { return c.Name == collection }):
+					collections = append(collections, mcat.PlanCollection{Name: collection, Comment: comment})
+				}
+				continue
+			}
+			switch {
+			case slices.Contains(configNamespaces, kind):
+				continue
+			case kind == mcat.ConsumersNamespace:
+				// **A provider's consumers' credentials** (ADR 0373): its machine's client fills them from the vault,
+				// for a provision the module provides, in a file only it reads (consumersPlaceholderProblems).
+				if item {
+					problems = append(problems, fmt.Sprintf("%s: its item's template %s names %s: an item is kept in a "+
+						"bucket, where no secret is (novox/hq ADR 0349 §7)", m.Module, templateOf[id], found[0]))
+				} else if !judgedConsumers[id] {
+					judgedConsumers[id] = true
+					problems = append(problems, consumersOfTemplate(m, id, all[id])...)
+				}
+				continue
+			case item && (kind == "secret" || kind == "bound"):
+				problems = append(problems, fmt.Sprintf("%s: its item's template %s names %s: an item is kept in a "+
+					"bucket, where no secret is (novox/hq ADR 0349 §7)", m.Module, templateOf[id], found[0]))
+				continue
+			case kind == "secret":
+				// **The module's own secret, by name** (design 57 V4): its machine's client asks the vault for it.
+				// A requirement's credential is a binding's, and moves with the providers (design 57 B1–B3).
+				if _, own := m.OwnSecrets.Plain()[key]; !own && moved[key] {
+					// **A credential it requires, from a provider that has moved** (issue 788): the client fills it
+					// from the vault's row for this holder, which the plan names.
+					if !slices.Contains(required, key) {
+						required = append(required, key)
+					}
+				} else if !own {
+					problems = append(problems, fmt.Sprintf("%s: its template %s names %s, which is no secret of its "+
+						"own; a credential it requires moves with its provider (design 57 B1–B3)", m.Module,
+						templateOf[id], found[0]))
+				} else if !slices.Contains(secrets, key) {
+					secrets = append(secrets, key)
+				}
+				continue
+			case kind == "bound" && moved[strings.SplitN(key, ":", 2)[0]]:
+				// **What its moved provider told it** (issue 788): the client fills it from the provider's entry.
+				continue
+			case !slices.Contains(mcat.PlacementKinds, kind):
+				if known(kind) {
+					problems = append(problems, fmt.Sprintf("%s: its template %s names %s, and the provisioner's "+
+						"client fills only config, secrets, collections and placement until that domain moves "+
+						"(design 57)", m.Module, templateOf[id], found[0]))
+				}
+				continue
+			}
+			name := kind + ":" + key
+			if _, done := out[name]; done {
+				continue
+			}
+			if kind == mcat.BackupNamespace {
+				// **What the machine's modules back up** (design 57 L3, issue 794): the text the old contribution
+				// placeholders render, from the same function, over the modules placed on this machine.
+				value, problem := backups.placed(m, key, item)
+				if problem != "" {
+					problems = append(problems, fmt.Sprintf("%s: its template %s names %s: %s", m.Module,
+						templateOf[id], found[0], problem))
+					continue
+				}
+				out[name] = value
+				continue
+			}
+			value, err := placed(node, found[0], m, dirs, accessPaths, facts, with)
+			if err != nil {
+				problems = append(problems, err.Error())
+				continue
+			}
+			out[name] = value
+		}
+	}
+	if len(problems) > 0 {
+		sort.Strings(problems)
+		return nil, nil, nil, nil, errors.New(strings.Join(problems, "; "))
+	}
+	sort.Slice(collections, func(a, b int) bool { return collections[a].Name < collections[b].Name })
+	return out, secrets, required, collections, nil
+}
+
+// known is whether a namespace is one the mesh fills somewhere.
+func known(kind string) bool {
+	for _, f := range fillers {
+		if f.namespace == kind {
+			return true
+		}
+	}
+	return false
+}
+
+// placed is one placement placeholder's value, filled by the passes that fill it in a file's content.
+func placed(node, placeholder string, m mcat.Manifest, dirs, accessPaths, facts map[string]string, with mcat.Rendering) (string, error) {
+	r := map[string]any{"id": "placement", "type": "file", "path": "/placement", "content": placeholder}
+	if err := dirInto(r, dirs, m.Module); err != nil {
+		return "", err
+	}
+	if err := accessInto(r, accessPaths, m.Module); err != nil {
+		return "", err
+	}
+	if err := portInto(r, m.Module, m.Listens, with); err != nil {
+		return "", err
+	}
+	if err := seatInto(r, m.Module, with); err != nil {
+		return "", err
+	}
+	if err := machineInto(r, facts, m.Module); err != nil {
+		return "", err
+	}
+	value := fmt.Sprint(r["content"])
+	if value == placeholder {
+		return "", fmt.Errorf("%s: %s is not answered by placement on %s", m.Module, placeholder, node)
+	}
+	return value, nil
+}
+
+// routedTemplates is the templates archive as this node fetches it, through the artifact store it reaches.
+func routedTemplates(m mcat.Manifest, with mcat.Rendering) (mcat.PlanTemplates, error) {
+	r := map[string]any{"id": "templates", "source": m.Handed.Source}
+	if err := artifactsInto(r, m.Module, with); err != nil {
+		return mcat.PlanTemplates{}, err
+	}
+	return mcat.PlanTemplates{Source: fmt.Sprint(r["source"]), Digest: m.Handed.Digest}, nil
+}
+
+// handedFiles gathers, over one composition, the files handed to the provisioner and each handed module's plan.
+type handedFiles struct {
+	paths []string
+	plans map[string]mcat.Plan
+	// secrets is each handed module's own secrets its declaration names, by name: the path of the file holding one
+	// alone, or "" for one only its templates name.
+	secrets map[string]map[string]string
+	// provisions is each handed module's credentials of what it requires that the vault keeps for it (issue 757).
+	provisions map[string][]mcat.PlanProvision
+	// contributes is each handed module's manifest `contributes`, by the requirement it is about (issue 776).
+	contributes map[string]map[string]map[string]any
+	// identities is who each handed module is at its providers' ends (issue 788), and required the credentials of
+	// what it requires that its templates name.
+	identities map[string]string
+	required   map[string]map[string]bool
+	// names is the names composed for each handed module through each requirement it contributes to (issue 792).
+	names map[string]map[string]map[string]string
+	// keyedOnly is each module with a plan only for what Keyed keys of a consumer not handed: a provision its
+	// provider's helper answers (issue 774), such as a route.
+	keyedOnly map[string]bool
+	// contributed is what each handed module gives each requirement's provider, encoded (PlanProvision.Contributed).
+	contributed map[string]map[string]json.RawMessage
+}
+
+// contribute records what a handed module gives one requirement's provider, encoded; nothing for none.
+func (h *handedFiles) contribute(module, provision string, raw json.RawMessage) {
+	if len(raw) == 0 {
+		return
+	}
+	if h.contributed == nil {
+		h.contributed = map[string]map[string]json.RawMessage{}
+	}
+	if h.contributed[module] == nil {
+		h.contributed[module] = map[string]json.RawMessage{}
+	}
+	h.contributed[module][provision] = raw
+}
+
+// keyed starts the plan of a module begin started none for, when the composition keys any of its needs as a consumer
+// not handed (Keyed, issue 774): one whose provider's helper answers a provision of it (grafana's route). A module
+// handed that keeps no template or item (a held one's stub, issue 1126) is not handed here either: what it keeps
+// stays the controller's but for what a helper answers. Its plan names provisions alone: no templates, files or
+// secrets. Answers whether it started one.
+func (h *handedFiles) keyed(node string, m mcat.Manifest, needs []mcat.Needed) bool {
+	if _, started := h.plans[m.Module]; started {
+		return false
+	}
+	if !slices.ContainsFunc(needs, func(n mcat.Needed) bool { return n.For == m.Module && Keyed(false, n) }) {
+		return false
+	}
+	if h.identities == nil {
+		h.identities = map[string]string{}
+		h.required = map[string]map[string]bool{}
+	}
+	h.identities[m.Module] = mcat.ConsumerIdentity(node, mcat.IdentitySource(m.Slug, m.Module))
+	h.plans[m.Module] = mcat.Plan{}
+	if h.keyedOnly == nil {
+		h.keyedOnly = map[string]bool{}
+	}
+	h.keyedOnly[m.Module] = true
+	if len(m.Contributes) > 0 {
+		if h.contributes == nil {
+			h.contributes = map[string]map[string]map[string]any{}
+		}
+		h.contributes[m.Module] = m.Contributes
+	}
+	return true
+}
+
+// name records the names composed for a handed module through one requirement, as its binding file carries them.
+func (h *handedFiles) name(module, provision string, own map[string]any) {
+	values := map[string]string{}
+	withOwnNames(values, own)
+	if len(values) == 0 {
+		return
+	}
+	if h.names == nil {
+		h.names = map[string]map[string]map[string]string{}
+	}
+	if h.names[module] == nil {
+		h.names[module] = map[string]map[string]string{}
+	}
+	h.names[module][provision] = values
+}
+
+// begin starts a module's plan where this composition hands it, and answers the ids of the files handed: none for
+// a module that is not handed here. The plan's templates and placement values are composed now; each file is added
+// as it is composed.
+//
+// **Assigned or only pulled in by another** (issue 765): the plan travels in the module's value of the assignments
+// mirror, `<node>.<module>`, which the client reads (inventory.Provisioning); a module pulled in has a value there of
+// its own, which says what pulled it in.
+func (h *handedFiles) begin(node string, m mcat.Manifest, dirs, accessPaths, facts map[string]string,
+	with mcat.Rendering, caps map[string]bool, needs []mcat.Needed, backups backupPlacer) (map[string]bool, error) {
+	if !renderingHanding(with, m) {
+		return nil, nil
+	}
+	texts := map[string]string{}
+	ids := map[string]bool{}
+	for _, r := range m.Resources {
+		id := fmt.Sprint(r["id"])
+		if _, named := m.Handed.Templates[id]; !named {
+			continue
+		}
+		if mergesFile(r) {
+			// **A merging file is filled the old way** (issue 831, ADR 0349 clause 17): handing it needs the client
+			// to merge the layers, which nothing builds yet. Its text stays, the controller fills and merges it.
+			continue
+		}
+		if fmt.Sprint(r["type"]) != "file" {
+			return nil, fmt.Errorf("%s: %s is a %v and its build kept a template for it; only a file is filled "+
+				"from one", m.Module, id, r["type"])
+		}
+		text, _ := r["content"].(string)
+		texts[id] = text
+		ids[id] = true
+	}
+	for _, id := range sortedKeys(m.Handed.Templates) {
+		if !ids[id] && !mergingIn(m, id) {
+			return nil, fmt.Errorf("%s: its build kept a template for %s, which it does not declare", m.Module, id)
+		}
+	}
+	// **Its items, by template** (design 57 L1): the client fills each and records it for this node.
+	items := map[string]string{}
+	var planned []mcat.PlanItem
+	for _, it := range m.Items {
+		template, kept := m.Handed.Items[itemKey(it)]
+		if !kept {
+			return nil, fmt.Errorf("%s: its build kept no template for its item of %s", m.Module, itemKey(it))
+		}
+		// **A capability the machine lacks leaves the item out of its plan** (design 57 L3): the client judges none.
+		if it.IfCapability != "" && !caps[it.IfCapability] {
+			continue
+		}
+		items[itemKey(it)] = it.Content
+		planned = append(planned, mcat.PlanItem{Collection: it.Collection, Name: it.Name,
+			Attributes: it.Attributes, Template: template})
+	}
+	if len(ids) == 0 && len(planned) == 0 {
+		return nil, nil
+	}
+	templates, err := routedTemplates(m, with)
+	if err != nil {
+		return nil, err
+	}
+	// What it requires from a provider that has moved (issue 788): its templates may name what that provider tells it.
+	moved := map[string]bool{}
+	for _, n := range needs {
+		if n.For == m.Module && n.ProviderMoved {
+			moved[n.Name] = true
+			// A credential kept per local name (issue 793) is named by its local in a template.
+			moved[mcat.SecretLocal(n.Name, n.Local)] = true
+		}
+	}
+	placement, secrets, required, collections, err := placementOf(node, m, texts, items, dirs, accessPaths, facts,
+		with, moved, backups)
+	if err != nil {
+		return nil, err
+	}
+	if h.identities == nil {
+		h.identities = map[string]string{}
+		h.required = map[string]map[string]bool{}
+	}
+	h.identities[m.Module] = mcat.ConsumerIdentity(node, mcat.IdentitySource(m.Slug, m.Module))
+	h.required[m.Module] = map[string]bool{}
+	for _, name := range required {
+		h.required[m.Module][name] = true
+	}
+	for _, name := range secrets {
+		h.secret(m.Module, mcat.PlanSecret{Name: name})
+	}
+	plan := mcat.Plan{Templates: templates, Items: planned, Collections: collections}
+	if len(placement) > 0 {
+		plan.Placement = placement
+	}
+	h.plans[m.Module] = plan
+	if len(m.Contributes) > 0 {
+		if h.contributes == nil {
+			h.contributes = map[string]map[string]map[string]any{}
+		}
+		h.contributes[m.Module] = m.Contributes
+	}
+	return ids, nil
+}
+
+// add is one handed file of a module, composed. A path handed twice is refused: the node-engine writes a filled
+// file for exactly one resource, and the client's write names only the path (mesh-host internal/apply).
+func (h *handedFiles) add(module string, f mcat.PlanFile) error {
+	if slices.Contains(h.paths, f.Path) {
+		return fmt.Errorf("%s: %s is handed to the provisioner twice on this machine; a filled file has one "+
+			"resource and one writer (novox/hq ADR 0349 §5)", module, f.Path)
+	}
+	plan := h.plans[module]
+	plan.Files = append(plan.Files, f)
+	h.plans[module] = plan
+	h.paths = append(h.paths, f.Path)
+	return nil
+}
+
+// secret is one of a handed module's own secrets its declaration names; a file holding it alone is a filled file.
+func (h *handedFiles) secret(module string, sec mcat.PlanSecret) {
+	if h.secrets == nil {
+		h.secrets = map[string]map[string]string{}
+	}
+	if h.secrets[module] == nil {
+		h.secrets[module] = map[string]string{}
+	}
+	if sec.Path != "" || h.secrets[module][sec.Name] == "" {
+		h.secrets[module][sec.Name] = sec.Path
+	}
+}
+
+// addSecretFile is a handed module's own secret file, composed: a filled file, and its secret in the plan.
+func (h *handedFiles) addSecretFile(module string, sec mcat.PlanSecret) error {
+	if slices.Contains(h.paths, sec.Path) {
+		return fmt.Errorf("%s: %s is handed to the provisioner twice on this machine; a filled file has one "+
+			"resource and one writer (novox/hq ADR 0349 §5)", module, sec.Path)
+	}
+	h.paths = append(h.paths, sec.Path)
+	h.secret(module, sec)
+	return nil
+}
+
+// addProvisionFile is a handed module's credential file for something it requires, which the vault keeps for it
+// alone (issue 757): a filled file, and the credential in the plan.
+func (h *handedFiles) addProvisionFile(module string, pr mcat.PlanProvision) error {
+	if slices.Contains(h.paths, pr.Path) {
+		return fmt.Errorf("%s: %s is handed to the provisioner twice on this machine; a filled file has one "+
+			"resource and one writer (novox/hq ADR 0349 §5)", module, pr.Path)
+	}
+	h.paths = append(h.paths, pr.Path)
+	if h.provisions == nil {
+		h.provisions = map[string][]mcat.PlanProvision{}
+	}
+	h.provisions[module] = append(h.provisions[module], pr)
+	return nil
+}
+
+// finished is every plan with its secrets, by name, and what its module requires, each with its provider.
+func (h *handedFiles) finished(needs []mcat.Needed) map[string]mcat.Plan {
+	if len(h.plans) == 0 {
+		return nil
+	}
+	for module, plan := range h.plans {
+		// **Every provision it requires, with its provider** (issue 760); a credential the vault keeps for it alone
+		// is that provision's entry, with its name and file (issue 757).
+		provisions := provisionsOf(needs, module, !h.keyedOnly[module], h.identities[module], h.contributes[module],
+			h.required[module])
+		for _, credential := range h.provisions[module] {
+			i := slices.IndexFunc(provisions, func(p mcat.PlanProvision) bool {
+				return p.Provision == credential.Provision && p.Local == credential.Local
+			})
+			if i < 0 {
+				credential.As = h.identities[module]
+				provisions = append(provisions, credential)
+				continue
+			}
+			provisions[i].Name, provisions[i].Path = credential.Name, credential.Path
+		}
+		for i := range provisions {
+			provisions[i].Names = maps.Clone(h.names[module][provisions[i].Provision])
+		}
+		sortProvisions(provisions)
+		// **What the consumer contributes, on the provision's first entry** (issue 774): a provider serving from the
+		// plans alone reads each contribution once, however many local names the requirement has.
+		gave := map[string]bool{}
+		for i := range provisions {
+			if raw := h.contributed[module][provisions[i].Provision]; len(raw) > 0 && !gave[provisions[i].Provision] {
+				gave[provisions[i].Provision] = true
+				provisions[i].Contributed = slices.Clone(raw)
+			}
+		}
+		plan.Provisions = provisions
+		h.plans[module] = plan
+	}
+	for module, named := range h.secrets {
+		plan, ok := h.plans[module]
+		if !ok {
+			continue
+		}
+		plan.Secrets = nil
+		for _, name := range sortedKeys(named) {
+			plan.Secrets = append(plan.Secrets, mcat.PlanSecret{Name: name, Path: named[name]})
+		}
+		h.plans[module] = plan
+	}
+	return h.plans
+}
diff --git a/internal/compose/resolution/handed_bound_test.go b/internal/compose/resolution/handed_bound_test.go
new file mode 100644
index 0000000..970662c
--- /dev/null
+++ b/internal/compose/resolution/handed_bound_test.go
@@ -0,0 +1,146 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// gitea's server.env, as the catalogue keeps it: its database as the provider told it and the consumer's own login.
+const giteaServerEnv = "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\n" +
+	"GITEA__database__DB_TYPE=postgres\n" +
+	"GITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\n" +
+	"GITEA__database__NAME=${bound:postgres-database:as}\n" +
+	"GITEA__database__USER=${bound:postgres-database:as}\n" +
+	"GITEA__database__PASSWD=${secret:postgres-database}\n"
+
+// databaseConsumer is a handed module, with the template gitea's server.env is, requiring a database from a provider
+// that has moved or not (issue 788); slug is the module's identity source when it declares one.
+func databaseConsumer(t *testing.T, slug string, moved bool) mcat.Resolution {
+	t.Helper()
+	raw := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
+		`"requires":["postgres-database"],"own-secrets":{"internal-token":"${dir:state}/internal-token"}`, 1)
+	if slug != "" {
+		raw = strings.Replace(raw, `"version":"1",`, `"version":"1","slug":"`+slug+`",`, 1)
+	}
+	return withDatabase(t, raw, giteaServerEnv, moved)
+}
+
+// withDatabase resolves the module in raw, whose template is text, against a provider of postgres-database that has
+// moved or not.
+func withDatabase(t *testing.T, raw, text string, moved bool) mcat.Resolution {
+	t.Helper()
+	r, err := Resolve(shelf(held(t, raw, builtBot(text)), mcat.Manifest{Module: "postgres", Version: "1", Provides: []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeNode}}}),
+		[]string{"bot"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	// Answered on this machine, it states no need; one from the provider's machine is stated, as the plan does.
+	r.Needs = []mcat.Needed{{Name: "postgres-database", For: "bot", Module: "postgres", From: "novox", At: "10.7.0.1",
+		CredentialForm: mcat.CredentialFormPair, IssuedToHolder: moved, ProviderMoved: moved}}
+	return r
+}
+
+// The forge's server.env composes for a handed module when what it requires has moved, its plan entry carrying the
+// provider's address, machine and the consumer's identity as today's binding file gives them; and is refused with the
+// text it has always had when the provider has not.
+func TestAHandedModuleMayNameWhatItRequiresWhereItsProviderHasMoved(t *testing.T) {
+	c, got := composeWith(t, databaseConsumer(t, "", true), handingTo("store:5000"))
+	if strings.Contains(got, "sealed") {
+		t.Fatalf("a handed module's declaration carries a sealed value: %s", got)
+	}
+	want := []mcat.PlanProvision{{Name: "postgres-database", Provision: "postgres-database", Provider: "novox",
+		ProviderModule: "postgres", CredentialForm: mcat.CredentialFormPair, At: "10.7.0.1", From: "novox",
+		As: mcat.ConsumerIdentity("workstation", "bot")}}
+	if !reflect.DeepEqual(c.Plans["bot"].Provisions, want) {
+		t.Fatalf("the plan names %+v, want %+v", c.Plans["bot"].Provisions, want)
+	}
+	for _, unmoved := range []mcat.Resolution{databaseConsumer(t, "", false)} {
+		_, err := Compose(unmoved, handingTo("store:5000"))
+		if err == nil || !strings.Contains(err.Error(), "which is no secret of its own; a credential it requires moves "+
+			"with its provider (design 57 B1–B3)") {
+			t.Fatalf("a provider not moved, the credential: %v", err)
+		}
+		bound := strings.Replace(giteaServerEnv, "${secret:postgres-database}", "x", 1)
+		r := withDatabase(t, strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
+			`"requires":["postgres-database"],"own-secrets":{"internal-token":"${dir:state}/internal-token"}`, 1),
+			bound, false)
+		_, err = Compose(r, handingTo("store:5000"))
+		if err == nil || !strings.Contains(err.Error(), "the provisioner's client fills only config, secrets, "+
+			"collections and placement until that domain moves (design 57)") {
+			t.Fatalf("a provider not moved, the binding: %v", err)
+		}
+	}
+}
+
+// A handed module's credentials the vault keeps as one login per local name (issue 793): gitea's internal token and
+// admin password, which the `secret` provision hands as `${secret:<local>}`. Each is a plan entry naming its local,
+// its file declared placed and without a value; the template naming the local is allowed.
+func TestAHandedModulesLocalCredentialsOfTheVaultAreNamedByLocalInItsPlan(t *testing.T) {
+	raw := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
+		`"requires":["secret"],"secrets":{"secret":{"internal-token":"${dir:state}/internal-token.secret",`+
+			`"admin":"${dir:state}/admin.secret"}},"own-secrets":{"token":"${dir:state}/token"}`, 1)
+	r, err := Resolve(shelf(held(t, raw, builtBot("T=${secret:internal-token}\n")), mcat.Manifest{Module: "vault", Version: "1", Provides: []mcat.Offer{{Name: "secret", Scope: mcat.ScopeNode}}}),
+		[]string{"bot"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	r.Needs = []mcat.Needed{
+		{Name: "secret", Local: "internal-token", For: "bot", Module: "vault", From: "novox",
+			CredentialForm: mcat.CredentialFormPair, IssuedToHolder: true, ProviderMoved: true},
+		{Name: "secret", Local: "admin", For: "bot", Module: "vault", From: "novox",
+			CredentialForm: mcat.CredentialFormPair, IssuedToHolder: true, ProviderMoved: true},
+	}
+	c, got := composeWith(t, r, handingTo("store:5000"))
+	if strings.Contains(got, "sealed") {
+		t.Fatalf("the declaration carries a sealed value: %s", got)
+	}
+	var names []string
+	for _, p := range c.Plans["bot"].Provisions {
+		if p.Provision != "secret" || p.Provider != "novox" || p.Path == "" || p.Name != p.Local {
+			t.Errorf("the plan entry is %+v", p)
+		}
+		names = append(names, p.Name)
+	}
+	if !reflect.DeepEqual(names, []string{"admin", "internal-token"}) {
+		t.Fatalf("the plan names %v, want admin and internal-token", names)
+	}
+}
+
+// **Issue 969: a key its provider serves only at run time.** A moved module's file may name `${bound:…}` of a
+// provision whose provider tells it at run time (ssh-client's known_host of the forge). Where the machine takes
+// handed files the client fills it and the module composes; where it does not the controller must fill it from what
+// the provider serves statically, cannot, and refuses it with the very words an unmarked module is refused with
+// (ADR 0349 §17: the old way, byte for byte).
+func TestAHandedModuleNamingARunTimeBoundKeyComposesOnlyWhereItIsHanded(t *testing.T) {
+	text := "Host ${bound:postgres-database:at}\n  KnownHost ${bound:postgres-database:known_host}\n"
+	moved := strings.Replace(botMoved(), `"own-secrets":{"token":"${dir:state}/token"}`,
+		`"requires":["postgres-database"],"own-secrets":{"token":"${dir:state}/token"}`, 1)
+	unmoved := strings.Replace(moved, `"moved":true,`, ``, 1)
+	if unmoved == moved {
+		t.Fatal("the twin is still marked moved")
+	}
+
+	c, got := composeWith(t, withDatabase(t, moved, text, true), handingTo("store:5000"))
+	if strings.Contains(got, "known_host") || len(c.Filled) == 0 {
+		t.Fatalf("handed, the module is filled by the client and the controller names nothing: %v %s", c.Filled, got)
+	}
+
+	for name, with := range map[string]mcat.Rendering{
+		"an engine that does not take a filled file alone": {Provisioner: "mesh-provisioner-client", ArtifactStore: "store:5000"},
+		"no provisioner client on the machine":             {Hands: true, ArtifactStore: "store:5000"},
+	} {
+		_, err := Compose(withDatabase(t, moved, text, true), sealedForBot(with))
+		if err == nil || !strings.Contains(err.Error(), `asks its postgres-database binding for "known_host"`) {
+			t.Fatalf("%s: the key is not refused: %v", name, err)
+		}
+		_, before := Compose(withDatabase(t, unmoved, text, false), sealedForBot(with))
+		if before == nil || before.Error() != err.Error() {
+			t.Fatalf("%s: refused otherwise than the unmarked module: %v / %v", name, err, before)
+		}
+	}
+}
diff --git a/internal/compose/resolution/handed_consumers_test.go b/internal/compose/resolution/handed_consumers_test.go
new file mode 100644
index 0000000..e03d969
--- /dev/null
+++ b/internal/compose/resolution/handed_consumers_test.go
@@ -0,0 +1,48 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const handedProvider = `{"module":"db","version":"1","moved":true,
+  "provides":[{"name":"postgres-database","scope":"mesh","identity":{"max":63,"in":"a PostgreSQL role"}}],
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[
+    {"id":"state","type":"directory","mode":"0700","place":"."},
+    {"id":"consumers","type":"file","path":"${dir:state}/consumers.json","mode":"0600","template":"files/consumers.json"}]}`
+
+const consumersText = "${consumers:postgres-database}"
+
+func builtProvider(text string) []mcat.Built {
+	return []mcat.Built{{Name: "files", Kind: mcat.ArtifactArchive,
+		Reference: mcat.ArtifactStoreScheme + "db/files/blobs/sha256:" + strings.Repeat("f", 64),
+		Digest:    "sha256:" + strings.Repeat("f", 64), Texts: map[string]string{"consumers.json": text}}}
+}
+
+func TestWhatAConsumersPlaceholderMayNotBeIsRefused(t *testing.T) {
+	for why, c := range map[string]struct{ raw, text, want string }{
+		"a provision the module does not provide": {handedProvider, "${consumers:cache}", "does not provide"},
+		"a module providing nothing": {strings.Replace(handedProvider, `"provides":[{"name":"postgres-database","scope":"mesh","identity":{"max":63,"in":"a PostgreSQL role"}}],`,
+			"", 1), consumersText, "does not provide"},
+		"a file others may read": {strings.Replace(handedProvider, `"mode":"0600","template"`,
+			`"mode":"0640","template"`, 1), consumersText, "0600"},
+		"a file the program keeps": {strings.Replace(handedProvider, `"mode":"0600","template"`,
+			`"mode":"0600","create-once":true,"template"`, 1), consumersText, "owned"},
+	} {
+		m, err := decodeForTest([]byte(c.raw))
+		if err != nil {
+			t.Fatalf("%s: %v", why, err)
+		}
+		resolved, err := m.Resolve(builtProvider(c.text))
+		if err == nil {
+			r := notifierOn(t, resolved)
+			_, err = Compose(r, handingTo("store:5000"))
+		}
+		if err == nil || !strings.Contains(err.Error(), c.want) {
+			t.Errorf("%s: %v, want a refusal saying %q", why, err, c.want)
+		}
+	}
+}
diff --git a/internal/compose/resolution/handed_providers_test.go b/internal/compose/resolution/handed_providers_test.go
new file mode 100644
index 0000000..7ae1a41
--- /dev/null
+++ b/internal/compose/resolution/handed_providers_test.go
@@ -0,0 +1,111 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// notifierConsumer is the notifier requiring a mesh-scoped database, marked moved when moved, with its credential
+// kept under two local names (ADR 0094) when locals is set.
+func notifierConsumer(t *testing.T, moved, locals bool) mcat.Manifest {
+	t.Helper()
+	raw := handedNotifier
+	if moved {
+		raw = notifierMoved()
+	}
+	add := `"requires":["postgres-database"],`
+	if locals {
+		add += `"secrets":{"postgres-database":{"hot":"/var/lib/notify/hot","cold":"/var/lib/notify/cold"}},`
+	}
+	raw = strings.Replace(raw, `"build":`, add+`"build":`, 1)
+	return held(t, raw, builtNotifier())
+}
+
+// twoStores is a mesh where two machines each run a store providing the database, the consumer pinned to one.
+func twoStores(pin string) mcat.World {
+	return mcat.World{Offered: map[string][]mcat.Provider{"postgres-database": {
+		{Node: "anchor", At: "anchor.internal", Module: "store", Serves: map[string]any{"port": 5432}},
+		{Node: "home", At: "home.internal", Module: "store-two", Serves: map[string]any{"port": 5434}},
+	}}, Pinned: map[string]mcat.Chosen{"postgres-database": {Node: pin}}}
+}
+
+func consumerOn(t *testing.T, m mcat.Manifest, w mcat.World) mcat.Resolution {
+	t.Helper()
+	node := workstation()
+	node.At = "workstation.internal"
+	stores := shelf(m, mcat.Manifest{Module: "store", Version: "1", Provides: []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeMesh,
+		Credential: &mcat.OfferCredential{Form: mcat.CredentialFormPair}}},
+		Serves: map[string]map[string]any{"postgres-database": {"port": 5432}}}, mcat.Manifest{Module: "store-two", Version: "1", Provides: []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeMesh, Credential: &mcat.OfferCredential{Form: mcat.CredentialFormPair}}},
+		Serves: map[string]map[string]any{"postgres-database": {"port": 5434}}})
+	r, err := Resolve(stores, []string{m.Module}, node, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	return r
+}
+
+// A consumer's plan entry carries the names the mesh composed for it through that provision (issue 792): what its
+// binding file names as `${bound:<provision>:name|internal-name|name-<local>|internal-name-<local>}`, so a moved
+// provider's helper copies them into the consumer's entry and the client fills the same text. A consumer
+// contributing no label has the entry it had.
+func TestAHandedModulesPlanEntryCarriesTheNamesComposedForIt(t *testing.T) {
+	m := notifierConsumer(t, true, false)
+	m.ContributesMany = map[string]map[string]map[string]any{
+		"postgres-database": {"web": {"label": "git"}, "api": {"label": "git-api"}}}
+	r := consumerOn(t, m, twoStores("anchor"))
+	r.PublicDomain = "example.org"
+	c, _ := composeWith(t, r, handingTo("store:5000"))
+	got := c.Plans["notify"].Provisions
+	if len(got) != 1 {
+		t.Fatalf("the plan names %+v", got)
+	}
+	want := map[string]string{"name-web": "git.example.org", "name-api": "git-api.example.org"}
+	own, err := resolutionOwnNames(r, m, "postgres-database", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := map[string]string{}
+	withOwnNames(file, own)
+	for k, v := range file {
+		if strings.HasPrefix(k, "internal-") {
+			want[k] = v
+		}
+	}
+	if !reflect.DeepEqual(got[0].Names, want) {
+		t.Fatalf("the entry carries %v, the binding file names %v", got[0].Names, want)
+	}
+}
+
+// A plan entry names the tool of an offer whose credential the provider's software issues (issue 928), so the vault
+// asks that tool for each holder; an offer of any other form names none.
+func TestAHandedModulesPlanNamesTheCredentialToolOfASoftwareIssuedOffer(t *testing.T) {
+	for credential, want := range map[string]string{
+		``:                                      "",
+		`,"credential":{"own":"admin"}`:         "",
+		`,"credential":{"issued-by":"outside"}`: "",
+		`,"credential":{"issued-by":"software","tool":"gitea_agent_token"}`: "gitea_agent_token",
+	} {
+		raw := `{"module":"store","version":"1","provides":[{"name":"postgres-database","scope":"mesh"` +
+			credential + `}],"serves":{"postgres-database":{"port":5432}}`
+		if strings.Contains(credential, `"own"`) {
+			raw += `,"own-secrets":{"admin":{"path":"/var/lib/store/admin","taken":"at-start"}}`
+		}
+		node := workstation()
+		node.At = "workstation.internal"
+		consumer := notifierConsumer(t, true, false)
+		r, err := Resolve(shelf(consumer, mustParse(t, raw+`}`)), []string{consumer.Module}, node, twoStores("anchor"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		r.Account = "op"
+		c, _ := composeWith(t, r, handingTo("store:5000"))
+		got := c.Plans["notify"].Provisions
+		if len(got) != 1 || got[0].CredentialTool != want {
+			t.Errorf("an offer with %q: the plan names %+v, want the tool %q", credential, got, want)
+		}
+	}
+}
diff --git a/internal/compose/resolution/handed_pulled_in_test.go b/internal/compose/resolution/handed_pulled_in_test.go
new file mode 100644
index 0000000..3eac0ca
--- /dev/null
+++ b/internal/compose/resolution/handed_pulled_in_test.go
@@ -0,0 +1,55 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// pulledInBy is a module that requires what raw's module provides, so resolving it alone pulls that module in.
+const pulledInBy = `{"module":"desk","version":"1","requires":["pulled-in-here"]}`
+
+// providing is raw's module providing what desk requires.
+func providing(raw string) string {
+	return strings.Replace(raw, `"version":"1",`, `"version":"1","provides":[{"name":"pulled-in-here"}],`, 1)
+}
+
+// onWorkstation resolves m on the workstation either assigned beside desk, or pulled in by desk alone.
+func onWorkstation(t *testing.T, m mcat.Manifest, assigned bool) mcat.Resolution {
+	t.Helper()
+	desk, err := decodeForTest([]byte(pulledInBy))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"desk"}
+	if assigned {
+		want = append(want, m.Module)
+	}
+	r, err := Resolve(shelf(m, desk), want, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	why := map[bool]string{true: "assigned", false: "required by desk"}[assigned]
+	if r.Because[m.Module] != why {
+		t.Fatalf("%s is on the workstation because %q, want %q", m.Module, r.Because[m.Module], why)
+	}
+	r.Account = "op"
+	return r
+}
+
+// What requires a module pulled in is said by name, for its value in the assignments mirror; nothing for one
+// assigned.
+func TestAPulledInModuleSaysWhatRequiresIt(t *testing.T) {
+	m := held(t, providing(notifierMoved()), builtNotifier())
+	if by := RequiredBy(onWorkstation(t, m, false), "notify"); by != "desk" {
+		t.Errorf("pulled in, notify is required by %q, want desk", by)
+	}
+	assigned := onWorkstation(t, m, true)
+	if by := RequiredBy(assigned, "notify"); by != "" {
+		t.Errorf("assigned, notify is required by %q", by)
+	}
+	if by := RequiredBy(assigned, "absent"); by != "" {
+		t.Errorf("a module not on the machine is required by %q", by)
+	}
+}
diff --git a/internal/compose/resolution/handed_secrets_test.go b/internal/compose/resolution/handed_secrets_test.go
new file mode 100644
index 0000000..e9d4924
--- /dev/null
+++ b/internal/compose/resolution/handed_secrets_test.go
@@ -0,0 +1,78 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const handedBot = `{"module":"bot","version":"1",
+  "own-secrets":{"token":"${dir:state}/token"},
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[
+    {"id":"state","type":"directory","mode":"0700","place":"."},
+    {"id":"conf","type":"file","path":"/etc/bot/bot.conf","mode":"0640","template":"files/bot.conf"},
+    {"id":"daemon","type":"process","name":"bot","run":["bot"],"env":{"BOT_TOKEN_FILE":"${dir:state}/token"}}]}`
+
+const botText = "token = ${secret:token}\nhome = ${machine:account-home}\n"
+
+func botMoved() string {
+	return strings.Replace(handedBot, `"version":"1",`, `"version":"1","moved":true,`, 1)
+}
+
+func builtBot(text string) []mcat.Built {
+	return []mcat.Built{{Name: "files", Kind: mcat.ArtifactArchive,
+		Reference: mcat.ArtifactStoreScheme + "bot/files/blobs/sha256:" + strings.Repeat("e", 64),
+		Digest:    "sha256:" + strings.Repeat("e", 64), Texts: map[string]string{"bot.conf": text}}}
+}
+
+// What the controller seals for the bot when it fills it the old way: a stand-in sealed value.
+func sealedForBot(with mcat.Rendering) mcat.Rendering {
+	with.Needed = map[string]map[string]string{"bot": {"token": "sealed-to-the-node"}}
+	return with
+}
+
+func TestAHandedModulesSecretsAreNamedAndNoValueIsSealed(t *testing.T) {
+	r := notifierOn(t, held(t, botMoved(), builtBot(botText)))
+	c, got := composeWith(t, r, handingTo("store:5000"))
+	if strings.Contains(got, "sealed") || strings.Contains(got, "${secret:") {
+		t.Fatalf("a handed module's declaration carries a sealed value or a secret placeholder: %s", got)
+	}
+	var token map[string]any
+	for _, res := range c.Resources {
+		if res["id"] == "bot.needs-token" {
+			token = res
+		}
+	}
+	if token == nil {
+		t.Fatalf("the token's file is not declared: %s", got)
+	}
+	if token["path"] == nil || strings.Contains(token["path"].(string), "${") || token["mode"] != "0600" ||
+		token["owner-at-runtime"] != "owned" || token[mcat.HandedSecretField] != nil {
+		t.Fatalf("the token's file is declared %v: placed, 0600, owned at runtime, no value", token)
+	}
+	path := token["path"].(string)
+	if !reflect.DeepEqual(c.Filled, []string{path, "/etc/bot/bot.conf"}) {
+		t.Fatalf("the filled files are %v", c.Filled)
+	}
+	if want := []mcat.PlanSecret{{Name: "token", Path: path}}; !reflect.DeepEqual(c.Plans["bot"].Secrets, want) {
+		t.Fatalf("the plan names secrets %+v, want %+v", c.Plans["bot"].Secrets, want)
+	}
+	// Issue 774 (postgres on novox, 2026-10-31): where the vault judged it handed, its secrets are the vault's even on a
+	// machine the node reads as not taking a filled file, and nothing is refused for a value the vault never answers.
+	judged, err := Compose(r, mcat.Rendering{ArtifactStore: "store:5000", Assigned: map[string]bool{"bot": true}})
+	if err != nil {
+		t.Fatalf("a module the vault judged handed is refused: %v", err)
+	}
+	if want := []mcat.PlanSecret{{Name: "token", Path: path}}; !reflect.DeepEqual(judged.Plans["bot"].Secrets, want) {
+		t.Errorf("judged handed by the vault, the plan names secrets %+v, want %+v", judged.Plans["bot"].Secrets, want)
+	}
+	// A process naming the token's file still restarts when its client writes it.
+	for _, res := range c.Resources {
+		if res["id"] == "bot.daemon" && !strings.Contains(strings.Join(stringsIn(res["restart-on"]), " "), "bot.needs-token") {
+			t.Errorf("the daemon does not restart on its token's file: %v", res["restart-on"])
+		}
+	}
+}
diff --git a/internal/compose/resolution/handed_test.go b/internal/compose/resolution/handed_test.go
new file mode 100644
index 0000000..561dc9e
--- /dev/null
+++ b/internal/compose/resolution/handed_test.go
@@ -0,0 +1,57 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const handedNotifier = `{"module":"notify","version":"1",
+  "config":{"width":{"type":"number","description":"How wide a notification is, in pixels.","default":250}},
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[
+    {"id":"configuration-dir","type":"directory","path":"${machine:account-home}/.config/notify","owner":"${machine:account}","mode":"0755"},
+    {"id":"configuration","type":"file","path":"${machine:account-home}/.config/notify/rc","owner":"${machine:account}","mode":"0644","template":"files/rc"},
+    {"id":"legacy","type":"file","path":"/etc/notify.conf","content":"plain = yes\n"},
+    {"id":"notifier","type":"service","unit":"notify.service","scope":"user","user":"${machine:account}","reload-on":["configuration"]}]}`
+
+const notifierText = "width = ${config:width}\nhome = ${machine:account-home}\n"
+
+func notifierMoved() string {
+	return strings.Replace(handedNotifier, `"version":"1",`, `"version":"1","moved":true,`, 1)
+}
+
+func builtNotifier() []mcat.Built {
+	return []mcat.Built{{Name: "files", Kind: mcat.ArtifactArchive,
+		Reference: mcat.ArtifactStoreScheme + "notify/files/blobs/sha256:" + strings.Repeat("d", 64),
+		Digest:    "sha256:" + strings.Repeat("d", 64), Texts: map[string]string{"rc": notifierText}}}
+}
+
+func notifierOn(t *testing.T, m mcat.Manifest) mcat.Resolution {
+	t.Helper()
+	r, err := Resolve(shelf(m), []string{m.Module}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	return r
+}
+
+func composeWith(t *testing.T, r mcat.Resolution, with mcat.Rendering) (mcat.Composed, string) {
+	t.Helper()
+	c, err := Compose(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, err := json.Marshal(c.Resources)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c, string(raw)
+}
+
+func handingTo(store string) mcat.Rendering {
+	return mcat.Rendering{Hands: true, Provisioner: "mesh-provisioner-client", ArtifactStore: store}
+}
diff --git a/internal/compose/resolution/health.go b/internal/compose/resolution/health.go
new file mode 100644
index 0000000..08746b0
--- /dev/null
+++ b/internal/compose/resolution/health.go
@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// healthInto composes a resource's `health` into the node-engine's words, or takes it away (to-be 48 §2,
+// §3): for an engine that reads it, the endpoint becomes the port this machine published it on and the
+// defaults are written out; for one that does not — older and strict — the field is not sent, and the
+// resource is judged by liveness alone, as before.
+func healthInto(resource map[string]any, m mcat.Manifest, with mcat.Rendering) {
+	if _, has := resource[mcat.HealthField]; !has {
+		return
+	}
+	if !with.ReadsHealth {
+		delete(resource, mcat.HealthField)
+		return
+	}
+	h, _, _ := mcat.ReadHealth(resource)
+	out := map[string]any{"kind": h.Kind, "interval": h.Interval.String(), "timeout": h.Timeout.String(),
+		"looks": h.Looks, "grace": h.Grace.String()}
+	if h.Endpoint != "" {
+		out["endpoint"] = h.Endpoint
+		if port, ok := mcat.EndpointPort(m, h.Endpoint); ok {
+			out["port"] = renderingMachinePort(with, m.Module, port)
+		}
+	}
+	if h.Kind == mcat.HealthHTTP {
+		path := h.Path
+		if path == "" {
+			path = "/"
+		}
+		out["path"] = path
+		if h.Status != 0 {
+			out["status"] = h.Status
+		}
+		if h.Body != "" {
+			out["body"] = h.Body
+		}
+		if h.Scheme != "" {
+			out["scheme"] = h.Scheme
+		}
+	}
+	if h.Command != "" {
+		out["command"] = h.Command
+	}
+	if h.Tool != "" {
+		out["tool"] = h.Tool
+	}
+	if h.Needs != "" {
+		out["needs"] = h.Needs
+	}
+	resource[mcat.HealthField] = out
+}
diff --git a/internal/compose/resolution/health_seats.go b/internal/compose/resolution/health_seats.go
new file mode 100644
index 0000000..78fa348
--- /dev/null
+++ b/internal/compose/resolution/health_seats.go
@@ -0,0 +1,104 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// healthDecision is the record that made the four seats.
+const healthDecision = "novox/hq ADR 0564"
+
+// conditionsVerbs are the condition keeper's verbs (ADR 0564 clauses 3, 9, 12).
+func conditionsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "conditions", Description: "What is wrong with the mesh now: every open condition, urgent first, then oldest, " +
+			"raised from the observers' findings (the watchman, the self-check, the healers, the assigner) and cleared when " +
+			"the finding goes, never by hand. Given a key, that one whole with its evidence; with history, every transition " +
+			"lately.",
+			Input: schema(map[string]string{
+				"key":      "a condition's key: that one whole; with history, only its transitions",
+				"scope":    "only this scope: machine, plan, call, build, merge, provider, seat, bus, core, probe, mesh, delivery or module",
+				"severity": "only urgent, or only warning",
+				"machine":  "only those about this machine",
+				"history":  "\"true\": every raising, change, silence and clearing lately, oldest first",
+				"days":     "with history: how many days back (default 7, at most 90)",
+			}, nil, "history")},
+		{Name: "silence", Description: "Stop one condition's messages for a while, a hand act with why: it stays open and in " +
+			"status, and the silence is kept as its transition in history.",
+			Input: schema(map[string]string{
+				"key":   "the condition's key",
+				"for":   "how long: 30m, 4h, 2d; at most 7d",
+				"why":   "why, required and recorded",
+				"cause": "the cause in a word (the condition's kind when absent)",
+			}, []string{"key", "for", "why"})},
+		{Name: "resync", Description: "Read every observer's findings again and raise and clear what differs from the open " +
+			"conditions: the recovery of a keeper that missed a change.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}
+
+// watchdogsVerbs are the watchman's verbs (ADR 0564 clauses 4, 5, 12).
+func watchdogsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "signals", Description: "Every watchdog of the signals table the watchman keeps, each a key that expires unless " +
+			"its signal renews it: its row, what renews it, its bound, the age of its newest signal, and the finding its " +
+			"expiry wrote.",
+			Input: schema(map[string]string{"row": "one row, e.g. S1"}, nil)},
+		{Name: "stuck", Description: "Every want, build or step the watchman says stopped moving past its bound, with since " +
+			"when and the words of its finding.",
+			Input: schema(map[string]string{"machine": "only those on this machine"}, nil)},
+		{Name: "presence", Description: "Every machine and tool runner the watchman sees connected, with its last word, and " +
+			"those it says silent; a machine that said it sleeps is shown as sleeping, not silent.",
+			Input: schema(map[string]string{"machine": "one machine"}, nil)},
+		{Name: "dead-letters", Description: "Every message a consumer on the bus gave up on, kept in DEAD_LETTERS: whose " +
+			"consumer, the subject, how often it was handed over and when it was given up, newest first. With id: that one " +
+			"whole. With deliver or drop, a hand act with why.",
+			Input: schema(map[string]string{
+				"id":       "a dead letter's id, as the list gives it: that one whole, with its message",
+				"consumer": "a consumer's name, or <stream>.<consumer>: only what that one gave up on",
+				"limit":    "how many to list, newest first (default 50); only when listing",
+				"deliver":  "a dead letter's id: deliver it again to the consumer that gave it up (needs why)",
+				"drop":     "a dead letter's id: drop it for good (needs why)",
+				"why":      "with deliver or drop: why, required and recorded",
+				"cause":    "with deliver or drop: the cause in a word (dead-letter when absent)",
+			}, nil)},
+		{Name: "resync", Description: "Rebuild presence from the bus's connections, and the pulses and findings from the keys " +
+			"the watchman watches, and take every dead-letter notice waiting: the recovery of a watchman that missed a change.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}
+
+// selfCheckVerbs are the self-check's verbs (ADR 0564 clause 6).
+func selfCheckVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "doctor", Description: "The self-check: the last run's verdict at once, each probe passed, failed, deferred " +
+			"(its facts not on the bus yet, named) or could not run, and how long ago. With run, a run now; with probe, one " +
+			"probe's verdict whole. Runs every five minutes on its own; each failure is a finding.",
+			Input: schema(map[string]string{
+				"run":   "\"true\": run every probe now and answer the verdict",
+				"probe": "one probe's id (D6): its verdict alone, with every finding",
+			}, nil, "run")},
+		{Name: "probes", Description: "The registry: what each probe asserts, where it reads its facts, and the finding it writes.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}
+
+// healersVerbs are the healers' verbs (ADR 0564 clauses 7, 8).
+func healersVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "healers", Description: "The healers: each registered response to one kind of condition, its repair, its " +
+			"budget and what happens when it is spent; every act taken lately with its outcome, and the mesh-wide brake.",
+			Input: schema(map[string]string{"days": "how many days of acts back (default 7)"}, nil)},
+		{Name: "heal", Description: "Take one healer's act for one open condition now, within its budget and the brake.",
+			Input: schema(map[string]string{
+				"key": "the condition's key",
+				"why": "why now, kept with the act",
+			}, []string{"key", "why"})},
+		{Name: "drill", Description: "Record a drill: something broken on purpose to see the mesh raise and clear it, with " +
+			"what it tests. A drill is never a repair: no healer is wanted for it however often it is run.",
+			Input: schema(map[string]string{
+				"what":      "what was done on purpose, in a line",
+				"why":       "what the drill tests",
+				"condition": "the key of the condition the drill is meant to raise, if any (optional)",
+			}, []string{"what", "why"})},
+	}
+}
diff --git a/internal/compose/resolution/health_test.go b/internal/compose/resolution/health_test.go
new file mode 100644
index 0000000..e7bb79b
--- /dev/null
+++ b/internal/compose/resolution/health_test.go
@@ -0,0 +1,104 @@
+package resolution
+
+import (
+	"encoding/json"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const healthDigest = "@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+// healthManifest is a module of one web container, one running service and one step, with the health
+// given on the container (or on the resource named by on).
+func healthManifest(t *testing.T, on string, health map[string]any, more ...map[string]any) []byte {
+	t.Helper()
+	resources := []map[string]any{
+		{"id": "server", "type": "container", "name": "app-server", "image": "registry.example/app" + healthDigest,
+			"ports": []any{"8080"}},
+		{"id": "daemon", "type": "service", "unit": "app.service", "state": "running"},
+		{"id": "seed", "type": "container", "name": "app-seed", "image": "registry.example/app" + healthDigest,
+			"run-once": true},
+		{"id": "sweep", "type": "container", "name": "app-sweep", "image": "registry.example/app" + healthDigest,
+			"schedule": "0 3 * * *"},
+	}
+	resources = append(resources, more...)
+	for _, r := range resources {
+		if r["id"] == on && health != nil {
+			r["health"] = health
+		}
+	}
+	m := map[string]any{"module": "app", "requires": []any{"postgres-database"}, "tools": []any{"app_status"},
+		"listens": []any{
+			map[string]any{"name": "web", "port": 8080, "from": "mesh"},
+			map[string]any{"name": "beacon", "port": 9999, "protocol": "udp", "from": "mesh"},
+		},
+		"resources": resources}
+	raw, err := json.Marshal(m)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+func TestHealthIsComposedAsThePortThisMachineGaveTheEndpoint(t *testing.T) {
+	m, err := decodeForTest(healthManifest(t, "server", map[string]any{"kind": "http", "endpoint": "web", "path": "/healthz",
+		"needs": "postgres-database"}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	compose := func(with mcat.Rendering) map[string]any {
+		out, err := Declaration(mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m}}, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		at := indexOfID(out, "app.server")
+		if at < 0 {
+			t.Fatal("the container was lost")
+		}
+		return out[at]
+	}
+	// An engine older than the field is not sent it: it would refuse the whole declaration.
+	if h, sent := compose(mcat.Rendering{Ports: map[string]map[int]int{"app": {8080: 31001}}})["health"]; sent {
+		t.Fatalf("health was sent to an engine that does not read it: %v", h)
+	}
+	got := compose(mcat.Rendering{ReadsHealth: true, Ports: map[string]map[int]int{"app": {8080: 31001}}})["health"].(map[string]any)
+	if got["port"] != 31001 || got["endpoint"] != "web" || got["path"] != "/healthz" || got["needs"] != "postgres-database" {
+		t.Errorf("composed as %v", got)
+	}
+	if got["interval"] != "30s" || got["timeout"] != "5s" || got["looks"] != 3 || got["grace"] != "1m0s" {
+		t.Errorf("the defaults were not written out: %v", got)
+	}
+	// The port this machine gives the endpoint moves, and the check moves with it.
+	moved := compose(mcat.Rendering{ReadsHealth: true, Ports: map[string]map[int]int{"app": {8080: 31002}}})["health"].(map[string]any)
+	if moved["port"] != 31002 {
+		t.Errorf("after the port moved the check still dials %v", moved["port"])
+	}
+	// And the catalogue's manifest is untouched by composing it.
+	if _, ok := m.Resources[0]["health"].(map[string]any)["port"]; ok {
+		t.Error("composing wrote the port into the catalogue's own manifest")
+	}
+}
+
+// What the controller composes the node-engine takes: every kind, composed for an engine that reads it,
+// passes the engine's own validator (mesh-host/validate) — one set of words on both sides.
+func TestEveryComposedHealthIsOneTheNodeEngineTakes(t *testing.T) {
+	for _, h := range []map[string]any{
+		{"kind": "http", "endpoint": "web", "path": "/healthz", "status": 200, "body": "ok", "needs": "postgres-database"},
+		{"kind": "tcp", "endpoint": "web", "interval": "10s", "timeout": "2s", "looks": 2, "grace": "0s"},
+		{"kind": "runtime"},
+		{"kind": "exec", "command": "pg_isready -q"},
+	} {
+		m, err := decodeForTest(healthManifest(t, "server", h,
+			map[string]any{"id": "admin", "type": "service", "unit": "app-admin.service", "state": "running",
+				"health": map[string]any{"kind": "tool", "tool": "app_status"}}))
+		if err != nil {
+			t.Fatal(err)
+		}
+		m.Resources[1]["health"] = map[string]any{"kind": "unit"}
+		if _, err := Declaration((mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m}}), mcat.Rendering{ReadsHealth: true,
+			Ports: map[string]map[int]int{"app": {8080: 31001}}}); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
diff --git a/internal/compose/resolution/holdings_test.go b/internal/compose/resolution/holdings_test.go
new file mode 100644
index 0000000..b0396fe
--- /dev/null
+++ b/internal/compose/resolution/holdings_test.go
@@ -0,0 +1,110 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func busSeatDelivering(t *testing.T, delivers string) {
+	t.Helper()
+	was := mcat.Seats()
+	t.Cleanup(func() { mcat.UseSeats(was) })
+	mcat.UseSeats([]mcat.Seat{{Name: "mesh-broker", Scope: mcat.ScopeMesh, Delivers: delivers, Decision: "test"}})
+}
+
+func oldBroker() mcat.Manifest {
+	return mcat.Manifest{Module: "old-broker", Provides: []mcat.Offer{{Name: "mesh-bus", Scope: mcat.ScopeMesh}},
+		Claims: []mcat.Claim{{Name: "mesh-broker", Scope: mcat.ScopeMesh}}}
+}
+
+func newBroker() mcat.Manifest {
+	return mcat.Manifest{Module: "new-broker", Provides: []mcat.Offer{{Name: "mesh-bus", Scope: mcat.ScopeMesh}},
+		Claims: []mcat.Claim{{Name: "mesh-broker", Scope: mcat.ScopeMesh}}}
+}
+
+// Nothing on record: exactly the old rule. One claimant holds; two are refused.
+func TestWithNoHolderOnRecordTheSoleClaimantHoldsAndTwoAreRefused(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	node := mcat.Node{Name: "anchor"}
+
+	held, problems := checkClaims([]mcat.Manifest{oldBroker()}, node, nil, nil)
+	if len(problems) != 0 || len(held) != 1 || held[0].Module != "old-broker" {
+		t.Fatalf("a sole claimant did not hold the seat: held=%v problems=%v", held, problems)
+	}
+	_, problems = checkClaims([]mcat.Manifest{oldBroker(), newBroker()}, node, nil, nil)
+	if len(problems) != 1 || !strings.Contains(problems[0], "both claim") {
+		t.Fatalf("two claimants with nothing on record were not refused: %v", problems)
+	}
+}
+
+// With a holder on record, the other eligible assignment is silent: not refused, and not holding.
+func TestTheHolderOnRecordHoldsAndTheOtherClaimantStandsBesideIt(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	node := mcat.Node{Name: "anchor"}
+	record := []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh, Node: "anchor", Module: "new-broker"}}
+
+	held, problems := checkClaims([]mcat.Manifest{oldBroker(), newBroker()}, node, nil, record)
+	if len(problems) != 0 {
+		t.Fatalf("the assignment beside the holder was refused: %v", problems)
+	}
+	if len(held) != 1 || held[0].Module != "new-broker" {
+		t.Fatalf("the holder on record is not the one holding: %v", held)
+	}
+}
+
+// The record names a node too: an eligible module on another machine holds nothing, and its
+// machine's set still resolves.
+func TestAHolderOnRecordElsewhereLeavesThisMachinesClaimantSilent(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	record := []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh, Node: "anchor", Module: "new-broker"}}
+
+	held, problems := checkClaims([]mcat.Manifest{oldBroker()}, mcat.Node{Name: "laptop"}, nil, record)
+	if len(problems) != 0 || len(held) != 0 {
+		t.Fatalf("a claimant elsewhere than the recorded holder was not simply silent: held=%v problems=%v",
+			held, problems)
+	}
+}
+
+// A machine being moved is handed its membership for the new bus as a sealed file in its own
+// declaration — the machine's, not any module's (design 28, task 5.2).
+func TestAMembershipForTheNewBusIsComposedAsASealedFile(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor"}
+	got, err := Compose(r, mcat.Rendering{BusMembership: "sealed-blob"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found map[string]any
+	for _, res := range got.Resources {
+		if res["id"] == BusMembershipID() {
+			found = res
+		}
+	}
+	if found == nil {
+		t.Fatalf("no membership resource in %v", got.Resources)
+	}
+	if found["path"] != mcat.BusMembershipPath || found["sealed"] != "sealed-blob" || found["mode"] != "0600" {
+		t.Fatalf("the membership is not a sealed 0600 file where the host reads it: %v", found)
+	}
+	// And a machine not being moved is handed nothing.
+	got, _ = Compose(r, mcat.Rendering{})
+	for _, res := range got.Resources {
+		if res["id"] == BusMembershipID() {
+			t.Fatal("a machine with no membership on record was handed one")
+		}
+	}
+}
+
+func TestARefusalWithNothingOnRecordNamesTheHandover(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	elsewhere := []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh, Node: "anchor", Module: "old-broker"}}
+
+	_, problems := checkClaims([]mcat.Manifest{newBroker()}, mcat.Node{Name: "laptop"}, elsewhere, nil)
+	if len(problems) != 1 {
+		t.Fatalf("two derived claimants across machines were not refused: %v", problems)
+	}
+	if !strings.Contains(problems[0], "`seat mesh-broker --to anchor/old-broker`") {
+		t.Fatalf("the refusal does not name the handover that records the holder: %s", problems[0])
+	}
+}
diff --git a/internal/compose/resolution/hostname_seat_test.go b/internal/compose/resolution/hostname_seat_test.go
new file mode 100644
index 0000000..1971074
--- /dev/null
+++ b/internal/compose/resolution/hostname_seat_test.go
@@ -0,0 +1,53 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The catalogue's module: /etc/hostname is the operator's `hostname` setting. Without it the module is
+// left out, naming the key — the mesh never renames a machine on its own — and a mesh-wide setting
+// naming ${machine:name} gives every machine its mesh name.
+func TestTheMachinesNameIsItsSetting(t *testing.T) {
+	cat := map[string]mcat.Manifest{"hostname": catalogueManifest(t, "hostname")}
+	got, err := Resolve(cat, []string{"hostname"}, mcat.Node{Name: "ace", At: "ace.internal"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	machines := map[string]string{"ace.internal": "10.42.0.2"}
+	nameOf := func(settings mcat.SettingsBy) (string, string) {
+		t.Helper()
+		composed, err := Compose(got, mcat.Rendering{Names: machines, Machines: machines, Suffix: "internal",
+			Settings: settings})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if why := composed.LeftOut["hostname"]; why != "" {
+			return "", why
+		}
+		for _, r := range composed.Resources {
+			if r["path"] == "/etc/hostname" {
+				return r["content"].(string), ""
+			}
+		}
+		t.Fatal("no /etc/hostname composed")
+		return "", ""
+	}
+
+	if _, why := nameOf(nil); !strings.Contains(why, "hostname") {
+		t.Errorf("with no setting the machine's name was written, or left out for another reason: %q", why)
+	}
+	if name, why := nameOf(mcat.SettingsBy{"hostname": {{From: "ace", Values: map[string]any{"hostname": "Ace"}}}}); name != "Ace\n" {
+		t.Errorf("the operator's name for the machine gave %q (%s)", name, why)
+	}
+	mesh := mcat.Layer{From: "the mesh", Values: map[string]any{"hostname": "${machine:name}"}}
+	if name, why := nameOf(mcat.SettingsBy{"hostname": {mesh}}); name != "ace\n" {
+		t.Errorf("a mesh-wide ${machine:name} gave %q (%s)", name, why)
+	}
+	node := mcat.Layer{From: "ace", Values: map[string]any{"hostname": "Ace"}}
+	if name, why := nameOf(mcat.SettingsBy{"hostname": {mesh, node}}); name != "Ace\n" {
+		t.Errorf("a machine's own name over the mesh-wide one gave %q (%s)", name, why)
+	}
+}
diff --git a/internal/compose/resolution/jails_into.go b/internal/compose/resolution/jails_into.go
new file mode 100644
index 0000000..420bc0b
--- /dev/null
+++ b/internal/compose/resolution/jails_into.go
@@ -0,0 +1,66 @@
+package resolution
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// jailsInto composes every jail declared by the modules on a node into the files the holder writes:
+// one jail file (all stanzas, so the fail2ban service restarts on a single resource) and one filter
+// file per jail (its failregex, which fail2ban references by the jail's name).
+//
+// Owned by the holder, because the directory is: two modules writing into one fail2ban is the
+// collision the holder model exists to prevent. Empty when nothing declares a jail — then the file
+// is written empty rather than absent, so removing the last jail is an ordinary change the service
+// restarts on rather than a file that vanishes.
+func jailsInto(modules []mcat.Manifest, j *mcat.Jailing) []map[string]any {
+	type declared struct {
+		module string
+		jail   mcat.Jail
+	}
+	var jails []declared
+	for _, m := range modules {
+		for _, jail := range m.Jails {
+			jails = append(jails, declared{m.Module, jail})
+		}
+	}
+	// A stable order the host applies as given (ADR 0005), and so the same set composes byte for
+	// byte every time rather than differing by map iteration.
+	sort.Slice(jails, func(a, b int) bool { return jails[a].jail.Name < jails[b].jail.Name })
+
+	var composed strings.Builder
+	composed.WriteString("# The mesh's jails, composed from the modules this node runs. Do not edit —\n")
+	composed.WriteString("# replaced whenever the node's modules change (novox/hq to-be 31).\n")
+
+	out := make([]map[string]any, 0, len(jails)+1)
+	for _, d := range jails {
+		// **The filter's digest rides in the jail file.** fail2ban is restarted when this file
+		// changes, and the filter is a file of its own: a module that changed only what a failure
+		// looks like rewrote the filter on disk and left the running jail on the old pattern, with
+		// nothing said (novox/hq issue 191's rollout found it on gitea's sshd). Naming the filter's
+		// digest here makes a changed pattern a changed jail file, so the restart the service
+		// already takes on it covers the filter too.
+		sum := sha256.Sum256([]byte(d.jail.Failregex))
+		fmt.Fprintf(&composed, "\n# from %s, filter %s\n[%s]\nenabled = true\nfilter = %s\n%s\n",
+			d.module, hex.EncodeToString(sum[:])[:12], d.jail.Name, d.jail.Name,
+			strings.TrimRight(d.jail.Jail, "\n"))
+		// The filter is a file of its own, named as the jail's filter= references it.
+		out = append(out, map[string]any{
+			"id":   "filter-" + d.jail.Name,
+			"type": "file", "path": strings.TrimRight(j.FilterInto, "/") + "/" + d.jail.Name + ".conf",
+			"mode": "0644",
+			"content": "# Generated by the mesh (from module " + d.module + "). Do not edit.\n" +
+				"[Definition]\nfailregex = " + d.jail.Failregex + "\n",
+		})
+	}
+	// The one jail file, first, with the fixed id the fail2ban service names in its restart-on.
+	return append([]map[string]any{{
+		"id": mcat.ComposedJailsID(), "type": "file", "path": j.Into, "mode": "0644",
+		"content": composed.String(),
+	}}, out...)
+}
diff --git a/internal/compose/resolution/jails_into_test.go b/internal/compose/resolution/jails_into_test.go
new file mode 100644
index 0000000..a42cd7e
--- /dev/null
+++ b/internal/compose/resolution/jails_into_test.go
@@ -0,0 +1,74 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A node's fail2ban jails are composed from the modules it runs (novox/hq to-be 31): the holder
+// (jailing) gathers every module's declared jail into one jail file and a filter file per jail.
+func TestJailsAreComposedFromTheNodesModules(t *testing.T) {
+	modules := []mcat.Manifest{
+		{Module: "fail2ban", Jailing: &mcat.Jailing{Into: "/etc/fail2ban/jail.d/mesh-composed.conf", FilterInto: "/etc/fail2ban/filter.d"}},
+		{Module: "postgres", Jails: []mcat.Jail{{Name: "postgres-auth", Failregex: "auth failed from <HOST>", Jail: "port = 5432\nmaxretry = 5"}}},
+	}
+	files := jailsInto(modules, modules[0].Jailing)
+
+	by := map[string]map[string]any{}
+	for _, f := range files {
+		by[f["id"].(string)] = f
+	}
+	jail := by[mcat.ComposedJailsID()]
+	if jail == nil || jail["path"] != "/etc/fail2ban/jail.d/mesh-composed.conf" {
+		t.Fatalf("the composed jail file was not written: %v", jail)
+	}
+	body := jail["content"].(string)
+	if !strings.Contains(body, "[postgres-auth]") || !strings.Contains(body, "filter = postgres-auth") ||
+		!strings.Contains(body, "port = 5432") {
+		t.Fatalf("the postgres jail stanza was not composed in:\n%s", body)
+	}
+	filter := by["filter-postgres-auth"]
+	if filter == nil || filter["path"] != "/etc/fail2ban/filter.d/postgres-auth.conf" {
+		t.Fatalf("the jail's filter file was not written: %v", filter)
+	}
+	if !strings.Contains(filter["content"].(string), "failregex = auth failed from <HOST>") {
+		t.Fatalf("the failregex was not written: %v", filter["content"])
+	}
+}
+
+// A holder whose node runs no jail-declaring module still gets the file, empty — so removing the
+// last jail is a change the service restarts on, not a file that vanishes.
+func TestTheComposedJailFileIsWrittenEvenWhenEmpty(t *testing.T) {
+	files := jailsInto([]mcat.Manifest{{Module: "fail2ban"}}, &mcat.Jailing{Into: "/x", FilterInto: "/f"})
+	if len(files) != 1 || files[0]["id"] != mcat.ComposedJailsID() {
+		t.Fatalf("the empty composed jail file was not written alone: %v", files)
+	}
+}
+
+// A changed pattern restarts fail2ban (novox/hq issue 191's rollout): the service restarts when the
+// composed jail file changes, and the filter is a file of its own, so the jail file names the
+// filter's digest. Changing only the failregex must change the jail file; the same pattern must not.
+func TestAChangedFilterChangesTheJailFile(t *testing.T) {
+	jailFile := func(failregex string) string {
+		modules := []mcat.Manifest{
+			{Module: "fail2ban", Jailing: &mcat.Jailing{Into: "/etc/fail2ban/jail.d/mesh.conf", FilterInto: "/etc/fail2ban/filter.d"}},
+			{Module: "gitea", Jails: []mcat.Jail{{Name: "gitea", Failregex: failregex, Jail: "port = 222"}}},
+		}
+		for _, f := range jailsInto(modules, modules[0].Jailing) {
+			if f["id"] == mcat.ComposedJailsID() {
+				return f["content"].(string)
+			}
+		}
+		t.Fatal("no composed jail file")
+		return ""
+	}
+	before := jailFile("web login failed from <HOST>")
+	if again := jailFile("web login failed from <HOST>"); again != before {
+		t.Errorf("the same pattern composed a different jail file, which would restart fail2ban for nothing")
+	}
+	if after := jailFile("web login failed from <HOST>\n            Invalid user .* from <HOST>"); after == before {
+		t.Errorf("a changed pattern left the jail file as it was, so fail2ban keeps the old filter:\n%s", after)
+	}
+}
diff --git a/internal/compose/resolution/kept_test.go b/internal/compose/resolution/kept_test.go
new file mode 100644
index 0000000..aba91dd
--- /dev/null
+++ b/internal/compose/resolution/kept_test.go
@@ -0,0 +1,59 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A module that keeps the operator-sealed secrets is handed the export as a file, at 0600, and a
+// module that does not keep them is handed nothing — the export goes to the vault and nowhere else.
+func TestOnlyAModuleThatKeepsGetsTheExport(t *testing.T) {
+	vault := mcat.Manifest{Module: "mesh-vault", Version: "1", Provides: mcat.FromAnywhere("secret"),
+		Keeps: "/var/lib/mesh-vault/root"}
+	other := mcat.Manifest{Module: "zsh", Version: "1", Provides: mcat.Offers("shell")}
+	got, err := Resolve(shelf(vault, other), []string{"mesh-vault", "zsh"}, mcat.Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kept := &mcat.KeptExport{Export: 1, OperatorKey: "OPERATOR", Fingerprint: "sha256:abcd",
+		Kept: []mcat.Kept{{Node: "anchor", Module: "postgres", Name: "superuser", Origin: "accepted", Sealed: "CIPHERTEXT", Key: "OPERATOR"}}}
+	out, err := Declaration(got, mcat.Rendering{Kept: kept})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var files int
+	for _, r := range out {
+		if r["path"] != "/var/lib/mesh-vault/root/export.json" {
+			continue
+		}
+		files++
+		if r["mode"] != "0600" {
+			t.Errorf("the export is written at mode %v, and it is the mesh's root secrets, sealed or not", r["mode"])
+		}
+		content, _ := r["content"].(string)
+		for _, want := range []string{`"operator-key": "OPERATOR"`, `"sealed": "CIPHERTEXT"`, `"module": "postgres"`} {
+			if !strings.Contains(content, want) {
+				t.Errorf("the export lacks %s:\n%s", want, content)
+			}
+		}
+		if id, _ := r["id"].(string); !strings.Contains(id, "mesh-vault") {
+			t.Errorf("the export's resource id %q does not carry its module", id)
+		}
+	}
+	if files != 1 {
+		t.Fatalf("%d export files; one module keeps them", files)
+	}
+
+	// No operator key yet: the vault is declared without the file, not with an empty one.
+	out, err = Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if r["path"] == "/var/lib/mesh-vault/root/export.json" {
+			t.Fatal("an export was written with nothing to export")
+		}
+	}
+}
diff --git a/internal/compose/resolution/keyed.go b/internal/compose/resolution/keyed.go
new file mode 100644
index 0000000..2db0b7f
--- /dev/null
+++ b/internal/compose/resolution/keyed.go
@@ -0,0 +1,14 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Keyed is whether a need is a provision of the seat mesh-provisioner: a key, an entry in its consumer's plan, and a
+// wait of the consumer's want. consumerHanded is whether the composition hands the consumer to the provisioner.
+func Keyed(consumerHanded bool, n mcat.Needed) bool {
+	if n.ByRecord || n.Module == "" || n.From == "" {
+		return false
+	}
+	return consumerHanded || n.AnsweredByHelper
+}
diff --git a/internal/compose/resolution/keyed_test.go b/internal/compose/resolution/keyed_test.go
new file mode 100644
index 0000000..2ca665c
--- /dev/null
+++ b/internal/compose/resolution/keyed_test.go
@@ -0,0 +1,142 @@
+package resolution
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A module not handed has a plan for what a provider's helper answers of it, and for nothing else (issue 774: grafana
+// had no plan, so no route key, and route-proxy served no route for it); a need the controller still answers stays out.
+func TestAModuleNotHandedHasAPlanForWhatAHelperAnswers(t *testing.T) {
+	consumer := notifierConsumer(t, false, false)
+	consumer.Requires = append(consumer.Requires, "route")
+	consumer.Contributes = map[string]map[string]any{"route": {"host": "notify.example.org"}}
+	consumer.ContributesMany = map[string]map[string]map[string]any{"route": {"api": {"label": "notify-api", "port": 9000}}}
+	node := workstation()
+	node.At, node.PublicDomain = "workstation.internal", "example.org"
+	proxy := mcat.Manifest{Module: "proxy", Version: "1", Provides: []mcat.Offer{{Name: "route", Scope: mcat.ScopeMesh, AnsweredBy: mcat.AnsweredByHelper}}}
+	store := mcat.Manifest{Module: "store", Version: "1", Provides: []mcat.Offer{{Name: "postgres-database", Scope: mcat.ScopeMesh,
+		Credential: &mcat.OfferCredential{Form: mcat.CredentialFormPair}}}, Serves: map[string]map[string]any{"postgres-database": {"port": 5432}}}
+	w := twoStores("anchor")
+	w.Offered["route"] = []mcat.Provider{{Node: "anchor", At: "anchor.internal", Module: "proxy"}}
+	r, err := Resolve(shelf(consumer, proxy, store), []string{consumer.Module}, node, w)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r.Account = "op"
+	for i, n := range r.Needs {
+		// As the plan sets it (compose's answeredByHelper).
+		r.Needs[i].AnsweredByHelper = n.Name == "route"
+	}
+	_, before := composeWith(t, r, mcat.Rendering{})
+	c, got := composeWith(t, r, handingTo("store:5000"))
+	if got != before {
+		t.Fatalf("the plan changed what is composed:\nbefore: %s\nnow:    %s", before, got)
+	}
+	plan, ok := c.Plans["notify"]
+	if !ok || len(plan.Provisions) != 1 || plan.Provisions[0].Provision != "route" || plan.Provisions[0].ProviderModule != "proxy" {
+		t.Fatalf("the plan is %+v (%v), want the route alone", plan, ok)
+	}
+	if plan.Templates != (mcat.PlanTemplates{}) || plan.Files != nil || plan.Secrets != nil ||
+		!strings.Contains(plan.Provisions[0].As, "notify") || plan.Provisions[0].Contributes["host"] != "notify.example.org" {
+		t.Fatalf("the plan names %+v", plan)
+	}
+	// What it contributes, composed as a received file carried it, and where its machine is, as opaque bytes the
+	// provider's own contract reads (issue 774, research 072 row 34): route-proxy serves the route from the plan alone.
+	given, err := mcat.DecodeContributed(plan.Provisions[0].Contributed)
+	if err != nil || given.At != "workstation.internal" || len(given.Each) != 2 || given.Each[0].Local != "" ||
+		string(given.Each[0].Values) != `{"host":"notify.example.org"}` || given.Each[1].Local != "api" ||
+		string(given.Each[1].Values) != `{"internal-name":"notify-api.anchor.internal","label":"notify-api","name":"notify-api.example.org","port":9000}` {
+		t.Fatalf("the plan gives %+v (%v)", given, err)
+	}
+	// Its port is where the machine publishes it, the number ${port:9000} gives the module and its declaration publishes,
+	// never the software's own where the placement moved it (2026-10-31: route-proxy dialled gitea's 3000, published at
+	// 20000): its provider dials what the plan says. Where a plan carries it, a port the module does not listen on is
+	// refused by module, node and port.
+	for _, p := range []struct {
+		name    string
+		ports   map[string]map[int]int
+		given   map[string]map[int]int
+		planned bool
+		port    float64
+		refused string
+	}{
+		{"assigned by the placement (gitea 3000 at 20000)", map[string]map[int]int{"notify": {9000: 20009}}, nil, true, 20009, ""},
+		{"given by the node over the placement", map[string]map[int]int{"notify": {9000: 20009}},
+			map[string]map[int]int{"notify": {9000: 9900}}, true, 9900, ""},
+		{"a bare published port the placement holds none for keeps its number (influxdb 8086)",
+			map[string]map[int]int{"notify": {9000: 9000}}, nil, true, 9000, ""},
+		{"a mapping the module fixed (as mailu 7080:80)", map[string]map[int]int{"notify": {9000: 7080}}, nil, true, 7080, ""},
+		{"a port the module does not listen on", nil, nil, true, 0,
+			"notify contributing to route: its port 9000 on workstation is none of the ports it listens on"},
+		{"a declaration with no ports leaves it as written", nil, nil, false, 9000, ""},
+	} {
+		with := handingTo("store:5000")
+		with.Ports, with.Given, with.Planned = p.ports, p.given, p.planned
+		c, err := Compose(r, with)
+		if p.refused != "" {
+			if err == nil || !strings.Contains(err.Error(), p.refused) {
+				t.Errorf("%s: composed with %v, want refused with %q", p.name, err, p.refused)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("%s: %v", p.name, err)
+			continue
+		}
+		given, err := mcat.DecodeContributed(c.Plans["notify"].Provisions[0].Contributed)
+		var api map[string]any
+		if err == nil {
+			err = json.Unmarshal(given.Each[1].Values, &api)
+		}
+		if err != nil || api["port"] != p.port || given.At != "workstation.internal" {
+			t.Errorf("%s: the plan gives %v at %q (%v), want port %v", p.name, api, given.At, err, p.port)
+		}
+	}
+	// Read strictly: a form the SDK does not write is refused, whatever its contributions say.
+	for raw, refused := range map[string]string{
+		`{"v":2,"each":[{"values":{}}]}`:                         "version 2",
+		`{"v":1,"each":[]}`:                                      "no contribution",
+		`{"v":1,"each":[{"values":{}}],"route":{}}`:              "unknown field",
+		`{"v":1,"each":[{"values":{}},{"values":{}}]}`:           "twice",
+		`{"v":1,"each":[{"local":"api","values":["a"]}]}`:        "not a JSON object",
+		`{"v":1,"each":[{"values":{}}]} {}`:                      "more than one",
+		`{"v":1,"at":"10.0.0.2","each":[{"values":{"x":true}}]}`: "",
+	} {
+		_, err := mcat.DecodeContributed(json.RawMessage(raw))
+		if (refused == "") != (err == nil) || err != nil && !strings.Contains(err.Error(), refused) {
+			t.Errorf("DecodeContributed(%s) = %v, want %q", raw, err, refused)
+		}
+	}
+	// And it hands nothing: Plan.Hands, the one rule every reader of a plan asks, by each part a plan can name.
+	if plan.Hands() {
+		t.Fatalf("a plan naming the route alone hands its module: %+v", plan)
+	}
+	for _, c := range []struct {
+		name  string
+		plan  mcat.Plan
+		hands bool
+	}{
+		{"empty", mcat.Plan{}, false},
+		{"provisions alone", mcat.Plan{Provisions: plan.Provisions}, false},
+		{"a digest without an archive", mcat.Plan{Templates: mcat.PlanTemplates{Digest: "sha256:1"}}, false},
+		{"templates alone", mcat.Plan{Templates: mcat.PlanTemplates{Source: "notify.tar", Digest: "sha256:1"}}, true},
+		{"files alone", mcat.Plan{Files: []mcat.PlanFile{{ID: "conf", Path: "/etc/notify.conf"}}}, true},
+		{"secrets alone", mcat.Plan{Secrets: []mcat.PlanSecret{{Name: "admin"}}}, true},
+		{"items alone", mcat.Plan{Items: []mcat.PlanItem{{Collection: "routes", Template: "route.tmpl"}}}, true},
+		{"secrets and provisions", mcat.Plan{Secrets: []mcat.PlanSecret{{Name: "admin"}}, Provisions: plan.Provisions}, true},
+	} {
+		if got := c.plan.Hands(); got != c.hands {
+			t.Errorf("%s: Hands() is %v, want %v", c.name, got, c.hands)
+		}
+	}
+	if want := mcat.Awaited(consumer, func(p string) []mcat.Manifest {
+		return map[string][]mcat.Manifest{"route": {proxy}, "postgres-database": {store}}[p]
+	}); !reflect.DeepEqual(want, []string{"route"}) {
+		t.Fatalf("the assigner waits for %v, and the plan keys the route alone", want)
+	}
+}
diff --git a/internal/compose/resolution/kinded_test.go b/internal/compose/resolution/kinded_test.go
new file mode 100644
index 0000000..554ba81
--- /dev/null
+++ b/internal/compose/resolution/kinded_test.go
@@ -0,0 +1,25 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func aChannel(module, kind string) mcat.Manifest {
+	return mcat.Manifest{Module: module, Claims: []mcat.Claim{
+		{Name: "channel", Scope: mcat.ScopeMesh, Kind: kind}, {Name: "intake", Scope: mcat.ScopeMesh, Kind: kind}}}
+}
+
+// Two kinds on one machine are two holders, and one kind on two machines is a second claimant.
+func TestEachKindIsItsOwnHolderWhenResolved(t *testing.T) {
+	modules := []mcat.Manifest{aChannel("telegram", "telegram"), aChannel("desk-channel", "desktop")}
+	held, problems := checkClaims(modules, mcat.Node{Name: "anchor"}, nil, nil)
+	if len(problems) > 0 || len(held) != 4 {
+		t.Fatalf("two kinds on one machine: held %v, problems %v", held, problems)
+	}
+	_, problems = checkClaims([]mcat.Manifest{aChannel("telegram", "telegram")}, mcat.Node{Name: "home"}, held, nil)
+	if len(problems) == 0 {
+		t.Fatal("one kind held on two machines was not refused")
+	}
+}
diff --git a/internal/compose/resolution/laid_values.go b/internal/compose/resolution/laid_values.go
new file mode 100644
index 0000000..1b8ebf6
--- /dev/null
+++ b/internal/compose/resolution/laid_values.go
@@ -0,0 +1,38 @@
+package resolution
+
+import (
+	"encoding/json"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// LaidSource says whether a value resolved from source is laid over a module's files: mesh config, node config and the
+// module's own value are; a manifest's default is not, since it is the composition's already and a taken key is laid
+// only when a layer sets it, never from a default (TakesSettingsField); an unset value is not, since a required one is
+// refused by the composition by name. **The one rule for every composer** (issue 1126, C2): the controller's config
+// read and a node composing its own lay the same values, so the two compose the same files.
+func LaidSource(source string) bool {
+	switch source {
+	case mcat.SourceMesh, mcat.SourceNode, mcat.SourceModule:
+		return true
+	}
+	return false
+}
+
+// LaidValue is one key of mesh-config_resolved read as a composer lays it: its value, and true when its source is laid
+// (LaidSource) and it holds a value; false for a default, an unset value, a source not known and a value that cannot be
+// read.
+func LaidValue(raw []byte) (any, bool) {
+	var r struct {
+		Value  json.RawMessage `json:"value"`
+		Source string          `json:"source"`
+	}
+	if json.Unmarshal(raw, &r) != nil || !LaidSource(r.Source) || len(r.Value) == 0 {
+		return nil, false
+	}
+	var v any
+	if json.Unmarshal(r.Value, &v) != nil {
+		return nil, false
+	}
+	return v, true
+}
diff --git a/internal/compose/resolution/licence_test.go b/internal/compose/resolution/licence_test.go
new file mode 100644
index 0000000..64bea19
--- /dev/null
+++ b/internal/compose/resolution/licence_test.go
@@ -0,0 +1,259 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func aModelUser() mcat.Manifest {
+	return mcat.Manifest{Module: "assistant", Requires: []string{"model-access"},
+		Binds:   map[string]string{"model-access": "/etc/assistant/model.json"},
+		Secrets: map[string]string{"model-access": "/etc/assistant/key"}}
+}
+
+// A provision answered by a record rather than a node.
+//
+// novox/hq ADR 0024: a hosted model is on nobody's machine and is reached over the public
+// internet, so the rule that refuses two ends sharing no private network must not apply. This
+// node is deliberately not on the private network at all — under the old rule that alone would
+// refuse it.
+func TestAProvisionAnsweredByARecordDoesNotNeedAPrivateNetwork(t *testing.T) {
+	got, err := Resolve(
+		map[string]mcat.Manifest{"assistant": aModelUser()},
+		[]string{"assistant"}, mcat.Node{Name: "workstation"}, mcat.World{
+			Licences: map[string][]mcat.Record{"model-access": {{Name: "personal",
+				Serves: map[string]any{"model": "a-model"}}}},
+			Using: map[string]map[string]mcat.Record{"assistant": {"model-access": {Name: "personal",
+				Serves: map[string]any{"model": "a-model"}}}},
+		})
+	if err != nil {
+		t.Fatalf("a machine off the private network could not be given model access: %v", err)
+	}
+	if len(got.Needs) != 1 {
+		t.Fatalf("the licence was not recorded as something this node takes: %+v", got.Needs)
+	}
+	if !got.Needs[0].ByRecord {
+		t.Fatal("the licence was treated as a machine, so the reachability rule would apply to it")
+	}
+	if got.Needs[0].From != "personal" {
+		t.Fatalf("the licence is not named by what a person calls it: %+v", got.Needs[0])
+	}
+}
+
+// Refused when the consumer has not said which — and the refusal names the candidates and the
+// command, because ADR 0024 warns this will be felt: a mesh holding three ways to reach a model
+// refuses every consumer that has not chosen.
+func TestAConsumerThatHasNotSaidWhichLicenceIsRefusedWithTheCandidates(t *testing.T) {
+	_, err := Resolve(
+		map[string]mcat.Manifest{"assistant": aModelUser()},
+		[]string{"assistant"}, mcat.Node{Name: "workstation"}, mcat.World{Licences: map[string][]mcat.Record{"model-access": {
+			{Name: "personal"}, {Name: "the-organisation"},
+		}}})
+	if err == nil {
+		t.Fatal("a consumer was given model access without anybody saying which")
+	}
+	said := err.Error()
+	for _, want := range []string{"personal", "the-organisation", "licence use"} {
+		if !strings.Contains(said, want) {
+			t.Fatalf("the refusal does not name %q, so it is correct and unusable:\n%s", want, said)
+		}
+	}
+}
+
+// A model the mesh runs itself answers it locally, and a record is not consulted.
+func TestAModelInTheMeshsOwnSetAnswersItWithoutALicence(t *testing.T) {
+	got, err := Resolve(
+		map[string]mcat.Manifest{
+			"assistant": aModelUser(),
+			"ollama": {Module: "ollama",
+				Provides: []mcat.Offer{{Name: "model-access", Scope: mcat.ScopeNode}}},
+		},
+		[]string{"assistant", "ollama"}, mcat.Node{Name: "workstation"}, mcat.World{Licences: map[string][]mcat.Record{"model-access": {{Name: "personal"}}}})
+	if err != nil {
+		t.Fatalf("a machine running its own model was asked to choose a licence: %v", err)
+	}
+	for _, n := range got.Needs {
+		if n.ByRecord {
+			t.Fatal("a record was used although the answer was on this machine")
+		}
+	}
+}
+
+// A key that was never supplied is refused by name rather than silently not written.
+//
+// The mesh discarded the plaintext when the key was accepted and cannot seal another, so a
+// machine that resolved cleanly would receive no file and fail at whatever read it.
+func TestAModuleOnALicenceWithNoKeyIsRefusedRatherThanLeftEmpty(t *testing.T) {
+	r := mcat.Resolution{
+		Node:    "workstation",
+		Modules: []mcat.Manifest{aModelUser()},
+		Needs:   []mcat.Needed{{Name: "model-access", From: "personal", ByRecord: true, For: "assistant"}},
+	}
+	_, err := Declaration(r, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module was given a licence with no key, so it receives nothing and fails later")
+	}
+	if !strings.Contains(err.Error(), "licence key personal") {
+		t.Fatalf("the refusal does not say how to fix it: %v", err)
+	}
+}
+
+// And with a key, both files arrive: what is public, and what is not.
+func TestALicenceDeliversWhatIsPublicAndWhatIsSealed(t *testing.T) {
+	r := mcat.Resolution{
+		Node:    "workstation",
+		Modules: []mcat.Manifest{aModelUser()},
+		Needs: []mcat.Needed{{Name: "model-access", From: "personal", ByRecord: true, For: "assistant",
+			Serves: map[string]any{"model": "a-model"}, Sealed: "sealed-blob"}},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	files := map[string]map[string]any{}
+	for _, res := range out {
+		if path, ok := res["path"].(string); ok {
+			files[path] = res
+		}
+	}
+	bound, given := files["/etc/assistant/model.json"]
+	if !given {
+		t.Fatal("the consumer was not told what it needs to know that is not secret")
+	}
+	content, _ := bound["content"].(string)
+	if !strings.Contains(content, "a-model") {
+		t.Fatalf("the binding does not carry what the licence serves:\n%s", content)
+	}
+	// The binding says it is a record rather than leaving an empty address, which a reader would
+	// take for something the mesh failed to fill in.
+	if !strings.Contains(content, "not a machine") {
+		t.Fatalf("the binding leaves an empty address with no explanation:\n%s", content)
+	}
+	key, delivered := files["/etc/assistant/key"]
+	if !delivered {
+		t.Fatal("the key was not delivered")
+	}
+	if key["sealed"] != "sealed-blob" {
+		t.Fatalf("the key is not the sealed one: %+v", key)
+	}
+	// And never in the open. The whole arrangement is that what travels is unreadable by
+	// everything between here and the machine.
+	if strings.Contains(content, "sealed-blob") {
+		t.Fatal("the key was written into the public file as well")
+	}
+}
+
+// One machine's unresolvable module must not remove it from the private network.
+//
+// The pass that answers *what does this node offer* takes a failed resolution to mean it learned
+// nothing — so refusing an unanswerable requirement there makes the machine disappear, and every
+// other machine is then told, wrongly, that the two of them share no network. A wrong answer about
+// a machine nobody asked about, caused by a fault on a third.
+func TestAnUnanswerableRequirementDoesNotRemoveAMachineFromTheMesh(t *testing.T) {
+	shelf := map[string]mcat.Manifest{
+		"assistant": aModelUser(),
+		"networking": {Module: "networking",
+			Provides: []mcat.Offer{{Name: "mesh-network", Scope: mcat.ScopeNode}}},
+	}
+	// The first pass: what does this machine offer? It is assigned something nothing answers.
+	got, err := Resolve(shelf, []string{"assistant", "networking"}, mcat.Node{Name: "laptop"}, mcat.World{Unchecked: true})
+	if err != nil {
+		t.Fatalf("a machine with one unanswerable requirement was lost entirely: %v", err)
+	}
+	var offers bool
+	for _, m := range got.Modules {
+		for _, o := range m.Offers() {
+			if o == "mesh-network" {
+				offers = true
+			}
+		}
+	}
+	if !offers {
+		t.Fatal("the machine's own network module was not seen, so it looks off the network")
+	}
+
+	// And the second pass, where the question is actually being asked, still refuses it.
+	if _, err := Resolve(shelf, []string{"assistant", "networking"}, mcat.Node{Name: "laptop"}, mcat.World{}); err == nil {
+		t.Fatal("the requirement nothing answers was accepted when it was actually asked")
+	}
+}
+
+// A same-node provider that mints no credential but serves a port the consumer cannot guess must
+// still deliver that port. A `local-model` provider (ollama) provides `model-access` at node scope
+// and serves a port and a model name, minting nothing; a co-located consumer requires and binds it
+// and has a file that names `${bound:model-access:port}`. The served facts never reached the
+// consumer's needs — node scope set `local`, not `brokered`, so the delivering branch was skipped —
+// and the consumer's file was refused for naming a provision it "did not require". The endpoint is
+// keyless, but a port is still a fact nobody can invent.
+func TestAKeylessSameNodeProviderStillDeliversWhatItServes(t *testing.T) {
+	provider := mcat.Manifest{Module: "local-model",
+		Provides: []mcat.Offer{{Name: "model-access", Scope: mcat.ScopeNode}},
+		Serves: map[string]map[string]any{
+			"model-access": {"port": 11434, "model": "a-model"}}}
+	consumer := mcat.Manifest{Module: "assistant", Requires: []string{"model-access"},
+		Binds: map[string]string{"model-access": "/etc/assistant/model.json"}}
+
+	// node.At empty: a single-node deployment with no private network. The delivered binding must
+	// still carry a usable address — loopback, because a machine off the network still reaches
+	// itself, and an empty `at` would be written into the consumer's file as a host that resolves
+	// to nothing.
+	got, err := Resolve(
+		map[string]mcat.Manifest{"local-model": provider, "assistant": consumer},
+		[]string{"assistant", "local-model"}, mcat.Node{Name: "workstation"}, mcat.World{})
+	if err != nil {
+		t.Fatalf("a keyless same-node model endpoint was refused: %v", err)
+	}
+
+	var found *mcat.Needed
+	for i := range got.Needs {
+		if got.Needs[i].Name == "model-access" && got.Needs[i].For == "assistant" {
+			found = &got.Needs[i]
+		}
+	}
+	if found == nil {
+		t.Fatalf("the served endpoint was not delivered to the consumer at all: %+v", got.Needs)
+	}
+	if found.ByRecord {
+		t.Fatal("a same-node endpoint was treated as a record, so the reachability rule would apply")
+	}
+	if found.At == "" {
+		t.Fatalf("the binding carries no address, so its file names a host that resolves to nothing: %+v", found)
+	}
+	if found.At != "127.0.0.1" {
+		t.Fatalf("off the private network the address must fall back to loopback, got %q", found.At)
+	}
+	if got, want := plainly(found.Serves["port"]), "11434"; got != want {
+		t.Fatalf("the port the consumer cannot guess was not delivered: got %q want %q", got, found.Serves)
+	}
+	if found.Serves["model"] != "a-model" {
+		t.Fatalf("the extra served fact was not delivered: %+v", found.Serves)
+	}
+
+	// End to end: a file that names ${bound:model-access:...} is filled rather than refused, which
+	// is the whole failure this fixes — boundInto reads knownFor, and knownFor reads the needs.
+	consumer.Resources = []map[string]any{{
+		"id": "env", "type": "file", "path": "/etc/assistant/.env",
+		"content": "OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1\n",
+	}}
+	got, err = Resolve(
+		map[string]mcat.Manifest{"local-model": provider, "assistant": consumer},
+		[]string{"assistant", "local-model"}, mcat.Node{Name: "workstation"}, mcat.World{})
+	if err != nil {
+		t.Fatalf("resolution refused the consumer with a bound file: %v", err)
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("the declaration refused the consumer's bound file: %v", err)
+	}
+	var env string
+	for _, res := range out {
+		if res["path"] == "/etc/assistant/.env" {
+			env, _ = res["content"].(string)
+		}
+	}
+	if want := "http://127.0.0.1:11434/v1"; !strings.Contains(env, want) {
+		t.Fatalf("the bound file was not filled with the served endpoint, want %q:\n%s", want, env)
+	}
+}
diff --git a/internal/compose/resolution/localnetwork.go b/internal/compose/resolution/localnetwork.go
new file mode 100644
index 0000000..0a3b725
--- /dev/null
+++ b/internal/compose/resolution/localnetwork.go
@@ -0,0 +1,117 @@
+package resolution
+
+import (
+	"fmt"
+	"net/netip"
+	"slices"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// privateRanges are the only ranges a local network may lie in (ADR 0340 §2): RFC 1918 for IPv4 and the
+// unique local addresses for IPv6. A network counts only when it lies wholly inside one of them.
+var privateRanges = []struct {
+	prefix netip.Prefix
+	name   string
+}{
+	{netip.MustParsePrefix("10.0.0.0/8"), "a private range (RFC 1918, 10.0.0.0/8)"},
+	{netip.MustParsePrefix("172.16.0.0/12"), "a private range (RFC 1918, 172.16.0.0/12)"},
+	{netip.MustParsePrefix("192.168.0.0/16"), "a private range (RFC 1918, 192.168.0.0/16)"},
+	{netip.MustParsePrefix("fc00::/7"), "the IPv6 unique local range (fc00::/7)"},
+}
+
+// JudgeLocalNetworks says, for each network a machine reported, whether it counts as its local network.
+//
+// **A public subnet never counts** (ADR 0340 §2): a network counts only when it lies wholly in a private
+// range, so `local-network` can never open a port to the internet — a machine sitting on a public /24 has
+// that /24 judged and refused, never rendered. A link-local network does not count either. And only a
+// link the machine reported as facing outside it counts (§3): the private network's own link and a
+// container bridge are this machine's own, not its local network, whatever their addresses.
+//
+// Sorted by link and then network, one entry per (link, network), so what `node` shows and what the
+// filter is rendered from do not depend on the order a machine happened to say them in.
+func JudgeLocalNetworks(attached []mcat.AttachedNetwork, outward []string, tunnel string) []mcat.LocalNetwork {
+	seen := map[[2]string]bool{}
+	var out []mcat.LocalNetwork
+	for _, a := range attached {
+		key := [2]string{a.Link, a.Network}
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, judgeOne(a, outward, tunnel))
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Link != out[j].Link {
+			return out[i].Link < out[j].Link
+		}
+		return out[i].Network < out[j].Network
+	})
+	return out
+}
+
+func judgeOne(a mcat.AttachedNetwork, outward []string, tunnel string) mcat.LocalNetwork {
+	j := mcat.LocalNetwork{Link: a.Link, Network: a.Network}
+	prefix, err := netip.ParsePrefix(strings.TrimSpace(a.Network))
+	if err != nil {
+		j.Why = "not a network the mesh can read (" + err.Error() + ")"
+		return j
+	}
+	prefix = prefix.Masked()
+	j.Network = prefix.String()
+	switch {
+	case tunnel != "" && a.Link == tunnel:
+		j.Why = "the private network's own link, not the local network"
+		return j
+	case !slices.Contains(outward, a.Link):
+		j.Why = fmt.Sprintf("%s does not face outside this machine (a bridge or a link of its own)", a.Link)
+		return j
+	case prefix.Addr().IsLoopback():
+		j.Why = "loopback"
+		return j
+	case prefix.Addr().IsLinkLocalUnicast():
+		j.Why = "link-local, never counted"
+		return j
+	}
+	for _, r := range privateRanges {
+		if r.prefix.Contains(prefix.Addr()) && prefix.Bits() >= r.prefix.Bits() {
+			j.Counts = true
+			j.Why = "in " + r.name
+			return j
+		}
+	}
+	if prefix.Addr().IsPrivate() {
+		// Overlaps a private range without lying wholly inside it (a /7 around 10.0.0.0/8, say).
+		j.Why = "not wholly in a private range, so never counted"
+		return j
+	}
+	j.Why = "public, never counted: local-network may not open a port to the internet"
+	return j
+}
+
+// CountedLocalNetworks is the networks that count, as the filter renders them: sorted, without repeats.
+func CountedLocalNetworks(judged []mcat.LocalNetwork) []string {
+	var out []string
+	for _, j := range judged {
+		if j.Counts && !slices.Contains(out, j.Network) {
+			out = append(out, j.Network)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// LocalNetworkPorts is every rule admitted from `local-network`, with the networks it resolved to.
+func LocalNetworkPorts(rules []mcat.Rule, networks []string) []mcat.LocalNetworkPort {
+	var out []mcat.LocalNetworkPort
+	for _, rule := range rules {
+		if rule.From != mcat.FromLocalNetwork {
+			continue
+		}
+		out = append(out, mcat.LocalNetworkPort{Port: rule.Port, Protocol: rule.Protocol,
+			Because: rule.Because, Networks: networks})
+	}
+	return out
+}
diff --git a/internal/compose/resolution/localnetwork_test.go b/internal/compose/resolution/localnetwork_test.go
new file mode 100644
index 0000000..fb60417
--- /dev/null
+++ b/internal/compose/resolution/localnetwork_test.go
@@ -0,0 +1,183 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
+// provider handed it, beside the private network's own link and a container bridge.
+var homeServer = []mcat.AttachedNetwork{
+	{Link: "eth0", Network: "192.168.1.10/24"},
+	{Link: "eth1", Network: "203.0.113.7/24"},
+	{Link: "eth0", Network: "fe80::1/64"},
+	{Link: "eth0", Network: "fd12:3456:789a::5/64"},
+	{Link: "wg-mesh", Network: "10.10.0.4/24"},
+	{Link: "docker0", Network: "172.17.0.1/16"},
+}
+
+func judged(t *testing.T) []mcat.LocalNetwork {
+	t.Helper()
+	return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
+}
+
+// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
+// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
+func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
+	got := CountedLocalNetworks(judged(t))
+	want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
+	if strings.Join(got, " ") != strings.Join(want, " ") {
+		t.Fatalf("counted %v, want %v", got, want)
+	}
+	for _, j := range judged(t) {
+		if j.Why == "" {
+			t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
+		}
+		switch j.Network {
+		case "203.0.113.0/24":
+			if j.Counts || !strings.Contains(j.Why, "public") {
+				t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
+			}
+		case "fe80::/64":
+			if j.Counts || !strings.Contains(j.Why, "link-local") {
+				t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
+			}
+		case "10.10.0.0/24", "172.17.0.0/16":
+			if j.Counts {
+				t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
+			}
+		}
+	}
+}
+
+// A network overlapping a private range without lying wholly inside it does not count either, so a
+// wide prefix around a private range cannot carry the internet with it.
+func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
+	for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
+		got := JudgeLocalNetworks([]mcat.AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
+		if len(got) != 1 || got[0].Counts {
+			t.Errorf("%s counts as a local network: %+v", n, got)
+		}
+	}
+}
+
+// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
+// in both chains, and never the public subnet.
+func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
+	rules := []mcat.Rule{
+		{Port: 1883, Protocol: "tcp", From: mcat.FromLocalNetwork, Because: []string{"mosquitto"}},
+		{Port: 5432, Protocol: "tcp", From: mcat.FromMesh, Because: []string{"postgres"}},
+	}
+	local := CountedLocalNetworks(judged(t))
+	out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
+		[]string{"eth0", "eth1"}, "wg-mesh", local)
+
+	for _, want := range []string{
+		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
+		"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
+		"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
+		// The mesh-only port is not widened by the machine having a local network.
+		"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("the rule set lacks %q:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, "203.0.113") {
+		t.Errorf("the public subnet reached the rule set:\n%s", out)
+	}
+	if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
+		t.Errorf("1883 is open to anywhere:\n%s", out)
+	}
+	for _, line := range strings.Split(out, "\n") {
+		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
+			t.Fatalf("1883 is open to anywhere:\n%s", out)
+		}
+	}
+}
+
+// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
+// port from the private network only, and the rule set says it found none — never widened to anywhere.
+func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
+	rules := []mcat.Rule{{Port: 1883, Protocol: "tcp", From: mcat.FromLocalNetwork, Because: []string{"mosquitto"}}}
+	out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
+	if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
+		t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
+	}
+	if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
+		t.Errorf("the port is not admitted from the private network:\n%s", out)
+	}
+	for _, line := range strings.Split(out, "\n") {
+		if strings.TrimSpace(line) == "tcp dport 1883 accept" {
+			t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
+		}
+	}
+	said := LocalNetworkPorts(rules, nil)[0].Said()
+	if !strings.Contains(said, "none") {
+		t.Errorf("plan says %q, want it to say no local network was found", said)
+	}
+}
+
+// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
+// filter opens — the internal name, not the public one.
+func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
+	public, internal := namesFor(t, aRoutedWeb(), reachSet(mcat.ReachLocalNetwork))
+	if public != "" || internal != "app.anchor.internal" {
+		t.Fatalf("names are %q and %q, want the internal name only", public, internal)
+	}
+	bare := aRoutedWeb()
+	bare.Contributes = nil
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{bare}}
+	rules, err := Rules(r, mcat.Rendering{Settings: reachSet(mcat.ReachLocalNetwork)})
+	if err != nil {
+		t.Fatalf("rules: %v", err)
+	}
+	if len(rules) != 1 || rules[0].From != mcat.FromLocalNetwork {
+		t.Fatalf("reach local-network made the filter say %+v", rules)
+	}
+}
+
+// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
+// the local network: it covers the mesh, and anywhere covers it.
+func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
+	got := widest([]mcat.Rule{
+		{Port: 53, Protocol: "udp", From: mcat.FromMesh, Because: []string{"a"}},
+		{Port: 53, Protocol: "udp", From: mcat.FromLocalNetwork, Because: []string{"b"}},
+	})
+	if len(got) != 1 || got[0].From != mcat.FromLocalNetwork || len(got[0].Because) != 2 {
+		t.Fatalf("got %+v", got)
+	}
+	got = widest(append(got, mcat.Rule{Port: 53, Protocol: "udp", From: mcat.FromEverywhere, Because: []string{"c"}}))
+	if len(got) != 1 || got[0].From != mcat.FromEverywhere {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+// On an adopted node the opening is the private network's part only: the found firewall admits the
+// local network, and an opening that widened to everywhere would open the port to the internet.
+func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
+	out := Openings([]mcat.Rule{{Port: 1883, Protocol: "tcp", From: mcat.FromLocalNetwork}}, nil, nil)
+	if len(out) != 1 || out[0]["from"] != mcat.OpeningFromMesh {
+		t.Fatalf("openings %v", out)
+	}
+}
+
+// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
+// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
+func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
+	got := JudgeLocalNetworks([]mcat.AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
+	if len(got) != 1 {
+		t.Fatalf("judged %+v", got)
+	}
+	if got[0].Counts {
+		t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
+	}
+	if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
+		t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
+	}
+	if n := CountedLocalNetworks(got); len(n) != 0 {
+		t.Fatalf("counted %v", n)
+	}
+}
diff --git a/internal/compose/resolution/machine_into_files.go b/internal/compose/resolution/machine_into_files.go
new file mode 100644
index 0000000..296f1ce
--- /dev/null
+++ b/internal/compose/resolution/machine_into_files.go
@@ -0,0 +1,153 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofMachine is where a module says a fact about the machine underneath it belongs:
+// ${machine:<key>}.
+var ofMachine = regexp.MustCompile(`\$\{machine:([a-z0-9][a-z0-9_-]*)\}`)
+
+// machineUsed are the keys a file's content asks for, first appearance first.
+func machineUsed(content string) []string {
+	var used []string
+	seen := map[string]bool{}
+	for _, m := range ofMachine.FindAllStringSubmatch(content, -1) {
+		if key := m[1]; !seen[key] {
+			seen[key] = true
+			used = append(used, key)
+		}
+	}
+	return used
+}
+
+// machineFacts is what a module may name about the machine it was assigned to.
+//
+// `at` is absent rather than empty when the machine is not on the private network. A module asking
+// to be reached at an address that does not exist is a misconfiguration, and it is said here —
+// where the module and the machine are both named — rather than discovered later as a certificate
+// nobody can verify.
+//
+// `address` is what `at` resolves to, read from the names the control plane composed — the same map
+// the hosts file and the resolver's wildcards are written from, so a file naming the machine's
+// address and the file every other machine reaches it by cannot disagree. Absent, like `at`, when
+// the machine is off the network or the mesh has not placed it.
+func machineFacts(r mcat.Resolution, names map[string]string, meshRange string) map[string]string {
+	out := map[string]string{"name": r.Node}
+	if r.At != "" {
+		out["at"] = r.At
+		if address := names[r.At]; address != "" {
+			out["address"] = address
+		}
+	}
+	// The private network's whole range — a mesh-wide fact, not this machine's, but named here
+	// because a module cannot know it and sometimes must (an intrusion filter that must never ban a
+	// tunnel peer). Absent when the mesh has no range to give.
+	if meshRange != "" {
+		out["mesh-range"] = meshRange
+	}
+	// The operator's login on this machine and where its home is (novox/hq to-be 29), so a module
+	// that writes operator config names the account and its home rather than a value it cannot know.
+	// Absent when no operator account is known — a headless box a person never logs into.
+	if r.Account != "" {
+		out["account"] = r.Account
+		out["account-home"] = accountHomeOf(r.Account, r.AccountHome)
+	}
+	// The account agents run as here, and whether it must never become root (novox/hq ADR 0266). The agent
+	// account where the node names one; the operator account otherwise, so a module writing the agent's
+	// home names one fact on every machine. `agent-root` is "never" only for an account of the agents' own:
+	// the user resource naming it then asks the node-engine to judge it, and on a machine where agents run
+	// as the operator it is empty, asserting nothing — the operator's account may become root there.
+	if agent, home := resolutionAgentAccount(r); agent != "" {
+		out["agent-account"] = agent
+		out["agent-home"] = home
+		out["agent-root"] = ""
+		if r.AgentAccount != "" {
+			out["agent-root"] = mcat.RootNever
+		}
+	}
+	return out
+}
+
+// agentAccount is the account agents run as on this machine and its home: the agent account when the node
+// names one (novox/hq ADR 0266), else the operator account; empty when neither is known.
+func resolutionAgentAccount(r mcat.Resolution) (string, string) {
+	if r.AgentAccount != "" {
+		return r.AgentAccount, agentHomeOf(r.AgentAccount, r.AgentAccountHome)
+	}
+	if r.Account != "" {
+		return r.Account, accountHomeOf(r.Account, r.AccountHome)
+	}
+	return "", ""
+}
+
+// agentHomeOf is where the agent account's home is: what was stored, or /home/<account>. Never /root: the
+// agent account is never root.
+func agentHomeOf(account, home string) string {
+	if home != "" {
+		return home
+	}
+	return "/home/" + account
+}
+
+// accountHomeOf is where an account's home is: what was stored, or the derived default — /root for
+// root, /home/<account> otherwise. The one place the default is written, so a fact and the store
+// cannot disagree about it.
+func accountHomeOf(account, home string) string {
+	if home != "" {
+		return home
+	}
+	if account == "root" {
+		return "/root"
+	}
+	return "/home/" + account
+}
+
+// machineInto replaces a file's ${machine:…} placeholders with what the mesh knows about the
+// machine the module was assigned to.
+//
+// A key the mesh does not hold is refused, for the same reason a binding's is: left alone, the
+// literal would be written into a configuration file and read as a value.
+func machineInto(resource map[string]any, facts map[string]string, module string) error {
+	// Content, and now the path and owner too: a module that writes into a person's home names it
+	// with ${machine:account-home} and ${machine:account}, which it cannot know until assigned
+	// (novox/hq to-be 29), the same reason its content names ${machine:address}. And the name a
+	// `user` shape sets the login shell of, and the user a user-scoped unit or a process runs as:
+	// the shell module makes the operator's account its holder's login shell, and the desktop's
+	// watchers run as that account (novox/hq ADR 0176, ADR 0177) — neither can name the person. And a
+	// user's `root`: the agent's module declares the account agents run as with ${machine:agent-root},
+	// "never" only where that account is the agents' own (novox/hq ADR 0266), and its `home`, so an account
+	// the operator named with a home of its own is made there (${machine:agent-home}); the node-engine reads a
+	// user's home only when it creates the account, so an existing one is never moved.
+	for _, field := range []string{"path", "owner", "content", "name", "user", "root", "home"} {
+		s, ok := resource[field].(string)
+		if !ok {
+			continue
+		}
+		for _, key := range machineUsed(s) {
+			value, has := facts[key]
+			if !has {
+				return fmt.Errorf(
+					"%s has a %s that says ${machine:%s}, and this machine says %s",
+					module, field, key, orNothing(namesOfFacts(facts)))
+			}
+			s = strings.ReplaceAll(s, fmt.Sprintf("${machine:%s}", key), value)
+			resource[field] = s
+		}
+	}
+	return nil
+}
+
+func namesOfFacts(facts map[string]string) []string {
+	out := make([]string, 0, len(facts))
+	for k := range facts {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/internal/compose/resolution/machine_into_files_test.go b/internal/compose/resolution/machine_into_files_test.go
new file mode 100644
index 0000000..0b7acee
--- /dev/null
+++ b/internal/compose/resolution/machine_into_files_test.go
@@ -0,0 +1,122 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// anchored is a machine on the private network, which is where a name worth certifying comes from.
+func anchored() mcat.Node {
+	n := workstation()
+	n.At = "workstation.internal"
+	return n
+}
+
+// authority is a module that must put its own machine's name into a file it writes.
+func authority() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "authority", Version: "1",
+		Provides: mcat.FromAnywhere("acme-ca"),
+		Serves:   map[string]map[string]any{"acme-ca": {}},
+		Resources: []map[string]any{{
+			"id": "init", "type": "file", "path": "/var/lib/authority/init.env",
+			"content": "NAMES=${machine:at},${machine:name},localhost\n",
+		}},
+	}
+}
+
+func TestAModuleNamesTheMachineItWasAssignedTo(t *testing.T) {
+	got, err := Resolve(shelf(authority()), []string{"authority"}, anchored(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	content := ""
+	for _, r := range mustDeclare(t, got) {
+		if strings.HasSuffix(plainly(r["id"]), "init") {
+			content = plainly(r["content"])
+		}
+	}
+	if content == "" {
+		t.Fatal("the authority's file was not declared")
+	}
+	if strings.Contains(content, "${machine:") {
+		t.Fatalf("the placeholder was written into the file as a value: %q", content)
+	}
+	// The machine's own name on the private network — the one a consumer is handed as `at`, and so
+	// the one a certificate has to carry.
+	if !strings.Contains(content, "workstation.internal") {
+		t.Errorf("the file does not name the address consumers reach it at: %q", content)
+	}
+}
+
+// A machine not on the private network has no such address, and a module asking to be reached at
+// one is named here rather than left to fail later as a certificate nobody can verify.
+func TestAnAddressAMachineDoesNotHaveIsRefused(t *testing.T) {
+	got, err := Resolve(shelf(authority()), []string{"authority"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Declaration(got, mcat.Rendering{}); err == nil {
+		t.Fatal("an address the machine does not have was substituted rather than refused")
+	} else if !strings.Contains(err.Error(), "at") {
+		t.Errorf("the refusal does not name what was asked for: %v", err)
+	}
+}
+
+// A module that must give software the machine's ADDRESS rather than its name — a resolver pointing
+// the container runtime at itself, whose list of resolvers cannot be a name — says
+// ${machine:address}, and gets what the machine's name resolves to on the private network: the same
+// address every other machine's hosts file carries for it.
+func TestAModuleNamesTheAddressBehindItsMachinesName(t *testing.T) {
+	pointing := mcat.Manifest{Module: "pointing", Version: "1", Resources: []map[string]any{{
+		"id": "runtime", "type": "file", "path": "/etc/runtime.json",
+		"content": `{"dns":["${machine:address}"]}`,
+	}}}
+	got, err := Resolve(shelf(pointing), []string{"pointing"}, anchored(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Names: map[string]string{
+		"workstation.internal": "10.42.0.7", "anchor.internal": "10.42.0.1"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if content := plainly(out[0]["content"]); content != `{"dns":["10.42.0.7"]}` {
+		t.Fatalf("the machine's address was not the one its name resolves to: %q", content)
+	}
+
+	// Off the network there is no such address, and the refusal says what the machine does have —
+	// rather than a placeholder written into the runtime's file and read as an address.
+	got, err = Resolve(shelf(pointing), []string{"pointing"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Declaration(got, mcat.Rendering{}); err == nil || !strings.Contains(err.Error(), "${machine:address}") {
+		t.Fatalf("a machine off the network was given an address, or refused for another reason: %v", err)
+	}
+}
+
+// The mesh's private range is offered as ${machine:mesh-range}, so a module names it rather than
+// hardcoding a value it cannot know (novox/hq ADR 0112) — the fail2ban ignoreip is the case.
+func TestAModuleNamesTheMeshRange(t *testing.T) {
+	facts := machineFacts(mcat.Resolution{Node: "anchor", At: "anchor.internal"}, map[string]string{"anchor.internal": "10.10.0.1"}, "10.10.0.0/24")
+	if facts["mesh-range"] != "10.10.0.0/24" {
+		t.Fatalf("the mesh range is not a machine fact: %v", facts)
+	}
+	res := map[string]any{"type": "file", "id": "jail", "content": "ignoreip = 127.0.0.1/8 ${machine:mesh-range}\n"}
+	if err := machineInto(res, facts, "fail2ban"); err != nil {
+		t.Fatal(err)
+	}
+	if got := res["content"].(string); !strings.Contains(got, "10.10.0.0/24") || strings.Contains(got, "${machine:") {
+		t.Fatalf("the mesh range was not written in: %q", got)
+	}
+	// A mesh with no range gives no such fact, and a file that names it is refused rather than
+	// left with a literal placeholder in it.
+	none := machineFacts(mcat.Resolution{Node: "anchor"}, nil, "")
+	if _, has := none["mesh-range"]; has {
+		t.Fatal("a mesh with no range still offered one")
+	}
+}
diff --git a/internal/compose/resolution/manifest.go b/internal/compose/resolution/manifest.go
new file mode 100644
index 0000000..cec6bc7
--- /dev/null
+++ b/internal/compose/resolution/manifest.go
@@ -0,0 +1,23 @@
+package resolution
+
+import (
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// OffersIssuedOutside is whether any module of a catalogue offers the provision with a credential issued outside
+// the mesh (novox/hq ADR 0337), and the first such module by name.
+func OffersIssuedOutside(shelf map[string]mcat.Manifest, provision string) (string, bool) {
+	var names []string
+	for name, m := range shelf {
+		if m.IssuedOutsideOf(provision) {
+			names = append(names, name)
+		}
+	}
+	if len(names) == 0 {
+		return "", false
+	}
+	sort.Strings(names)
+	return names[0], true
+}
diff --git a/internal/compose/resolution/names_test.go b/internal/compose/resolution/names_test.go
new file mode 100644
index 0000000..2b1ad2d
--- /dev/null
+++ b/internal/compose/resolution/names_test.go
@@ -0,0 +1,56 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func containersOf(t *testing.T, r mcat.Resolution, with mcat.Rendering) []map[string]any {
+	t.Helper()
+	out, err := Declaration(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found []map[string]any
+	for _, res := range out {
+		if res["type"] == "container" {
+			found = append(found, res)
+		}
+	}
+	return found
+}
+
+func namesOf(r map[string]any) []string {
+	var out []string
+	if given, ok := r["hosts"].([]any); ok {
+		for _, h := range given {
+			out = append(out, h.(string))
+		}
+	}
+	return out
+}
+
+// No resource is given a `hosts` key it did not declare. A file or a service carrying one is a
+// declaration the host refuses outright — it takes no unknown field — so an invented key breaks
+// the whole machine rather than one resource.
+func TestNothingIsGivenNamesItDidNotDeclare(t *testing.T) {
+	out, err := Declaration(mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{{
+		Module: "app",
+		Resources: []map[string]any{
+			{"id": "conf", "type": "file", "path": "/etc/app.conf", "content": "x", "mode": "0644"},
+			{"id": "run", "type": "service", "unit": "app.service", "state": "running"},
+			{"id": "web", "type": "container", "name": "web",
+				"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)},
+		},
+	}}}, mcat.Rendering{Names: map[string]string{"anchor.internal": "10.42.0.1"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if _, given := r["hosts"]; given {
+			t.Fatalf("a %v was given names it never declared: %v", r["type"], r)
+		}
+	}
+}
diff --git a/internal/compose/resolution/needs_test.go b/internal/compose/resolution/needs_test.go
new file mode 100644
index 0000000..7740b69
--- /dev/null
+++ b/internal/compose/resolution/needs_test.go
@@ -0,0 +1,79 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func needy() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "postgres", Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"superuser": {Path: "/var/lib/mesh/postgres/superuser"}},
+		Resources: []map[string]any{
+			{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
+		},
+	}
+}
+
+func TestAModulesOwnSecretLandsSealed(t *testing.T) {
+	got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{
+		Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if r["path"] != "/var/lib/mesh/postgres/superuser" {
+			continue
+		}
+		if r["sealed"] != "c2VhbGVk" {
+			t.Fatalf("got %v", r)
+		}
+		if r["content"] != nil {
+			t.Fatal("a module's own secret was written in the clear")
+		}
+		return
+	}
+	t.Fatalf("no secret was written: %v", out)
+}
+
+func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
+	// Skipping it would start a database with no password it knows, which fails to authenticate
+	// three layers from the machine reporting it.
+	got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
+	_, err := Declaration(got, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module needing a secret was declared without one")
+	}
+	if !strings.Contains(err.Error(), "superuser") {
+		t.Fatalf("the refusal does not name what is missing: %v", err)
+	}
+}
+
+func TestAModuleMayNeedSeveralThings(t *testing.T) {
+	// A password and a token, say. Telling them apart is the module's business, not the mesh's.
+	m := needy()
+	m.OwnSecrets["replication"] = mcat.OwnSecret{Path: "/var/lib/mesh/postgres/replication"}
+	got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), mcat.World{})
+	out, err := Declaration(got, mcat.Rendering{Needed: map[string]map[string]string{
+		"postgres": {"superuser": "b25l", "replication": "dHdv"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]string{}
+	for _, r := range out {
+		if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
+			seen[path], _ = r["sealed"].(string)
+		}
+	}
+	if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
+		t.Fatalf("two needs did not land as two secrets: %v", seen)
+	}
+}
diff --git a/internal/compose/resolution/no_subjects_test.go b/internal/compose/resolution/no_subjects_test.go
new file mode 100644
index 0000000..6946b19
--- /dev/null
+++ b/internal/compose/resolution/no_subjects_test.go
@@ -0,0 +1,41 @@
+package resolution
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// theCatalogue is every manifest of the catalogue internal/beside finds, parsed the way registration
+// parses one.
+func theCatalogue(t *testing.T) []mcat.Manifest {
+	t.Helper()
+	root := beside.Catalogue(t)
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []mcat.Manifest
+	for _, e := range entries {
+		if !e.IsDir() {
+			continue
+		}
+		raw, err := os.ReadFile(filepath.Join(root, e.Name(), "module.json"))
+		if err != nil {
+			continue
+		}
+		var m mcat.Manifest
+		if err := json.Unmarshal(raw, &m); err != nil {
+			t.Fatalf("%s: %v", e.Name(), err)
+		}
+		out = append(out, m)
+	}
+	if len(out) == 0 {
+		t.Fatalf("no manifests under %s, so this proved nothing", root)
+	}
+	return out
+}
diff --git a/internal/compose/resolution/node_resolver.go b/internal/compose/resolution/node_resolver.go
new file mode 100644
index 0000000..ef796db
--- /dev/null
+++ b/internal/compose/resolution/node_resolver.go
@@ -0,0 +1,97 @@
+package resolution
+
+import (
+	"path"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// resolverVerbs is the contract every holder of node-resolver serves (novox/hq ADR 0247): what is routed
+// where, route a set of domains, and take a route away. The same verbs are served on the machine itself to
+// the modules there, so what a VPN pushed never crosses the bus to be routed; on the mesh they are the
+// operator's way to read and correct the same.
+func resolverVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "routes", Description: "What this machine's own resolver sends where: the mesh's resolvers, " +
+			"which answer every name not routed elsewhere, and each link given servers of its own with the " +
+			"domains routed to them. Also the resolver file's outside writes it kept, newest first: when, who " +
+			"wrote it as far as the file says, whether a module took it, and when the resolver's own file was " +
+			"put back.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"resolvectl status", "resolvectl dns", "resolvectl domain"}},
+		{Name: "route", Description: "Send these domains, and every name under them, to these servers over " +
+			"this link — and only them: the link is never the machine's default route for names, and the " +
+			"mesh's own domain is refused. Replaces whatever the link was given before. A link that goes away " +
+			"takes its route with it.",
+			Input: schema(map[string]string{
+				"link":    "the network link the servers are reached over, by name (a VPN's tunnel interface)",
+				"domains": "the domains to route there, separated by spaces or commas",
+				"servers": "the servers' addresses, separated by spaces or commas",
+			}, []string{"link", "domains", "servers"}),
+			Replaces: []string{"resolvectl dns", "resolvectl domain", "resolvectl default-route"}},
+		{Name: "unroute", Description: "Take one link's route away: its domains go back to the mesh's " +
+			"resolvers. Nothing changes when the link has none.",
+			Input:    schema(map[string]string{"link": "the network link, by name"}, []string{"link"}),
+			Replaces: []string{"resolvectl revert"}},
+	}
+}
+
+// holdsSeat says whether a module claims a seat, by its current name.
+func holdsSeat(m mcat.Manifest, seat string) bool {
+	for _, c := range m.Claims {
+		if canonicalSeat(c.Name) == seat {
+			return true
+		}
+	}
+	return false
+}
+
+// stepsBack is the module as it composes among the modules of one machine (novox/hq ADR 0287,
+// ADR 0247):
+// **where it holds a seat that names a path stepping back for another seat, and that other seat's holder
+// is on the machine and declares the path, its own rendering of the path is left out**, and nothing else
+// of it changes. Only a file the mesh renders for it steps back, as before: a resource on the path is
+// composed as declared (the declaration copies a module's resources whole), so an uplink holder declaring
+// the resolver file as a resource beside the resolver's holder is two owners of one path, and refused. The stepping back is the seat's definition — node-uplink stepping back from the resolver
+// file for node-resolver — so any other module declaring the path beside the owner's is still two owners
+// of one path, and is refused as before.
+func stepsBack(m mcat.Manifest, modules []mcat.Manifest) mcat.Manifest {
+	drop := map[string]bool{}
+	for _, c := range m.Claims {
+		seat, known := mcat.SeatNamed(c.Name)
+		if !known {
+			continue
+		}
+		for _, p := range seat.Paths {
+			if p.StepsBackFor == "" {
+				continue
+			}
+			for _, o := range modules {
+				if o.Module != m.Module && holdsSeat(o, p.StepsBackFor) && declaresPath(o, p.Path) {
+					drop[p.Path] = true
+				}
+			}
+		}
+	}
+	if len(drop) == 0 {
+		return m
+	}
+	facts := make(map[string]mcat.RosterFile, len(m.Facts))
+	for name, f := range m.Facts {
+		if !f.Home && drop[path.Clean(f.Path)] {
+			continue
+		}
+		facts[name] = f
+	}
+	m.Facts = facts
+	return m
+}
+
+// steppedBack is every module of one machine as it composes there (stepsBack, each).
+func steppedBack(modules []mcat.Manifest) []mcat.Manifest {
+	out := make([]mcat.Manifest, len(modules))
+	for i, m := range modules {
+		out[i] = stepsBack(m, modules)
+	}
+	return out
+}
diff --git a/internal/compose/resolution/node_resolver_test.go b/internal/compose/resolution/node_resolver_test.go
new file mode 100644
index 0000000..4033831
--- /dev/null
+++ b/internal/compose/resolution/node_resolver_test.go
@@ -0,0 +1,184 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// localResolver is a stand-in holder: it claims the seat and renders the resolver file naming the
+// machine's own address. What is under test is the controller's rule, not the catalogue's module.
+func localResolver() mcat.Manifest {
+	return mcat.Manifest{Module: "local-resolver", Version: "1",
+		Claims: []mcat.Claim{{Name: mcat.ResolverSeat, Scope: mcat.ScopeNode}},
+		Facts: map[string]mcat.RosterFile{"resolvers": {Path: mcat.ResolverFile,
+			Template: "# Managed by the mesh\n{{range .Machines}}{{if eq .Name $.Node}}nameserver {{.Address}}\n{{end}}{{end}}"}}}
+}
+
+func splitDNSLaptop() mcat.Node {
+	return mcat.Node{Name: "laptop", At: "laptop.internal", Capabilities: map[string]bool{
+		"package-manager": true, "service-manager": true, "uplink-systemd-networkd": true}}
+}
+
+// Where a module holds node-resolver, the machine is composed one resolver file, the holder's, naming
+// the machine's own address; the uplink's holder composes everything else it declares, and not that file.
+func TestWhereTheResolverIsHeldItWritesTheFileAndTheUplinkStepsBack(t *testing.T) {
+	shelf := resolverShelf(t)
+	shelf["local-resolver"] = localResolver()
+	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "local-resolver"}, splitDNSLaptop(), mcat.World{})
+	if err != nil {
+		t.Fatalf("the resolver's holder and the uplink's were refused together: %v", err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: mcat.SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var files []string
+	for _, r := range out {
+		if r["path"] == mcat.ResolverFile {
+			files = append(files, r["id"].(string))
+		}
+	}
+	if strings.Join(files, " ") != "local-resolver.fact-resolvers" {
+		t.Fatalf("the resolver file is composed as %v; once, the resolver's", files)
+	}
+	content := byID(out)["local-resolver.fact-resolvers"]["content"].(string)
+	if !strings.Contains(content, "nameserver 10.42.0.2\n") || strings.Contains(content, "10.42.0.1") {
+		t.Errorf("the resolver file does not name this machine's own resolver alone:\n%s", content)
+	}
+	// The uplink's holder is still composed: only the one file moved.
+	uplinkComposed := false
+	for _, r := range out {
+		if id, _ := r["id"].(string); strings.HasPrefix(id, "systemd-networkd.") {
+			uplinkComposed = true
+		}
+	}
+	if !uplinkComposed {
+		t.Errorf("the uplink's holder composed nothing once the resolver was held")
+	}
+}
+
+// Where nobody holds it, nothing changes: the uplink's holder writes the file, listing the mesh's
+// resolvers (ADR 0223) — every machine but the one that requires split-dns.
+func TestWithoutTheResolverTheUplinkWritesTheFileAsBefore(t *testing.T) {
+	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "systemd-networkd"}, splitDNSLaptop(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: mcat.SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r := byID(out)["systemd-networkd.fact-resolvers"]; r == nil || r["path"] != mcat.ResolverFile {
+		t.Fatalf("without the resolver, the uplink's holder no longer writes the resolver file: %v", r)
+	}
+}
+
+// Only the uplink's holder steps back. A third module rendering or declaring the file beside the
+// resolver's is two owners of one path, refused as before; and a module rendering it without holding
+// the seat is not the resolver, so the uplink's holder does not step back for it.
+func TestOnlyTheUplinkStepsBackForTheResolver(t *testing.T) {
+	uplink := mcat.Manifest{Module: "uplink", Version: "1", Claims: []mcat.Claim{{Name: "node-uplink"}},
+		Facts: map[string]mcat.RosterFile{"resolvers": {Path: mcat.ResolverFile, Template: "nameserver 10.42.0.1\n"}}}
+	if p := checkResources([]mcat.Manifest{uplink, localResolver()}); len(p) != 0 {
+		t.Errorf("the uplink's holder and the resolver's were refused together: %v", p)
+	}
+	other := mcat.Manifest{Module: "other", Version: "1",
+		Facts: map[string]mcat.RosterFile{"mine": {Path: mcat.ResolverFile, Template: "nameserver 10.42.0.9\n"}}}
+	if p := checkResources([]mcat.Manifest{uplink, localResolver(), other}); len(p) == 0 {
+		t.Error("a third module wrote the resolver file beside the resolver's")
+	}
+	if p := checkResources([]mcat.Manifest{uplink, other}); len(p) == 0 {
+		t.Error("a module that does not hold node-resolver took the resolver file from the uplink's holder")
+	}
+	declared := mcat.Manifest{Module: "declared", Version: "1", Resources: []map[string]any{
+		{"id": "mine", "type": "file", "path": mcat.ResolverFile, "content": "nameserver 10.42.0.9\n"}}}
+	if p := checkResources([]mcat.Manifest{uplink, localResolver(), declared}); len(p) == 0 {
+		t.Error("a module declaring the resolver file was let beside the resolver's")
+	}
+	// What steps back is the one file: the uplink's other facts stay.
+	uplink.Facts["hosts"] = mcat.RosterFile{Path: "/etc/elsewhere", Template: "x"}
+	if got := stepsBack(uplink, []mcat.Manifest{uplink, localResolver()}); len(got.Facts) != 1 || got.Facts["hosts"].Path == "" {
+		t.Errorf("the uplink's holder lost more than the resolver file: %v", got.Facts)
+	}
+	if got := stepsBack(uplink, []mcat.Manifest{uplink}); len(got.Facts) != 2 {
+		t.Errorf("the uplink's holder stepped back with no resolver held: %v", got.Facts)
+	}
+}
+
+// The catalogue as it is: every holder of node-resolver renders the resolver file as the mesh's own
+// (its header is how the uplink's verb and the node-engine read a file as the mesh's), and provides
+// split-dns at the machine's reach — a requirement is answered only on the same machine and never pulls
+// the resolver in. Skipped while the catalogue has no holder.
+func TestTheCataloguesResolverHoldersWriteTheFileAndProvideSplitDNS(t *testing.T) {
+	held := 0
+	for _, m := range theCatalogue(t) {
+		if !holdsSeat(m, mcat.ResolverSeat) {
+			continue
+		}
+		held++
+		f, ok := m.Facts["resolvers"]
+		if !ok || f.Path != mcat.ResolverFile || !strings.HasPrefix(f.Template, "# Managed by the mesh") {
+			t.Errorf("%s holds %s and does not render the resolver file as the mesh's: %+v", m.Module, mcat.ResolverSeat, f)
+		}
+		provides := false
+		for _, o := range m.Provides {
+			if o.Name == "split-dns" && o.Reach == mcat.ReachMachine {
+				provides = true
+			}
+		}
+		if !provides {
+			t.Errorf("%s holds %s and does not provide split-dns at the machine's reach", m.Module, mcat.ResolverSeat)
+		}
+	}
+	if held == 0 {
+		t.Skip("no module of the catalogue holds node-resolver yet")
+	}
+}
+
+// The catalogue's systemd-resolved, composed on a machine beside its uplink: the resolver file names the
+// machine's own private address alone, its kept copy is the same file, and resolved is given every mesh
+// resolver as its default route and the private address to listen on. Skipped without the catalogue.
+func TestTheCataloguesResolverComposesOnAMachine(t *testing.T) {
+	shelf := resolverShelf(t)
+	shelf["systemd-resolved"] = catalogueManifest(t, "systemd-resolved")
+	got, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "systemd-resolved"}, splitDNSLaptop(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Names: twoMachines, Machines: twoMachines, Suffix: "internal",
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1", "home.internal": "10.42.0.3"}},
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: mcat.SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ids := byID(out)
+	resolv, _ := ids["systemd-resolved.fact-resolvers"]["content"].(string)
+	kept, _ := ids["systemd-resolved.fact-kept"]["content"].(string)
+	if !strings.Contains(resolv, "\nnameserver 10.42.0.2\noptions timeout:1 attempts:2 edns0\n") || resolv != kept {
+		t.Errorf("the resolver file does not name this machine's own resolver alone, or its copy differs:\n%s", resolv)
+	}
+	if ids["systemd-networkd.fact-resolvers"] != nil {
+		t.Error("the uplink's holder still writes the resolver file beside the resolver's")
+	}
+	conf, _ := ids["systemd-resolved.fact-resolved"]["content"].(string)
+	for _, want := range []string{"\nDNS=10.42.0.1 10.42.0.3 \n", "\nDNSStubListenerExtra=10.42.0.2\n", "\nFallbackDNS=\n"} {
+		if !strings.Contains(conf, want) {
+			t.Errorf("resolved's drop-in lacks %q:\n%s", want, conf)
+		}
+	}
+	if s, _ := ids["systemd-resolved.fact-suffix"]["content"].(string); s != "internal\n" {
+		t.Errorf("the mesh's domain is rendered as %q", s)
+	}
+}
diff --git a/internal/compose/resolution/operators_machine_test.go b/internal/compose/resolution/operators_machine_test.go
new file mode 100644
index 0000000..350db4f
--- /dev/null
+++ b/internal/compose/resolution/operators_machine_test.go
@@ -0,0 +1,33 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+)
+
+// A `user` shape and a user-scoped unit name the operator account the way a home file does
+// (novox/hq ADR 0176, ADR 0177): with ${machine:account}, resolved when the module is assigned.
+func TestAUserShapeAndAUserScopedUnitNameTheAccount(t *testing.T) {
+	facts := map[string]string{"account": "ops", "account-home": "/home/ops"}
+	login := map[string]any{"type": "user", "id": "login", "name": "${machine:account}", "shell": "/usr/bin/zsh"}
+	if err := machineInto(login, facts, "zsh"); err != nil {
+		t.Fatal(err)
+	}
+	if login["name"] != "ops" {
+		t.Fatalf("the user shape did not learn the account: %v", login["name"])
+	}
+	watcher := map[string]any{"type": "service", "id": "watcher", "unit": "i3-reload-watcher.service",
+		"scope": "user", "user": "${machine:account}"}
+	if err := machineInto(watcher, facts, "i3"); err != nil {
+		t.Fatal(err)
+	}
+	if watcher["user"] != "ops" {
+		t.Fatalf("the user-scoped unit did not learn the account: %v", watcher["user"])
+	}
+	// A machine with no operator account refuses rather than writing the literal.
+	err := machineInto(map[string]any{"type": "user", "id": "login", "name": "${machine:account}"},
+		map[string]string{"address": "10.0.0.1"}, "zsh")
+	if err == nil || !strings.Contains(err.Error(), "${machine:account}") {
+		t.Fatalf("a user shape on a machine with no account was not refused by name: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/optional_requirements.go b/internal/compose/resolution/optional_requirements.go
new file mode 100644
index 0000000..6604c84
--- /dev/null
+++ b/internal/compose/resolution/optional_requirements.go
@@ -0,0 +1,75 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// wantsHard is whether this module wants the name as a hard requirement: required without
+// `optional`, or contributed to.
+func manifestWantsHard(m mcat.Manifest, name string) bool {
+	for _, w := range m.Wants() {
+		if w == name {
+			return !m.IsOptional(name)
+		}
+	}
+	return false
+}
+
+// AbsentFor is the optional requirements of one module this resolution leaves unbound.
+func AbsentFor(r mcat.Resolution, module string) map[string]bool {
+	out := map[string]bool{}
+	for _, a := range r.Absent {
+		if a.Consumer == module {
+			out[a.Requirement] = true
+		}
+	}
+	return out
+}
+
+// absentOf is, for each requirement left absent, every module of the set that requires it
+// optionally, sorted by consumer then requirement.
+func absentOf(names map[string]bool, order []string, catalogue map[string]mcat.Manifest) []mcat.Absent {
+	var out []mcat.Absent
+	for _, module := range order {
+		m := catalogue[module]
+		for _, r := range m.Requires {
+			if names[r] && m.IsOptional(r) {
+				out = append(out, mcat.Absent{Consumer: module, Requirement: r})
+			}
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Consumer != out[j].Consumer {
+			return out[i].Consumer < out[j].Consumer
+		}
+		return out[i].Requirement < out[j].Requirement
+	})
+	return out
+}
+
+// withoutAbsent drops the resources delivered only while a requirement is bound whose requirement is
+// absent here (ADR 0330 §5), and the field itself from every resource that keeps it.
+func withoutAbsent(resources []map[string]any, absent map[string]bool) []map[string]any {
+	out := make([]map[string]any, 0, len(resources))
+	for _, r := range resources {
+		when, has := r[mcat.OnlyWhenBound]
+		if !has {
+			out = append(out, r)
+			continue
+		}
+		if absent[fmt.Sprint(when)] {
+			continue
+		}
+		kept := make(map[string]any, len(r))
+		for k, v := range r {
+			if k != mcat.OnlyWhenBound {
+				kept[k] = v
+			}
+		}
+		out = append(out, kept)
+	}
+	return out
+}
diff --git a/internal/compose/resolution/optional_requirements_test.go b/internal/compose/resolution/optional_requirements_test.go
new file mode 100644
index 0000000..c8c6081
--- /dev/null
+++ b/internal/compose/resolution/optional_requirements_test.go
@@ -0,0 +1,168 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func optionalShelf() map[string]mcat.Manifest {
+	grafana := mcat.Manifest{Module: "grafana", Version: "1", Requires: []string{"influxdb-api", "shell"},
+		OptionalRequires: map[string]bool{"influxdb-api": true, "shell": true}}
+	return shelf(mcat.Manifest{Module: "influxdb", Version: "1", Provides: mcat.FromAnywhere("influxdb-api")}, mcat.Manifest{Module: "zsh", Version: "1", Provides: mcat.Offers("shell")}, grafana, mcat.
+		// What wants the same names hard, for the cases where one consumer's optional is another's hard.
+		Manifest{Module: "telegraf", Version: "1", Requires: []string{"influxdb-api"}}, mcat.Manifest{Module: "editor", Version: "1", Requires: []string{"shell"}}, mcat.Manifest{Module: "suite", Version: "1", Requires: []string{"editor"}},
+	)
+}
+
+func TestAnOptionalRequirementWithNoProviderIsAbsentAndNothingIsInstalled(t *testing.T) {
+	// Exactly one catalogue module could answer each — the case where a hard requirement installs it.
+	// Brokered (influxdb-api, from anywhere) and on this machine (shell); both passes.
+	for _, world := range []mcat.World{{}, {Unchecked: true}} {
+		got, err := Resolve(optionalShelf(), []string{"grafana"}, reachable(), world)
+		if err != nil {
+			t.Fatalf("an optional requirement with no provider refused the assignment: %v", err)
+		}
+		if have := strings.Join(names(got), " "); have != "grafana" {
+			t.Fatalf("assigning grafana put %s on the machine; nothing is installed for an optional requirement (ADR 0330 §3)", have)
+		}
+		if world.Unchecked {
+			continue
+		}
+		want := []mcat.Absent{{Consumer: "grafana", Requirement: "influxdb-api"}, {Consumer: "grafana", Requirement: "shell"}}
+		if len(got.Absent) != 2 || got.Absent[0] != want[0] || got.Absent[1] != want[1] {
+			t.Fatalf("absent: %+v, want %+v", got.Absent, want)
+		}
+		if len(got.Needs) != 0 {
+			t.Fatalf("an absent requirement was given a binding: %+v", got.Needs)
+		}
+	}
+}
+
+func TestAnOptionalRequirementWithAProviderBindsAsAHardOne(t *testing.T) {
+	world := mcat.World{Offered: map[string][]mcat.Provider{"influxdb-api": {
+		{Node: "anchor", At: "anchor.internal", Module: "influxdb", Serves: map[string]any{"port": 8086}}}}}
+	got, err := Resolve(optionalShelf(), []string{"grafana", "zsh"}, reachable(), world)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := boundFrom(t, got, "grafana", "influxdb-api"); n.From != "anchor" || n.Module != "influxdb" {
+		t.Fatalf("bound to %s/%s", n.From, n.Module)
+	}
+	if len(got.Absent) != 0 {
+		t.Fatalf("a requirement with a provider was left absent: %+v", got.Absent)
+	}
+	// And the same assignment without the provider is absent: what binds it later is only the
+	// provider being assigned, with no act on grafana (ADR 0330 §7).
+	before, err := Resolve(optionalShelf(), []string{"grafana", "zsh"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(before.Absent) != 1 || before.Absent[0].Requirement != "influxdb-api" {
+		t.Fatalf("absent before the provider was assigned: %+v", before.Absent)
+	}
+}
+
+func TestOneConsumersOptionalRequirementIsAnothersHardOne(t *testing.T) {
+	// telegraf wants influxdb-api hard: with nothing offering it, the assignment is refused as
+	// before, naming what to assign — grafana's optional does not soften telegraf's.
+	_, err := Resolve(optionalShelf(), []string{"grafana", "telegraf"}, reachable(), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), "assign influxdb") {
+		t.Fatalf("a hard requirement with no provider was not refused naming the candidate: %v", err)
+	}
+	// And the refusal names telegraf, whose remedy it is, not grafana, which met the name first.
+	if !strings.Contains(err.Error(), "wanted by telegraf") {
+		t.Errorf("the refusal does not name the module that wants it hard: %v", err)
+	}
+	// And a module pulled in later (suite → editor) that wants the shell hard installs it, even
+	// though grafana, met first, wanted it only optionally — and grafana is then bound to it.
+	got, err := Resolve(optionalShelf(), []string{"grafana", "suite"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if have := strings.Join(names(got), " "); !strings.Contains(have, "zsh") {
+		t.Fatalf("a hard requirement met after an optional one was not installed: %s", have)
+	}
+	for _, a := range got.Absent {
+		if a.Requirement == "shell" {
+			t.Fatalf("the shell is installed and still listed absent: %+v", got.Absent)
+		}
+	}
+}
+
+func TestAHardRequirementWithNoProviderIsStillRefused(t *testing.T) {
+	_, err := Resolve(optionalShelf(), []string{"telegraf"}, reachable(), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), "influxdb") {
+		t.Fatalf("got %v", err)
+	}
+}
+
+func optionalModule(resources string) string {
+	return `{"module":"grafana","version":"1",
+		"requires":["route",{"name":"influxdb-api","optional":true}],
+		"secrets":{"influxdb-api":"/var/lib/grafana/influxdb-api"},
+		"resources":[` + resources + `]}`
+}
+
+func absentGrafana(t *testing.T, absent bool) mcat.Resolution {
+	t.Helper()
+	m := mustParse(t, optionalModule(`
+		{"id":"env","type":"file","path":"/var/lib/grafana/env","mode":"0644",
+		 "content":"INFLUX=${bound:influxdb-api:at|default:none}:${bound:influxdb-api:port|default:0}\n"},
+		{"id":"ds","type":"file","path":"/var/lib/grafana/ds.yaml","mode":"0400",
+		 "content":"url: ${bound:influxdb-api:at}\npassword: ${secret:influxdb-api}\n","only-when-bound":"influxdb-api"}`))
+	m.Requires = []string{"influxdb-api"}
+	m.Binds = map[string]string{"influxdb-api": "/var/lib/grafana/influxdb.json"}
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{m}}
+	if absent {
+		r.Absent = []mcat.Absent{{Consumer: "grafana", Requirement: "influxdb-api"}}
+	} else {
+		r.Needs = []mcat.Needed{{Name: "influxdb-api", From: "anchor", At: "anchor.internal", For: "grafana",
+			Module: "influxdb", Sealed: "sealed-influx", Serves: map[string]any{"port": float64(8086)}}}
+	}
+	return r
+}
+
+func TestAnAbsentRequirementIsComposedWithItsDefaultsAndWithoutItsFiles(t *testing.T) {
+	out, err := Declaration(absentGrafana(t, true), mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	env := fileNamed(out, "grafana.env")
+	if env == nil || env["content"] != "INFLUX=none:0\n" {
+		t.Fatalf("the defaults were not rendered: %v", env)
+	}
+	for _, id := range []string{"grafana.ds", "grafana." + mcat.SecretID("influxdb-api"), "grafana." + mcat.BoundID("influxdb-api")} {
+		if fileNamed(out, id) != nil {
+			t.Errorf("%s was delivered while influxdb-api is absent (ADR 0330 §5, §6)", id)
+		}
+	}
+	for _, r := range out {
+		if _, has := r[mcat.OnlyWhenBound]; has {
+			t.Errorf("%v carries %s to the node-engine, which knows no such field", r["id"], mcat.OnlyWhenBound)
+		}
+	}
+}
+
+func TestABoundOptionalRequirementIsComposedAsAHardOne(t *testing.T) {
+	out, err := Declaration(absentGrafana(t, false), mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if env := fileNamed(out, "grafana.env"); env == nil || env["content"] != "INFLUX=anchor.internal:8086\n" {
+		t.Fatalf("the bound values were not rendered: %v", env)
+	}
+	ds := fileNamed(out, "grafana.ds")
+	if ds == nil {
+		t.Fatalf("the only-when-bound file was left out while bound: %v", out)
+	}
+	if _, has := ds[mcat.OnlyWhenBound]; has {
+		t.Errorf("the file carries %s to the node-engine", mcat.OnlyWhenBound)
+	}
+	for _, id := range []string{"grafana." + mcat.SecretID("influxdb-api"), "grafana." + mcat.BoundID("influxdb-api")} {
+		if fileNamed(out, id) == nil {
+			t.Errorf("%s was not delivered while bound", id)
+		}
+	}
+}
diff --git a/internal/compose/resolution/outside_not_given_test.go b/internal/compose/resolution/outside_not_given_test.go
new file mode 100644
index 0000000..a23838d
--- /dev/null
+++ b/internal/compose/resolution/outside_not_given_test.go
@@ -0,0 +1,104 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func outsideManifest(t *testing.T) mcat.Manifest {
+	t.Helper()
+	m, err := decodeForTest([]byte(`{"module":"assistant","version":"1",
+	  "own-secrets":{
+	    "password":{"path":"/var/lib/assistant/password.secret","taken":"at-start"},
+	    "vendor-key":{"path":"/var/lib/assistant/vendor-key.secret","taken":"at-start","issued-by":"outside"}},
+	  "resources":[
+	    {"id":"env","type":"file","path":"/var/lib/assistant/env","mode":"0600",
+	     "content":"PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n"},
+	    {"id":"server","type":"container","name":"assistant","image":"assistant:1",
+	     "env-file":["/var/lib/assistant/env"],
+	     "volumes":["/var/lib/assistant/vendor-key.secret:/run/vendor-key:ro"],
+	     "secrets-in-environment":"reads its settings from the environment only"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func resourceAt(out []map[string]any, path string) map[string]any {
+	for _, r := range out {
+		if r["path"] == path {
+			return r
+		}
+	}
+	return nil
+}
+
+func resourceNamed(out []map[string]any, name string) map[string]any {
+	for _, r := range out {
+		if r["name"] == name {
+			return r
+		}
+	}
+	return nil
+}
+
+func TestAnOutsideSecretNotGivenIsNoFileAndAFileNamingItSaysEmpty(t *testing.T) {
+	r := mcat.Resolution{Node: "server", Modules: []mcat.Manifest{outsideManifest(t)}}
+	out, err := Declaration(r, mcat.Rendering{Needed: map[string]map[string]string{"assistant": {"password": "sealed-password"}}})
+	if err != nil {
+		t.Fatalf("a module whose outside secret nobody gave did not compose: %v", err)
+	}
+	if got := resourceAt(out, "/var/lib/assistant/vendor-key.secret"); got != nil {
+		t.Fatalf("a secret nobody gave was placed: %v", got)
+	}
+	env := resourceAt(out, "/var/lib/assistant/env")
+	if env == nil {
+		t.Fatal("the module's own file is not composed")
+	}
+	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=\n" {
+		t.Fatalf("the file names the secret nobody gave as %q", content)
+	}
+	secrets, _ := env["secrets"].(map[string]any)
+	if len(secrets) != 1 || secrets["password"] != "sealed-password" {
+		t.Fatalf("the file is filled from %v", secrets)
+	}
+	server := resourceNamed(out, "assistant")
+	if on := strings.Join(stringsIn(server["restart-on"]), " "); strings.Contains(on, "vendor-key") {
+		t.Fatalf("the container restarts on a secret nobody gave: %q", on)
+	}
+}
+
+func TestAnOutsideSecretGivenIsPlacedAndFilled(t *testing.T) {
+	r := mcat.Resolution{Node: "server", Modules: []mcat.Manifest{outsideManifest(t)}}
+	out, err := Declaration(r, mcat.Rendering{Needed: map[string]map[string]string{"assistant": {
+		"password": "sealed-password", "vendor-key": "sealed-vendor-key"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	placed := resourceAt(out, "/var/lib/assistant/vendor-key.secret")
+	if placed == nil || placed["sealed"] != "sealed-vendor-key" {
+		t.Fatalf("the secret given is placed as %v", placed)
+	}
+	env := resourceAt(out, "/var/lib/assistant/env")
+	if content := env["content"].(string); content != "PASSWORD=${secret:password}\nVENDOR_KEY=${secret:vendor-key}\n" {
+		t.Fatalf("the file was changed: %q", content)
+	}
+	if secrets, _ := env["secrets"].(map[string]any); secrets["vendor-key"] != "sealed-vendor-key" {
+		t.Fatalf("the file is filled from %v", secrets)
+	}
+	server := resourceNamed(out, "assistant")
+	if on := strings.Join(stringsIn(server["restart-on"]), " "); !strings.Contains(on, "assistant."+mcat.NeedID("vendor-key")) {
+		t.Fatalf("the container does not restart on the secret given: %q", on)
+	}
+}
+
+// A secret the mesh makes is still refused when it was not made: only an outside one is left out.
+func TestAnOwnSecretTheMeshMakesIsStillRefusedWhenNotMade(t *testing.T) {
+	r := mcat.Resolution{Node: "server", Modules: []mcat.Manifest{outsideManifest(t)}}
+	_, err := Declaration(r, mcat.Rendering{})
+	if nm, ok := err.(*NotMadeError); !ok || nm.Name != "password" {
+		t.Fatalf("a secret the mesh makes, not made: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/own_name_test.go b/internal/compose/resolution/own_name_test.go
new file mode 100644
index 0000000..3eabe07
--- /dev/null
+++ b/internal/compose/resolution/own_name_test.go
@@ -0,0 +1,128 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// selfAware contributes a labelled route, binds the requirement, and writes its own name into a file.
+func selfAware(label string) mcat.Manifest {
+	m := labelled("board", label, 8080)
+	m.Requires = []string{"reverse-proxy"}
+	m.Binds = map[string]string{"reverse-proxy": "/var/lib/board/route.json"}
+	m.Resources = []map[string]any{
+		{"id": "conf", "type": "file", "path": "/var/lib/board/app.conf",
+			"content": "root = https://${bound:reverse-proxy:name}/\ninternal = ${bound:reverse-proxy:internal-name}\n"},
+	}
+	return m
+}
+
+// servingProxy is proxy() as the catalogue's route providers are declared: the provision scoped to
+// the mesh, serving nothing a consumer must know (route-adapter, route-proxy: `"serves": {"route": {}}`).
+func servingProxy() mcat.Manifest {
+	p := proxy()
+	p.Provides = []mcat.Offer{{Name: "reverse-proxy", Scope: mcat.ScopeMesh}}
+	p.Serves = map[string]map[string]any{"reverse-proxy": {}}
+	return p
+}
+
+// nodeProxy is the same provider scoped to its node, whose answer on the same machine comes from
+// `here` rather than from the mesh's needs — the other path a binding is written by.
+func nodeProxy() mcat.Manifest {
+	p := proxy()
+	p.Serves = map[string]map[string]any{"reverse-proxy": {"scheme": "http"}}
+	return p
+}
+
+// onBoth is a node with a public domain and a private-network address, so both names compose.
+func onBoth(domain string) mcat.Node {
+	n := withDomain(domain)
+	n.At = "anchor.internal"
+	return n
+}
+
+func fileAt(t *testing.T, out []map[string]any, path string) string {
+	t.Helper()
+	for _, r := range out {
+		if r["path"] == path {
+			return r["content"].(string)
+		}
+	}
+	t.Fatalf("nothing was declared at %s", path)
+	return ""
+}
+
+func TestAModuleIsToldTheNameItsProviderServes(t *testing.T) {
+	got, err := Resolve(shelf(servingProxy(), selfAware("git")), []string{"traefik", "board"},
+		onBoth("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := mustDeclare(t, got)
+	served := received(t, out)[0].Values
+
+	var binding map[string]any
+	if err := json.Unmarshal([]byte(fileAt(t, out, "/var/lib/board/route.json")), &binding); err != nil {
+		t.Fatal(err)
+	}
+	if binding["name"] != served["name"] || binding["name"] != "git.example.tld" {
+		t.Fatalf("the module was told %v, the provider serves %v", binding["name"], served["name"])
+	}
+	if binding["internal-name"] != served["internal-name"] || binding["internal-name"] == nil {
+		t.Fatalf("internal name: module told %v, provider serves %v",
+			binding["internal-name"], served["internal-name"])
+	}
+
+	conf := fileAt(t, out, "/var/lib/board/app.conf")
+	want := "root = https://git.example.tld/\ninternal = " + served["internal-name"].(string) + "\n"
+	if conf != want {
+		t.Fatalf("the file was rendered as\n%s\nwant\n%s", conf, want)
+	}
+}
+
+func TestTheNameAModuleIsToldFollowsTheNodesDomain(t *testing.T) {
+	// The whole point: the same definition, two machines, two names — nothing edited.
+	for _, domain := range []string{"example.tld", "other.example"} {
+		got, err := Resolve(shelf(servingProxy(), selfAware("git")), []string{"traefik", "board"},
+			onBoth(domain), mcat.World{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		conf := fileAt(t, mustDeclare(t, got), "/var/lib/board/app.conf")
+		if !strings.HasPrefix(conf, "root = https://git."+domain+"/") {
+			t.Fatalf("on %s the module wrote %q", domain, conf)
+		}
+	}
+}
+
+func TestAModuleWithNoPublicNameIsNotToldOne(t *testing.T) {
+	// No public domain on the node: nothing composed, so no `name` — and a file asking for one is
+	// refused rather than rendered with a placeholder or an empty host.
+	m := selfAware("git")
+	m.Resources[0]["content"] = "root = https://${bound:reverse-proxy:name}/\n"
+	got, err := Resolve(shelf(servingProxy(), m), []string{"traefik", "board"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Declaration(got, mcat.Rendering{}); err == nil ||
+		!strings.Contains(err.Error(), `"name"`) {
+		t.Fatalf("a file asking for a name that was never composed was not refused: %v", err)
+	}
+}
+
+func TestAModuleIsToldItsNameByANodeScopedProviderToo(t *testing.T) {
+	m := selfAware("git")
+	m.Resources[0]["content"] = "root = https://${bound:reverse-proxy:name}/\n"
+	got, err := Resolve(shelf(nodeProxy(), m), []string{"board"},
+		withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	conf := fileAt(t, mustDeclare(t, got), "/var/lib/board/app.conf")
+	if !strings.HasPrefix(conf, "root = https://git.example.tld/") {
+		t.Fatalf("a same-machine, node-scoped answer did not tell the module its name: %q", conf)
+	}
+}
diff --git a/internal/compose/resolution/own_secret_owner_test.go b/internal/compose/resolution/own_secret_owner_test.go
new file mode 100644
index 0000000..c64d6fa
--- /dev/null
+++ b/internal/compose/resolution/own_secret_owner_test.go
@@ -0,0 +1,95 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// mailSenderManifest is the fixture every mail-sender issue builds on: the real parts of mesh-mail's manifest
+// taken from mesh-catalog/modules/mesh-mail/module.json, extended as ADR 0436 §7-§8 describe, with `own` naming
+// the account that owns the family's files.
+func mailSenderManifest(t *testing.T, own string) mcat.Manifest {
+	t.Helper()
+	ownSecrets := `"mail-credential-*":{"path":"/var/lib/mesh-mail/mail-credential-*.secret","issued-by":"outside"`
+	if own != "" {
+		ownSecrets += `,"owner":"` + own + `"`
+	}
+	ownSecrets += `}`
+	m, err := decodeForTest([]byte(`{"module":"mesh-mail","version":"1","secrets-owner":"mesh-mail","own-secrets":{` +
+		ownSecrets + `},"resources":[{"id":"account","type":"user","name":"mesh-mail-send"}]}`))
+	if err != nil {
+		t.Fatalf("a manifest with own=%q was refused: %v", own, err)
+	}
+	return m
+}
+
+// 1170/AC1: a family owned by the module's own account lands at 0600, owned by that account — and a module's
+// other own secrets (no per-secret owner declared) keep secrets-owner, unchanged.
+func TestAnOwnSecretsOwnerIsGivenToItsFiles(t *testing.T) {
+	m := mailSenderManifest(t, "mesh-mail-send")
+	m.OwnSecrets["smtp-relay-key"] = mcat.OwnSecret{Path: "/var/lib/mesh-mail/smtp-relay-key", Taken: mcat.TakenAtStart}
+	r := mcat.Resolution{Node: "novox", Modules: []mcat.Manifest{m}}
+	out, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"mesh-mail": {"mail-credential-smtp": "sealed-credential", "smtp-relay-key": "sealed-relay"}},
+	})
+	if err != nil {
+		t.Fatalf("composing the declaration: %v", err)
+	}
+	var family, plain map[string]any
+	for _, res := range out {
+		if res["type"] != "file" {
+			continue
+		}
+		switch res["path"] {
+		case "/var/lib/mesh-mail/mail-credential-smtp.secret":
+			family = res
+		case "/var/lib/mesh-mail/smtp-relay-key":
+			plain = res
+		}
+	}
+	if family == nil {
+		t.Fatalf("the family member was not composed at all: %v", out)
+	}
+	if got := family["owner"]; got != "mesh-mail-send" {
+		t.Fatalf("the family member's owner: %v; want mesh-mail-send", got)
+	}
+	// review round 1, finding 7: asserted, not merely logged. ownedBy never sets "mode", so a sealed secret
+	// file carries none here either — the host applies 0600 to every one regardless (novox/hq ADR 0086) —
+	// and the owner clause must not have added one of its own that could override that.
+	if _, has := family["mode"]; has {
+		t.Fatalf("the family member carries its own mode %v; the owner clause must not set one, so the "+
+			"host's 0600 for every sealed secret file stands", family["mode"])
+	}
+	if plain == nil {
+		t.Fatalf("the module's other own secret was not composed at all: %v", out)
+	}
+	if got := plain["owner"]; got != "mesh-mail" {
+		t.Fatalf("a secret with no per-secret owner kept %v; want the module's secrets-owner %q", got, "mesh-mail")
+	}
+}
+
+// 1170/AC3: a manifest with no owner on any own secret composes exactly as it did before this clause existed:
+// every secret file belongs to the module's secrets-owner (or nothing, when that is absent too).
+func TestNoOwnerOnAnySecretComposesAsMainDoes(t *testing.T) {
+	m := mailSenderManifest(t, "")
+	r := mcat.Resolution{Node: "novox", Modules: []mcat.Manifest{m}}
+	out, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"mesh-mail": {"mail-credential-smtp": "sealed-credential"}},
+	})
+	if err != nil {
+		t.Fatalf("composing the declaration: %v", err)
+	}
+	var found bool
+	for _, res := range out {
+		if res["type"] == "file" && res["path"] == "/var/lib/mesh-mail/mail-credential-smtp.secret" {
+			found = true
+			if got := res["owner"]; got != "mesh-mail" {
+				t.Fatalf("with no per-secret owner declared, the file's owner: %v; want secrets-owner %q", got, "mesh-mail")
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("the family member was not composed at all: %v", out)
+	}
+}
diff --git a/internal/compose/resolution/pin_names_module_test.go b/internal/compose/resolution/pin_names_module_test.go
new file mode 100644
index 0000000..8deae85
--- /dev/null
+++ b/internal/compose/resolution/pin_names_module_test.go
@@ -0,0 +1,104 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func issuerShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "public-acme", Version: "1", Provides: mcat.FromAnywhere("acme-ca"),
+		Serves: map[string]map[string]any{"acme-ca": {"at": "acme-v02.api.letsencrypt.org"}}}, mcat.Manifest{Module: "step-ca", Version: "1", Provides: mcat.FromAnywhere("acme-ca"),
+		Serves: map[string]map[string]any{"acme-ca": {"at": "novox.internal"}}}, mcat.Manifest{Module: "route-proxy", Version: "1", Requires: []string{"acme-ca"}},
+	)
+}
+
+func twoIssuersOnOneNode() map[string][]mcat.Provider {
+	return map[string][]mcat.Provider{"acme-ca": {
+		{Node: "novox", At: "novox.internal", Module: "public-acme", Serves: map[string]any{"at": "acme-v02.api.letsencrypt.org"}},
+		{Node: "novox", At: "novox.internal", Module: "step-ca", Serves: map[string]any{"at": "novox.internal"}},
+	}}
+}
+
+func TestTwoProvidersOnOneNodeAreRefusedWithBothNamed(t *testing.T) {
+	// The refusal must name the pair, because a node alone cannot tell them apart.
+	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(), mcat.World{Offered: twoIssuersOnOneNode()})
+	if err == nil {
+		t.Fatal("two providers on one node were resolved by picking")
+	}
+	for _, want := range []string{"novox/public-acme", "novox/step-ca", "<node> <module>"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal does not say %q: %v", want, err)
+		}
+	}
+}
+
+func TestAPinNamesTheModule(t *testing.T) {
+	got, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(), mcat.World{Offered: twoIssuersOnOneNode(),
+		Pinned: map[string]mcat.Chosen{"acme-ca": {Node: "novox", Module: "public-acme"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 || got.Needs[0].From != "novox" || got.Needs[0].Serves["at"] != "acme-v02.api.letsencrypt.org" {
+		t.Fatalf("the named module was not the one taken: %+v", got.Needs)
+	}
+}
+
+func TestARecordNamingOnlyTheNodeIsRefusedWhenThatNodeAnswersTwice(t *testing.T) {
+	// A pin from before the module was asked for. It once took the last one listed — a coin flip.
+	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(), mcat.World{Offered: twoIssuersOnOneNode(), Pinned: map[string]mcat.Chosen{"acme-ca": {Node: "novox"}}})
+	if err == nil {
+		t.Fatal("a node that answers twice was resolved by picking")
+	}
+	if !strings.Contains(err.Error(), "provides it 2 times") || !strings.Contains(err.Error(), "pin workstation acme-ca novox <module>") {
+		t.Fatalf("the refusal does not ask for the module: %v", err)
+	}
+}
+
+func TestAPinNamingAModuleThatDoesNotProvideItIsRefused(t *testing.T) {
+	_, err := Resolve(issuerShelf(), []string{"route-proxy"}, reachable(), mcat.World{Offered: twoIssuersOnOneNode(), Pinned: map[string]mcat.Chosen{"acme-ca": {Node: "novox", Module: "gitea"}}})
+	if err == nil || !strings.Contains(err.Error(), "novox/gitea does not provide it") {
+		t.Fatalf("a module that does not provide it was not refused by name: %v", err)
+	}
+}
+
+func TestTwoProvidersBesideTheConsumerAreRefusedUntilOneIsNamed(t *testing.T) {
+	// The same ambiguity on the consumer's own machine. This was settled by a map walk — random,
+	// per plan — which is how novox's own proxy got its issuer.
+	_, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(), mcat.World{})
+	if err == nil {
+		t.Fatal("two providers beside the consumer were resolved by picking")
+	}
+	if !strings.Contains(err.Error(), "workstation provides \"acme-ca\" 2 times") || !strings.Contains(err.Error(), "public-acme, step-ca") {
+		t.Fatalf("the refusal does not list them: %v", err)
+	}
+}
+
+func TestAPinSettlesTwoProvidersBesideTheConsumer(t *testing.T) {
+	got, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(), mcat.World{Pinned: map[string]mcat.Chosen{"acme-ca": {Node: "workstation", Module: "public-acme"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found bool
+	for _, n := range got.Needs {
+		if n.Name == "acme-ca" {
+			found = true
+			if n.Serves["at"] != "acme-v02.api.letsencrypt.org" {
+				t.Fatalf("the named module was not the one taken: %+v", n)
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("no need for acme-ca was created: %+v", got.Needs)
+	}
+}
+
+func TestTheFirstPassDoesNotRefuseTwoProvidersBesideTheConsumer(t *testing.T) {
+	// The first pass answers only what a node offers. Refused there, the node vanishes from every
+	// other node's world — and the whole mesh loses its vault for an ambiguity one machine has to
+	// settle. The second pass is where it is refused, and the test above proves it is.
+	if _, err := Resolve(issuerShelf(), []string{"route-proxy", "public-acme", "step-ca"}, reachable(), mcat.World{Unchecked: true}); err != nil {
+		t.Fatalf("the first pass refused what only the second may: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/placed_paths_test.go b/internal/compose/resolution/placed_paths_test.go
new file mode 100644
index 0000000..019b2cd
--- /dev/null
+++ b/internal/compose/resolution/placed_paths_test.go
@@ -0,0 +1,182 @@
+package resolution
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// TestPlacedDirectoriesKeepTheirPaths is the check novox/hq issue 119 asks for before a definition
+// stops naming where its data lives: a converted manifest, resolved on a node with the default root,
+// names exactly the paths the manifest before it named. Data that a service is using must not move
+// because a definition stopped saying where it was.
+//
+// Two checkouts: MESH_CATALOGUE_BEFORE, the catalogue as it was, and MESH_CATALOGUE, as it is now.
+// Every module in both is resolved with the controller's own rule (dirsFor, dirFill) and compared
+// whole — not only the directories, but every string a directory's id was written into. Both
+// sides are resolved, so a manifest converted in two steps (issue 119, then issue 174) is judged
+// against the paths it named, not the text it used to name them with.
+func TestPlacedDirectoriesKeepTheirPaths(t *testing.T) {
+	before, after := os.Getenv("MESH_CATALOGUE_BEFORE"), os.Getenv("MESH_CATALOGUE")
+	if before == "" || after == "" {
+		t.Skip("set MESH_CATALOGUE_BEFORE and MESH_CATALOGUE to two catalogue checkouts to run this")
+	}
+	found, _ := filepath.Glob(filepath.Join(after, "modules", "*", "module.json"))
+	compared := 0
+	for _, path := range found {
+		module := filepath.Base(filepath.Dir(path))
+		old, err := os.ReadFile(filepath.Join(before, "modules", module, "module.json"))
+		if err != nil {
+			continue // new since; nothing to keep
+		}
+		now, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(old) == string(now) {
+			continue
+		}
+		m, err := decodeForTest(now)
+		if err != nil {
+			t.Errorf("%s: %v", module, err)
+			continue
+		}
+		earlier, err := decodeForTest(old)
+		if err != nil {
+			t.Errorf("%s before: %v", module, err)
+			continue
+		}
+		var was, is any
+		if err := json.Unmarshal(old, &was); err != nil {
+			t.Fatal(err)
+		}
+		if err := json.Unmarshal(now, &is); err != nil {
+			t.Fatal(err)
+		}
+		// Both sides resolved: the manifest before may itself already place some directories
+		// (issue 119's conversion), and what must not move is the path a machine sees.
+		was = resolvedTree(was, dirsFor(earlier, mcat.Rendering{}), module, t)
+		resolved := resolvedTree(is, dirsFor(m, mcat.Rendering{}), module, t)
+		// An access named by id resolves to the path the definition still carries as its default
+		// (issue 153) — the same rule as a placed directory: an assignment that says nothing moves
+		// nothing.
+		was = accessesResolved(was, earlier)
+		resolved = accessesResolved(resolved, m)
+		if !reflect.DeepEqual(was, resolved) {
+			wasJSON, _ := json.MarshalIndent(was, "", "  ")
+			isJSON, _ := json.MarshalIndent(resolved, "", "  ")
+			t.Errorf("%s: resolved on the default root, the converted manifest is not the one before it\n--- before\n%s\n--- resolved now\n%s",
+				module, firstDifference(string(wasJSON), string(isJSON)), "")
+		}
+		compared++
+	}
+	t.Logf("%d converted manifest(s) resolve to the paths they named before", compared)
+}
+
+// resolvedTree is the manifest as a machine would see it: every ${dir:…} filled, a pathless
+// directory given the path it resolves to, and the placement word removed.
+func resolvedTree(node any, dirs map[string]string, module string, t *testing.T) any {
+	switch v := node.(type) {
+	case map[string]any:
+		out := map[string]any{}
+		for k, child := range v {
+			if k == "place" {
+				continue
+			}
+			out[k] = resolvedTree(child, dirs, module, t)
+		}
+		if out["type"] == "directory" {
+			if _, has := out["path"]; !has {
+				if id, ok := out["id"].(string); ok {
+					out["path"] = dirs[id]
+				}
+			}
+		}
+		return out
+	case []any:
+		out := make([]any, len(v))
+		for i, child := range v {
+			out[i] = resolvedTree(child, dirs, module, t)
+		}
+		return out
+	case string:
+		filled, err := dirFill(v, dirs, module)
+		if err != nil {
+			t.Error(err)
+		}
+		return filled
+	}
+	return node
+}
+
+func firstDifference(a, b string) string {
+	al, bl := strings.Split(a, "\n"), strings.Split(b, "\n")
+	for i := range al {
+		if i >= len(bl) || al[i] != bl[i] {
+			from := i - 2
+			if from < 0 {
+				from = 0
+			}
+			to := i + 3
+			if to > len(al) {
+				to = len(al)
+			}
+			bt := i + 3
+			if bt > len(bl) {
+				bt = len(bl)
+			}
+			return "before:\n" + strings.Join(al[from:to], "\n") + "\nnow:\n" + strings.Join(bl[from:bt], "\n")
+		}
+	}
+	return "(the difference is beyond the shorter document)"
+}
+
+// accessesResolved fills every ${access:<id>} with the default path the definition carries for that
+// access, and drops the id, so a manifest that names its accesses is compared by the paths a machine
+// with no placement receives.
+func accessesResolved(node any, m mcat.Manifest) any {
+	defaults := map[string]string{}
+	for _, a := range m.Accesses {
+		if a.ID != "" && a.Path != "" {
+			defaults[a.ID] = a.Path
+		}
+	}
+	var walk func(any) any
+	walk = func(n any) any {
+		switch v := n.(type) {
+		case map[string]any:
+			out := map[string]any{}
+			for k, child := range v {
+				if k == "id" {
+					if _, isAccess := v["mode"]; isAccess && v["type"] == nil {
+						if _, hasPath := v["path"]; hasPath {
+							continue
+						}
+					}
+				}
+				out[k] = walk(child)
+			}
+			return out
+		case []any:
+			out := make([]any, len(v))
+			for i, child := range v {
+				out[i] = walk(child)
+			}
+			return out
+		case string:
+			return accessRef.ReplaceAllStringFunc(v, func(ref string) string {
+				if p, ok := defaults[accessRef.FindStringSubmatch(ref)[1]]; ok {
+					return p
+				}
+				return ref
+			})
+		}
+		return n
+	}
+	return walk(node)
+}
diff --git a/internal/compose/resolution/placement.go b/internal/compose/resolution/placement.go
new file mode 100644
index 0000000..1c65ca4
--- /dev/null
+++ b/internal/compose/resolution/placement.go
@@ -0,0 +1,275 @@
+package resolution
+
+import (
+	"fmt"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// asSaid is the layers with placement folded back into the values, for what reads a layer whole as it
+// did while placement was kept in it: today's mergeable file, which takes every key (ADR 0326 §3), and
+// the judgement that no value holds a line end.
+func asSaid(layers []mcat.Layer) []mcat.Layer {
+	out := make([]mcat.Layer, len(layers))
+	for i, l := range layers {
+		out[i] = l
+		if len(l.Placement) > 0 {
+			out[i] = mcat.Layer{From: l.From, Values: l.Whole(), Default: l.Default}
+		}
+	}
+	return out
+}
+
+var systemTrees = []string{"/etc", "/usr", "/boot", "/root", "/run", "/var/run", "/var/lock", "/proc", "/sys",
+	"/dev", "/bin", "/sbin", "/lib", "/lib32", "/lib64", "/var/lib/mesh", "/var/lib/mesh-host", "/var/spool",
+	"/var/lib/docker", "/var/lib/containers", "/var/lib/containerd", "/opt"}
+
+var systemRoots = []string{"/", "/var", "/var/lib", "/var/cache", "/var/log", "/var/tmp", "/home",
+	"/mnt", "/media", "/srv", "/tmp", "/storage", "/data", "/services"}
+
+// systemPath says why a clean absolute path is the machine's own and never a placement's or an access's, or "".
+func systemPath(path string) string {
+	// Any home's keys, wherever the home is: a .ssh directory is its account's, and the keys and the list of who
+	// may log in as it are in there.
+	for _, part := range strings.Split(path, "/") {
+		if part == ".ssh" {
+			return path + " is an account's .ssh, which holds its keys and who may log in as it"
+		}
+	}
+	for _, tree := range systemTrees {
+		if path == tree || strings.HasPrefix(path, tree+"/") {
+			return path + " is in " + tree + ", the machine's own or the mesh's state"
+		}
+		if strings.HasPrefix(tree, path+"/") || path == "/" {
+			return path + " holds " + tree + ", the machine's own or the mesh's state"
+		}
+	}
+	for _, root := range systemRoots {
+		if path == root {
+			return path + " is the parent of every module's or every person's directories"
+		}
+	}
+	return ""
+}
+
+// engineModule is the node-engine's own module, the one that places in engineTrees.
+const engineModule = "mesh-host"
+
+// accessRef is how a module names one of its accesses: ${access:<id>}.
+var accessRef = regexp.MustCompile(`\$\{access:([a-z0-9][a-z0-9-]*)\}`)
+
+// AccessPlaces reads where this node keeps the operator's data the module accesses, by access id.
+//
+// It refuses an id the module declares no access under, and a path that is not absolute. An
+// access declared by path alone cannot be placed — it has no name to place it by.
+func AccessPlaces(m mcat.Manifest, layers []mcat.Layer) (map[string]string, error) {
+	declared := map[string]bool{}
+	for _, a := range m.Accesses {
+		if a.ID != "" {
+			declared[a.ID] = true
+		}
+	}
+	out := map[string]string{}
+	for _, layer := range layers {
+		raw, ok := layer.Placement[mcat.AccessesSetting]
+		if !ok {
+			continue
+		}
+		blocks, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { access: path } map, and %q set it to something else",
+				m.Module, mcat.AccessesSetting, layer.From)
+		}
+		for id, body := range blocks {
+			if !declared[id] {
+				return nil, fmt.Errorf(
+					"%s places the access %q, which it does not declare — the setting reaches "+
+						"nothing. It declares %s", m.Module, id, orNothing(namesOfAccesses(m)))
+			}
+			path, _ := body.(string)
+			path = strings.TrimSpace(path)
+			if !strings.HasPrefix(path, "/") {
+				return nil, fmt.Errorf("%s places the access %q at %v, which is not an absolute path",
+					m.Module, id, body)
+			}
+			path = filepath.Clean(path)
+			if why := systemPath(path); why != "" {
+				return nil, fmt.Errorf("%s places the access %q at %s: %s, and an access is mounted into the "+
+					"module's container — no access is ever there (novox/hq issue 339)", m.Module, id, path, why)
+			}
+			out[id] = path
+		}
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// placedAccess is one access with the path it resolves to on this node.
+type placedAccess struct {
+	ID   string
+	Path string
+	Mode string
+}
+
+// accessesFor is every access of a module with its path on this node: the assignment's where it
+// placed one, the definition's where it carries a default, and refused where neither says — an
+// access that resolves to nowhere would reach the machine as a mount of nothing.
+func accessesFor(m mcat.Manifest, layers []mcat.Layer) ([]placedAccess, map[string]string, error) {
+	placed, err := AccessPlaces(m, layers)
+	if err != nil {
+		return nil, nil, err
+	}
+	var out []placedAccess
+	byID := map[string]string{}
+	for _, a := range m.Accesses {
+		path := a.Path
+		if a.ID != "" {
+			if at, said := placed[a.ID]; said {
+				path = at
+			}
+		}
+		if path == "" {
+			return nil, nil, fmt.Errorf(
+				"%s accesses %q, and nothing says where that is on this node — the definition "+
+					"carries no path (it must not, novox/hq ADR 0112) and the assignment places "+
+					"none. Set %s: {%q: \"/where/it/is\"}",
+				m.Module, a.ID, mcat.AccessesSetting, a.ID)
+		}
+		out = append(out, placedAccess{ID: a.ID, Path: path, Mode: a.At()})
+		if a.ID != "" {
+			byID[a.ID] = path
+		}
+	}
+	return out, byID, nil
+}
+
+// accessFill resolves every ${access:…} in one string, or refuses a reference naming no access.
+func accessFill(s string, accesses map[string]string, module string) (string, error) {
+	var missing error
+	out := accessRef.ReplaceAllStringFunc(s, func(ref string) string {
+		id := accessRef.FindStringSubmatch(ref)[1]
+		path, has := accesses[id]
+		if !has {
+			missing = fmt.Errorf(
+				"%s says ${access:%s}, and %s declares no access %q. It declares %s",
+				module, id, module, id, orNothing(namesOfAccessIDs(accesses)))
+			return ref
+		}
+		return path
+	})
+	return out, missing
+}
+
+// accessInto fills every ${access:…} a resource carries — in its path, its content, its mounts,
+// its environment and its env-files — with the path this node resolved for it. The same walk as
+// dirInto, for the same reason: a literal `${access:x}` reaching the machine would be mounted as
+// a directory called that.
+func accessInto(resource map[string]any, accesses map[string]string, module string) error {
+	if !mentionsAccess(resource) {
+		return nil
+	}
+	fill := func(s string) (string, error) { return accessFill(s, accesses, module) }
+	var err error
+	if path, ok := resource["path"].(string); ok {
+		if resource["path"], err = fill(path); err != nil {
+			return err
+		}
+	}
+	if content, ok := resource["content"].(string); ok {
+		if resource["content"], err = fill(content); err != nil {
+			return err
+		}
+	}
+	for _, field := range []string{"volumes", "env-file"} {
+		list, ok := resource[field].([]any)
+		if !ok {
+			continue
+		}
+		filled := make([]any, len(list))
+		for i, v := range list {
+			filled[i] = v
+			if s, ok := v.(string); ok {
+				if filled[i], err = fill(s); err != nil {
+					return err
+				}
+			}
+		}
+		resource[field] = filled
+	}
+	if env, ok := resource["env"].(map[string]any); ok {
+		filled := make(map[string]any, len(env))
+		for key, v := range env {
+			filled[key] = v
+			if s, ok := v.(string); ok {
+				if filled[key], err = fill(s); err != nil {
+					return err
+				}
+			}
+		}
+		resource["env"] = filled
+	}
+	return nil
+}
+
+func mentionsAccess(resource map[string]any) bool {
+	for _, field := range []string{"path", "content"} {
+		if s, ok := resource[field].(string); ok && accessRef.MatchString(s) {
+			return true
+		}
+	}
+	for _, field := range []string{"volumes", "env-file"} {
+		if list, ok := resource[field].([]any); ok {
+			for _, v := range list {
+				if s, ok := v.(string); ok && accessRef.MatchString(s) {
+					return true
+				}
+			}
+		}
+	}
+	if env, ok := resource["env"].(map[string]any); ok {
+		for _, v := range env {
+			if s, ok := v.(string); ok && accessRef.MatchString(s) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// ownerInto gives a placed directory the owner the assignment said, where it said one. The
+// manifest's owner is what the image expects on any machine; the assignment's is what this
+// machine's data already is.
+func ownerInto(resource map[string]any, placed map[string]mcat.Placement) {
+	if fmt.Sprint(resource["type"]) != "directory" {
+		return
+	}
+	if p, ok := placed[fmt.Sprint(resource["id"])]; ok && p.Owner != "" {
+		resource["owner"] = p.Owner
+	}
+}
+
+func namesOfAccesses(m mcat.Manifest) []string {
+	var names []string
+	for _, a := range m.Accesses {
+		if a.ID != "" {
+			names = append(names, fmt.Sprintf("%q", a.ID))
+		}
+	}
+	sort.Strings(names)
+	return names
+}
+
+func namesOfAccessIDs(accesses map[string]string) []string {
+	var names []string
+	for id := range accesses {
+		names = append(names, fmt.Sprintf("%q", id))
+	}
+	sort.Strings(names)
+	return names
+}
diff --git a/internal/compose/resolution/placement_seat.go b/internal/compose/resolution/placement_seat.go
new file mode 100644
index 0000000..1861c91
--- /dev/null
+++ b/internal/compose/resolution/placement_seat.go
@@ -0,0 +1,59 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// placementVerbs are the seat's verbs: what reads all it keeps and does by hand all it does by itself (ADR 0567 §10).
+// Optional while the holder that serves them is not yet on every node (design 33 §7): the seat is new in the same
+// delivery as its holder.
+func placementVerbs() []mcat.Verb {
+	changes := map[string]any{"type": "array", "minItems": 1, "description": "the changes, each an object with `op`: " +
+		"place (node, module, ports, bindings), take-off (node, module), pin (node, provision, provider {node, module}), " +
+		"unpin (node, provision), hold (node, module, claim, scope, kind, site), unhold (node, module, claim), decide " +
+		"(node, field, value: a decided field of the node, its address among them), config (node, module, mesh-wide, " +
+		"layer, mesh-wide-values, values), add-node (node, decided, keys: a joining node, mesh-enrolment's alone, the " +
+		"proposal's one change, with the enrolment's warrant, its tunnel key alone at the operator's yes; ADR 0587 §7), " +
+		"remove-node (node: a joining node never confirmed, taken off when its enrolment ends; mesh-enrolment's alone, " +
+		"on the same warrant)",
+		"items": map[string]any{"type": "object", "required": []string{"op", "node"}}}
+	return []mcat.Verb{
+		{Name: mcat.PlacementVerbPlacement, Optional: true, Description: "Read placement: one node's key, the nodes one " +
+			"module is placed on, or every key, each with its revision, and how full the state is against its cap. With " +
+			"history, one node's or one module's changes in order: a revision the state keeps whole, an older one as the " +
+			"proposal's changes from its placement-changed event.",
+			Input: schema(map[string]string{"node": "one node", "module": "one module: the nodes it is placed on",
+				"history": "\"true\": the changes in order, from the stream and the state's revisions",
+				// ADR 0571 clause 4: who holds which seat on which node, from the state seat-holders.
+				"seats": "\"true\": who holds each seat, and on which node (the state seat-holders); with node, that node's"},
+				nil, "history", "seats")},
+		{Name: mcat.PlacementVerbProposals, Optional: true, Description: "Every open proposal of placement: its changes, " +
+			"the revision of each key it was laid over, its candidates, every node's answer, the differences computed and " +
+			"answered, its verdict and its ask. Narrowed to one by id.",
+			Input: schema(map[string]string{"id": "one proposal's id"}, nil)},
+		{Name: mcat.PlacementVerbPropose, Optional: true, Description: "Propose a change of placement, with why: laid over " +
+			"the current keys and refused at once, naming every finding, when the result cannot be placed (two modules " +
+			"on one host port, a provider not placed, a seat held once held twice, two nodes with one address, two " +
+			"hubs, a module the indexer does not hold, a node with no record). Otherwise the nodes it touches compose " +
+			"it in shadow and answer, and on a passing verdict the operator is asked to approve it. Who proposes is the " +
+			"caller, as the runtime proves it. An add-node from mesh-enrolment, whose warrant names its node and address, " +
+			"is written with no ask of its own: its Approve is the enrolment's (ADR 0587 §7).",
+			Input: map[string]any{"type": "object", "additionalProperties": false, "required": []string{"why", "changes"},
+				"properties": map[string]any{
+					"why":     map[string]any{"type": "string", "description": "why, shown to the operator with the proposal"},
+					"changes": changes,
+					// ADR 0587 §7: an add-node carries the warrant of the enrolment that issued the node's token, whose
+					// Approve is the proposal's; the holder writes it with no ask of its own.
+					"warrant": map[string]any{"type": "object", "description": "for an add-node alone: the enrolment's " +
+						"warrant {node, address, ask, warrant}, naming the change's node and address",
+						"required": []string{"node", "address", "ask", "warrant"}},
+				}}},
+		{Name: mcat.PlacementVerbWithdraw, Optional: true, Description: "Withdraw an open proposal: its key and its " +
+			"candidates are deleted and placement-withdrawn carries it whole. With why.",
+			Input: schema(map[string]string{"id": "the proposal's id", "why": "why, kept in the event"}, []string{"id", "why"})},
+		{Name: mcat.PlacementVerbAgain, Optional: true, Description: "Judge an open proposal now with the answers that " +
+			"stand, and raise its ask again when its verdict passes and the operator's channel does not hold the ask. " +
+			"Nothing more: the recovery of a proposal whose judgement or ask was lost.",
+			Input: schema(map[string]string{"id": "the proposal's id"}, []string{"id"})},
+	}
+}
diff --git a/internal/compose/resolution/port_into.go b/internal/compose/resolution/port_into.go
new file mode 100644
index 0000000..1669b51
--- /dev/null
+++ b/internal/compose/resolution/port_into.go
@@ -0,0 +1,133 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofPort is where a module asks which port it was given: ${port:<the port its software uses>}.
+var ofPort = regexp.MustCompile(`\$\{port:([0-9]+)\}`)
+
+// portsUsed are the ports a written value asks about, first appearance first.
+func portsUsed(content string) []int {
+	var used []int
+	seen := map[int]bool{}
+	for _, m := range ofPort.FindAllStringSubmatch(content, -1) {
+		n, err := strconv.Atoi(m[1])
+		if err != nil || seen[n] {
+			continue
+		}
+		seen[n] = true
+		used = append(used, n)
+	}
+	return used
+}
+
+// portInto replaces a resource's ${port:…} placeholders with what this machine assigned — in a
+// file's content, and in a value of a container's or a process's environment.
+//
+// **A process's environment is a container's** (novox/hq to-be 38 WP4c). A module's code moving out
+// of its container becomes a process on the machine and still has to be told what the container
+// was told; filled for one kind and not the other, the literal reached the process and was read as
+// a port, and the modules that moved first wrote their run-once steps a 0600 env file instead.
+//
+// A port the module did not say it listens on is refused, for the same reason a binding's unknown
+// key is: the module is asking about something it never declared, and the answer would be a guess.
+// Left alone, the literal would be written into a configuration file, or handed to a process as
+// its environment, and read as a port number.
+func portInto(resource map[string]any, module string, listens []mcat.Listening, with mcat.Rendering) error {
+	switch fmt.Sprint(resource["type"]) {
+	case "file":
+		content, ok := resource["content"].(string)
+		if !ok {
+			return nil
+		}
+		filled, err := portsFilledInto(content,
+			fmt.Sprintf("%s has a file that", module), module, listens, with)
+		if err != nil {
+			return err
+		}
+		resource["content"] = filled
+
+	case "container", "process":
+		env, ok := resource["env"].(map[string]any)
+		if !ok {
+			return nil
+		}
+		// In a stated order, so a container with two bad values always refuses on the same one.
+		named := make([]string, 0, len(env))
+		for key := range env {
+			named = append(named, key)
+		}
+		sort.Strings(named)
+
+		// **A fresh map, and only when something changes.** This map came out of the module's
+		// manifest and the resource around it is a shallow copy, so filling a value in place would
+		// change what the catalogue holds for every other machine running the module.
+		var filled map[string]any
+		for _, key := range named {
+			written, ok := env[key].(string)
+			if !ok || len(portsUsed(written)) == 0 {
+				continue
+			}
+			value, err := portsFilledInto(written,
+				fmt.Sprintf("%s's %s %s sets %s to something that",
+					module, resource["type"], resource["name"], key), module, listens, with)
+			if err != nil {
+				return err
+			}
+			if filled == nil {
+				filled = map[string]any{}
+				for k, v := range env {
+					filled[k] = v
+				}
+			}
+			filled[key] = value
+		}
+		if filled != nil {
+			resource["env"] = filled
+		}
+	}
+	return nil
+}
+
+// portsFilledInto answers every ${port:…} in one written value, or refuses. `where` names the
+// place it was written, so a refusal is one edit from right whichever kind of resource it came
+// out of.
+func portsFilledInto(written, where, module string, listens []mcat.Listening, with mcat.Rendering) (
+	string, error) {
+	for _, wanted := range portsUsed(written) {
+		var declared bool
+		for _, l := range listens {
+			if l.Port == wanted {
+				declared = true
+			}
+		}
+		if !declared {
+			return "", fmt.Errorf(
+				"%s says ${port:%d}, and %s does not say it listens on %d. A module is told the "+
+					"port it was given for something it declared, and %s",
+				where, wanted, module, wanted, orNoListens(listens))
+		}
+		written = strings.ReplaceAll(written, fmt.Sprintf("${port:%d}", wanted),
+			strconv.Itoa(renderingMachinePort(with, module, wanted)))
+	}
+	return written, nil
+}
+
+// orNoListens says what would have worked, so a refusal is one edit from right.
+func orNoListens(listens []mcat.Listening) string {
+	if len(listens) == 0 {
+		return "it declares no ports at all"
+	}
+	said := make([]string, 0, len(listens))
+	for _, l := range listens {
+		said = append(said, strconv.Itoa(l.Port))
+	}
+	return "it declares " + strings.Join(said, ", ")
+}
diff --git a/internal/compose/resolution/port_into_test.go b/internal/compose/resolution/port_into_test.go
new file mode 100644
index 0000000..c5a2e57
--- /dev/null
+++ b/internal/compose/resolution/port_into_test.go
@@ -0,0 +1,172 @@
+package resolution
+
+import (
+	"reflect"
+	"strconv"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// **A process binds the port the mesh gave it, not the one it wrote down.**
+//
+// A container never needed this: the mesh rewrites its `ports` into assigned:wanted, so the
+// software binds the number it always bound and the machine publishes another. A process runs on
+// the machine with nothing to rewrite, so without a way to ask, every process binds the number in
+// its own configuration and two modules declaring the same one collide — which is the whole
+// problem ADR 0038 exists to prevent, reintroduced by the resource kind that most needs it.
+func TestAModuleIsToldWhichPortItWasGiven(t *testing.T) {
+	file := map[string]any{
+		"type": "file", "id": "settings",
+		"content": "LISTEN=${port:8080}\n",
+	}
+	listens := []mcat.Listening{{Port: 8080, From: mcat.FromMesh}}
+	with := mcat.Rendering{Ports: map[string]map[int]int{"showcase": {8080: 21000}}}
+
+	if err := portInto(file, "showcase", listens, with); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"].(string); got != "LISTEN=21000\n" {
+		t.Fatalf("the module was not told its assigned port: %q", got)
+	}
+}
+
+// With nothing assigned yet, it is told the port it asked about — so a mesh that has not made an
+// assignment still composes something coherent rather than writing a zero.
+func TestWithNoAssignmentAModuleIsToldWhatItAskedFor(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "LISTEN=${port:8080}\n"}
+	if err := portInto(file, "showcase", []mcat.Listening{{Port: 8080}}, mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"].(string); got != "LISTEN=8080\n" {
+		t.Fatalf("an unassigned port did not fall back to what was declared: %q", got)
+	}
+}
+
+// **Asking about a port it never declared is refused**, and the refusal says what it did declare.
+// The module is asking about something the mesh has no opinion on, and answering would be a guess
+// written into a configuration file as a port number.
+func TestAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "LISTEN=${port:9999}\n"}
+	err := portInto(file, "showcase", []mcat.Listening{{Port: 8080}}, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module was told a port it never said it listens on")
+	}
+	if !strings.Contains(err.Error(), "8080") {
+		t.Fatalf("the refusal does not say what would have worked: %v", err)
+	}
+}
+
+// And a file mentioning no port is left exactly as it was.
+func TestAFileWithNoPortIsUntouched(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "GREETING=hello\n"}
+	if err := portInto(file, "showcase", nil, mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"].(string); got != "GREETING=hello\n" {
+		t.Fatalf("a file with no port was changed: %q", got)
+	}
+}
+
+// **A container that dials the machine is told the same thing, in its environment.**
+//
+// The forge's own sidecar reaches the forge over the machine's loopback (novox/hq 04-ISSUES/088).
+// The `assigned:wanted` mapping that lets the forge itself go on binding 3000 does nothing for the
+// caller: the caller dials the machine, so it must be given the machine's number — here one the
+// node was given rather than one the mesh assigned, which is the case that makes the literal wrong
+// even on a mesh that never allocates (ADR 0100).
+func TestAContainerIsToldWhichPortItWasGiven(t *testing.T) {
+	sidecar := map[string]any{
+		"type": "container", "id": "runtime", "name": "mesh-gitea",
+		"env": map[string]any{
+			"MESH_GITEA_URL":  "http://127.0.0.1:${port:3000}",
+			"MESH_ADMIN_USER": "mesh-admin",
+		},
+	}
+	listens := []mcat.Listening{{Port: 3000, From: mcat.FromMesh}}
+	with := mcat.Rendering{Given: map[string]map[int]int{"gitea": {3000: 2999}}}
+
+	if err := portInto(sidecar, "gitea", listens, with); err != nil {
+		t.Fatal(err)
+	}
+	env := sidecar["env"].(map[string]any)
+	if env["MESH_GITEA_URL"] != "http://127.0.0.1:2999" {
+		t.Fatalf("the sidecar dials %v, not the port this machine puts the forge on",
+			env["MESH_GITEA_URL"])
+	}
+	if env["MESH_ADMIN_USER"] != "mesh-admin" {
+		t.Fatalf("filling one value changed another: %v", env)
+	}
+}
+
+// **And the manifest it came out of is left alone.**
+//
+// An `env` map is the catalogue's, shared by every node running the module, and the resource
+// around it is a shallow copy. Filled in place, the first node composed would write its own port
+// into the catalogue and every node composed after it would be told that one — a fault that is
+// invisible in a single composition and wrong in every mesh with two machines.
+func TestFillingAContainersEnvironmentLeavesTheManifestAlone(t *testing.T) {
+	env := map[string]any{"MESH_GITEA_URL": "http://127.0.0.1:${port:3000}"}
+	manifest := map[string]any{"type": "container", "id": "runtime", "name": "mesh-gitea", "env": env}
+
+	for _, at := range []int{2999, 3100} {
+		copied := map[string]any{}
+		for k, v := range manifest {
+			copied[k] = v
+		}
+		with := mcat.Rendering{Given: map[string]map[int]int{"gitea": {3000: at}}}
+		if err := portInto(copied, "gitea", []mcat.Listening{{Port: 3000}}, with); err != nil {
+			t.Fatal(err)
+		}
+		want := "http://127.0.0.1:" + strconv.Itoa(at)
+		if got := copied["env"].(map[string]any)["MESH_GITEA_URL"]; got != want {
+			t.Fatalf("the second node was told %v, not %v — the first composition wrote its own "+
+				"port into the catalogue", got, want)
+		}
+	}
+	if env["MESH_GITEA_URL"] != "http://127.0.0.1:${port:3000}" {
+		t.Fatalf("the module's own manifest was edited: %v", env)
+	}
+}
+
+// Asking in an environment about a port it never declared is refused exactly as a file's is, and
+// the refusal names the container and the variable — there is no line number to go on.
+func TestAContainerAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
+	sidecar := map[string]any{
+		"type": "container", "id": "runtime", "name": "mesh-gitea",
+		"env": map[string]any{"MESH_GITEA_URL": "http://127.0.0.1:${port:9999}"},
+	}
+	err := portInto(sidecar, "gitea", []mcat.Listening{{Port: 3000}}, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a container was told a port its module never said it listens on")
+	}
+	for _, said := range []string{"mesh-gitea", "MESH_GITEA_URL", "3000"} {
+		if !strings.Contains(err.Error(), said) {
+			t.Errorf("the refusal does not say %q: %v", said, err)
+		}
+	}
+}
+
+// And a container naming no port keeps the environment it was written with — the same map, so
+// nothing is copied and no other node's composition is disturbed.
+func TestAContainerWithNoPortPlaceholderKeepsItsEnvironment(t *testing.T) {
+	env := map[string]any{"MESH_GITEA_URL": "http://gitea:3000", "PORT": 3000}
+	sidecar := map[string]any{"type": "container", "name": "mesh-gitea", "env": env}
+	if err := portInto(sidecar, "gitea", []mcat.Listening{{Port: 3000}}, mcat.Rendering{
+		Given: map[string]map[int]int{"gitea": {3000: 2999}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	// A sibling reached over the runtime's own network is reached on the port INSIDE it, which the
+	// module does control: a literal there is right, and moving it would break the one address the
+	// mapping does not touch.
+	if got := sidecar["env"].(map[string]any)["MESH_GITEA_URL"]; got != "http://gitea:3000" {
+		t.Fatalf("an address on the runtime's own network was moved to the machine's port: %v", got)
+	}
+	// The same map, not a copy of it: a container that asks for nothing is left alone, and
+	// comparing the contents would say yes even to a rebuilt map.
+	if reflect.ValueOf(sidecar["env"]).Pointer() != reflect.ValueOf(env).Pointer() {
+		t.Fatalf("a container that asked for nothing had its environment rebuilt: %v", sidecar["env"])
+	}
+}
diff --git a/internal/compose/resolution/process_bus.go b/internal/compose/resolution/process_bus.go
new file mode 100644
index 0000000..a4dd0d1
--- /dev/null
+++ b/internal/compose/resolution/process_bus.go
@@ -0,0 +1,16 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ToolsBusSecret says name is the own secret a tools bundle's bus account is held in: `broker-<binary>` for a bundle
+// whose bus the manifest declares (ADR 0564 Limits 4). Its file belongs to the runtime's account, which runs the bundle.
+func ToolsBusSecret(m mcat.Manifest, name string) bool {
+	for _, a := range m.BusAccounts() {
+		if a.Tools && name == "broker-"+a.ID {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/compose/resolution/process_bus_test.go b/internal/compose/resolution/process_bus_test.go
new file mode 100644
index 0000000..09e5e19
--- /dev/null
+++ b/internal/compose/resolution/process_bus_test.go
@@ -0,0 +1,103 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A process resource may declare `bus` (novox/hq ADR 0436 §1): what it emits, the module's own work-queue
+// streams it consumes, the module's own state it reads and writes, whether it reads the router's records of
+// this module's own asks, and the tools and seat verbs it calls. The fixture is mesh-mail's future manifest
+// shape (ADR 0436 §7, §8), copied from mesh-catalog/modules/mesh-mail/module.json and extended as settled by
+// the lead: process id "send" is the manifest's own `id` (internal/catalogue/runtime.go:72-74 is the model for
+// a process id); the account file uses the controller's real JSON tags (modules.go:1041-1056 issueWith).
+func mailSenderProcessManifest(t *testing.T, bus string) string {
+	t.Helper()
+	process := `{"id":"send","type":"process","run":["./mesh-mail","send"],"user":"mesh-mail-send"`
+	if bus != "" {
+		process += `,"bus":` + bus
+	}
+	process += `}`
+	// The stream itself is plain here, not retention work-queue: 1179 checks only that a process names a
+	// stream the module owns, never its retention — that rule is 1178's (WorkQueueStreamProblems), and is
+	// tested against its own fixture there (work_queue_consumer_test.go) so this one stays accepted whether
+	// or not a process currently names "mail-sends" in bus.queues.
+	return `{"module":"mesh-mail","version":"1","emits":["mail.send.sent","mail.send.failed"],` +
+		`"state":["sends"],"streams":[{"name":"mail-sends","events":["mail.send.approved"],"max-age-days":1,` +
+		`"max-mib":64}],"resources":[{"id":"account","type":"user","name":"mesh-mail-send"},` + process + `]}`
+}
+
+const mailSenderBus = `{"emits":["mail.send.sent","mail.send.failed"],"queues":["mail-sends"],` +
+	`"state":["sends"],"asks":true,"invokes":["seat:operator-channel.tell"]}`
+
+// 1179/AC5: a process declaring bus is composed with no bus key on the wire, and is otherwise byte for byte
+// what main composes for the same process without bus.
+func TestAProcessesBusNeverReachesTheWire(t *testing.T) {
+	withBus, err := decodeForTest([]byte(mailSenderProcessManifest(t, mailSenderBus)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	withoutBus, err := decodeForTest([]byte(mailSenderProcessManifest(t, "")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	with := mcat.Rendering{Needed: map[string]map[string]string{}}
+	outWith, err := Declaration(mcat.Resolution{Node: "novox", Modules: []mcat.Manifest{withBus}}, with)
+	if err != nil {
+		t.Fatalf("composing with bus: %v", err)
+	}
+	outWithout, err := Declaration(mcat.Resolution{Node: "novox", Modules: []mcat.Manifest{withoutBus}}, with)
+	if err != nil {
+		t.Fatalf("composing without bus: %v", err)
+	}
+	var withProcess, withoutProcess map[string]any
+	for _, r := range outWith {
+		if r["id"] == "mesh-mail.send" {
+			withProcess = r
+		}
+	}
+	for _, r := range outWithout {
+		if r["id"] == "mesh-mail.send" {
+			withoutProcess = r
+		}
+	}
+	if withProcess == nil || withoutProcess == nil {
+		t.Fatalf("the process was not composed at all: with=%v without=%v", withProcess, withoutProcess)
+	}
+	if _, has := withProcess["bus"]; has {
+		t.Fatalf("the process resource carried a bus key onto the wire: %v", withProcess)
+	}
+	delete(withProcess, "bus")
+	if !mapsEqual(withProcess, withoutProcess) {
+		t.Fatalf("with bus declared, the process composed differently: %+v\nwant: %+v", withProcess, withoutProcess)
+	}
+}
+
+func mapsEqual(a, b map[string]any) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k, v := range a {
+		bv, ok := b[k]
+		if !ok {
+			return false
+		}
+		if av, ok := v.([]any); ok {
+			bbv, ok := bv.([]any)
+			if !ok || len(av) != len(bbv) {
+				return false
+			}
+			for i := range av {
+				if av[i] != bbv[i] {
+					return false
+				}
+			}
+			continue
+		}
+		if v != bv {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/compose/resolution/process_env_test.go b/internal/compose/resolution/process_env_test.go
new file mode 100644
index 0000000..92a4ace
--- /dev/null
+++ b/internal/compose/resolution/process_env_test.go
@@ -0,0 +1,82 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// **A process's environment is composed as a container's is** (novox/hq to-be 38 WP4c).
+//
+// A module's code moving out of its container becomes a process on the machine, and what its
+// container's environment asked for — the port this machine gave the module, the place it put the
+// module's directory — it still has to be told. Filled for a container and not for a process, the
+// literal `${port:8080}` reached the process as its environment and was read as a port; the modules
+// that moved first wrote their run-once steps an env file instead.
+func processModule(env map[string]any) mcat.Manifest {
+	return mcat.Manifest{
+		Module:  "showcase",
+		Listens: []mcat.Listening{{Port: 8080, From: mcat.FromMesh}},
+		Resources: []map[string]any{
+			{"id": "data", "type": "directory", "mode": "0700"},
+			{"id": "setup", "type": "process", "name": "showcase-setup", "run-once": true,
+				"run": []any{"/usr/bin/showcase", "setup"}, "env": env},
+		},
+	}
+}
+
+func TestAProcessIsToldItsPortAndItsPlaceInItsEnvironment(t *testing.T) {
+	env := map[string]any{
+		"SHOWCASE_URL":  "http://127.0.0.1:${port:8080}",
+		"SHOWCASE_DATA": "${dir:data}/objects",
+		"SHOWCASE_DB":   "127.0.0.1:${seat:mesh-store:5432}",
+		"GREETING":      "hello",
+	}
+	out, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{processModule(env)}}, mcat.Rendering{
+		Ports: map[string]map[int]int{"showcase": {8080: 21000}},
+		Seats: map[string]map[int]int{"mesh-store": {5432: 6852}},
+	})
+	if err != nil {
+		t.Fatalf("a process asking for its port and its place does not compose: %v", err)
+	}
+	setup := fileNamed(out, "showcase.setup")
+	if setup == nil {
+		t.Fatalf("the process is not in the declaration: %v", out)
+	}
+	got, _ := setup["env"].(map[string]any)
+	for key, want := range map[string]string{
+		"SHOWCASE_URL":  "http://127.0.0.1:21000",
+		"SHOWCASE_DATA": "/var/lib/showcase/data/objects",
+		"SHOWCASE_DB":   "127.0.0.1:6852",
+		"GREETING":      "hello",
+	} {
+		if got[key] != want {
+			t.Errorf("the process is told %s=%v, want %q", key, got[key], want)
+		}
+	}
+	if env["SHOWCASE_URL"] != "http://127.0.0.1:${port:8080}" {
+		t.Fatalf("composing for one machine edited the module's own manifest: %v", env)
+	}
+}
+
+// An unknown reference in a process's environment is refused as a container's is, naming the
+// process and the variable — left alone, it would reach the machine as a literal.
+func TestAProcessAskingAboutAnUndeclaredPortIsRefused(t *testing.T) {
+	env := map[string]any{"SHOWCASE_URL": "http://127.0.0.1:${port:9999}"}
+	_, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{processModule(env)}}, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a process was told a port its module never said it listens on")
+	}
+	for _, said := range []string{"showcase-setup", "SHOWCASE_URL", "${port:9999}", "8080"} {
+		if !strings.Contains(err.Error(), said) {
+			t.Errorf("the refusal does not say %q: %v", said, err)
+		}
+	}
+
+	env = map[string]any{"SHOWCASE_DATA": "${dir:date}/objects"}
+	if _, err := Declaration((mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{processModule(env)}}), mcat.Rendering{}); err == nil ||
+		!strings.Contains(err.Error(), "${dir:date}") {
+		t.Fatalf("a process naming no directory of its module was not refused: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/proofs_test.go b/internal/compose/resolution/proofs_test.go
new file mode 100644
index 0000000..cd1396b
--- /dev/null
+++ b/internal/compose/resolution/proofs_test.go
@@ -0,0 +1,476 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/provisions"
+
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// The proofs that a manifest composes, which the indexer's judge tests and route-proxy's tests held while the
+// composition was mesh-sdk's (novox/hq ADR 0593 §7): the composition is the node-engine's, so they are held here, each
+// case as it was (sdk1, .work/sdk1/proofs-for-node-engine.md; mesh-delivery 6fb743f, mesh-networking a74f9db).
+
+// declared is the declaration of r with, failing the test on a refusal.
+func declared(t *testing.T, r mcat.Resolution, with mcat.Rendering) []map[string]any {
+	t.Helper()
+	out, err := Declaration(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+func twoMergeableFiles(app, sidecar []any) mcat.Manifest {
+	appFile := map[string]any{"id": "app", "type": "file", "path": "/etc/app.json", "merge": mcat.MergeJSON,
+		"content": `{"server":{"port":8080},"search":{"safe":1}}`}
+	sideFile := map[string]any{"id": "sidecar", "type": "file", "path": "/etc/sidecar.json", "merge": mcat.MergeJSON,
+		"content": `{"url":"http://127.0.0.1:8080"}`}
+	if app != nil {
+		appFile[mcat.TakesSettingsField] = app
+	}
+	if sidecar != nil {
+		sideFile[mcat.TakesSettingsField] = sidecar
+	}
+	return mcat.Manifest{Module: "search", Resources: []map[string]any{appFile, sideFile,
+		{"id": "env", "type": "file", "path": "/etc/search.env", "content": "SITE=${setting:site-name}\n"}}}
+}
+
+// The indexer's judge's proofs, items 1 to 13 of its list.
+func TestTheJudgesProofsOfAComposition(t *testing.T) {
+	runtimeWith := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "dash": {"token": "sealed-token"}}}
+	processOf := func(out []map[string]any) map[string]any {
+		return fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	}
+
+	t.Run("1 a bundle's words resolve per machine into the runtime's tool env", func(t *testing.T) {
+		dash := mcat.Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
+			Listens:    []mcat.Listening{{Name: "web", Port: 3000, Protocol: "tcp"}},
+			OwnSecrets: mcat.OwnSecrets{"token": {Path: "${dir:mesh-state}/token"}},
+			Resources: []map[string]any{
+				{"id": "mesh-state", "type": "directory", "mode": "0700", "place": "mesh"},
+				{"id": "config", "type": "file", "path": "${dir:mesh-state}/config.json", "mode": "0600", "content": "{}\n"},
+				{"id": "unrelated", "type": "file", "path": "/etc/dash.conf", "content": "x\n"},
+			},
+			Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript",
+				Entrypoints: []string{"tools/index.js"},
+				Env: map[string]string{"DASH_CONFIG_FILE": "${dir:mesh-state}/config.json", "DASH_TOKEN_FILE": "${dir:mesh-state}/token",
+					"DASH_URL": "http://127.0.0.1:${port:3000}", "DASH_ADMIN": "mesh-admin"}}}}}
+		dash, err := dash.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
+			Reference: mcat.ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		other := aToolsModule(t, "nftables", "tools/index.js")
+		out := declared(t, mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{dash, other, theRuntime(t)}}, runtimeWith)
+		dir := fileNamed(out, "dash.mesh-state")
+		if dir == nil {
+			t.Fatalf("no directory: %v", ids(out))
+		}
+		at := fmt.Sprint(dir["path"])
+		process := processOf(out)
+		env := process["env"].(map[string]string)
+		var given map[string]map[string]string
+		if err := json.Unmarshal([]byte(env[mcat.RuntimeToolEnv]), &given); err != nil {
+			t.Fatalf("the runtime's %s is not JSON: %q", mcat.RuntimeToolEnv, env[mcat.RuntimeToolEnv])
+		}
+		want := map[string]string{"DASH_CONFIG_FILE": at + "/config.json", "DASH_TOKEN_FILE": at + "/token",
+			"DASH_URL": "http://127.0.0.1:3000", "DASH_ADMIN": "mesh-admin"}
+		if fmt.Sprint(given["dash"]) != fmt.Sprint(want) {
+			t.Errorf("dash is given %v, want %v", given["dash"], want)
+		}
+		if _, has := given["nftables"]; has {
+			t.Errorf("a module that declares no words was given some: %v", given)
+		}
+		for _, id := range []string{"dash.mesh-state", "dash.config", "dash." + mcat.NeedID("token")} {
+			if r := fileNamed(out, id); r == nil || r["owner"] != "ops" {
+				t.Errorf("%s is not the account's to read: %v", id, r)
+			}
+		}
+		if r := fileNamed(out, "dash.unrelated"); r == nil || r["owner"] != nil {
+			t.Errorf("a file no word names was given an owner: %v", r)
+		}
+		restarts := fmt.Sprint(process["restart-on"])
+		for _, want := range []string{"dash.config", "dash." + mcat.NeedID("token")} {
+			if !strings.Contains(restarts, want) {
+				t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
+			}
+		}
+		if strings.Contains(restarts, "dash.unrelated") || strings.Contains(restarts, "dash.mesh-state") {
+			t.Errorf("the runtime restarts for something no word names as a file: %s", restarts)
+		}
+		// No account: the runtime is root and nothing is re-owned.
+		if r := fileNamed(declared(t, mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{dash, theRuntime(t)}}, runtimeWith),
+			"dash.config"); r["owner"] != nil {
+			t.Errorf("re-owned with no account: %v", r)
+		}
+		// A change to a module's words changes the runtime's process.
+		changed := dash
+		changed.Bundles = append([]mcat.Bundle(nil), dash.Bundles...)
+		changed.Bundles[0].Env = map[string]string{"DASH_ADMIN": "somebody-else"}
+		out2 := declared(t, mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{changed, theRuntime(t)}}, runtimeWith)
+		if fmt.Sprint(processOf(out2)["env"]) == fmt.Sprint(env) {
+			t.Error("the runtime's process is the same after a module's words changed, so it would not restart")
+		}
+	})
+
+	t.Run("2 a Go bundle is delivered and named to the runtime by its binary", func(t *testing.T) {
+		lamp := mcat.Manifest{Module: "lamp", Version: "1", Tools: []string{"on"},
+			Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "tools", Kind: mcat.ArtifactBundle, Language: "go",
+				System: "arch", From: "cmd/lamp-tools"}}}}
+		lamp, err := lamp.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
+			Reference: mcat.ArtifactStoreScheme + "lamp/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := declared(t, mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{lamp, theRuntime(t)}}, runtimeWith)
+		if fileNamed(out, "lamp."+BundleID("tools")) == nil {
+			t.Errorf("the Go bundle is not delivered: %v", ids(out))
+		}
+		if env := processOf(out)["env"].(map[string]string); env[mcat.RuntimeToolModules] != "lamp="+BundlePath("lamp", "tools")+"/lamp-tools" {
+			t.Errorf("the runtime is told %q, want the binary", env[mcat.RuntimeToolModules])
+		}
+	})
+
+	t.Run("3 a handed module's plan names its provider's credential form", func(t *testing.T) {
+		storeOffering := func(credential string) mcat.Manifest {
+			raw := `{"module":"store","version":"1","provides":[{"name":"postgres-database","scope":"mesh"` +
+				credential + `}],"serves":{"postgres-database":{"port":5432}}`
+			if strings.Contains(credential, `"own"`) {
+				raw += `,"own-secrets":{"admin":{"path":"/var/lib/store/admin","taken":"at-start"},` +
+					`"token":{"path":"/var/lib/store/token","taken":"at-start","issued-by":"outside"}}`
+			}
+			return mustParse(t, raw+`}`)
+		}
+		for credential, want := range map[string]string{
+			``:                                      "",
+			`,"credential":{"form":"pair"}`:         mcat.CredentialFormPair,
+			`,"credential":{"form":"none"}`:         mcat.CredentialFormNone,
+			`,"credential":{"own":"admin"}`:         mcat.CredentialFormShared,
+			`,"credential":{"own":"token"}`:         mcat.CredentialFormGiven,
+			`,"credential":{"issued-by":"outside"}`: mcat.CredentialFormGiven,
+			`,"credential":{"issued-by":"software","tool":"store_issued_token"}`: mcat.CredentialFormIssued,
+		} {
+			node := workstation()
+			node.At = "workstation.internal"
+			consumer := notifierConsumer(t, true, false)
+			r, err := Resolve(shelf(consumer, storeOffering(credential)), []string{consumer.Module}, node, twoStores("anchor"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			r.Account = "op"
+			c, _ := composeWith(t, r, handingTo("store:5000"))
+			if got := c.Plans["notify"].Provisions; len(got) != 1 || got[0].CredentialForm != want {
+				t.Errorf("an offer with %q: the plan names %+v, want the form %q", credential, got, want)
+			}
+		}
+	})
+
+	t.Run("4 a stored definition from before the settings rule still composes", func(t *testing.T) {
+		m := twoMergeableFiles(nil, nil)
+		m.Resources[2]["content"] = "WORKERS=${setting:workers}\n"
+		raw, err := json.Marshal(map[string]any{"module": m.Module, "version": "1", "resources": m.Resources,
+			"settings": map[string]any{"workers": map[string]any{"kind": mcat.KindPreference, "default": 4, "why": "a number"}}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		read, err := mcat.Decode(raw)
+		if err != nil {
+			t.Fatalf("a stored build from before the rule is not read again: %v", err)
+		}
+		if err := JudgeSettings(read, nil, false); err != nil {
+			t.Errorf("a stored definition is composed as before, and was refused: %v", err)
+		}
+	})
+
+	t.Run("5 a placeholder outside its holder is refused at composition", func(t *testing.T) {
+		for _, c := range []struct{ content, want string }{
+			{"${environment:posix}", "toolchain's resource rc names ${environment:posix} and toolchain does not claim node-environment"},
+			{"${shell:zsh:normal}", "toolchain's resource rc names ${shell:zsh:normal} and toolchain does not claim node-login-shell"},
+		} {
+			m := mcat.Manifest{Module: "toolchain", Resources: []map[string]any{
+				{"id": "rc", "type": "file", "path": "/etc/rc", "content": c.content}}}
+			r := mcat.Resolution{Node: "workstation", Account: "op", Modules: []mcat.Manifest{m}}
+			if _, err := Declaration(r, mcat.Rendering{}); err == nil || !strings.Contains(err.Error(), c.want) {
+				t.Errorf("composition accepted %s outside its holder: %v", c.content, err)
+			}
+		}
+	})
+
+	t.Run("6 a provider read from its tree composes where it would be handed", func(t *testing.T) {
+		dir := t.TempDir()
+		if err := os.MkdirAll(filepath.Join(dir, "files"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "files", "consumers.json"), []byte(consumersText), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		var m mcat.Manifest
+		if err := json.Unmarshal([]byte(handedProvider), &m); err != nil {
+			t.Fatal(err)
+		}
+		filled, err := mcat.WithTemplatesFrom(m, dir)
+		if err != nil {
+			t.Fatalf("a provider read from its tree is refused: %v", err)
+		}
+		if _, err := Compose(notifierOn(t, filled), handingTo("store:5000")); err != nil {
+			t.Fatalf("a provider read from its tree does not compose where it would be handed: %v", err)
+		}
+	})
+
+	t.Run("7 a module whose field is set aside is composed whole", func(t *testing.T) {
+		for where, raw := range map[string]string{
+			"the top": `{"module": "later", "version": "2", "a-field-from-later": {"x": 1}}`,
+			"a state": `{"module": "later", "version": "2", "state": [{"name": "s", "a-field-from-later": 1}]}`,
+		} {
+			var m mcat.Manifest
+			if err := json.Unmarshal([]byte(raw), &m); err != nil {
+				t.Fatalf("%s: %v", where, err)
+			}
+			if left := LeftOut(mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{m, notifier()}}, nil, false); len(left) != 0 {
+				t.Errorf("%s: a module was left out for a field set aside: %v", where, left)
+			}
+		}
+		var later mcat.Manifest
+		if err := json.Unmarshal([]byte(`{"module": "later", "version": "2", "a-field-from-later": 1,
+		"resources": [{"id": "d", "type": "directory", "mode": "0700"}, {"id": "rc", "type": "file", "path": "/etc/later.conf", "content": "x\n"}],
+		"data": {"own": [{"id": "d", "path": "${dir:d}", "class": "valuable"}]}}`), &later); err != nil {
+			t.Fatal(err)
+		}
+		holder := mcat.Manifest{Module: "backups", Version: "1",
+			Claims: []mcat.Claim{{Name: mcat.BackupSeat, Scope: mcat.ScopeNode}},
+			Resources: []map[string]any{{"id": "list", "type": "file", "path": "/etc/backups.list", "mode": "0644",
+				"content": "${contribution:" + mcat.BackupSeat + ":backup}"}}}
+		r := anAdoptedAnchor()
+		r.Modules = append(r.Modules, holder, later)
+		composed, err := Compose(r, anchorRendering(false))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, left := composed.LeftOut["later"]; left {
+			t.Fatalf("left out: %v", composed.LeftOut)
+		}
+		got := byID(composed.Resources)
+		if _, declared := got["later.rc"]; !declared {
+			t.Fatal("the module's file is not declared")
+		}
+		if list, _ := got["backups.list"]["content"].(string); !strings.Contains(list, "# later") || !strings.Contains(list, "path /var/lib/later/d") {
+			t.Fatalf("the module's data is not backed up:\n%s", list)
+		}
+	})
+
+	t.Run("8 composing refuses a silent sidecar", func(t *testing.T) {
+		if err := JudgeSettings(twoMergeableFiles([]any{"server"}, nil), nil, false); err == nil || !strings.Contains(err.Error(), "sidecar") {
+			t.Errorf("composing it should refuse it, and said: %v", err)
+		}
+	})
+
+	t.Run("9 ApplySettings refuses a file that does not merge and names keys", func(t *testing.T) {
+		plain := map[string]any{"id": "plain", "type": "file", "path": "/x", "content": "x", mcat.TakesSettingsField: []any{"a"}}
+		if _, err := ApplySettings(plain, nil); err == nil {
+			t.Error("a file that does not merge and names keys was settled")
+		}
+	})
+
+	t.Run("10 the runtime is told whom agents run as", func(t *testing.T) {
+		envOf := func(r mcat.Resolution) map[string]string {
+			r.Node, r.Modules = "anchor", []mcat.Manifest{aToolsModule(t, "nftables", "tools/index.js"), theRuntime(t)}
+			process := processOf(declared(t, r, runtimeWith))
+			if process == nil {
+				t.Fatal("no runtime process was composed")
+			}
+			return process["env"].(map[string]string)
+		}
+		env := envOf(mcat.Resolution{Account: "ops", AgentAccount: "agent"})
+		if env[mcat.RuntimeAgentAccount] != "agent" || env[mcat.RuntimeAgentHome] != "/home/agent" || env[mcat.RuntimeOperatorAccount] != "ops" {
+			t.Errorf("the runtime is not told whom agents run as: %v", env)
+		}
+		env = envOf(mcat.Resolution{Account: "ops"})
+		if env[mcat.RuntimeAgentAccount] != "ops" || env[mcat.RuntimeAgentHome] != "/home/ops" {
+			t.Errorf("with no agent account, agents run as the operator: %v", env)
+		}
+		if _, set := envOf(mcat.Resolution{})[mcat.RuntimeAgentAccount]; set {
+			t.Error("a machine with no account names an agent account")
+		}
+	})
+
+	t.Run("11 the session's files are placed by the display server's holder alone", func(t *testing.T) {
+		xorg := mcat.Manifest{Module: "xorg", Claims: []mcat.Claim{{Name: mcat.DisplayServerSeat}},
+			Shell: []mcat.ShellCode{{For: "xinitrc", Slot: "first", Code: "xset s off"}},
+			Resources: []map[string]any{
+				{"id": "xinitrc", "type": "file", "path": "/home/op/.xinitrc",
+					"content": "${shell:xinitrc:first}${shell:xinitrc:normal}${shell:xinitrc:last}"},
+				{"id": "xresources", "type": "file", "path": "/home/op/.Xresources", "content": "${shell:xresources:normal}"},
+			}}
+		i3 := mcat.Manifest{Module: "i3", Shell: []mcat.ShellCode{{For: "xinitrc", Slot: "last", Code: "exec i3"}}}
+		theme := mcat.Manifest{Module: "theme", Shell: []mcat.ShellCode{
+			{For: "xresources", Slot: "normal", Code: "Xft.dpi: 96"}, {For: "zsh", Slot: "normal", Code: "not for the session"}}}
+		out := declared(t, mcat.Resolution{Node: "workstation", Account: "op", Modules: []mcat.Manifest{xorg, i3, theme}}, mcat.Rendering{})
+		by := map[string]any{}
+		for _, res := range out {
+			by[res["id"].(string)] = res["content"]
+		}
+		if got := by["xorg.xinitrc"]; got != "# xorg\nxset s off\n# i3\nexec i3\n" {
+			t.Errorf("the .xinitrc is %q", got)
+		}
+		if got := by["xorg.xresources"]; got != "# theme\nXft.dpi: 96\n" {
+			t.Errorf("the .Xresources is %q", got)
+		}
+	})
+
+	t.Run("12 what a handed module cannot have from the vault is refused", func(t *testing.T) {
+		requires := strings.Replace(botMoved(), `"own-secrets":`, `"requires":["database"],"secrets":{"database":"/etc/bot/db"},"own-secrets":`, 1)
+		r, err := Resolve(shelf(held(t, requires, builtBot("db = ${secret:database}\n")),
+			mcat.Manifest{Module: "db", Version: "1", Provides: []mcat.Offer{{Name: "database", Scope: mcat.ScopeNode}}}),
+			[]string{"bot"}, workstation(), mcat.World{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		r.Account = "op"
+		if _, err := Compose(r, handingTo("store:5000")); err == nil || !strings.Contains(err.Error(), "moves with its provider") {
+			t.Errorf("a template naming a required credential: %v", err)
+		}
+		inline := strings.Replace(botMoved(), `{"id":"daemon"`,
+			`{"id":"legacy","type":"file","path":"/etc/bot/legacy","content":"t = ${secret:token}\n"},{"id":"daemon"`, 1)
+		if _, err := Compose(notifierOn(t, held(t, inline, builtBot(botText))), handingTo("store:5000")); err == nil ||
+			!strings.Contains(err.Error(), "keep it in a template") {
+			t.Errorf("an inline file naming a secret in a handed module: %v", err)
+		}
+	})
+	// 13, a held manifest's template checked by HeldTemplateProblem: TestAManifestStillNamingATemplateIsNotHeld in template_test.go, moved
+	// with the catalogue's tests, and the held fixture each case above reads its manifests through.
+}
+
+// route-proxy's proofs, items 1 to 3 of its list.
+func TestRouteProxysProofsOfAComposition(t *testing.T) {
+	proxy := mcat.Manifest{Module: "route-proxy", Version: "1",
+		Provides: []mcat.Offer{{Name: "route", Scope: mcat.ScopeMesh, AnsweredBy: mcat.AnsweredByHelper}}}
+	world := mcat.World{Offered: map[string][]mcat.Provider{"route": {{Node: "anchor", At: "anchor.internal", Module: "route-proxy"}}}}
+
+	t.Run("1 route-proxy's manifest composes for a machine", func(t *testing.T) {
+		if root := os.Getenv(beside.Env); root != "" {
+			if _, err := os.Stat(filepath.Join(root, "mesh-networking")); err != nil {
+				// A checker from before novox/hq ADR 0593 places no mesh-networking beside the node-engine: absent, not
+				// wrong, and said aloud. Once it does, a missing route-proxy manifest in it fails below.
+				t.Skipf("NOT JUDGED: mesh-networking is not beside this check in %s=%s; the running checker places none for the node-engine, so route-proxy's manifest is judged only once it does", beside.Env, root)
+			}
+		}
+		root := beside.Dir(t, "mesh-networking")
+		m, err := mcat.ReadTreeManifest(root, filepath.Join(root, "modules", "route-proxy"))
+		if err != nil {
+			t.Fatalf("route-proxy's manifest does not parse:\n%v", err)
+		}
+		// As a build would leave it: each artifact a container names resolved to an image; an archive unpacks a bundle.
+		for _, res := range m.Resources {
+			if artifact, ok := res["artifact"].(string); ok && res["type"] != "archive" {
+				delete(res, "artifact")
+				res["image"] = "registry.invalid/route-proxy/" + artifact +
+					"@sha256:1111111111111111111111111111111111111111111111111111111111111111"
+			}
+		}
+		r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m}, Needs: []mcat.Needed{{
+			Name: "internal-acme-ca", From: "home", At: "home.internal", For: "route-proxy",
+			Serves: map[string]any{"port": float64(9000), "path": "/acme/acme/directory", "roots": "/roots.pem"}}}}
+		// Its own broker credential, sealed as the mesh would.
+		out := declared(t, r, mcat.Rendering{Needed: map[string]map[string]string{"route-proxy": {"broker": "sealed"}}})
+		if fileNamed(out, "route-proxy.acme-env") == nil {
+			t.Fatalf("nothing writes the public issuer's environment: %v", ids(out))
+		}
+		if fileNamed(out, "route-proxy.bound-acme-ca") != nil {
+			t.Error("a binding to acme-ca is still written")
+		}
+		sealed := false
+		for _, res := range out {
+			sealed = sealed || strings.Contains(fmt.Sprint(res), "sealed")
+		}
+		internal := false
+		for _, res := range out {
+			internal = internal || strings.Contains(fmt.Sprint(res["content"]), "home.internal:9000")
+		}
+		if !sealed || !internal {
+			t.Errorf("the broker credential sealed: %v; the internal-acme-ca need resolved: %v (%v)", sealed, internal, ids(out))
+		}
+	})
+
+	t.Run("2 and 3 a route endpoint's machine port, and the plan's provision entry", func(t *testing.T) {
+		for _, c := range []struct {
+			name, node, module string
+			port               int
+			published          []any
+			placed             map[int]int
+			at                 int
+		}{
+			{"beside the proxy, moved by the placement (gitea)", "anchor", "gitea", 3000, []any{"3000"}, map[int]int{3000: 20000}, 20000},
+			{"on another machine, moved by the placement (grafana)", "home", "grafana", 3000, []any{"3000"}, map[int]int{3000: 20012}, 20012},
+			{"a bare port the placement holds none for (influxdb)", "home", "influxdb", 8086, []any{"8086"}, nil, 8086},
+			{"a fixed mapping (mailu 7080:80)", "anchor", "mailu", 7080, []any{"25", "7080:80"}, nil, 7080},
+			{"a fixed mapping the placement names another port of (photos 9102:9000)", "anchor", "photos", 9102,
+				[]any{"9102:9000"}, map[int]int{9000: 20011}, 9102},
+			{"the host's network (home-assistant)", "anchor", "home-assistant", 8123, nil, nil, 8123},
+		} {
+			container := map[string]any{"type": "container", "name": c.module, "image": "x"}
+			if c.published != nil {
+				container["ports"] = c.published
+			} else {
+				container["network"] = "host"
+			}
+			module := mcat.Manifest{Module: c.module, Version: "1", Requires: []string{"route"},
+				Listens:     []mcat.Listening{{Name: "web", Port: c.port, Protocol: "tcp", From: "mesh"}},
+				Contributes: map[string]map[string]any{"route": {"label": c.module, "endpoint": "web"}},
+				Resources:   []map[string]any{container}}
+			node := mcat.Node{Name: c.node, At: c.node + ".internal", PublicDomain: "example.org",
+				Capabilities: map[string]bool{"container-runtime": true}}
+			r, err := Resolve(map[string]mcat.Manifest{module.Module: module, proxy.Module: proxy}, []string{module.Module}, node, world)
+			if err != nil {
+				t.Fatalf("%s: %v", c.name, err)
+			}
+			r.Account = "op"
+			for i, n := range r.Needs {
+				r.Needs[i].AnsweredByHelper = n.Name == "route" // as the plan sets it (compose's answeredByHelper)
+			}
+			ports := map[int]int{} // as compose's portsFor gives them
+			for _, l := range module.Listens {
+				where, mayAssign := module.MachineSide(l.Port)
+				if at, known := c.placed[l.Port]; mayAssign && known {
+					where = at
+				}
+				ports[l.Port] = where
+			}
+			if ports[c.port] != c.at {
+				t.Errorf("%s: the endpoint's machine port is %d, want %d", c.name, ports[c.port], c.at)
+			}
+			composed, err := Compose(r, mcat.Rendering{Hands: true, Provisioner: "mesh-provisioner-client",
+				ArtifactStore: "store:5000", Planned: true, Ports: map[string]map[int]int{c.module: ports}})
+			if err != nil {
+				t.Fatalf("%s: %v", c.name, err)
+			}
+			// The plan's provision entry names the proxy and carries a Contributed the contract accepts, end to end.
+			value, err := provisions.EncodePlan(provisions.Plan{Node: c.node, Module: c.module, Plan: composed.Plans[c.module]})
+			if err != nil {
+				t.Fatalf("%s: the plan does not fit the contract: %v", c.name, err)
+			}
+			back, err := provisions.DecodePlan(value)
+			if err != nil {
+				t.Fatalf("%s: %v", c.name, err)
+			}
+			var entry *mcat.PlanProvision
+			for i := range back.Plan.Provisions {
+				if back.Plan.Provisions[i].Provision == "route" {
+					entry = &back.Plan.Provisions[i]
+				}
+			}
+			if entry == nil || entry.ProviderModule != "route-proxy" || len(entry.Contributed) == 0 ||
+				!strings.Contains(string(entry.Contributed), fmt.Sprint(c.at)) {
+				t.Errorf("%s: the plan's route entry %+v names no proxy, or not the port %d", c.name, entry, c.at)
+			}
+		}
+	})
+}
diff --git a/internal/compose/resolution/reach_test.go b/internal/compose/resolution/reach_test.go
new file mode 100644
index 0000000..c92dae0
--- /dev/null
+++ b/internal/compose/resolution/reach_test.go
@@ -0,0 +1,163 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// a web module with one routed endpoint, the shape almost every routed module in the catalogue has.
+func aRoutedWeb() mcat.Manifest {
+	return mcat.Manifest{
+		Module:  "web",
+		Listens: []mcat.Listening{{Port: 3000, From: mcat.FromMesh}},
+		Contributes: map[string]map[string]any{
+			"route": {"label": "app", "port": 3000},
+		},
+	}
+}
+
+func reachSet(reach string) mcat.SettingsBy {
+	return mcat.SettingsBy{"web": {{From: "node anchor",
+		Placement: map[string]any{mcat.ReachSetting: map[string]any{"3000": reach}}}}}
+}
+
+// namesFor renders the contribution a routed module makes and returns the two names it carries.
+func namesFor(t *testing.T, m mcat.Manifest, settings mcat.SettingsBy) (public, internal string) {
+	t.Helper()
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	given, err := resolutionContributions(r, settings, nil, nil)
+	if err != nil {
+		t.Fatalf("contributions: %v", err)
+	}
+	for _, c := range given["route"] {
+		p, _ := c.Values["name"].(string)
+		i, _ := c.Values["internal-name"].(string)
+		return p, i
+	}
+	t.Fatal("the module contributed no route")
+	return "", ""
+}
+
+// **The filter reads the same value — for an endpoint the proxy does not serve.**
+//
+// A routed endpoint's port is how the proxy reaches it and nothing else (ADR 0045): a public service
+// listens from the mesh, only the proxy reaches it, and it is exposed by name. So on a routed
+// endpoint the reach asks for a name and the port keeps what the manifest said.
+func TestAnUnroutedEndpointsPortFollowsItsReach(t *testing.T) {
+	// The same module with its route taken away: now the port is the only way in, so reach governs it.
+	bare := aRoutedWeb()
+	bare.Contributes = nil
+
+	for _, c := range []struct{ reach, want string }{
+		{mcat.ReachInternal, mcat.FromMesh},
+		{mcat.ReachPublic, mcat.FromEverywhere},
+		{mcat.ReachBoth, mcat.FromEverywhere},
+		{mcat.ReachMachine, mcat.FromMachine},
+	} {
+		r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{bare}}
+		rules, err := Rules(r, mcat.Rendering{Settings: reachSet(c.reach)})
+		if err != nil {
+			t.Fatalf("%s: rules: %v", c.reach, err)
+		}
+		found := false
+		for _, rule := range rules {
+			if rule.Port == 3000 {
+				found = true
+				if rule.From != c.want {
+					t.Fatalf("reach %q made the filter say %q, want %q", c.reach, rule.From, c.want)
+				}
+			}
+		}
+		if !found {
+			t.Fatalf("reach %q produced no rule for the port", c.reach)
+		}
+	}
+}
+
+// **A public name does not open the machine's port**, which is the case that found this.
+//
+// A module whose routed name must be public and whose machine-side port must not be had no way to say
+// so while one value drove both. Under one value it could not be expressed; the port would reopen.
+func TestAPublicNameLeavesARoutedPortAsTheManifestSaid(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{aRoutedWeb()},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	rules, err := Rules(r, mcat.Rendering{Settings: reachSet(mcat.ReachPublic)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, rule := range rules {
+		if rule.Port == 3000 && rule.From != mcat.FromMesh {
+			t.Fatalf("a public reach opened a routed port to %q; the proxy is how it is reached",
+				rule.From)
+		}
+	}
+	// And the name it asked for is there, so the reach was not simply ignored.
+	public, internal := namesFor(t, aRoutedWeb(), reachSet(mcat.ReachPublic))
+	if public != "app.example.test" || internal != "" {
+		t.Fatalf("names are %q and %q, want the public one only", public, internal)
+	}
+}
+
+// A reach for a port the module does not listen on reaches nothing, and is refused where it is
+// written rather than accepted and ignored.
+func TestAReachForAPortTheModuleDoesNotListenOnIsRefused(t *testing.T) {
+	_, err := Reaches(aRoutedWeb(), []mcat.Layer{{From: "node anchor",
+		Placement: map[string]any{mcat.ReachSetting: map[string]any{"9999": mcat.ReachInternal}}}})
+	if err == nil || !strings.Contains(err.Error(), "reaches nothing") {
+		t.Fatalf("a reach naming an undeclared port was accepted: %v", err)
+	}
+}
+
+// A value that is not a reach is refused, and the refusal names the four so a reader is one edit from
+// right. "mesh" is the tempting wrong answer, because that is the filter's word for nearly the same
+// thing.
+func TestAValueThatIsNotAReachIsRefused(t *testing.T) {
+	for _, wrong := range []string{"mesh", "anywhere", "private", "true"} {
+		_, err := Reaches(aRoutedWeb(), []mcat.Layer{{From: "node anchor",
+			Placement: map[string]any{mcat.ReachSetting: map[string]any{"3000": wrong}}}})
+		if err == nil || !strings.Contains(err.Error(), "a reach is") {
+			t.Fatalf("%q was accepted as a reach: %v", wrong, err)
+		}
+	}
+}
+
+// **A port that says both reach and expose is refused.** They say the same thing in different words,
+// and accepting both would have the filter follow one while the names followed the other — the
+// disagreement ADR 0138 exists to remove, reintroduced by the migration away from the older word.
+func TestReachAndExposeForOnePortAreRefused(t *testing.T) {
+	_, err := Reaches(aRoutedWeb(), []mcat.Layer{{From: "node anchor", Placement: map[string]any{mcat.ReachSetting: map[string]any{"3000": mcat.ReachInternal}, mcat.ExposeSetting: map[string]any{"3000": mcat.FromEverywhere}}}})
+	if err == nil || !strings.Contains(err.Error(), "same thing in different") {
+		t.Fatalf("a port set both ways was accepted: %v", err)
+	}
+}
+
+// A path-level refusal carries no port: it is a rule about a name, not an endpoint, and it inherits
+// whatever that name turned out to be. Narrowing the endpoint must not silently drop it.
+func TestARuleWithNoPortIsLeftAlone(t *testing.T) {
+	m := aRoutedWeb()
+	m.ContributesMany = map[string]map[string]map[string]any{
+		"route": {"refused": {"label": "app", "path": "/internal", "deny": true}},
+	}
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m},
+		PublicDomain: "example.test", At: "anchor.internal"}
+	given, err := resolutionContributions(r, reachSet(mcat.ReachInternal), nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sawDeny bool
+	for _, c := range given["route"] {
+		if deny, _ := c.Values["deny"].(bool); deny {
+			sawDeny = true
+			// It keeps both, because it named no endpoint to be narrowed by.
+			if c.Values["name"] == nil || c.Values["internal-name"] == nil {
+				t.Fatalf("the path rule lost a name it shadows: %v", c.Values)
+			}
+		}
+	}
+	if !sawDeny {
+		t.Fatal("the path rule was dropped")
+	}
+}
diff --git a/internal/compose/resolution/reads-outside b/internal/compose/resolution/reads-outside
new file mode 100644
index 0000000..f6b2d87
--- /dev/null
+++ b/internal/compose/resolution/reads-outside
@@ -0,0 +1 @@
+These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
diff --git a/internal/compose/resolution/reads.go b/internal/compose/resolution/reads.go
new file mode 100644
index 0000000..ce313bd
--- /dev/null
+++ b/internal/compose/resolution/reads.go
@@ -0,0 +1,173 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// readsVerbs is the contract every holder of node-reads serves (novox/hq ADR 0310 §2). The bounds are the
+// build's to set and each verb's description to state (ADR 0310, Consequences); the holder states them in
+// every answer it cuts.
+func readsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "stat", Description: "Each component of one path or several, from / down: its type, owner and group " +
+			"(name and number), mode, whether it is a link and to what, and whether it is a mount point and of which " +
+			"file system. A link is not followed unless follow is \"true\". Read as the holder's own account, which " +
+			"holds no secret: a component it may not reach says so. At most 200 paths in one call.",
+			Input: schema(map[string]string{
+				"paths":  "one absolute path, or several separated by line breaks",
+				"follow": "\"true\": also say where the path leads once every link is followed",
+			}, []string{"paths"}, "follow"),
+			Replaces: []string{"stat", "ls -ld", "namei -l", "findmnt -T"}},
+		{Name: "readlink", Description: "What one link points to, as written, and where the path leads once every " +
+			"link is followed, and whether that exists.",
+			Input:    schema(map[string]string{"path": "an absolute path"}, []string{"path"}),
+			Replaces: []string{"readlink", "readlink -f", "realpath"}},
+		{Name: "list", Description: "Every entry of one directory with its type, owner, group, mode, size and, for a " +
+			"link, its target. At most 2000 entries; a longer directory is cut and says so. A place a secret is kept " +
+			"is refused by name.",
+			Input:    schema(map[string]string{"path": "an absolute path to a directory"}, []string{"path"}),
+			Replaces: []string{"ls", "ls -la"}},
+		{Name: "read", Description: "One text file, or a part of it by line: at most 256 KiB in one answer " +
+			"(64 KiB unless more is asked), cut at a line and said so. A binary file is refused; a place a secret is " +
+			"kept, or a known credential file, is refused by name; a line shaped like a secret is withheld and its " +
+			"number said. /proc and /sys are read as far as the holder's account may.",
+			Input: schema(map[string]string{
+				"path":  "an absolute path to a file",
+				"from":  "the first line to answer, counted from 1 (optional)",
+				"lines": "how many lines to answer (optional)",
+				"bytes": "the most bytes to answer, up to 262144 (optional, 65536 unless given)",
+			}, []string{"path"}),
+			Replaces: []string{"cat", "head", "tail", "less"}},
+		{Name: "search", Description: "Find a fixed string (never a pattern) in one file or under one directory: " +
+			"every matching line with its file and number. Bounded: at most 500 matches (100 unless more is asked), " +
+			"8 directories deep (4 unless more is asked), 5000 files and 4 MiB per file; links are not followed and " +
+			"binary files are skipped. A place a secret is kept is skipped and named; a matching line shaped like a " +
+			"secret is withheld. The answer says which bound it met.",
+			Input: schema(map[string]string{
+				"text":    "the fixed string to find",
+				"path":    "an absolute path to a file or a directory",
+				"depth":   "how many directories deep, up to 8 (optional)",
+				"matches": "the most matches to answer, up to 500 (optional)",
+				"case":    "\"false\": match whatever the case (optional)",
+			}, []string{"text", "path"}, "case"),
+			Replaces: []string{"grep", "grep -r", "grep -F"}},
+		{Name: "account", Description: "One account or group by name or number, as this node's account files say: " +
+			"an account's number, group, home, shell and every group it is in; a group's number and members. With " +
+			"neither, every account and group. Never a password field.",
+			Input: schema(map[string]string{
+				"name":  "an account's name or number (optional)",
+				"group": "a group's name or number (optional)",
+			}, nil),
+			Replaces: []string{"getent passwd", "getent group", "id", "groups"}},
+	}
+}
+
+// secretPlaces is every place on this node a secret is kept, as the placed manifests say (novox/hq ADR 0310
+// §5): the directory of every module's own secret, every credential file a module is given and every grant
+// directory a provider is handed its consumers' credentials in, the place a module keeps the operator-sealed
+// secrets, and every directory of the module that provides `secret` — the vault — wherever the node places it,
+// a directory declared without a path included. Sorted, each once, and a place under another dropped, so the
+// list says each refusal once.
+//
+// **Failure is loud.** A place still holding a placeholder, or not absolute, fails the composition with the
+// module named: a list that silently shrank would be a refusal the decision promises and nothing does.
+func resolutionSecretPlaces(r mcat.Resolution, with mcat.Rendering) ([]string, error) {
+	seen := map[string]bool{}
+	var problems []string
+	add := func(module, what, path string) {
+		path = strings.TrimSpace(path)
+		if path == "" {
+			return
+		}
+		if !strings.HasPrefix(path, "/") || strings.Contains(path, "${") {
+			problems = append(problems, fmt.Sprintf("%s's %s is %q, which is not a place on %s", module, what, path, r.Node))
+			return
+		}
+		path = filepath.Clean(path)
+		if path == "/" {
+			problems = append(problems, fmt.Sprintf("%s's %s is the root directory", module, what))
+			return
+		}
+		seen[path] = true
+	}
+	for _, m := range r.Modules {
+		for name, own := range m.OwnSecrets {
+			add(m.Module, "own secret "+name, own.Path)
+			if strings.HasPrefix(own.Path, "/") {
+				add(m.Module, "own secret "+name+"'s directory", filepath.Dir(own.Path))
+			}
+		}
+		for _, to := range m.SecretRequirements() {
+			for _, f := range m.SecretFiles(to) {
+				add(m.Module, "credential file for "+to, f.Path)
+			}
+		}
+		for to, where := range m.Grants {
+			add(m.Module, "grant directory for "+to, where)
+		}
+		add(m.Module, "place for the operator-sealed secrets (keeps)", m.Keeps)
+		if providesSecret(m) {
+			dirs := dirsFor(m, with)
+			for _, id := range sortedKeys(dirs) {
+				add(m.Module, "directory "+id, dirs[id])
+			}
+		}
+	}
+	if len(problems) > 0 {
+		sort.Strings(problems)
+		return nil, fmt.Errorf("the holder of %s on %s cannot be told where a secret is kept, so it would read "+
+			"one (novox/hq ADR 0310 §5): %s", mcat.ReadsSeat, r.Node, strings.Join(problems, "; "))
+	}
+	all := make([]string, 0, len(seen))
+	for p := range seen {
+		all = append(all, p)
+	}
+	sort.Strings(all)
+	var out []string
+	for _, p := range all {
+		if n := len(out); n > 0 && strings.HasPrefix(p, out[n-1]+"/") {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out, nil
+}
+
+func providesSecret(m mcat.Manifest) bool {
+	for _, p := range m.Provides {
+		if p.Name == "secret" {
+			return true
+		}
+	}
+	return false
+}
+
+// readsWords is what the holder of node-reads is given beside its own words: the node's secret places.
+func resolutionReadsWords(r mcat.Resolution, m mcat.Manifest, words map[string]string, with mcat.Rendering) (map[string]string, error) {
+	if !m.ClaimsSeat(mcat.ReadsSeat) {
+		return words, nil
+	}
+	places, err := resolutionSecretPlaces(r, with)
+	if err != nil {
+		return nil, err
+	}
+	body, err := json.Marshal(places)
+	if err != nil {
+		return nil, err
+	}
+	if words == nil {
+		words = map[string]string{}
+	}
+	if _, has := words[mcat.ReadsSecretPlaces]; has {
+		return nil, fmt.Errorf("%s gives its own %s; the node's secret places are the mesh's to say (novox/hq ADR 0310 §5)",
+			m.Module, mcat.ReadsSecretPlaces)
+	}
+	words[mcat.ReadsSecretPlaces] = string(body)
+	return words, nil
+}
diff --git a/internal/compose/resolution/reads_test.go b/internal/compose/resolution/reads_test.go
new file mode 100644
index 0000000..91a6ade
--- /dev/null
+++ b/internal/compose/resolution/reads_test.go
@@ -0,0 +1,81 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// novox/hq ADR 0310 §5: the holder is told, by the composition, where its node keeps a secret — the directory
+// of every module's own secret, every credential file and grant directory, the vault's directories and the
+// place the operator-sealed secrets are kept — and no other module is told.
+func TestTheHolderOfNodeReadsIsToldWhereItsNodeKeepsASecret(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "reads": {"broker": "own"}, "desk": {"broker": "own"}}}
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reads := aToolsModule(t, "reads", "tools/index.js")
+	reads.RunsAs, reads.SecretsOwner = "mesh-reads", "mesh-reads"
+	reads.Claims = []mcat.Claim{{Name: mcat.ReadsSeat}}
+	reads.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh-reads/broker"}}
+	desk := aToolsModule(t, "desk", "tools/index.js")
+	desk.RunsAs, desk.SecretsOwner = "desk", "desk"
+	desk.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/desk/broker"}}
+	// The vault as the catalogue declares it: its directories have no path of their own, and the node places them.
+	vault, err := placedManifest(catalogueResolved(t, "mesh-vault", mcat.Built{Name: "code", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + "mesh-vault/code/blobs/" + bundleDigest, Digest: bundleDigest}), with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := mcat.Manifest{Module: "app", Version: "1", Secrets: map[string]string{"postgres-database": "/etc/app/db.secret"},
+		OwnSecrets: mcat.OwnSecrets{"token": {Path: "/home/ops/.config/app/token"}}}
+	r := mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{reads, desk, vault, app, goRuntime}}
+	owns, err := resolutionOwnRuntimes(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var given map[string]map[string]string
+	for _, p := range owns {
+		if p["id"] == "reads."+mcat.OwnRuntimeID() {
+			if err := json.Unmarshal([]byte(p["env"].(map[string]string)[mcat.RuntimeToolEnv]), &given); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if p["id"] == "desk."+mcat.OwnRuntimeID() && strings.Contains(p["env"].(map[string]string)[mcat.RuntimeToolEnv], mcat.ReadsSecretPlaces) {
+			t.Error("a module not holding node-reads is told the node's secret places")
+		}
+	}
+	var places []string
+	if err := json.Unmarshal([]byte(given["reads"][mcat.ReadsSecretPlaces]), &places); err != nil {
+		t.Fatalf("the holder is not told its node's secret places: %v (%v)", err, given)
+	}
+	want := []string{"/etc/app/db.secret", "/home/ops/.config/app", "/var/lib/desk", "/var/lib/mesh-reads",
+		"/var/lib/mesh-vault", "/var/lib/mesh/" + mcat.RuntimeModule}
+	if strings.Join(places, " ") != strings.Join(want, " ") {
+		t.Errorf("secret places:\n got %v\nwant %v", places, want)
+	}
+}
+
+// The review of #257: a secret place the controller cannot resolve fails the composition, naming the module,
+// rather than leaving the list one place shorter.
+func TestASecretPlaceThatCannotBeResolvedFailsTheComposition(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{
+		{Module: "app", Version: "1", Keeps: "${dir:keep}/sealed"},
+	}}
+	if _, err := resolutionSecretPlaces(r, mcat.Rendering{}); err == nil || !strings.Contains(err.Error(), "app") {
+		t.Errorf("an unresolved place was dropped: %v", err)
+	}
+	r.Modules[0].Keeps = "relative/place"
+	if _, err := resolutionSecretPlaces(r, mcat.Rendering{}); err == nil {
+		t.Error("a relative place was dropped")
+	}
+}
diff --git a/internal/compose/resolution/received_on_the_bus_test.go b/internal/compose/resolution/received_on_the_bus_test.go
new file mode 100644
index 0000000..4ba108b
--- /dev/null
+++ b/internal/compose/resolution/received_on_the_bus_test.go
@@ -0,0 +1,68 @@
+package resolution
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// What a provider receives is composed once, and issued twice: as its received file, and in its
+// membership on the bus (novox/hq ADR 0167). The two are the same list, so a proxy reading the bus
+// and one reading the file serve the same routes — including the port the machine published, which
+// is the same-node fix the file already carries.
+func TestWhatAProviderReceivesIsTheSameOnTheBusAsInItsFile(t *testing.T) {
+	gitea := mcat.Manifest{
+		Module: "gitea", Version: "1",
+		Listens:     []mcat.Listening{{Port: 3000, Protocol: "tcp", From: mcat.FromMesh}},
+		Contributes: map[string]map[string]any{"route": {"label": "git", "port": 3000}},
+		Resources: []map[string]any{{
+			"id": "server", "type": "container", "name": "gitea", "ports": []any{"3000"},
+		}},
+	}
+	r, err := Resolve(shelf(gitea, routeProxy(), stepCA()),
+		[]string{"gitea", "route-proxy", "step-ca"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	composed, err := Compose(r, mcat.Rendering{Ports: map[string]map[int]int{"gitea": {3000: 20000}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	file := fileNamed(composed.Resources, "route-proxy.received-route")
+	if file == nil {
+		t.Fatal("the proxy was given no routes file")
+	}
+	var written struct {
+		Given []mcat.Contribution `json:"given"`
+	}
+	if err := json.Unmarshal([]byte(file["content"].(string)), &written); err != nil {
+		t.Fatal(err)
+	}
+	issued, said := composed.Received["route-proxy"]["route"]
+	if !said {
+		t.Fatalf("nothing is issued for the proxy to receive on the bus: %v", composed.Received)
+	}
+	// Compared as JSON, which is what both are once they leave the controller.
+	a, _ := json.Marshal(written.Given)
+	b, _ := json.Marshal(issued)
+	var fromFile, fromBus any
+	_ = json.Unmarshal(a, &fromFile)
+	_ = json.Unmarshal(b, &fromBus)
+	if !reflect.DeepEqual(fromFile, fromBus) {
+		t.Errorf("the bus and the file disagree about the routes:\nfile %s\nbus  %s", a, b)
+	}
+	if len(issued) != 1 {
+		t.Fatalf("expected one route on the bus, got %v", issued)
+	}
+	if port, ok := asPort(issued[0].Values["port"]); !ok || port != 20000 {
+		t.Errorf("the bus carries a port nothing listens on: %v", issued[0].Values["port"])
+	}
+
+	// A module that receives nothing is issued nothing to receive.
+	if _, any := composed.Received["gitea"]; any {
+		t.Errorf("a module that receives nothing was issued something: %v", composed.Received["gitea"])
+	}
+}
diff --git a/internal/compose/resolution/reflects_renamed_test.go b/internal/compose/resolution/reflects_renamed_test.go
new file mode 100644
index 0000000..556011b
--- /dev/null
+++ b/internal/compose/resolution/reflects_renamed_test.go
@@ -0,0 +1,32 @@
+package resolution
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestReflectsRenamedReadsBothShapes(t *testing.T) {
+	// The list arrives as []any when the resource was parsed from JSON, and as []string when it
+	// was composed in code — the overlay's registry trust is the second kind. A shape that was
+	// skipped would leave the reference unprefixed, pointing at nothing, and the service would
+	// never restart while every check passed (novox/hq issues 042/048, the run-8 diagnosis).
+	parsed := reflectsRenamed("mesh-wireguard", []any{"registry-trust"})
+	if !reflect.DeepEqual(parsed, []any{"mesh-wireguard.registry-trust"}) {
+		t.Fatalf("parsed shape: %v", parsed)
+	}
+	composed := reflectsRenamed("mesh-wireguard", []string{"registry-trust"})
+	if !reflect.DeepEqual(composed, []any{"mesh-wireguard.registry-trust"}) {
+		t.Fatalf("composed shape: %v", composed)
+	}
+
+	// A name already under a module keeps it: that is how a service reflects a file another
+	// module put on the machine.
+	kept := reflectsRenamed("resolver", []string{"mesh-wireguard.fact-node-names", "own-config"})
+	if !reflect.DeepEqual(kept, []any{"mesh-wireguard.fact-node-names", "resolver.own-config"}) {
+		t.Fatalf("dotted name was not kept: %v", kept)
+	}
+
+	if got := reflectsRenamed("any", nil); got != nil {
+		t.Fatalf("no list should rename to nothing, got %v", got)
+	}
+}
diff --git a/internal/compose/resolution/replay166_test.go b/internal/compose/resolution/replay166_test.go
new file mode 100644
index 0000000..874fab0
--- /dev/null
+++ b/internal/compose/resolution/replay166_test.go
@@ -0,0 +1,43 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Replay of novox/hq issue 166: every soft dependency had become a hard requirement. grafana runs without a
+// data source, yet a manifest could not say so: a mesh without influxdb could not register a grafana that
+// said its influxdb-api was optional, and with influxdb only in the catalogue, assigning grafana installed
+// influxdb for it. Written only with what the catalogue had before its fix (mesh-controller #281):
+// ParseManifest, Resolve, and the resolve tests' shelf, reachable machine and names, so it is laid over the
+// commit before.
+func TestReplay166(t *testing.T) {
+	grafana, err := decodeForTest([]byte(`{"module":"grafana","version":"1",
+		"requires":[{"name":"influxdb-api","optional":true}]}`))
+	if err != nil {
+		t.Fatalf("a manifest cannot say grafana runs without influxdb-api: %v", err)
+	}
+	catalogue := shelf(mcat.Manifest{Module: "influxdb", Version: "1", Provides: mcat.FromAnywhere("influxdb-api")}, grafana)
+	// Nothing in the mesh runs influxdb; it is only in the catalogue.
+	got, err := Resolve(catalogue, []string{"grafana"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatalf("grafana could not be assigned on a mesh without influxdb: %v", err)
+	}
+	if have := strings.Join(names(got), " "); have != "grafana" {
+		t.Fatalf("assigning grafana put %s on the machine; nothing is installed for an optional requirement", have)
+	}
+	if len(got.Needs) != 0 {
+		t.Fatalf("grafana was given a binding with nothing providing it: %+v", got.Needs)
+	}
+	// And once influxdb runs somewhere, grafana binds to it as before.
+	got, err = Resolve(catalogue, []string{"grafana"}, reachable(), mcat.World{Offered: map[string][]mcat.Provider{
+		"influxdb-api": {{Node: "anchor", At: "anchor.internal", Module: "influxdb"}}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 || got.Needs[0].From != "anchor" || got.Needs[0].For != "grafana" {
+		t.Fatalf("grafana did not bind to influxdb on anchor: %+v", got.Needs)
+	}
+}
diff --git a/internal/compose/resolution/replay279_test.go b/internal/compose/resolution/replay279_test.go
new file mode 100644
index 0000000..fb58dbf
--- /dev/null
+++ b/internal/compose/resolution/replay279_test.go
@@ -0,0 +1,40 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// Replay of novox/hq issue 279 (2026-10-06): the media managers' recycle-bin folders were declared owned by
+// a literal user and group, and on a machine whose puid and pgid settings named another account the apps
+// refused them as not writable. A directory's owner could not follow the account its module runs as. Written
+// only with what the catalogue had before its fix (mesh-controller #260): Compose, LeftOut, a setting layer,
+// and the adoption tests' anchor, so it is laid over the commit before.
+func TestReplay279(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, mcat.Manifest{Module: "sonarr",
+		Resources: []map[string]any{
+			{"id": "recycle-bin", "type": "directory", "path": "/srv/sonarr/recycle", "mode": "0755",
+				"owner": "${setting:puid}:${setting:pgid}"},
+			{"id": "identity", "type": "file", "path": "/srv/sonarr/identity.env", "mode": "0644",
+				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\n"},
+		},
+	})
+	with := anchorRendering(false)
+	with.Settings["sonarr"] = []mcat.Layer{{From: "node anchor", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatalf("the machine did not compose: %v", err)
+	}
+	if why, left := composed.LeftOut["sonarr"]; left {
+		t.Fatalf("the module was left out: %s", why)
+	}
+	got, ok := byID(composed.Resources)["sonarr.recycle-bin"]
+	if !ok {
+		t.Fatal("the recycle bin was not declared")
+	}
+	if got["owner"] != "1001:2000" {
+		t.Fatalf("the recycle bin reaches the node-engine owned by %v, not the account the module runs as (1001:2000)", got["owner"])
+	}
+}
diff --git a/internal/compose/resolution/resolve.go b/internal/compose/resolution/resolve.go
new file mode 100644
index 0000000..7a36df8
--- /dev/null
+++ b/internal/compose/resolution/resolve.go
@@ -0,0 +1,1187 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// heldKey is what one holder holds: the seat, and its kind on a kinded bench.
+func heldKey(claim, kind string) string {
+	if kind == "" {
+		return canonicalSeat(claim)
+	}
+	return canonicalSeat(claim) + "/" + kind
+}
+
+// Refusal is why a set of assignments cannot become a declaration.
+//
+// Every reason at once rather than the first, and each says what to do about it. A person
+// resolving these fixes them in one pass or in four.
+type Refusal struct{ Problems []string }
+
+func (r *Refusal) Error() string {
+	return "these assignments cannot be applied:\n  - " + strings.Join(r.Problems, "\n  - ")
+}
+
+// Resolve works out everything a node runs, from what was assigned to it.
+//
+// The catalogue is every module the mesh knows about; assigned is what a person put on this node.
+// What comes back is the closure — assigned modules plus everything they require — or a refusal
+// naming every reason it could not be closed.
+func Resolve(catalogue map[string]mcat.Manifest, assigned []string, node mcat.Node, world mcat.World) (mcat.Resolution, error) {
+	elsewhere := world.Held
+	var problems []string
+
+	// Which names are answered from elsewhere in the mesh rather than from this machine. A
+	// property of the name, not of each provider: two modules disagreeing about whether a
+	// database is local would make the same requirement mean different things depending on which
+	// one happened to answer it.
+	brokered := map[string]bool{}
+	local := map[string]bool{}
+	// And which of them keep their consumers' data (novox/hq ADR 0232) — also a property of the name.
+	keeps := map[string]bool{}
+	for _, m := range catalogue {
+		for _, o := range m.Provides {
+			if o.At() == mcat.ScopeMesh {
+				brokered[o.Name] = true
+				if m.KeepsConsumerData(o.Name) {
+					keeps[o.Name] = true
+				}
+				continue
+			}
+			local[o.Name] = true
+		}
+	}
+	// Which names are usable only on their provider's own machine (novox/hq ADR 0208 §3). Also a
+	// property of the name: a display one provider says is the machine's and another says is not
+	// would be pulled in for one consumer and refused for the next.
+	machineReach := map[string]bool{}
+	plainLocal := map[string]bool{}
+	for _, m := range catalogue {
+		for _, o := range m.Provides {
+			if o.MachineReach() {
+				machineReach[o.Name] = true
+			} else if o.At() == mcat.ScopeNode {
+				plainLocal[o.Name] = true
+			}
+		}
+	}
+	for want := range machineReach {
+		if plainLocal[want] {
+			problems = append(problems, fmt.Sprintf(
+				"the catalogue disagrees about %q: some modules provide it with the machine's reach and "+
+					"others without, so a requirement for it would be met differently by each", want))
+		}
+	}
+	for want := range brokered {
+		if local[want] {
+			problems = append(problems, fmt.Sprintf(
+				"the catalogue disagrees about %q: some modules provide it here and others from "+
+					"anywhere in the mesh, so the same requirement would mean two things", want))
+		}
+	}
+
+	// What each name can be satisfied by. Built once from the whole catalogue, because "how many
+	// modules provide this" is the question the whole rule turns on.
+	offers := map[string][]string{}
+	for _, m := range catalogue {
+		for _, o := range m.Offers() {
+			offers[o] = append(offers[o], m.Module)
+		}
+	}
+	for k := range offers {
+		sort.Strings(offers[k])
+	}
+
+	chosen := map[string]bool{}
+	because := map[string]string{}
+	var order []string
+	var needs []mcat.Needed
+
+	// What the set already offers, which is the first thing a requirement is checked against.
+	//
+	// Without this, assigning zsh does not satisfy something that requires a shell: the
+	// requirement is counted against the catalogue, three modules provide it, and the answer is
+	// still "choose one" after somebody has chosen one. That makes the remedy useless, and it is
+	// how this read when first used.
+	satisfied := map[string]bool{}
+	// Which modules a person assigned here, hostable. The walk marks a module chosen only when it
+	// reaches it, and a consumer may be reached before the provider beside it — so the provider of
+	// something already satisfied is looked for among these as well as among the chosen.
+	assignedHere := map[string]bool{}
+
+	// Everything a person assigned goes in first, except what this machine cannot run. Those are
+	// choices already made, and a requirement one of them answers is not a choice to put back to
+	// anybody.
+	//
+	// **A module the machine cannot host is left out here rather than refusing the whole set.**
+	// Assigning fail2ban to a machine whose profile reports no firewall is one module on the wrong
+	// machine (novox/hq ADR 0009's sibling case): the person meant something, the remedy is theirs,
+	// and it is a fact about this one module — not a reason the healthy modules beside it should
+	// fail to resolve and converge. It is reported as un-applied on the resolution, so it is neither
+	// silently dropped nor fatal to the rest. The distinction is who wanted it: a module *required*
+	// by something running here that cannot be hosted makes the set itself incoherent, and that is
+	// still refused, by checkCapabilities, where it stays in the closure.
+	var unhostable []mcat.Unhostable
+	var queue []string
+	for _, a := range assigned {
+		if m, known := catalogue[a]; known {
+			if missing := missingCapabilities(m, node); len(missing) > 0 {
+				unhostable = append(unhostable, mcat.Unhostable{Module: a, Missing: missing})
+				continue
+			}
+			for _, o := range m.Offers() {
+				satisfied[o] = true
+			}
+			assignedHere[a] = true
+		}
+		because[a] = "assigned"
+		queue = append(queue, a)
+	}
+
+	// What has already been complained about. A requirement can be wanted by several modules at
+	// once, and saying the same thing twice makes a person hunt for the difference between two
+	// identical lines before realising there is none.
+	reported := map[string]bool{}
+
+	// **An optional requirement is settled last** (novox/hq ADR 0330). Whether a name is optional is
+	// a question about every module that wants it, and a module pulled in later may want it hard; so
+	// a name only optional modules want so far is put aside until the walk has nothing else, and only
+	// then, if still nobody wants it hard, settled by the optional rule: bound to a provider that is
+	// already assigned or reachable, exactly as a hard one, and otherwise absent — never refused,
+	// and never answered by installing anything.
+	var deferred []string
+	settling := map[string]bool{}
+	absent := map[string]bool{}
+	wantedHard := func(want string) bool {
+		for _, name := range order {
+			if manifestWantsHard(catalogue[name], want) {
+				return true
+			}
+		}
+		return false
+	}
+	wantedOptionally := func(want string) bool {
+		for _, name := range order {
+			if catalogue[name].IsOptional(want) {
+				return true
+			}
+		}
+		return false
+	}
+	leaveAbsent := func(want string) {
+		absent[want] = true
+		reported[want] = true
+	}
+
+	for {
+		if len(queue) == 0 {
+			if len(deferred) == 0 {
+				break
+			}
+			// What a module chosen since wants hard goes back to the walk, which may install for
+			// it; only when none does is the rest settled, since settling installs nothing and so
+			// can change no other name's answer.
+			var hard, optional []string
+			for _, d := range deferred {
+				if wantedHard(d) {
+					hard = append(hard, d)
+				} else {
+					optional = append(optional, d)
+				}
+			}
+			if len(hard) > 0 {
+				queue, deferred = hard, optional
+				continue
+			}
+			for _, d := range optional {
+				settling[d] = true
+			}
+			queue, deferred = optional, nil
+		}
+		want := queue[0]
+		queue = queue[1:]
+		if chosen[want] || reported[want] {
+			continue
+		}
+		if !settling[want] && because[want] != "assigned" && !wantedHard(want) && wantedOptionally(want) {
+			deferred = append(deferred, want)
+			continue
+		}
+		// Walked as a hard requirement: a refusal names a module that wants it hard, never one that
+		// wanted it only optionally and met it first — whose remedy it is not.
+		if first, known := catalogue[because[want]]; !settling[want] && known && !manifestWantsHard(first, want) {
+			for _, name := range order {
+				if manifestWantsHard(catalogue[name], want) {
+					because[want] = name
+					break
+				}
+			}
+		}
+		// Already answered by something in the set. This is the case that makes assigning zsh do
+		// what a person meant by it.
+		//
+		// **Except when the thing answering it grants a credential** (novox/hq 04-ISSUES/021). A
+		// shell answered here needs nothing more; a database answered here still needs a
+		// password, because the consumer reaches it over TCP from its own container and the
+		// database asks exactly as it would from another machine. **The machine stops being a
+		// trust boundary the moment both ends are containers**, and treating it as one gave the
+		// commonest arrangement of all — a service and its database on one node — the weakest
+		// handling, silently.
+		if satisfied[want] && !isModule(catalogue, want) && !answeredElsewhere(want, node, world, brokered, keeps) {
+			here := func(name string) bool { return chosen[name] || assignedHere[name] }
+			local := providersHere(catalogue, here, want)
+			// Which of them it matters to choose between. A plain capability — a shell, a display
+			// server — asks nothing of whoever answers it, and three shells beside an editor are
+			// not a choice to put to anybody. One that grants a credential, or serves a fact the
+			// consumer cannot guess, becomes a binding, and a binding is to one provider.
+			matter := local
+			if !brokered[want] {
+				matter = nil
+				for _, name := range local {
+					if _, ok := catalogue[name].Serves[want]; ok {
+						matter = append(matter, name)
+					}
+				}
+			}
+			var by mcat.Manifest
+			switch len(matter) {
+			case 0:
+				// Nothing to bind to; satisfied by its presence, as it was.
+			case 1:
+				by = catalogue[matter[0]]
+			default:
+				// Two modules on this machine answer it. Taking whichever a map walk met first
+				// was the rule until novox/hq #258 — random, per plan — and the same stance as
+				// across machines applies: ambiguity is refused, never resolved by picking.
+				//
+				// **Not in the first pass.** That pass exists only to answer *what does this node
+				// offer*, and refusing there makes the machine vanish rather than report a problem
+				// (the sibling case below says why): every other node then loses what this one
+				// provides — the vault, the identity provider — and refuses for a fault that is
+				// this node's to settle. The second pass refuses it properly, where it is asked.
+				if world.Unchecked {
+					continue
+				}
+				c, pinned := world.Pinned[want]
+				if !pinned || c.Node != node.Name || !oneOf(matter, c.Module) {
+					reported[want] = true
+					problems = append(problems, fmt.Sprintf(
+						"%s provides %q %d times, wanted by %s — say which with `pin %s %s %s <module>`: %s",
+						node.Name, want, len(matter), because[want], node.Name, want, node.Name,
+						strings.Join(matter, ", ")))
+					continue
+				}
+				by = catalogue[c.Module]
+			}
+			if brokered[want] {
+				// Answered here, and still a need: the provider is this node.
+				//
+				// **The same loopback fallback as the branch below, and it was missing here.** A
+				// machine with no private network has no `at`, and this branch passed that through
+				// — so a consumer whose file says `${bound:<provision>:at}:${bound:...:port}` was
+				// handed `:5000`, a name with no host, written into its environment without
+				// complaint. The sibling case a few lines down had the fallback and the reasoning
+				// for it; only this one did not. A machine off the network still reaches itself.
+				at := node.At
+				if at == "" {
+					at = "127.0.0.1"
+				}
+				needs = append(needs, mcat.Needed{
+					Name: want, From: node.Name, At: at, Module: by.Module,
+					Serves: servedByOne(by, want), For: because[want],
+					SharedOwn: sharedByOne(by, want), CredentialForm: by.CredentialFormOf(want), CredentialTool: by.CredentialToolOf(want),
+					Identity: by.IdentityBoundOf(want)})
+			} else if served := servedByOne(by, want); len(served) > 0 {
+				// Answered here with no credential to mint, but the provider serves facts the
+				// consumer cannot guess — a port, a model name — and so still needs a binding.
+				// **The reachability rule does not apply**: both ends are on this same machine, so
+				// there is no private network to share and nothing to refuse (novox/hq ADR 0024's
+				// sibling case — a same-node keyless endpoint that the consumer still cannot invent
+				// the port for, exactly what declaration.go's here() was left to patch after the
+				// fact). Delivering it here as a need is what lets knownFor see it, so a file that
+				// says ${bound:<provision>:port} is filled rather than refused.
+				//
+				// The address is this machine's own name on the private network when it has one, and
+				// loopback when it does not — a machine off the network still reaches itself, and the
+				// consumer's binding must carry a usable `at`. The same fallback declaration.go's
+				// here() applies, done here because this need is now found before here() would run.
+				at := node.At
+				if at == "" {
+					at = "127.0.0.1"
+				}
+				needs = append(needs, mcat.Needed{
+					Name: want, From: node.Name, At: at, Serves: served, For: because[want], Module: by.Module,
+					CredentialForm: by.CredentialFormOf(want), CredentialTool: by.CredentialToolOf(want)})
+			}
+			continue
+		}
+
+		// Answered from elsewhere in the mesh, if it is that kind of name. **Never installed
+		// here.** Choosing a machine to put a database on is a decision with consequences
+		// nobody would want made silently by something resolving a web application.
+		if brokered[want] {
+			reported[want] = true
+			where := world.Offered[want]
+			if settling[want] && len(where) == 0 {
+				// Nothing assigned anywhere answers it: absent, and nothing is put on a machine
+				// for it (ADR 0330 §3), however few modules in the catalogue could.
+				leaveAbsent(want)
+				continue
+			}
+			names := providerNames(where)
+			take := func(p mcat.Provider) {
+				if node.At != "" && p.At == "" || node.At == "" && p.At != "" || node.At == "" && p.At == "" {
+					// One of them is not on the private network, so there is no path between
+					// them. Said here rather than discovered as a connection timing out on a
+					// machine that the mesh reported as configured.
+					problems = append(problems, fmt.Sprintf(
+						"%s needs %q from %s, and they are not both on the private network — "+
+							"assign %s to whichever is missing it",
+						node.Name, want, p.Node, meshNetwork))
+					return
+				}
+				shared, form, tool := "", "", ""
+				// A provider whose definition is not in hand is held to the tightest bound the
+				// mesh knows, not to none: what it keeps is not known here (ADR 0225).
+				bound := mcat.DefaultIdentityBound
+				if pm, known := catalogue[p.Module]; known {
+					shared, _ = pm.SharedCredentialOf(want)
+					form, tool = pm.CredentialFormOf(want), pm.CredentialToolOf(want)
+					bound = pm.IdentityBoundOf(want)
+				}
+				needs = append(needs, mcat.Needed{Name: want, From: p.Node, At: p.At, Module: p.Module,
+					Serves: p.Serves, For: because[want], SharedOwn: shared, CredentialForm: form, CredentialTool: tool, Identity: bound,
+					LeftOut: p.LeftOut})
+			}
+			switch {
+			case world.Unchecked:
+				// First pass. Whether anything answers this is exactly the question this pass
+				// exists to make answerable, so it is not asked here.
+			case len(where) == 0:
+				remedy := "and nothing in the catalogue could"
+				if answers := offers[want]; len(answers) == 1 {
+					remedy = "— assign " + answers[0] + " to a node"
+				} else if len(answers) > 1 {
+					remedy = "— assign one of these to a node: " + strings.Join(answers, ", ")
+				}
+				problems = append(problems, fmt.Sprintf(
+					"nothing in this mesh provides %q, wanted by %s %s",
+					want, because[want], remedy))
+			case len(where) == 1:
+				if c, pinned := world.Pinned[want]; pinned && !chosenMatches(c, where[0]) {
+					// One provider, and it is not the one this machine was told to use. Silently
+					// using the other would be the mesh overruling a choice somebody made.
+					problems = append(problems, fmt.Sprintf(
+						"%s was told to get %q from %s, and only %s provides it",
+						node.Name, want, c, nameOf(where[0])))
+					break
+				}
+				take(where[0])
+			default:
+				c, pinned := world.Pinned[want]
+				if !pinned {
+					// **The seat's holder answers, when a seat delivers this** (novox/hq ADR 0110).
+					// Not a guess, which ADR 0009 refuses: the choice was made once, mesh-wide, by
+					// assigning the holder, where a pin makes it again on every consumer's node. A
+					// pin still wins — it is a consumer coupled to one provider's contents, and has
+					// said so.
+					if holder, held := HolderAmong(want, where, world.Held); held {
+						take(holder)
+						break
+					}
+					problems = append(problems, fmt.Sprintf(
+						"%d providers of %q, wanted by %s — say which with `pin %s %s <node> <module>`: %s",
+						len(where), want, because[want], node.Name, want,
+						strings.Join(names, ", ")))
+					break
+				}
+				matching := chosenAmong(c, where)
+				switch len(matching) {
+				case 0:
+					// Pointed at a provider that does not answer this. Refused rather than
+					// falling back to another: a fallback would quietly move somebody's data to
+					// a machine they did not choose, which is the whole reason this is asked.
+					problems = append(problems, fmt.Sprintf(
+						"%s was told to get %q from %s, and %s does not provide it — these do: %s",
+						node.Name, want, c, c, strings.Join(names, ", ")))
+				case 1:
+					take(matching[0])
+				default:
+					// A record naming only the node, from before a pin named the module, and that
+					// node answers twice. This once took the last one listed (novox/hq #258): a
+					// coin flip, handed to whoever reads the certificate it chose.
+					problems = append(problems, fmt.Sprintf(
+						"%s was told to get %q from %s, and %s provides it %d times — say which with "+
+							"`pin %s %s %s <module>`: %s",
+						node.Name, want, c, c.Node, len(matching), node.Name, want, c.Node,
+						strings.Join(providerNames(matching), ", ")))
+				}
+			}
+			continue
+		}
+
+		// Usable only on its provider's own machine, and not here: refused, never answered by
+		// installing a provider (novox/hq ADR 0208 §3). The display server is the machine's own role,
+		// gated by its graphical session; one pulled in for a window manager is the misassignment
+		// research 026 found. Another node's provider never counts — node scope is never brokered.
+		if machineReach[want] && !isModule(catalogue, want) {
+			reported[want] = true
+			if settling[want] {
+				leaveAbsent(want)
+				continue
+			}
+			if world.Unchecked {
+				// The first pass's refusals take a machine off the network; the second says it.
+				continue
+			}
+			problems = append(problems, fmt.Sprintf(
+				"%q is wanted by %s and is usable only on the machine that provides it, and nothing "+
+					"assigned to %s does — %s", want, because[want], node.Name,
+				machineReachRemedy(catalogue, want, node.Name)))
+			continue
+		}
+
+		candidates := offers[want]
+		if settling[want] && !(len(candidates) == 0 && len(world.Licences[want]) > 0) {
+			// Not answered by anything in this node's set, and only installing could answer it
+			// here — which is never done for an optional requirement (ADR 0330 §3), not even
+			// for the only candidate. A licence record still answers it, in the post-pass.
+			leaveAbsent(want)
+			continue
+		}
+		switch len(candidates) {
+		case 0:
+			if len(world.Licences[want]) > 0 {
+				// Answered by a record rather than by a module, and the post-pass below settles
+				// which one. Left alone here: the two questions a refusal must answer — *is
+				// there anything* and *which one* — have different remedies, and answering the
+				// first wrongly would send somebody looking for a module to install.
+				reported[want] = true
+				continue
+			}
+			if world.Unchecked {
+				// The first pass, which exists only to answer *what does this node offer*.
+				//
+				// **Refusing here makes the machine vanish** rather than reporting a problem: the
+				// caller takes a failed resolution to mean it learned nothing about this node, so
+				// one unanswerable requirement on one machine removes that machine from the
+				// private network as far as every OTHER machine is concerned — and they are then
+				// told, wrongly, that the two of them share no network.
+				//
+				// That is a wrong answer about a machine nobody asked about, caused by a fault on
+				// a third. The second pass refuses it properly, where the question is being asked.
+				reported[want] = true
+				continue
+			}
+			reported[want] = true
+			problems = append(problems, fmt.Sprintf(
+				"nothing provides %q, wanted by %s", want, because[want]))
+			continue
+		case 1:
+			// No choice to make, so none is made. This is the case that lets `install i3` bring
+			// in xorg without anybody being asked anything.
+		default:
+			reported[want] = true
+			problems = append(problems, fmt.Sprintf(
+				"%q is wanted by %s and %d modules provide it — choose one and assign it: %s",
+				want, because[want], len(candidates), strings.Join(candidates, ", ")))
+			continue
+		}
+
+		m := catalogue[candidates[0]]
+		if chosen[m.Module] {
+			continue
+		}
+		chosen[m.Module] = true
+		order = append(order, m.Module)
+		for _, o := range m.Offers() {
+			satisfied[o] = true
+		}
+		if _, ok := because[m.Module]; !ok {
+			because[m.Module] = requiredByWords + because[want]
+		}
+
+		for _, r := range m.Wants() {
+			if _, ok := because[r]; !ok {
+				because[r] = m.Module
+			}
+			queue = append(queue, r)
+		}
+	}
+
+	// One need per module that wants it, rather than one per name (novox/hq 04-ISSUES/022).
+	//
+	// **A consumer is a module on a machine, not a machine.** The walk above is a work-list over
+	// names, so a requirement three modules share is visited once and produced one need, carrying
+	// whichever module happened to mention it first. Everything downstream inherited that: one
+	// credential, named after a node, and the other two consumers given nothing at all — a
+	// service that resolves cleanly and then cannot authenticate, which is the exact shape of
+	// 021.
+	//
+	// The record pass below already gets this right and says so. It is the same rule.
+	needs = perConsumer(needs, order, catalogue)
+
+	// **A consumer bound to its data stays bound to it** (novox/hq ADR 0232). Per consumer, after
+	// the fan-out, because a binding is a consumer's: the walk above chose one provider per name for
+	// the whole machine, and two consumers of it may have been bound at different times.
+	var kept []mcat.KeptBinding
+	if !world.Unchecked {
+		here := func(name string) bool { return chosen[name] || assignedHere[name] }
+		var stuck []string
+		needs, kept, stuck = keepBound(needs, catalogue, node, world, keeps, here)
+		problems = append(problems, stuck...)
+	}
+
+	// What is answered by a record rather than by a machine.
+	//
+	// A post-pass, deliberately: nothing about it depends on the order requirements were walked
+	// in, and putting it in the queue would mean the reachability rule — which must not apply
+	// here — sitting one branch away from a case it would be wrong for.
+	//
+	// **Refused when the consumer has not said which.** ADR 0024 warns this will be felt: a mesh
+	// holding three ways to reach a model refuses every consumer that has not chosen, which is
+	// correct and is a great deal of saying-which the first time. So the refusal names the
+	// candidates and the exact command, because being right is not the same as being usable.
+	for _, name := range order {
+		m := catalogue[name]
+		for _, want := range m.Wants() {
+			offered, byRecord := world.Licences[want]
+			if !byRecord || len(offered) == 0 {
+				continue
+			}
+			if satisfied[want] {
+				// Something in this node's own set answers it -- a model the mesh runs itself,
+				// most obviously. A record is not consulted when there is a local answer.
+				continue
+			}
+			using, said := world.Using[m.Module][want]
+			if !said {
+				if world.Unchecked {
+					continue
+				}
+				names := make([]string, 0, len(offered))
+				for _, r := range offered {
+					names = append(names, r.Name)
+				}
+				sort.Strings(names)
+				problems = append(problems, fmt.Sprintf(
+					"%s on %s needs %q and has not been told which one to use — say which with "+
+						"`licence use <name> %s %s`: %s",
+					m.Module, node.Name, want, node.Name, m.Module, strings.Join(names, ", ")))
+				continue
+			}
+			needs = append(needs, mcat.Needed{
+				Name: want, From: using.Name, Serves: using.Serves, ByRecord: true,
+				// The module that required it, not whatever first mentioned the name: the key is
+				// sealed per consumer, and a consumer here is a module on a machine.
+				For: m.Module,
+			})
+		}
+	}
+
+	resolution := mcat.Resolution{Node: node.Name, At: node.At, PublicDomain: node.PublicDomain,
+		Account: node.Account, AccountHome: node.AccountHome, AgentAccount: node.AgentAccount,
+		AgentAccountHome: node.AgentAccountHome, Capabilities: node.Capabilities,
+		Because: because, Needs: needs, Unhostable: unhostable, Kept: kept,
+		Absent: absentOf(absent, order, catalogue)}
+	for _, n := range providersFirst(order, catalogue) {
+		resolution.Modules = append(resolution.Modules, catalogue[n])
+	}
+
+	problems = append(problems, checkCapabilities(resolution.Modules, node)...)
+	claims, claimProblems := checkClaims(resolution.Modules, node, elsewhere, world.Holdings)
+	problems = append(problems, claimProblems...)
+	problems = append(problems, checkResources(resolution.Modules)...)
+	resolution.Claims = claims
+
+	// Judged over the closure — what this node will actually run — so a holder pulled in by a
+	// requirement counts, and the holders' mutual dependence resolves (novox/hq ADR 0207 §3).
+	// Reported until the switch; refused after it, though never in the first pass, whose refusals
+	// make a machine vanish from the network rather than report anything.
+	resolution.Unheld = UnheldDependencies(catalogue, node.Name, resolution.Modules, nil)
+	// Only a dependency some module in the catalogue could meet is refused: one with no possible
+	// holder has no remedy to name, and stays a report in `status` (novox/hq ADR 0207 §4, read with
+	// the assign rule above it).
+	if enforceSeatDependencies && !world.Unchecked {
+		for _, u := range resolution.Unheld {
+			if len(u.Holders) > 0 {
+				problems = append(problems, u.String())
+			}
+		}
+	}
+
+	if len(problems) > 0 {
+		sort.Strings(problems)
+		return mcat.Resolution{}, &Refusal{Problems: problems}
+	}
+	return resolution, nil
+}
+
+// isModule reports whether a name is a module in its own right rather than only something
+// modules provide.
+//
+// A requirement naming a module is not satisfied by something else providing that name: `i3`
+// requires `xorg` and means xorg, not "anything calling itself a display server".
+func isModule(catalogue map[string]mcat.Manifest, want string) bool {
+	_, ok := catalogue[want]
+	return ok
+}
+
+// missingCapabilities is the capabilities a module declares that this machine does not have.
+//
+// Only the absent ones: a capability the machine reports having is nothing to say. Empty means the
+// machine can host the module as far as its capabilities go.
+func missingCapabilities(m mcat.Manifest, node mcat.Node) []string {
+	var missing []string
+	for _, c := range append(append([]string(nil), m.Capabilities...), impliedCapabilities(m)...) {
+		if !node.Capabilities[c] {
+			missing = append(missing, c)
+		}
+	}
+	return missing
+}
+
+// WrongMachine is why a module cannot run here, said as a fact about the machine.
+//
+// Said the same whether a module was refused because something running here requires it or reported
+// as un-applied because a person assigned it directly: the reason is identical, and nothing can be
+// installed to change it.
+func WrongMachine(module, capability, node string) string {
+	return fmt.Sprintf(
+		"%s needs the capability %q and %s does not have it — this is the wrong machine, "+
+			"not a missing module", module, capability, node)
+}
+
+// checkCapabilities refuses a module the machine cannot run that something running here requires.
+//
+// A directly-assigned module the machine cannot host is left out of the closure before this runs
+// and reported as un-applied instead (see Resolve); what reaches here is a module still in the
+// closure because something requires it, and that set is genuinely incoherent — the requiring
+// module cannot have its requirement met on this machine.
+func checkCapabilities(modules []mcat.Manifest, node mcat.Node) []string {
+	var problems []string
+	for _, m := range modules {
+		for _, c := range missingCapabilities(m, node) {
+			problems = append(problems, WrongMachine(m.Module, c, node.Name))
+		}
+	}
+	return problems
+}
+
+// checkClaims refuses two modules holding one singular thing.
+//
+// Within this node's own set, and against what is already held elsewhere for the wider scopes. A
+// claim at mesh scope is the same idea as the mesh's one hub, said once instead of hard-coded.
+func checkClaims(modules []mcat.Manifest, node mcat.Node, elsewhere []mcat.Held, holdings []mcat.Held) ([]mcat.Held, []string) {
+	var problems []string
+	var held []mcat.Held
+
+	// onRecord is every recorded holder of a seat, if a handover ever named one: one for most seats,
+	// and as many as were added for a replicated one (novox/hq ADR 0223).
+	onRecord := func(claim, scope string) []mcat.Held {
+		var out []mcat.Held
+		for _, h := range holdings {
+			hs, ok := mcat.SeatNamed(h.Claim)
+			cs, cok := mcat.SeatNamed(claim)
+			if ok && cok && hs.Name == cs.Name && h.Scope == scope {
+				out = append(out, h)
+			}
+		}
+		return out
+	}
+	// recordedHere says this node's module is one of a seat's holders on record.
+	recordedHere := func(claim, scope, module string) bool {
+		for _, rec := range onRecord(claim, scope) {
+			if rec.Node == node.Name && rec.Module == module {
+				return true
+			}
+		}
+		return false
+	}
+
+	byScope := map[string]map[string]string{} // scope → claim → module
+	for _, m := range modules {
+		for _, c := range m.Claims {
+			scope := c.At()
+			// **A recorded holder settles it before any counting.** An assignment that could hold
+			// the seat but is not the one on record is eligible, and that is all: it is not a second
+			// holder, so it is not refused, and it does not hold (novox/hq ADR 0131). This is what
+			// lets the next holder stand beside the current one until the seat is handed over.
+			if recs := onRecord(c.Name, scope); len(recs) > 0 {
+				// **A seat held once is on record once** (novox/hq ADR 0223). Only a replicated seat
+				// may have several holders on record; several for any other seat is a store that
+				// disagrees with the mesh's definition of the role, and it is refused, named, rather
+				// than letting two machines answer for what the mesh has one of.
+				if s, known := mcat.SeatNamed(c.Name); known && !s.Replicated && len(recs) > 1 {
+					problems = append(problems, fmt.Sprintf(
+						"%q is on record as held by %d assignments, and it is held once per %s — "+
+							"`seat %s --to <node>/<module>` records one", c.Name, len(recs), scope, c.Name))
+					continue
+				}
+				if !recordedHere(c.Name, scope, m.Module) {
+					continue
+				}
+			}
+			if byScope[scope] == nil {
+				byScope[scope] = map[string]string{}
+			}
+			// **One seat under either of its names** (novox/hq ADR 0122): a manifest registered before
+			// a rename claims the former name, and one written after it the current — two claimants of
+			// one seat, compared by the seat they resolve to and not by how each spelled it.
+			seat := heldKey(c.Name, c.Kind)
+			if other, taken := byScope[scope][seat]; taken {
+				problems = append(problems, fmt.Sprintf(
+					"%s and %s both claim %q, and only one thing may hold it per %s",
+					other, m.Module, seat, scope))
+				continue
+			}
+			byScope[scope][seat] = m.Module
+			held = append(held, mcat.Held{Claim: c.Name, Scope: scope, Node: node.Name,
+				Module: m.Module, Site: node.Site, Kind: c.Kind})
+		}
+	}
+
+	// And against the rest of the mesh, for the scopes that reach past this machine.
+	for _, h := range held {
+		for _, e := range elsewhere {
+			if e.Node == node.Name || heldKey(e.Claim, e.Kind) != heldKey(h.Claim, h.Kind) || e.Scope != h.Scope {
+				continue
+			}
+			switch h.Scope {
+			case mcat.ScopeMesh:
+				// **A holder on record is never a second claimant** (novox/hq ADR 0223). Records are
+				// the mesh's settled answer: one for most seats, several only for a replicated seat,
+				// each added by an act. Two holders here are two records, and both hold.
+				if recordedHere(h.Claim, h.Scope, h.Module) {
+					continue
+				}
+				// Both claim and nobody is on record, or this refusal could not have happened.
+				// The remedy is the handover that records the holder (novox/hq ADR 0131,
+				// 04-ISSUES/170), so it is named here rather than left to be found.
+				problems = append(problems, fmt.Sprintf(
+					"%s on %s claims %q, which %s on %s already holds — one per mesh. Nothing is "+
+						"on record for it; `seat %s --to %s/%s` records the holder, and the other "+
+						"assignment then stands beside it, eligible and silent",
+					h.Module, node.Name, h.Claim, e.Module, e.Node, h.Claim, e.Node, e.Module))
+			case mcat.ScopeSite:
+				if node.Site != "" && node.Site == e.Site {
+					problems = append(problems, fmt.Sprintf(
+						"%s on %s claims %q, which %s on %s already holds at %s — one per site",
+						h.Module, node.Name, h.Claim, e.Module, e.Node, node.Site))
+				}
+			}
+		}
+	}
+	return held, problems
+}
+
+// canonicalSeat is the seat a claimed name refers to, by its current name: itself for a name the mesh
+// does not know (a module's own seat), its seat's name for a former one.
+func canonicalSeat(name string) string {
+	if s, known := mcat.SeatNamed(name); known {
+		return s.Name
+	}
+	return name
+}
+
+// checkResources refuses two modules writing the same thing.
+//
+// This costs no manifest field: the mesh already holds every resource of every module, so two
+// declaring one path or one unit are visible without either having to know about the other. A
+// declared claim is only for the abstract conflicts nothing in the resources reveals.
+//
+// **The refusal is about ownership, not use** (novox/hq ADR 0051, 04-ISSUES/036). Two modules
+// owning one path is the fault this catches — the class of collision this repository keeps
+// recording. Two modules *accessing* one operator-owned path is not a collision: it is the whole
+// point of a media stack, where the library server, the managers and the download client must see
+// the same directories. An access is not a resource and never enters the owner map, so co-access
+// resolves with no refusal. What is refused is the contradiction — a path one module owns and
+// another merely accesses — because shared data is the operator's and nobody's to own.
+func checkResources(modules []mcat.Manifest) []string {
+	// Judged as the machine composes them: where the node-resolver holder writes the resolver file, the
+	// uplink holder's rendering of it is not composed, so it is not a second owner (novox/hq ADR 0247).
+	modules = steppedBack(modules)
+	// And only a claimant of a seat naming a path declares it — the controller's generated resources
+	// included, which are judged here at composition (novox/hq ADR 0287).
+	problems := seatPathsOnMachine(modules)
+	owner := map[string]string{}
+	ownedPath := map[string]string{} // path → owning module, for the access check below
+	packagePresent, packageAbsent := map[string][]string{}, map[string][]string{}
+
+	for _, m := range modules {
+		// Compared placed, not as written (novox/hq ADR 0112): ${dir:state} is the same six
+		// characters in every module and a different directory in each — two modules' templates
+		// being spelled alike is not two modules owning one path. The default root serves the
+		// comparison: a collision is within one node, and any one root keeps distinct modules'
+		// places distinct. A reference that cannot be placed is left as written — naming what
+		// does not exist is the manifest's own problem, refused where it was made.
+		dirs := dirsFor(m, mcat.Rendering{})
+		for _, r := range m.Resources {
+			if fmt.Sprint(r["type"]) == "user" {
+				// **An account is shared; what it is set to is not.** Several modules may need one
+				// login: the shell's module sets its shell, the container runtime's puts it in the
+				// `docker` group. The host only ever adds groups, and takes back only a group it put the
+				// account in, when no declared resource still asks for it (novox/hq ADR 0252) — so groups
+				// from several modules cannot contradict each other and are not owned. A shell or a home
+				// is one value, and two modules setting it would each be undone by the other's
+				// apply: each stays one module's per node, and two are refused naming both.
+				name, _ := r["name"].(string)
+				for _, field := range []string{"shell", "home"} {
+					if v, ok := r[field].(string); !ok || v == "" || name == "" {
+						continue
+					}
+					key := "user " + field + " " + name
+					if other, taken := owner[key]; taken && other != m.Module {
+						problems = append(problems, fmt.Sprintf(
+							"%s and %s both set the %s of the user %q", other, m.Module, field, name))
+					}
+					owner[key] = m.Module
+				}
+				continue
+			}
+			if fmt.Sprint(r["type"]) == "package" {
+				// **A package may be declared by several modules** (novox/hq ADR 0303): declaring it says
+				// it is needed, and the host installs a missing one, never removes one a declaration
+				// stopped naming, so a second declaration changes nothing on the machine. What two
+				// modules can contradict is presence: one declaring it present and another absent
+				// (ADR 0180) would have the host install and remove it in turn, so that pair is refused.
+				if name, _ := r["package"].(string); name != "" {
+					if r["absent"] == true {
+						packageAbsent[name] = append(packageAbsent[name], m.Module)
+					} else {
+						packagePresent[name] = append(packagePresent[name], m.Module)
+					}
+				}
+				continue
+			}
+			for _, field := range []string{"path", "unit", "name"} {
+				value, ok := r[field].(string)
+				if !ok || value == "" {
+					if field == "path" && fmt.Sprint(r["type"]) == "directory" {
+						// A pathless directory owns its placed path — a module stating that
+						// very path is exactly the collision this exists to catch.
+						value = dirs[fmt.Sprint(r["id"])]
+					}
+					if value == "" {
+						continue
+					}
+				}
+				if field == "path" {
+					if placed, err := dirFill(value, dirs, m.Module); err == nil {
+						value = placed
+					}
+				}
+				key := field + " " + value
+				if other, taken := owner[key]; taken && other != m.Module {
+					problems = append(problems, fmt.Sprintf(
+						"%s and %s both declare the %s %q", other, m.Module, field, value))
+				}
+				owner[key] = m.Module
+				if field == "path" {
+					ownedPath[value] = m.Module
+				}
+			}
+		}
+		// **A file the mesh renders for a module is that module's path too** (novox/hq ADR 0223). The
+		// machine's resolver file is a fact the uplink's holder asks for, and a second module asking
+		// for it, or declaring it, would have the host write one path twice in every apply, the last
+		// one winning. A fact under the operator's home is placed per account and compared nowhere.
+		for _, name := range sortedFacts(m.Facts) {
+			fact := m.Facts[name]
+			if fact.Home || !strings.HasPrefix(fact.Path, "/") {
+				continue
+			}
+			key := "path " + fact.Path
+			if other, taken := owner[key]; taken && other != m.Module {
+				problems = append(problems, fmt.Sprintf(
+					"%s and %s both declare the path %q", other, m.Module, fact.Path))
+			}
+			owner[key] = m.Module
+			ownedPath[fact.Path] = m.Module
+		}
+	}
+	for _, name := range packageNames(packageAbsent) {
+		if wanted := packagePresent[name]; len(wanted) > 0 {
+			problems = append(problems, fmt.Sprintf("%s declares the package %q absent and %s declare it present (novox/hq ADR 0303)",
+				strings.Join(packageAbsent[name], ", "), name, strings.Join(wanted, ", ")))
+		}
+	}
+
+	// An accessed path is the operator's, so no module may declare it as one of its own
+	// (novox/hq ADR 0051). Refused here rather than silently tolerated: an owner would create and
+	// chown the very directory another module was told to expect the operator to provide, and the
+	// two intentions cannot both hold. Two modules *accessing* it, by contrast, is never checked,
+	// which is what lets the stack in 04-ISSUES/036 co-resolve.
+	for _, m := range modules {
+		for _, a := range m.Accesses {
+			if a.Path == "" {
+				continue // placed by the assignment; nothing to compare at registration
+			}
+			switch other := ownedPath[a.Path]; other {
+			case "":
+				// Nobody owns it — the ordinary, correct case for shared data.
+			case m.Module:
+				problems = append(problems, fmt.Sprintf(
+					"%s both owns and accesses %q — it is one or the other", m.Module, a.Path))
+			default:
+				problems = append(problems, fmt.Sprintf(
+					"%s accesses %q, which %s declares it owns — shared data is the operator's, "+
+						"owned by no module (novox/hq ADR 0051)", m.Module, a.Path, other))
+			}
+		}
+	}
+	return problems
+}
+
+// meshNetwork is what to assign to a machine that needs to reach another one.
+//
+// A string here rather than an import, because the private network is a module the control plane
+// ships and this package must not depend on the thing it resolves. The name being wrong would
+// show up as a refusal naming a module nobody can assign, which a test checks
+// (provided_test.go). The private network's own module since novox/hq ADR 0226 retired the
+// `networking` bundle that required it.
+const meshNetwork = "mesh-wireguard"
+
+// providersFirst orders a node's modules so that what answers a requirement comes before what
+// asked for it.
+//
+// **The host does not sort** (novox/hq ADR 0005), so the order written here is the order a machine
+// applies. Selection walks outward from what was assigned, which puts a consumer before the thing
+// it pulled in — and a module whose service reads a file another module writes then starts before
+// the file exists.
+//
+// It fails, and the next reconcile fixes it. That is the worst shape a fault can take: what gets
+// remembered is that it works, and nobody looks again
+// ([04-ISSUES/013](novox/hq)). This is the same fault one level up from where that was found.
+//
+// **Stable where nothing requires anything.** Modules with no relation keep the order selection
+// gave them, because that order is meaningful — assigned first, then what they pulled in — and a
+// sort that reshuffled unrelated modules would make every declaration's diff unreadable.
+func providersFirst(order []string, shelf map[string]mcat.Manifest) []string {
+	// Who offers what, among the modules actually chosen.
+	offeredBy := map[string]string{}
+	for _, name := range order {
+		for _, offered := range shelf[name].Offers() {
+			if _, taken := offeredBy[offered]; !taken {
+				offeredBy[offered] = name
+			}
+		}
+	}
+
+	needs := map[string][]string{}
+	for _, name := range order {
+		for _, want := range shelf[name].Wants() {
+			provider, known := offeredBy[want]
+			if !known || provider == name {
+				continue
+			}
+			needs[name] = append(needs[name], provider)
+		}
+	}
+
+	var out []string
+	placed := map[string]bool{}
+	var place func(string, map[string]bool)
+	place = func(name string, visiting map[string]bool) {
+		if placed[name] {
+			return
+		}
+		if visiting[name] {
+			// Two modules requiring each other. Left in the order selection gave them rather
+			// than refused: a cycle here is not a machine that cannot work — both are applied,
+			// and one of them starts before the other is ready and settles on the next pass.
+			// Refusing would make a pair of modules that cooperate impossible to assign.
+			return
+		}
+		visiting[name] = true
+		for _, provider := range needs[name] {
+			place(provider, visiting)
+		}
+		delete(visiting, name)
+		placed[name] = true
+		out = append(out, name)
+	}
+	for _, name := range order {
+		place(name, map[string]bool{})
+	}
+	return out
+}
+
+// perConsumer turns one need per provision into one need per module that wants it.
+//
+// Order follows the resolved modules rather than a map, so the same set always produces the same
+// needs — a declaration whose contents move for no reason makes every push look like a change.
+//
+// A need nothing in the set wants is kept as it is rather than dropped. That should not happen;
+// if it does, the honest outcome is an extra credential nobody reads, not a consumer silently
+// losing the one it depends on.
+func perConsumer(needs []mcat.Needed, order []string, catalogue map[string]mcat.Manifest) []mcat.Needed {
+	out := make([]mcat.Needed, 0, len(needs))
+	// Once per (provision, consumer, local name, provider). The walk over names visits a
+	// same-node provision once per module that mentions it, so two consumers of one produced two
+	// raw needs and, fanned out below, four — the same credential twice for each. Harmless
+	// downstream, since a pair is one row however often it is asked for, and wrong all the same.
+	seen := map[[4]string]bool{}
+	keep := func(n mcat.Needed) {
+		key := [4]string{n.Name, n.For, n.Local, n.From}
+		if seen[key] {
+			return
+		}
+		seen[key] = true
+		out = append(out, n)
+	}
+	for _, n := range needs {
+		var wanted bool
+		for _, name := range order {
+			m, known := catalogue[name]
+			if !known {
+				continue
+			}
+			for _, want := range m.Wants() {
+				if want != n.Name {
+					continue
+				}
+				copied := n
+				copied.For = m.Module
+				// And once per file THIS module keeps the credential in, where it keeps several
+				// (ADR 0094) — here, where the consumer is finally known, not on the walk above.
+				for _, one := range eachLocal(nil, catalogue, copied) {
+					keep(one)
+				}
+				wanted = true
+				break
+			}
+		}
+		if !wanted {
+			keep(n)
+		}
+	}
+	return out
+}
+
+// eachLocal appends the need once per file the wanting module keeps the credential in: once, with
+// no local name, in the ordinary case; once per local name where the module wants several values
+// from one provider (ADR 0094). Each is its own pair credential downstream.
+func eachLocal(needs []mcat.Needed, catalogue map[string]mcat.Manifest, n mcat.Needed) []mcat.Needed {
+	files := catalogue[n.For].SecretFiles(n.Name)
+	// One file under a local name is still a local name: the review found a module keeping ONE
+	// named secret given a need with no local, and so no file, while everything reported success.
+	if len(files) == 0 || (len(files) == 1 && files[0].Local == "") {
+		return append(needs, n)
+	}
+	for _, f := range files {
+		one := n
+		one.Local = f.Local
+		needs = append(needs, one)
+	}
+	return needs
+}
+
+// machineReachRemedy names what would meet a requirement with the machine's reach: every module in
+// the catalogue that provides it, each with the node seats it holds — for a display, the holders of
+// node-display-server (novox/hq ADR 0208 §3), named by the seat because that is the role being
+// asked for, without this code knowing which seat any provision belongs to.
+func machineReachRemedy(catalogue map[string]mcat.Manifest, want, node string) string {
+	var named []string
+	for _, name := range sortedKeys(catalogue) {
+		m := catalogue[name]
+		provides := false
+		for _, o := range m.Provides {
+			if o.Name == want {
+				provides = true
+			}
+		}
+		if !provides {
+			continue
+		}
+		var held []string
+		for _, c := range m.Claims {
+			if c.At() == mcat.ScopeNode {
+				held = append(held, c.Name)
+			}
+		}
+		if len(held) > 0 {
+			named = append(named, fmt.Sprintf("%s (holds %s)", name, strings.Join(held, ", ")))
+		} else {
+			named = append(named, name)
+		}
+	}
+	if len(named) == 0 {
+		return "and nothing in the catalogue provides it"
+	}
+	return fmt.Sprintf("assign one to %s: %s", node, strings.Join(named, "; "))
+}
+
+// answeredElsewhere says that a mesh-wide provision this machine could answer itself is answered by
+// another machine all the same: one this machine was pinned to, or the holder of the mesh seat that
+// delivers it (novox/hq ADR 0110, ADR 0194).
+//
+// **A provider on the machine was taken before either was asked.** The branch for a provision
+// answered here bound the consumer to the local provider and consulted a pin only between two local
+// ones, and the seat's holder never; both were read only for a provider on another machine. So when
+// every machine ran a provider of `wildcard-resolution` — each machine's own resolver, still assigned
+// while the mesh moved to one — every machine bound its resolver configuration to itself, with the
+// mesh's one resolver recorded, held and pinned (novox/hq issue 258). The seat is the mesh's choice of
+// who answers, made once; a provider that merely runs here does not overrule it, and neither does it
+// overrule a pin somebody set on this machine.
+//
+// Not in the first pass, which asks only what this machine offers and has no providers to read.
+//
+// **And never by the seat alone for a provision that keeps its consumers' data** (novox/hq ADR
+// 0232). The rule above was written for the mesh's resolver, which any provider answers alike. Read
+// for the store's seat, it re-bound every database consumer on a machine running its own store to
+// the seat's holder on another machine, which made each of them a fresh, empty database there and
+// left their data behind (novox/hq issue 273). A provider beside a consumer of its data is where that
+// data is; only a pin — a person — answers it from elsewhere.
+func answeredElsewhere(want string, node mcat.Node, world mcat.World, brokered, keeps map[string]bool) bool {
+	if world.Unchecked || !brokered[want] {
+		return false
+	}
+	if c, pinned := world.Pinned[want]; pinned {
+		return c.Node != node.Name
+	}
+	if keeps[want] {
+		return false
+	}
+	// **A machine holding the seat answers itself** (novox/hq ADR 0223). With a replicated seat
+	// another machine holds it too, and the first holder in the providers' order may be that one; a
+	// holder is still where this machine's own requirement is answered, so its resolver file lists
+	// itself first.
+	if seat, delivered := mcat.SeatDelivering(want); delivered {
+		for _, h := range append(append([]mcat.Held(nil), world.Holdings...), world.Held...) {
+			if hs, ok := mcat.SeatNamed(h.Claim); ok && hs.Name == seat.Name && h.Scope == seat.Scope &&
+				h.Node == node.Name {
+				return false
+			}
+		}
+	}
+	holder, held := HolderAmong(want, world.Offered[want], world.Held)
+	return held && holder.Node != node.Name
+}
+
+// packageNames are the packages a map names, in order.
+func packageNames(m map[string][]string) []string {
+	names := make([]string, 0, len(m))
+	for n := range m {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	return names
+}
+
+// impliedCapabilities are the capabilities a module needs for what its resources say, beyond those it declares: a
+// container that names groups needs an engine that reads them, so the module is left out of a machine whose report
+// lacks the capability, naming it, and the field is sent to no engine that would refuse it. None for a module whose
+// containers name no groups.
+func impliedCapabilities(m mcat.Manifest) []string {
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "container" && len(groupsOf(r)) > 0 {
+			return []string{mcat.ContainerGroups}
+		}
+	}
+	return nil
+}
diff --git a/internal/compose/resolution/resolve_loopback_test.go b/internal/compose/resolution/resolve_loopback_test.go
new file mode 100644
index 0000000..e5c7554
--- /dev/null
+++ b/internal/compose/resolution/resolve_loopback_test.go
@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A MESH-SCOPED provider on the consumer's own node must deliver a usable address too.
+//
+// The sibling case — a node-scoped provider minting no credential — has had this fallback and a
+// test for it for some time. This branch did not, and the difference is invisible until something
+// puts the address into a string: the mesh's own artifact store is mesh-scoped and lives on the
+// same machine as the builder that pushes to it, so the builder's environment was written as
+// `MESH_REGISTRY=:5000`. Nothing refused it. The runtime did, several steps later, with
+// `":5000/mesh-tools/build" is not a valid repository/tag` — a message about a tag, for a fault in
+// how a binding was resolved.
+//
+// A machine off the private network still reaches itself.
+func TestAMeshScopedProviderOnThisNodeStillCarriesAnAddress(t *testing.T) {
+	provider := mcat.Manifest{Module: "registry",
+		Provides: []mcat.Offer{{Name: "artifact-store", Scope: mcat.ScopeMesh}},
+		Serves: map[string]map[string]any{
+			"artifact-store": {"port": 5000}}}
+	consumer := mcat.Manifest{Module: "builder", Requires: []string{"artifact-store"}}
+
+	// No `At`: a mesh with no private network raised, which is every mesh before somebody places
+	// its nodes on one — including the moment just after it is installed.
+	got, err := Resolve(
+		map[string]mcat.Manifest{"registry": provider, "builder": consumer},
+		[]string{"builder", "registry"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatalf("a mesh-scoped provision answered on this very node was refused: %v", err)
+	}
+
+	var found *mcat.Needed
+	for i := range got.Needs {
+		if got.Needs[i].Name == "artifact-store" && got.Needs[i].For == "builder" {
+			found = &got.Needs[i]
+		}
+	}
+	if found == nil {
+		t.Fatalf("the store was not delivered to the builder at all: %+v", got.Needs)
+	}
+	if found.At == "" {
+		t.Fatalf("the binding carries no address, so anything composing a host from it gets none: %+v", found)
+	}
+	if found.At != "127.0.0.1" {
+		t.Fatalf("off the private network the address must fall back to loopback, got %q", found.At)
+	}
+	if got, want := plainly(found.Serves["port"]), "5000"; got != want {
+		t.Fatalf("the port was not delivered: got %q want %q", got, want)
+	}
+}
diff --git a/internal/compose/resolution/resolve_test.go b/internal/compose/resolution/resolve_test.go
new file mode 100644
index 0000000..d6f0d4b
--- /dev/null
+++ b/internal/compose/resolution/resolve_test.go
@@ -0,0 +1,484 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func mod(name string, provides, requires, capabilities []string, claims ...mcat.Claim) mcat.Manifest {
+	return mcat.Manifest{Module: name, Provides: mcat.Offers(provides...), Requires: requires,
+		Capabilities: capabilities, Claims: claims}
+}
+
+func shelf(ms ...mcat.Manifest) map[string]mcat.Manifest {
+	out := map[string]mcat.Manifest{}
+	for _, m := range ms {
+		out[m.Module] = m
+	}
+	return out
+}
+
+func workstation() mcat.Node {
+	return mcat.Node{Name: "workstation", Site: "house",
+		Capabilities: map[string]bool{"seat": true, "container-runtime": true}}
+}
+
+func names(r mcat.Resolution) []string {
+	var out []string
+	for _, m := range r.Modules {
+		out = append(out, m.Module)
+	}
+	return out
+}
+
+func TestARequirementWithOneAnswerIsTakenSilently(t *testing.T) {
+	// `install i3` should bring in xorg without asking anybody anything, because there was no
+	// choice to make. This is what keeps the refusing rule from being tiresome.
+	got, err := Resolve(shelf(
+		mod("i3", nil, []string{"xorg"}, []string{"seat"}),
+		mod("xorg", []string{"display-server"}, nil, []string{"seat"}, mcat.Claim{Name: "the-seat"}),
+	), []string{"i3"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Modules) != 2 {
+		t.Fatalf("resolved %v; i3 should have brought xorg with it", names(got))
+	}
+	if got.Because["xorg"] == "assigned" {
+		t.Error("xorg is recorded as assigned; it was required")
+	}
+}
+
+func TestARequirementWithSeveralAnswersIsRefusedAndNamed(t *testing.T) {
+	// The mesh does not pick. A default would be a choice made for somebody who finds out later,
+	// and naming the candidates is the whole remedy.
+	_, err := Resolve(shelf(
+		mod("editor", nil, []string{"shell"}, nil),
+		mod("bash", []string{"shell"}, nil, nil),
+		mod("zsh", []string{"shell"}, nil, nil),
+		mod("fish", []string{"shell"}, nil, nil),
+	), []string{"editor"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("a requirement with three answers was resolved without asking")
+	}
+	for _, want := range []string{"bash", "fish", "zsh", "choose one"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not mention %q: %v", want, err)
+		}
+	}
+}
+
+func TestARequirementWithNoAnswerIsRefused(t *testing.T) {
+	_, err := Resolve(shelf(mod("i3", nil, []string{"xorg"}, nil)), []string{"i3"}, workstation(), mcat.World{})
+
+	if err == nil || !strings.Contains(err.Error(), "nothing provides") {
+		t.Fatalf("a requirement nothing satisfies gave %v", err)
+	}
+}
+
+func TestSeveralModulesMayProvideTheSameThingAndCoexist(t *testing.T) {
+	// Shells. Nothing is claimed, so any number may be assigned — which is the case that made
+	// "flavor" look necessary and turns out to need nothing at all.
+	got, err := Resolve(shelf(
+		mod("bash", []string{"shell"}, nil, nil),
+		mod("zsh", []string{"shell"}, nil, nil),
+		mod("fish", []string{"shell"}, nil, nil),
+	), []string{"bash", "zsh", "fish"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatalf("three shells could not coexist: %v", err)
+	}
+	if len(got.Modules) != 3 {
+		t.Errorf("resolved %v", names(got))
+	}
+}
+
+func TestTwoModulesClaimingOneThingAreRefused(t *testing.T) {
+	// xorg and wayland. Neither knows the other exists — the refusal comes from both claiming
+	// the seat, which is what lets a third display server be added without editing either.
+	_, err := Resolve(shelf(
+		mod("xorg", []string{"display-server"}, nil, nil, mcat.Claim{Name: "the-seat"}),
+		mod("wayland", []string{"display-server"}, nil, nil, mcat.Claim{Name: "the-seat"}),
+	), []string{"xorg", "wayland"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("two modules claiming the seat were both assigned")
+	}
+	if !strings.Contains(err.Error(), "the-seat") || !strings.Contains(err.Error(), "per node") {
+		t.Errorf("the refusal does not say what was claimed or how widely: %v", err)
+	}
+}
+
+func TestAThirdModuleNeedsNoChangeToTheOthers(t *testing.T) {
+	// The property claims exist for. A third display server says what it claims and nothing else
+	// in the catalogue is touched — where pairwise exclusion would need xorg and wayland edited
+	// to know about it, and the edits would grow as the square of the count.
+	catalogue := shelf(
+		mod("xorg", []string{"display-server"}, nil, nil, mcat.Claim{Name: "the-seat"}),
+		mod("wayland", []string{"display-server"}, nil, nil, mcat.Claim{Name: "the-seat"}),
+		mod("mir", []string{"display-server"}, nil, nil, mcat.Claim{Name: "the-seat"}),
+	)
+	for _, pair := range [][]string{{"xorg", "mir"}, {"wayland", "mir"}} {
+		if _, err := Resolve(catalogue, pair, workstation(), mcat.World{}); err == nil {
+			t.Errorf("%v were both assigned", pair)
+		}
+	}
+	if _, err := Resolve(catalogue, []string{"mir"}, workstation(), mcat.World{}); err != nil {
+		t.Errorf("the newcomer alone was refused: %v", err)
+	}
+}
+
+func TestADirectlyAssignedModuleTheMachineCannotHostIsReportedNotRefused(t *testing.T) {
+	// A person put a display server on a seatless machine. The remedy differs from a missing module
+	// and the message has to say which — nothing can be installed to give a server a seat. But it is
+	// one module on the wrong machine, not a reason the whole node fails to resolve: it is kept out
+	// of what the node runs and reported as un-applied, so the healthy modules beside it still
+	// converge.
+	server := mcat.Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
+	got, err := Resolve(shelf(mod("xorg", nil, nil, []string{"seat"}, mcat.Claim{Name: "the-seat"})), []string{"xorg"}, server, mcat.World{})
+
+	if err != nil {
+		t.Fatalf("one un-hostable assignment refused the whole node: %v", err)
+	}
+	if len(got.Modules) != 0 {
+		t.Errorf("xorg was declared on a machine that cannot run it: %v", names(got))
+	}
+	if len(got.Unhostable) != 1 || got.Unhostable[0].Module != "xorg" {
+		t.Fatalf("xorg was not reported as un-applied: %+v", got.Unhostable)
+	}
+	if len(got.Unhostable[0].Missing) != 1 || got.Unhostable[0].Missing[0] != "seat" {
+		t.Errorf("the missing capability was not named: %+v", got.Unhostable[0])
+	}
+	if !strings.Contains(WrongMachine("xorg", "seat", "server"), "wrong machine") {
+		t.Errorf("the report reads like a missing module")
+	}
+}
+
+func TestAnUnhostableModuleSomethingRequiresRefusesTheNode(t *testing.T) {
+	// The other side of the distinction. A module the machine cannot host that is *required* by
+	// something running here makes the set incoherent: the requiring module cannot have its
+	// requirement met on this machine, so it is refused rather than quietly declared without it.
+	server := mcat.Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
+	_, err := Resolve(shelf(
+		mod("desktop", nil, []string{"display-server"}, nil),
+		mod("xorg", []string{"display-server"}, nil, []string{"seat"}),
+	), []string{"desktop"}, server, mcat.World{})
+
+	if err == nil {
+		t.Fatal("a node requiring a module the machine cannot host was resolved")
+	}
+	if !strings.Contains(err.Error(), "wrong machine") {
+		t.Errorf("the refusal reads like a missing module: %v", err)
+	}
+}
+
+func TestOneUnhostableAssignmentDoesNotTakeDownTheHealthyModules(t *testing.T) {
+	// The bug the whole-mesh dry-run found: fail2ban declares a capability the host lacks, and its
+	// one un-hostable assignment refused the entire node's resolution — so a push refused to send
+	// the healthy modules beside it too. The healthy modules must still resolve and converge; the
+	// un-hostable one is reported as un-applied, neither silently dropped nor fatal to the rest.
+	server := mcat.Node{Name: "server", Capabilities: map[string]bool{"container-runtime": true}}
+	got, err := Resolve(shelf(
+		mod("web", nil, nil, nil),
+		mod("cache", nil, nil, nil),
+		mod("cron", nil, nil, nil),
+		// The one on the wrong machine: it needs a firewall the machine's profile does not report.
+		mod("fail2ban", nil, nil, []string{"firewall"}),
+	), []string{"web", "cache", "cron", "fail2ban"}, server, mcat.World{})
+
+	if err != nil {
+		t.Fatalf("one un-hostable assignment refused the whole node: %v", err)
+	}
+	// The healthy three resolved.
+	if got := names(got); len(got) != 3 {
+		t.Fatalf("the healthy modules did not all resolve: %v", got)
+	}
+	for _, m := range got.Modules {
+		if m.Module == "fail2ban" {
+			t.Error("fail2ban was declared on a machine that cannot run it")
+		}
+	}
+	// The un-hostable one is reported, not silently dropped.
+	if len(got.Unhostable) != 1 || got.Unhostable[0].Module != "fail2ban" {
+		t.Fatalf("fail2ban was not reported as un-applied: %+v", got.Unhostable)
+	}
+	if len(got.Unhostable[0].Missing) != 1 || got.Unhostable[0].Missing[0] != "firewall" {
+		t.Errorf("the missing capability was not named: %+v", got.Unhostable[0])
+	}
+}
+
+func TestAMeshWideClaimIsHeldByOneNode(t *testing.T) {
+	// The hub, said as a claim rather than hard-coded. Another node already holds it, so this one
+	// cannot.
+	_, err := Resolve(shelf(mod("hub", nil, nil, nil, mcat.Claim{Name: "the-hub", Scope: mcat.ScopeMesh})),
+		[]string{"hub"}, workstation(), mcat.World{Held: []mcat.Held{{Claim: "the-hub", Scope: mcat.ScopeMesh, Node: "anchor", Module: "hub"}}})
+	if err == nil {
+		t.Fatal("two nodes both hold a mesh-wide claim")
+	}
+	if !strings.Contains(err.Error(), "anchor") || !strings.Contains(err.Error(), "one per mesh") {
+		t.Errorf("the refusal does not say who holds it: %v", err)
+	}
+}
+
+func TestAFoundationModuleCannotBeRaisedOnASecondNode(t *testing.T) {
+	// novox/hq 04-ISSUES/056. The store and broker are adopted in place on the control-node; each
+	// foundation module claims a mesh-scoped seat named after its server — the same mechanism that
+	// keeps one controller — so a second `assign` to another node is refused rather than silently
+	// raising a second postgres or broker that holds none of the first's data.
+	for _, tc := range []struct{ module, seat string }{
+		{"postgres", "mesh-store"},
+		{"lavinmq", "mesh-broker"},
+		{"mesh-controller", "mesh-controller"},
+	} {
+		_, err := Resolve(
+			shelf(mod(tc.module, nil, nil, nil, mcat.Claim{Name: tc.seat, Scope: mcat.ScopeMesh})),
+			[]string{tc.module}, workstation(), mcat.World{Held: []mcat.Held{{Claim: tc.seat, Scope: mcat.ScopeMesh, Node: "anchor", Module: tc.module}}})
+		if err == nil {
+			t.Fatalf("%s was raised on a second node though %s is a mesh-wide seat", tc.module, tc.seat)
+		}
+		if !strings.Contains(err.Error(), "one per mesh") {
+			t.Errorf("%s: the refusal does not say it is one per mesh: %v", tc.module, err)
+		}
+	}
+}
+
+func TestASiteClaimOnlyCollidesWithinThatSite(t *testing.T) {
+	// A DHCP server per segment. Two of them is a fault at one site and perfectly ordinary
+	// across two, and treating site as mesh would forbid the ordinary case.
+	catalogue := shelf(mod("dhcp", nil, nil, nil, mcat.Claim{Name: "dhcp", Scope: mcat.ScopeSite}))
+
+	elsewhere := []mcat.Held{{Claim: "dhcp", Scope: mcat.ScopeSite, Node: "other", Module: "dhcp", Site: "house"}}
+	if _, err := Resolve(catalogue, []string{"dhcp"}, workstation(), mcat.World{Held: elsewhere}); err == nil {
+		t.Error("two DHCP servers at one site were allowed")
+	}
+
+	faraway := []mcat.Held{{Claim: "dhcp", Scope: mcat.ScopeSite, Node: "other", Module: "dhcp", Site: "office"}}
+	if _, err := Resolve(catalogue, []string{"dhcp"}, workstation(), mcat.World{Held: faraway}); err != nil {
+		t.Errorf("a DHCP server at another site was treated as a collision: %v", err)
+	}
+}
+
+func TestTwoModulesWritingOneFileAreRefusedWithoutAnyClaim(t *testing.T) {
+	// This conflict costs no manifest field: the mesh already holds every resource of every
+	// module, so two declaring one path are visible without either knowing the other exists.
+	a := mod("a", nil, nil, nil)
+	a.Resources = []map[string]any{{"id": "conf", "type": "file", "path": "/etc/thing.conf"}}
+	b := mod("b", nil, nil, nil)
+	b.Resources = []map[string]any{{"id": "conf", "type": "file", "path": "/etc/thing.conf"}}
+
+	_, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), mcat.World{})
+	if err == nil {
+		t.Fatal("two modules writing the same file were both assigned")
+	}
+	if !strings.Contains(err.Error(), "/etc/thing.conf") {
+		t.Errorf("the refusal does not name the file: %v", err)
+	}
+}
+
+func TestResourceIdentitiesCarryTheirModule(t *testing.T) {
+	// Two modules may reasonably both call something "config". Without the prefix the second
+	// would silently replace the first, and the node would apply one of them and report success.
+	a := mod("a", nil, nil, nil)
+	a.Resources = []map[string]any{{"id": "config", "type": "file", "path": "/etc/a"}}
+	b := mod("b", nil, nil, nil)
+	b.Resources = []map[string]any{{"id": "config", "type": "file", "path": "/etc/b"}}
+
+	got, err := Resolve(shelf(a, b), []string{"a", "b"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]bool{}
+	for _, r := range mustDeclare(t, got) {
+		id := r["id"].(string)
+		if seen[id] {
+			t.Errorf("two resources share the identity %q", id)
+		}
+		seen[id] = true
+	}
+	if !seen["a.config"] || !seen["b.config"] {
+		t.Errorf("identities are not qualified by module: %v", seen)
+	}
+}
+
+func TestWhatAServiceReflectsIsQualifiedToo(t *testing.T) {
+	// Otherwise it names a resource that no longer exists under that identity, and the service
+	// quietly stops being restarted when its own configuration changes.
+	m := mod("thing", nil, nil, nil)
+	m.Resources = []map[string]any{
+		{"id": "conf", "type": "file", "path": "/etc/thing.conf"},
+		{"id": "svc", "type": "service", "unit": "thing.service", "state": "running",
+			"restart-on": []any{"conf"}},
+	}
+	got, err := Resolve(shelf(m), []string{"thing"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range mustDeclare(t, got) {
+		if r["id"] == "thing.svc" {
+			if got := fmt.Sprint(r["restart-on"]); got != "[thing.conf]" {
+				t.Errorf("a service reflects %s, which is not a resource in the declaration", got)
+			}
+			return
+		}
+	}
+	t.Error("the service is missing from the declaration")
+}
+
+func TestEveryReasonIsGivenAtOnce(t *testing.T) {
+	// Somebody resolving these fixes them in one pass or in three. Every reason that genuinely
+	// refuses the set is collected, rather than only the first: a claim two modules both take, a
+	// requirement nothing answers, and a requirement several answer without anybody choosing.
+	_, err := Resolve(shelf(
+		mod("xorg", nil, nil, nil, mcat.Claim{Name: "the-seat"}),
+		mod("wayland", nil, nil, nil, mcat.Claim{Name: "the-seat"}),
+		mod("i3", nil, []string{"compositor"}, nil),
+		mod("editor", nil, []string{"shell"}, nil),
+		mod("bash", []string{"shell"}, nil, nil),
+		mod("zsh", []string{"shell"}, nil, nil),
+	), []string{"xorg", "wayland", "i3", "editor"}, workstation(), mcat.World{})
+
+	if err == nil {
+		t.Fatal("expected refusals")
+	}
+	if strings.Count(err.Error(), "\n  - ") < 3 {
+		t.Errorf("only some problems were reported:\n%v", err)
+	}
+}
+
+func TestACycleStopsRatherThanRunsAway(t *testing.T) {
+	// Two modules requiring each other is a mistake somebody makes, and it must produce an answer
+	// rather than a stack overflow.
+	got, err := Resolve(shelf(
+		mod("a", nil, []string{"b"}, nil),
+		mod("b", nil, []string{"a"}, nil),
+	), []string{"a"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Modules) != 2 {
+		t.Errorf("a cycle resolved to %v", names(got))
+	}
+}
+
+func TestChoosingOneSatisfiesTheRequirement(t *testing.T) {
+	// The other half of refusing. "Choose one and assign it" has to actually work, or the remedy
+	// names three modules and then ignores the one you pick — which is how this read the first
+	// time it was used on a real mesh.
+	got, err := Resolve(shelf(
+		mod("editor", nil, []string{"shell"}, nil),
+		mod("bash", []string{"shell"}, nil, nil),
+		mod("zsh", []string{"shell"}, nil, nil),
+		mod("fish", []string{"shell"}, nil, nil),
+	), []string{"editor", "zsh"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatalf("choosing a shell did not satisfy the requirement for one: %v", err)
+	}
+	if len(got.Modules) != 2 {
+		t.Errorf("resolved %v; only the chosen shell should have come in", names(got))
+	}
+}
+
+func TestChoosingSeveralIsStillFine(t *testing.T) {
+	// And the choice is not exclusive. Nothing is claimed, so a person may have all three and
+	// the requirement is answered by whichever they picked.
+	got, err := Resolve(shelf(
+		mod("editor", nil, []string{"shell"}, nil),
+		mod("bash", []string{"shell"}, nil, nil),
+		mod("zsh", []string{"shell"}, nil, nil),
+		mod("fish", []string{"shell"}, nil, nil),
+	), []string{"editor", "zsh", "bash", "fish"}, workstation(), mcat.World{})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Modules) != 4 {
+		t.Errorf("resolved %v", names(got))
+	}
+}
+
+func TestARequirementNamingAModuleMeansThatModule(t *testing.T) {
+	// i3 requires xorg and means xorg, not "anything calling itself a display server". Otherwise
+	// assigning wayland would silently satisfy i3 and the machine would come up with a window
+	// manager talking to nothing.
+	_, err := Resolve(shelf(
+		mod("i3", nil, []string{"xorg"}, nil),
+		mod("xorg", []string{"display-server"}, nil, nil),
+		mod("wayland", []string{"display-server", "xorg"}, nil, nil),
+	), []string{"i3", "wayland"}, workstation(), mcat.World{})
+
+	// wayland claiming to provide "xorg" is a manifest saying something untrue; what matters is
+	// that a real xorg module still wins when it exists, and that the answer is not silent.
+	if err != nil && !strings.Contains(err.Error(), "xorg") {
+		t.Errorf("unexpected refusal: %v", err)
+	}
+}
+
+func mustDeclare(t *testing.T, r mcat.Resolution) []map[string]any {
+	t.Helper()
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+// A requirement answered on the same machine is still a requirement (novox/hq 04-ISSUES/021).
+//
+// **The machine stops being a trust boundary once both ends are containers.** A consumer reaches
+// its provider over TCP from its own container, and the database asks for a password exactly as it
+// would from another machine. Before this, two such modules resolved cleanly with zero needs: no
+// credential was made, the consumer's secret file was never written, and whatever read it failed
+// somewhere else entirely.
+//
+// It went unnoticed because everything proven until then was cross-machine, which is the
+// interesting case for a mesh and the rare one in practice.
+func TestSomethingAnsweredOnThisMachineIsStillANeed(t *testing.T) {
+	provider := mcat.Manifest{
+		Module: "postgres", Version: "1",
+		Provides: mcat.FromAnywhere("postgres-database"),
+		Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
+	}
+	consumer := mcat.Manifest{
+		Module: "keycloak", Version: "1",
+		Requires: []string{"postgres-database"},
+		Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/database.env"},
+	}
+	got, err := Resolve(shelf(provider, consumer), []string{"postgres", "keycloak"}, mcat.Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 {
+		t.Fatalf("%d need(s); a consumer of a brokered provision needs a credential wherever "+
+			"the provider is", len(got.Needs))
+	}
+	if got.Needs[0].From != "anchor" {
+		t.Errorf("the need names %q as the provider, and it is this machine", got.Needs[0].From)
+	}
+	// And it carries what the provider says a consumer must know, which a local provider never
+	// contributes through the world.
+	if got.Needs[0].Serves["port"] != 5432 {
+		t.Errorf("the need carries %v, and the provider serves port 5432", got.Needs[0].Serves)
+	}
+}
+
+// A name nothing grants is unchanged: answered here means answered, and nothing more is owed.
+func TestSomethingOrdinaryAnsweredHereNeedsNothing(t *testing.T) {
+	got, err := Resolve(shelf(
+		mod("zsh", []string{"shell"}, nil, nil),
+		mod("editor-user", nil, []string{"shell"}, nil),
+	), []string{"zsh", "editor-user"}, mcat.Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 0 {
+		t.Fatalf("a shell answered on this machine produced %d need(s)", len(got.Needs))
+	}
+}
diff --git a/internal/compose/resolution/resolved_path_test.go b/internal/compose/resolution/resolved_path_test.go
new file mode 100644
index 0000000..ec7c7c4
--- /dev/null
+++ b/internal/compose/resolution/resolved_path_test.go
@@ -0,0 +1,32 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTheMeshsPlaceForDockerIsAccepted(t *testing.T) {
+	// The fix #205 needed: the mesh's own directory for the module, <root>/mesh/docker.
+	m, err := decodeForTest([]byte(`{"module": "docker", "version": "1", "resources": [
+		{"id": "state", "type": "directory", "place": "mesh"},
+		{"id": "marker", "type": "file", "path": "${dir:state}/applied", "content": "x"}]}`))
+	if err != nil {
+		t.Fatalf("place %q is in the mesh's tree, where the mesh writes for every module: %v", "mesh", err)
+	}
+	if got := dirsFor(m, mcat.Rendering{}); got["state"] != "/var/lib/mesh/docker" {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestComposingAMachineIsNeverStoppedByOneModulesPath(t *testing.T) {
+	// A module registered from outside the catalogue never passes the gate. Refusing its path while a machine's
+	// declaration is composed would fail the whole declaration and freeze every module on that machine; the
+	// node-engine fails only the one resource. So composition leaves it to the engine.
+	m := mcat.Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
+		{"id": "state", "type": "directory", "place": "."},
+	}}
+	if _, err := Declaration((mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{m}}), mcat.Rendering{}); err != nil {
+		t.Fatalf("the machine's declaration failed for one module's path: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/resolver_file_is_the_uplinks_test.go b/internal/compose/resolution/resolver_file_is_the_uplinks_test.go
new file mode 100644
index 0000000..9f555ac
--- /dev/null
+++ b/internal/compose/resolution/resolver_file_is_the_uplinks_test.go
@@ -0,0 +1,57 @@
+package resolution
+
+import (
+	"reflect"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestTheResolverConfigSeatIsGone(t *testing.T) {
+	if _, known := mcat.SeatNamed("node-resolver-config"); known {
+		t.Error("node-resolver-config is still in the mesh's set; the uplink's holder writes the resolver file")
+	}
+	// An uplink's holder needs no seat beside it for the file: it is its own.
+	if got := DependsOn(nil, mod("networkmanager", nil, nil, nil, mcat.Claim{Name: "node-uplink"})); len(got) != 0 {
+		t.Errorf("an uplink holder with nothing declared depends on %v", got)
+	}
+}
+
+// The catalogue as it is: nothing claims the retired seat, and every manager the mesh knows holds the
+// uplink and writes the resolver file; beside them only a holder of node-resolver does (ADR 0247).
+func TestTheCataloguesUplinksWriteTheResolverFileAndNothingElseDoes(t *testing.T) {
+	cat := map[string]mcat.Manifest{}
+	for _, m := range theCatalogue(t) {
+		cat[m.Module] = m
+	}
+	if got := PossibleHolders(cat, "node-uplink"); !reflect.DeepEqual(got, uplinks) {
+		t.Errorf("node-uplink can be held by %v, not %v", got, uplinks)
+	}
+	for name, m := range cat {
+		for _, c := range m.Claims {
+			if c.Name == "node-resolver-config" {
+				t.Errorf("%s still claims node-resolver-config", name)
+			}
+		}
+		_, writes := m.Facts["resolvers"]
+		isUplink := false
+		for _, u := range uplinks {
+			isUplink = isUplink || u == name
+		}
+		for _, f := range m.Facts {
+			// Or the machine's own resolver's, where it is held (novox/hq ADR 0247): the uplink's holder
+			// steps back from the file there, and nowhere else.
+			if f.Path == "/etc/resolv.conf" && !isUplink && !holdsSeat(m, mcat.ResolverSeat) {
+				t.Errorf("%s writes /etc/resolv.conf and holds neither the uplink nor the machine's resolver", name)
+			}
+		}
+		for _, r := range m.Resources {
+			if r["path"] == "/etc/resolv.conf" {
+				t.Errorf("%s declares /etc/resolv.conf as a file of its own", name)
+			}
+		}
+		if isUplink && !writes {
+			t.Errorf("%s holds the uplink and does not write the resolver file", name)
+		}
+	}
+}
diff --git a/internal/compose/resolution/resolver_manifests_test.go b/internal/compose/resolution/resolver_manifests_test.go
new file mode 100644
index 0000000..5a8d3b1
--- /dev/null
+++ b/internal/compose/resolution/resolver_manifests_test.go
@@ -0,0 +1,232 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// resolverShelf is the resolver, an uplink module that writes what the machine asks (novox/hq ADR
+// 0223), and the container runtime beside something that answers `mesh-addressing`.
+// The networking module that really does is composed in the controller and cannot be imported
+// here, so a stand-in offers the same word; what is under test is the manifests, not the network.
+func resolverShelf(t *testing.T) map[string]mcat.Manifest {
+	t.Helper()
+	shelf := map[string]mcat.Manifest{
+		"net": {Module: "net", Version: "1", Provides: []mcat.Offer{{Name: "mesh-addressing"}}},
+	}
+	for _, name := range []string{"dnsmasq", "systemd-networkd", "docker"} {
+		shelf[name] = catalogueManifest(t, name)
+	}
+	return shelf
+}
+
+// twoMachines is what the control plane hands a rendering: internal names and their addresses.
+var twoMachines = map[string]string{"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2"}
+
+// The resolver and what points the machine at it compose on one machine, and what arrives is the
+// mesh's account of every machine as a wildcard, the suffix kept local, the daemon restarting on
+// that file, the machine pointed at the resolver by address, and the runtime given no resolver of
+// its own but kept running across a restart (ADR 0196).
+func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
+	got, err := Resolve(resolverShelf(t), []string{"dnsmasq", "systemd-networkd", "docker"}, mcat.Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
+		"package-manager": true, "service-manager": true, "privileged": true,
+		"uplink-systemd-networkd": true}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(strings.Join(named(got), " "), "net") {
+		t.Fatalf("the resolver's data is the mesh's addresses, and nothing answering them was taken: %v", named(got))
+	}
+	out, err := Declaration(got, mcat.Rendering{
+		// Names is every name the mesh serves; Machines is the subset that is a node (novox/hq
+		// issue 111) — the resolver's zones read only the second, and in this scenario the two
+		// happen to be the same map, since nothing routed is part of it.
+		Names: twoMachines, Machines: twoMachines, Suffix: "internal",
+		Zones:    []mcat.ZoneAt{{Zone: "incus", Address: "10.42.0.2", Port: 5353}},
+		Holders:  map[string]map[string]string{"mesh-dns-resolver": {"anchor.internal": "10.42.0.1"}},
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: mcat.SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ids := byID(out)
+	zones := ids["dnsmasq.fact-node-zones"]
+	if zones == nil || zones["path"] != "/etc/mesh-resolver/nodes.conf" {
+		t.Fatalf("the resolver was not given the machines where its configuration reads them: %v", zones)
+	}
+	content, _ := zones["content"].(string)
+	for _, want := range []string{
+		"local=/internal/", "address=/anchor.internal/10.42.0.1", "address=/laptop.internal/10.42.0.2",
+	} {
+		if !strings.Contains(content, want) {
+			t.Errorf("the machines file lacks %q:\n%s", want, content)
+		}
+	}
+
+	service := ids["dnsmasq.service"]
+	if service == nil {
+		t.Fatal("no resolver service composed")
+	}
+	reflects := map[string]bool{}
+	for _, id := range service["restart-on"].([]any) {
+		reflects[id.(string)] = true
+	}
+	if !reflects["dnsmasq.config"] || !reflects["dnsmasq.fact-node-zones"] || !reflects["dnsmasq.fact-zones"] {
+		t.Errorf("the daemon does not restart on its configuration, the machines and the zones: %v", service["restart-on"])
+	}
+	if z, _ := ids["dnsmasq.fact-zones"]["content"].(string); !strings.Contains(z, "server=/incus/10.42.0.2#5353\n") {
+		t.Errorf("the resolver was not told to forward the zone to its answerer:\n%s", z)
+	}
+
+	// The runtime's own file, written into (novox/hq ADR 0102) with one key, by the runtime's own
+	// module — a module does not write another software's configuration (issue 190): a restart keeps
+	// every container running. No `dns` — a container copies its machine's resolvers (ADR 0196), and
+	// neither the resolver nor what decides how the machine resolves writes the runtime's file.
+	if ids["dnsmasq.runtime-dns"] != nil {
+		t.Errorf("the resolver still writes the runtime's dns: %v", ids["dnsmasq.runtime-dns"])
+	}
+	for id := range ids {
+		if strings.HasPrefix(id, "systemd-networkd.runtime") {
+			t.Errorf("what the machine asks still writes the runtime's file: %s", id)
+		}
+	}
+	runtime := ids["docker.daemon"]
+	if runtime == nil || runtime["path"] != "/etc/docker/daemon.json" || runtime["into"] != "json" {
+		t.Fatalf("live-restore is not written into the runtime's file: %v", runtime)
+	}
+	var keys map[string]any
+	if err := json.Unmarshal([]byte(runtime["content"].(string)), &keys); err != nil {
+		t.Fatalf("the runtime's keys are not JSON: %v", err)
+	}
+	// What the runtime is given is what its own module declares, and nothing a layer or another module
+	// adds. This used to say "live-restore and nothing else", to hold the line ADR 0196 drew when `dns`
+	// left the file; since the docker module gained log rotation as a preference (mesh-catalog #205 and
+	// #217, novox/hq issue 452) that frozen copy failed every check (novox/hq issue 498). So the keys are
+	// judged against the module's own daemon.json instead: live-restore is given, `dns` never is, and no
+	// key the module does not declare appears.
+	if keys["live-restore"] != true {
+		t.Errorf("the runtime is given %v; a restart must keep every container running (live-restore)", keys)
+	}
+	if _, ok := keys["dns"]; ok {
+		t.Errorf("the runtime is given a resolver of its own, %v; a container copies its machine's (ADR 0196)", keys["dns"])
+	}
+	declared := daemonKeysDeclared(t)
+	for key := range keys {
+		if !declared[key] {
+			t.Errorf("the runtime is given %q, which the docker module does not declare: %v", key, keys)
+		}
+	}
+	// The log rotation preference, at its defaults, wherever the module declares it. The copy captured in
+	// testdata/beside predates it, so outside a merge check it is not there to judge.
+	if declared["log-driver"] {
+		opts, _ := keys["log-opts"].(map[string]any)
+		if keys["log-driver"] != "json-file" || opts["max-size"] != "100m" || opts["max-file"] != "10" {
+			t.Errorf("the runtime is given %v; its containers' logs are cut at 100m and ten are kept (novox/hq issue 452)", keys)
+		}
+	}
+	// The runtime is reloaded when that file changes, and never restarted: a restart stops every
+	// container on the machine (ADR 0102), and a reload is what turns live-restore on.
+	var reloaded bool
+	for _, r := range out {
+		if r["type"] != "service" || r["unit"] != "docker.service" {
+			continue
+		}
+		if _, restarts := r["restart-on"]; restarts {
+			t.Errorf("the runtime is ordered restarted, which stops every container (ADR 0102): %v", r)
+		}
+		for _, on := range asStrings(r["reload-on"]) {
+			if on == "docker.daemon" {
+				reloaded = true
+			}
+		}
+	}
+	if !reloaded {
+		t.Errorf("the runtime is not reloaded when its file changes, so live-restore never takes effect")
+	}
+
+	resolv := ids["systemd-networkd.fact-resolvers"]
+	if resolv == nil || !strings.Contains(resolv["content"].(string), "\nnameserver 10.42.0.1\noptions ") {
+		t.Fatalf("the machine is not pointed at the resolver by address, and only at it: %v", resolv)
+	}
+}
+
+// Two modules deciding what a machine asks are refused on one machine, as before — now that the file
+// is the uplink's (novox/hq ADR 0223), by two things: a machine runs one network manager, and no other
+// module may write the resolver file beside the uplink's, as a file or as a rendered fact.
+func TestTwoThingsDecidingWhatAMachineAsksAreRefused(t *testing.T) {
+	shelf := resolverShelf(t)
+	shelf["networkmanager"] = catalogueManifest(t, "networkmanager")
+	node := mcat.Node{Name: "anchor", At: "anchor.internal", Capabilities: map[string]bool{
+		"package-manager": true, "service-manager": true,
+		"uplink-systemd-networkd": true, "uplink-networkmanager": true}}
+	_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "networkmanager"}, node, mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), "node-uplink") {
+		t.Fatalf("two network managers were both assigned to one machine: %v", err)
+	}
+
+	// The second is made up: what is under test is that the resolver file has one owner, so any
+	// module asking the mesh to render it — or declaring it — will do.
+	for name, m := range map[string]mcat.Manifest{
+		"a-rendered-one": {Module: "a-rendered-one", Version: "1",
+			Facts: map[string]mcat.RosterFile{"mine": {Path: "/etc/resolv.conf", Template: "nameserver 10.42.0.1\n"}}},
+		"a-declared-one": {Module: "a-declared-one", Version: "1", Resources: []map[string]any{
+			{"id": "mine", "type": "file", "path": "/etc/resolv.conf", "content": "nameserver 10.42.0.1\n"}}},
+	} {
+		shelf := resolverShelf(t)
+		shelf[name] = m
+		_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", name}, node, mcat.World{})
+		if err == nil || !strings.Contains(err.Error(), "/etc/resolv.conf") {
+			t.Errorf("%s wrote the resolver file beside the uplink's: %v", name, err)
+		}
+	}
+}
+
+// A machine that is not on the private network has no address for the runtime to be pointed at.
+// Refused where the module and the machine are both named, rather than a placeholder written into
+// the runtime's file and read as an address.
+func TestTheResolverOnAMachineOffTheNetworkIsRefused(t *testing.T) {
+	got, err := Resolve(resolverShelf(t), []string{"dnsmasq"}, mcat.Node{Name: "anchor"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Left out of the declaration and said, rather than composed listening nowhere: a module that
+	// cannot compose on a machine is kept as it is there, with the reason (hq ADR 0163).
+	composed, err := Compose(got, mcat.Rendering{Names: twoMachines, Suffix: "internal",
+		Needed:   map[string]map[string]string{"dnsmasq": {"broker": "sealed"}},
+		Settings: mcat.SettingsBy{"dnsmasq": {{From: "the mesh", Values: map[string]any{"listen-addresses": "127.0.0.1"}}}}})
+	if err == nil && !strings.Contains(composed.LeftOut["dnsmasq"], "${machine:address}") {
+		t.Fatalf("a machine off the network was composed a resolver, or left out for another reason: %v",
+			composed.LeftOut)
+	}
+	if err != nil && !strings.Contains(err.Error(), "${machine:address}") {
+		t.Fatalf("a machine off the network was refused for another reason: %v", err)
+	}
+}
+
+// daemonKeysDeclared is the top-level keys of the docker module's own daemon.json, read from its
+// manifest: what the runtime may be given (novox/hq issue 498). A placeholder sits inside a JSON
+// string there, so the content parses as it is.
+func daemonKeysDeclared(t *testing.T) map[string]bool {
+	t.Helper()
+	for _, r := range catalogueManifest(t, "docker").Resources {
+		if r["id"] != "daemon" {
+			continue
+		}
+		var keys map[string]any
+		if err := json.Unmarshal([]byte(r["content"].(string)), &keys); err != nil {
+			t.Fatalf("the docker module's daemon.json is not JSON: %v", err)
+		}
+		declared := map[string]bool{}
+		for key := range keys {
+			declared[key] = true
+		}
+		return declared
+	}
+	t.Fatal("the docker module declares no daemon.json")
+	return nil
+}
diff --git a/internal/compose/resolution/roster.go b/internal/compose/resolution/roster.go
new file mode 100644
index 0000000..747ffa6
--- /dev/null
+++ b/internal/compose/resolution/roster.go
@@ -0,0 +1,226 @@
+package resolution
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"text/template"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// rosterView is what a RosterFile's template sees. A closed shape — a template referencing a field
+// the mesh does not compute fails to render here, not on a machine.
+type rosterView struct {
+	Node     string
+	Suffix   string
+	Names    []rosterEntry
+	Machines []rosterEntry
+	// Zones is every zone a module in the mesh answers itself, with where its answerer is (novox/hq
+	// ADR 0199) — what the mesh's resolver forwards. Ordered by zone.
+	Zones []rosterZone
+	// Holders is the machines holding each replicated mesh seat, by seat (novox/hq ADR 0223) — what
+	// a machine's resolver file lists for `mesh-dns-resolver`. **This machine first when it is one
+	// of them**, then the rest by name: the nearest holder is asked first, and two renderings of
+	// one mesh on one machine are one file. A template reads one seat's with
+	// `index .Holders "<seat>"`; a seat nobody holds ranges over nothing.
+	Holders map[string][]rosterEntry
+}
+
+// rosterZone is one zone as a template sees it: the zone, and the address and port answering it.
+type rosterZone struct {
+	Zone    string
+	Address string
+	Port    int
+}
+
+// rosterEntry is one machine as a template sees it: its bare name, its full mesh name, its address,
+// and the operator account to log into it as (novox/hq to-be 29) — empty when none is known, so an
+// ssh Host block template can omit the User line for a machine nobody has an account on.
+type rosterEntry struct {
+	Name    string
+	FQDN    string
+	Address string
+	Account string
+}
+
+// FactsFrom renders the roster files a module asked for from everything the mesh composed for this
+// machine: its machines, zones and the holders of each replicated seat.
+func FactsFrom(m mcat.Manifest, r mcat.Resolution, with mcat.Rendering) ([]map[string]any, error) {
+	if len(m.Facts) == 0 {
+		return nil, nil
+	}
+	names := sortedFacts(m.Facts)
+
+	view := rosterView{
+		Node:     r.Node,
+		Suffix:   strings.TrimPrefix(suffixOr(with.Suffix), "."),
+		Names:    entriesFrom(with.Names, with.Accounts, with.Suffix),
+		Machines: entriesFrom(with.Machines, with.Accounts, with.Suffix),
+		Zones:    zonesFrom(with.Zones),
+		Holders:  holdersFrom(with.Holders, with.Accounts, with.Suffix, r.Node),
+	}
+
+	out := make([]map[string]any, 0, len(names))
+	for _, name := range names {
+		fact := m.Facts[name]
+		content, err := renderRoster(fact.Template, view)
+		if err != nil {
+			return nil, fmt.Errorf("%s cannot render %q: %w", m.Module, name, err)
+		}
+		// Where the file goes: under the operator's home and chowned to it (a home fact), or at the
+		// absolute system path it names. A home fact on a machine with no operator account cannot be
+		// placed, and is left out rather than written to nowhere (novox/hq to-be 29).
+		path := fact.Path
+		var owner string
+		if fact.Home {
+			if r.Account == "" {
+				continue
+			}
+			path = accountHomeOf(r.Account, r.AccountHome) + "/" + strings.TrimLeft(fact.Path, "/")
+			owner = r.Account
+		} else if !strings.HasPrefix(fact.Path, "/") {
+			return nil, fmt.Errorf(
+				"%s asks for %q at %q, which is not an absolute path", m.Module, name, fact.Path)
+		}
+		file := map[string]any{
+			"id": "fact-" + name, "type": "file", "path": path, "mode": "0644",
+			"content": content,
+		}
+		if owner != "" {
+			file["owner"] = owner
+		}
+		if fact.Shared {
+			// The host owns only the lines between `# BEGIN mesh <id>` and `# END mesh <id>` and
+			// keeps the rest of the file byte for byte; undeclared, the region goes and nothing else
+			// does (novox/hq issue 128). Every node on the private network receives this, so every
+			// node's host — the controller's own machine included — must be block-aware before a
+			// controller emitting it is rolled out: the order ADR 0102 set for `into: json`.
+			file["into"] = "block"
+		}
+		out = append(out, file)
+	}
+	return out, nil
+}
+
+// renderRoster runs a module's template over the roster. A template that will not parse, or reads
+// a field the mesh does not have, is an error here — where the manifest is — rather than an empty
+// file on a machine.
+func renderRoster(tmpl string, view rosterView) (string, error) {
+	t, err := template.New("roster").Option("missingkey=error").Parse(tmpl)
+	if err != nil {
+		return "", err
+	}
+	var b bytes.Buffer
+	if err := t.Execute(&b, view); err != nil {
+		return "", err
+	}
+	return b.String(), nil
+}
+
+// entriesFrom is a name→address map as sorted roster entries.
+//
+// **A machine with no address is left out.** The mesh has a record for it — somebody added it —
+// and does not yet know where it is, which is the ordinary state between adding a machine and it
+// joining. Writing the name anyway would give a name that resolves to nothing, and a connection to
+// that hangs; leaving it out fails at once and says the name is unknown.
+func entriesFrom(addresses, accounts map[string]string, suffix string) []rosterEntry {
+	out := make([]rosterEntry, 0, len(addresses))
+	for _, name := range sortedNames(addresses) {
+		if routed(name, suffix) {
+			// A routed name is already a full name under a public domain, and it has no mesh
+			// form: appending the suffix made `<name>.<suffix>`, which every machine's hosts file
+			// carried and nothing served (novox/hq issue 157). It is published as itself, once.
+			out = append(out, rosterEntry{Name: name, FQDN: name, Address: addresses[name], Account: accounts[name]})
+			continue
+		}
+		internal, bare := meshName(name, suffix)
+		// The account is looked up by whichever key the caller keys accounts on — the internal name
+		// or the bare one — so a template gets the right login however the maps were built.
+		account := accounts[name]
+		if account == "" {
+			account = accounts[bare]
+		}
+		out = append(out, rosterEntry{Name: bare, FQDN: internal, Address: addresses[name], Account: account})
+	}
+	return out
+}
+
+// meshName is a machine's internal name and its bare one, from either. The control plane keys
+// the names it hands a resolution by the internal name (`homer.internal`), the same map a
+// container gets as its hosts; a caller that keys by the bare name gets the same answer. The
+// suffix is the one the control plane composed those names with, handed down rather than written
+// here a second time — the alternative was `homer.internal.internal` on every machine.
+func meshName(name, suffix string) (internal, bare string) {
+	dotted := "." + strings.TrimPrefix(suffixOr(suffix), ".")
+	if strings.HasSuffix(name, dotted) {
+		return name, strings.TrimSuffix(name, dotted)
+	}
+	return name + dotted, name
+}
+
+// routed says whether a name the mesh serves is a routed public name rather than a machine's: it
+// carries a domain of its own and not the mesh's suffix. A machine's name is bare (`homer`) or
+// internal (`homer.internal`); anything else with a dot in it was composed under a public domain.
+func routed(name, suffix string) bool {
+	dotted := "." + strings.TrimPrefix(suffixOr(suffix), ".")
+	return strings.Contains(name, ".") && !strings.HasSuffix(name, dotted)
+}
+
+// suffixOr is the suffix given, or the one the mesh composes names with when none was handed down.
+// The one place the default is written, so a fact and a name cannot disagree about it.
+func suffixOr(suffix string) string {
+	if suffix == "" {
+		return "internal"
+	}
+	return suffix
+}
+
+func sortedNames(addresses map[string]string) []string {
+	out := make([]string, 0, len(addresses))
+	for name, at := range addresses {
+		// A machine the mesh cannot place is left out rather than named at nothing.
+		if at == "" {
+			continue
+		}
+		out = append(out, name)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// zonesFrom is the zones a template ranges, ordered by zone so two renderings of one mesh are one file.
+func zonesFrom(zones []mcat.ZoneAt) []rosterZone {
+	out := make([]rosterZone, 0, len(zones))
+	for _, z := range zones {
+		out = append(out, rosterZone{Zone: z.Zone, Address: z.Address, Port: z.Port})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Zone < out[j].Zone })
+	return out
+}
+
+// holdersFrom is each replicated seat's holders as a template ranges them: this machine first when
+// it holds the seat, then the others by name (novox/hq ADR 0223). A machine with no address is left
+// out, as everywhere in the roster — a resolver named at nothing is a lookup that hangs.
+func holdersFrom(holders map[string]map[string]string, accounts map[string]string, suffix, node string) map[string][]rosterEntry {
+	out := make(map[string][]rosterEntry, len(holders))
+	for seat, at := range holders {
+		entries := entriesFrom(at, accounts, suffix)
+		sort.SliceStable(entries, func(i, j int) bool {
+			return entries[i].Name == node && entries[j].Name != node
+		})
+		out[seat] = entries
+	}
+	return out
+}
+
+// sortedFacts is a module's fact names in order, so what is said about them is said the same way twice.
+func sortedFacts(facts map[string]mcat.RosterFile) []string {
+	out := make([]string, 0, len(facts))
+	for name := range facts {
+		out = append(out, name)
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/internal/compose/resolution/routing_test.go b/internal/compose/resolution/routing_test.go
new file mode 100644
index 0000000..1ed5281
--- /dev/null
+++ b/internal/compose/resolution/routing_test.go
@@ -0,0 +1,250 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// labelled is a module that asks to be published under a subdomain rather than a full hostname.
+func labelled(module, label string, port int) mcat.Manifest {
+	return mcat.Manifest{Module: module, Version: "1",
+		Contributes: map[string]map[string]any{
+			"reverse-proxy": {"label": label, "port": port},
+		}}
+}
+
+// withDomain is a workstation that composes its routed names under one public domain.
+func withDomain(domain string) mcat.Node {
+	n := workstation()
+	n.PublicDomain = domain
+	return n
+}
+
+func TestALabelComposesWithTheNodesPublicDomain(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 1 {
+		t.Fatalf("the proxy was told about %d of 1: %v", len(given), given)
+	}
+	if given[0].Values["name"] != "git.example.tld" {
+		t.Fatalf("the label did not compose with the domain: %v", given[0].Values)
+	}
+	// The port the module gave is still there — composing the name must not drop what the proxy
+	// needs to reach the workload.
+	if given[0].Values["port"] != float64(8080) {
+		t.Fatalf("composing the name dropped the port: %v", given[0].Values)
+	}
+}
+
+func TestTheApexLabelComposesToTheBareDomain(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), labelled("board", "@", 4000)),
+		[]string{"board"}, withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 1 {
+		t.Fatalf("the proxy was told about %d of 1: %v", len(given), given)
+	}
+	// `@` is the zone-file apex: served at the bare public domain, no subdomain, no leading dot.
+	if given[0].Values["name"] != "example.tld" {
+		t.Fatalf("the apex label did not compose to the bare domain: %v", given[0].Values)
+	}
+}
+
+func TestOneNodeSettingMovesTheCatalogueBetweenDomains(t *testing.T) {
+	// The ADR's name-agnostic check: the same catalogue resolves against two different public
+	// domains by changing one node setting and nothing else.
+	one, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	two, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("other.example"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	first := received(t, mustDeclare(t, one))[0].Values
+	second := received(t, mustDeclare(t, two))[0].Values
+
+	if first["name"] != "git.example.tld" || second["name"] != "git.other.example" {
+		t.Fatalf("the name did not track the domain: %v then %v", first["name"], second["name"])
+	}
+	// And nothing else moved: same label, same port. The domain is the one fact that changed.
+	if first["label"] != second["label"] || first["label"] != "git" {
+		t.Fatalf("the label changed with the domain: %v then %v", first["label"], second["label"])
+	}
+	if first["port"] != second["port"] {
+		t.Fatalf("the port changed with the domain: %v then %v", first["port"], second["port"])
+	}
+}
+
+func TestALegacyFullNameContributionPassesThroughUnchanged(t *testing.T) {
+	// Backward compatibility: a contribution that still carries a full `name` and no `label` is
+	// granted that name as-is, even on a node that has a public domain. This is what lets the
+	// catalogue migrate one module at a time while the running mesh keeps working.
+	legacy := mcat.Manifest{Module: "board", Version: "1",
+		Contributes: map[string]map[string]any{
+			"reverse-proxy": {"name": "git.pinned.example", "port": 8080},
+		}}
+	got, err := Resolve(shelf(proxy(), legacy), []string{"board"}, withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if given[0].Values["name"] != "git.pinned.example" {
+		t.Fatalf("a full name was rewritten: %v", given[0].Values)
+	}
+	if _, grewLabel := given[0].Values["label"]; grewLabel {
+		t.Fatalf("a legacy contribution grew a label: %v", given[0].Values)
+	}
+}
+
+func TestALabelWithNoPublicDomainComposesNothing(t *testing.T) {
+	// A routed module on a node with no public domain has nothing to join its label to. It composes
+	// no name — which reads downstream exactly as a route that named no host, the same as before
+	// this existed — rather than an fabricated `git.` with a dangling dot.
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if _, named := given[0].Values["name"]; named {
+		t.Fatalf("a name was composed with no domain to compose it from: %v", given[0].Values)
+	}
+	if given[0].Values["label"] != "git" {
+		t.Fatalf("the label was lost: %v", given[0].Values)
+	}
+}
+
+// withPrivateAddress is a workstation on the private network, at the given internal name — the
+// same fact a route's own consumers already receive as `${bound:...:at}`.
+func withPrivateAddress(at string) mcat.Node {
+	n := workstation()
+	n.At = at
+	return n
+}
+
+func TestALabelComposesWithTheNodesPrivateAddressToo(t *testing.T) {
+	// A predecessor proxy answered a route on both a public and a private-network hostname for the
+	// same convenience the mesh restores here: reaching a service over the VPN without a public TLS
+	// round trip. Composed independently of the public name, from the node's own `At`.
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withPrivateAddress("anchor.internal"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if given[0].Values["internal-name"] != "git.anchor.internal" {
+		t.Fatalf("the label did not compose with the private address: %v", given[0].Values)
+	}
+}
+
+func TestThePublicAndInternalNamesComposeIndependently(t *testing.T) {
+	// A node with both a public domain and a private address gets both names from one label; a
+	// node with only one of the two gets only the matching one — neither composition depends on
+	// the other being possible.
+	both := withPrivateAddress("anchor.internal")
+	both.PublicDomain = "example.tld"
+	got, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, both, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if given[0].Values["name"] != "git.example.tld" {
+		t.Fatalf("the public name did not compose alongside the internal one: %v", given[0].Values)
+	}
+	if given[0].Values["internal-name"] != "git.anchor.internal" {
+		t.Fatalf("the internal name did not compose alongside the public one: %v", given[0].Values)
+	}
+
+	publicOnly, err := Resolve(shelf(proxy(), labelled("board", "git", 8080)),
+		[]string{"board"}, withDomain("example.tld"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	givenPublicOnly := received(t, mustDeclare(t, publicOnly))
+	if _, has := givenPublicOnly[0].Values["internal-name"]; has {
+		t.Fatalf("an internal name was composed with no private address to compose it from: %v",
+			givenPublicOnly[0].Values)
+	}
+}
+
+func TestTheApexLabelComposesToTheBarePrivateAddress(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), labelled("board", "@", 4000)),
+		[]string{"board"}, withPrivateAddress("anchor.internal"), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if given[0].Values["internal-name"] != "anchor.internal" {
+		t.Fatalf("the apex label did not compose to the bare private address: %v", given[0].Values)
+	}
+}
+
+// novox/hq ADR 0066 propagate, by ADR 0148's means: a granted route name is published into the
+// machine's roster mapped to the node that serves it, beside the `<node>.internal` names, and the
+// machine's resolver answers it to every container. Nothing is written into the container itself —
+// a routed name that moved would otherwise be wrong inside every container until each was recreated.
+func TestARoutedNameResolvesToTheServingNode(t *testing.T) {
+	names := map[string]string{
+		"anchor.internal": "10.42.0.1",
+		"git.example.tld": "10.42.0.1",
+	}
+	got := containersOf(t, mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+		Module: "app",
+		Resources: []map[string]any{{"id": "web", "type": "container", "name": "web",
+			"image": "registry.example/web@sha256:" + strings.Repeat("a", 64)}},
+	}}}, mcat.Rendering{Names: names})
+	if len(got) != 1 {
+		t.Fatalf("expected one container, got %d", len(got))
+	}
+	if given := namesOf(got[0]); len(given) != 0 {
+		t.Fatalf("the routed name was copied into the container, where it would go stale: %v", given)
+	}
+	var sawRoute bool
+	for _, e := range entriesFrom(names, nil, "internal") {
+		if e.Name == "git.example.tld" && e.Address == "10.42.0.1" {
+			sawRoute = true
+		}
+	}
+	if !sawRoute {
+		t.Fatalf("the routed name is not in the roster the machine's resolver answers from")
+	}
+}
+
+// novox/hq issue 139, ADR 0151: `<label>.<node>.internal` is answered by every machine's resolver as
+// "anything under that node's name goes to that node", so the node in a route's internal name must
+// be the one whose proxy answers it. Composed under the consumer's own name, a route served from
+// another machine got an internal name that resolved to a machine with nothing listening, while the
+// public name — published at the serving node's address — worked.
+func TestARoutesInternalNameIsComposedUnderTheNodeThatServesIt(t *testing.T) {
+	hub := proxy()
+	hub.Provides = mcat.FromAnywhere("reverse-proxy")
+	got, err := Resolve(shelf(hub, labelled("board", "git", 8080)), []string{"board"},
+		withPrivateAddress("laptop.internal"), mcat.World{Offered: map[string][]mcat.Provider{
+			"reverse-proxy": {{Node: "anchor", At: "anchor.internal", Module: "traefik"}},
+		}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Gathered the way the control plane gathers a consumer's contribution for a provider on
+	// another machine.
+	values, asks, err := ContributionsFrom(got, "reverse-proxy", "board", nil)
+	if err != nil || !asks {
+		t.Fatalf("the route was not contributed: %v %v", asks, err)
+	}
+	if values["internal-name"] != "git.anchor.internal" {
+		t.Fatalf("the internal name does not say where the request arrives: %v", values)
+	}
+}
diff --git a/internal/compose/resolution/runonce_test.go b/internal/compose/resolution/runonce_test.go
new file mode 100644
index 0000000..dd273e3
--- /dev/null
+++ b/internal/compose/resolution/runonce_test.go
@@ -0,0 +1,54 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// indexOfID returns the position of the resource with the given (module-prefixed) id, or -1.
+func indexOfID(out []map[string]any, id string) int {
+	for i, r := range out {
+		if r["id"] == id {
+			return i
+		}
+	}
+	return -1
+}
+
+func TestARunOnceContainerRendersBeforeTheContainerItGates(t *testing.T) {
+	// The gate is declaration order, not a resolved dependency: the step is written before the
+	// container that needs it, and the host applies in order and stops at a step that did not
+	// complete. So the control plane must carry run-once through untouched and must not reorder the
+	// two containers.
+	digest := "@sha256:" + strings.Repeat("a", 64)
+	r := mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{{
+		Module: "mosquitto",
+		Resources: []map[string]any{
+			{"id": "seed", "type": "container", "name": "seed",
+				"image": "registry.example/runtime" + digest, "run-once": true},
+			{"id": "server", "type": "container", "name": "broker",
+				"image": "registry.example/broker" + digest},
+		},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seed := indexOfID(out, "mosquitto.seed")
+	server := indexOfID(out, "mosquitto.server")
+	if seed == -1 || server == -1 {
+		t.Fatalf("a container was lost in rendering: seed=%d server=%d", seed, server)
+	}
+	if seed >= server {
+		t.Errorf("the run-once step rendered after the container it gates (seed=%d server=%d)", seed, server)
+	}
+	if once, _ := out[seed]["run-once"].(bool); !once {
+		t.Errorf("run-once did not reach the host declaration: %+v", out[seed])
+	}
+	if _, present := out[server]["run-once"]; present {
+		t.Errorf("run-once leaked onto the container that is not a step: %+v", out[server])
+	}
+}
diff --git a/internal/compose/resolution/runtime.go b/internal/compose/resolution/runtime.go
new file mode 100644
index 0000000..9eedf9c
--- /dev/null
+++ b/internal/compose/resolution/runtime.go
@@ -0,0 +1,410 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// BundleID names the archive resource that delivers one of a module's bundles; prefixed with the
+// module like every resource of its own.
+func BundleID(bundle string) string { return "bundle-" + bundle }
+
+// BundlePath is where one module's bundle is unpacked on a machine.
+func BundlePath(module, bundle string) string { return mcat.BundleRoot + "/" + module + "/" + bundle }
+
+// runtimeHere says whether this node's set includes the runtime module, which is what decides
+// whether anything about tools changes on the machine (to-be 38 WP2): until the runtime is assigned,
+// a node is sent exactly what it was sent before, bundles included, because a bundle nothing loads
+// is bytes nobody reads.
+func resolutionRuntimeHere(r mcat.Resolution) bool {
+	for _, m := range r.Modules {
+		if m.Module == mcat.RuntimeModule {
+			return true
+		}
+	}
+	return false
+}
+
+// bundleArchives is one archive per tools bundle of a module — a bundle the runtime LOADS something
+// from — as the host fetches and unpacks any artifact (novox/hq ADR 0175 §3: a module brings its
+// tools as a bundle, delivered by the host like any artifact, never an image). A bundle it loads
+// nothing from is run rather than loaded: a daemon, a step, the runtime itself — delivered by the
+// process that runs it, and not again here.
+//
+// The source is the kept reference; the per-resource pass that follows routes it through the
+// artifact store as this network reaches it now, as it does every image and archive the mesh built.
+func bundleArchives(m mcat.Manifest) []map[string]any {
+	var out []map[string]any
+	for _, b := range m.Bundles {
+		if len(b.Loads) == 0 {
+			continue
+		}
+		out = append(out, map[string]any{
+			"id": BundleID(b.Name), "type": "archive",
+			"source": b.Source, "digest": b.Digest,
+			"path": BundlePath(m.Module, b.Name),
+		})
+	}
+	return out
+}
+
+// RuntimeProcessID names the one process the mesh composes for a machine's runtime; prefixed with
+// the runtime module like a resource of its own, because that module is what the host sees it as.
+func RuntimeProcessID() string { return "runtime" }
+
+// interpreterFor is how a bundle in a language is run: the program the host's unit starts, with the
+// bundle's entrypoint after it. The one thing the composer takes from a language, and said here
+// rather than in a manifest because the runtime's process is the mesh's to compose (to-be 38 WP3).
+func interpreterFor(language string) (string, error) {
+	switch language {
+	case "typescript":
+		return "node", nil
+	}
+	return "", fmt.Errorf(
+		"%s is written in %q, and the mesh knows no interpreter to run a %q bundle with", mcat.RuntimeModule, language, language)
+}
+
+// runtimeProcess is the one process a machine runs the node's tool runtime as (novox/hq ADR 0175,
+// to-be 38 WP2.3): the runtime module's own bundle, run by its language's interpreter, told which
+// modules it serves and from which files, where its credential is, and who the machine's operator
+// is — and restarted when any bundle it loads or the credential it holds changes.
+//
+// Composed from the placed manifests, so the credential's path is where this node puts it. The
+// runtime runs as the operator's account when the machine has one, which is what lets a tool that
+// needs root escalate as the operator would (ADR 0175 §4); on a machine with no account it runs as
+// root, and the two operator words are not set.
+func resolutionRuntimeProcess(r mcat.Resolution, with mcat.Rendering) (map[string]any, error) {
+	var runtime *mcat.Manifest
+	for i := range r.Modules {
+		if r.Modules[i].Module == mcat.RuntimeModule {
+			runtime = &r.Modules[i]
+		}
+	}
+	if runtime == nil || runtime.Stubbed {
+		// Held (its stand-in, Stubbed): its process is never applied, what runs of it is carried, and its stand-in is
+		// never refused by a rule about its bundle or its broker (issue 774: node-tools held for a build not done, then
+		// "its build produced 0 bundle(s)", refused every module of ace, g14 and shanks).
+		return nil, nil
+	}
+	if len(runtime.Bundles) != 1 {
+		return nil, fmt.Errorf(
+			"%s is assigned to %s and its build produced %d bundle(s); the runtime is one bundle "+
+				"the mesh runs, so the module declares exactly one (novox/hq to-be 38)", mcat.RuntimeModule, r.Node, len(runtime.Bundles))
+	}
+	bundle := runtime.Bundles[0]
+	// What runs it (novox/hq ADR 0193): a runtime compiled to a binary runs itself, from its own
+	// unpacked bundle; an interpreted one is its language's interpreter and its one entrypoint.
+	var run []any
+	if bundle.Binary != "" {
+		run = []any{"./" + bundle.Binary}
+	} else {
+		if len(bundle.Entrypoints) != 1 {
+			return nil, fmt.Errorf(
+				"%s's bundle %q names %d entrypoint(s); the runtime is run from one, so the module "+
+					"declares exactly one (novox/hq to-be 38)", mcat.RuntimeModule, bundle.Name, len(bundle.Entrypoints))
+		}
+		interpreter, err := interpreterFor(bundle.Language)
+		if err != nil {
+			return nil, err
+		}
+		run = []any{interpreter, bundle.Entrypoints[0]}
+	}
+	credential, declared := runtime.OwnSecrets["broker"]
+	if !declared {
+		return nil, fmt.Errorf(
+			"%s declares no own secret named broker, and the node's credential is delivered there: "+
+				"a module that speaks on the bus declares \"own-secrets\": {\"broker\": <path>}", mcat.RuntimeModule,
+		)
+	}
+
+	// What it serves, and from which files: every module on this machine that composes here, in
+	// name order, each bundle it loads from in the order the manifest gave. A module left out of
+	// the declaration — a filter on an adopted machine — is left out of this too, or the runtime
+	// would be told to load files that were never delivered.
+	var served []string
+	var restartOn []string
+	given := map[string]map[string]string{}
+	for _, m := range r.Modules {
+		if with.Adopted && m.Filtering != nil {
+			continue
+		}
+		if m.RunsAs != "" {
+			// Served by a runtime of its own, on its own account (ownRuntimes): never the machine's.
+			continue
+		}
+		words, err := bundleWords(m, with)
+		if err != nil {
+			return nil, err
+		}
+		// The holder of node-files is told the same, and the paths modules own here (novox/hq ADR 0394 §4).
+		if words, err = resolutionFilesWords(r, m, words, with); err != nil {
+			return nil, err
+		}
+		if len(words) > 0 {
+			given[m.Module] = words
+		}
+		for _, b := range m.Bundles {
+			if len(b.Loads) == 0 {
+				continue
+			}
+			for _, load := range b.Loads {
+				// What the runtime starts: the launcher the build wrote beside the entrypoint, where
+				// it wrote one (ADR 0193); the entrypoint itself for a build from before them.
+				if launcher, has := b.Launchers[load]; has {
+					load = launcher
+				}
+				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
+			}
+			restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
+		}
+	}
+	sort.Strings(served)
+	restartOn = append(restartOn, mcat.RuntimeModule+"."+mcat.NeedID("broker"))
+	sort.Strings(restartOn)
+
+	env := map[string]string{mcat.RuntimeToolModules: strings.Join(served, ","), mcat.RuntimeBrokerFile: credential.Path}
+	if len(given) > 0 {
+		// Marshalled from maps, whose keys encoding/json sorts: the same words, the same unit.
+		body, err := json.Marshal(given)
+		if err != nil {
+			return nil, err
+		}
+		env[mcat.RuntimeToolEnv] = string(body)
+	}
+	process := map[string]any{
+		"id": mcat.RuntimeModule + "." + RuntimeProcessID(), "type": "process", "name": mcat.RuntimeModule,
+		"source": bundle.Source, "digest": bundle.Digest,
+		"run":        run,
+		"env":        env,
+		"restart-on": toAny(restartOn),
+	}
+	if r.Account != "" {
+		env[mcat.RuntimeOperatorAccount] = r.Account
+		env[mcat.RuntimeOperatorHome] = accountHomeOf(r.Account, r.AccountHome)
+		process["user"] = r.Account
+	}
+	if agent, home := resolutionAgentAccount(r); agent != "" {
+		env[mcat.RuntimeAgentAccount] = agent
+		env[mcat.RuntimeAgentHome] = home
+	}
+	// Routed through the artifact store as this network reaches it now, like everything the mesh
+	// built; refused with the same words when there is no store to route through.
+	if err := artifactsInto(process, mcat.RuntimeModule, with); err != nil {
+		return nil, err
+	}
+	return process, nil
+}
+
+// NoRuntimeToRunError is a module of its own account with no runtime program on its node to run it from. Held says the
+// runtime is there and held (its stand-in, Stubbed): the module cannot compose because the runtime does not, so a
+// composition that holds the runtime holds it too, never the node (issue 774).
+type NoRuntimeToRunError struct {
+	Held bool
+	said string
+}
+
+func (e *NoRuntimeToRunError) Error() string { return e.said }
+
+// ownRuntimes are the processes the modules of their own account are served by (novox/hq ADR 0259 §8): each
+// the machine's runtime program — the same build, run from the same source — serving that one module alone,
+// as the module's own account, on the module's own bus credential. Never the machine's runtime, which runs
+// as the operator's account and carries every module on the machine.
+func resolutionOwnRuntimes(r mcat.Resolution, with mcat.Rendering) ([]map[string]any, error) {
+	var own []mcat.Manifest
+	for _, m := range r.Modules {
+		// A held module's stand-in (Stubbed) has no runtime of its own composed, and so none of this function's rules
+		// about one: none of its composition is applied, and what runs of it is carried as it runs. Refusing it here
+		// refused its whole node (issue 774, 2026-10-30 21:04: mesh-self-check, held for its broker not made, then
+		// "runs as its own account and declares no own secret broker", failed 74 modules on ace and 79 on novox).
+		if m.RunsAs != "" && !m.Stubbed && !(with.Adopted && m.Filtering != nil) {
+			own = append(own, m)
+		}
+	}
+	if len(own) == 0 {
+		return nil, nil
+	}
+	var runtime *mcat.Manifest
+	for i := range r.Modules {
+		if r.Modules[i].Module == mcat.RuntimeModule {
+			runtime = &r.Modules[i]
+		}
+	}
+	if runtime == nil || len(runtime.Bundles) != 1 || runtime.Bundles[0].Binary == "" {
+		return nil, &NoRuntimeToRunError{Held: runtime != nil && runtime.Stubbed, said: fmt.Sprintf("%s runs as its own "+
+			"account in a runtime of its own, and %s is not here to run it from: assign %s to %s first (novox/hq ADR 0259)",
+			own[0].Module, mcat.RuntimeModule, mcat.RuntimeModule, r.Node)}
+	}
+	program := runtime.Bundles[0]
+	var out []map[string]any
+	for _, m := range own {
+		// Never the node's operator account, nor the account agents run as there (the review of 2026-10-09):
+		// either would hand what it holds back to the very accounts it is kept from.
+		switch {
+		case r.Account != "" && m.RunsAs == r.Account:
+			return nil, fmt.Errorf("%s runs as %s, the operator's account on %s: a module of its own account never "+
+				"runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		case r.AgentAccount != "" && m.RunsAs == r.AgentAccount:
+			return nil, fmt.Errorf("%s runs as %s, the account agents run as on %s: a module of its own account "+
+				"never runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
+		}
+		credential, declared := m.OwnSecrets["broker"]
+		if !declared {
+			return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)
+		}
+		var served, restartOn []string
+		for _, b := range m.Bundles {
+			for _, load := range b.Loads {
+				if launcher, has := b.Launchers[load]; has {
+					load = launcher
+				}
+				served = append(served, m.Module+"="+BundlePath(m.Module, b.Name)+"/"+load)
+			}
+			if len(b.Loads) > 0 {
+				restartOn = append(restartOn, m.Module+"."+BundleID(b.Name))
+			}
+		}
+		if len(served) == 0 {
+			return nil, fmt.Errorf("%s runs as its own account and its build produced no bundle to serve", m.Module)
+		}
+		sort.Strings(served)
+		restartOn = append(restartOn, m.Module+"."+mcat.NeedID("broker"))
+		sort.Strings(restartOn)
+		env := map[string]string{mcat.RuntimeToolModules: strings.Join(served, ","), mcat.RuntimeBrokerFile: credential.Path}
+		words, err := bundleWords(m, with)
+		if err != nil {
+			return nil, err
+		}
+		// The holder of node-reads is told where this node keeps its secrets (novox/hq ADR 0310 §5).
+		if words, err = resolutionReadsWords(r, m, words, with); err != nil {
+			return nil, err
+		}
+		// A build seat's holder gives way on its node, and its steps are told their part of the node's share
+		// (novox/hq ADR 0553).
+		yielding, yieldWords := resolutionYieldsOf(r, m, with)
+		if len(yieldWords) > 0 {
+			if words == nil {
+				words = map[string]string{}
+			}
+			for k, v := range yieldWords {
+				words[k] = v
+			}
+		}
+		if len(words) > 0 {
+			body, err := json.Marshal(map[string]map[string]string{m.Module: words})
+			if err != nil {
+				return nil, err
+			}
+			env[mcat.RuntimeToolEnv] = string(body)
+		}
+		process := map[string]any{
+			"id": m.Module + "." + mcat.OwnRuntimeID(), "type": "process", "name": m.Module + "-runtime",
+			"source": program.Source, "digest": program.Digest,
+			"run": []any{"./" + program.Binary}, "env": env, "restart-on": toAny(restartOn),
+			"user": m.RunsAs,
+		}
+		// How it is ready, as the module declared it (novox/hq ADR 0366 §1), in the node-engine's words.
+		if _, has := mcat.OwnRuntimeHealth(m); has {
+			process[mcat.HealthField] = m.RuntimeHealth
+			healthInto(process, m, with)
+		}
+		if yielding != nil {
+			process["yields"] = yielding
+		}
+		if err := artifactsInto(process, mcat.RuntimeModule, with); err != nil {
+			return nil, err
+		}
+		out = append(out, process)
+	}
+	return out, nil
+}
+
+func toAny(in []string) []any {
+	out := make([]any, 0, len(in))
+	for _, s := range in {
+		out = append(out, s)
+	}
+	return out
+}
+
+// bundleWords is what one module's tools bundles are given on this machine (novox/hq ADR 0192):
+// each loaded bundle's env, its ${dir:…} resolved to where this machine places the module's
+// directories and its ${port:…} to the port this machine gave it — the same resolution a
+// container's environment gets. Two bundles of one module naming one word differently is refused:
+// the runtime hands a module's words to all its bundles.
+func bundleWords(m mcat.Manifest, with mcat.Rendering) (map[string]string, error) {
+	var out map[string]string
+	dirs := dirsFor(m, with)
+	for _, b := range m.Bundles {
+		if len(b.Loads) == 0 || len(b.Env) == 0 {
+			continue
+		}
+		for _, word := range sortedKeys(b.Env) {
+			value, err := dirFill(b.Env[word], dirs, m.Module)
+			if err != nil {
+				return nil, err
+			}
+			if value, err = portsFilledInto(value, m.Module+"'s bundle "+b.Name+" ("+word+")", m.Module, m.Listens, with); err != nil {
+				return nil, err
+			}
+			if out == nil {
+				out = map[string]string{}
+			}
+			if was, had := out[word]; had && was != value {
+				return nil, fmt.Errorf("%s's bundles give %s two values (%q, %q); a module's words are "+
+					"handed to all its bundles, so they agree (novox/hq ADR 0192)", m.Module, word, was, value)
+			}
+			out[word] = value
+		}
+	}
+	return out, nil
+}
+
+// givenTo makes what a bundle's words name readable by the account the runtime runs as (novox/hq
+// ADR 0192): every file and directory of the module whose path a word names, or that holds one,
+// is owned by the account — a tool reads its configuration and its secret as the account, and a
+// root-owned 0600 file or a 0700 directory is one it cannot. Only where it says no owner already:
+// a module that named one knew why. Nothing on a machine with no account, where the runtime is root.
+//
+// It answers the files a word names exactly: what a tool reads, whose change the runtime must be
+// restarted for, as the container the tools came from was restarted when its configuration changed.
+func givenTo(out []map[string]any, owner map[string]string, words map[string]map[string]string, account string) []string {
+	var named []string
+	if len(words) == 0 {
+		return nil
+	}
+	for _, resource := range out {
+		module := owner[fmt.Sprint(resource["id"])]
+		mine := words[module]
+		if len(mine) == 0 {
+			continue
+		}
+		kind := fmt.Sprint(resource["type"])
+		if kind != "file" && kind != "directory" {
+			continue
+		}
+		path, _ := resource["path"].(string)
+		if path == "" {
+			continue
+		}
+		for _, value := range mine {
+			if kind == "file" && value == path {
+				named = append(named, fmt.Sprint(resource["id"]))
+			}
+		}
+		if _, said := resource["owner"]; said || account == "" {
+			continue
+		}
+		for _, value := range mine {
+			if value == path || strings.HasPrefix(value, strings.TrimRight(path, "/")+"/") {
+				resource["owner"] = account
+				break
+			}
+		}
+	}
+	sort.Strings(named)
+	return named
+}
diff --git a/internal/compose/resolution/runtime_health_test.go b/internal/compose/resolution/runtime_health_test.go
new file mode 100644
index 0000000..65043cf
--- /dev/null
+++ b/internal/compose/resolution/runtime_health_test.go
@@ -0,0 +1,57 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The runtime-health is composed onto <module>.own-runtime, in the words the node-engine takes; to an engine
+// that does not read health it is not sent, as for every resource.
+func TestARuntimeHealthIsComposedOntoTheModulesOwnRuntime(t *testing.T) {
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	keeper := aToolsModule(t, "keeper", "tools/index.js")
+	keeper.Tools = []string{"keeper_health"}
+	keeper.RunsAs, keeper.SecretsOwner = "keeper", "keeper"
+	keeper.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/keeper/broker"}}
+	keeper.RuntimeHealth = map[string]any{"kind": "tool", "tool": "keeper_health", "interval": "60s", "timeout": "10s",
+		"looks": 2.0}
+	for _, reads := range []bool{true, false} {
+		with := mcat.Rendering{ArtifactStore: "anchor.internal:5101", ReadsHealth: reads,
+			Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed"}, "keeper": {"broker": "own"}}}
+		out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{keeper, goRuntime}}, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		own := fileNamed(out, "keeper."+mcat.OwnRuntimeID())
+		if own == nil {
+			t.Fatalf("no own runtime: %v", ids(out))
+		}
+		h, has := own[mcat.HealthField].(map[string]any)
+		if !reads {
+			if has {
+				t.Errorf("health sent to an engine that does not read it: %v", h)
+			}
+			continue
+		}
+		if !has || h["kind"] != "tool" || h["tool"] != "keeper_health" || h["interval"] != "1m0s" ||
+			h["timeout"] != "10s" || h["looks"] != 2 || h["grace"] != "1m0s" {
+			t.Errorf("its own runtime's health: %v", own[mcat.HealthField])
+		}
+		if machine := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID()); machine[mcat.HealthField] != nil {
+			t.Errorf("the machine's runtime was given the module's health: %v", machine[mcat.HealthField])
+		}
+	}
+	// The catalogue's own manifest is not written into.
+	if _, ok := keeper.RuntimeHealth.(map[string]any)["grace"]; ok {
+		t.Error("composing wrote the defaults into the catalogue's manifest")
+	}
+}
diff --git a/internal/compose/resolution/runtime_test.go b/internal/compose/resolution/runtime_test.go
new file mode 100644
index 0000000..0075bfe
--- /dev/null
+++ b/internal/compose/resolution/runtime_test.go
@@ -0,0 +1,421 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+var bundleDigest = "sha256:" + strings.Repeat("b", 64)
+
+// aToolsModule is a module whose tools come as a compiled bundle and nothing else — the shape every
+// module takes once its tool container goes (to-be 38 WP4).
+func aToolsModule(t *testing.T, name string, entrypoints ...string) mcat.Manifest {
+	t.Helper()
+	m := mcat.Manifest{Module: name, Version: "1", Tools: []string{"status"},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{
+			{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript", Entrypoints: entrypoints},
+		}}}
+	resolved, err := m.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + name + "/tools/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return resolved
+}
+
+// theRuntime is the runtime module as the catalogue holds it: its own bundle, run rather than
+// loaded, and its broker secret to receive the node's credential in.
+func theRuntime(t *testing.T) mcat.Manifest {
+	t.Helper()
+	m := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
+			Entrypoints: []string{"src/main.js"}}}}}
+	resolved, err := m.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return resolved
+}
+
+func TestEveryToolsBundleIsDeliveredWhereTheRuntimeRuns(t *testing.T) {
+	store := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+	nftables := aToolsModule(t, "nftables", "tools/index.js")
+	zsh := aToolsModule(t, "zsh", "tools/index.js", "tools/more.js")
+
+	t.Run("with the runtime, one archive per tools bundle", func(t *testing.T) {
+		r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, zsh, theRuntime(t)}}
+		out, err := Declaration(r, store)
+		if err != nil {
+			t.Fatal(err)
+		}
+		archive := fileNamed(out, "nftables."+BundleID("tools"))
+		if archive == nil {
+			t.Fatalf("nftables' tools bundle was not delivered: %v", ids(out))
+		}
+		if archive["type"] != "archive" || archive["digest"] != bundleDigest ||
+			archive["path"] != mcat.BundleRoot+"/nftables/tools" {
+			t.Errorf("delivered as %v", archive)
+		}
+		if archive["source"] != "http://anchor.internal:5101/v2/nftables/tools/blobs/"+bundleDigest {
+			t.Errorf("fetched from %v, not through the store as this network reaches it", archive["source"])
+		}
+		if fileNamed(out, "zsh."+BundleID("tools")) == nil {
+			t.Errorf("zsh's tools bundle was not delivered: %v", ids(out))
+		}
+		// The runtime's own bundle is run, not loaded: its process delivers it, not an archive.
+		if fileNamed(out, mcat.RuntimeModule+"."+BundleID("runtime")) != nil {
+			t.Error("the runtime's own bundle was delivered as an archive beside its process")
+		}
+	})
+
+	t.Run("without the runtime, nothing changes", func(t *testing.T) {
+		r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, zsh}}
+		out, err := Declaration(r, store)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, id := range ids(out) {
+			if strings.Contains(id, BundleID("")) {
+				t.Errorf("%s was delivered to a machine running no runtime to load it", id)
+			}
+		}
+	})
+}
+
+func ids(out []map[string]any) []string {
+	var names []string
+	for _, r := range out {
+		names = append(names, r["id"].(string))
+	}
+	return names
+}
+
+// One process per machine runs the runtime from its own bundle, told what it serves and from where,
+// where its credential is, and who the operator is — restarted when any of that changes.
+func TestTheMachineRunsOneRuntimeLoadingEveryDeliveredBundle(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+	nftables := aToolsModule(t, "nftables", "tools/index.js")
+	// A bundle carrying a daemon beside its tools says which files the runtime loads.
+	showcase := mcat.Manifest{Module: "showcase", Version: "1", Tools: []string{"greet"},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "code", Kind: mcat.ArtifactBundle, Language: "typescript",
+			Entrypoints: []string{"daemon/index.js", "tools/index.js"}, Loads: []string{"tools/index.js"}}}}}
+	showcase, err := showcase.Resolve([]mcat.Built{{Name: "code", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + "showcase/code/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{nftables, showcase, theRuntime(t)}}
+	out, err := Declaration(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	if process == nil {
+		t.Fatalf("no runtime process was composed: %v", ids(out))
+	}
+	if process["type"] != "process" || process["name"] != mcat.RuntimeModule || process["digest"] != bundleDigest ||
+		process["source"] != "http://anchor.internal:5101/v2/"+mcat.RuntimeModule+"/runtime/blobs/"+bundleDigest {
+		t.Errorf("the runtime's process is %v", process)
+	}
+	if fmt.Sprint(process["run"]) != "[node src/main.js]" {
+		t.Errorf("the runtime is run as %v; its bundle's one entrypoint, by its language's interpreter", process["run"])
+	}
+	env := process["env"].(map[string]string)
+	if env[mcat.RuntimeToolModules] != "nftables="+mcat.BundleRoot+"/nftables/tools/tools/index.js,"+
+		"showcase="+mcat.BundleRoot+"/showcase/code/tools/index.js" {
+		t.Errorf("the runtime is told to serve %q: every loaded file, by module, and nothing a bundle runs", env[mcat.RuntimeToolModules])
+	}
+	if env[mcat.RuntimeBrokerFile] != "/var/lib/mesh/"+mcat.RuntimeModule+"/broker" {
+		t.Errorf("the runtime reads its credential at %q, not where the module's own secret is placed", env[mcat.RuntimeBrokerFile])
+	}
+	if env[mcat.RuntimeOperatorAccount] != "ops" || env[mcat.RuntimeOperatorHome] != "/home/ops" || process["user"] != "ops" {
+		t.Errorf("the operator is not handed to the runtime: %v as %v", env, process["user"])
+	}
+	// The credential the process reads belongs to the account it runs as, or it could not read it
+	// (to-be 38 WP3); other modules' secrets are left as their manifests say.
+	if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != "ops" {
+		t.Errorf("the runtime's credential is not the account's to read: %v", credential)
+	}
+	restarts := fmt.Sprint(process["restart-on"])
+	for _, want := range []string{"nftables." + BundleID("tools"), "showcase." + BundleID("code"), mcat.RuntimeModule + "." + mcat.NeedID("broker")} {
+		if !strings.Contains(restarts, want) {
+			t.Errorf("the runtime is not restarted when %s changes: %s", want, restarts)
+		}
+	}
+	// After every bundle and the credential, so both exist before it starts.
+	names := ids(out)
+	if names[len(names)-1] != mcat.RuntimeModule+"."+RuntimeProcessID() {
+		t.Errorf("the runtime's process is not last: %v", names)
+	}
+
+	t.Run("a machine with no account runs it as root without the operator words", func(t *testing.T) {
+		out, err := Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{nftables, theRuntime(t)}}, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+		env := process["env"].(map[string]string)
+		if _, set := env[mcat.RuntimeOperatorAccount]; set {
+			t.Error("an operator account was named on a machine that has none")
+		}
+		if _, set := process["user"]; set {
+			t.Error("a user was set on a machine with no account")
+		}
+		if credential := fileNamed(out, mcat.RuntimeModule+"."+mcat.NeedID("broker")); credential == nil || credential["owner"] != nil {
+			t.Errorf("the runtime's credential was given an owner on a machine with no account: %v", credential)
+		}
+	})
+
+	t.Run("a runtime module built wrong is refused by name", func(t *testing.T) {
+		two := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1", OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/b"}},
+			Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "typescript",
+				Entrypoints: []string{"a.js", "b.js"}}}}}
+		resolved, err := two.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+			Reference: mcat.ArtifactStoreScheme + "x/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+		if err != nil {
+			t.Fatal(err)
+		}
+		_, err = Declaration(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{resolved}}, with)
+		if err == nil || !strings.Contains(err.Error(), "entrypoint") {
+			t.Errorf("a runtime bundle with two entrypoints was composed: %v", err)
+		}
+	})
+}
+
+// novox/hq ADR 0193: the runtime is told the launcher a build wrote, and the entrypoint itself for a
+// build from before launchers — so the move needs no flag day.
+func TestTheRuntimeStartsTheLauncherWhereTheBuildWroteOne(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+	launched := mcat.Manifest{Module: "dash", Version: "1", Tools: []string{"status"},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "tools", Kind: mcat.ArtifactBundle, Language: "typescript",
+			Entrypoints: []string{"tools/index.js"}}}}}
+	launched, err := launched.Resolve([]mcat.Built{{Name: "tools", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + "dash/tools/blobs/" + bundleDigest, Digest: bundleDigest,
+		Launchers: map[string]string{"tools/index.js": "tools/index.serve.mjs"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	older := aToolsModule(t, "nftables", "tools/index.js")
+	out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{launched, older, theRuntime(t)}}, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	env := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())["env"].(map[string]string)
+	want := "dash=" + mcat.BundleRoot + "/dash/tools/tools/index.serve.mjs,nftables=" + mcat.BundleRoot + "/nftables/tools/tools/index.js"
+	if env[mcat.RuntimeToolModules] != want {
+		t.Errorf("the runtime is told %q, want %q", env[mcat.RuntimeToolModules], want)
+	}
+}
+
+// novox/hq ADR 0193: a runtime compiled to a binary runs itself from its own unpacked bundle.
+func TestARuntimeCompiledToABinaryRunsItself(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}}}
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{aToolsModule(t, "nftables", "tools/index.js"), goRuntime}}, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	process := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	if fmt.Sprint(process["run"]) != "[./node-tools]" {
+		t.Errorf("a Go runtime is run as %v, want its own binary", process["run"])
+	}
+	env := process["env"].(map[string]string)
+	if env[mcat.RuntimeToolModules] == "" || process["user"] != "ops" {
+		t.Errorf("the Go runtime is not told what to serve or whose it is: %v %v", env, process["user"])
+	}
+}
+
+// novox/hq ADR 0259 §8: a module of its own account is served by a runtime of its own — the machine's
+// runtime program, as that account, on that module's own credential — and never by the machine's runtime,
+// which runs as the operator's account and is given none of its words.
+func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	telegram := aToolsModule(t, "telegram", "tools/index.js")
+	telegram.RunsAs, telegram.SecretsOwner = "telegram", "telegram"
+	telegram.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+	out, err := Declaration(mcat.Resolution{Node: "anchor", Account: "ops",
+		Modules: []mcat.Manifest{aToolsModule(t, "nftables", "tools/index.js"), telegram, goRuntime}}, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	machine := fileNamed(out, mcat.RuntimeModule+"."+RuntimeProcessID())
+	if served := machine["env"].(map[string]string)[mcat.RuntimeToolModules]; strings.Contains(served, "telegram") || !strings.Contains(served, "nftables") {
+		t.Errorf("the machine's runtime serves %q", served)
+	}
+	own := fileNamed(out, "telegram."+mcat.OwnRuntimeID())
+	if own == nil {
+		t.Fatalf("telegram has no runtime of its own: %v", ids(out))
+	}
+	env := own["env"].(map[string]string)
+	if own["user"] != "telegram" || fmt.Sprint(own["run"]) != "[./node-tools]" ||
+		env[mcat.RuntimeBrokerFile] != "/var/lib/telegram/broker" ||
+		env[mcat.RuntimeToolModules] != "telegram="+mcat.BundleRoot+"/telegram/tools/tools/index.js" {
+		t.Errorf("its own runtime: user %v run %v env %v", own["user"], own["run"], env)
+	}
+	if _, told := env[mcat.RuntimeOperatorAccount]; told {
+		t.Error("a runtime of a module's own account is told the operator's account")
+	}
+	if _, yields := own["yields"]; yields {
+		t.Errorf("telegram holds no build seat and yields: %v", own["yields"])
+	}
+	// The build seats' holders yield (ADR 0553): idle, under the node's one share from the node-engine's build-cpu-share,
+	// and their steps are told it.
+	builder := func(name, seat string) mcat.Manifest {
+		b := aToolsModule(t, name, "tools/index.js")
+		b.RunsAs, b.SecretsOwner = name, name
+		b.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/" + name + "/broker"}}
+		b.Claims = []mcat.Claim{{Name: seat}}
+		return b
+	}
+	gob, img := builder("gob", "node-build-go"), builder("img", "node-build-image")
+	with.Needed["gob"], with.Needed["img"] = map[string]string{"broker": "own"}, map[string]string{"broker": "own"}
+	for _, c := range []struct {
+		settings mcat.SettingsBy
+		share    string
+	}{
+		{nil, "50"},
+		{mcat.SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(75)}}}}, "75"},
+		{mcat.SettingsBy{"mesh-host": {{From: "anchor", Values: map[string]any{"build-cpu-share": float64(0)}}}}, "50"},
+	} {
+		with.Settings = c.settings
+		runtimes, err := resolutionOwnRuntimes(mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{gob, img, telegram, goRuntime}}, with)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(runtimes) != 3 {
+			t.Fatalf("%d runtimes of their own, want gob's, img's and telegram's", len(runtimes))
+		}
+		for _, p := range runtimes {
+			name := fmt.Sprint(p["name"])
+			words := map[string]map[string]string{}
+			_ = json.Unmarshal([]byte(p["env"].(map[string]string)[mcat.RuntimeToolEnv]), &words)
+			mod := strings.TrimSuffix(name, "-runtime")
+			if mod == "telegram" {
+				if p["yields"] != nil || words[mod]["MESH_BUILD_CPU_SHARE"] != "" {
+					t.Errorf("telegram yields under %v: %v %v", c.settings, p["yields"], words)
+				}
+				continue
+			}
+			if got := fmt.Sprint(p["yields"]); got != "map[cpu-share:"+c.share+" priority:idle]" ||
+				words[mod]["MESH_BUILD_CPU_SHARE"] != c.share {
+				t.Errorf("%s under %v yields %s with words %v; want share %s", name, c.settings, got, words[mod], c.share)
+			}
+		}
+	}
+	with.Settings = nil
+	// Without the machine's runtime to run it from, it is refused in words.
+	if _, err := resolutionOwnRuntimes((mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{telegram}}), with); err == nil {
+		t.Error("a module of its own account composed without a runtime program")
+	}
+}
+
+// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
+// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
+func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, account := range []string{"ops", "agent"} {
+		telegram := aToolsModule(t, "telegram", "tools/index.js")
+		telegram.RunsAs, telegram.SecretsOwner = account, account
+		telegram.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+		_, err := resolutionOwnRuntimes(mcat.Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
+			Modules: []mcat.Manifest{telegram, goRuntime}}, with)
+		if err == nil || !strings.Contains(err.Error(), account) {
+			t.Errorf("telegram running as %s was composed: %v", account, err)
+		}
+	}
+}
+
+// Issue 723: the vault runs as its own account, so what the mesh writes for it — the export it keeps, the grant
+// files it holds for its consumers, and what its words name — belongs to that account, never the operator's.
+func TestWhatAModuleOfItsOwnAccountReadsIsItsAccounts(t *testing.T) {
+	with := mcat.Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{mcat.RuntimeModule: {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
+		Kept:   &mcat.KeptExport{Export: 1, OperatorKey: "k"},
+		Grants: []mcat.Grant{{Provision: "secret", Consumer: "anchor", From: "telegram", Sealed: "sealed-to-anchor",
+			Values: map[string]any{"name": "telegram"}}}}
+	goRuntime := mcat.Manifest{Module: mcat.RuntimeModule, Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/" + mcat.RuntimeModule + "/broker"}},
+		Build: &mcat.Build{Artifacts: []mcat.Artifact{{Name: "runtime", Kind: mcat.ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]mcat.Built{{Name: "runtime", Kind: mcat.ArtifactBundle,
+		Reference: mcat.ArtifactStoreScheme + mcat.RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	vault := aToolsModule(t, "vault", "tools/index.js")
+	vault.RunsAs, vault.SecretsOwner = "vault", "vault"
+	vault.OwnSecrets = mcat.OwnSecrets{"broker": {Path: "/var/lib/vault/broker"}}
+	vault.Keeps = "/var/lib/vault/root"
+	vault.Grants = map[string]string{"secret": "/var/lib/vault/grants"}
+	vault.Receives = map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}
+	vault.Bundles[0].Env = map[string]string{"MESH_RECEIVES": "/var/lib/vault/grants/mesh.json"}
+	out, err2 := Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{vault, goRuntime}}, with)
+	if err = err2; err != nil {
+		t.Fatal(err)
+	}
+	seen := 0
+	for _, r := range out {
+		path := fmt.Sprint(r["path"])
+		if !strings.HasPrefix(path, "/var/lib/vault/") || r["type"] != "file" {
+			continue
+		}
+		seen++
+		if r["owner"] != "vault" {
+			t.Errorf("%s (%v) belongs to %v, not the vault's own account", path, r["id"], r["owner"])
+		}
+	}
+	if seen < 4 {
+		t.Errorf("only %d of the vault's files were composed: %v", seen, ids(out))
+	}
+	// Carried by the machine's runtime instead, nothing of it changes: the operator's account reads them.
+	carried := vault
+	carried.RunsAs, carried.SecretsOwner = "", ""
+	out, err = Declaration(mcat.Resolution{Node: "anchor", Account: "ops", Modules: []mcat.Manifest{carried, goRuntime}}, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if path := fmt.Sprint(r["path"]); strings.HasPrefix(path, "/var/lib/vault/") && r["owner"] == "vault" {
+			t.Errorf("%s belongs to the vault's account though it runs as none", path)
+		}
+	}
+}
diff --git a/internal/compose/resolution/schedule_test.go b/internal/compose/resolution/schedule_test.go
new file mode 100644
index 0000000..a054505
--- /dev/null
+++ b/internal/compose/resolution/schedule_test.go
@@ -0,0 +1,34 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestAScheduledContainerRendersWithTheCronField(t *testing.T) {
+	// The resolver carries `schedule` into the rendered host declaration untouched, exactly as it
+	// carries run-once — a container's keys are copied through, so the host receives the field as
+	// written.
+	digest := "@sha256:" + strings.Repeat("a", 64)
+	r := mcat.Resolution{Node: "laptop", Modules: []mcat.Manifest{{
+		Module: "kometa",
+		Resources: []map[string]any{
+			{"id": "sync", "type": "container", "name": "sync",
+				"image": "registry.example/runtime" + digest, "schedule": "0 3 * * *"},
+		},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sync := indexOfID(out, "kometa.sync")
+	if sync == -1 {
+		t.Fatal("the scheduled container was lost in rendering")
+	}
+	if got, _ := out[sync]["schedule"].(string); got != "0 3 * * *" {
+		t.Errorf("schedule did not reach the host declaration: %+v", out[sync])
+	}
+}
diff --git a/internal/compose/resolution/seat_contributions.go b/internal/compose/resolution/seat_contributions.go
new file mode 100644
index 0000000..0c8b38c
--- /dev/null
+++ b/internal/compose/resolution/seat_contributions.go
@@ -0,0 +1,200 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofContribution is where a holder places a kind: ${contribution:<seat>:<kind>}. Loose inside the
+// braces, so a misspelt seat or kind is found and refused rather than written out as text.
+var ofContribution = regexp.MustCompile(`\$\{contribution:([^}]*)\}`)
+
+// receivable is what a seat receives of a kind, with the seat's canonical name; false when the seat
+// is unknown or does not receive it.
+func receivable(seat, kind string) (mcat.Seat, mcat.Receivable, bool) {
+	s, known := mcat.SeatNamed(seat)
+	if !known {
+		return mcat.Seat{}, mcat.Receivable{}, false
+	}
+	for _, r := range s.Receives {
+		if r.Kind == kind {
+			return s, r, true
+		}
+	}
+	return s, mcat.Receivable{}, false
+}
+
+// kindsOf names a seat's receivable kinds for a refusal.
+func kindsOf(s mcat.Seat) string {
+	if len(s.Receives) == 0 {
+		return "it receives no contributions"
+	}
+	var kinds []string
+	for _, r := range s.Receives {
+		kinds = append(kinds, r.Kind)
+	}
+	return "it receives " + strings.Join(kinds, ", ")
+}
+
+// seatPlaceholderProblems is what is wrong with one resource's ${contribution:…}: placed only in a
+// file's content, naming a seat and a kind it receives, and only by a module that claims that seat
+// — another would be a second writer of a file there is one of (novox/hq ADR 0212 §3).
+func seatPlaceholderProblems(m mcat.Manifest, r map[string]any) []string {
+	var problems []string
+	for _, field := range sortedKeys(r) {
+		v, ok := r[field].(string)
+		if !ok {
+			continue
+		}
+		found := ofContribution.FindAllStringSubmatch(v, -1)
+		if len(found) == 0 {
+			continue
+		}
+		if field != "content" {
+			problems = append(problems, fmt.Sprintf(
+				"%s's resource %v names %s in its %s; contributions are placed only in a file's content",
+				m.Module, r["id"], found[0][0], field))
+			continue
+		}
+		for _, f := range found {
+			seat, rest, two := strings.Cut(f[1], ":")
+			// A kind received as data may be narrowed by its shape's placing fields (novox/hq ADR 0255).
+			kind, where, _ := strings.Cut(rest, ":")
+			s, rcv, ok := receivable(seat, kind)
+			if two && ok {
+				if _, err := placeholderWhere(rcv, where); err != nil {
+					problems = append(problems, fmt.Sprintf("%s's resource %v names %s: %v", m.Module, r["id"], f[0], err))
+				}
+			}
+			if !two || !ok {
+				detail := "the mesh defines no seat " + fmt.Sprintf("%q", seat)
+				if s.Name != "" {
+					detail = s.Name + ": " + kindsOf(s)
+				}
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s; a contribution is ${contribution:<seat>:<kind>} (%s)",
+					m.Module, r["id"], f[0], detail))
+				continue
+			}
+			if !m.ClaimsSeat(s.Name) {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v names %s and %s does not claim %s; every module's contributions to a "+
+						"seat are placed by its holder alone (novox/hq ADR 0212)",
+					m.Module, r["id"], f[0], m.Module, s.Name))
+			}
+		}
+	}
+	return problems
+}
+
+// seatContributions is every module's contribution of one kind to one seat (novox/hq ADR 0212 §3):
+// in module order, each module's pieces in the order it declared them, each module's preceded by a
+// comment line naming it in the tool's grammar, and empty when nothing is contributed. A kind that
+// takes directories has each contributor's `${dir:<id>}` filled with where that module's directory
+// is on this machine (novox/hq to-be 43).
+//
+// A directory placed in a person's home is named `${machine:account-home}/…` (novox/hq to-be 29); in a
+// kind that takes directories that is filled from the machine's facts as well, so the holder reads a
+// path, never a placeholder (novox/hq ADR 0233: an item in the operator's home is backed up too).
+//
+// A kind received as data is rendered through the holder's template instead, narrowed by where
+// (novox/hq ADR 0255); and a contribution naming a capability this machine did not report is left
+// out, of either form.
+//
+// What it could not render is answered as unplaced, each naming its module and why, and left out: one
+// piece the holder's template does not know is that piece's fault, not the machine's.
+func seatContributions(modules []mcat.Manifest, holder mcat.Manifest, placeholder string, with mcat.Rendering, facts map[string]string, caps map[string]bool) (string, []string, error) {
+	seat, rest, _ := strings.Cut(placeholder, ":")
+	kind, whereText, _ := strings.Cut(rest, ":")
+	s, r, ok := receivable(seat, kind)
+	if !ok {
+		return "", nil, nil
+	}
+	if r.Shape != nil {
+		where, err := placeholderWhere(r, whereText)
+		if err != nil {
+			return "", nil, err
+		}
+		return shapedContributions(modules, holder, facts["name"], facts, s, r, where, caps)
+	}
+	var failed error
+	var unplacedLines []string
+	var blocks []textBlock
+	for _, m := range inModuleOrder(modules) {
+		var old strings.Builder
+		// A left-out module's lines are best effort (novox/hq ADR 0262): what cannot be placed is said,
+		// and the machine is declared without it. A placement setting that does not read is not
+		// replaced by the definition's own path, which may not be where the data is.
+		if m.BestEffort && r.Dirs {
+			if _, err := mcat.Places(m, with.Settings[m.Module]); err != nil {
+				unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left out, "+
+					"is not placed: its placement setting does not read (%v)", m.Module, kind, s.Name, err))
+				continue
+			}
+		}
+		for _, c := range manifestAllContributions(m) {
+			if c.Kind != kind || !capable(c, caps) {
+				continue
+			}
+			if cs, known := mcat.SeatNamed(c.Seat); !known || cs.Name != s.Name {
+				continue
+			}
+			content := c.Content
+			var lineFailed error
+			if r.Dirs {
+				filled, err := dirFill(content, dirsFor(m, with), m.Module)
+				if err != nil && lineFailed == nil {
+					lineFailed = err
+				}
+				// An operator's path the module was given, as an item of data on it (novox/hq ADR 0233).
+				if accessRef.MatchString(filled) {
+					_, byID, err := accessesFor(m, with.Settings[m.Module])
+					if err == nil {
+						filled, err = accessFill(filled, byID, m.Module)
+					}
+					if err != nil && lineFailed == nil {
+						lineFailed = err
+					}
+				}
+				for _, key := range machineUsed(filled) {
+					value, has := facts[key]
+					if !has {
+						if lineFailed == nil {
+							lineFailed = fmt.Errorf("%s's %s for %s says ${machine:%s}, and this machine says %s",
+								m.Module, kind, s.Name, key, orNothing(namesOfFacts(facts)))
+						}
+						continue
+					}
+					filled = strings.ReplaceAll(filled, "${machine:"+key+"}", value)
+				}
+				content = filled
+			}
+			if lineFailed != nil {
+				if m.BestEffort {
+					unplacedLines = append(unplacedLines, fmt.Sprintf("%s's %s for %s, kept while it is left "+
+						"out, is not placed: %v", m.Module, kind, s.Name, lineFailed))
+					continue
+				}
+				if failed == nil {
+					failed = lineFailed
+				}
+			}
+			if old.Len() == 0 {
+				fmt.Fprintf(&old, "%s %s\n", r.Comment, m.Module)
+			}
+			old.WriteString(content)
+			if !strings.HasSuffix(content, "\n") {
+				old.WriteString("\n")
+			}
+		}
+		var held []heldItem
+		if !r.Dirs {
+			held = heldItems(m, "contribution:"+s.Name+":"+kind, nil, facts, caps)
+		}
+		blocks = append(blocks, moduleBlocks(m, r.Comment, old.String(), held)...)
+	}
+	return joinBlocks(blocks), unplacedLines, failed
+}
diff --git a/internal/compose/resolution/seat_contributions_test.go b/internal/compose/resolution/seat_contributions_test.go
new file mode 100644
index 0000000..8243e2d
--- /dev/null
+++ b/internal/compose/resolution/seat_contributions_test.go
@@ -0,0 +1,62 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func hotkeysHolder() mcat.Manifest {
+	return mcat.Manifest{Module: "triggerhappy", Claims: []mcat.Claim{{Name: mcat.HotkeysSeat}}, Resources: []map[string]any{
+		{"id": "triggers", "type": "file", "path": "/etc/triggerhappy/triggers.d/mesh.conf",
+			"content": "# the mesh's triggers\n${contribution:node-hotkeys:trigger}"},
+	}}
+}
+
+func TestAContributionReachesTheHoldersFileInModuleOrderNamedByModule(t *testing.T) {
+	laptop := mcat.Manifest{Module: "laptop", Contributions: []mcat.SeatContribution{
+		{Seat: mcat.HotkeysSeat, Kind: "trigger", Content: "KEY_PROG1 1 play ${machine:account-home}"},
+		{Seat: mcat.HotkeysSeat, Kind: "trigger", Content: "KEY_F21 1 touchpad\n"},
+	}}
+	another := mcat.Manifest{Module: "another", Contributions: []mcat.SeatContribution{
+		{Seat: mcat.HotkeysSeat, Kind: "trigger", Content: "KEY_MUTE 1 mute ${shell:zsh:first}"},
+	}}
+	unrelated := mcat.Manifest{Module: "bar", Contributions: []mcat.SeatContribution{
+		{Seat: mcat.DisplaySessionSeat, Kind: "config", Content: "bar { }"},
+	}}
+	r := mcat.Resolution{Node: "laptop", Account: "op", Modules: []mcat.Manifest{hotkeysHolder(), laptop, another, unrelated}}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var file map[string]any
+	for _, res := range out {
+		if res["id"] == "triggerhappy.triggers" {
+			file = res
+		}
+	}
+	if file == nil {
+		t.Fatalf("the holder's file was not composed: %v", out)
+	}
+	// Module order; each module named once; text never read, so neither ${machine:…} nor ${shell:…}
+	// inside a contribution is filled.
+	want := "# the mesh's triggers\n" +
+		"# another\nKEY_MUTE 1 mute ${shell:zsh:first}\n" +
+		"# laptop\nKEY_PROG1 1 play ${machine:account-home}\nKEY_F21 1 touchpad\n"
+	if got := file["content"]; got != want {
+		t.Fatalf("the holder's file is\n%s\nnot\n%s", got, want)
+	}
+}
+
+func TestNoContributionPlacesNothing(t *testing.T) {
+	r := mcat.Resolution{Node: "laptop", Account: "op", Modules: []mcat.Manifest{hotkeysHolder()}}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range out {
+		if res["id"] == "triggerhappy.triggers" && res["content"] != "# the mesh's triggers\n" {
+			t.Fatalf("an empty kind left %q", res["content"])
+		}
+	}
+}
diff --git a/internal/compose/resolution/seat_data.go b/internal/compose/resolution/seat_data.go
new file mode 100644
index 0000000..1aab6a1
--- /dev/null
+++ b/internal/compose/resolution/seat_data.go
@@ -0,0 +1,230 @@
+package resolution
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"math"
+	"sort"
+	"strings"
+	"text/template"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// collectableAsText is whether a collector may name a kind received as data as a collection.
+func collectableAsText(r mcat.Receivable) bool { return r.Shape != nil && r.Shape.Text }
+
+// renderFuncs are the functions a holder's template may call. `quote` writes a value as a JSON
+// string with DEL escaped as well — JSON leaves it bare, and TOML refuses it — which makes it a valid
+// basic string in TOML and in most tools' grammars, so a contributed command with quotes or control
+// characters in it cannot break out of the holder's line.
+var renderFuncs = template.FuncMap{"quote": quote}
+
+func quote(v any) (string, error) {
+	b, err := json.Marshal(fmt.Sprint(v))
+	return strings.ReplaceAll(string(b), "\x7f", `\u007f`), err
+}
+
+// wholeIn is v as a whole number within [lo, hi]; JSON gives every number as a float.
+func wholeIn(v any, lo, hi int) (int, bool) {
+	f, ok := v.(float64)
+	if !ok {
+		if i, isInt := v.(int); isInt {
+			f, ok = float64(i), true
+		}
+	}
+	if !ok || f != math.Trunc(f) || f < float64(lo) || f > float64(hi) {
+		return 0, false
+	}
+	return int(f), true
+}
+
+// placeholderWhere parses the narrowing part of a placeholder, `bar=bottom,place=status`, against the
+// kind's shape. Empty narrows nothing.
+func placeholderWhere(r mcat.Receivable, where string) (map[string]string, error) {
+	out := map[string]string{}
+	if where == "" {
+		return out, nil
+	}
+	if r.Shape == nil {
+		return nil, fmt.Errorf("%s is text, which a placeholder does not narrow", r.Kind)
+	}
+	for _, pair := range strings.Split(where, ",") {
+		field, value, ok := strings.Cut(pair, "=")
+		var p *mcat.PlaceField
+		for i := range r.Shape.Places {
+			if r.Shape.Places[i].Field == field {
+				p = &r.Shape.Places[i]
+			}
+		}
+		switch {
+		case !ok || p == nil:
+			return nil, fmt.Errorf("%q narrows by %s, and %s is placed by %s", where, field, r.Kind, placeFields(r))
+		case !oneOf(p.Values, value):
+			return nil, fmt.Errorf("%q says %s=%s; %s is one of %s", where, field, value, field, strings.Join(p.Values, ", "))
+		case out[field] != "":
+			return nil, fmt.Errorf("%q names %s twice", where, field)
+		}
+		out[field] = value
+	}
+	return out, nil
+}
+
+func placeFields(r mcat.Receivable) string {
+	var names []string
+	for _, p := range r.Shape.Places {
+		names = append(names, p.Field)
+	}
+	return strings.Join(names, ", ")
+}
+
+// holderTemplate is the holder's template for a kind, parsed.
+func holderTemplate(holder mcat.Manifest, seat mcat.Seat, kind string) (*template.Template, error) {
+	for _, c := range holder.Claims {
+		if s, known := mcat.SeatNamed(c.Name); !known || s.Name != seat.Name {
+			continue
+		}
+		text, has := c.Renders[kind]
+		if !has || strings.TrimSpace(text) == "" {
+			break
+		}
+		t, err := template.New(seat.Name + ":" + kind).Funcs(renderFuncs).Parse(text)
+		if err != nil {
+			return nil, fmt.Errorf("%s's template for %s:%s does not parse: %v", holder.Module, seat.Name, kind, err)
+		}
+		return t, nil
+	}
+	return nil, fmt.Errorf("%s places %s:%s, which is data, and its claim gives no template for it in `renders` "+
+		"(novox/hq ADR 0255)", holder.Module, seat.Name, kind)
+}
+
+// renderPiece is one piece of data in the holder's grammar. The template sees the piece's fields,
+// `module`, the contributor, and `machine`, the node it is composed for. A value the piece does not have reads as nothing in a `with` or an `if`;
+// printed bare it would write `<no value>` into the tool's file, which is refused here instead.
+func renderPiece(t *template.Template, module, machine string, data map[string]any) (string, error) {
+	view := map[string]any{"module": module, "machine": machine}
+	for k, v := range data {
+		view[k] = v
+	}
+	var b bytes.Buffer
+	if err := t.Execute(&b, view); err != nil {
+		return "", fmt.Errorf("rendering %s's piece: %v", module, err)
+	}
+	out := b.String()
+	if strings.Contains(out, "<no value>") {
+		return "", fmt.Errorf("rendering %s's piece printed a value it does not have: %q", module, out)
+	}
+	return out, nil
+}
+
+// placedPiece is one contributed piece on its way into a holder's file.
+type placedPiece struct {
+	module string
+	data   map[string]any
+	order  int
+	// text is a moved contributor's item, rendered (collections.go heldItems): placed as it is, not through the
+	// holder's template.
+	text string
+	item bool
+}
+
+// shapedContributions is every module's data of one kind to one seat, narrowed by where and by the
+// machine's capabilities, ordered, and rendered through the holder's template — each piece under a
+// comment line naming its module.
+//
+// A piece the template renders to nothing — a `shows` the holder does not know yet — or fails on is
+// left out and answered as unplaced, naming its module: the other pieces and the rest of the machine's
+// declaration go on (novox/hq ADR 0255).
+func shapedContributions(modules []mcat.Manifest, holder mcat.Manifest, machine string, facts map[string]string, s mcat.Seat, r mcat.Receivable, where map[string]string, caps map[string]bool) (string, []string, error) {
+	var pieces []placedPiece
+	for _, m := range inModuleOrder(modules) {
+		for _, c := range manifestAllContributions(m) {
+			if c.Kind != r.Kind || !capable(c, caps) {
+				continue
+			}
+			if cs, known := mcat.SeatNamed(c.Seat); !known || cs.Name != s.Name {
+				continue
+			}
+			match := true
+			for field, value := range where {
+				if v, _ := c.Data[field].(string); v != value {
+					match = false
+				}
+			}
+			if !match {
+				continue
+			}
+			order := mcat.OrderDefault
+			if v, ok := wholeIn(c.Data[r.Shape.Order], 0, 99); ok {
+				order = v
+			}
+			pieces = append(pieces, placedPiece{module: m.Module, data: c.Data, order: order})
+		}
+		// A moved contributor's items of the kind, by their attributes (design 57 L3, issue 777): each in its
+		// module's place, by its order, then its name.
+		if !r.Dirs {
+			for _, h := range heldItems(m, "contribution:"+s.Name+":"+r.Kind, where, facts, caps) {
+				pieces = append(pieces, placedPiece{module: m.Module, order: itemOrder(h.item), text: h.text, item: true})
+			}
+		}
+	}
+	if len(pieces) == 0 {
+		return "", nil, nil
+	}
+	var t *template.Template
+	for _, p := range pieces {
+		if p.item {
+			continue
+		}
+		var err error
+		if t, err = holderTemplate(holder, s, r.Kind); err != nil {
+			return "", nil, err
+		}
+		break
+	}
+	sort.SliceStable(pieces, func(a, b int) bool { return pieces[a].order < pieces[b].order })
+	var b strings.Builder
+	var unplaced []string
+	for _, p := range pieces {
+		if p.item {
+			fmt.Fprintf(&b, "%s %s\n", r.Comment, p.module)
+			b.WriteString(p.text)
+			continue
+		}
+		out, err := renderPiece(t, p.module, machine, p.data)
+		if err == nil && strings.TrimSpace(out) == "" {
+			err = fmt.Errorf("%s's template renders nothing for it", holder.Module)
+		}
+		if err != nil {
+			unplaced = append(unplaced, fmt.Sprintf("%s's %s:%s %s is not placed by %s: %v",
+				p.module, s.Name, r.Kind, describePiece(p.data), holder.Module, err))
+			continue
+		}
+		fmt.Fprintf(&b, "%s %s\n", r.Comment, p.module)
+		b.WriteString(out)
+		if !strings.HasSuffix(out, "\n") {
+			b.WriteString("\n")
+		}
+	}
+	return b.String(), unplaced, nil
+}
+
+// describePiece is a piece in one line, its fields in order, for a person reading why it was left out.
+func describePiece(data map[string]any) string {
+	var parts []string
+	for _, k := range sortedKeys(data) {
+		if _, nested := data[k].(map[string]any); nested {
+			continue
+		}
+		parts = append(parts, fmt.Sprintf("%s=%v", k, data[k]))
+	}
+	return "(" + strings.Join(parts, " ") + ")"
+}
+
+// capable is whether a contribution applies on a machine with these capabilities: always, unless it
+// names one with `if-capability` the machine did not report (novox/hq ADR 0255). A machine whose
+// capabilities are not known has none, so a conditional piece is left out rather than guessed in.
+func capable(c mcat.SeatContribution, caps map[string]bool) bool {
+	return c.IfCapability == "" || caps[c.IfCapability]
+}
diff --git a/internal/compose/resolution/seat_data_test.go b/internal/compose/resolution/seat_data_test.go
new file mode 100644
index 0000000..4a55517
--- /dev/null
+++ b/internal/compose/resolution/seat_data_test.go
@@ -0,0 +1,108 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const barTemplate = `{{if eq .shows "battery"}}[[block]]
+block = "battery"
+{{with .options}}{{with .device}}device = {{quote .}}
+{{end}}{{end}}{{else if eq .shows "command"}}[[block]]
+block = "custom"
+command = {{quote .options.command}}
+interval = {{.options.interval}}
+{{else if eq .shows "state"}}[[block]]
+block = "custom"
+command = {{quote (printf "show %s %s" .options.state (or .options.key .machine))}}
+{{end}}`
+
+func barHolder() mcat.Manifest {
+	place := func(bar string) string {
+		return "own-first\n${contribution:node-bar:block:bar=" + bar + ",place=resources}" +
+			"own-middle\n${contribution:node-bar:block:bar=" + bar + ",place=status}own-last\n"
+	}
+	return mcat.Manifest{Module: "a-bar", Claims: []mcat.Claim{{Name: mcat.BarSeat, Renders: map[string]string{mcat.BarKindBlock: barTemplate}}},
+		Resources: []map[string]any{
+			{"id": "bottom", "type": "file", "path": "/b", "content": place("bottom")},
+			{"id": "top", "type": "file", "path": "/t", "content": place("top")},
+		}}
+}
+
+func block(data string) mcat.SeatContribution {
+	var d map[string]any
+	if err := json.Unmarshal([]byte(data), &d); err != nil {
+		panic(err)
+	}
+	return mcat.SeatContribution{Seat: mcat.BarSeat, Kind: mcat.BarKindBlock, Data: d}
+}
+
+func composedFile(t *testing.T, r mcat.Resolution, id string) string {
+	t.Helper()
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range out {
+		if res["id"] == id {
+			return res["content"].(string)
+		}
+	}
+	t.Fatalf("%s was not composed", id)
+	return ""
+}
+
+func TestResolveCarriesTheMachinesCapabilities(t *testing.T) {
+	node := workstation()
+	node.Capabilities["battery"] = true
+	r, err := Resolve(shelf(mcat.Manifest{Module: "a"}), []string{"a"}, node, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !r.Capabilities["battery"] || !r.Capabilities["seat"] {
+		t.Fatalf("the resolution carries %v, not the node's %v", r.Capabilities, node.Capabilities)
+	}
+}
+
+func TestAPieceTheHolderCannotRenderIsLeftOutAndNamedNotTheMachine(t *testing.T) {
+	// A shows the shape gained after the holder's template was written: built here, past the check.
+	power := mcat.Manifest{Module: "power", Contributions: []mcat.SeatContribution{
+		block(`{"bar":"bottom","place":"status","shows":"gpu"}`),
+		block(`{"bar":"bottom","place":"status","shows":"battery"}`),
+	}}
+	r := mcat.Resolution{Node: "n", Account: "op", Modules: []mcat.Manifest{barHolder(), power}}
+	c, err := Compose(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("one piece failed the whole machine: %v", err)
+	}
+	if len(c.Unplaced) != 1 || !strings.Contains(c.Unplaced[0], "power's node-bar:block") ||
+		!strings.Contains(c.Unplaced[0], "shows=gpu") || !strings.Contains(c.Unplaced[0], "renders nothing") {
+		t.Fatalf("unplaced: %v", c.Unplaced)
+	}
+	for _, res := range c.Resources {
+		if res["id"] == "a-bar.bottom" && !strings.Contains(res["content"].(string), `block = "battery"`) {
+			t.Fatalf("the piece beside it was lost too: %s", res["content"])
+		}
+	}
+}
+
+func TestAnOfferedBlockMakesNoDependencyOnTheBar(t *testing.T) {
+	power := mcat.Manifest{Module: "power", Contributions: []mcat.SeatContribution{
+		block(`{"bar":"bottom","place":"status","shows":"battery"}`),
+		{Seat: mcat.HotkeysSeat, Kind: "trigger", Content: "x"},
+	}}
+	for _, seat := range DependsOn(nil, power) {
+		if seat == mcat.BarSeat {
+			t.Fatalf("a block made the power module depend on the bar: %v", DependsOn(nil, power))
+		}
+	}
+	// And on a machine with no bar it is placed nowhere, and nothing fails.
+	r := mcat.Resolution{Node: "server", Account: "op", Capabilities: map[string]bool{"battery": true},
+		Modules: []mcat.Manifest{hotkeysHolder(), power}}
+	if _, err := Declaration(r, mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/compose/resolution/seat_dependencies.go b/internal/compose/resolution/seat_dependencies.go
new file mode 100644
index 0000000..a655673
--- /dev/null
+++ b/internal/compose/resolution/seat_dependencies.go
@@ -0,0 +1,219 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// appliedThrough is which seat applies a resource of each type. **Only these three**: ADR 0207
+// names them and no more. A process is supervised by the host itself, a file, a directory, an
+// archive, a user or an action is the host's own act, and a module's other kinds reach the machine
+// without a role in between — adding one here is a decision, not a refinement.
+var appliedThrough = map[string]string{
+	"service":   mcat.ServiceManagerSeat,
+	"package":   mcat.PackageManagerSeat,
+	"container": mcat.ContainerRuntimeSeat,
+}
+
+// enforceSeatDependencies is the one-line switch ADR 0207 §4 names. Off, an unmet dependency at
+// composition is *reported* — in the resolution, in `status`, once in the log — and the node still
+// resolves; on, it is refused like any unresolved requirement. Off until `status` reports none,
+// which is when the three holders are assigned to every node: switching it before then would stop
+// every machine lacking one from being sent anything at all.
+//
+// Switched on 2026-10-04, when `status` first reported no unmet dependency on any node: systemd,
+// pacman and docker were assigned to all four machines that afternoon (novox/hq to-be 42).
+//
+// A variable rather than a constant only so a test can hold both behaviours; nothing else sets it.
+var enforceSeatDependencies = true
+
+// foundationModules are the pieces genesis lays before any module exists (novox/hq ADR 0207 §5):
+// the host and the private network. Registered as modules so they can be assigned, but what they
+// declare is the installation's, not a module's, so it is never judged. The third piece, the
+// bootstrap container runtime, is not a module at all: its package and service are in the genesis
+// bundle the host applies itself, and never pass through a resolution here.
+//
+// The private network's module is overlay.Name, written out because the overlay package composes
+// on top of this one; its resources are computed, which exempts it by the rule below as well.
+var foundationModules = map[string]bool{
+	"mesh-host":      true,
+	"mesh-wireguard": true,
+}
+
+// isFoundation is whether a module's declarations are the foundation's rather than its own. A
+// module whose resources are computed is the mesh's by construction — the private network's peer
+// list and its tools are the controller's, written per node — so it counts whatever its name.
+func isFoundation(m mcat.Manifest) bool {
+	return foundationModules[m.Module] || m.Computed != ""
+}
+
+// DependsOn is every seat a module needs held on its node: derived from the resource types it
+// declares itself (novox/hq ADR 0207 §2), from what it contributes to (ADR 0210), and from what a
+// node seat it claims needs beside it — read from whichever manifest in `catalogue` declares that
+// seat (novox/hq ADR 0220, ADR 0378 §8). Sorted.
+//
+// **The module's own `resources` only**, for the first source. What the controller composes around
+// a module — its filter, jails, certificates, kept files, bundles, the guard — is the mesh's, put
+// there because the module is assigned, and depending on it would make the module answer for the
+// mesh's choices.
+func DependsOn(catalogue map[string]mcat.Manifest, m mcat.Manifest) []string {
+	if isFoundation(m) {
+		return nil
+	}
+	seen := map[string]bool{}
+	for _, r := range m.Resources {
+		if seat, applied := appliedThrough[fmt.Sprint(r["type"])]; applied {
+			seen[seat] = true
+		}
+	}
+	for _, seat := range contributedTo(m) {
+		seen[seat] = true
+	}
+	for _, seat := range neededBesideClaims(catalogue, m) {
+		seen[seat] = true
+	}
+	out := make([]string, 0, len(seen))
+	for s := range seen {
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// contributedTo is every seat a module contributes to (novox/hq ADR 0210 §3): a contribution is
+// configuration only the seat's holder applies, so it is a dependency on that seat exactly as a
+// resource is on the seat that applies it. The environment goes to node-environment's holder
+// (ADR 0203); shell code to the holder that places it for its target — the login shell's for a
+// shell, the display server's for the session's start and resources (ADR 0204, ADR 0208 §4).
+func contributedTo(m mcat.Manifest) []string {
+	var out []string
+	if e := m.Environment; e != nil && (len(e.Variables) > 0 || len(e.Path) > 0) {
+		out = append(out, mcat.EnvironmentSeat)
+	}
+	for _, c := range m.Shell {
+		out = append(out, placerOf(c.For))
+	}
+	// Any other seat's contribution (novox/hq ADR 0212 §4), by the seat's canonical name; one the
+	// mesh does not define is refused at registration and depends on nothing here.
+	// A kind the seat only offers to place makes no dependency (novox/hq ADR 0255).
+	for _, c := range m.Contributions {
+		if s, r, ok := receivable(c.Seat, c.Kind); ok && r.Offered {
+			continue
+		} else if s.Name != "" {
+			out = append(out, s.Name)
+		}
+	}
+	// And the backup holder for what is irreplaceable (novox/hq ADR 0233): it backs it up or watches the
+	// array it is on. What is valuable is backed up where a holder is — the standard plan — and makes
+	// no machine refuse it for want of one.
+	if m.NeedsBackupHolder() {
+		out = append(out, mcat.BackupSeat)
+	}
+	return out
+}
+
+// neededBesideClaims is every seat a node seat the module claims needs held on the same node
+// (novox/hq ADR 0220, ADR 0378 §8): a module-declared seat's needs are read from whichever manifest
+// in the catalogue declares that seat, never written again in the claimant's own manifest. Derived
+// from the claim, as a resource's seat is derived from its type, so a module that claims the seat
+// cannot leave the dependency out. A compiled seat carries no needs (novox/hq ADR 0378 §8).
+func neededBesideClaims(catalogue map[string]mcat.Manifest, m mcat.Manifest) []string {
+	var out []string
+	for _, seat := range nodeSeatsClaimed(m) {
+		for _, candidate := range catalogue {
+			for _, s := range candidate.DefinesSeats {
+				if s.Name == seat {
+					out = append(out, s.Needs...)
+				}
+			}
+		}
+	}
+	return out
+}
+
+// claimsSeat is whether a module claims a node seat, by its current name or one it used to have
+// (ADR 0122), so a rename leaves the dependency met.
+func claimsSeat(m mcat.Manifest, seat string) bool {
+	for _, c := range m.Claims {
+		if c.At() != mcat.ScopeNode {
+			continue
+		}
+		name := c.Name
+		if s, known := mcat.SeatNamed(name); known {
+			name = s.Name
+		}
+		if name == seat {
+			return true
+		}
+	}
+	return false
+}
+
+// PossibleHolders is every module in the catalogue that claims a seat at node scope — what a
+// refusal names as the remedy.
+func PossibleHolders(catalogue map[string]mcat.Manifest, seat string) []string {
+	var out []string
+	for name, m := range catalogue {
+		if claimsSeat(m, seat) {
+			out = append(out, name)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// UnheldDependencies is every dependency of the modules in `judged` that the node's whole set
+// leaves unmet (novox/hq ADR 0207 §3).
+//
+// **Judged over the whole set, never one module at a time.** The holders depend on each other:
+// the service manager's own package needs the package manager, and the package manager's timer
+// needs the service manager. Asked one by one, neither could ever be first; asked of the set, the
+// two assigned together meet each other. A module holding a seat it depends on meets its own
+// dependency. `judged` nil judges every module of the set.
+func UnheldDependencies(catalogue map[string]mcat.Manifest, node string, set []mcat.Manifest, judged map[string]bool) []mcat.Unheld {
+	held := map[string]bool{}
+	for _, m := range set {
+		for _, seat := range nodeSeatsClaimed(m) {
+			held[seat] = true
+		}
+	}
+	var out []mcat.Unheld
+	for _, m := range set {
+		if judged != nil && !judged[m.Module] {
+			continue
+		}
+		for _, seat := range DependsOn(catalogue, m) {
+			if held[seat] {
+				continue
+			}
+			out = append(out, mcat.Unheld{Node: node, Module: m.Module, Seat: seat,
+				Holders: PossibleHolders(catalogue, seat)})
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Module != out[j].Module {
+			return out[i].Module < out[j].Module
+		}
+		return out[i].Seat < out[j].Seat
+	})
+	return out
+}
+
+// nodeSeatsClaimed is every node seat a module claims, each by its current name (ADR 0122), so
+// a dependency on any of them — a resource's or a contribution's — is met by the claim.
+func nodeSeatsClaimed(m mcat.Manifest) []string {
+	var out []string
+	for _, c := range m.Claims {
+		if c.At() != mcat.ScopeNode {
+			continue
+		}
+		name := c.Name
+		if s, known := mcat.SeatNamed(name); known {
+			name = s.Name
+		}
+		out = append(out, name)
+	}
+	return out
+}
diff --git a/internal/compose/resolution/seat_dependencies_test.go b/internal/compose/resolution/seat_dependencies_test.go
new file mode 100644
index 0000000..c514f16
--- /dev/null
+++ b/internal/compose/resolution/seat_dependencies_test.go
@@ -0,0 +1,97 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func res(kind, id string) map[string]any {
+	r := map[string]any{"id": id, "type": kind}
+	switch kind {
+	case "service":
+		r["unit"] = id + ".service"
+	case "package":
+		r["package"] = id
+	case "container":
+		r["image"] = id
+	case "file":
+		r["path"] = "/etc/" + id
+	}
+	return r
+}
+
+func withResources(m mcat.Manifest, rs ...map[string]any) mcat.Manifest {
+	m.Resources = rs
+	return m
+}
+
+// The three holders as to-be 42 names them, each declaring what it really does: systemd's own
+// package needs the package manager, pacman's timer needs the service manager, docker's package and
+// service need both.
+func coreThree() []mcat.Manifest {
+	return []mcat.Manifest{
+		withResources(mod("systemd", nil, nil, nil, mcat.Claim{Name: mcat.ServiceManagerSeat}), res("package", "systemd")),
+		withResources(mod("pacman", nil, nil, nil, mcat.Claim{Name: mcat.PackageManagerSeat}), res("service", "pacman-refresh")),
+		withResources(mod("docker", nil, nil, nil, mcat.Claim{Name: mcat.ContainerRuntimeSeat}),
+			res("package", "docker"), res("service", "docker")),
+	}
+}
+
+func TestADependencyIsDerivedFromEachResourceTypeThatAppliesThroughASeat(t *testing.T) {
+	cases := map[string][]string{
+		"service":   {mcat.ServiceManagerSeat},
+		"package":   {mcat.PackageManagerSeat},
+		"container": {mcat.ContainerRuntimeSeat},
+		// The host's own acts, or the mesh's: nothing in between holds a role for them.
+		"file": nil, "directory": nil, "process": nil, "archive": nil, "user": nil,
+		"action": nil, "network": nil, "access": nil,
+	}
+	for kind, want := range cases {
+		got := DependsOn(nil, withResources(mod("m", nil, nil, nil), res(kind, "x")))
+		if len(got) == 0 {
+			got = nil
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Errorf("a %s resource depends on %v, want %v", kind, got, want)
+		}
+	}
+	all := DependsOn(nil, withResources(mod("m", nil, nil, nil),
+		res("container", "a"), res("service", "b"), res("package", "c"), res("package", "d")))
+	if want := []string{mcat.ContainerRuntimeSeat, mcat.PackageManagerSeat, mcat.ServiceManagerSeat}; !reflect.DeepEqual(all, want) {
+		t.Errorf("a module of every kind depends on %v, want each seat once: %v", all, want)
+	}
+}
+
+func TestStatusIsToldOfAnUnmetDependencyAndTheNodeStillResolves(t *testing.T) {
+	// Before the switch (the state the mesh ran in until every node held the three seats).
+	enforceSeatDependencies = false
+	defer func() { enforceSeatDependencies = true }()
+	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
+	cat := shelf(append(coreThree(), web)...)
+	got, err := Resolve(cat, []string{"web"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatalf("an unmet dependency refused the node before the switch: %v", err)
+	}
+	want := []mcat.Unheld{{Node: "workstation", Module: "web", Seat: mcat.ContainerRuntimeSeat, Holders: []string{"docker"}}}
+	if !reflect.DeepEqual(got.Unheld, want) {
+		t.Errorf("reported %+v, want %+v", got.Unheld, want)
+	}
+}
+
+func TestWithTheSwitchFlippedAnUnmetDependencyRefusesTheNode(t *testing.T) {
+	enforceSeatDependencies = true
+	defer func() { enforceSeatDependencies = true }()
+	web := withResources(mod("web", nil, nil, nil), res("container", "web"))
+	cat := shelf(append(coreThree(), web)...)
+	_, err := Resolve(cat, []string{"web"}, workstation(), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), mcat.ContainerRuntimeSeat) || !strings.Contains(err.Error(), "docker") {
+		t.Fatalf("with the switch on, an unmet dependency gave %v", err)
+	}
+	// Never in the first pass, whose refusals take a machine off the network instead.
+	if _, err := Resolve(cat, []string{"web"}, workstation(), mcat.World{Unchecked: true}); err != nil {
+		t.Errorf("the first pass refused an unmet dependency: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/seat_into.go b/internal/compose/resolution/seat_into.go
new file mode 100644
index 0000000..4a08686
--- /dev/null
+++ b/internal/compose/resolution/seat_into.go
@@ -0,0 +1,193 @@
+package resolution
+
+import (
+	"encoding/json"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ofSeat is where a module asks about a seat: ${seat:<seat>:<the port its holder's software uses>}.
+var ofSeat = regexp.MustCompile(`\$\{seat:([a-z0-9][a-z0-9-]*):([0-9]+)\}`)
+
+// **Where this machine reaches a mesh seat's holder** (novox/hq ADR 0222, issue 190).
+//
+// `${seat:<mesh-seat>:reach}` is host:port — the address this machine dials to reach whatever holds a
+// seat the mesh holds once. The same reasoning as the port above, one step further: nothing is
+// required, nothing is granted, no credential is minted, and the answer is an address the mesh
+// already holds in the clear and composes into every reference it built. What it is for is a module
+// that must *state* where a mesh service is to software it owns — the container runtime trusting
+// the mesh's registry is the case — without becoming that service's consumer.
+//
+// Answered for the seats in reachedSeats only. Another seat is refused by name rather than answered
+// with nothing: a module asking where something is that the mesh does not say would otherwise be
+// given an empty value and never know the question was not understood.
+//
+// The answer may be empty: no machine on the private network holds the seat yet (genesis raises
+// the store before the network). In a file written into as JSON, an empty member is dropped from
+// its list, and a list left with none is dropped, so the runtime is never told to trust "".
+var ofSeatReach = regexp.MustCompile(`\$\{seat:([a-z0-9][a-z0-9-]*):reach\}`)
+
+// reachedSeats is every seat ${seat:…:reach} answers for.
+var reachedSeats = map[string]bool{"mesh-artifact-store": true}
+
+// seatInto replaces a resource's ${seat:…} placeholders with where this machine put each seat's
+// holder — in a file's content, and in a value of a container's or a process's environment. The
+// same places portInto fills, for the same reason: they are where a program reads a number from.
+func seatInto(resource map[string]any, module string, with mcat.Rendering) error {
+	switch fmt.Sprint(resource["type"]) {
+	case "file":
+		content, ok := resource["content"].(string)
+		if !ok || (!ofSeat.MatchString(content) && !ofSeatReach.MatchString(content)) {
+			return nil
+		}
+		where := fmt.Sprintf("%s has a file that", module)
+		filled, err := seatsFilledInto(content, where, with)
+		if err != nil {
+			return err
+		}
+		if ofSeatReach.MatchString(filled) {
+			if filled, err = reachFilledInto(filled, where, with); err != nil {
+				return err
+			}
+			if fmt.Sprint(resource["into"]) == "json" {
+				if filled, err = withoutEmptyMembers(filled, where); err != nil {
+					return err
+				}
+			}
+		}
+		resource["content"] = filled
+
+	case "container", "process":
+		env, ok := resource["env"].(map[string]any)
+		if !ok {
+			return nil
+		}
+		named := make([]string, 0, len(env))
+		for key := range env {
+			named = append(named, key)
+		}
+		sort.Strings(named)
+
+		// A fresh map, and only when something changes — this map is the catalogue's, shared by
+		// every node running the module (see portInto).
+		var filled map[string]any
+		for _, key := range named {
+			written, ok := env[key].(string)
+			if !ok || (!ofSeat.MatchString(written) && !ofSeatReach.MatchString(written)) {
+				continue
+			}
+			where := fmt.Sprintf("%s's %s %s sets %s to something that",
+				module, resource["type"], resource["name"], key)
+			value, err := seatsFilledInto(written, where, with)
+			if err != nil {
+				return err
+			}
+			if value, err = reachFilledInto(value, where, with); err != nil {
+				return err
+			}
+			if filled == nil {
+				filled = map[string]any{}
+				for k, v := range env {
+					filled[k] = v
+				}
+			}
+			filled[key] = value
+		}
+		if filled != nil {
+			resource["env"] = filled
+		}
+	}
+	return nil
+}
+
+// seatsFilledInto answers every ${seat:…} in one written value.
+//
+// A port the seat's holder does not publish on this machine — or a seat nothing on it holds —
+// answers with nothing, for the reason the package comment gives. A port that is not one is
+// refused: it was written by a person and it is wrong.
+func seatsFilledInto(written, where string, with mcat.Rendering) (string, error) {
+	for _, m := range ofSeat.FindAllStringSubmatch(written, -1) {
+		seat, port := m[1], m[2]
+		wanted, err := strconv.Atoi(port)
+		if err != nil || wanted < 1 || wanted > 65535 {
+			return "", fmt.Errorf("%s says ${seat:%s:%s}, and %s is not a port", where, seat, port, port)
+		}
+		answer := ""
+		if at, known := with.Seats[seat][wanted]; known {
+			answer = strconv.Itoa(at)
+		}
+		written = strings.ReplaceAll(written, m[0], answer)
+	}
+	return written, nil
+}
+
+// reachFilledInto answers every ${seat:…:reach} in one written value with where this machine
+// reaches the seat's holder, or with nothing when no holder is reachable yet. A seat the mesh does
+// not answer this for is refused by name.
+func reachFilledInto(written, where string, with mcat.Rendering) (string, error) {
+	for _, m := range ofSeatReach.FindAllStringSubmatch(written, -1) {
+		seat := m[1]
+		if !reachedSeats[seat] {
+			known := make([]string, 0, len(reachedSeats))
+			for s := range reachedSeats {
+				known = append(known, s)
+			}
+			sort.Strings(known)
+			return "", fmt.Errorf("%s says ${seat:%s:reach}, and the mesh says where a seat's holder is "+
+				"reached only for %s (novox/hq ADR 0222)", where, seat, strings.Join(known, ", "))
+		}
+		written = strings.ReplaceAll(written, m[0], with.SeatReach[seat])
+	}
+	return written, nil
+}
+
+// withoutEmptyMembers drops every empty string from the lists at the top of a JSON object written
+// into a machine's file, and a list left with no members, so an unanswered ${seat:…:reach} adds
+// nothing to the machine's list rather than adding "".
+func withoutEmptyMembers(content, where string) (string, error) {
+	var object map[string]json.RawMessage
+	if err := json.Unmarshal([]byte(content), &object); err != nil {
+		return "", fmt.Errorf("%s is written into as JSON and is not a JSON object: %w", where, err)
+	}
+	changed := false
+	for key, raw := range object {
+		var members []json.RawMessage
+		if err := json.Unmarshal(raw, &members); err != nil {
+			continue // not a list
+		}
+		kept := make([]json.RawMessage, 0, len(members))
+		for _, member := range members {
+			var s string
+			if json.Unmarshal(member, &s) == nil && s == "" {
+				continue
+			}
+			kept = append(kept, member)
+		}
+		if len(kept) == len(members) {
+			continue
+		}
+		changed = true
+		if len(kept) == 0 {
+			delete(object, key)
+			continue
+		}
+		list, err := json.Marshal(kept)
+		if err != nil {
+			return "", err
+		}
+		object[key] = list
+	}
+	if !changed {
+		return content, nil
+	}
+	out, err := json.Marshal(object)
+	if err != nil {
+		return "", err
+	}
+	return string(out) + "\n", nil
+}
diff --git a/internal/compose/resolution/seat_into_test.go b/internal/compose/resolution/seat_into_test.go
new file mode 100644
index 0000000..77f6cb6
--- /dev/null
+++ b/internal/compose/resolution/seat_into_test.go
@@ -0,0 +1,162 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func TestASeatPlaceholderAnswersWhereThisMachinePutTheHolder(t *testing.T) {
+	control := map[string]any{
+		"type": "container", "id": "server", "name": "mesh-controller",
+		"env": map[string]any{
+			"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}",
+			"MESH_BROKER_ADDRESS_PORT":  "${seat:mesh-broker:5671}",
+			"MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
+		},
+	}
+	with := mcat.Rendering{Seats: map[string]map[int]int{
+		"mesh-store": {5432: 6852}, "mesh-broker": {5672: 5679, 5671: 5671},
+	}}
+	if err := seatInto(control, "mesh-controller", with); err != nil {
+		t.Fatal(err)
+	}
+	env := control["env"].(map[string]any)
+	for key, want := range map[string]string{
+		"MESH_STORE_INVENTORY_PORT": "6852",
+		"MESH_BROKER_ADDRESS_PORT":  "5671",
+		"MESH_STORE_INVENTORY_FILE": "/run/secrets/inventory",
+	} {
+		if env[key] != want {
+			t.Errorf("%s = %v, want %q", key, env[key], want)
+		}
+	}
+}
+
+// A seat nothing on this machine holds — or one whose holder the mesh has given no port — answers
+// with nothing, so the port genesis wrote into the connection string stands. Not the software's
+// own port: on a node given a port at genesis before the store's module exists, that would
+// override the right number with the catalogue's.
+func TestASeatTheMeshCannotPlaceAnswersWithNothing(t *testing.T) {
+	control := map[string]any{
+		"type": "container", "id": "server", "name": "mesh-controller",
+		"env": map[string]any{"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}"},
+	}
+	if err := seatInto(control, "mesh-controller", mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := control["env"].(map[string]any)["MESH_STORE_INVENTORY_PORT"]; got != "" {
+		t.Fatalf("with nothing known, the seat answered %q", got)
+	}
+	file := map[string]any{"type": "file", "content": "port=${seat:mesh-store:5432}\n"}
+	if err := seatInto(file, "x", mcat.Rendering{Seats: map[string]map[int]int{"mesh-store": {5433: 1}}}); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"]; got != "port=\n" {
+		t.Fatalf("a port the holder does not publish answered %q", got)
+	}
+}
+
+func TestASeatPlaceholderNamingNoPortIsRefused(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "${seat:mesh-store:99999}"}
+	if err := seatInto(file, "x", mcat.Rendering{}); err == nil {
+		t.Fatal("99999 was accepted as a port")
+	}
+}
+
+func TestFillingASeatLeavesTheManifestAlone(t *testing.T) {
+	env := map[string]any{"MESH_STORE_INVENTORY_PORT": "${seat:mesh-store:5432}"}
+	manifest := map[string]any{"type": "container", "id": "server", "env": env}
+	for _, at := range []int{6852, 5432} {
+		copied := map[string]any{}
+		for k, v := range manifest {
+			copied[k] = v
+		}
+		with := mcat.Rendering{Seats: map[string]map[int]int{"mesh-store": {5432: at}}}
+		if err := seatInto(copied, "mesh-controller", with); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if env["MESH_STORE_INVENTORY_PORT"] != "${seat:mesh-store:5432}" {
+		t.Fatalf("the module's own manifest was edited: %v", env)
+	}
+}
+
+func runtimeTrust() map[string]any {
+	return map[string]any{
+		"type": "file", "id": "daemon", "path": "/etc/docker/daemon.json", "into": "json",
+		"content": `{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"]}` + "\n",
+	}
+}
+
+func TestASeatsReachIsWhereThisMachineReachesItsHolder(t *testing.T) {
+	file := runtimeTrust()
+	with := mcat.Rendering{SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"}}
+	if err := seatInto(file, "docker", with); err != nil {
+		t.Fatal(err)
+	}
+	want := `{"live-restore": true, "insecure-registries": ["anchor.internal:5100"]}` + "\n"
+	if file["content"] != want {
+		t.Fatalf("content = %q, want %q", file["content"], want)
+	}
+
+	process := map[string]any{"type": "process", "name": "p",
+		"env": map[string]any{"REGISTRY": "${seat:mesh-artifact-store:reach}"}}
+	if err := seatInto(process, "x", with); err != nil {
+		t.Fatal(err)
+	}
+	if got := process["env"].(map[string]any)["REGISTRY"]; got != "anchor.internal:5100" {
+		t.Fatalf("an environment value was filled with %q", got)
+	}
+}
+
+// With no holder reachable, the runtime is not told to trust "": the member is dropped, and the
+// list with it when nothing else is in it.
+func TestAnUnansweredReachAddsNothingToAList(t *testing.T) {
+	file := runtimeTrust()
+	if err := seatInto(file, "docker", mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := file["content"]; got != `{"live-restore":true}`+"\n" {
+		t.Fatalf("with no store reachable, the runtime's keys are %q", got)
+	}
+
+	kept := map[string]any{"type": "file", "into": "json",
+		"content": `{"insecure-registries": ["${seat:mesh-artifact-store:reach}", "192.0.2.7:5000"]}`}
+	if err := seatInto(kept, "docker", mcat.Rendering{}); err != nil {
+		t.Fatal(err)
+	}
+	if got := kept["content"]; got != `{"insecure-registries":["192.0.2.7:5000"]}`+"\n" {
+		t.Fatalf("a list's other members were not kept: %q", got)
+	}
+}
+
+func TestAReachTheMeshDoesNotAnswerIsRefused(t *testing.T) {
+	file := map[string]any{"type": "file", "content": "${seat:mesh-store:reach}"}
+	err := seatInto(file, "x", mcat.Rendering{SeatReach: map[string]string{"mesh-store": "anchor.internal:5432"}})
+	if err == nil || !strings.Contains(err.Error(), "mesh-artifact-store") {
+		t.Fatalf("a reach the mesh does not answer was not refused by name: %v", err)
+	}
+}
+
+// Through the whole composition, as the container runtime's module declares it.
+func TestTheRuntimesTrustIsComposedFromTheSeatsReach(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+		Module: "docker", Resources: []map[string]any{runtimeTrust()},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{
+		SeatReach: map[string]string{"mesh-artifact-store": "anchor.internal:5100"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "docker.daemon")
+	if file == nil {
+		t.Fatalf("no file in %v", out)
+	}
+	if got := file["content"]; !strings.Contains(fmt.Sprint(got), `["anchor.internal:5100"]`) {
+		t.Fatalf("the runtime's file says %q", got)
+	}
+}
diff --git a/internal/compose/resolution/seat_pass.go b/internal/compose/resolution/seat_pass.go
new file mode 100644
index 0000000..5f80658
--- /dev/null
+++ b/internal/compose/resolution/seat_pass.go
@@ -0,0 +1,74 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// SeatsToPassOn reads the mesh for seats held once whose holder on record has left (novox/hq ADR 0449 §4).
+//
+// **A holder on record that is assigned on no machine holds nothing, and a seat that answers nothing is
+// the day a delivery removed its module.** Of such a seat, exactly one assignment in the mesh able to hold
+// it (it claims the seat at its scope and CanHold accepts it) takes it over: that is a pass, and the caller
+// records it and writes the hand act. With no such assignment the record stays; with two or more nothing is
+// recorded and the answer says so, naming both and the `seat --to` that settles it. A holder still assigned
+// anywhere changes nothing: the other claimants stand beside it, eligible and silent (ADR 0131). Only mesh
+// seats held once are read: a replicated seat's holders are added by an act (ADR 0223), a kinded bench is held
+// by its claims, and a seat with several holders on record is a store that disagrees with the mesh (refused
+// by the resolver).
+func SeatsToPassOn(holdings []mcat.Held, assignments []mcat.Assignment) ([]mcat.SeatPass, []string) {
+	assigned := map[string]bool{}
+	for _, a := range assignments {
+		assigned[a.Manifest.Module] = true
+	}
+	bySeat := map[string][]mcat.Held{}
+	var order []string
+	for _, h := range holdings {
+		s, ok := mcat.SeatNamed(h.Claim)
+		if !ok || s.Replicated || s.Scope != mcat.ScopeMesh || h.Scope != mcat.ScopeMesh || mcat.KindedBenches[s.Name] {
+			continue
+		}
+		if _, seen := bySeat[s.Name]; !seen {
+			order = append(order, s.Name)
+		}
+		bySeat[s.Name] = append(bySeat[s.Name], h)
+	}
+	sort.Strings(order)
+
+	var passes []mcat.SeatPass
+	var said []string
+	for _, name := range order {
+		recs := bySeat[name]
+		if len(recs) != 1 || assigned[recs[0].Module] {
+			continue
+		}
+		seat, _ := mcat.SeatNamed(name)
+		var claimants []mcat.Held
+		for _, a := range assignments {
+			if mcat.CanHold(a.Manifest, seat) != nil {
+				continue
+			}
+			claimants = append(claimants, mcat.Held{Claim: seat.Name, Scope: seat.Scope, Node: a.Node, Module: a.Manifest.Module})
+		}
+		sort.Slice(claimants, func(i, j int) bool {
+			if claimants[i].Node != claimants[j].Node {
+				return claimants[i].Node < claimants[j].Node
+			}
+			return claimants[i].Module < claimants[j].Module
+		})
+		switch len(claimants) {
+		case 0:
+		case 1:
+			passes = append(passes, mcat.SeatPass{Seat: seat, From: recs[0], To: claimants[0]})
+		default:
+			said = append(said, fmt.Sprintf(
+				"%s on %s is on record as the holder of %q and is assigned nowhere, and %s on %s and %s on %s both claim it "+
+					"— nothing is recorded; `seat %s --to <node>/<module>` records the one that holds it",
+				recs[0].Module, recs[0].Node, seat.Name, claimants[0].Module, claimants[0].Node,
+				claimants[1].Module, claimants[1].Node, seat.Name))
+		}
+	}
+	return passes, said
+}
diff --git a/internal/compose/resolution/seat_pass_test.go b/internal/compose/resolution/seat_pass_test.go
new file mode 100644
index 0000000..347defd
--- /dev/null
+++ b/internal/compose/resolution/seat_pass_test.go
@@ -0,0 +1,80 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func onRecord(node, module string) []mcat.Held {
+	return []mcat.Held{{Claim: "mesh-broker", Scope: mcat.ScopeMesh, Node: node, Module: module}}
+}
+
+// 1317/AC1
+func TestASeatWhoseHolderIsAssignedNowhereIsPassedToItsOnlyClaimant(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"),
+		[]mcat.Assignment{{Node: "novox", Manifest: newBroker()}})
+	if len(said) != 0 || len(passes) != 1 {
+		t.Fatalf("the only claimant was not given the seat: passes=%v said=%v", passes, said)
+	}
+	p := passes[0]
+	if p.Seat.Name != "mesh-broker" || p.From.Module != "old-broker" || p.From.Node != "novox" ||
+		p.To.Module != "new-broker" || p.To.Node != "novox" {
+		t.Fatalf("the pass does not name the seat, the former holder and the new one: %+v", p)
+	}
+}
+
+// 1317/AC2
+func TestWithTwoClaimantsAndTheHolderGoneNothingIsPassedAndTheRefusalNamesBoth(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	passes, said := SeatsToPassOn(onRecord("novox", "gone"), []mcat.Assignment{
+		{Node: "novox", Manifest: newBroker()}, {Node: "ace", Manifest: oldBroker()}})
+	if len(passes) != 0 || len(said) != 1 {
+		t.Fatalf("two claimants: passes=%v said=%v", passes, said)
+	}
+	for _, want := range []string{"old-broker", "new-broker", "seat mesh-broker --to"} {
+		if !strings.Contains(said[0], want) {
+			t.Fatalf("the refusal does not say %q: %s", want, said[0])
+		}
+	}
+}
+
+// 1317/AC3
+func TestAHolderStillAssignedSomewhereChangesNothing(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	// Assigned on another machine than the record names: still assigned somewhere.
+	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"), []mcat.Assignment{
+		{Node: "ace", Manifest: oldBroker()}, {Node: "novox", Manifest: newBroker()}})
+	if len(passes) != 0 || len(said) != 0 {
+		t.Fatalf("a holder still assigned lost its seat: passes=%v said=%v", passes, said)
+	}
+}
+
+// 1317/AC4
+func TestWithNoClaimantTheRecordStays(t *testing.T) {
+	busSeatDelivering(t, "mesh-bus")
+	passes, said := SeatsToPassOn(onRecord("novox", "old-broker"), []mcat.Assignment{
+		{Node: "novox", Manifest: mcat.Manifest{Module: "other"}}})
+	if len(passes) != 0 || len(said) != 0 {
+		t.Fatalf("with no claimant: passes=%v said=%v", passes, said)
+	}
+	// A claimant that cannot hold the seat (it does not provide what the seat delivers) is no claimant.
+	bad := mcat.Manifest{Module: "no-bus", Claims: []mcat.Claim{{Name: "mesh-broker", Scope: mcat.ScopeMesh}}}
+	passes, said = SeatsToPassOn(onRecord("novox", "old-broker"), []mcat.Assignment{{Node: "novox", Manifest: bad}})
+	if len(passes) != 0 || len(said) != 0 {
+		t.Fatalf("a module that cannot hold the seat was passed it: passes=%v said=%v", passes, said)
+	}
+}
+
+// A replicated seat is never passed: its holders are added by an act (ADR 0223).
+func TestAReplicatedSeatIsNeverPassed(t *testing.T) {
+	record := []mcat.Held{{Claim: "mesh-dns-resolver", Scope: mcat.ScopeMesh, Node: "novox", Module: "gone"}}
+	resolver := mcat.Manifest{Module: "resolver", Provides: []mcat.Offer{{Name: "wildcard-resolution", Scope: mcat.ScopeMesh}},
+		Claims: []mcat.Claim{{Name: "mesh-dns-resolver", Scope: mcat.ScopeMesh}}}
+	passes, _ := SeatsToPassOn(record, []mcat.Assignment{{Node: "novox", Manifest: resolver}})
+	if len(passes) != 0 {
+		t.Fatalf("a replicated seat was passed: %v", passes)
+	}
+}
diff --git a/internal/compose/resolution/seat_paths.go b/internal/compose/resolution/seat_paths.go
new file mode 100644
index 0000000..d1c41f9
--- /dev/null
+++ b/internal/compose/resolution/seat_paths.go
@@ -0,0 +1,125 @@
+package resolution
+
+import (
+	"fmt"
+	"path"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// declaredPaths is every machine path a module declares it owns: a resource's literal path, and a file
+// the mesh renders for it outside the operator's home. An access is not here — reading is not owning.
+//
+// **Cleaned, because the machine writes the cleaned path**: /etc//hosts, /etc/./hosts, /etc/../etc/hosts and
+// /etc/hosts/ are all /etc/hosts to it, and a seat's path is clean by its own rule, so a declaration compared
+// as written would pass for a path nobody named.
+func declaredPaths(m mcat.Manifest) map[string]bool {
+	out := map[string]bool{}
+	if m.OwnsPaths != nil {
+		// Carried: what its manifest declares, never what runs of it (issue 1126, seed-8: f1-circuits, snake and txt-game
+		// on ace owned their /var/lib paths on the node and none on the controller).
+		for _, p := range m.OwnsPaths {
+			out[p] = true
+		}
+		return out
+	}
+	for _, r := range m.Resources {
+		if p, ok := r["path"].(string); ok && strings.HasPrefix(p, "/") {
+			out[path.Clean(p)] = true
+		}
+	}
+	for _, f := range m.Facts {
+		if !f.Home && strings.HasPrefix(f.Path, "/") {
+			out[path.Clean(f.Path)] = true
+		}
+	}
+	return out
+}
+
+// DeclaredPaths is every machine path a module's manifest declares it owns (declaredPaths), sorted and never nil: what
+// a carried module owns (Manifest.OwnsPaths).
+func DeclaredPaths(m mcat.Manifest) []string {
+	return append([]string{}, sortedKeys(declaredPaths(m))...)
+}
+
+// declaresPath says whether a module declares one path, as a resource or as a file the mesh renders.
+func declaresPath(m mcat.Manifest, p string) bool { return declaredPaths(m)[p] }
+
+// pathSeats is which seats name each path: the mesh's own, and then those modules declare, in the order
+// given. A module's seat naming a path a seat already names loses it, and the refusal says so (novox/hq
+// ADR 0287 — as for a seat's name, the second declaration loses).
+func pathSeats(order []string, shelf mcat.Shelf, declaredBy map[string]string) (map[string][]string, []string) {
+	named := map[string][]string{}
+	for _, s := range mcat.Seats() {
+		for _, p := range s.Paths {
+			named[p.Path] = append(named[p.Path], s.Name)
+		}
+	}
+	var problems []string
+	for _, module := range order {
+		for _, s := range shelf[module].DefinesSeats {
+			if declaredBy != nil && declaredBy[s.Name] != module {
+				continue // a second declaration of the seat's name, refused for that already
+			}
+			for _, p := range s.Paths {
+				if others := named[p]; len(others) > 0 {
+					problems = append(problems, fmt.Sprintf(
+						"%s declares the seat %s naming the path %q, which %s already names; no two seats "+
+							"name one path (novox/hq ADR 0287)", module, s.Name, p, strings.Join(others, " and ")))
+					continue
+				}
+				named[p] = append(named[p], s.Name)
+			}
+		}
+	}
+	return named, problems
+}
+
+// unclaimedSeatPaths is each path a module declares that a seat names while it claims none of the seats
+// naming it (novox/hq ADR 0287): only a claimant declares a seat's path, and a module claiming any one of
+// them may.
+func unclaimedSeatPaths(m mcat.Manifest, named map[string][]string) []string {
+	claims := map[string]bool{}
+	for _, c := range m.Claims {
+		claims[canonicalSeat(c.Name)] = true
+	}
+	var problems []string
+	declared := declaredPaths(m)
+	for _, p := range sortedKeys(declared) {
+		seats := named[p]
+		if len(seats) == 0 {
+			continue
+		}
+		claimsOne := false
+		for _, s := range seats {
+			claimsOne = claimsOne || claims[s]
+		}
+		if !claimsOne {
+			problems = append(problems, fmt.Sprintf(
+				"%s declares the path %q, which the seat %s names, and claims none of them; only a holder of "+
+					"a seat naming a path declares it (novox/hq ADR 0287)", m.Module, p, strings.Join(seats, " and ")))
+		}
+	}
+	return problems
+}
+
+// seatPathsOnMachine is each path the modules of one machine declare that a seat names, for a module
+// claiming none of the seats naming it (novox/hq ADR 0287). Registration refuses the same of a manifest;
+// this holds what the controller generates for a machine to it too, because a computed module's resources
+// exist only once composed (checkResources is asked them there). The seats are the mesh's own and those the
+// machine's modules declare.
+func seatPathsOnMachine(modules []mcat.Manifest) []string {
+	shelf := mcat.Shelf{}
+	var order []string
+	for _, m := range modules {
+		shelf[m.Module] = m
+		order = append(order, m.Module)
+	}
+	named, _ := pathSeats(order, shelf, nil)
+	var problems []string
+	for _, m := range modules {
+		problems = append(problems, unclaimedSeatPaths(m, named)...)
+	}
+	return problems
+}
diff --git a/internal/compose/resolution/seat_paths_test.go b/internal/compose/resolution/seat_paths_test.go
new file mode 100644
index 0000000..38bfa8f
--- /dev/null
+++ b/internal/compose/resolution/seat_paths_test.go
@@ -0,0 +1,56 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+type writesHosts struct{}
+
+func (writesHosts) Resources(string) ([]map[string]any, bool, error) {
+	return []map[string]any{{"id": "hosts", "type": "file", "path": "/etc/hosts", "into": "block",
+		"content": "10.42.0.1 anchor\n"}}, true, nil
+}
+
+// The controller is bound too: what it generates for a machine on a seat's path is refused at composition.
+func TestAGeneratedResourceOnASeatsPathIsRefused(t *testing.T) {
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{
+		{Module: "mesh-names", Computed: "mesh-names"},
+	}}
+	_, err := Declaration(r, mcat.Rendering{Generators: map[string]mcat.Generator{"mesh-names": writesHosts{}}})
+	if err == nil {
+		t.Fatal("a generated resource on /etc/hosts was composed")
+	}
+	for _, want := range []string{"mesh-names", "/etc/hosts", "node-hostname"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %s: %v", want, err)
+		}
+	}
+}
+
+// The stepping back comes from the seat, and is of a rendered file only: an uplink holder declaring the
+// resolver file as a resource beside a node-resolver holder is two writers of one path, refused when the
+// machine is resolved — never composed twice — as before the seat named its paths.
+func TestAnUplinkDeclaringTheResolverFileAsAResourceIsRefusedBesideTheResolver(t *testing.T) {
+	shelf := resolverShelf(t)
+	uplink := shelf["systemd-networkd"]
+	uplink.Facts = nil
+	uplink.Resources = append(append([]map[string]any(nil), uplink.Resources...),
+		map[string]any{"id": "resolvers", "type": "file", "path": mcat.ResolverFile, "content": "nameserver 10.42.0.1\n"})
+	shelf["systemd-networkd"] = uplink
+	shelf["local-resolver"] = localResolver()
+	_, err := Resolve(shelf, []string{"dnsmasq", "systemd-networkd", "local-resolver"}, splitDNSLaptop(), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), `both declare the path "/etc/resolv.conf"`) {
+		t.Fatalf("an uplink declaring the resolver file as a resource beside the resolver was not refused: %v", err)
+	}
+	// Its rendered file steps back, by the seat's definition, and nothing else of it does.
+	rendered := mcat.Manifest{Module: "uplink", Version: "1", Claims: []mcat.Claim{{Name: "node-uplink"}},
+		Facts: map[string]mcat.RosterFile{"resolvers": {Path: "/etc//resolv.conf", Template: "x"},
+			"other": {Path: "/etc/uplink.conf", Template: "x"}}}
+	got := stepsBack(rendered, []mcat.Manifest{rendered, localResolver()})
+	if len(got.Facts) != 1 || got.Facts["other"].Path == "" {
+		t.Errorf("the uplink's holder renders %v beside the resolver", got.Facts)
+	}
+}
diff --git a/internal/compose/resolution/seats.go b/internal/compose/resolution/seats.go
new file mode 100644
index 0000000..85b5015
--- /dev/null
+++ b/internal/compose/resolution/seats.go
@@ -0,0 +1,651 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// defaultSeats is the set the mesh ships with — the seed for the control plane's seat table and the
+// fallback when it has none (novox/hq ADR 0122). It is the one place the closed set 0110 defines is
+// written; the store's table is seeded from it and thereafter is the live, editable copy.
+//
+// In the order a person reads it: the mesh's own, then a node's.
+var defaultSeats = append([]mcat.Seat{
+	// The store's first verbs (novox/hq ADR 0159): the smallest set that makes the store askable,
+	// served by whichever module holds the seat with tools of these names.
+	{Name: "mesh-store", Scope: mcat.ScopeMesh, Delivers: "postgres-database", Decision: "novox/hq ADR 0079",
+		Serves: []mcat.Verb{
+			{Name: "databases", Description: "Every database the store holds, with its on-disk size.",
+				Input: schema(map[string]string{}, nil), Replaces: []string{"psql -l"}},
+			{Name: "query", Description: "One read-only statement against one database the store holds.",
+				Input: schema(map[string]string{"database": "the database to query", "sql": "the read-only statement"},
+					[]string{"database", "sql"}), Replaces: []string{"psql"}},
+		}},
+	// **Delivers the mesh's own bus, not `amqp`.** Those were the same word until
+	// ADR 0127 separated them: `amqp` is a backing service a module may require, and this seat is
+	// the mesh's own transport. ADR 0128 then made that connection something a module requires
+	// rather than receives ambiently — 23 of the catalogue's modules never speak, and an ambient
+	// connection would mint a credential for each.
+	{Name: mcat.BrokerSeat, Scope: mcat.ScopeMesh, Delivers: "mesh-bus", Decision: "novox/hq ADR 0079"},
+	// The vault: the controller seals every minted credential with what it provides, which is the
+	// test for a seat of the mesh's own (novox/hq ADR 0161) — a second provider of `secret` is a
+	// second claimant, refused by name, rather than a candidate for a pin.
+	//
+	// Its verb `get` hands a secret on request and reply, sealed to the key the asker sends and only to an
+	// asker the vault allows (novox/hq ADR 0349 §11, issue 674). `accept`, `secret-ask`, `issued` and `rotate`
+	// take a value in and make one anew (ADR 0349 clauses 8 to 10, issue 675): the first three in two steps from
+	// the controller alone, which carries the value sealed to a key the vault made for the call and cannot open
+	// it. All optional until the vault that runs serves them (design 33 §7).
+	{Name: "mesh-vault", Scope: mcat.ScopeMesh, Delivers: "secret", Decision: "novox/hq ADR 0161",
+		Serves: []mcat.Verb{
+			{Name: "get", Optional: true, Description: "One secret, sealed to the public key the asker sends (the " +
+				"sealed box of ADR 0206), with its generation; answered only to an asker the vault allows, as the " +
+				"bus proved it. Never the value in the clear, and never to a private key.",
+				Input: schema(map[string]string{"name": "the secret's name",
+					"public_key": "the asker's X25519 public key as SPKI PEM — never a private key"},
+					[]string{"name", "public_key"})},
+			{Name: "accept", Optional: true, Description: "Take a value given at the controller's terminal, from the " +
+				"controller alone: name the secret and get a call and a key made for it, then send the call and the " +
+				"value sealed to that key. The vault alone opens it, and never remakes an accepted credential.",
+				Input: schema(vaultIntake(map[string]string{"node": "the machine, for a module's own secret",
+					"module": "the module, for a module's own secret", "name": "the secret's name in the module",
+					"provider": "the provider's machine, for a provision's credential", "provision": "the provision",
+					"by": "who gave it at the terminal",
+					"origin": "issued for a bus account the controller minted for a core or moved module and hands " +
+						"at once (ADR 0374, issue 787); left out for a value given at the terminal"}), nil)},
+			{Name: "secret-ask", Optional: true, Description: "Ask the operator for a module's own secret at a desk, " +
+				"from the controller or a caller the vault's manifest names, named as the bus proved it (novox/hq ADR " +
+				"0563 §8): the ask is recorded in the vault's store and bounded before the prompt " +
+				"opens, and what is typed is sealed to a key the vault made for the call and opens there alone.",
+				Input: schema(vaultIntake(map[string]string{"node": "the machine the secret is for",
+					"module": "the module", "name": "the secret's name in the module",
+					"desk": "the machine whose prompt asks", "asked_by": "who asked, as the bus named its caller",
+					"outcome": "instead of sealed: how the prompt ended"}), nil)},
+			{Name: "issued", Optional: true, Description: "Take the credential a provider's software issued for a " +
+				"provision, from the controller alone, which asks the provider's tool with a key the vault made for " +
+				"the call; kept as the provision's one credential, or, when the tool answers a value per holder named, " +
+				"each as that holder's own; the same value again writes nothing.",
+				Input: withHolders(schema(vaultIntake(map[string]string{"provision": "the provision",
+					"provider": "the provider's machine", "module": "the provider's module"}), nil))},
+			{Name: "rotate", Optional: true, Description: "Make a secret anew. Refused for a value a provider's " +
+				"software issued and for an accepted credential. Never answers the value.",
+				Input: schema(map[string]string{"node": "the machine, for a module's own secret", "module": "the module",
+					"name": "the secret's name in the module", "provider": "the provider's machine",
+					"provision": "the provision", "by": "who asked, when the controller carries the act"}, nil)},
+			// The move of the controller's secrets (design 57's V3, issue 676): each machine's node-engine hands in what
+			// was sealed to its machine, which the controller cannot open; the controller copies its record of asks.
+			{Name: "move-in", Optional: true, Description: "Take one value of the controller's store in, as it is, " +
+				"from the node-engine of a machine it was sealed to and no other caller: name the row, its origin " +
+				"and generation and get a call and a key made for it, then send the call, the value sealed to that " +
+				"key and a key to read back to. Never replaces a value the vault holds; answers what it kept, read " +
+				"back sealed to that key.",
+				Input: schema(vaultIntake(map[string]string{"node": "a module's own secret: its machine",
+					"module": "its module", "name": "its name in the module",
+					"provider": "a pair credential: the provider's machine", "provision": "the provision",
+					"consumer": "the consumer's machine", "consumer_module": "the consuming module",
+					"local":      "the credential's local name, when it has one",
+					"origin":     "made, accepted or issued, as the controller's store says",
+					"generation": "the controller's generation for the value", "made_at": "when it was made (RFC 3339)",
+					"read_back_to": "the second step: a raw X25519 public key the read-back is sealed to"}), nil)},
+			// A machine's node-engine states its own sealing key (novox/hq ADR 0372, issue 786).
+			{Name: "node-key", Optional: true, Description: "State this machine's sealing key to the vault, in its " +
+				"own name, from the node-engine of the machine alone: at its start and whenever the key changes. A " +
+				"first or changed key is recorded and the machine's core secrets are said changed; the same key " +
+				"again changes nothing.",
+				Input: schema(map[string]string{"key": "the machine's sealing key, a raw X25519 public key in base64"}, nil)},
+			// A machine's node-engine composes its own modules and asks their secrets sealed to its key (novox/hq ADR 0547
+			// §2, ADR 0550 §5, issue 1126); granted as buscompose's Principal.AsksItsOwnSecrets says.
+			{Name: "own", Optional: true, Description: "Answer the node-engine of one machine, about its own machine " +
+				"alone (as the bus proved the caller, never an argument), its modules' own secrets and the pair " +
+				"credentials it consumes or provides that it names, each sealed to the key it stated with node-key. A " +
+				"credential the vault does not hold is named missing; never a value in the clear.",
+				Input: map[string]any{"type": "object", "properties": map[string]any{"credentials": map[string]any{
+					"type": "array", "items": map[string]any{"type": "object"},
+					"description": "the pair credentials the machine's composition reads, each {role: consumer|provider, " +
+						"provision, consumer, consumer_module, provider, local}"}}}},
+			{Name: "move-asks", Optional: true, Description: "Copy rows of the controller's record of asks at a desk " +
+				"into the vault's, as they are and once, from the controller alone. No value is in any of them.",
+				Input: map[string]any{"type": "object", "properties": map[string]any{"asks": map[string]any{
+					"type": "array", "items": map[string]any{"type": "object"},
+					"description": "the controller's rows: id, node, module, name, desk, asked_by, opened_at, ended_at, outcome"}}}},
+			{Name: "issue-account", Optional: true, Description: "Mint one bus account the grants part wants, now (novox/hq " +
+				"ADR 0561 §9): only while the controller's lease is handed away, never a node's account or the " +
+				"controller's, never anew for one the vault holds a value or an adopted hash for. Never the value.",
+				Input: schema(map[string]string{"user": "the bus user, e.g. ace.mesh-build-go"}, []string{"user"})},
+			{Name: "sign", Optional: true, Description: "Sign with the vault's key or authority (novox/hq ADR 0550 §2): " +
+				"kind node-certificate signs the certificate of a machine's internal name, asked by that machine's " +
+				"node-engine for the serving key its record states, built from bus state alone, or by mesh-enrolment for " +
+				"a node it enrols, for the serving key the node presented at redeem (ADR 0587 §3); kind enrolment signs a " +
+				"redeem answer under its own context, for mesh-enrolment alone. Answers the certificate or the signature " +
+				"and the signer's fingerprint, and says signed; never a key.",
+				Input: schema(map[string]string{"kind": "node-certificate or enrolment",
+					"node":        "the machine, for a node certificate: the caller's own, or the node mesh-enrolment enrols",
+					"serving_key": "from mesh-enrolment: the serving key's public half the enrolling node presented",
+					"reply":       "the redeem answer's bytes in base64, for an enrolment"}, []string{"kind"})},
+			// Enrolment (novox/hq ADR 0561 §5, ADR 0587 §3, §5; issue 774): mesh-enrolment is the only caller the vault's
+			// manifest names for these two.
+			{Name: "enrolment-token", Optional: true, Description: "Make a one-time token for a node mesh-enrolment " +
+				"issues on the operator's warrant: its secret kept with its copy sealed to the operator key and its hash " +
+				"written as the bus user enrol.<node>. Answers only what the joining machine must trust (the bus's " +
+				"address, the bus certificate's fingerprint, the vault's public signing key), never the token; with " +
+				"sealed, the token sealed to the operator key, for tokens to relay; with drop, the token and its hash " +
+				"dropped, at the enrolment's end. Asked by mesh-enrolment alone, only from the lease write. The token " +
+				"carries the first tunnel mesh-enrolment built at issue (ADR 0587 §3, insight of 2026-11-02).",
+				Input: withObject(schema(map[string]string{"node": "the node the token is for",
+					"expires": "when the token expires (RFC 3339), as the enrolment's key says",
+					"sealed":  "\"true\": answer the token sealed to the operator key",
+					"drop":    "\"true\": drop the node's token and its hash"}, []string{"node"}, "sealed", "drop"),
+					"tunnel", "the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's "+
+						"public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range",
+					map[string]string{"hub_key": "the hub's tunnel public key", "hub_endpoint": "the hub's endpoint, host:port",
+						"address": "the joining node's tunnel address",
+						"key":     "the joining machine's own tunnel public key, as given at issue",
+						"range":   "the private network's range, a prefix"})},
+			{Name: "node-account", Optional: true, Description: "Mint a joining node's bus account node.<node>, sealed " +
+				"to the sealing key it presented, and write its hash; asked again for the same node and keys, answers the " +
+				"account it already minted; with retire, the account it minted for a revoked enrolment retired. Writes the " +
+				"node's node-logins key naming node.<node>. Asked by mesh-enrolment alone. Never the value in the clear.",
+				Input: schema(map[string]string{"node": "the joining node",
+					"sealing_key": "the sealing key's public half the node presented, which the account is sealed to",
+					"keys_digest": "the digest of every public key the node presented (delivery.KeysDigest)",
+					"retire":      "\"true\": retire the account minted for this node"}, []string{"node"}, "retire")},
+			// A node's account rotates over two logins (novox/hq ADR 0583 §2-§5; issue 774), one node at a time, the bus
+			// node last; the state node-logins says where each node stands.
+			{Name: "rotate-node", Optional: true, Description: "Begin a node's account rotation to its other login: " +
+				"answered only for a call carrying a hand act recorded through mesh-hand-acts, which the vault reads back by " +
+				"its id. Makes the other login's value sealed to that node, writes it rotating in node-logins and says " +
+				"rotation-begun; says node-account-ready once the bus node's have shows a list holding both logins. One " +
+				"node at a time across the mesh, the bus node last: a call while a rotation runs waits until it is done.",
+				Input: schema(map[string]string{"node": "the node whose account rotates", "why": "why, in a sentence",
+					"act": "the id of the hand act recorded for it in mesh-hand-acts"}, []string{"node", "why", "act"})},
+			{Name: "node-account-confirm", Optional: true, Description: "Confirm a node's switch to its new login: " +
+				"asked by the node-engine dialled as that login, the runtime's proof of the caller being the confirmation. " +
+				"The old login's hash is then removed, and rotation-done said once the bus node's have shows the list " +
+				"without it.",
+				Input: schema(map[string]string{}, nil)},
+			{Name: "abandon", Optional: true, Description: "Abandon a node's rotation before its old login is retired: " +
+				"the new login and its value dropped, the old one kept; a node that switched switches back first.",
+				Input: schema(map[string]string{"node": "the node whose rotation is abandoned"}, []string{"node"})},
+		}},
+	// The owner of every config value (novox/hq ADR 0348 §9, design 57 K3): its holder alone writes the buckets
+	// mesh-config_values, _resolved, _predefined and _proposals, and serves the one verb `config` (§1, §10).
+	// Optional until the mesh-config that runs serves it (design 33 §7).
+	{Name: "mesh-config", Scope: mcat.ScopeMesh, Decision: "novox/hq ADR 0348, ADR 0565",
+		Serves: []mcat.Verb{
+			{Name: "config", Optional: true, Description: "Set, clear, list or read the history of config values: " +
+				"mesh config or node config for a predefined key, or a module's own value on one node, each set " +
+				"with why, validated, and naming each module on each node whose value moves.",
+				Input: configInput()},
+		}},
+	// The provisioner's server (novox/hq ADR 0349 clause 3, design 57 P4): its holder keeps the registry of which
+	// domain answers which kind of placeholder, and the buckets mesh-provisioner_needs, _applied and _collect,
+	// which it and each machine's provisioner client (for its own machine's keys) alone write. Its one verb reads
+	// them. Optional until the mesh-provisioner that runs serves it (design 33 §7).
+	{Name: "mesh-provisioner", Scope: mcat.ScopeMesh, Decision: "novox/hq ADR 0349",
+		Serves: []mcat.Verb{
+			{Name: "provisioning", Optional: true, Description: "Read what the provisioner keeps: the registry " +
+				"(which domain answers which kind of placeholder), the needs each module on each node recorded, what " +
+				"is applied where, or the items of every collection, narrowed by node and module. Reads only.",
+				Input: schema(map[string]string{"what": "registry (when not given), needs, applied or collect",
+					"node": "a node", "module": "a module: for collect, a contributor", "collection": "for collect: a collection"}, nil)},
+		}},
+	// Named for its scope since 2026-09-30 (novox/hq ADR 0156); `the-artifact-store` resolves to it as
+	// an alias on a mesh that predates the rename. It serves artifacts of every kind a build makes —
+	// images and archives, by digest — which is why the provision is the artifact store and not an
+	// image registry.
+	{Name: "mesh-artifact-store", Scope: mcat.ScopeMesh, Delivers: "artifact-store", Decision: "novox/hq ADR 0075"},
+	{Name: "mesh-catalog", Scope: mcat.ScopeMesh, Decision: "novox/hq ADR 0121"},
+	// The delivery's owner (novox/hq ADR 0239): one commit's journey from its pull request's head to every
+	// machine, and a group of them, recorded and ordered by its holder, which asks the controller for each act.
+	// What it says it says as its module (`mesh-delivery.transition`), through the runtime that launches it.
+	{Name: mcat.DeliverySeat, Scope: mcat.ScopeMesh, Serves: deliveryVerbs(), Decision: "novox/hq ADR 0239"},
+	// Placement (novox/hq ADR 0567): which module runs on which node, state on the bus held by the assigner, changed only by
+	// a proposal the nodes answer and the operator approves. Its states and events are the holder module's.
+	{Name: mcat.PlacementSeat, Scope: mcat.ScopeMesh, Serves: placementVerbs(), Decision: "novox/hq ADR 0567"},
+	// The delivery's checker (novox/hq ADR 0547 §10, issue 774): the try is its verb, not the controller's.
+	{Name: mcat.CheckerSeat, Scope: mcat.ScopeMesh, Serves: checkerVerbs(), Decision: "novox/hq ADR 0547"},
+	// The mesh's health, out of the controller (novox/hq ADR 0564 clause 1, health_seats.go): the condition keeper, the
+	// watchman's watchdogs, the self-check and the healers.
+	{Name: mcat.ConditionsSeat, Scope: mcat.ScopeMesh, Decision: healthDecision,
+		Emits: []string{"condition-raised", "condition-changed", "condition-cleared"}, Serves: conditionsVerbs()},
+	{Name: mcat.WatchdogsSeat, Scope: mcat.ScopeMesh, Decision: healthDecision, Serves: watchdogsVerbs()},
+	{Name: mcat.SelfCheckSeat, Scope: mcat.ScopeMesh, Decision: healthDecision, Emits: []string{"checked"}, Serves: selfCheckVerbs()},
+	{Name: mcat.HealersSeat, Scope: mcat.ScopeMesh, Decision: healthDecision, Emits: []string{"healer-acted"}, Serves: healersVerbs()},
+	// The control records, out of the controller (novox/hq ADR 0565 clause 1, control_records_seats.go): a person's
+	// policy and the bus step at the assigner, and the hand-act log.
+	{Name: mcat.WantsSeat, Scope: mcat.ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"policy-changed"}, Serves: wantsVerbs()},
+	{Name: mcat.HandActsSeat, Scope: mcat.ScopeMesh, Decision: controlRecordsDecision, Emits: []string{"act-recorded"}, Serves: handActsVerbs()},
+	// Joining a machine (novox/hq ADR 0587 §1, enrolment_seat.go): held once by the module mesh-enrolment.
+	{Name: mcat.EnrolmentSeat, Scope: mcat.ScopeMesh, Decision: enrolmentDecision, Emits: mcat.EnrolmentEvents, Serves: enrolmentVerbs()},
+	// The artifact sweep (novox/hq ADR 0571 clause 2, artifact_sweep_seat.go).
+	{Name: mcat.ArtifactSweepSeat, Scope: mcat.ScopeMesh, Decision: "novox/hq ADR 0571", Emits: []string{"artifacts-gone"},
+		Serves: artifactSweepVerbs()},
+	// Deferred renames (novox/hq ADR 0121): these deliver a provision, so renaming them is a
+	// delivering-seat migration with a mesh-wide cascade if a holder stops resolving mid-flight.
+	// They keep their names until that migration is done deliberately, apart from the node-* pass.
+	{Name: "npm-package-registry", Scope: mcat.ScopeMesh, Delivers: "npm-package-registry", Decision: "novox/hq ADR 0109"},
+	{Name: "git", Scope: mcat.ScopeMesh, Delivers: "git", Decision: "novox/hq ADR 0111"},
+	// **A build node's work, one seat per build language** (novox/hq ADR 0525 §2, §10; ADR 0536 §4; issue 1887). The
+	// build module of each language claims its seat on every node it runs on; the builder and the checker put their
+	// asks on the seat's accepted kinds, which the broker derives as one work queue with a shared worker per kind, and
+	// each holder pulls delivery first, then check, then recheck, at most its node's build capacity at once. Its verbs
+	// say what the node runs and pause or resume it there: every holder pulls from the same worker, so a node's pause is
+	// its holder taking nothing, kept on the module's own pause key (issue 1887's design limit 2). They replace
+	// node-build-agent, retired with build-agent (ADR 0524 §5).
+	{Name: "node-build-go", Scope: mcat.ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("Go"),
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
+	{Name: "node-build-node", Scope: mcat.ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("Node"),
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
+	{Name: "node-build-image", Scope: mcat.ScopeNode, Accepts: buildAskKinds(), PulledByKind: true, Serves: buildSeatVerbs("image"),
+		Yields: true, Decision: "novox/hq ADR 0525, ADR 0536, ADR 0553"},
+	// **The mesh's resolvers** (novox/hq ADR 0194, 0196, 0223): every node's internal domain, and
+	// every node and container asks them and nothing else. Replicated since ADR 0223: held on more
+	// than one machine, each answering the same names from the same roster, and every machine's
+	// resolver file lists every holder — its own first — and no public resolver, so whichever answers
+	// first gives the one answer. Delivers what a machine's resolver configuration requires, so that
+	// requirement resolves to a holder wherever they are placed.
+	{Name: "mesh-dns-resolver", Scope: mcat.ScopeMesh, Delivers: "wildcard-resolution", Replicated: true,
+		Decision: "novox/hq ADR 0194, ADR 0223"},
+	// **A machine's names are one module's** (novox/hq ADR 0199, ADR 0223): its holder writes
+	// /etc/hostname and the machine's own lines in /etc/hosts, and keeps every other line of the hosts
+	// file as the operator's, changed through these three verbs on that machine alone. The controller
+	// holds none of it. Named node-hosts-file until ADR 0223; the former name resolves to it as an
+	// alias on a mesh that knew it.
+	{Name: "node-hostname", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0199, ADR 0223",
+		// The machine's names are the role's files, whatever program fills it (novox/hq ADR 0287).
+		Paths: []mcat.SeatPath{{Path: "/etc/hosts"}, {Path: "/etc/hostname"}},
+		Serves: []mcat.Verb{
+			{Name: "entries", Description: "Every line of this machine's /etc/hosts, each marked whose it is: " +
+				"the operator's, or the block of the module or tool that writes it.",
+				Input: schema(map[string]string{}, nil), Replaces: []string{"cat /etc/hosts", "getent hosts"}},
+			{Name: "add", Description: "Add one address and its names to the operator's lines of this machine's " +
+				"/etc/hosts — a name for this machine's own programs, not the mesh's.",
+				Input: schema(map[string]string{"address": "the IPv4 or IPv6 address",
+					"names": "the names for it, separated by spaces"}, []string{"address", "names"}),
+				Replaces: []string{"edit /etc/hosts", "HOSTALIASES"}},
+			{Name: "remove", Description: "Remove one name, or every line of one address, from the operator's " +
+				"lines of this machine's /etc/hosts. A line a module writes is refused, naming the module.",
+				Input: schema(map[string]string{"name": "a host name, or an address to remove every line of"},
+					[]string{"name"}), Replaces: []string{"sed -i /etc/hosts"}},
+		}},
+	// The intrusion prevention's verbs (novox/hq ADR 0179): what a person asks a machine's ban list
+	// whatever keeps it — who is banned and why, ban one address, let one go. Every holder serves all
+	// four; the jails themselves are composed from the modules the machine runs (to-be 31).
+	{Name: "node-intrusion-prevention", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0121",
+		Serves: []mcat.Verb{
+			{Name: "status", Description: "Every jail on this machine with how many it is watching and " +
+				"holding now, and the totals since the jail started; one jail's detail when named.",
+				Input: schema(map[string]string{"jail": "one jail (optional)"}, nil), Replaces: []string{"fail2ban-client status"}},
+			{Name: "banned", Description: "Every address banned on this machine right now, with the jail " +
+				"that holds it and when the ban ends.",
+				Input: schema(map[string]string{"jail": "one jail (optional)"}, nil), Replaces: []string{"fail2ban-client banned"}},
+			{Name: "ban", Description: "Ban one address in one jail now, for the jail's ban time — an " +
+				"operator's act on the live ban list, which the mesh never writes itself.",
+				Input:    schema(map[string]string{"ip": "the address", "jail": "the jail to hold it"}, []string{"ip", "jail"}),
+				Replaces: []string{"fail2ban-client set banip"}},
+			{Name: "unban", Description: "Let one address go, from one jail or from every jail when none is named.",
+				Input:    schema(map[string]string{"ip": "the address", "jail": "one jail (optional)"}, []string{"ip"}),
+				Replaces: []string{"fail2ban-client unban", "fail2ban-client set unbanip"}},
+		}},
+	// The packet filter's verbs (novox/hq ADR 0170): what a person asks a machine's filter whatever
+	// filter answers — the rules as enforced, reload the mesh's own, remove one thing the mesh did
+	// not write. Every holder serves all three; what differs by filter is the holder's own tools.
+	{Name: "node-packet-filter", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0121",
+		Serves: []mcat.Verb{
+			{Name: "rules", Description: "The packet filter as this machine enforces it now: the nftables " +
+				"ruleset and, where the tool exists, the legacy filter's listings. Narrowed to one table or " +
+				"chain when asked.",
+				Input: schema(map[string]string{"table": "one nftables table, as `family name` (optional)",
+					"chain": "one chain of that table (optional)"}, nil),
+				Replaces: []string{"nft list ruleset", "iptables -L", "iptables-save"}},
+			{Name: "reload", Description: "Load the mesh's own filter again from the file the mesh writes, " +
+				"and answer with the mesh's table as loaded.",
+				Input: schema(map[string]string{}, nil), Replaces: []string{"nft -f"}},
+			{Name: "remove", Description: "Remove one rule set the mesh did not write, named exactly as the " +
+				"host reports it (novox/hq ADR 0168) — `chain X (iptables-legacy)` or `table ip6 filter, chain " +
+				"DOCKER-USER`. Refuses the mesh's tables, the runtime's own chains, a built-in chain and an " +
+				"active found firewall's chains. An operator's act, by name, never a flush.",
+				Input:    schema(map[string]string{"where": "the rule set, as `node show` lists it"}, []string{"where"}),
+				Replaces: []string{"nft delete", "iptables -X"}},
+		}},
+	// The machine's service manager (novox/hq ADR 0177). The host applies every declared unit,
+	// system or user scope; the holder answers questions and operator acts about them, each verb
+	// taking the unit and an optional scope. The holder runs nothing of its own: its verbs are
+	// served by the node tools runtime (ADR 0175).
+	{Name: mcat.ServiceManagerSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0177",
+		Serves: serviceManagerVerbs()},
+	// The machine's package manager (novox/hq ADR 0207). A module declaring a `package` depends on
+	// it being held on its node, as one declaring a `service` depends on node-service-manager: the
+	// mesh's word for "something on this machine answers for installing", where a capability only
+	// says the software is there. No verbs yet — the seat says who answers, and what may be asked
+	// of it is decided when someone needs to ask.
+	{Name: mcat.PackageManagerSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0207"},
+	// The machine's container runtime (novox/hq ADR 0166, seeded now by ADR 0207): a module
+	// declaring a `container` depends on it being held on its node. Its verbs, and the host creating
+	// containers through its holder, wait for ADR 0166's acceptance — seeded without them so the
+	// dependency has a seat to name and the runtime's module has one to claim.
+	{Name: mcat.ContainerRuntimeSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0166, ADR 0207"},
+	// The operator account's environment (novox/hq ADR 0203): one module per machine writes it, and
+	// every module contributes to it. No verbs — the seat says who places the environment's files,
+	// and their path is its protocol: a shell sources ~/.config/mesh/environment.sh without knowing
+	// which module wrote it.
+	{Name: mcat.EnvironmentSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0203"},
+	// The provisioner client on every machine (novox/hq ADR 0349 clause 3, design 57 P5): a service of its own on a
+	// bus account of its own (mesh-controller internal/broker NodeProvisionerSeat, design 57 P3), which fills the
+	// machine's templates. It serves no verb an agent calls.
+	{Name: "node-provisioner", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0349"},
+	// The login shell (novox/hq ADR 0204, replacing the module-declared `login-shell` of ADR 0176):
+	// the mesh's, so a second shell module claims the seat rather than declaring a second one, and
+	// the seat exists whether or not zsh's definition is registered. `execute` is the contract a caller
+	// may call where the machine serves it (optional: ADR 0268); the holder places every module's shell
+	// code in its slots.
+	{Name: mcat.LoginShellSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0204",
+		Serves: loginShellVerbs()},
+	// A machine's power (novox/hq ADR 0211): its holder owns logind's power handling, places the
+	// code modules contribute for the power moments, and publishes the machine's power states as
+	// its events. Every machine has one — every machine boots and shuts down. No verbs yet.
+	{Name: mcat.PowerSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0211"},
+	// The machine's hotkeys (novox/hq ADR 0212): the daemon that sees the keys the window manager
+	// does not — a laptop's vendor keys — run by one module per machine, which owns its
+	// configuration. Every other module with keys contributes trigger lines to it.
+	{Name: mcat.HotkeysSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0212",
+		Receives: []mcat.Receivable{{Kind: "trigger", Comment: "#"}}},
+	// The machine's message bus (novox/hq ADR 0215): its holder owns the D-Bus implementation and its
+	// system service, never restarts it live, and publishes curated events about it, never its traffic.
+	// It receives nothing yet: packages ship their own policies.
+	{Name: mcat.MessageBusSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0215"},
+	// The machine's backups (novox/hq ADR 0214, to-be 43): its holder keeps nightly restore points of
+	// the data every module on the machine declares, on the machine, against mistakes rather than
+	// disasters. A module contributes `backup` lines — what to run to take a consistent copy, and
+	// which of its directories to keep.
+	{Name: mcat.BackupSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0214",
+		Serves: backupVerbs(),
+		// `backup` is what to run and which paths to keep; `data` every item a module declares, with its
+		// class, for the holder to measure (novox/hq ADR 0233). Both derived from modules' data sections.
+		Receives: []mcat.Receivable{{Kind: mcat.BackupKindBackup, Comment: "#", Dirs: true}, {Kind: mcat.BackupKindData, Comment: "#", Dirs: true}}},
+	// Deferred (novox/hq ADR 0121): renaming to mesh-private-network is a scope + server/client
+	// model change, not a rename, so it stays until that is built.
+	{Name: "the-private-network", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0110"},
+	// The program that manages the machine's own network. It delivers nothing: its holder keeps the
+	// manager and the mesh from contradicting each other — the private network's interface left
+	// alone — and writes the machine's resolver file itself, because the manager is what would
+	// otherwise rewrite it (novox/hq ADR 0223, which retired node-resolver-config into this seat).
+	// It never declares a link, an address or a wireless network, because the link is the only
+	// channel a fix could arrive on. A seat
+	// rather than a condition in the resolver's module, so a machine running two managers is
+	// refused at assignment instead of found by the resolver being rewritten (novox/hq ADR 0117).
+	//
+	// Its verbs say what the machine resolves through and over which links (novox/hq ADR 0241): the
+	// resolver file as it is and who wrote it, and every link with its addresses, routes and the resolvers
+	// the manager knows for it — the same for every holder, so a question about a machine's names is asked
+	// the same way whatever manages its network. Optional until both holders serve them.
+	//
+	// It owns the resolver file, stepping back for node-resolver where that is held (novox/hq ADR 0287,
+	// ADR 0247).
+	{Name: "node-uplink", Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0117", Serves: uplinkVerbs(),
+		Paths: []mcat.SeatPath{{Path: mcat.ResolverFile, StepsBackFor: mcat.ResolverSeat}}},
+	// The machine's own resolver (novox/hq ADR 0247): held only where something requires `split-dns` — a
+	// VPN client whose domains must go to its own servers while every other name goes to the mesh's.
+	// Where it is held, its holder writes the resolver file and the uplink's holder steps back from it
+	// (node_resolver.go). It knows nothing of any VPN: its verbs route domains to servers over a link.
+	{Name: mcat.ResolverSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0247", Serves: resolverVerbs(),
+		Paths: []mcat.SeatPath{{Path: mcat.ResolverFile}}},
+	// A machine's shares and the shares it mounts (novox/hq ADR 0263): the holder of node-nfs-server
+	// exports a machine's folders to the private network and provides each as `nfs-share`; the holder of
+	// node-mounts writes a mount and an automount unit per share on a machine that asks (shares.go).
+	{Name: mcat.NFSServerSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0263", Serves: nfsServerVerbs()},
+	{Name: mcat.MountsSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0263", Serves: mountsVerbs()},
+	// A node's files and accounts, read (novox/hq ADR 0310, reads.go): by an account of the holder's own that holds
+	// no secret, on every node, so the reads ADR 0268 §5 takes over from the login shell's execute have a tool.
+	{Name: mcat.ReadsSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0310", Serves: readsVerbs()},
+	// A node's files, read and managed (novox/hq ADR 0394, files.go): beside node-reads until mesh-files is assigned
+	// on every node, then node-reads goes (ADR 0394 §9).
+	{Name: mcat.FilesSeat, Scope: mcat.ScopeNode, Decision: "novox/hq ADR 0394", Serves: filesVerbs()},
+	// The node's engine's own verbs and asks (novox/hq ADR 0563 §1): held by the engine on every node, by no module.
+	engineSeat(),
+},
+	// The graphical session's roles (novox/hq ADR 0208), last because they are a workstation's.
+	graphicalSessionSeats()...)
+
+// seats is the working set the lookups read. It starts as the compiled defaults and is replaced by
+// what the control plane loaded from its store (novox/hq ADR 0122), so a change to the set is a
+// change to data, not to this code.
+var seats = defaultSeats
+
+// configInput is the schema of mesh-config's verb: a value of the key's own type (a number for a number, never its
+// text), and a limit that is a number; every other argument a string.
+func configInput() map[string]any {
+	in := schema(map[string]string{"action": "list (when not given), set, clear or history",
+		"key": "the config key", "value": "for set: the value, of the key's type",
+		"module": "a module: its own value, with node", "node": "a node",
+		"why": "for set and clear: why", "by": "who gave the value at the controller's terminal",
+		"limit": "for history: at most this many, newest"}, nil)
+	props := in["properties"].(map[string]any)
+	props["value"] = map[string]any{"description": "for set: the value, of the key's type: a number, a string, " +
+		"a boolean, or for a trusted key an object or a list"}
+	props["limit"] = map[string]any{"type": "number", "description": "for history: at most this many, newest"}
+	return in
+}
+
+func providesAt(m mcat.Manifest, provision, scope string) bool {
+	for _, o := range m.Provides {
+		if o.Name == provision && o.At() == scope {
+			return true
+		}
+	}
+	return false
+}
+
+// HolderAmong is which of several providers of a provision holds the seat that delivers it.
+//
+// Found by the (node, module) pair, because a provider is identified by both (novox/hq to-be 23):
+// two modules on one node could both provide a provision, and only the one holding the seat
+// answers for it. Nothing when no seat delivers the provision, when nobody holds
+// it, or when the holder is not among the providers offered.
+//
+// **The first holder in the providers' own order** (novox/hq ADR 0223). A replicated seat has
+// several, and the answer must not depend on the order the mesh happened to resolve its machines
+// in: the providers come sorted by machine, so every consumer is bound to the same one. A seat with
+// one holder gets the same answer as before.
+func HolderAmong(provision string, providers []mcat.Provider, held []mcat.Held) (mcat.Provider, bool) {
+	seat, delivered := mcat.SeatDelivering(provision)
+	if !delivered {
+		return mcat.Provider{}, false
+	}
+	for _, p := range providers {
+		for _, h := range held {
+			// Resolve the held claim to a seat rather than comparing names, so a record naming a
+			// seat's former name still matches it after a rename (novox/hq ADR 0122).
+			hs, ok := mcat.SeatNamed(h.Claim)
+			if !ok || hs.Name != seat.Name || h.Scope != seat.Scope {
+				continue
+			}
+			if p.Node == h.Node && p.Module == h.Module {
+				return p, true
+			}
+		}
+	}
+	return mcat.Provider{}, false
+}
+
+// serviceManagerVerbs is the contract every holder of node-service-manager serves (novox/hq ADR
+// 0177): the units on the machine in both scopes, read and acted on by name. Every verb takes an
+// optional scope — "system" when absent, "user" for the operator account's own manager — so a
+// caller asks for a user unit the way it asks for a system one; `failed` alone reads both managers
+// when none is named. `failed`, `reset-failed`, `wanted-by` and `unlink-dangling` are optional
+// (Verb.Optional) until every holder serves them (ADR 0246).
+func serviceManagerVerbs() []mcat.Verb {
+	scoped := func(more map[string]string, required []string) map[string]any {
+		props := map[string]string{"scope": "\"system\" (the default) or \"user\": the operator account's own manager"}
+		for k, v := range more {
+			props[k] = v
+		}
+		return schema(props, required)
+	}
+	unit := map[string]string{"unit": "the unit's name, as the service manager knows it"}
+	return []mcat.Verb{
+		{Name: "units", Description: "The units the service manager knows in a scope, each with its load, active and sub state; narrowed to a pattern when asked.",
+			Input: scoped(map[string]string{"pattern": "a glob the unit's name must match (optional)"}, nil), Replaces: []string{"systemctl list-units"}},
+		{Name: "status", Description: "One unit as the service manager sees it now: its states, whether it starts at boot, its main process, and whether the mesh declares it.",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl status", "systemctl is-active"}},
+		{Name: "start", Description: "Start one unit. For a unit the mesh declares, the answer says the host will restore what its declaration says at the next apply.",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl start"}},
+		{Name: "stop", Description: "Stop one unit; for a mesh-declared unit the answer says the host will restore its declared state.",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl stop"}},
+		{Name: "restart", Description: "Restart one unit.",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl restart"}},
+		{Name: "enable", Description: "Make one unit start at boot (or at the account's login, in user scope).",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl enable"}},
+		{Name: "disable", Description: "Stop one unit starting at boot (or at login, in user scope).",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl disable"}},
+		// **A window, not only a tail** (the operator's direction 2026-10-07): an incident is read for the
+		// minutes it happened in, and with no window on the verb a person reached for a shell. Every
+		// argument is the holder's to validate — passed to journalctl as one word of its own, never through
+		// a shell — and what the unit printed of a secret is redacted before it is answered.
+		{Name: "journal", Description: "The last lines of one unit's journal (at most 2000), in a time window and " +
+			"narrowed to a priority and to lines holding a text when asked. A secret the unit printed is shown as " +
+			"[redacted: <what it was>].",
+			Input: scoped(map[string]string{
+				"unit":     unit["unit"],
+				"lines":    "how many lines from the end of what matches (default 100, at most 2000)",
+				"since":    "the window's start: an RFC 3339 time (2026-10-07T09:30:00Z) or relative to now (-30min, -2h, yesterday) (optional)",
+				"until":    "the window's end, in the same forms (optional; now when absent)",
+				"match":    "only the lines holding this text, as written — a fixed string, not a pattern (optional)",
+				"priority": "only entries this severe or more: 0-7 or emerg, alert, crit, err, warning, notice, info, debug (optional)",
+			}, []string{"unit"}),
+			Replaces: []string{"journalctl"}},
+		// What has failed, on the seat rather than as one holder's own tool: whatever holds the role answers
+		// it, so a caller asks every machine the same way. **Optional while its holders catch up**: the
+		// systemd module running today serves it as its own systemd_failed, and a required verb would
+		// refuse it before the version serving `failed` could be delivered.
+		{Name: "failed", Optional: true, Description: "Every failed unit on this machine, in the system manager and in the operator " +
+			"account's; a manager that does not answer is reported with its error, never as nothing failed.",
+			Input:    schema(map[string]string{"scope": "\"system\" or \"user\": only that manager (both when absent)"}, nil),
+			Replaces: []string{"systemctl --failed"}},
+		// **Clearing a failed record, and finding what starts a unit** (novox/hq issue 332): a unit whose
+		// file is gone stays failed in its manager until the record is reset, and what keeps asking for it
+		// is a dependency or an enable link no verb could show. Required since every holder serves them
+		// (ADR 0246 step 3).
+		{Name: "reset-failed", Description: "Clear one unit's failed record in its manager — " +
+			"its failed state and its start-limit count — and answer its state after. It removes no file and " +
+			"starts nothing.",
+			Input: scoped(unit, []string{"unit"}), Replaces: []string{"systemctl reset-failed"}},
+		{Name: "wanted-by", Description: "What wants, requires or triggers one unit, read-only: the " +
+			"manager's reverse dependencies (WantedBy, RequiredBy, UpheldBy, BoundBy, TriggeredBy and the rest) and " +
+			"every enable link naming it in the scope's configuration directories (*.wants, *.requires, *.upholds), " +
+			"each with where it points and whether it dangles — the account's own directory included in user scope.",
+			Input: scoped(unit, []string{"unit"}),
+			Replaces: []string{"systemctl list-dependencies --reverse", "systemctl show -p WantedBy",
+				"ls ~/.config/systemd/user/*.wants"}},
+		// **A dangling enable link removed on the person's word** (novox/hq issue 332): `systemctl disable`
+		// leaves a link whose unit file is gone, so the manager keeps asking for the unit. Required since
+		// every holder serves it (ADR 0246 step 3).
+		{Name: "unlink-dangling", Description: "Remove the dangling enable links named for one " +
+			"unit — links in a *.wants, *.requires or *.upholds directory of the account's or the machine's own " +
+			"configuration whose target does not exist, which `disable` leaves once the unit's file is gone — on " +
+			"the person's word: `why` is required. Each is recorded (its path, its target, the reason) before it is " +
+			"removed, and the manager reloaded; a link whose target exists, or one a package, a generator or the " +
+			"runtime placed, is left and said.",
+			Input: scoped(map[string]string{"unit": unit["unit"],
+				"why": "the person's reason for removing the links, kept in the record"}, []string{"unit", "why"}),
+			Replaces: []string{"rm ~/.config/systemd/user/*.wants/<unit>", "unlink /etc/systemd/system/*.wants/<unit>"}},
+	}
+}
+
+// uplinkVerbs is the contract every holder of node-uplink serves (novox/hq ADR 0241): read-only answers
+// about what the machine resolves through and over which links, whatever program manages its network.
+func uplinkVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "resolvers", Description: "The machine's resolver file as it is now: the resolvers, search " +
+			"domains and options it lists, whether it is the file the mesh declares, and when it is not, who " +
+			"wrote it as far as the machine shows — its header, a backup a VPN client left beside it, a link " +
+			"in its place, a known writer running.",
+			Input: schema(nil, nil), Optional: true},
+		{Name: "links", Description: "Every network link on the machine: its state, its addresses, whether " +
+			"the default route leaves through it, and the resolvers and search domains the network manager " +
+			"knows for it — a VPN's tunnel included.",
+			Input: schema(nil, nil), Optional: true},
+	}
+}
+
+// backupVerbs is the node-backup seat's protocol (novox/hq to-be 43): what is kept, take one now,
+// and restore beside the live data — never over it.
+func backupVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "backed-up", Description: "What this machine backs up: each module, what it declared, " +
+			"its last good night, how many restore points are kept and the repository's size.",
+			Input: schema(map[string]string{"module": "one module (optional)"}, nil), Replaces: []string{"restic snapshots"}},
+		{Name: "now", Description: "Take a backup now, of one module or of every module on this " +
+			"machine — before a migration, a retirement or anything else that could go wrong.",
+			Input: schema(map[string]string{"module": "one module (optional)"}, nil), Replaces: []string{"restic backup"}},
+		{Name: "restore", Description: "Restore one module's data from a restore point BESIDE the live " +
+			"data, never over it: each directory as <path>.restored-<date>. Swapping it in is a " +
+			"person's act. Lists the restore points when none is named.",
+			Input: schema(map[string]string{
+				"module":   "the module",
+				"snapshot": "the restore point (from `backed-up`; the newest when omitted)",
+				"path":     "one of the module's directories (all of them when omitted)",
+			}, []string{"module"}), Replaces: []string{"restic restore"}},
+	}
+}
+
+// loginShellVerbs is the contract of node-login-shell (novox/hq ADR 0176, ADR 0204): one command, run
+// the way the operator's own terminal would run it, bounded below the runtime's thirty-second call limit
+// so a hung command answers rather than times the caller out.
+//
+// **`execute` is optional** (novox/hq ADR 0268). It runs any command as the operator account, which can
+// become root without a person, so a machine may withhold it: the control-node does, through the
+// holder's own `execute` setting, until a call to it needs a person's approval (hq research 039). The mark
+// is ADR 0246's: a holder that does not serve the verb on a machine still holds the seat there, and its
+// silence on the bus is not judged — a holder withholding it serves nothing on the seat.
+func loginShellVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "execute", Optional: true, Description: "Run one command on this machine as the operator account, in a " +
+			"non-interactive login shell in its home; answers with what it printed and how it exited.",
+			Input: schema(map[string]string{
+				"command":         "the command line, as you would type it",
+				"timeout_seconds": "give up after this long, at most 25 (default 20)",
+			}, []string{"command"})},
+	}
+}
+
+// buildAskKinds are a build seat's accepted kinds, in the order a holder pulls them (ADR 0536 §4; mesh-sdk
+// delivery.AskKinds).
+func buildAskKinds() []string { return []string{"delivery", "check", "recheck"} }
+
+// buildSeatVerbs are what a build module answers on its own node for its seat (ADR 0525 §10).
+func buildSeatVerbs(language string) []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "current", Description: "The " + language + " asks this node runs now (each ask's id, kind, module and when it " +
+			"started), its build capacity, and whether it is paused, taking no new ask.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "pause", Description: "Take no new " + language + " ask on this node until resumed; an ask running here " +
+			"ends in its place. Kept across a restart of the build module (its pause key). A capacity of 0 is the " +
+			"lasting way to keep a node from building.",
+			Input: schema(map[string]string{}, nil)},
+		{Name: "resume", Description: "Take " + language + " asks again on this node.",
+			Input: schema(map[string]string{}, nil)},
+	}
+}
+
+// vaultIntake is a two-step vault verb's arguments: what its first step names, then the call and what was sealed.
+// withHolders adds to `issued` the provision's holders from that provider (issue 749): a provider's tool may answer a
+// value for each, which the vault keeps as that holder's own and hands to it alone.
+func withHolders(input map[string]any) map[string]any {
+	props, _ := input["properties"].(map[string]any)
+	props["holders"] = map[string]any{"type": "array",
+		"description": "the provision's holders from that provider, each {node, module}: its tool may answer a value " +
+			"for each, kept as that holder's own and handed to it alone",
+		"items": map[string]any{"type": "object", "properties": map[string]any{
+			"node":   map[string]any{"type": "string", "description": "the holder's machine"},
+			"module": map[string]any{"type": "string", "description": "the consuming module"}}}}
+	return input
+}
+
+func vaultIntake(first map[string]string) map[string]string {
+	out := map[string]string{"call": "the second step: the call the first step answered",
+		"sealed": "the second step: the value sealed to the call's key — never the value"}
+	for k, v := range first {
+		out[k] = v
+	}
+	return out
+}
diff --git a/internal/compose/resolution/seats_test.go b/internal/compose/resolution/seats_test.go
new file mode 100644
index 0000000..8c3cdd5
--- /dev/null
+++ b/internal/compose/resolution/seats_test.go
@@ -0,0 +1,72 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func registryShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "gitea", Version: "1", Provides: mcat.FromAnywhere("npm-package-registry"),
+		Claims: []mcat.Claim{{Name: "npm-package-registry", Scope: mcat.ScopeMesh}}}, mcat.Manifest{Module: "verdaccio", Version: "1", Provides: mcat.FromAnywhere("npm-package-registry")}, mcat.Manifest{Module: "builder", Version: "1", Requires: []string{"npm-package-registry"}},
+	)
+}
+
+func twoRegistries() map[string][]mcat.Provider {
+	return map[string][]mcat.Provider{"npm-package-registry": {
+		{Node: "anchor", At: "anchor.internal", Module: "gitea"},
+		{Node: "archive", At: "archive.internal", Module: "verdaccio"},
+	}}
+}
+
+func giteaHoldsTheSeat() []mcat.Held {
+	return []mcat.Held{{Claim: "npm-package-registry", Scope: mcat.ScopeMesh, Node: "anchor", Module: "gitea"}}
+}
+
+func TestTheSeatsHolderAnswersWhenSeveralProvide(t *testing.T) {
+	// The whole point: a second registry beside the holder harms nothing, and nobody pins.
+	got, err := Resolve(registryShelf(), []string{"builder"}, reachable(), mcat.World{Offered: twoRegistries(), Held: giteaHoldsTheSeat()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 || got.Needs[0].From != "anchor" {
+		t.Fatalf("the seat's holder did not answer: %v", got.Needs)
+	}
+}
+
+func TestAPinStillWinsOverTheSeat(t *testing.T) {
+	// A consumer coupled to one provider's contents has said so, and the seat does not overrule it.
+	got, err := Resolve(registryShelf(), []string{"builder"}, reachable(), mcat.World{Offered: twoRegistries(), Held: giteaHoldsTheSeat(),
+		Pinned: map[string]mcat.Chosen{"npm-package-registry": {Node: "archive", Module: "verdaccio"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 1 || got.Needs[0].From != "archive" {
+		t.Fatalf("the pin was overruled by the seat: %v", got.Needs)
+	}
+}
+
+func TestWithTheSeatUnheldSeveralProvidersAreStillRefused(t *testing.T) {
+	// No seat held is no choice made, and ADR 0009's rule stands: never guessed.
+	_, err := Resolve(registryShelf(), []string{"builder"}, reachable(), mcat.World{Offered: twoRegistries()})
+	if err == nil {
+		t.Fatal("one of two registries was picked with nobody holding the seat")
+	}
+	if !strings.Contains(err.Error(), "pin") {
+		t.Fatalf("the refusal does not say how to choose: %v", err)
+	}
+}
+
+func TestTheHolderIsTheModuleNotTheMachine(t *testing.T) {
+	// Two modules on one machine could provide the same thing; only the one holding the seat
+	// answers. A holder matched by node alone would send consumers to whichever came first.
+	providers := []mcat.Provider{
+		{Node: "anchor", At: "anchor.internal", Module: "verdaccio"},
+		{Node: "anchor", At: "anchor.internal", Module: "gitea"},
+	}
+	holder, held := HolderAmong("npm-package-registry", providers, giteaHoldsTheSeat())
+	if !held || holder.Module != "gitea" {
+		t.Fatalf("the holder was not told apart from a neighbour: %+v", holder)
+	}
+}
diff --git a/internal/compose/resolution/secret_family_test.go b/internal/compose/resolution/secret_family_test.go
new file mode 100644
index 0000000..1e3a846
--- /dev/null
+++ b/internal/compose/resolution/secret_family_test.go
@@ -0,0 +1,44 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func familyManifest(t *testing.T, ownSecrets string) (mcat.Manifest, error) {
+	t.Helper()
+	return decodeForTest([]byte(`{"module":"mounts","version":"1","own-secrets":{` + ownSecrets + `}}`))
+}
+
+// A member given is one file at its path; one not given is nothing, and the machine still composes — the mesh never
+// makes a member.
+func TestAMemberGivenIsPlacedAndOneNotGivenIsNothing(t *testing.T) {
+	m, err := familyManifest(t, `"smb-password-*":{"path":"/var/lib/mounts/smb-password-*.secret","issued-by":"outside"}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{m}}
+	out, err := Declaration(r, mcat.Rendering{Needed: map[string]map[string]string{"mounts": {"smb-password-games": "sealed"}}})
+	if err != nil {
+		t.Fatalf("a module with one member given did not compose: %v", err)
+	}
+	var paths []string
+	for _, res := range out {
+		if res["sealed"] != nil {
+			paths = append(paths, res["path"].(string))
+		}
+	}
+	if len(paths) != 1 || paths[0] != "/var/lib/mounts/smb-password-games.secret" {
+		t.Fatalf("placed: %v", paths)
+	}
+	out, err = Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("a module with no member given did not compose: %v", err)
+	}
+	for _, res := range out {
+		if res["sealed"] != nil {
+			t.Fatalf("a member nobody gave was placed: %v", res)
+		}
+	}
+}
diff --git a/internal/compose/resolution/secret_restart_test.go b/internal/compose/resolution/secret_restart_test.go
new file mode 100644
index 0000000..c8fb993
--- /dev/null
+++ b/internal/compose/resolution/secret_restart_test.go
@@ -0,0 +1,90 @@
+package resolution
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// What reads one of a module's own secrets is restarted when the secret changes (novox/hq issue 203,
+// issue 206): the build machine kept an hour-old credential open because its manifest restarted it
+// on its environment file alone. Composed, so a manifest need not say it; a scheduled process is
+// left alone, because the host refuses a restart-on for one and it reads the file afresh each run.
+func TestAContainerReadingAnOwnSecretIsRestartedWhenItChanges(t *testing.T) {
+	m := mcat.Manifest{Module: "agent", Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"broker": {Path: "/var/lib/mesh/agent/broker"}},
+		Resources: []map[string]any{
+			{"id": "mesh-state", "type": "directory", "path": "/var/lib/mesh/agent", "mode": "0700"},
+			{"id": "settings", "type": "file", "path": "/var/lib/mesh/agent/agent.env", "mode": "0600", "content": "A=1\n"},
+			{"id": "server", "type": "container", "name": "agent", "network": "host",
+				"image":      "registry.example/agent@sha256:" + strings.Repeat("a", 64),
+				"volumes":    []any{"/var/lib/mesh/agent:/run/mesh:ro", "/var/lib/mesh/agent/broker:/run/mesh/broker:ro"},
+				"env-file":   []any{"/var/lib/mesh/agent/agent.env"},
+				"restart-on": []any{"settings"}},
+			{"id": "nightly", "type": "container", "name": "agent-nightly", "schedule": "0 3 * * *",
+				"image":   "registry.example/agent@sha256:" + strings.Repeat("a", 64),
+				"volumes": []any{"/var/lib/mesh/agent/broker:/run/mesh/broker:ro"}},
+			{"id": "other", "type": "container", "name": "agent-other",
+				"image": "registry.example/agent@sha256:" + strings.Repeat("a", 64)},
+		}}
+	got, err := Resolve(shelf(m), []string{m.Module}, mcat.Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{"container-runtime": true}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Needed: map[string]map[string]string{"agent": {"broker": "SEALED"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	by := map[string]map[string]any{}
+	for _, r := range out {
+		by[r["id"].(string)] = r
+	}
+	if want := []any{"agent.settings", "agent.needs-broker"}; !reflect.DeepEqual(by["agent.server"]["restart-on"], want) {
+		t.Fatalf("the server reads the credential and is not restarted on it: %v", by["agent.server"]["restart-on"])
+	}
+	if _, has := by["agent.nightly"]["restart-on"]; has {
+		t.Fatalf("a scheduled container was given a restart-on, which the host refuses: %v", by["agent.nightly"]["restart-on"])
+	}
+	if _, has := by["agent.other"]["restart-on"]; has {
+		t.Fatalf("a container that reads no secret was given one to restart on: %v", by["agent.other"]["restart-on"])
+	}
+}
+
+// A member of a secret family is an own secret too (novox/hq issue 405, ADR 0283 decision 6): a container that
+// reads a member given is restarted when it changes, as for a secret declared by name. A member not given is no
+// file, so nothing is restarted on it.
+func TestAContainerReadingAFamilyMemberIsRestartedWhenItChanges(t *testing.T) {
+	m := mcat.Manifest{Module: "mounts", Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"smb-password-*": {Path: "/var/lib/mesh/mounts/smb-password-*.secret", IssuedBy: mcat.IssuedOutside}},
+		Resources: []map[string]any{
+			{"id": "games", "type": "container", "name": "mounts-games", "network": "host",
+				"image":   "registry.example/mounts@sha256:" + strings.Repeat("a", 64),
+				"volumes": []any{"/var/lib/mesh/mounts/smb-password-games.secret:/run/password:ro"}},
+			{"id": "library", "type": "container", "name": "mounts-library", "network": "host",
+				"image":   "registry.example/mounts@sha256:" + strings.Repeat("a", 64),
+				"volumes": []any{"/var/lib/mesh/mounts/smb-password-library.secret:/run/password:ro"}},
+		}}
+	got, err := Resolve(shelf(m), []string{m.Module}, mcat.Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{"container-runtime": true}}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Needed: map[string]map[string]string{"mounts": {"smb-password-games": "SEALED"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	by := map[string]map[string]any{}
+	for _, r := range out {
+		by[r["id"].(string)] = r
+	}
+	if want := []any{"mounts.needs-smb-password-games"}; !reflect.DeepEqual(by["mounts.games"]["restart-on"], want) {
+		t.Fatalf("a container reading a member given is not restarted on it: %v", by["mounts.games"]["restart-on"])
+	}
+	if _, placed := by["mounts.needs-smb-password-games"]; !placed {
+		t.Fatalf("the member given is not placed, so a restart-on names nothing: %v", out)
+	}
+	if _, has := by["mounts.library"]["restart-on"]; has {
+		t.Fatalf("a container reading a member not given was given a restart-on naming nothing: %v", by["mounts.library"]["restart-on"])
+	}
+}
diff --git a/internal/compose/resolution/secrets_into_files.go b/internal/compose/resolution/secrets_into_files.go
new file mode 100644
index 0000000..ef70735
--- /dev/null
+++ b/internal/compose/resolution/secrets_into_files.go
@@ -0,0 +1,214 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// placeholder is what a module's file content says where a sealed value belongs: ${secret:name}.
+//
+// The same expression the host matches, written out again rather than shared: they are separate
+// repositories and this is a wire format, like the shape of the declaration itself.
+//
+// **Nothing here can check that they agree, and the claim that something did was wrong.** A unit
+// test in this repository can only assert what this repository already believes. What proves it is
+// the lab, where a real host receives a real declaration and the file arrives filled — and where
+// the two expressions disagreeing shows up as a placeholder written through to a machine.
+var placeholder = regexp.MustCompile(`\$\{secret:([a-z0-9][a-z0-9-]*)\}`)
+
+// secretsUsed are the names a file's content asks for, in the order they first appear.
+func secretsUsed(content string) []string {
+	var used []string
+	seen := map[string]bool{}
+	for _, m := range placeholder.FindAllStringSubmatch(content, -1) {
+		if !seen[m[1]] {
+			seen[m[1]] = true
+			used = append(used, m[1])
+		}
+	}
+	return used
+}
+
+// sealedFor is every credential a module may name from inside one of its own files.
+//
+// **Exactly what it already declared, and nothing else.** A module reaches its own secrets and the
+// credentials it was granted for what it requires — both written down in its own manifest. It
+// cannot name another module's, which is not an oversight: two modules on one machine are as
+// separate as two on different machines, and letting one read the other's credential by guessing a
+// name would end that, to save writing a file.
+func sealedFor(m mcat.Manifest, needs []mcat.Needed, with mcat.Rendering) (map[string]string, error) {
+	sealed := map[string]string{}
+	for name := range m.OwnSecrets.Plain() {
+		if value := with.Needed[m.Module][name]; value != "" {
+			sealed[name] = value
+		} else if with.Foreseen[m.Module][name] {
+			// A stand-in where its own file has one (the Foreseeing and Planning modes, issue 774): a file naming it
+			// composes as its own file does, never refused for a value no such composition reads.
+			sealed[name] = mcat.ForeseenSealed
+		}
+	}
+	for _, to := range m.SecretRequirements() {
+		for _, file := range m.SecretFiles(to) {
+			key := mcat.SecretLocal(to, file.Local)
+			if _, taken := sealed[key]; taken {
+				// A module whose own secret and whose requirement share a name. Refused rather than
+				// settled by precedence: whichever won, the manifest would read as though the other
+				// had, and the file would hold the credential for the wrong thing while every check
+				// passed.
+				return nil, fmt.Errorf(
+					"%s has a secret of its own called %q and also requires %q, so a file saying "+
+						"${secret:%s} could mean either — rename one of them", m.Module, key, key, key)
+			}
+			for i := range needs {
+				// `For == m.Module`, not name alone: on a node with two modules requiring the same
+				// provision, both appear in `needs`, and matching by name would fill ${secret:X} with
+				// whichever came last — the other module's credential (novox/hq 04-ISSUES/022). And
+				// the local name, where the module keeps several (ADR 0094).
+				if needs[i].Name == to && needs[i].For == m.Module && needs[i].Local == file.Local && needs[i].Sealed != "" {
+					sealed[key] = needs[i].Sealed
+				}
+			}
+		}
+	}
+	return sealed, nil
+}
+
+// refuseSecretsInEnvironment is the check. `secretFiles` is every file of this module whose
+// content names a secret.
+func refuseSecretsInEnvironment(resource map[string]any, secretFiles map[string]bool, module string) error {
+	if fmt.Sprint(resource["type"]) != "container" {
+		return nil
+	}
+	name := fmt.Sprint(resource["name"])
+	if env, ok := resource["env"].(map[string]any); ok {
+		for key, value := range env {
+			if strings.Contains(fmt.Sprint(value), "${secret:") {
+				return fmt.Errorf(
+					"%s's container %s puts ${secret:…} in its env (%s). A secret is never filled into an "+
+						"environment variable: put it in a file the module declares and mount that, or name the "+
+						"file in env-file and say %q why", module, name, key, mcat.SecretsInEnvironment)
+			}
+		}
+	}
+	reason, _ := resource[mcat.SecretsInEnvironment].(string)
+	if strings.TrimSpace(reason) != "" {
+		return nil
+	}
+	if files, ok := resource["env-file"].([]any); ok {
+		for _, f := range files {
+			if secretFiles[fmt.Sprint(f)] {
+				return fmt.Errorf(
+					"%s's container %s reads %s as an env-file, and that file carries a secret, so the secret "+
+						"reaches the process environment — readable in `docker inspect` and /proc (novox/hq "+
+						"04-ISSUES/041). Mount the secret's file and point the program at it, or, if the program "+
+						"reads only its environment, say so on the container: %q: \"<why>\"",
+					module, name, f, mcat.SecretsInEnvironment)
+			}
+		}
+	}
+	return nil
+}
+
+// secretFilesOf is the paths of a module's file resources whose content names a secret.
+func secretFilesOf(resources []map[string]any) map[string]bool {
+	out := map[string]bool{}
+	for _, r := range resources {
+		if fmt.Sprint(r["type"]) != "file" {
+			continue
+		}
+		if content, ok := r["content"].(string); ok && len(secretsUsed(content)) > 0 {
+			out[fmt.Sprint(r["path"])] = true
+		}
+	}
+	return out
+}
+
+// intoFile gives a file the sealed values its content asks for.
+//
+// A name the module never declared is refused here rather than on the machine. The host would
+// refuse it too — but it would do so having already been handed a declaration, which reads as the
+// mesh sending something broken, and the name it could not find is a manifest's typo.
+//
+// **An own secret issued outside the mesh that nobody gave is filled with nothing** (novox/hq issue 401): the mesh
+// never makes one (ADR 0228), and a file is where the module reads it, so the place says empty — the module sees it
+// was not given, where a value the mesh made looked given and wrong. notGiven names those secrets.
+func intoFile(resource map[string]any, sealed map[string]string, notGiven map[string]bool, module string) error {
+	if fmt.Sprint(resource["type"]) != "file" {
+		return nil
+	}
+	content, ok := resource["content"].(string)
+	if !ok {
+		return nil
+	}
+	used := secretsUsed(content)
+	if len(used) == 0 {
+		return nil
+	}
+	into := map[string]any{}
+	for _, name := range used {
+		value := sealed[name]
+		if value == "" && notGiven[name] {
+			content = strings.ReplaceAll(content, "${secret:"+name+"}", "")
+			continue
+		}
+		if value == "" {
+			return fmt.Errorf(
+				"%s has a file that says ${secret:%s}, and %s has no secret of its own by that "+
+					"name and requires nothing called that either. A file may name %s",
+				module, name, module, namesOr(sealed))
+		}
+		into[name] = value
+	}
+	resource["content"] = content
+	if len(into) > 0 {
+		resource["secrets"] = into
+	}
+	return nil
+}
+
+// outsideNotGiven is each own secret of a module issued outside the mesh that this composition holds no value for
+// (novox/hq issue 401): what intoFile fills with nothing, and what nothing restarts on.
+func outsideNotGiven(m mcat.Manifest, given map[string]string) map[string]bool {
+	out := map[string]bool{}
+	for name, own := range m.OwnSecrets.Plain() {
+		if own.IssuedBy == mcat.IssuedOutside && given[name] == "" {
+			out[name] = true
+		}
+	}
+	return out
+}
+
+// namesOr says what a module could have written, because the answer to "that name is wrong" is
+// almost always one of two or three right ones.
+func namesOr(sealed map[string]string) string {
+	if len(sealed) == 0 {
+		return "nothing — it has no secrets of its own and requires nothing that grants one"
+	}
+	var names []string
+	for name := range sealed {
+		names = append(names, fmt.Sprintf("%q", name))
+	}
+	sort.Strings(names)
+	return join(names)
+}
+
+func join(names []string) string {
+	switch len(names) {
+	case 1:
+		return names[0]
+	case 2:
+		return names[0] + " or " + names[1]
+	}
+	out := ""
+	for i, n := range names[:len(names)-1] {
+		if i > 0 {
+			out += ", "
+		}
+		out += n
+	}
+	return out + " or " + names[len(names)-1]
+}
diff --git a/internal/compose/resolution/secrets_into_files_test.go b/internal/compose/resolution/secrets_into_files_test.go
new file mode 100644
index 0000000..eb3f1fe
--- /dev/null
+++ b/internal/compose/resolution/secrets_into_files_test.go
@@ -0,0 +1,245 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func fileNamed(out []map[string]any, id string) map[string]any {
+	for _, r := range out {
+		if r["id"] == id {
+			return r
+		}
+	}
+	return nil
+}
+
+// A module's own credential, put into a file it wrote: the value sealed to the node, or, in a composition asked ahead of
+// the send or for a plan alone, the stand-in its own file has (issue 774: baserow's config.json refused ace's plans).
+func TestAFileGetsTheSecretItsContentAsksFor(t *testing.T) {
+	for _, row := range []struct {
+		name string
+		with mcat.Rendering
+		want string
+	}{
+		{"sealed", mcat.Rendering{Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}}}, "sealed-admin"},
+		{"foreseen", mcat.Rendering{Foreseen: map[string]map[string]bool{"gitea": {"admin": true}}}, mcat.ForeseenSealed},
+	} {
+		r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+			Module:     "gitea",
+			OwnSecrets: mcat.OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
+			Resources: []map[string]any{{
+				"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
+				"content": "[security]\nSECRET_KEY = ${secret:admin}\n",
+			}},
+		}}}
+		out, err := Declaration(r, row.with)
+		if err != nil {
+			t.Fatalf("%s: %v", row.name, err)
+		}
+		file := fileNamed(out, "gitea.conf")
+		if file == nil {
+			t.Fatalf("%s: no file in %v", row.name, out)
+		}
+		got, _ := file["secrets"].(map[string]any)
+		if got["admin"] != row.want {
+			t.Errorf("%s: the file was sent without its secret: %v", row.name, file)
+		}
+		// The hole is still a hole on the wire. The mesh does not fill it in; the host does, on the
+		// machine, which is the only place both halves exist.
+		if !strings.Contains(file["content"].(string), "${secret:admin}") {
+			t.Errorf("%s: the mesh substituted it itself: %v", row.name, file["content"])
+		}
+	}
+}
+
+// The gap this exists for: a granted credential arrives as a bare password, and the program that
+// needs it reads KEY=value.
+func TestAGrantedCredentialCanBeShapedIntoAnEnvFile(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "anchor",
+		Modules: []mcat.Manifest{{
+			Module:   "keycloak",
+			Requires: []string{"postgres-database"},
+			Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
+			Resources: []map[string]any{{
+				"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
+				"content": "KC_DB_USERNAME=keycloak\nKC_DB_PASSWORD=${secret:postgres-database}\n",
+				"mode":    "0600",
+			}},
+		}},
+		Needs: []mcat.Needed{{Name: "postgres-database", For: "keycloak", From: "anchor", Sealed: "sealed-db"}},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "keycloak.dbenv")
+	got, _ := file["secrets"].(map[string]any)
+	if got["postgres-database"] != "sealed-db" {
+		t.Errorf("the credential never reached the file it was needed in: %v", file)
+	}
+}
+
+// Two modules on one node requiring the same provision each get THEIR OWN credential in a
+// ${secret:…} file — not whichever need happened to come last. This is the placeholder-path twin of
+// the guard novox/hq 04-ISSUES/022 put on the secrets:-map path; without it, a node with baserow and
+// letta both consuming postgres gave baserow letta's password and authentication failed.
+func TestTwoConsumersOfOneProvisionEachGetTheirOwnInAPlaceholderFile(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "anchor",
+		Modules: []mcat.Manifest{
+			{
+				Module:   "keycloak",
+				Requires: []string{"postgres-database"},
+				Secrets:  map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"},
+				Resources: []map[string]any{{
+					"id": "dbenv", "type": "file", "path": "/var/lib/keycloak/database.env",
+					"content": "PW=${secret:postgres-database}\n", "mode": "0600",
+				}},
+			},
+			{
+				Module:   "grafana",
+				Requires: []string{"postgres-database"},
+				Secrets:  map[string]string{"postgres-database": "/var/lib/grafana/db.secret"},
+				Resources: []map[string]any{{
+					"id": "dbenv", "type": "file", "path": "/var/lib/grafana/database.env",
+					"content": "PW=${secret:postgres-database}\n", "mode": "0600",
+				}},
+			},
+		},
+		Needs: []mcat.Needed{
+			{Name: "postgres-database", For: "keycloak", From: "anchor", Sealed: "sealed-kc"},
+			{Name: "postgres-database", For: "grafana", From: "anchor", Sealed: "sealed-gf"},
+		},
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	kc, _ := fileNamed(out, "keycloak.dbenv")["secrets"].(map[string]any)
+	if kc["postgres-database"] != "sealed-kc" {
+		t.Errorf("keycloak got the wrong credential (someone else's password): %v", kc)
+	}
+	gf, _ := fileNamed(out, "grafana.dbenv")["secrets"].(map[string]any)
+	if gf["postgres-database"] != "sealed-gf" {
+		t.Errorf("grafana got the wrong credential (someone else's password): %v", gf)
+	}
+}
+
+// A name nothing declared is a typo, and it is refused here rather than on the machine.
+func TestAFileNamingASecretTheModuleDoesNotHaveIsRefused(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+		Module:     "gitea",
+		OwnSecrets: mcat.OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
+		Resources: []map[string]any{{
+			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
+			"content": "SECRET_KEY = ${secret:adnim}\n",
+		}},
+	}}}
+	_, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
+	})
+	if err == nil {
+		t.Fatal("a file asked for a secret that does not exist and the mesh sent it anyway")
+	}
+	// It says what could have been meant, because the answer is nearly always one of two names.
+	if !strings.Contains(err.Error(), `"admin"`) {
+		t.Errorf("the refusal does not say what it could have named: %v", err)
+	}
+}
+
+// One module may not read another's credential by guessing its name.
+func TestAFileCannotNameAnotherModulesSecret(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{
+		{Module: "postgres", OwnSecrets: mcat.OwnSecrets{"superuser": {Path: "/var/lib/postgres/su.env"}}},
+		{Module: "gitea", Resources: []map[string]any{{
+			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini",
+			"content": "PASSWORD=${secret:superuser}\n",
+		}}},
+	}}
+	_, err := Declaration(r, mcat.Rendering{Needed: map[string]map[string]string{
+		"postgres": {"superuser": "sealed-su"},
+	}})
+	if err == nil {
+		t.Fatal("gitea read postgres's credential by naming it")
+	}
+}
+
+// A token inside a JSON document, where a setting put the placeholder there.
+//
+// **The case this whole shape was argued from**: a desktop client that reads its token from an
+// attribute inside a JSON file in a home directory, not from an environment variable. The module
+// ships an empty document, a setting says which attribute, and the credential never passes
+// through the mesh in the open.
+func TestASettingThatCarriesAPlaceholderIsStillFilled(t *testing.T) {
+	r := mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{{
+		Module:     "chat",
+		OwnSecrets: mcat.OwnSecrets{"api-token": {Path: "/home/operator/.config/chat/token"}},
+		Resources: []map[string]any{{
+			"id": "settings", "type": "file", "merge": "json",
+			"path": "/home/operator/.config/chat/settings.json", "content": "{}",
+		}},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"chat": {"api-token": "sealed-token"}},
+		Settings: mcat.SettingsBy{"chat": {{From: "node", Values: map[string]any{
+			"chat.atlassian.token": "${secret:api-token}",
+		}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := fileNamed(out, "chat.settings")
+	got, _ := file["secrets"].(map[string]any)
+	if got["api-token"] != "sealed-token" {
+		t.Errorf("a placeholder a setting put there was never filled: %v", file)
+	}
+	// Filling secrets runs after settings for exactly this reason: before the merge, the content
+	// is "{}" and asks for nothing at all.
+	if !strings.Contains(file["content"].(string), "${secret:api-token}") {
+		t.Errorf("the hole did not survive to the machine: %v", file["content"])
+	}
+}
+
+// An own secret and a requirement of the same name would make ${secret:x} mean either.
+func TestANameMeaningTwoThingsIsRefused(t *testing.T) {
+	r := mcat.Resolution{
+		Node: "anchor",
+		Modules: []mcat.Manifest{{
+			Module:     "thing",
+			OwnSecrets: mcat.OwnSecrets{"store": {Path: "/var/lib/thing/own.env"}},
+			Secrets:    map[string]string{"store": "/var/lib/thing/granted.env"},
+		}},
+		Needs: []mcat.Needed{{Name: "store", From: "anchor", Sealed: "sealed-granted"}},
+	}
+	_, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"thing": {"store": "sealed-own"}},
+	})
+	if err == nil || !strings.Contains(err.Error(), "rename") {
+		t.Errorf("one name meant two credentials and nothing said so: %v", err)
+	}
+}
+
+// A file with no placeholder is not given a secrets map. The host refuses a secret its content
+// never asks for, so an empty map added helpfully would break every file that has none.
+func TestAFileWithNoPlaceholderIsLeftAlone(t *testing.T) {
+	r := mcat.Resolution{Node: "anchor", Modules: []mcat.Manifest{{
+		Module:     "gitea",
+		OwnSecrets: mcat.OwnSecrets{"admin": {Path: "/var/lib/gitea/admin.env"}},
+		Resources: []map[string]any{{
+			"id": "conf", "type": "file", "path": "/etc/gitea/app.ini", "content": "RUN_MODE=prod\n",
+		}},
+	}}}
+	out, err := Declaration(r, mcat.Rendering{
+		Needed: map[string]map[string]string{"gitea": {"admin": "sealed-admin"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, given := fileNamed(out, "gitea.conf")["secrets"]; given {
+		t.Error("a file that asks for nothing was given a secrets map, which the host refuses")
+	}
+}
diff --git a/internal/compose/resolution/served_own_names.go b/internal/compose/resolution/served_own_names.go
new file mode 100644
index 0000000..891ad4d
--- /dev/null
+++ b/internal/compose/resolution/served_own_names.go
@@ -0,0 +1,89 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// requirementsContributedTo is every requirement m contributes to, sorted.
+func requirementsContributedTo(m mcat.Manifest) []string {
+	seen := map[string]bool{}
+	for to := range m.Contributes {
+		seen[to] = true
+	}
+	for to := range m.ContributesMany {
+		seen[to] = true
+	}
+	out := make([]string, 0, len(seen))
+	for to := range seen {
+		out = append(out, to)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// ServedOwnNames fills the provider's own composed names into what it serves one provision's
+// consumers, from this resolution's composition of the provider's machine (ADR 0346).
+//
+// A value naming a name this machine does not compose is left out, with its key, and said. The map is
+// copied only when something changes, as ServedTo does: the caller's may be the manifest's.
+func ServedOwnNames(r mcat.Resolution, m mcat.Manifest, provision string, serves map[string]any, layers []mcat.Layer) (
+	map[string]any, []string, error) {
+	var asking []string
+	for _, key := range sortedAnyKeys(serves) {
+		if text, ok := serves[key].(string); ok && bound.MatchString(text) {
+			asking = append(asking, key)
+		}
+	}
+	if len(asking) == 0 {
+		return serves, nil, nil
+	}
+	own := map[string]map[string]string{}
+	for _, to := range requirementsContributedTo(m) {
+		names, err := resolutionOwnNames(r, m, to, layers)
+		if err != nil {
+			return nil, nil, err
+		}
+		values := map[string]string{}
+		withOwnNames(values, names)
+		own[to] = values
+	}
+	out := make(map[string]any, len(serves))
+	for k, v := range serves {
+		out[k] = v
+	}
+	var said []string
+	for _, key := range asking {
+		text := serves[key].(string)
+		var missing string
+		filled := bound.ReplaceAllStringFunc(text, func(token string) string {
+			parts := bound.FindStringSubmatch(token)
+			if value := own[parts[1]][parts[2]]; value != "" && parts[3] == "" {
+				return value
+			}
+			if missing == "" {
+				missing = token
+			}
+			return token
+		})
+		if missing != "" {
+			delete(out, key)
+			said = append(said, fmt.Sprintf(
+				"%s serves %s without %q: it names %s, and %s composes no such name for %s (it has no "+
+					"public domain, or the endpoint is not reached publicly) (novox/hq ADR 0346)",
+				m.Module, provision, key, missing, orHere(r.Node), m.Module))
+			continue
+		}
+		out[key] = filled
+	}
+	return out, said, nil
+}
+
+func orHere(node string) string {
+	if node == "" {
+		return "this machine"
+	}
+	return node
+}
diff --git a/internal/compose/resolution/served_own_names_test.go b/internal/compose/resolution/served_own_names_test.go
new file mode 100644
index 0000000..7586e93
--- /dev/null
+++ b/internal/compose/resolution/served_own_names_test.go
@@ -0,0 +1,117 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const aRegistryForge = `{"module":"forge","version":"1","requires":["route"],
+  "provides":[{"name":"npm-package-registry","scope":"mesh"}],
+  "contributes":{"route":{"web":{"label":"git","port":3000}}},
+  "serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
+    "public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`
+
+func aForgeManifest(t *testing.T) mcat.Manifest {
+	t.Helper()
+	m, err := decodeForTest([]byte(aRegistryForge))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return m
+}
+
+func TestAProviderServesItsOwnComposedName(t *testing.T) {
+	m := aForgeManifest(t)
+	r := mcat.Resolution{Node: "home", PublicDomain: "example.org"}
+	got, said, err := ServedOwnNames(r, m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["public-root"] != "https://git.example.org/api/packages/novox/npm/" || len(said) != 0 {
+		t.Fatalf("the public root is the route's composed name: %v, said %v", got, said)
+	}
+	if got["npm-path"] != "/api/packages/novox/npm/" || got["port"] != float64(3000) {
+		t.Fatalf("the rest is served as it was: %v", got)
+	}
+	if m.Serves["npm-package-registry"]["public-root"] != "https://${bound:route:name-web}/api/packages/novox/npm/" {
+		t.Fatal("the manifest's own map was rewritten")
+	}
+}
+
+// On the provider's own machine the consumer is served the same name (ADR 0346 §2).
+func TestAConsumerBesideTheProviderIsServedItsName(t *testing.T) {
+	m := aForgeManifest(t)
+	consumer := mcat.Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
+		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
+	node := workstation()
+	node.PublicDomain = "example.org"
+	got, err := Resolve(shelf(minimalRouteProxy(), m, consumer), []string{"route-proxy", "forge", "lab"}, node, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	served, answered, err := resolutionServedOnThisMachine(got, "npm-package-registry", mcat.Rendering{})
+	if err != nil || !answered {
+		t.Fatalf("answered %v: %v", answered, err)
+	}
+	if served["public-root"] != "https://git.example.org/api/packages/novox/npm/" {
+		t.Fatalf("served beside the provider: %v", served)
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var binding string
+	for _, r := range out {
+		if r["path"] == "/var/lib/lab/package-registry.json" {
+			binding, _ = r["content"].(string)
+		}
+	}
+	if !strings.Contains(binding, `"public-root": "https://git.example.org/api/packages/novox/npm/"`) &&
+		!strings.Contains(binding, `"public-root":"https://git.example.org/api/packages/novox/npm/"`) {
+		t.Fatalf("the consumer's binding carries the name:\n%s", binding)
+	}
+	if strings.Contains(binding, "${bound:") {
+		t.Fatalf("a placeholder reached the consumer:\n%s", binding)
+	}
+}
+
+// From another machine, the provider's served values carry what that machine composed, and a key it
+// left out is said on the consumer's need (ADR 0346 §2, §3).
+func TestAConsumerElsewhereIsToldWhatTheProviderLeftOut(t *testing.T) {
+	consumer := mcat.Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
+		Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
+	node := workstation()
+	node.At = "workstation.internal"
+	world := mcat.World{Offered: map[string][]mcat.Provider{"npm-package-registry": {{Node: "home", At: "home.internal",
+		Module: "forge", Serves: map[string]any{"port": 3000},
+		LeftOut: []string{`forge serves npm-package-registry without "public-root"`}}}}}
+	got, err := Resolve(shelf(aForgeManifest(t), consumer), []string{"lab"}, node, world)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "npm-package-registry" {
+			if len(n.LeftOut) != 1 {
+				t.Fatalf("the need carries what was left out: %+v", n)
+			}
+			return
+		}
+	}
+	t.Fatalf("no need: %+v", got.Needs)
+}
+
+// The provider's contributions file carries no own name on a consumer's entry (ADR 0346 §4): only what
+// is derived for that consumer is there (ADR 0202 §5), and the provider reads its own names in its files.
+func TestAProvidersOwnNameIsNotOnItsConsumersEntry(t *testing.T) {
+	m := aForgeManifest(t)
+	r := mcat.Resolution{Node: "home", PublicDomain: "example.org", Modules: []mcat.Manifest{m}}
+	derived, err := resolutionDerivedFor(r, "npm-package-registry", "lab_home", "lab", "", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if derived != nil {
+		t.Fatalf("a consumer's entry carries only what was derived for it: %v", derived)
+	}
+}
diff --git a/internal/compose/resolution/setting_defaults.go b/internal/compose/resolution/setting_defaults.go
new file mode 100644
index 0000000..f7ea3c8
--- /dev/null
+++ b/internal/compose/resolution/setting_defaults.go
@@ -0,0 +1,64 @@
+package resolution
+
+import (
+	"sort"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// meshWords are the settings keys the mesh reads itself; a module declares none of them.
+var meshWords = map[string]bool{mcat.PortsSetting: true, mcat.ExposeSetting: true, mcat.ReachSetting: true, mcat.EndpointsSetting: true, mcat.PlacesSetting: true, mcat.AccessesSetting: true, mcat.NetworksSetting: true}
+
+// Defaults is the layer a module's own defaults make, or nothing when it gives none.
+func Defaults(m mcat.Manifest) (mcat.Layer, bool) {
+	if len(m.Settings) == 0 {
+		return mcat.Layer{}, false
+	}
+	values := map[string]any{}
+	for key, d := range m.Settings {
+		if d.Default != nil {
+			values[key] = d.Default
+		}
+	}
+	return mcat.Layer{From: mcat.DefaultLayer, Values: values, Default: true}, len(values) > 0
+}
+
+// WithDefaults is a module's layers with its defaults under them, for filling `${setting:<key>}`.
+func WithDefaults(m mcat.Manifest, layers []mcat.Layer) []mcat.Layer {
+	d, has := Defaults(m)
+	if !has {
+		return layers
+	}
+	return append([]mcat.Layer{d}, layers...)
+}
+
+// Effective is every key a module gives a default or a layer sets, with its value and where it came
+// from: the default, then the mesh's layer, then the node's — later wins.
+func Effective(m mcat.Manifest, layers []mcat.Layer) []mcat.SettingSource {
+	byKey := map[string]*mcat.SettingSource{}
+	for key, d := range m.Settings {
+		if d.Default == nil {
+			// A required config value has no default (ADR 0348 §4); a settings declaration always has one.
+			continue
+		}
+		byKey[key] = &mcat.SettingSource{Key: key, Value: d.Default, From: mcat.DefaultLayer, FromDefault: true,
+			Default: d.Default, HasDefault: true}
+	}
+	for _, layer := range layers {
+		// As the layer is said, placement too: `settings` answers it as a person set it.
+		for key, v := range layer.Whole() {
+			s, ok := byKey[key]
+			if !ok {
+				s = &mcat.SettingSource{Key: key}
+				byKey[key] = s
+			}
+			s.Value, s.From, s.FromDefault = v, layer.From, layer.Default
+		}
+	}
+	out := make([]mcat.SettingSource, 0, len(byKey))
+	for _, s := range byKey {
+		out = append(out, *s)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Key < out[j].Key })
+	return out
+}
diff --git a/internal/compose/resolution/setting_defaults_test.go b/internal/compose/resolution/setting_defaults_test.go
new file mode 100644
index 0000000..9ec70f1
--- /dev/null
+++ b/internal/compose/resolution/setting_defaults_test.go
@@ -0,0 +1,188 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func notifier() mcat.Manifest {
+	return mcat.Manifest{Module: "notifier",
+		Settings: map[string]mcat.SettingDeclaration{
+			"font-size": {Kind: mcat.KindPreference, Default: float64(10), Why: "readable at a scale of one"},
+			"width":     {Kind: mcat.KindPreference, Default: float64(250), Why: "fits a title of forty characters"},
+		},
+		Resources: []map[string]any{{"id": "configuration", "type": "file", "path": "/x/notifierrc",
+			"content": "font = Inter ${setting:font-size}\nwidth = ${setting:width}\n"}},
+	}
+}
+
+func TestAnUnsetPreferenceTakesItsDefault(t *testing.T) {
+	t.Run("the node over the mesh over the default", theNodeOverTheMeshOverTheDefault)
+	m := notifier()
+	for _, layers := range [][]mcat.Layer{nil, {{From: mcat.MeshWideLayer, Values: map[string]any{}}}} {
+		file := map[string]any{}
+		for k, v := range m.Resources[0] {
+			file[k] = v
+		}
+		if err := settingInto(file, WithDefaults(m, layers), m.Module); err != nil {
+			t.Fatal(err)
+		}
+		if file["content"] != "font = Inter 10\nwidth = 250\n" {
+			t.Fatalf("filled as %q", file["content"])
+		}
+	}
+	if err := JudgeSettings(m, nil, false); err != nil {
+		t.Fatalf("a module whose every key has a default does not compose with no layer: %v", err)
+	}
+}
+
+func theNodeOverTheMeshOverTheDefault(t *testing.T) {
+	m := notifier()
+	layers := []mcat.Layer{
+		{From: mcat.MeshWideLayer, Values: map[string]any{"width": float64(300)}},
+		{From: "laptop", Values: map[string]any{"font-size": float64(13), "width": float64(340)}},
+	}
+	file := map[string]any{"type": "file", "content": m.Resources[0]["content"]}
+	if err := settingInto(file, WithDefaults(m, layers), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if file["content"] != "font = Inter 13\nwidth = 340\n" {
+		t.Fatalf("filled as %q", file["content"])
+	}
+	file = map[string]any{"type": "file", "content": m.Resources[0]["content"]}
+	if err := settingInto(file, WithDefaults(m, layers[:1]), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if file["content"] != "font = Inter 10\nwidth = 300\n" {
+		t.Fatalf("the mesh's layer over the default filled as %q", file["content"])
+	}
+}
+
+// Composed for a machine, the way a push writes it: the default reaches the file, and the node's
+// layer overrides it.
+func TestAComposedMachineGetsTheDefaultAndTheNodesValue(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, notifier())
+	with := anchorRendering(false)
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["notifier"]; left {
+		t.Fatalf("the notifier was left out: %s", why)
+	}
+	if c := byID(composed.Resources)["notifier.configuration"]["content"]; c != "font = Inter 10\nwidth = 250\n" {
+		t.Fatalf("composed with no layer as %q", c)
+	}
+	with.Settings["notifier"] = []mcat.Layer{{From: "anchor", Values: map[string]any{"font-size": float64(13)}}}
+	if composed, err = Compose(r, with); err != nil {
+		t.Fatal(err)
+	}
+	if c := byID(composed.Resources)["notifier.configuration"]["content"]; c != "font = Inter 13\nwidth = 250\n" {
+		t.Fatalf("composed with the node's font size as %q", c)
+	}
+}
+
+// A default fills ${setting:…} only: it never becomes a key of a mergeable file (issue 168).
+func TestADefaultIsNotMergedIntoAJSONFile(t *testing.T) {
+	m := notifier()
+	m.Resources = append(m.Resources, map[string]any{"id": "other", "type": "file", "path": "/x/other.json",
+		"merge": mcat.MergeJSON, "content": `{"keep": 1}`})
+	out, err := ApplySettings(m.Resources[1], WithDefaults(m, nil))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(out["content"].(string), "font-size") {
+		t.Fatalf("a default reached a mergeable file: %s", out["content"])
+	}
+}
+
+// A value that is the operator's has no default: no layer setting it is refused by name, as before.
+func TestAnOperatorsValueWithoutADefaultIsStillRefused(t *testing.T) {
+	m := notifier()
+	m.Resources[0]["content"] = "font = Inter ${setting:font-size}\nwidth = ${setting:width}\nfrom = ${setting:domain}\n"
+	err := JudgeSettings(m, nil, false)
+	if err == nil || !strings.Contains(err.Error(), "${setting:domain}") {
+		t.Fatalf("judged %v", err)
+	}
+	if strings.Contains(err.Error(), "font-size") {
+		t.Fatalf("a default was named as set today: %v", err)
+	}
+}
+
+func TestEveryValueSaysWhereItCameFrom(t *testing.T) {
+	m := notifier()
+	m.Resources[0]["content"] = m.Resources[0]["content"].(string) + "x = ${setting:position}\n"
+	got := Effective(m, []mcat.Layer{
+		{From: mcat.MeshWideLayer, Values: map[string]any{"width": float64(300), "position": "top-right"}},
+		{From: "laptop", Values: map[string]any{"font-size": float64(13)}},
+	})
+	want := map[string]string{"font-size": "laptop", "position": mcat.MeshWideLayer, "width": mcat.MeshWideLayer}
+	if len(got) != 3 {
+		t.Fatalf("effective: %+v", got)
+	}
+	for _, s := range got {
+		if s.From != want[s.Key] {
+			t.Errorf("%s from %q, want %q", s.Key, s.From, want[s.Key])
+		}
+	}
+	if got[0].Key != "font-size" || got[0].Value != float64(13) || got[0].Default != float64(10) {
+		t.Fatalf("font-size: %+v", got[0])
+	}
+	only := Effective(m, nil)
+	if only[0].From != mcat.DefaultLayer || only[0].Value != float64(10) {
+		t.Fatalf("with no layer: %+v", only)
+	}
+}
+
+// A node may be called `default`. Its layer is a node's like any other: it overrides the module's
+// default, it merges into a mergeable file, and it is named among what is set.
+func TestANodeCalledDefaultIsANodesLayer(t *testing.T) {
+	m := notifier()
+	node := []mcat.Layer{{From: mcat.DefaultLayer, Values: map[string]any{"font-size": float64(13)}}}
+	file := map[string]any{"type": "file", "content": m.Resources[0]["content"]}
+	if err := settingInto(file, WithDefaults(m, node), m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if file["content"] != "font = Inter 13\nwidth = 250\n" {
+		t.Fatalf("the node called default was dropped: %q", file["content"])
+	}
+	out, err := ApplySettings(map[string]any{"id": "j", "type": "file", "merge": mcat.MergeJSON, "content": `{}`}, node)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(out["content"].(string), `"font-size": 13`) {
+		t.Fatalf("the node called default did not merge: %s", out["content"])
+	}
+	if got := Effective(m, node); got[0].FromDefault || got[0].Value != float64(13) {
+		t.Fatalf("the node's value read as the default: %+v", got[0])
+	}
+}
+
+// A default fills ${setting:…} in what a module contributes and serves, and never replaces a value a
+// contribution states itself.
+func TestADefaultFillsAContributionAndAServedFactButNotALiteral(t *testing.T) {
+	m := notifier()
+	m.Settings["site-title"] = mcat.SettingDeclaration{Kind: mcat.KindPreference, Default: "Notes", Why: "x"}
+	contribution := map[string]any{"title": "${setting:site-title}", "width": "fixed", "port": float64(8080)}
+	got, err := overridden(contribution, WithDefaults(m, nil), "a contribution")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got["title"] != "Notes" || got["width"] != "fixed" {
+		t.Fatalf("contribution: %v", got)
+	}
+	got, err = overridden(contribution, WithDefaults(m, []mcat.Layer{{From: "laptop", Values: map[string]any{"width": "wide"}}}), "a contribution")
+	if err != nil || got["width"] != "wide" {
+		t.Fatalf("a node's value did not override a contribution's own key: %v %v", got, err)
+	}
+	served, err := Settle(map[string]any{"name": "${setting:site-title}"}, WithDefaults(m, nil))
+	if err != nil || served["name"] != "Notes" {
+		t.Fatalf("served: %v %v", served, err)
+	}
+	if _, err := Settle(map[string]any{"name": "${setting:site-title}"}, nil); err == nil {
+		t.Fatal("a served fact without the defaults was filled")
+	}
+}
diff --git a/internal/compose/resolution/setting_in_owner_test.go b/internal/compose/resolution/setting_in_owner_test.go
new file mode 100644
index 0000000..2adf317
--- /dev/null
+++ b/internal/compose/resolution/setting_in_owner_test.go
@@ -0,0 +1,107 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func recycler() mcat.Manifest {
+	return mcat.Manifest{Module: "sonarr",
+		Resources: []map[string]any{
+			{"id": "recycle-bin", "type": "directory", "path": "/srv/sonarr/recycle", "mode": "0755",
+				"owner": "${setting:puid}:${setting:pgid}"},
+			{"id": "identity", "type": "file", "path": "/srv/sonarr/identity.env", "mode": "0644",
+				"content": "PUID=${setting:puid}\nPGID=${setting:pgid}\n"},
+		},
+	}
+}
+
+func copied(r map[string]any) map[string]any {
+	out := map[string]any{}
+	for k, v := range r {
+		out[k] = v
+	}
+	return out
+}
+
+// The node's identity reaches the directory's owner, the node's layer over the mesh's, a number given
+// as a string or as a JSON number alike.
+func TestASettingOwnsADirectory(t *testing.T) {
+	m := recycler()
+	layers := []mcat.Layer{
+		{From: "the mesh", Values: map[string]any{"puid": "1000", "pgid": "1000"}},
+		{From: "this node", Values: map[string]any{"puid": float64(1001), "pgid": "2000"}},
+	}
+	r := copied(m.Resources[0])
+	if err := settingInto(r, layers, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if r["owner"] != "1001:2000" {
+		t.Fatalf("owned by %q, not 1001:2000", r["owner"])
+	}
+	user := copied(m.Resources[0])
+	user["owner"] = "${setting:puid}"
+	if err := settingInto(user, layers, m.Module); err != nil || user["owner"] != "1001" {
+		t.Fatalf("user alone: %v, %v", user["owner"], err)
+	}
+}
+
+// Composed for a machine, the way a push writes it: the directory reaches the node-engine owned by the
+// number the node's settings name, never by the placeholder.
+func TestAComposedMachineGetsTheOwnerTheSettingNames(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, recycler())
+	with := anchorRendering(false)
+	with.Settings["sonarr"] = []mcat.Layer{{From: "anchor", Values: map[string]any{"puid": "1001", "pgid": "2000"}}}
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["sonarr"]; left {
+		t.Fatalf("left out: %s", why)
+	}
+	got := byID(composed.Resources)["sonarr.recycle-bin"]
+	if got["owner"] != "1001:2000" {
+		t.Fatalf("composed owned by %v, not 1001:2000", got["owner"])
+	}
+}
+
+// Only a whole number owns a directory: an account's name, text, a sign, a fraction or a value past the
+// kernel's ids is refused by name, and the directory is left as it was. So is a key nothing sets.
+func TestAnOwnerSettingThatIsNoNumberIsRefused(t *testing.T) {
+	m := recycler()
+	for _, bad := range []any{"abc", "root", "", "-1", "+5", "1000:1000", "10 00", "1000\nx", float64(1.5),
+		float64(-3), "4294967295", "99999999999", true} {
+		r := copied(m.Resources[0])
+		err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"puid": bad, "pgid": "1000"}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), `"puid"`) || !strings.Contains(err.Error(), "whole number") {
+			t.Errorf("%v: %v", bad, err)
+		}
+		if r["owner"] != m.Resources[0]["owner"] {
+			t.Errorf("%v: the owner was changed on refusal: %v", bad, r["owner"])
+		}
+	}
+	r := copied(m.Resources[0])
+	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:puid}") {
+		t.Errorf("nothing set: %v", err)
+	}
+	if err := JudgeSettings(m, []mcat.Layer{{From: "ace", Values: map[string]any{"puid": "media", "pgid": "1000"}}}, false); err == nil ||
+		!strings.Contains(err.Error(), "whole number") {
+		t.Errorf("a stored name is not refused when judged: %v", err)
+	}
+}
+
+// An owner is written as the number parsed: "0001" and "00" reach the node-engine as 1 and 0, never as text.
+// Uid 0 is allowed, because a key an owner asks for is the terminal's alone.
+func TestAnOwnerSettingIsWrittenAsTheNumber(t *testing.T) {
+	m := recycler()
+	r := copied(m.Resources[0])
+	if err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"puid": "0001", "pgid": "00"}}}, m.Module); err != nil {
+		t.Fatal(err)
+	}
+	if r["owner"] != "1:0" {
+		t.Fatalf("owned by %q, not 1:0", r["owner"])
+	}
+}
diff --git a/internal/compose/resolution/setting_in_unit_test.go b/internal/compose/resolution/setting_in_unit_test.go
new file mode 100644
index 0000000..5c5d36d
--- /dev/null
+++ b/internal/compose/resolution/setting_in_unit_test.go
@@ -0,0 +1,115 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func scrubber() mcat.Manifest {
+	return mcat.Manifest{Module: "zfs",
+		Settings: map[string]mcat.SettingDeclaration{
+			"scrub-cadence": {Kind: mcat.KindPreference, Default: "weekly", Why: "what the distribution's timer did"},
+		},
+		Resources: []map[string]any{
+			{"id": "distribution-weekly", "type": "service", "unit": "zfs-scrub-weekly@${setting:scrub-pool}.timer",
+				"state": "stopped", "boot": "disabled"},
+			{"id": "distribution-monthly", "type": "service", "unit": "zfs-scrub-monthly@${setting:scrub-pool}.timer",
+				"state": "stopped", "boot": "disabled"},
+			{"id": "scrub-config", "type": "file", "path": "/etc/zfs-tools/scrub.conf",
+				"content": "pool=${setting:scrub-pool}\ncadence=${setting:scrub-cadence}\n"},
+		},
+	}
+}
+
+func TestASettingNamesAServicesUnit(t *testing.T) {
+	m := scrubber()
+	layers := WithDefaults(m, []mcat.Layer{{From: "ace", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}})
+	for i, want := range []string{"zfs-scrub-weekly@storage.timer", "zfs-scrub-monthly@storage.timer"} {
+		r := map[string]any{}
+		for k, v := range m.Resources[i] {
+			r[k] = v
+		}
+		if err := settingInto(r, layers, m.Module); err != nil {
+			t.Fatal(err)
+		}
+		if r["unit"] != want {
+			t.Errorf("composed as %q, not %q", r["unit"], want)
+		}
+	}
+}
+
+// Composed for a machine, the way a push writes it: the operator's pool and cadence reach the units' names
+// and the file.
+func TestAComposedMachineGetsTheUnitTheSettingNames(t *testing.T) {
+	r := anAdoptedAnchor()
+	r.Modules = append(r.Modules, scrubber())
+	with := anchorRendering(false)
+	with.Settings["zfs"] = []mcat.Layer{{From: "anchor", Values: map[string]any{"scrub-pool": "storage", "scrub-cadence": "monthly"}}}
+	composed, err := Compose(r, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := composed.LeftOut["zfs"]; left {
+		t.Fatalf("left out: %s", why)
+	}
+	got := byID(composed.Resources)
+	for id, want := range map[string]string{"zfs.distribution-weekly": "zfs-scrub-weekly@storage.timer",
+		"zfs.distribution-monthly": "zfs-scrub-monthly@storage.timer"} {
+		if got[id]["unit"] != want {
+			t.Errorf("%s composed as %v, not %s", id, got[id]["unit"], want)
+		}
+		t.Logf("%s: %v", id, got[id]["unit"])
+	}
+	if c := got["zfs.scrub-config"]["content"]; c != "pool=storage\ncadence=monthly\n" {
+		t.Errorf("the file: %q", c)
+	}
+}
+
+// A value that would not make a unit's name is refused by name, never written: a space, a slash, a
+// newline that would begin a directive, or a second suffix.
+func TestASettingThatMakesNoUnitNameIsRefused(t *testing.T) {
+	m := scrubber()
+	for _, bad := range []string{"", "stor age", "a/b", "storage\nExecStart=/bin/sh", "a@b", "$(x)", "*", `a\\x2d`} {
+		r := map[string]any{}
+		for k, v := range m.Resources[0] {
+			r[k] = v
+		}
+		err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), "scrub-pool") || !strings.Contains(err.Error(), "unit") {
+			t.Errorf("%q: %v", bad, err)
+		}
+		if r["unit"] != m.Resources[0]["unit"] {
+			t.Errorf("%q: the unit was changed on refusal: %v", bad, r["unit"])
+		}
+	}
+	r := map[string]any{}
+	for k, v := range m.Resources[0] {
+		r[k] = v
+	}
+	if err := settingInto(r, nil, m.Module); err == nil || !strings.Contains(err.Error(), "${setting:scrub-pool}") {
+		t.Errorf("nothing set: %v", err)
+	}
+}
+
+func TestAnInstanceValueMayNotLeadWithADashNorBeLong(t *testing.T) {
+	m := scrubber()
+	for _, bad := range []string{"-storage", "--help", strings.Repeat("a", 65)} {
+		r := map[string]any{}
+		for k, v := range m.Resources[0] {
+			r[k] = v
+		}
+		err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"scrub-pool": bad}}}, m.Module)
+		if err == nil || !strings.Contains(err.Error(), "scrub-pool") {
+			t.Errorf("%q: %v", bad, err)
+		}
+	}
+	r := map[string]any{}
+	for k, v := range m.Resources[0] {
+		r[k] = v
+	}
+	if err := settingInto(r, []mcat.Layer{{From: "ace", Values: map[string]any{"scrub-pool": strings.Repeat("a", 64)}}}, m.Module); err != nil {
+		t.Errorf("64 characters: %v", err)
+	}
+}
diff --git a/internal/compose/resolution/setting_into.go b/internal/compose/resolution/setting_into.go
new file mode 100644
index 0000000..df0abe2
--- /dev/null
+++ b/internal/compose/resolution/setting_into.go
@@ -0,0 +1,260 @@
+package resolution
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// settingRef is how a definition asks for an operator's value: ${setting:<key>}.
+var settingRef = regexp.MustCompile(`\$\{setting:([a-z0-9][a-z0-9_.-]*)\}`)
+
+// settingsUsed is every key a file's content asks for, once each, in order of first use.
+func settingsUsed(content string) []string {
+	var keys []string
+	seen := map[string]bool{}
+	for _, m := range settingRef.FindAllStringSubmatch(content, -1) {
+		if !seen[m[1]] {
+			seen[m[1]] = true
+			keys = append(keys, m[1])
+		}
+	}
+	return keys
+}
+
+// UnsetSettingError is a module whose definition says ${setting:<key>} where nothing sets that key: typed, so
+// that whoever reads why a module was left out of a machine can tell a setting nobody gave — the operator's
+// to give, named with the command that gives it — from any other reason (novox/hq issue 380). Its words are
+// the refusal's, unchanged.
+type UnsetSettingError struct {
+	Module, Setting string
+	said            string
+	// where says what asks for it — "a file", "a service whose unit", "a directory <id> whose owner" — and
+	// setToday which of the module's keys a layer sets, for saying it again in the config form's words.
+	where, setToday string
+	// field is the key of a contribution whose value asks for it, where the contribution's words are made by its caller.
+	field string
+}
+
+func (e *UnsetSettingError) Error() string { return e.said }
+
+// unsetInConfigWords is the refusal of a required config value nothing sets, in the words of a module written in the
+// config form (novox/hq ADR 0348 §1, §4): `${config:<key>}` and the config verb, never `settings set`. Any other
+// error, and any error of a module in the settings form, is returned as it was.
+func unsetInConfigWords(err error, m mcat.Manifest) error {
+	var unset *UnsetSettingError
+	if err == nil || !m.DeclaresConfig() || !errors.As(err, &unset) {
+		return err
+	}
+	return &UnsetSettingError{Module: unset.Module, Setting: unset.Setting, where: unset.where,
+		setToday: unset.setToday, said: fmt.Sprintf(
+			"%s has %s that says ${config:%s}, and nothing sets the required config value %q for it — a "+
+				"required value is the operator's own and has no default (novox/hq ADR 0348 §4): set it with "+
+				"the config verb, for %s on this node, key %q%s",
+			unset.Module, unset.where, unset.Setting, unset.Setting, unset.Module, unset.Setting,
+			strings.ReplaceAll(unset.setToday, "no setting is set", "no config value is set"))}
+}
+
+// settingInto fills a file's ${setting:…} placeholders from the layers over a module.
+//
+// The last layer setting a key wins, which is the node's over the mesh's over the module's own
+// default (novox/hq ADR 0262) — the same order settle applies to a mergeable file. The caller lays
+// the defaults under the layers with WithDefaults. A value that is not a string is written the way a program would read
+// it (a number without a trailing .000000, a boolean as true/false).
+func settingInto(resource map[string]any, layers []mcat.Layer, module string) error {
+	if fmt.Sprint(resource["type"]) == "service" {
+		return settingIntoUnit(resource, layers, module)
+	}
+	if fmt.Sprint(resource["type"]) == "directory" {
+		return settingIntoOwner(resource, layers, module)
+	}
+	if fmt.Sprint(resource["type"]) == "container" {
+		return settingIntoGroups(resource, layers, module)
+	}
+	if fmt.Sprint(resource["type"]) != "file" {
+		return nil
+	}
+	content, ok := resource["content"].(string)
+	if !ok {
+		return nil
+	}
+	for _, key := range settingsUsed(content) {
+		value, set := settingValue(layers, key)
+		if !set {
+			return &UnsetSettingError{Module: module, Setting: key, where: "a file",
+				setToday: orNoSettings(layers), said: fmt.Sprintf(
+					"%s has a file that says ${setting:%s}, and nothing sets %q for it — an operator's "+
+						"value is the assignment's, never the definition's (novox/hq ADR 0112), and only a "+
+						"preference has a default in the definition (ADR 0262): "+
+						"`settings set %s <file>` with {%q: …}%s",
+					module, key, key, module, key, orNoSettings(layers))}
+		}
+		content = strings.ReplaceAll(content, "${setting:"+key+"}", plainly(value))
+	}
+	resource["content"] = content
+	return nil
+}
+
+// unitPart is what a setting may put into a unit's name: the characters systemd allows in a unit name,
+// less the instance's `@` and the escape's `\`, and at least one of them. Anything else — a space, a slash,
+// a newline that would begin a directive in the unit file the name ends up in — is refused, never written.
+var unitPart = regexp.MustCompile(`^[A-Za-z0-9:_.][A-Za-z0-9:_.-]{0,63}$`)
+
+// settingIntoUnit fills ${setting:…} in a service resource's unit name: a module that holds the
+// distribution's timer for the pool the operator names cannot write the pool into its definition
+// (novox/hq ADR 0112). Refused, with the key and why, when nothing sets it or the value would not make a
+// unit's name; the resource is left as it was.
+func settingIntoUnit(resource map[string]any, layers []mcat.Layer, module string) error {
+	unit, ok := resource["unit"].(string)
+	if !ok {
+		return nil
+	}
+	for _, key := range settingsUsed(unit) {
+		value, set := settingValue(layers, key)
+		if !set {
+			return &UnsetSettingError{Module: module, Setting: key, where: "a service whose unit",
+				setToday: orNoSettings(layers), said: fmt.Sprintf(
+					"%s has a service whose unit says ${setting:%s}, and nothing sets %q for it — an operator's "+
+						"value is the assignment's, never the definition's (novox/hq ADR 0112): "+
+						"`settings set %s <file>` with {%q: …}%s",
+					module, key, key, module, key, orNoSettings(layers))}
+		}
+		v := plainly(value)
+		if !unitPart.MatchString(v) {
+			return fmt.Errorf("%s: the setting %q is %q, which cannot be the instance of the unit %s: an instance "+
+				"takes letters, digits, ':', '_', '.' and '-', does not begin with '-' (a systemctl option), and is "+
+				"at most 64 characters", module, key, v, unit)
+		}
+		unit = strings.ReplaceAll(unit, "${setting:"+key+"}", v)
+	}
+	resource["unit"] = unit
+	return nil
+}
+
+// wholeID is a value as a uid or a gid, and whether it is one: a whole number below the kernel's "no id"
+// (2^32-1). Uid 0 is one: a key an owner asks for is the controller's terminal's alone (TerminalKeys).
+func wholeID(v string) (uint64, bool) {
+	if v == "" || strings.TrimLeft(v, "0123456789") != "" {
+		return 0, false
+	}
+	n, err := strconv.ParseUint(v, 10, 32)
+	return n, err == nil && n < 1<<32-1
+}
+
+// settingIntoOwner fills ${setting:…} in a directory's owner, refusing — with the key and why, the
+// resource left as it was — a key nothing sets and a value that is not a whole number.
+func settingIntoOwner(resource map[string]any, layers []mcat.Layer, module string) error {
+	owner, ok := resource["owner"].(string)
+	if !ok {
+		return nil
+	}
+	for _, key := range settingsUsed(owner) {
+		value, set := settingValue(layers, key)
+		if !set {
+			return &UnsetSettingError{Module: module, Setting: key,
+				where: fmt.Sprintf("a directory %v whose owner", resource["id"]), setToday: orNoSettings(layers),
+				said: fmt.Sprintf(
+					"%s has a directory %v whose owner says ${setting:%s}, and nothing sets %q for it — an operator's "+
+						"value is the assignment's, never the definition's (novox/hq ADR 0112): "+
+						"`settings set %s <file>` with {%q: …}%s",
+					module, resource["id"], key, key, module, key, orNoSettings(layers))}
+		}
+		v := plainly(value)
+		id, whole := wholeID(v)
+		if !whole {
+			return fmt.Errorf("%s: the setting %q is %q, which cannot own the directory %v: an owner a setting "+
+				"names is a uid or a gid, a whole number, never an account's name or other text (novox/hq issue 279)",
+				module, key, v, resource["id"])
+		}
+		// Written as the number parsed, so "0001" reaches the node-engine as 1, never as text.
+		owner = strings.ReplaceAll(owner, "${setting:"+key+"}", strconv.FormatUint(id, 10))
+	}
+	resource["owner"] = owner
+	return nil
+}
+
+func settingValue(layers []mcat.Layer, key string) (any, bool) {
+	var value any
+	set := false
+	for _, layer := range layers {
+		if v, has := layer.Values[key]; has {
+			value, set = v, true
+		}
+	}
+	return value, set
+}
+
+func orNoSettings(layers []mcat.Layer) string {
+	var keys []string
+	for _, l := range layers {
+		if l.Default {
+			continue
+		}
+		for k := range l.Values {
+			keys = append(keys, k)
+		}
+	}
+	if len(keys) == 0 {
+		return "; no setting is set for this module"
+	}
+	sort.Strings(keys)
+	return "; set today: " + strings.Join(keys, ", ")
+}
+
+// groupsOf is a container resource's groups as the manifest wrote them (text or numbers), none when it names none.
+func groupsOf(r map[string]any) []any {
+	groups, _ := r["groups"].([]any)
+	return groups
+}
+
+// settingIntoGroups fills ${setting:…} in a container's groups, refusing — with the key and why, the resource left as
+// it was — a key nothing sets and a value that is not a whole number above zero. A number is kept; the list that
+// results is numbers alone.
+func settingIntoGroups(resource map[string]any, layers []mcat.Layer, module string) error {
+	groups := groupsOf(resource)
+	if len(groups) == 0 {
+		return nil
+	}
+	filled := make([]any, 0, len(groups))
+	for _, g := range groups {
+		s, isText := g.(string)
+		if !isText {
+			if f, isNumber := g.(float64); isNumber && f == float64(int(f)) {
+				g = int(f) // a number the manifest wrote, as the numbers a placeholder gives
+			}
+			filled = append(filled, g)
+			continue
+		}
+		keys := settingsUsed(s)
+		if len(keys) != 1 || settingRef.ReplaceAllString(s, "") != "" {
+			filled = append(filled, g) // not a whole placeholder: the manifest check refuses it
+			continue
+		}
+		key := keys[0]
+		value, set := settingValue(layers, key)
+		if !set {
+			return &UnsetSettingError{Module: module, Setting: key,
+				where: fmt.Sprintf("a container %v whose groups", resource["id"]), setToday: orNoSettings(layers),
+				said: fmt.Sprintf(
+					"%s has a container %v whose groups say ${setting:%s}, and nothing sets %q for it — an operator's "+
+						"value is the assignment's, never the definition's (novox/hq ADR 0112): "+
+						"`settings set %s <file>` with {%q: …}%s",
+					module, resource["id"], key, key, module, key, orNoSettings(layers))}
+		}
+		v := plainly(value)
+		id, whole := wholeID(v)
+		if !whole || id == 0 {
+			return fmt.Errorf("%s: the setting %q is %q, which cannot be a group of the container %v: a supplementary "+
+				"group is a whole number above zero, never a name or other text (novox/hq ADR 0480 clause 7, ADR 0328 §15)",
+				module, key, v, resource["id"])
+		}
+		filled = append(filled, int(id))
+	}
+	resource["groups"] = filled
+	return nil
+}
diff --git a/internal/compose/resolution/setting_into_test.go b/internal/compose/resolution/setting_into_test.go
new file mode 100644
index 0000000..21d7647
--- /dev/null
+++ b/internal/compose/resolution/setting_into_test.go
@@ -0,0 +1,42 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// An operator's value reaches a file from the assignment's settings, the node's layer over the
+// mesh's (novox/hq ADR 0112, ADR 0155), and a value nothing set is refused by name.
+func TestASettingReachesAFileFromTheLayers(t *testing.T) {
+	file := map[string]any{"id": "env", "type": "file", "path": "/x/mail.env",
+		"content": "DOMAIN=${setting:domain}\nSITENAME=${setting:sitename}\nWORKERS=${setting:workers}\n"}
+	layers := []mcat.Layer{
+		{From: "the mesh", Values: map[string]any{"domain": "example.tld", "sitename": "Mesh", "workers": float64(4)}},
+		{From: "this node", Values: map[string]any{"sitename": "This one"}},
+	}
+	if err := settingInto(file, layers, "mail"); err != nil {
+		t.Fatal(err)
+	}
+	if file["content"] != "DOMAIN=example.tld\nSITENAME=This one\nWORKERS=4\n" {
+		t.Fatalf("filled as %q", file["content"])
+	}
+}
+
+func TestASettingNothingSetIsRefusedByName(t *testing.T) {
+	file := map[string]any{"id": "env", "type": "file", "content": "DOMAIN=${setting:domain}\n"}
+	err := settingInto(file, []mcat.Layer{{From: "the mesh", Values: map[string]any{"other": "x"}}}, "mail")
+	if err == nil {
+		t.Fatal("a setting nothing set was written as something")
+	}
+	for _, want := range []string{"${setting:domain}", "settings set mail", "set today: other"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Fatalf("the refusal lacks %q: %v", want, err)
+		}
+	}
+	// Left as it was: the literal placeholder must never reach a machine.
+	if file["content"] != "DOMAIN=${setting:domain}\n" {
+		t.Fatalf("content was changed on refusal: %q", file["content"])
+	}
+}
diff --git a/internal/compose/resolution/setting_takes.go b/internal/compose/resolution/setting_takes.go
new file mode 100644
index 0000000..c3302cb
--- /dev/null
+++ b/internal/compose/resolution/setting_takes.go
@@ -0,0 +1,216 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const takenKeyField = "key"
+
+const takenAsField = "as"
+
+// takenEntry is one value a mergeable file takes: its key and the name the file has for it.
+type takenEntry struct {
+	key, as string
+	renamed bool
+}
+
+// takenEntries is the entries of a takes-settings list in their order, a usable entry only: a string is a key
+// under its own name, an object with exactly key and as a key under another (TakenSettingsProblems says the rest).
+func takenEntries(raw any) []takenEntry {
+	list, _ := raw.([]any)
+	var out []takenEntry
+	for _, item := range list {
+		if e, ok := asTakenEntry(item); ok {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
+// asTakenEntry reads one item of a takes-settings list, and whether it is shaped as an entry at all.
+func asTakenEntry(item any) (takenEntry, bool) {
+	switch v := item.(type) {
+	case string:
+		return takenEntry{key: v, as: v}, true
+	case map[string]any:
+		key, keyOK := v[takenKeyField].(string)
+		as, asOK := v[takenAsField].(string)
+		if !keyOK || !asOK || len(v) != 2 {
+			return takenEntry{}, false
+		}
+		return takenEntry{key: key, as: as, renamed: true}, true
+	}
+	return takenEntry{}, false
+}
+
+// takenKeys is the keys a resource names in takes-settings, each with the name the file has for it, and whether
+// it names any list at all. An empty list is a list: that file takes no setting.
+func takenKeys(resource map[string]any) (map[string]string, bool) {
+	raw, said := resource[mcat.TakesSettingsField]
+	if !said {
+		return nil, false
+	}
+	keys := map[string]string{}
+	for _, e := range takenEntries(raw) {
+		keys[e.key] = e.as
+	}
+	return keys, true
+}
+
+// onlyTaken is the layers with every key the file does not name left out, and each key it takes under the
+// file's name for it. The file's own defaults and what the mesh reads itself are not touched here: settle
+// already keeps both out of a file.
+//
+// **A layer said before its module moved still reaches the file** (issue 751): such a layer names a renamed value
+// by the file's own spelling (nodered's timeZone on one machine), and until K5 moves the layer and renames the key
+// that spelling is taken as the value's, so moving the module changes no machine's file. Where one layer says
+// both, the config key wins.
+func onlyTaken(layers []mcat.Layer, taken map[string]string) []mcat.Layer {
+	oldSpelling := map[string]string{}
+	for key, as := range taken {
+		if as != key {
+			oldSpelling[as] = key
+		}
+	}
+	kept := make([]mcat.Layer, 0, len(layers))
+	for _, layer := range layers {
+		values := map[string]any{}
+		for key, value := range layer.Values {
+			if as, takes := taken[key]; takes {
+				values[as] = value
+				continue
+			}
+			if newKey, old := oldSpelling[key]; old {
+				if _, said := layer.Values[newKey]; !said {
+					values[key] = value
+				}
+			}
+		}
+		kept = append(kept, mcat.Layer{From: layer.From, Values: values, Default: layer.Default})
+	}
+	return kept
+}
+
+// takenSettingsProblems is every rule of ADR 0326 §2 and §4, judged where a definition is checked and
+// where a stored one is composed.
+func takenSettingsProblems(m mcat.Manifest) []string {
+	var problems []string
+	var naming, silent []string
+	for _, r := range m.Resources {
+		id := fmt.Sprint(r["id"])
+		how, _ := r["merge"].(string)
+		raw, said := r[mcat.TakesSettingsField]
+		if how == "" {
+			if said {
+				problems = append(problems, fmt.Sprintf("%s's %s says %s and does not merge: only a mergeable "+
+					"file takes settings by key (novox/hq ADR 0326)", m.Module, id, mcat.TakesSettingsField))
+			}
+			continue
+		}
+		if !said {
+			silent = append(silent, id)
+			continue
+		}
+		naming = append(naming, id)
+		list, isList := raw.([]any)
+		if !isList {
+			problems = append(problems, fmt.Sprintf("%s's %s: %s is a list of setting keys, and this is %T",
+				m.Module, id, mcat.TakesSettingsField, raw))
+			continue
+		}
+		protected := map[string]bool{}
+		for _, k := range stringsOf(r["protected"]) {
+			protected[k] = true
+		}
+		seen, landed := map[string]bool{}, map[string]bool{}
+		for _, item := range list {
+			if _, isObject := item.(map[string]any); isObject {
+				e, shaped := asTakenEntry(item)
+				switch {
+				case !m.DeclaresConfig():
+					problems = append(problems, fmt.Sprintf("%s's %s: %v in %s lays a value under another name, "+
+						"which only the config form says: write the key alone (novox/hq issue 751)",
+						m.Module, id, item, mcat.TakesSettingsField))
+					continue
+				case !shaped:
+					problems = append(problems, fmt.Sprintf("%s's %s: %v in %s is a key alone, or an object "+
+						"saying exactly %q and %q: the config key and the file's name for it (novox/hq issue 751)",
+						m.Module, id, item, mcat.TakesSettingsField, takenKeyField, takenAsField))
+					continue
+				case !settingRef.MatchString("${setting:" + e.key + "}"):
+					problems = append(problems, fmt.Sprintf("%s's %s: %q in %s is not a usable key: a config "+
+						"key is lower-case letters, digits, dots, dashes and underscores; the file's own spelling "+
+						"is its %q", m.Module, id, e.key, mcat.TakesSettingsField, takenAsField))
+					continue
+				case !usableKey(e.as):
+					problems = append(problems, fmt.Sprintf("%s's %s: %q, the name %s takes %q as, is not a "+
+						"usable name in a file", m.Module, id, e.as, mcat.TakesSettingsField, e.key))
+					continue
+				}
+				problems = append(problems, takenEntryProblems(m.Module, id, e, seen, landed, protected)...)
+				continue
+			}
+			key, isString := item.(string)
+			if !isString || !usableKey(key) {
+				problems = append(problems, fmt.Sprintf("%s's %s: %v in %s is not a usable setting key",
+					m.Module, id, item, mcat.TakesSettingsField))
+				continue
+			}
+			problems = append(problems, takenEntryProblems(m.Module, id, takenEntry{key: key, as: key}, seen,
+				landed, protected)...)
+		}
+	}
+	if len(naming) > 0 {
+		for _, id := range silent {
+			problems = append(problems, fmt.Sprintf("%s's %s merges and names no %s while %s does: once one "+
+				"mergeable file of a module names the keys it takes, every one does, an empty list for none "+
+				"(novox/hq ADR 0326)", m.Module, id, mcat.TakesSettingsField, strings.Join(naming, ", ")))
+		}
+	}
+	return problems
+}
+
+// takenEntryProblems is what is wrong with one usable entry of a file's takes-settings, against those before it:
+// a key taken twice, or two values laid under one name in the file; a word the mesh reads itself, as the key or as
+// the file's name; a name the file keeps as protected. seen and landed are the keys and the names so far, added to.
+func takenEntryProblems(module, id string, e takenEntry, seen, landed, protected map[string]bool) []string {
+	var problems []string
+	switch {
+	case seen[e.key]:
+		problems = append(problems, fmt.Sprintf("%s's %s names %q twice in %s", module, id, e.key, mcat.TakesSettingsField))
+	case landed[e.as]:
+		problems = append(problems, fmt.Sprintf("%s's %s names %q twice in %s, as a key or as the name a key is "+
+			"laid under: one name in a file holds one value", module, id, e.as, mcat.TakesSettingsField))
+	case meshWords[e.key] || meshWords[e.as]:
+		word := e.key
+		if !meshWords[word] {
+			word = e.as
+		}
+		problems = append(problems, fmt.Sprintf("%s's %s names %q in %s, and the mesh reads %q itself "+
+			"(novox/hq ADR 0164 §14)", module, id, word, mcat.TakesSettingsField, word))
+	case protected[e.as]:
+		problems = append(problems, fmt.Sprintf("%s's %s names %q in %s and keeps it as protected: a "+
+			"key is the file's or the setting's, never both", module, id, e.as, mcat.TakesSettingsField))
+	}
+	seen[e.key], landed[e.as] = true, true
+	return problems
+}
+
+// usableKey is a key a file can be said to take: not empty, and no space, line end or control
+// character. Not the lower-case rule of a `${setting:<key>}`: a file's own keys are its software's
+// spelling, such as `timeZone`.
+func usableKey(key string) bool {
+	if key == "" {
+		return false
+	}
+	for _, r := range key {
+		if unicode.IsSpace(r) || unicode.IsControl(r) || !unicode.IsPrint(r) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/compose/resolution/settings.go b/internal/compose/resolution/settings.go
new file mode 100644
index 0000000..71c1864
--- /dev/null
+++ b/internal/compose/resolution/settings.go
@@ -0,0 +1,517 @@
+package resolution
+
+import (
+	"bytes"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ApplySettings produces a resource's final content from the module's own and the layers over it.
+//
+// Layers are applied in order, so a later one beats an earlier one — the mesh's settings for a
+// module first, then this node's. A node that differs from the rest is expressed by differing,
+// rather than by repeating everything the rest already say.
+func ApplySettings(resource map[string]any, layers []mcat.Layer) (map[string]any, error) {
+	// Today's form reaches a mergeable file with every key of the layer as it was said, placement too
+	// (novox/hq ADR 0326 §3, ADR 0348 clause 11: a module not yet moved keeps it), so a file composes
+	// byte for byte as it did while placement was kept in the layer.
+	layers = asSaid(layers)
+	how, _ := resource["merge"].(string)
+	taken, names := takenKeys(resource)
+	if how == "" {
+		if names {
+			// Refused by the module check too (TakenSettingsProblems); said here as well, for a
+			// definition stored by an older binary, rather than handed to the host, which knows no
+			// such field.
+			return nil, fmt.Errorf("%v says %s and does not merge: only a mergeable file takes "+
+				"settings by key (novox/hq ADR 0326)", resource["id"], mcat.TakesSettingsField)
+		}
+		// Not a mergeable file. Settings for it are ignored rather than silently doing nothing
+		// somewhere else — see UnusedSettings, which is what says so.
+		return resource, nil
+	}
+	if names {
+		// **The file takes the keys it names, and no other** (novox/hq ADR 0326, issue 168): a key
+		// for another file, for a `${setting:<key>}` or for the mesh itself does not land here.
+		layers = onlyTaken(layers, taken)
+	}
+	if how != mcat.MergeJSON {
+		return nil, fmt.Errorf(
+			"%v says it merges as %q, and this control plane knows how to merge %q",
+			resource["id"], how, mcat.MergeJSON)
+	}
+
+	content, _ := resource["content"].(string)
+	var base map[string]any
+	if strings.TrimSpace(content) == "" {
+		base = map[string]any{}
+	} else if err := json.Unmarshal([]byte(content), &base); err != nil {
+		return nil, fmt.Errorf("%v says it merges as JSON and its content is not JSON: %w",
+			resource["id"], err)
+	}
+
+	protected := map[string]bool{}
+	for _, k := range stringsOf(resource["protected"]) {
+		protected[k] = true
+	}
+
+	merged, err := settle(base, layers, protected, fmt.Sprint(resource["id"]))
+	if err != nil {
+		return nil, err
+	}
+
+	out := map[string]any{}
+	for k, v := range resource {
+		out[k] = v
+	}
+	// Keys sorted by the encoder, so the same settings always produce the same bytes. A file
+	// whose lines move for no reason makes every reconcile look like a change, and anything
+	// reflecting it would restart for ever.
+	rendered, err := json.MarshalIndent(merged, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	out["content"] = string(rendered) + "\n"
+	delete(out, "merge")
+	delete(out, "protected")
+	delete(out, mcat.TrustedField)
+	delete(out, mcat.TakesSettingsField)
+	return out, nil
+}
+
+// Settle fills what a provider serves from its settings. Exported because a served fact is settled
+// where the mesh is walked rather than where a node is declared.
+//
+// **What a provider serves is its definition's; a layer replaces none of it** (novox/hq ADR 0348
+// clause 11, issue 696). A served value is filled from the layers only where the definition asks,
+// with `${setting:<key>}` (ADR 0155) — a mail provider's domain, an identity provider's issuer, a
+// time-series store's org and bucket — and a layer that sets a key the provider serves as a literal
+// changes nothing a consumer is told. Nor does a setting add a key (novox/hq 04-ISSUES/173): a
+// setting made for one of the provider's files — a site name, a public address — is not part of the
+// contract. Until issue 696, a layer replaced any served key it named; influxdb on ace was the one
+// layer relying on it, and serves `${setting:org}` and `${setting:bucket}` since.
+func Settle(base map[string]any, layers []mcat.Layer) (map[string]any, error) {
+	out, err := filledFromSettings(deepCopy(base), layers, "what is served")
+	if err != nil {
+		// Said as it was, untyped: what is served names no module here to type it by.
+		return nil, errors.New(err.Error())
+	}
+	return out, nil
+}
+
+// overridden lays settings over a contribution: a map whose keys are its contract. Only the keys the
+// map already declares are touched; the rest of a layer is somebody else's business (a file's,
+// another destination's) and is left to reach it there.
+//
+// A declared value may itself be the operator's, `${setting:<key>}` (ADR 0155), filled after the
+// overrides (filledFromSettings).
+func overridden(base map[string]any, layers []mcat.Layer, what string) (map[string]any, error) {
+	kept := make([]mcat.Layer, 0, len(layers))
+	for _, layer := range layers {
+		values := map[string]any{}
+		for key, value := range layer.Values {
+			if _, declared := base[key]; declared {
+				values[key] = value
+			}
+		}
+		kept = append(kept, mcat.Layer{From: layer.From, Values: values, Default: layer.Default})
+	}
+	merged, err := settle(base, kept, nil, what)
+	if err != nil {
+		return nil, err
+	}
+	return filledFromSettings(merged, layers, what)
+}
+
+// filledFromSettings fills each `${setting:<key>}` in a map's top-level strings from the layers,
+// later beating earlier and a module's defaults lowest, and refuses one nothing sets by name — a
+// literal placeholder handed to a consumer is a service configured against a string nobody meant.
+// It fills merged in place and returns it.
+func filledFromSettings(merged map[string]any, layers []mcat.Layer, what string) (map[string]any, error) {
+	for key, value := range merged {
+		s, ok := value.(string)
+		if !ok {
+			continue
+		}
+		for _, asked := range settingsUsed(s) {
+			v, set := settingValue(layers, asked)
+			if !set {
+				// Typed, its module and where left to the caller that knows them (Resolution.composed), so a module in
+				// the config form is refused in its own words (unsetInConfigWords; issue 1126, seed-8).
+				return nil, &UnsetSettingError{Setting: asked, field: key, setToday: orNoSettings(layers), said: fmt.Sprintf(
+					"%s says ${setting:%s} for %q, and nothing sets %q — an operator's value is the "+
+						"assignment's, never the definition's (novox/hq ADR 0112)%s",
+					what, asked, key, asked, orNoSettings(layers))}
+			}
+			s = strings.ReplaceAll(s, "${setting:"+asked+"}", plainly(v))
+		}
+		merged[key] = s
+	}
+	return merged, nil
+}
+
+// settle lays the layers over a module's own values, in order.
+//
+// Shared by a file's content and a module's contributions, because they are the same act: the
+// module says what it means by default, and somebody says what it means here. A contribution that
+// could not be settled would have to be edited to be reused anywhere else. The two differ in one
+// respect, and the caller decides it: a file takes keys it did not declare (a setting may add to a
+// configuration), a contribution does not (overridden). A served fact takes no layer at all; only
+// its ${setting:<key>} is filled (Settle).
+func settle(base map[string]any, layers []mcat.Layer, protected map[string]bool, what string) (
+	map[string]any, error) {
+	merged := deepCopy(base)
+	for _, layer := range layers {
+		if layer.Default {
+			// A module's own defaults fill ${setting:<key>} only (novox/hq ADR 0262). A mergeable
+			// file's content already is its defaults, and a contribution or served fact declares its
+			// own; laid on here, a default would reach every mergeable file of its module (issue 168).
+			continue
+		}
+		for key, value := range layer.Values {
+			if key == mcat.PortsSetting {
+				// Where the machine puts a port is the mesh's to apply, not a value for a file or
+				// for what a consumer is told (novox/hq ADR 0100); it reaches both as the port.
+				continue
+			}
+			if protected[key] {
+				// The module said it must own this one. Refused rather than ignored: a setting
+				// that is quietly dropped is somebody believing they changed something.
+				return nil, fmt.Errorf(
+					"%s sets %q on %v, and that module keeps %q for itself — it is not settable",
+					layer.From, key, what, key)
+			}
+			// **No layer replaces a secret the vault fills, at any depth** (novox/hq issue 610): a
+			// mergeable file's `${secret:<name>}` is the vault's value, and a layer that reached it —
+			// `server.secret_key` under a `server` the file takes — would put a value the operator or an
+			// agent chose where the vault's belongs. Judged against the file's own content, so it holds
+			// whatever a module's `protected` list says.
+			if at := secretReplacedBy(base[key], value, key); at != "" {
+				return nil, fmt.Errorf(
+					"%s sets %q on %v, which the vault fills (${secret:…}); a secret comes from the vault, "+
+						"never from a setting (novox/hq issues 342, 610)", layer.From, at, what)
+			}
+			merged[key] = mergeValue(merged[key], value)
+		}
+	}
+	return merged, nil
+}
+
+// mergeValue combines one value with the one over it.
+//
+// Two objects merge key by key, so setting one field of a nested block does not delete its
+// siblings. Anything else is replaced whole: a list that merged element-wise could neither be
+// shortened nor reordered, and there is no correct guess about which element is "the same one".
+func mergeValue(under, over any) any {
+	underMap, isUnderMap := under.(map[string]any)
+	overMap, isOverMap := over.(map[string]any)
+	if !isUnderMap || !isOverMap {
+		return over
+	}
+	merged := deepCopy(underMap)
+	for k, v := range overMap {
+		merged[k] = mergeValue(merged[k], v)
+	}
+	return merged
+}
+
+func deepCopy(in map[string]any) map[string]any {
+	out := map[string]any{}
+	for k, v := range in {
+		if nested, ok := v.(map[string]any); ok {
+			out[k] = deepCopy(nested)
+			continue
+		}
+		out[k] = v
+	}
+	return out
+}
+
+// settingsHoldOneLine refuses a line break, a carriage return, any other line end (lineEnds) or a NUL in any
+// string of any setting, for every
+// module, at any depth, keys as well as values, in an object or a list (novox/hq issue 339). A value is
+// substituted into env and configuration files the node-engine writes as root — an app's env file, a logind
+// drop-in — and a line break there is a line of the caller's own: a directive, an assignment, a section. A NUL
+// ends a string early wherever C reads it. Judged where a layer is kept and again where it is composed, so a
+// layer that holds one, however it got into the store, is said with its key. What must hold lines is a file
+// of the module's own, never a setting — with one exception, the certificate authority's root as certificates
+// (certificates), because that is how step-ca serves it.
+func settingsHoldOneLine(module string, layers []mcat.Layer) error {
+	for _, layer := range layers {
+		for _, key := range sortedKeysAny(layer.Values) {
+			if module == rootModule && key == rootSetting {
+				if text, ok := layer.Values[key].(string); ok && certificates(text) {
+					continue
+				}
+			}
+			if at := lineBreakIn(layer.Values[key], key); at != "" {
+				return fmt.Errorf("%s: the setting %s in %q holds a line break, a carriage return, another line end or a NUL, which a "+
+					"file it is written into would read as a line of its own; a setting is one line (novox/hq "+
+					"issue 339)", module, at, layer.From)
+			}
+		}
+	}
+	return nil
+}
+
+// lineEnds are every character a reader may take as the end of a line: \n and \r, vertical tab and form feed,
+// NEL, and the Unicode line and paragraph separators; and NUL, which ends a string early wherever C reads it.
+const lineEnds = "\n\r\v\f\x00\u0085\u2028\u2029"
+
+const rootModule = "step-ca"
+
+const rootSetting = "root"
+
+// certificates says whether a value is one or more PEM CERTIFICATE blocks and nothing else: each decodes with
+// encoding/pem, carries no headers, and parses with x509.ParseCertificate; nothing but a final line break
+// surrounds them, and every line ends with \n alone.
+func certificates(v string) bool {
+	if strings.ContainsAny(v, "\r\v\f\x00\u0085\u2028\u2029") {
+		return false
+	}
+	rest := []byte(v)
+	found := 0
+	for len(rest) > 0 {
+		if !bytes.HasPrefix(rest, []byte("-----BEGIN ")) {
+			return false
+		}
+		block, after := pem.Decode(rest)
+		if block == nil || block.Type != "CERTIFICATE" || len(block.Headers) > 0 {
+			return false
+		}
+		if _, err := x509.ParseCertificate(block.Bytes); err != nil {
+			return false
+		}
+		found++
+		rest = after
+	}
+	return found > 0
+}
+
+// lineBreakIn is where the first string under v holding \n, \r or NUL is, or "".
+func lineBreakIn(v any, at string) string {
+	if strings.ContainsAny(at, lineEnds) {
+		return strconv.Quote(at)
+	}
+	switch t := v.(type) {
+	case string:
+		if strings.ContainsAny(t, lineEnds) {
+			return at
+		}
+	case map[string]any:
+		for _, k := range sortedKeysAny(t) {
+			if found := lineBreakIn(t[k], at+"."+k); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for i, e := range t {
+			if found := lineBreakIn(e, fmt.Sprintf("%s[%d]", at, i)); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}
+
+func sortedKeysAny(m map[string]any) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+func stringsOf(v any) []string {
+	raw, ok := v.([]any)
+	if !ok {
+		return nil
+	}
+	var out []string
+	for _, item := range raw {
+		if s, ok := item.(string); ok {
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// KeptNetworks reads which found networks each of a module's containers keeps, by container id.
+//
+// Refused from a mesh-wide layer — a found network is a fact about one machine — for an id the
+// module declares no container under, for a name that is not a network's, and on a machine that
+// is not adopted: the setting exists so neighbours the mesh has not taken yet keep reaching the
+// container, and a converged machine has no such neighbours.
+func KeptNetworks(m mcat.Manifest, layers []mcat.Layer, adopted bool) (map[string][]string, error) {
+	containers := map[string]bool{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "container" {
+			containers[fmt.Sprint(r["id"])] = true
+		}
+	}
+	out := map[string][]string{}
+	for _, layer := range layers {
+		raw, ok := layer.Placement[mcat.NetworksSetting]
+		if !ok {
+			continue
+		}
+		if layer.From == mcat.MeshWideLayer {
+			return nil, fmt.Errorf("%s: %s is given per node — a found network is a fact about one "+
+				"machine; set it with --node", m.Module, mcat.NetworksSetting)
+		}
+		if !adopted {
+			return nil, fmt.Errorf("%s: %s keeps a found network for neighbours the mesh has not taken "+
+				"yet, and %s is converged — nothing on it is found; clear the setting", m.Module, mcat.NetworksSetting, layer.From)
+		}
+		blocks, ok := raw.(map[string]any)
+		if !ok {
+			return nil, fmt.Errorf("%s: %s is a { container: [network, …] } map, and %q set it to "+
+				"something else", m.Module, mcat.NetworksSetting, layer.From)
+		}
+		for id, body := range blocks {
+			if !containers[id] {
+				return nil, fmt.Errorf("%s: %s names the container %q, which it does not declare — "+
+					"the setting reaches nothing; it declares %s", m.Module, mcat.NetworksSetting, id,
+					orNothing(sortedKeys(containers)))
+			}
+			names := stringsOf(body)
+			if len(names) == 0 {
+				return nil, fmt.Errorf("%s: %s for %q is a list of network names, and %q set it to %v",
+					m.Module, mcat.NetworksSetting, id, layer.From, body)
+			}
+			for _, n := range names {
+				if !networkName.MatchString(n) {
+					return nil, fmt.Errorf("%s: %s for %q names %q, which is not a network name",
+						m.Module, mcat.NetworksSetting, id, n)
+				}
+			}
+			sort.Strings(names)
+			out[id] = names
+		}
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	return out, nil
+}
+
+// networkName is what a container runtime accepts as a network's name.
+var networkName = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_.-]*$`)
+
+// JudgeSettings composes a module's settings against its definition and refuses the first thing
+// that cannot work, naming the module, the layer and the key (novox/hq ADR 0163, rule 6).
+//
+// **The same judgement where a setting is stored and where a machine is declared.** Stored, a
+// setting that cannot compose is refused before it is kept; composed later, a definition that has
+// moved under a stored setting leaves that module out of the machine's declaration rather than
+// the machine without one. Every reader of settings runs here: a port given, an exposure, a reach,
+// an endpoint, a placement, an access, a kept network, a mergeable file's keys and a file's
+// `${setting:…}`. A key that reaches nothing is not here: it cannot break a composition, so it is
+// refused where it is stored (SetSettings, with UnusedSettings) and said where a plan is read,
+// and never costs a module its place.
+func JudgeSettings(m mcat.Manifest, layers []mcat.Layer, adopted bool) error {
+	// Placement is judged for line ends as it always was: a path is written into files as well.
+	if err := settingsHoldOneLine(m.Module, asSaid(layers)); err != nil {
+		return err
+	}
+	// Which keys each mergeable file takes is the definition's to say right (novox/hq ADR 0326);
+	// judged here too for a definition stored by an older binary.
+	if problems := takenSettingsProblems(m); len(problems) > 0 {
+		return fmt.Errorf("%s", problems[0])
+	}
+	// With no layers too: a definition may ask for a setting nobody made — an access placed by
+	// nobody, a file's ${setting:…} nothing sets — and that is the same statement, missing.
+	if _, err := GivenPorts(m, layers); err != nil {
+		return err
+	}
+	if _, err := Reaches(m, layers); err != nil {
+		return err
+	}
+	if _, err := mcat.Endpoints(m, layers); err != nil {
+		return err
+	}
+	if _, err := mcat.Places(m, layers); err != nil {
+		return err
+	}
+	if _, _, err := accessesFor(m, layers); err != nil {
+		return err
+	}
+	if _, err := KeptNetworks(m, layers, adopted); err != nil {
+		return err
+	}
+	for _, r := range m.Resources {
+		settled, err := ApplySettings(r, layers)
+		if err != nil {
+			return err
+		}
+		copied := map[string]any{}
+		for k, v := range settled {
+			copied[k] = v
+		}
+		if err := unsetInConfigWords(settingInto(copied, WithDefaults(m, layers), m.Module), m); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// secretReplacedBy is the path in a mergeable file's own content that a layer's value would replace while the
+// vault fills it — a string holding `${secret:` — or "" when the value leaves every such string as it is
+// (novox/hq issue 610). Maps merge key by key (mergeValue), so only the keys the value names are judged; any
+// other value replaces the whole of what it lands on.
+func secretReplacedBy(base, value any, at string) string {
+	if baseMap, isMap := base.(map[string]any); isMap {
+		if valueMap, also := value.(map[string]any); also {
+			keys := make([]string, 0, len(valueMap))
+			for k := range valueMap {
+				keys = append(keys, k)
+			}
+			sort.Strings(keys)
+			for _, k := range keys {
+				if found := secretReplacedBy(baseMap[k], valueMap[k], at+"."+k); found != "" {
+					return found
+				}
+			}
+			return ""
+		}
+	}
+	return secretIn(base, at)
+}
+
+// secretIn is the first path under v holding a vault placeholder, or "".
+func secretIn(v any, at string) string {
+	switch t := v.(type) {
+	case string:
+		if strings.Contains(t, "${secret:") {
+			return at
+		}
+	case map[string]any:
+		keys := make([]string, 0, len(t))
+		for k := range t {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+		for _, k := range keys {
+			if found := secretIn(t[k], at+"."+k); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for i, item := range t {
+			if found := secretIn(item, fmt.Sprintf("%s[%d]", at, i)); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}
diff --git a/internal/compose/resolution/settings_test.go b/internal/compose/resolution/settings_test.go
new file mode 100644
index 0000000..cf9352b
--- /dev/null
+++ b/internal/compose/resolution/settings_test.go
@@ -0,0 +1,106 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func file(content string, protected ...string) map[string]any {
+	r := map[string]any{"id": "conf", "type": "file", "path": "/etc/thing.json",
+		"merge": mcat.MergeJSON, "content": content}
+	if len(protected) > 0 {
+		var as []any
+		for _, p := range protected {
+			as = append(as, p)
+		}
+		r["protected"] = as
+	}
+	return r
+}
+
+func TestAProtectedKeyIsRefusedNotIgnored(t *testing.T) {
+	// A setting quietly dropped is somebody believing they changed something. Refusing says so
+	// while they are looking at it.
+	_, err := ApplySettings(file(`{"socket":"/run/thing.sock","log":"info"}`, "socket"),
+		[]mcat.Layer{{From: "node", Values: map[string]any{"socket": "/tmp/mine.sock"}}})
+	if err == nil {
+		t.Fatal("a protected key was overridden")
+	}
+	if !strings.Contains(err.Error(), "socket") || !strings.Contains(err.Error(), "not settable") {
+		t.Errorf("the refusal does not say which key or why: %v", err)
+	}
+}
+
+func TestTheSameSettingsAlwaysProduceTheSameBytes(t *testing.T) {
+	// A file whose lines move for no reason makes every reconcile look like a change, and a
+	// service reflecting it would restart for ever.
+	//
+	// Note what this defends: Go's JSON encoder sorts map keys, so the stability comes from the
+	// standard library and this passes with the merging removed. It is worth keeping as the thing
+	// that would catch a move to an encoder that does not sort — but it is not evidence about the
+	// code below it, and it was checked.
+	resource := file(`{"b":2,"a":1,"c":3}`)
+	layer := mcat.Layer{From: "node", Values: map[string]any{"z": 26.0, "a": 100.0}}
+
+	first, err := ApplySettings(resource, []mcat.Layer{layer})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 5; i++ {
+		again, err := ApplySettings(resource, []mcat.Layer{layer})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if again["content"] != first["content"] {
+			t.Fatal("the same settings produced different bytes")
+		}
+	}
+}
+
+func TestAFileThatDoesNotMergeIsLeftAlone(t *testing.T) {
+	plain := map[string]any{"id": "conf", "type": "file", "path": "/etc/thing",
+		"content": "not structured at all\n"}
+	out, err := ApplySettings(plain, []mcat.Layer{{From: "node", Values: map[string]any{"x": 1}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out["content"] != "not structured at all\n" {
+		t.Errorf("a file with no merge rule was changed: %v", out["content"])
+	}
+}
+
+func TestContentThatIsNotJSONIsRefusedWhereSomebodyIsLooking(t *testing.T) {
+	// Rather than on the machine, at apply time, as a file the program cannot read.
+	_, err := ApplySettings(file(`this is not json`), nil)
+	if err == nil {
+		t.Fatal("a module claiming to merge as JSON shipped something else and was accepted")
+	}
+}
+
+// No layer replaces a value the vault fills, at any depth (novox/hq issue 610): searxng's server.secret_key
+// sits under `server`, a key its file takes, and a layer reaching it was let through by a top-level-only check.
+func TestNoLayerReplacesAVaultSecretAtAnyDepth(t *testing.T) {
+	file := map[string]any{"id": "settings", "type": "file", "merge": mcat.MergeJSON,
+		"content": `{"server": {"secret_key": "${secret:secret}", "port": 8080}, "ui": {"theme": "simple"}, "token": "${secret:token}"}`}
+	layer := func(values map[string]any) []mcat.Layer { return []mcat.Layer{{From: "anchor", Values: values}} }
+
+	merged, err := ApplySettings(file, layer(map[string]any{"server": map[string]any{"port": float64(9000)}, "ui": map[string]any{"theme": "dark"}}))
+	if err != nil {
+		t.Fatalf("a key beside the secret was refused: %v", err)
+	}
+	if c := merged["content"].(string); !strings.Contains(c, `"secret_key": "${secret:secret}"`) || !strings.Contains(c, `"port": 9000`) {
+		t.Fatalf("the secret or the setting did not land as meant:\n%s", c)
+	}
+	for name, values := range map[string]map[string]any{
+		"the nested secret":        {"server": map[string]any{"secret_key": "chosen"}},
+		"the whole map holding it": {"server": "elsewhere"},
+		"a top-level secret":       {"token": "chosen"},
+		"the secret, emptied":      {"server": map[string]any{"secret_key": ""}},
+	} {
+		if _, err := ApplySettings(file, layer(values)); err == nil || !strings.Contains(err.Error(), "vault") {
+			t.Errorf("%s: %v, want a refusal naming the vault", name, err)
+		}
+	}
+}
diff --git a/internal/compose/resolution/several_contributions_test.go b/internal/compose/resolution/several_contributions_test.go
new file mode 100644
index 0000000..0bdceda
--- /dev/null
+++ b/internal/compose/resolution/several_contributions_test.go
@@ -0,0 +1,117 @@
+package resolution
+
+import (
+	"encoding/json"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const twoRoutes = `{"module":"minio","version":"1","requires":["route"],
+  "contributes":{"route":{"api":{"label":"files-api","port":9000},"console":{"label":"files","port":9001}}}}`
+
+func minimalRouteProxy() mcat.Manifest {
+	return mcat.Manifest{Module: "route-proxy", Version: "1",
+		Provides: mcat.FromAnywhere("route"),
+		Receives: map[string]string{"route": "/var/lib/route-proxy/routes/mesh.json"},
+	}
+}
+
+func TestAModuleWithTwoRoutesGivesTheProviderTwoContributions(t *testing.T) {
+	minio, err := decodeForTest([]byte(twoRoutes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := Resolve(shelf(minimalRouteProxy(), minio), []string{"route-proxy", "minio"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var given []mcat.Contribution
+	for _, r := range out {
+		if r["path"] != "/var/lib/route-proxy/routes/mesh.json" {
+			continue
+		}
+		var parsed struct {
+			Given []mcat.Contribution `json:"given"`
+		}
+		if err := json.Unmarshal([]byte(r["content"].(string)), &parsed); err != nil {
+			t.Fatal(err)
+		}
+		given = parsed.Given
+	}
+	if len(given) != 2 {
+		t.Fatalf("two named routes from one module are two contributions: %+v", given)
+	}
+	byPort := map[float64]string{}
+	for _, g := range given {
+		if g.From != "minio" {
+			t.Fatalf("both contributions are minio's: %+v", g)
+		}
+		port, _ := g.Values["port"].(float64)
+		label, _ := g.Values["label"].(string)
+		byPort[port] = label
+	}
+	if byPort[9000] != "files-api" || byPort[9001] != "files" {
+		t.Fatalf("the two routes did not both survive: %+v", given)
+	}
+}
+
+// A module with the ordinary, single-contribution shape resolves exactly as it did before —
+// ContributesMany being empty must change nothing about it.
+func TestASingleRouteStillResolvesTheOrdinaryWay(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := received(t, mustDeclare(t, got))
+	if len(given) != 1 || given[0].From != "board" {
+		t.Fatalf("the plain shape regressed: %+v", given)
+	}
+}
+
+// ContributionsFrom is what mints the ONE pair credential a requiring module is granted
+// (cmd/mesh-controller/plan.go's grantsFor) — a separate path from Declaration()'s raw file, and
+// the one the two-routes test above never exercised. Where a module contributes several times,
+// there is no single "the" value: settling to whichever sorts first would both misrepresent the
+// grant and collide with that same contribution's own entry from contributions(), which is
+// exactly the duplicate a live plan against minio surfaced (files-api appearing once with a
+// credential, once without, while files got neither).
+func TestContributionsFromHasNoSingleValueWhenAModuleContributesSeveralTimes(t *testing.T) {
+	minio, err := decodeForTest([]byte(twoRoutes))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := Resolve(shelf(minimalRouteProxy(), minio), []string{"route-proxy", "minio"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	values, asks, err := ContributionsFrom(got, "route", "minio", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !asks {
+		t.Fatal("minio still requires route, so it still asks")
+	}
+	if len(values) != 0 {
+		t.Fatalf("no single value represents two contributions, got %+v", values)
+	}
+}
+
+// The ordinary, single-contribution case is unchanged: exactly one match still settles to it.
+func TestContributionsFromReturnsTheOneValueForAnOrdinaryContribution(t *testing.T) {
+	got, err := Resolve(shelf(proxy(), published("board", "board", 8080)), []string{"board"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	values, asks, err := ContributionsFrom(got, "reverse-proxy", "board", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !asks || values["host"] != "board" {
+		t.Fatalf("the ordinary single contribution should still settle to its own value: %+v", values)
+	}
+}
diff --git a/internal/compose/resolution/several_secrets_test.go b/internal/compose/resolution/several_secrets_test.go
new file mode 100644
index 0000000..dadd431
--- /dev/null
+++ b/internal/compose/resolution/several_secrets_test.go
@@ -0,0 +1,144 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const twoSecrets = `{"module":"ca","version":"1","requires":["secret"],
+  "secrets":{"secret":{"root-key":"/var/lib/ca/root.key","root-pass":"/var/lib/ca/root.pass"}},
+  "resources":[{"id":"state","type":"directory","path":"/var/lib/ca","mode":"0700"}]}`
+
+func vaultAndCA() map[string]mcat.Manifest {
+	ca, _ := decodeForTest([]byte(twoSecrets))
+	vault := mcat.Manifest{Module: "mesh-vault", Version: "1", Provides: mcat.FromAnywhere("secret"),
+		Grants:   map[string]string{"secret": "/var/lib/vault/grants"},
+		Receives: map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}}
+	// A second consumer of the same provision that keeps ONE file, mentioned before the one that
+	// keeps two: the lab found the expansion done on the first module to mention the provision,
+	// and the second consumer given one credential and no file.
+	cache := mcat.Manifest{Module: "cache", Version: "1", Requires: []string{"secret"},
+		Secrets: map[string]string{"secret": "/var/lib/cache/secret"}}
+	return shelf(vault, cache, ca)
+}
+
+func TestEachLocalNameIsANeedAFileAndAHolderOfItsOwn(t *testing.T) {
+	got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "cache", "ca"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var locals, cacheLocals []string
+	for _, n := range got.Needs {
+		if n.Name == "secret" && n.For == "ca" {
+			locals = append(locals, n.Local)
+		}
+		if n.Name == "secret" && n.For == "cache" {
+			cacheLocals = append(cacheLocals, n.Local)
+		}
+	}
+	if strings.Join(locals, ",") != "root-key,root-pass" {
+		t.Fatalf("two secrets from one provider are two needs: %v", got.Needs)
+	}
+	if len(cacheLocals) != 1 || cacheLocals[0] != "" {
+		t.Fatalf("the one-file consumer keeps one need with no local name: %v", got.Needs)
+	}
+	for i := range got.Needs {
+		got.Needs[i].Sealed = "sealed-" + got.Needs[i].Local
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]string{}
+	for _, r := range out {
+		if r["type"] == "file" && strings.HasPrefix(r["path"].(string), "/var/lib/ca/root.") {
+			seen[r["id"].(string)] = r["sealed"].(string)
+		}
+	}
+	if seen["ca."+mcat.SecretID("root-key")] != "sealed-root-key" || seen["ca."+mcat.SecretID("root-pass")] != "sealed-root-pass" {
+		t.Fatalf("each local name is its own file with its own credential: %v", seen)
+	}
+}
+
+func TestAProviderSeesEachLocalNameAsAHolderOfItsOwn(t *testing.T) {
+	r := mcat.Resolution{Modules: []mcat.Manifest{vaultAndCA()["mesh-vault"]}}
+	got, err := resolutionContributions(r, mcat.SettingsBy{}, []mcat.Grant{
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-key", Sealed: "x"},
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-pass", Sealed: "y"},
+	}, map[string]string{"secret": "/var/lib/vault/grants"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	given := got["secret"]
+	if len(given) != 2 {
+		t.Fatalf("two holders: %+v", given)
+	}
+	if given[0].As != "mesh_workstation_ca_root_key" && given[0].As != "mesh_workstation_ca_root-key" {
+		t.Fatalf("the holder is the consumer's identity with the local name after it: %q", given[0].As)
+	}
+	if given[0].Secret == given[1].Secret {
+		t.Fatalf("two holders share one file on the provider: %q", given[0].Secret)
+	}
+}
+
+// And on the provider's machine, two files with two ids — the lab's first run had the declaration
+// refused for two resources with one identity.
+func TestAProviderKeepsOneFilePerHolder(t *testing.T) {
+	got, err := Resolve(vaultAndCA(), []string{"mesh-vault", "cache", "ca"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Grants: []mcat.Grant{
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-key", Sealed: "x"},
+		{Provision: "secret", Consumer: "workstation", From: "ca", Local: "root-pass", Sealed: "y"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ids := map[string]string{}
+	for _, r := range out {
+		if id, _ := r["id"].(string); strings.Contains(id, "grant-secret") {
+			ids[id] = r["path"].(string)
+		}
+	}
+	if len(ids) != 2 {
+		t.Fatalf("two holders are two grant files: %v", ids)
+	}
+}
+
+// One file under a local name is still a local name (review C1): the need carries it, the file
+// is written, and ${secret:<name>} is filled.
+func TestOneLocalNameIsStillALocalName(t *testing.T) {
+	only, _ := decodeForTest([]byte(`{"module":"one","version":"1","requires":["secret"],
+	  "secrets":{"secret":{"only":"/var/lib/one/only"}}}`))
+	vault := vaultAndCA()["mesh-vault"]
+	got, err := Resolve(shelf(vault, only), []string{"mesh-vault", "one"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var found *mcat.Needed
+	for i, n := range got.Needs {
+		if n.For == "one" && n.Name == "secret" {
+			found = &got.Needs[i]
+		}
+	}
+	if found == nil || found.Local != "only" {
+		t.Fatalf("the one named file did not become a need under its name: %v", got.Needs)
+	}
+	found.Sealed = "sealed-only"
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var written bool
+	for _, r := range out {
+		if r["path"] == "/var/lib/one/only" && r["sealed"] == "sealed-only" {
+			written = true
+		}
+	}
+	if !written {
+		t.Fatal("the file under the one local name was not written")
+	}
+}
diff --git a/internal/compose/resolution/shared_account_test.go b/internal/compose/resolution/shared_account_test.go
new file mode 100644
index 0000000..f4ae90e
--- /dev/null
+++ b/internal/compose/resolution/shared_account_test.go
@@ -0,0 +1,71 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func userResource(fields map[string]any) map[string]any {
+	r := map[string]any{"id": "operator", "type": "user", "name": "op"}
+	for k, v := range fields {
+		r[k] = v
+	}
+	return r
+}
+
+func TestAShellAndAGroupOnOneAccountFromTwoModulesResolve(t *testing.T) {
+	zsh := mcat.Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{"shell": "/usr/bin/zsh"})}}
+	docker := mcat.Manifest{Module: "docker", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"docker"}})}}
+	other := mcat.Manifest{Module: "media", Resources: []map[string]any{userResource(map[string]any{"groups": []any{"video"}})}}
+	if problems := checkResources([]mcat.Manifest{zsh, docker, other}); len(problems) != 0 {
+		t.Fatalf("a shell and two modules' groups on one account were refused: %v", problems)
+	}
+	if _, err := Resolve(shelf(zsh, docker, other), []string{"zsh", "docker", "media"}, workstation(), mcat.World{}); err != nil {
+		t.Fatalf("the three did not resolve together: %v", err)
+	}
+}
+
+func TestTwoModulesSettingOneAccountsShellOrHomeAreRefused(t *testing.T) {
+	for _, field := range []string{"shell", "home"} {
+		a := mcat.Manifest{Module: "zsh", Resources: []map[string]any{userResource(map[string]any{field: "/one"})}}
+		b := mcat.Manifest{Module: "fish", Resources: []map[string]any{userResource(map[string]any{field: "/two", "groups": []any{"x"}})}}
+		problems := checkResources([]mcat.Manifest{a, b})
+		want := `zsh and fish both set the ` + field + ` of the user "op"`
+		if len(problems) != 1 || !strings.Contains(problems[0], want) {
+			t.Errorf("two modules setting %s gave %v, want %q", field, problems, want)
+		}
+	}
+}
+
+// An account a module declares only to put in a group is applied where it is written, after the package
+// that makes the group (novox/hq ADR 0252); one that says how it logs in still goes first (issue 213).
+func TestAnAccountOnlyGivenGroupsKeepsItsWrittenPlace(t *testing.T) {
+	compose := func(raw string) []map[string]any {
+		t.Helper()
+		m, err := decodeForTest([]byte(raw))
+		if err != nil {
+			t.Fatal(err)
+		}
+		out, err := Declaration(mcat.Resolution{Node: "workstation", Modules: []mcat.Manifest{m}}, mcat.Rendering{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return out
+	}
+	out := compose(`{"module": "lights", "version": "1", "resources": [
+	  {"id": "daemon", "type": "package", "package": "lights-daemon"},
+	  {"id": "account", "type": "user", "name": "op", "groups": ["lights"]}
+	]}`)
+	if pkg, acct := indexOf(out, "lights.daemon"), indexOf(out, "lights.account"); pkg < 0 || acct < pkg {
+		t.Fatalf("the account (%d) is not after the package that makes its group (%d): %v", acct, pkg, out)
+	}
+	out = compose(`{"module": "shell", "version": "1", "resources": [
+	  {"id": "package", "type": "package", "package": "zsh"},
+	  {"id": "login", "type": "user", "name": "op", "shell": "/usr/bin/zsh", "groups": ["wheel"]}
+	]}`)
+	if pkg, acct := indexOf(out, "shell.package"), indexOf(out, "shell.login"); acct < 0 || acct > pkg {
+		t.Fatalf("an account with a shell is no longer first (%d, package %d): %v", acct, pkg, out)
+	}
+}
diff --git a/internal/compose/resolution/shared_credential_test.go b/internal/compose/resolution/shared_credential_test.go
new file mode 100644
index 0000000..7b8f701
--- /dev/null
+++ b/internal/compose/resolution/shared_credential_test.go
@@ -0,0 +1,48 @@
+package resolution
+
+import (
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func sharingShelf() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "downloader", Version: "1",
+		Provides:   []mcat.Offer{{Name: "downloader-api", Scope: mcat.ScopeMesh, Credential: &mcat.OfferCredential{Own: "password"}}},
+		OwnSecrets: mcat.OwnSecrets{"password": {Path: "/var/lib/mesh/downloader/password", Taken: mcat.TakenAtStart}},
+		Serves:     map[string]map[string]any{"downloader-api": {"port": 8080, "username": "admin"}}}, mcat.Manifest{Module: "manager", Version: "1", Requires: []string{"downloader-api"}},
+	)
+}
+
+func TestAConsumersNeedCarriesTheSharedSecretsName(t *testing.T) {
+	// On the same machine.
+	together, err := Resolve(sharingShelf(), []string{"downloader", "manager"}, workstation(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, n := range together.Needs {
+		if n.Name == "downloader-api" && n.For == "manager" {
+			found = true
+			if n.SharedOwn != "password" {
+				t.Fatalf("the need on one machine does not name the shared secret: %+v", n)
+			}
+		}
+	}
+	if !found {
+		t.Fatalf("the manager's need was not resolved: %+v", together.Needs)
+	}
+	// Across machines, the provider known by its module.
+	apart, err := Resolve(sharingShelf(), []string{"manager"}, onBoth("example.tld"), mcat.World{
+		Offered: map[string][]mcat.Provider{"downloader-api": {{Node: "home-server", At: "home-server.internal",
+			Module: "downloader", Serves: map[string]any{"port": 8080}}}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range apart.Needs {
+		if n.Name == "downloader-api" && n.SharedOwn != "password" {
+			t.Fatalf("the need across machines does not name the shared secret: %+v", n)
+		}
+	}
+}
diff --git a/internal/compose/resolution/shares.go b/internal/compose/resolution/shares.go
new file mode 100644
index 0000000..7616c19
--- /dev/null
+++ b/internal/compose/resolution/shares.go
@@ -0,0 +1,78 @@
+package resolution
+
+import (
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// nfsServerVerbs is the contract every holder of node-nfs-server serves (novox/hq ADR 0263).
+func nfsServerVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "exports", Description: "Every share this machine exports: its name, its path, read-write or " +
+			"read-only, the owner every client is mapped to (uid and gid), each node it is exported to with that " +
+			"node's private address and access (only the nodes the server grants it to and that ask for it), " +
+			"what is granted and not asked for or asked for and not granted, and whether the kernel holds it " +
+			"now. Also the exports found that are not the mesh's: a dataset's sharenfs property, a line in " +
+			"/etc/exports.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -v", "cat /etc/exports", "zfs get sharenfs"}},
+		{Name: "clients", Description: "Which machines have mounted which share now, as the NFS server " +
+			"knows its clients.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"ss -tn sport = :2049", "cat /proc/fs/nfsd/clients/*/info"}},
+		{Name: "test", Description: "Whether this machine exports one share for the mesh now, and whether its " +
+			"NFS service is up; with an address, also whether the share is exported to that address: a node's " +
+			"own private address, when the server grants it the share and the node asks for it. What a machine " +
+			"mounting the share asks before it mounts.",
+			Input: schema(map[string]string{
+				"share":   "the share, by its name",
+				"address": "a node's private address, to ask whether the share is exported to it (optional)",
+			}, []string{"share"}),
+			Replaces: []string{"showmount -e"}},
+		{Name: "reload", Description: "Have the kernel read this machine's export files again now (exportfs " +
+			"-ra) and answer the shares as it then holds them. The module's own process writes its export " +
+			"file; this is for after a change made outside it. Changes no shared path.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"exportfs -ra"}},
+		{Name: "adopt", Description: "Take over an export a person made by hand: clear a dataset's sharenfs " +
+			"property for a path the mesh's own export now serves — only when that export is live. Without " +
+			"confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"path":    "the shared path whose hand-made export is taken over",
+				"confirm": "\"true\": change it (needs why); anything else is a dry run",
+				"why":     "why, for the record",
+			}, []string{"path"}, "confirm"),
+			Replaces: []string{"zfs set sharenfs=off"}},
+	}
+}
+
+// mountsVerbs is the contract every holder of node-mounts serves (novox/hq ADR 0263).
+func mountsVerbs() []mcat.Verb {
+	return []mcat.Verb{
+		{Name: "list", Description: "Every mount point on this machine: its fstab line, the mesh's mount and " +
+			"automount units for it, its state (armed, mounted, absent, unreachable, failed) and since when, " +
+			"and which settings asked for it. A password in a mount's options is never shown.",
+			Input:    schema(map[string]string{}, nil),
+			Replaces: []string{"cat /etc/fstab", "findmnt", "systemctl list-units --type=mount"}},
+		{Name: "test", Description: "Whether one share's or occasional source's server answers from this " +
+			"machine now, without touching its mount point.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"showmount -e", "ping"}},
+		{Name: "mount", Description: "Mount one share or occasional source now, rather than at its first " +
+			"access.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"mount"}},
+		{Name: "unmount", Description: "Release one share or occasional source now; its automount stays " +
+			"armed, so the next access mounts it again.",
+			Input:    schema(map[string]string{"name": "the share or source, by its name"}, []string{"name"}),
+			Replaces: []string{"umount"}},
+		{Name: "adopt", Description: "Take over a mount a person wrote by hand: comment out the /etc/fstab " +
+			"line for a mount point the mesh's own units now serve, keeping a copy of the file — only when " +
+			"the mesh's automount for it is armed. Without confirm, says what it would do and changes nothing.",
+			Input: schema(map[string]string{
+				"mountpoint": "the mount point whose fstab line is taken over",
+				"confirm":    "\"true\": change it (needs why); anything else is a dry run",
+				"why":        "why, for the record",
+			}, []string{"mountpoint"}, "confirm"),
+			Replaces: []string{"sed -i /etc/fstab"}},
+	}
+}
diff --git a/internal/compose/resolution/short_form_port_protocol_test.go b/internal/compose/resolution/short_form_port_protocol_test.go
new file mode 100644
index 0000000..89c0d2c
--- /dev/null
+++ b/internal/compose/resolution/short_form_port_protocol_test.go
@@ -0,0 +1,26 @@
+package resolution
+
+import (
+	"fmt"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A short-form port may name its protocol — "3478/udp" — and the mesh assigns the number exactly
+// as it does for "3478": the protocol rides along on the outside. Read as one token, the suffix made
+// the entry "not a port" and the runtime published it on a random machine port (found on ace: unifi's
+// STUN and discovery, while every TCP pin beside them held).
+func TestAShortFormPortKeepsItsProtocolAndGetsItsMachinePort(t *testing.T) {
+	container := map[string]any{"type": "container", "ports": []any{"3478/udp", "8443", "10001/udp"}}
+	with := mcat.Rendering{
+		Given: map[string]map[int]int{"unifi": {3478: 3478}},
+		Ports: map[string]map[int]int{"unifi": {8443: 20010, 10001: 20011}},
+	}
+	publishedOn(container, "unifi", with)
+	got := fmt.Sprint(container["ports"])
+	want := "[3478:3478/udp 20010:8443 20011:10001/udp]"
+	if got != want {
+		t.Fatalf("published %s, want %s", got, want)
+	}
+}
diff --git a/internal/compose/resolution/ssh_client_test.go b/internal/compose/resolution/ssh_client_test.go
new file mode 100644
index 0000000..e750448
--- /dev/null
+++ b/internal/compose/resolution/ssh_client_test.go
@@ -0,0 +1,117 @@
+package resolution
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/beside"
+)
+
+// boundKeys are every key the files of a module ask of ${bound:forge-account:<key>}, read from the module's own
+// tree on the shelf, so the test offers what ssh-client asks however often it asks one more (issue 985).
+func boundKeys(t *testing.T, module, provision string) map[string]bool {
+	t.Helper()
+	ask := regexp.MustCompile(`\$\{bound:` + regexp.QuoteMeta(provision) + `:([A-Za-z0-9_.-]+)\}`)
+	keys := map[string]bool{}
+	root := filepath.Join(beside.Catalogue(t), module)
+	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() || strings.HasSuffix(path, "_test.go") {
+			return err
+		}
+		body, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		for _, m := range ask.FindAllStringSubmatch(string(body), -1) {
+			keys[m[1]] = true
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("reading what %s asks of %s: %v", module, provision, err)
+	}
+	return keys
+}
+
+// The ssh-client module, composed as a machine receives it (novox/hq to-be 29, research 027/03): a
+// region at the START of the operator's ~/.ssh/config that includes ~/.ssh/config.d/* — first,
+// because ssh takes the first value it finds for each option — and the mesh's Host blocks as the
+// whole of ~/.ssh/config.d/00-mesh, every other node with its account. ~/.ssh and ~/.ssh/config.d
+// are created 0700 and owned by the account; the operator's own config below the region is kept.
+func TestSSHClientOwnsTheOperatorsSSHConfig(t *testing.T) {
+	shelf := shelf(catalogueManifest(t, "ssh-client"), catalogueManifest(t, "gitea"))
+	// ssh-client requires forge-account since mesh-catalog #340 (novox/hq issue 955), answered by the forge's
+	// holder on another node; this test is about the operator's config, so the forge is offered from there
+	// (issue 985).
+	// Every key ssh-client's files ask is offered, read from them (boundKeys); a few have a realistic value.
+	serves := map[string]any{}
+	for key := range boundKeys(t, "ssh-client", "forge-account") {
+		serves[key] = "sample-" + key
+	}
+	for key, value := range map[string]any{"ssh_host": "marge.internal", "ssh_port": 222,
+		"known_host": "[marge.internal]:222 ssh-ed25519 AAAA", "ssh_base": "ssh://git@marge.internal:222/",
+		"https_base": "https://git.example.org/"} {
+		serves[key] = value
+	}
+	forge := mcat.World{Offered: map[string][]mcat.Provider{
+		"forge-account": {{Node: "marge", At: "marge.internal", Module: "gitea", Serves: serves}}}}
+	got, err := Resolve(shelf, []string{"ssh-client"}, mcat.Node{Name: "homer", At: "homer.internal", Account: "jo", AccountHome: "/home/jo"}, forge)
+	if err != nil {
+		t.Fatal(err)
+	}
+	names := map[string]string{"homer.internal": "10.10.0.1", "marge.internal": "10.10.0.2",
+		"bart.internal": "10.10.0.3"}
+	out, err := Declaration(got, mcat.Rendering{
+		Names: names, Machines: names,
+		Accounts: map[string]string{"homer": "jo", "marge": "jo", "bart": "op"},
+		Suffix:   "internal",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	by := map[string]map[string]any{}
+	for _, r := range out {
+		by[r["id"].(string)] = r
+	}
+
+	for id, path := range map[string]string{
+		"ssh-client.ssh-dir": "/home/jo/.ssh", "ssh-client.config-d": "/home/jo/.ssh/config.d"} {
+		dir := by[id]
+		if dir == nil || dir["type"] != "directory" || dir["path"] != path || dir["owner"] != "jo" || dir["mode"] != "0700" {
+			t.Fatalf("%s is not created 0700 owned by the account: %v", path, dir)
+		}
+	}
+
+	cfg := by["ssh-client.config"]
+	if cfg == nil || cfg["path"] != "/home/jo/.ssh/config" || cfg["owner"] != "jo" ||
+		cfg["into"] != "block" || cfg["at"] != "start" {
+		t.Fatalf("the mesh's region is not the first thing in the operator's ~/.ssh/config: %v", cfg)
+	}
+	if body := cfg["content"].(string); !strings.Contains(body, "\nInclude ~/.ssh/config.d/*\n") || strings.Contains(body, "\nHost ") {
+		t.Fatalf("the region does not just include config.d:\n%s", body)
+	}
+
+	var hosts map[string]any
+	for _, r := range out {
+		if r["path"] == "/home/jo/.ssh/config.d/00-mesh" {
+			hosts = r
+		}
+	}
+	if hosts == nil || hosts["type"] != "file" || hosts["into"] != nil {
+		t.Fatalf("the mesh's hosts are not the whole of ~/.ssh/config.d/00-mesh: %v", hosts)
+	}
+	body := hosts["content"].(string)
+	for _, want := range []string{"Host marge marge.internal", "Host bart bart.internal", "User jo", "User op"} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("00-mesh does not say %q — every other node with its account:\n%s", want, body)
+		}
+	}
+	if strings.Contains(body, "Host homer ") {
+		t.Fatalf("00-mesh names the machine itself, not only its peers:\n%s", body)
+	}
+}
diff --git a/internal/compose/resolution/template.go b/internal/compose/resolution/template.go
new file mode 100644
index 0000000..3bcd65c
--- /dev/null
+++ b/internal/compose/resolution/template.go
@@ -0,0 +1,31 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// HeldTemplateProblem is why a manifest cannot be held by the mesh because it still names a template, or "": the
+// manifest the mesh holds carries every file's text, which a build reads back from its templates archive. One
+// naming a template was resolved by a builder that does not read templates, and would compose files with no text.
+func HeldTemplateProblem(m mcat.Manifest) string {
+	var named []string
+	for _, r := range m.Resources {
+		if t, has := r[mcat.TemplateField]; has {
+			named = append(named, fmt.Sprintf("%v (%v)", r["id"], t))
+		}
+	}
+	for _, it := range m.Items {
+		if it.Template != "" {
+			named = append(named, fmt.Sprintf("its item of %s (%s)", it.Collection, it.Template))
+		}
+	}
+	if len(named) == 0 {
+		return ""
+	}
+	return fmt.Sprintf("%s still names the template(s) of %s: the manifest the mesh holds carries each file's "+
+		"text, read back from the build's templates archive — this one was resolved by a builder that does not "+
+		"read templates, or not built at all (novox/hq ADR 0349 §2)", m.Module, strings.Join(named, ", "))
+}
diff --git a/internal/compose/resolution/template_test.go b/internal/compose/resolution/template_test.go
new file mode 100644
index 0000000..446407d
--- /dev/null
+++ b/internal/compose/resolution/template_test.go
@@ -0,0 +1,73 @@
+package resolution
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const inlineTwin = `{"module":"tidy","version":"1",
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[
+    {"id":"conf","type":"directory","path":"${dir:conf}"},
+    {"id":"main","type":"file","path":"${dir:conf}/tidy.conf","mode":"0644","content":"` + mainText + `"},
+    {"id":"extra","type":"file","path":"${dir:conf}/extra.conf","content":"` + extraText + `"}]}`
+
+const templatedTwin = `{"module":"tidy","version":"1",
+  "build":{"artifacts":[{"name":"files","kind":"archive","from":"files"}]},
+  "resources":[
+    {"id":"conf","type":"directory","path":"${dir:conf}"},
+    {"id":"main","type":"file","path":"${dir:conf}/tidy.conf","mode":"0644","template":"files/tidy.conf"},
+    {"id":"extra","type":"file","path":"${dir:conf}/extra.conf","template":"files/deeper/extra.conf"}]}`
+
+const mainText = `# tidy\nroot = ${dir:conf}\nquoted = \"yes\" é\n`
+
+const extraText = `one\ntwo\n`
+
+func builtFiles(texts map[string]string) []mcat.Built {
+	return []mcat.Built{{Name: "files", Kind: mcat.ArtifactArchive,
+		Reference: mcat.ArtifactStoreScheme + "tidy/files/blobs/sha256:" + strings.Repeat("c", 64),
+		Digest:    "sha256:" + strings.Repeat("c", 64), Texts: texts}}
+}
+
+// held is a manifest as registration holds it: resolved with what was built, then read again strictly.
+func held(t *testing.T, raw string, built []mcat.Built) mcat.Manifest {
+	t.Helper()
+	m, err := decodeForTest([]byte(raw))
+	if err != nil {
+		t.Fatal(err)
+	}
+	resolved, err := m.Resolve(built)
+	if err != nil {
+		t.Fatal(err)
+	}
+	again, err := json.Marshal(resolved)
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := decodeForTest(again)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if problem := HeldTemplateProblem(out); problem != "" {
+		t.Fatal(problem)
+	}
+	return out
+}
+
+// What registration refuses: a manifest to be held that still names a template — one resolved by a builder that
+// predates templates would otherwise compose files with no text.
+func TestAManifestStillNamingATemplateIsNotHeld(t *testing.T) {
+	m, err := decodeForTest([]byte(templatedTwin))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if problem := HeldTemplateProblem(m); !strings.Contains(problem, "main") || !strings.Contains(problem, "files/tidy.conf") {
+		t.Fatalf("a manifest naming a template would be held: %q", problem)
+	}
+	if problem := HeldTemplateProblem(held(t, inlineTwin, builtFiles(nil))); problem != "" {
+		t.Fatalf("an inline manifest is refused: %s", problem)
+	}
+}
diff --git a/internal/compose/resolution/terminal_settings_test.go b/internal/compose/resolution/terminal_settings_test.go
new file mode 100644
index 0000000..0c867e2
--- /dev/null
+++ b/internal/compose/resolution/terminal_settings_test.go
@@ -0,0 +1,77 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A line break, a carriage return or a NUL in any string of any setting is refused, at any depth, keys too —
+// where a layer is judged, which is both where it is kept and where it is composed (novox/hq issue 339).
+func TestASettingHoldsOneLine(t *testing.T) {
+	m := mcat.Manifest{Module: "mailu"}
+	for _, v := range []any{"a\nDEBUG=1", "a\rb", "a\x00b", []any{"ok", "x\ny"},
+		map[string]any{"k": []any{"ok", map[string]any{"deep": "x\ny"}}}, map[string]any{"k\nx": "v"}} {
+		if err := JudgeSettings(m, []mcat.Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
+			!strings.Contains(err.Error(), "line break") {
+			t.Errorf("%q: %v", v, err)
+		}
+	}
+	if err := JudgeSettings(m, []mcat.Layer{{From: "home", Values: map[string]any{"v\nPATH": "x"}}}, false); err == nil {
+		t.Error("a line break in a key was taken")
+	}
+	if err := JudgeSettings(m, []mcat.Layer{{From: "home", Values: map[string]any{"v": "one line", "n": 3.0,
+		"l": []any{"a", "b"}}}}, false); err != nil {
+		t.Errorf("one line each: %v", err)
+	}
+}
+
+// Lines are allowed in one setting only: step-ca's `root`, as certificates that encoding/pem decodes and
+// x509.ParseCertificate parses (novox/hq issue 339). Any other module or key, another label, or a block that is
+// not a certificate is refused like any other line break.
+func TestOnlyTheAuthoritysRootMayHoldLines(t *testing.T) {
+	ca := mcat.Manifest{Module: "step-ca"}
+	judge := func(m mcat.Manifest, key, v string) error {
+		return JudgeSettings(m, []mcat.Layer{{From: "anchor", Values: map[string]any{key: v}}}, false)
+	}
+	for _, ok := range []string{servedRoot, servedRoot + servedRoot, strings.TrimSuffix(servedRoot, "\n")} {
+		if err := judge(ca, "root", ok); err != nil {
+			t.Errorf("the authority's root: %v", err)
+		}
+	}
+	body := strings.TrimSuffix(strings.TrimPrefix(servedRoot, "-----BEGIN CERTIFICATE-----\n"), "-----END CERTIFICATE-----\n")
+	for name, bad := range map[string]string{
+		"a line after it":        servedRoot + "PATH=/tmp\n",
+		"a line before it":       "PATH=\n" + servedRoot,
+		"another label":          "-----BEGIN PRIVATE KEY-----\n" + body + "-----END PRIVATE KEY-----\n",
+		"headers":                "-----BEGIN CERTIFICATE-----\nProc-Type: 4,ENCRYPTED\n\n" + body + "-----END CERTIFICATE-----\n",
+		"base64 that is no cert": "-----BEGIN CERTIFICATE-----\nMIIBeDCCAR2gAwIBAgIQfake000000000000000000000000\n-----END CERTIFICATE-----\n",
+		"carriage returns":       strings.ReplaceAll(servedRoot, "\n", "\r\n"),
+	} {
+		if err := judge(ca, "root", bad); err == nil {
+			t.Errorf("%s was taken", name)
+		}
+	}
+	if err := judge(ca, "other", servedRoot); err == nil {
+		t.Error("a certificate in another key of the authority was taken")
+	}
+	if err := judge(mcat.Manifest{Module: "mailu"}, "root", servedRoot); err == nil {
+		t.Error("a certificate in another module's setting was taken")
+	}
+	if err := JudgeSettings(ca, []mcat.Layer{{From: "anchor", Values: map[string]any{"root": []any{servedRoot}}}}, false); err == nil {
+		t.Error("a certificate below the top of the setting was taken")
+	}
+}
+
+// Every character a reader takes as the end of a line is refused, not only \n and \r: vertical tab, form feed,
+// NEL and the Unicode line and paragraph separators (novox/hq issue 339).
+func TestEveryLineEndIsRefused(t *testing.T) {
+	m := mcat.Manifest{Module: "mailu"}
+	for _, v := range []string{"a\vb", "a\fb", "a\u0085b", "a\u2028b", "a\u2029b"} {
+		if err := JudgeSettings(m, []mcat.Layer{{From: "home", Values: map[string]any{"v": v}}}, false); err == nil ||
+			!strings.Contains(err.Error(), "line break") {
+			t.Errorf("%q: %v", v, err)
+		}
+	}
+}
diff --git a/internal/compose/resolution/testdata/bars/bar-battery b/internal/compose/resolution/testdata/bars/bar-battery
new file mode 100644
index 0000000..d2386ba
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/bar-battery
@@ -0,0 +1,9 @@
+[[block]]
+block = "battery"
+format = "$icon $percentage{ $time|}"
+charging_format = "$icon $percentage{ $time|}"
+not_charging_format = "$icon $percentage"
+full_format = "$icon $percentage"
+empty_format = "$icon $percentage"
+missing_format = ""
+
diff --git a/internal/compose/resolution/testdata/bars/bar-power-draw b/internal/compose/resolution/testdata/bars/bar-power-draw
new file mode 100644
index 0000000..3d0d338
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/bar-power-draw
@@ -0,0 +1,6 @@
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-value power.draw ${machine:name}"
+interval = 5
+hide_when_empty = true
+
diff --git a/internal/compose/resolution/testdata/bars/battery.bottom-bar.toml b/internal/compose/resolution/testdata/bars/battery.bottom-bar.toml
new file mode 100644
index 0000000..d5ec4c7
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/battery.bottom-bar.toml
@@ -0,0 +1,119 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+# power
+[[block]]
+block = "battery"
+format = "$icon $percentage{ $time|}"
+charging_format = "$icon $percentage{ $time|}"
+not_charging_format = "$icon $percentage"
+full_format = "$icon $percentage"
+empty_format = "$icon $percentage"
+missing_format = ""
+
+
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/compose/resolution/testdata/bars/battery.top-bar.toml b/internal/compose/resolution/testdata/bars/battery.top-bar.toml
new file mode 100644
index 0000000..33f1a3b
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/battery.top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+
diff --git a/internal/compose/resolution/testdata/bars/both.bottom-bar.toml b/internal/compose/resolution/testdata/bars/both.bottom-bar.toml
new file mode 100644
index 0000000..ad3a4e6
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/both.bottom-bar.toml
@@ -0,0 +1,126 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+# power
+[[block]]
+block = "battery"
+format = "$icon $percentage{ $time|}"
+charging_format = "$icon $percentage{ $time|}"
+not_charging_format = "$icon $percentage"
+full_format = "$icon $percentage"
+empty_format = "$icon $percentage"
+missing_format = ""
+
+# power
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-value power.draw workstation"
+interval = 5
+hide_when_empty = true
+
+
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/compose/resolution/testdata/bars/both.top-bar.toml b/internal/compose/resolution/testdata/bars/both.top-bar.toml
new file mode 100644
index 0000000..33f1a3b
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/both.top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+
diff --git a/internal/compose/resolution/testdata/bars/bottom-bar.toml b/internal/compose/resolution/testdata/bars/bottom-bar.toml
new file mode 100644
index 0000000..12e6805
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/bottom-bar.toml
@@ -0,0 +1,109 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+${collected:contribution:node-bar:block:bar=bottom,place=resources}
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+${collected:contribution:node-bar:block:bar=bottom,place=status}
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/compose/resolution/testdata/bars/none.bottom-bar.toml b/internal/compose/resolution/testdata/bars/none.bottom-bar.toml
new file mode 100644
index 0000000..59dc87a
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/none.bottom-bar.toml
@@ -0,0 +1,109 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/compose/resolution/testdata/bars/none.top-bar.toml b/internal/compose/resolution/testdata/bars/none.top-bar.toml
new file mode 100644
index 0000000..33f1a3b
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/none.top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+
diff --git a/internal/compose/resolution/testdata/bars/power-meter.bottom-bar.toml b/internal/compose/resolution/testdata/bars/power-meter.bottom-bar.toml
new file mode 100644
index 0000000..ae6c2ce
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/power-meter.bottom-bar.toml
@@ -0,0 +1,116 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+# power
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-value power.draw workstation"
+interval = 5
+hide_when_empty = true
+
+
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/internal/compose/resolution/testdata/bars/power-meter.top-bar.toml b/internal/compose/resolution/testdata/bars/power-meter.top-bar.toml
new file mode 100644
index 0000000..33f1a3b
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/power-meter.top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+
diff --git a/internal/compose/resolution/testdata/bars/top-bar.toml b/internal/compose/resolution/testdata/bars/top-bar.toml
new file mode 100644
index 0000000..be198e8
--- /dev/null
+++ b/internal/compose/resolution/testdata/bars/top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+${collected:contribution:node-bar:block:bar=top,place=resources}${collected:contribution:node-bar:block:bar=top,place=status}
diff --git a/internal/compose/resolution/testdata/catalogue-835bf22b-claude-code.module.json b/internal/compose/resolution/testdata/catalogue-835bf22b-claude-code.module.json
new file mode 100644
index 0000000..3b62d21
--- /dev/null
+++ b/internal/compose/resolution/testdata/catalogue-835bf22b-claude-code.module.json
@@ -0,0 +1,249 @@
+{
+  "module": "claude-code",
+  "version": "1",
+  "moved": true,
+  "slug": "agent",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
+  ],
+  "binds": {
+    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
+  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "servers",
+    "holdings",
+    "config",
+    "proposals",
+    "questions",
+    "memory",
+    "waits"
+  ],
+  "reads": [
+    "claude-licence-manager.bindings"
+  ],
+  "tools": [
+    "claude_code_status",
+    "claude_code_render",
+    "claude_code_guard",
+    "claude_code_pull",
+    "claude_code_grant",
+    "claude_code_add_api_key",
+    "claude_code_registrations",
+    "claude_code_memory",
+    "claude_code_mcp_list",
+    "claude_code_mcp_register",
+    "claude_code_mcp_unregister",
+    "claude_code_skill_list",
+    "claude_code_skill_register",
+    "claude_code_skill_unregister",
+    "claude_code_agent_list",
+    "claude_code_agent_register",
+    "claude_code_agent_unregister",
+    "claude_code_command_list",
+    "claude_code_command_register",
+    "claude_code_command_unregister",
+    "claude_code_hook_list",
+    "claude_code_hook_register",
+    "claude_code_hook_unregister",
+    "claude_code_output_style_list",
+    "claude_code_output_style_register",
+    "claude_code_output_style_unregister",
+    "claude_code_instructions_list",
+    "claude_code_instructions_register",
+    "claude_code_instructions_unregister",
+    "claude_code_instructions_propose",
+    "claude_code_proposals",
+    "claude_code_ask",
+    "claude_code_answer",
+    "claude_code_wait",
+    "claude_code_settings_get",
+    "claude_code_settings_set",
+    "claude_code_settings_clear",
+    "claude_code_permission_add",
+    "claude_code_permission_remove",
+    "claude_code_config_list",
+    "claude_code_config_show",
+    "claude_code_config_status",
+    "claude_code_config_import",
+    "claude_code_home_show",
+    "claude_code_home_remove",
+    "claude_code_home_removed",
+    "claude_code_home_restore",
+    "claude_code_judge",
+    "claude_code_judged"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "agent-home",
+        "path": "${dir:agent-home}",
+        "class": "valuable",
+        "why": "the operator's agent's own files: its memory, history and projects"
+      }
+    ]
+  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "claude-code"
+    },
+    {
+      "id": "managed",
+      "type": "directory",
+      "path": "/etc/claude-code",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/claude-agent",
+      "mode": "0755",
+      "template": "files/claude-agent"
+    },
+    {
+      "id": "agent-account-name",
+      "type": "file",
+      "path": "/etc/claude-code/agent-account",
+      "mode": "0644",
+      "template": "files/agent-account"
+    },
+    {
+      "id": "agent-account",
+      "type": "user",
+      "name": "${machine:agent-account}",
+      "home": "${machine:agent-home}",
+      "root": "${machine:agent-root}"
+    },
+    {
+      "id": "agent-home",
+      "type": "directory",
+      "path": "${machine:agent-home}/.claude",
+      "mode": "0700",
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "facts",
+      "type": "file",
+      "path": "${dir:state}/facts.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "template": "files/facts.json"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-code",
+        "binary": "claude-code",
+        "loads": [
+          "claude-code"
+        ],
+        "env": {
+          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
+          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
+          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/resolution/testdata/catalogue-835bf22b-dunst.module.json b/internal/compose/resolution/testdata/catalogue-835bf22b-dunst.module.json
new file mode 100644
index 0000000..0c6983b
--- /dev/null
+++ b/internal/compose/resolution/testdata/catalogue-835bf22b-dunst.module.json
@@ -0,0 +1,123 @@
+{
+  "module": "dunst",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-notifier",
+      "scope": "node",
+      "serves": [
+        "send",
+        "history"
+      ]
+    }
+  ],
+  "tools": [
+    "dunst_pause",
+    "dunst_resume",
+    "dunst_close_all",
+    "dunst_rules",
+    "dunst_count",
+    "dunst_reload"
+  ],
+    "config": {
+      "font-size": {
+        "type": "number",
+        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+        "minimum": 6,
+        "maximum": 72,
+        "predefined": "font-size",
+        "default": 10
+      },
+      "width": {
+        "type": "number",
+        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
+        "minimum": 50,
+        "maximum": 4000,
+        "default": 250
+      }
+    },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dunst"
+    },
+    {
+      "id": "client",
+      "type": "package",
+      "package": "libnotify"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "dropins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["50-slack.conf"]
+    },
+    {
+      "id": "configuration",
+      "trusted": false,
+      "type": "file",
+      "path": "${machine:account-home}/.config/dunst/dunstrc",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/dunstrc"
+    },
+    {
+      "id": "notifier",
+      "type": "service",
+      "unit": "dunst.service",
+      "scope": "user",
+      "user": "${machine:account}",
+      "reload-on": [
+        "configuration"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dunst-tools",
+        "binary": "dunst-tools",
+        "loads": [
+          "dunst-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "emits": [
+    "action-chosen",
+    "started",
+    "paused"
+  ],
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-dunst.conf"
+    }
+  ]
+}
diff --git a/internal/compose/resolution/testdata/catalogue-835bf22b-xterm.module.json b/internal/compose/resolution/testdata/catalogue-835bf22b-xterm.module.json
new file mode 100644
index 0000000..b65be8e
--- /dev/null
+++ b/internal/compose/resolution/testdata/catalogue-835bf22b-xterm.module.json
@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/compose/resolution/testdata/environment/all.posix b/internal/compose/resolution/testdata/environment/all.posix
new file mode 100644
index 0000000..aa61849
--- /dev/null
+++ b/internal/compose/resolution/testdata/environment/all.posix
@@ -0,0 +1,26 @@
+# adwaita
+export GTK2_RC_FILES='/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc'
+export GTK_THEME='Adwaita:dark'
+export QT_QPA_PLATFORMTHEME='qt6ct'
+export QT_SELECT='6'
+export QT_STYLE_OVERRIDE='Fusion'
+export XCURSOR_SIZE='24'
+export XCURSOR_THEME='Adwaita'
+# clipmenu
+export CM_HISTLENGTH='15'
+export CM_MAX_CLIPS='500'
+export CM_SELECTIONS='clipboard'
+# i3
+export XDG_CURRENT_DESKTOP='i3'
+export XDG_SESSION_DESKTOP='i3'
+# xterm
+export TERMINAL='xterm'
+# zsh
+export EDITOR='vim'
+export VISUAL='vim'
+export XDG_CONFIG_HOME='/home/op/.config'
+# zsh
+case ":${PATH}:" in *':/home/op/scripts/bin:'*) ;; *) PATH='/home/op/scripts/bin'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/home/op/scripts:'*) ;; *) PATH='/home/op/scripts'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
+export PATH
diff --git a/internal/compose/resolution/testdata/environment/all.systemd b/internal/compose/resolution/testdata/environment/all.systemd
new file mode 100644
index 0000000..70e7709
--- /dev/null
+++ b/internal/compose/resolution/testdata/environment/all.systemd
@@ -0,0 +1,23 @@
+# adwaita
+GTK2_RC_FILES=/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc
+GTK_THEME=Adwaita:dark
+QT_QPA_PLATFORMTHEME=qt6ct
+QT_SELECT=6
+QT_STYLE_OVERRIDE=Fusion
+XCURSOR_SIZE=24
+XCURSOR_THEME=Adwaita
+# clipmenu
+CM_HISTLENGTH=15
+CM_MAX_CLIPS=500
+CM_SELECTIONS=clipboard
+# i3
+XDG_CURRENT_DESKTOP=i3
+XDG_SESSION_DESKTOP=i3
+# xterm
+TERMINAL=xterm
+# zsh
+EDITOR=vim
+VISUAL=vim
+XDG_CONFIG_HOME=/home/op/.config
+# zsh
+PATH=/home/op/.local/bin:/home/op/scripts:/home/op/scripts/bin${PATH:+:$PATH}
diff --git a/internal/compose/resolution/testdata/environment/zsh.posix b/internal/compose/resolution/testdata/environment/zsh.posix
new file mode 100644
index 0000000..905c157
--- /dev/null
+++ b/internal/compose/resolution/testdata/environment/zsh.posix
@@ -0,0 +1,9 @@
+# zsh
+export EDITOR='vim'
+export VISUAL='vim'
+export XDG_CONFIG_HOME='/home/op/.config'
+# zsh
+case ":${PATH}:" in *':/home/op/scripts/bin:'*) ;; *) PATH='/home/op/scripts/bin'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/home/op/scripts:'*) ;; *) PATH='/home/op/scripts'"${PATH:+:${PATH}}" ;; esac
+case ":${PATH}:" in *':/home/op/.local/bin:'*) ;; *) PATH='/home/op/.local/bin'"${PATH:+:${PATH}}" ;; esac
+export PATH
diff --git a/internal/compose/resolution/testdata/environment/zsh.systemd b/internal/compose/resolution/testdata/environment/zsh.systemd
new file mode 100644
index 0000000..2a28ce0
--- /dev/null
+++ b/internal/compose/resolution/testdata/environment/zsh.systemd
@@ -0,0 +1,6 @@
+# zsh
+EDITOR=vim
+VISUAL=vim
+XDG_CONFIG_HOME=/home/op/.config
+# zsh
+PATH=/home/op/.local/bin:/home/op/scripts:/home/op/scripts/bin${PATH:+:$PATH}
diff --git a/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-ace.json b/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-ace.json
new file mode 100644
index 0000000..d9e60b8
--- /dev/null
+++ b/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-ace.json
@@ -0,0 +1,35 @@
+{
+  "grafana.bound-influxdb-api": {
+    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"made-up-bucket\",\n    \"org\": \"made-up-org\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
+    "id": "grafana.bound-influxdb-api",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb.json",
+    "type": "file"
+  },
+  "grafana.influxdb-datasource": {
+    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: made-up-bucket\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+    "id": "grafana.influxdb-datasource",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
+    "type": "file"
+  },
+  "grafana.influxdb-datasources": {
+    "id": "grafana.influxdb-datasources",
+    "mode": "0755",
+    "owner": "472:0",
+    "path": "/var/lib/grafana/influxdb-datasources",
+    "type": "directory"
+  },
+  "grafana.mesh-state": {
+    "id": "grafana.mesh-state",
+    "mode": "0700",
+    "path": "/var/lib/mesh/grafana",
+    "type": "directory"
+  },
+  "grafana.state": {
+    "id": "grafana.state",
+    "mode": "0700",
+    "path": "/var/lib/grafana",
+    "type": "directory"
+  }
+}
diff --git a/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-unlayered.json b/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-unlayered.json
new file mode 100644
index 0000000..a0ee798
--- /dev/null
+++ b/internal/compose/resolution/testdata/influxdb-served-by-setting/grafana-unlayered.json
@@ -0,0 +1,35 @@
+{
+  "grafana.bound-influxdb-api": {
+    "content": "{\n  \"as\": \"mesh_workstation_grafana\",\n  \"at\": \"workstation.internal\",\n  \"binding\": 1,\n  \"from\": \"workstation\",\n  \"generated\": \"by the mesh — do not edit; replaced whenever this changes. The credential is not here: it is sealed, in the file this module's manifest names under `secrets`\",\n  \"provision\": \"influxdb-api\",\n  \"serves\": {\n    \"bucket\": \"default\",\n    \"org\": \"mesh\",\n    \"port\": 8086,\n    \"scheme\": \"http\"\n  }\n}\n",
+    "id": "grafana.bound-influxdb-api",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb.json",
+    "type": "file"
+  },
+  "grafana.influxdb-datasource": {
+    "content": "apiVersion: 1\n# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):\n# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and\n# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because\n# the mesh resets it. The password is read from the file the mesh delivers, never written here.\ndatasources:\n  - name: InfluxDB (mesh)\n    uid: mesh-influxdb-api\n    type: influxdb\n    access: proxy\n    url: http://workstation.internal:8086\n    user: mesh_workstation_grafana\n    isDefault: false\n    editable: false\n    jsonData:\n      dbName: default\n      httpMode: POST\n    secureJsonData:\n      password: $__file{/run/secrets/influxdb/influxdb-api}\n",
+    "id": "grafana.influxdb-datasource",
+    "mode": "0644",
+    "path": "/var/lib/grafana/influxdb-datasources/mesh-influxdb.yaml",
+    "type": "file"
+  },
+  "grafana.influxdb-datasources": {
+    "id": "grafana.influxdb-datasources",
+    "mode": "0755",
+    "owner": "472:0",
+    "path": "/var/lib/grafana/influxdb-datasources",
+    "type": "directory"
+  },
+  "grafana.mesh-state": {
+    "id": "grafana.mesh-state",
+    "mode": "0700",
+    "path": "/var/lib/mesh/grafana",
+    "type": "directory"
+  },
+  "grafana.state": {
+    "id": "grafana.state",
+    "mode": "0700",
+    "path": "/var/lib/grafana",
+    "type": "directory"
+  }
+}
diff --git a/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger b/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger
new file mode 100644
index 0000000..5e4d165
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.contribution-node-hotkeys-trigger
@@ -0,0 +1,10 @@
+# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
+# and the touchpad key. Each runs this module's own script, as the operator's account.
+KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
+KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
+KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
+KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal b/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal
new file mode 100644
index 0000000..af60a9d
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/asus-zephyrus-g14.shell-after-wake-normal
@@ -0,0 +1,7 @@
+# The touchpad's settings again after waking, in the operator's session: X applies the module's
+# input class when the device appears, and this covers a wake that does not initialise it again.
+# Runs as root from the power module; the reset itself runs as the session's owner.
+sleep 2
+owner=$(ps -o user= -C i3 | head -n 1)
+[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
+true
diff --git a/internal/compose/resolution/testdata/l2-moved/items/claude-code.shell-zsh-normal b/internal/compose/resolution/testdata/l2-moved/items/claude-code.shell-zsh-normal
new file mode 100644
index 0000000..b90b85f
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/claude-code.shell-zsh-normal
@@ -0,0 +1,12 @@
+# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
+# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
+# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
+# the real claude: exec, sudo and its sh see no alias.
+if [[ -r /etc/claude-code/agent-account ]]; then
+	() {
+		local agent=$(</etc/claude-code/agent-account)
+		if [[ -n $agent && $agent != $USERNAME ]]; then
+			alias claude=claude-agent
+		fi
+	}
+fi
diff --git a/internal/compose/resolution/testdata/l2-moved/items/mesh-cli.shell-zsh-normal b/internal/compose/resolution/testdata/l2-moved/items/mesh-cli.shell-zsh-normal
new file mode 100644
index 0000000..117f2a5
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/mesh-cli.shell-zsh-normal
@@ -0,0 +1,3 @@
+# The operator's command (module mesh-cli, novox/hq ADR 0272): nox is mesh-cli, in interactive zsh only.
+# A script, sudo and a document meant to work everywhere say mesh-cli.
+alias nox=mesh-cli
diff --git a/internal/compose/resolution/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal b/internal/compose/resolution/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal
new file mode 100644
index 0000000..ba4fc1d
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/powerlevel10k.shell-zsh-normal
@@ -0,0 +1,3 @@
+# The prompt: powerlevel10k v1.20.0, pinned in this module (novox/hq ADR 0205), and its configuration.
+[[ ! -f ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme
+[[ ! -f ~/.config/powerlevel10k/p10k.zsh ]] || source ~/.config/powerlevel10k/p10k.zsh
diff --git a/internal/compose/resolution/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal b/internal/compose/resolution/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal
new file mode 100644
index 0000000..8179334
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/zsh-autosuggestions.shell-zsh-normal
@@ -0,0 +1,2 @@
+# Suggestions from history as you type, from the distribution's package.
+[[ ! -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
diff --git a/internal/compose/resolution/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last b/internal/compose/resolution/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last
new file mode 100644
index 0000000..bf9d5b1
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/items/zsh-syntax-highlighting.shell-zsh-last
@@ -0,0 +1,3 @@
+# Syntax highlighting of the command line, from the distribution's package. Last, as upstream asks:
+# it wraps every widget defined before it.
+[[ ! -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
diff --git a/internal/compose/resolution/testdata/l2-moved/templates/power b/internal/compose/resolution/testdata/l2-moved/templates/power
new file mode 100644
index 0000000..2655c22
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/templates/power
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment after-wake, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:after-wake:first}${shell:after-wake:normal}${shell:after-wake:last}
\ No newline at end of file
diff --git a/internal/compose/resolution/testdata/l2-moved/templates/triggerhappy b/internal/compose/resolution/testdata/l2-moved/templates/triggerhappy
new file mode 100644
index 0000000..4576633
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/templates/triggerhappy
@@ -0,0 +1,4 @@
+# The machine's hotkeys, written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on
+# every push: a key is added by the module it belongs to, as a contribution to node-hotkeys.
+# A line is: the key, its state (1 pressed, 2 held, 0 released), the command.
+${contribution:node-hotkeys:trigger}
\ No newline at end of file
diff --git a/internal/compose/resolution/testdata/l2-moved/templates/zsh b/internal/compose/resolution/testdata/l2-moved/templates/zsh
new file mode 100644
index 0000000..0e868f5
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/templates/zsh
@@ -0,0 +1,60 @@
+# The mesh's block (module zsh, novox/hq ADR 0204): the defaults every machine shares, and the code
+# other modules contribute in three slots. It is replaced at every push. Everything below it is
+# yours, kept as you wrote it, and runs after it, so your lines win.
+${shell:zsh:first}
+# History, kept across sessions and shared between open shells. Without these zsh saves none:
+# SAVEHIST defaults to 0 (novox/hq to-be 41, found on review 2026-10-04).
+HISTFILE="$HOME/.zsh_history"
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE HIST_REDUCE_BLANKS
+
+# The completion system. Nothing initialised it, so only zsh's basic completion ran. Its cache
+# goes under ~/.cache rather than beside ~/.zshrc.
+[[ -d "$HOME/.cache/zsh" ]] || mkdir -p "$HOME/.cache/zsh"
+autoload -Uz compinit && compinit -d "$HOME/.cache/zsh/zcompdump"
+zstyle ':completion:*' menu select
+
+# Terminal title: host, directory, git branch
+function set_terminal_title() {
+  local git_branch=""
+  if git rev-parse --is-inside-work-tree &>/dev/null; then
+    git_branch=" ($(git branch --show-current 2>/dev/null))"
+  fi
+  print -Pn "\e]2;%m: %~${git_branch}\a"
+}
+precmd_functions+=(set_terminal_title)
+
+# Keybindings
+bindkey  "^[[H"   beginning-of-line   # Home
+bindkey  "^[OH"   beginning-of-line   # Home
+bindkey  "^A"   beginning-of-line     # Ctrl + A
+bindkey  "^[[F"   end-of-line         # End
+bindkey  "^[OF"   end-of-line         # End
+bindkey  "^E"   end-of-line           # Ctrl + E
+bindkey  "^[[3~"  delete-char         # Del
+
+# Colour support of ls and friends
+if [ -x /usr/bin/dircolors ]; then
+  test -r $HOME/.dircolors && eval "$(dircolors -b $HOME/.dircolors)" || eval "$(dircolors -b)"
+  alias ls='ls --color=auto'
+  alias dir='dir --color=auto'
+  alias vdir='vdir --color=auto'
+  alias grep='grep --color=auto'
+  alias fgrep='fgrep --color=auto'
+  alias egrep='egrep --color=auto'
+fi
+alias ll='ls -alhF'
+alias la='ls -Ah'
+alias l='ls -CFh'
+
+# A throwaway container, and what takes the space under a directory
+alias drun='docker run -it --rm'
+disksize() {
+  du -h --max-depth=1 "${1:-.}" | sort -h
+}
+sudo-disksize() {
+  sudo du -h --max-depth=1 "${1:-.}" | sort -h
+}
+
+${shell:zsh:normal}${shell:zsh:last}
diff --git a/internal/compose/resolution/testdata/l2-moved/want/power b/internal/compose/resolution/testdata/l2-moved/want/power
new file mode 100644
index 0000000..736d28b
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/want/power
@@ -0,0 +1,11 @@
+# What every module on this machine runs at the moment after-wake, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+# asus-zephyrus-g14
+# The touchpad's settings again after waking, in the operator's session: X applies the module's
+# input class when the device appears, and this covers a wake that does not initialise it again.
+# Runs as root from the power module; the reset itself runs as the session's owner.
+sleep 2
+owner=$(ps -o user= -C i3 | head -n 1)
+[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
+true
diff --git a/internal/compose/resolution/testdata/l2-moved/want/triggerhappy b/internal/compose/resolution/testdata/l2-moved/want/triggerhappy
new file mode 100644
index 0000000..369ede9
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/want/triggerhappy
@@ -0,0 +1,14 @@
+# The machine's hotkeys, written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on
+# every push: a key is added by the module it belongs to, as a contribution to node-hotkeys.
+# A line is: the key, its state (1 pressed, 2 held, 0 released), the command.
+# asus-zephyrus-g14
+# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
+# and the touchpad key. Each runs this module's own script, as the operator's account.
+KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
+KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
+KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
+KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/internal/compose/resolution/testdata/l2-moved/want/zsh b/internal/compose/resolution/testdata/l2-moved/want/zsh
new file mode 100644
index 0000000..f9e16a2
--- /dev/null
+++ b/internal/compose/resolution/testdata/l2-moved/want/zsh
@@ -0,0 +1,88 @@
+# The mesh's block (module zsh, novox/hq ADR 0204): the defaults every machine shares, and the code
+# other modules contribute in three slots. It is replaced at every push. Everything below it is
+# yours, kept as you wrote it, and runs after it, so your lines win.
+
+# History, kept across sessions and shared between open shells. Without these zsh saves none:
+# SAVEHIST defaults to 0 (novox/hq to-be 41, found on review 2026-10-04).
+HISTFILE="$HOME/.zsh_history"
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE HIST_REDUCE_BLANKS
+
+# The completion system. Nothing initialised it, so only zsh's basic completion ran. Its cache
+# goes under ~/.cache rather than beside ~/.zshrc.
+[[ -d "$HOME/.cache/zsh" ]] || mkdir -p "$HOME/.cache/zsh"
+autoload -Uz compinit && compinit -d "$HOME/.cache/zsh/zcompdump"
+zstyle ':completion:*' menu select
+
+# Terminal title: host, directory, git branch
+function set_terminal_title() {
+  local git_branch=""
+  if git rev-parse --is-inside-work-tree &>/dev/null; then
+    git_branch=" ($(git branch --show-current 2>/dev/null))"
+  fi
+  print -Pn "\e]2;%m: %~${git_branch}\a"
+}
+precmd_functions+=(set_terminal_title)
+
+# Keybindings
+bindkey  "^[[H"   beginning-of-line   # Home
+bindkey  "^[OH"   beginning-of-line   # Home
+bindkey  "^A"   beginning-of-line     # Ctrl + A
+bindkey  "^[[F"   end-of-line         # End
+bindkey  "^[OF"   end-of-line         # End
+bindkey  "^E"   end-of-line           # Ctrl + E
+bindkey  "^[[3~"  delete-char         # Del
+
+# Colour support of ls and friends
+if [ -x /usr/bin/dircolors ]; then
+  test -r $HOME/.dircolors && eval "$(dircolors -b $HOME/.dircolors)" || eval "$(dircolors -b)"
+  alias ls='ls --color=auto'
+  alias dir='dir --color=auto'
+  alias vdir='vdir --color=auto'
+  alias grep='grep --color=auto'
+  alias fgrep='fgrep --color=auto'
+  alias egrep='egrep --color=auto'
+fi
+alias ll='ls -alhF'
+alias la='ls -Ah'
+alias l='ls -CFh'
+
+# A throwaway container, and what takes the space under a directory
+alias drun='docker run -it --rm'
+disksize() {
+  du -h --max-depth=1 "${1:-.}" | sort -h
+}
+sudo-disksize() {
+  sudo du -h --max-depth=1 "${1:-.}" | sort -h
+}
+
+# claude-code
+# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
+# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
+# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
+# the real claude: exec, sudo and its sh see no alias.
+if [[ -r /etc/claude-code/agent-account ]]; then
+	() {
+		local agent=$(</etc/claude-code/agent-account)
+		if [[ -n $agent && $agent != $USERNAME ]]; then
+			alias claude=claude-agent
+		fi
+	}
+fi
+# mesh-cli
+# The operator's command (module mesh-cli, novox/hq ADR 0272): nox is mesh-cli, in interactive zsh only.
+# A script, sudo and a document meant to work everywhere say mesh-cli.
+alias nox=mesh-cli
+# powerlevel10k
+# The prompt: powerlevel10k v1.20.0, pinned in this module (novox/hq ADR 0205), and its configuration.
+[[ ! -f ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme
+[[ ! -f ~/.config/powerlevel10k/p10k.zsh ]] || source ~/.config/powerlevel10k/p10k.zsh
+# zsh-autosuggestions
+# Suggestions from history as you type, from the distribution's package.
+[[ ! -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
+# zsh-syntax-highlighting
+# Syntax highlighting of the command line, from the distribution's package. Last, as upstream asks:
+# it wraps every widget defined before it.
+[[ ! -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
+
diff --git a/internal/compose/resolution/toolchain_manifests_test.go b/internal/compose/resolution/toolchain_manifests_test.go
new file mode 100644
index 0000000..43c226d
--- /dev/null
+++ b/internal/compose/resolution/toolchain_manifests_test.go
@@ -0,0 +1,71 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// builderNode is a machine that can run a build module: the package manager and user namespaces it asks of
+// the machine, and the forge account (mesh-scope, provided by the forge) and the artifact store the build
+// modules publish to (ADR 0513, provided by distribution) stood in for, and node-tools, the tool runner they pull their
+// asks through (mesh-catalog issue 1911; mesh-tools' module, not in the catalogue).
+func builderNode() mcat.Node {
+	return mcat.Node{Name: "builder", Site: "house",
+		Capabilities: map[string]bool{"package-manager": true, "user-namespaces": true}}
+}
+
+func toolchainShelf(t *testing.T) map[string]mcat.Manifest {
+	t.Helper()
+	m := map[string]mcat.Manifest{
+		"forge": {Module: "forge", Version: "1", Provides: []mcat.Offer{{Name: "forge-account"}, {Name: "npm-package-registry"}, {Name: "artifact-store"}, {Name: "node-tools"}}},
+	}
+	for _, name := range []string{"go", "nodejs", "mesh-build-go", "mesh-build-node", "dev-tools"} {
+		m[name] = catalogueManifest(t, name)
+	}
+	return m
+}
+
+func TestAModuleNeedingAToolchainIsRefusedOnANodeWithoutIt(t *testing.T) {
+	for _, c := range []struct{ module, provision string }{
+		{"mesh-build-go", "go-toolchain"},
+		{"mesh-build-node", "node-toolchain"},
+		{"dev-tools", "go-toolchain"},
+	} {
+		_, err := Resolve(toolchainShelf(t), []string{"forge", c.module}, builderNode(), mcat.World{})
+		if err == nil {
+			t.Fatalf("%s composed on a node with no toolchain module", c.module)
+		}
+		for _, want := range []string{`"` + c.provision + `" is wanted by ` + c.module,
+			"usable only on the machine that provides it"} {
+			if !strings.Contains(err.Error(), want) {
+				t.Errorf("%s: the refusal does not say %q:\n%v", c.module, want, err)
+			}
+		}
+	}
+}
+
+func TestAModuleNeedingAToolchainComposesOnANodeWithIt(t *testing.T) {
+	for _, c := range []struct{ module, owner string }{
+		{"mesh-build-go", "go"},
+		{"mesh-build-node", "nodejs"},
+		{"dev-tools", "go"},
+	} {
+		assigned := []string{"forge", c.owner, c.module}
+		if c.module == "dev-tools" {
+			assigned = append(assigned, "nodejs")
+		}
+		got, err := Resolve(toolchainShelf(t), assigned, builderNode(), mcat.World{})
+		if err != nil {
+			t.Fatalf("%s with %s did not compose: %v", c.module, c.owner, err)
+		}
+		in := map[string]bool{}
+		for _, n := range names(got) {
+			in[n] = true
+		}
+		if !in[c.module] || !in[c.owner] {
+			t.Errorf("%s with %s composed %v", c.module, c.owner, names(got))
+		}
+	}
+}
diff --git a/internal/compose/resolution/two_consumers_test.go b/internal/compose/resolution/two_consumers_test.go
new file mode 100644
index 0000000..bf2e95e
--- /dev/null
+++ b/internal/compose/resolution/two_consumers_test.go
@@ -0,0 +1,128 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func threeConsumers() map[string]mcat.Manifest {
+	return shelf(mcat.Manifest{Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database")}, mcat.Manifest{Module: "gitea", Version: "1", Requires: []string{"postgres-database"},
+		Contributes: map[string]map[string]any{"postgres-database": {"name": "gitea"}},
+		Secrets:     map[string]string{"postgres-database": "/var/lib/gitea/db.secret"}}, mcat.Manifest{Module: "keycloak", Version: "1", Requires: []string{"postgres-database"},
+		Contributes: map[string]map[string]any{"postgres-database": {"name": "keycloak"}},
+		Secrets:     map[string]string{"postgres-database": "/var/lib/keycloak/db.secret"}}, mcat.Manifest{Module: "umami", Version: "1", Requires: []string{"postgres-database"},
+		Contributes: map[string]map[string]any{"postgres-database": {"name": "umami"}},
+		Secrets:     map[string]string{"postgres-database": "/var/lib/umami/db.secret"}},
+	)
+}
+
+func TestEveryConsumerOnANodeGetsItsOwnCredential(t *testing.T) {
+	got, err := Resolve(threeConsumers(), []string{"gitea", "keycloak", "umami"},
+		reachable(), mcat.World{Offered: onNetwork("anchor")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Needs) != 3 {
+		t.Fatalf("three modules want a database and the node has %d need(s): %v",
+			len(got.Needs), got.Needs)
+	}
+	for _, want := range []string{"gitea", "keycloak", "umami"} {
+		var found bool
+		for _, n := range got.Needs {
+			if n.For == want {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("%s wants a database and no credential is made for it", want)
+		}
+	}
+}
+
+// Each consumer's own credential reaches its own file. Matching on the provision alone, every
+// consumer took whichever need was last — a module handed somebody else's password, which is a
+// valid credential and therefore fails in a way that looks like a configuration error.
+func TestEachConsumerGetsItsOwnCredentialAndNotAnothersFile(t *testing.T) {
+	got, err := Resolve(threeConsumers(), []string{"gitea", "keycloak", "umami"},
+		reachable(), mcat.World{Offered: onNetwork("anchor")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range got.Needs {
+		got.Needs[i].Sealed = "sealed-for-" + got.Needs[i].For
+	}
+	out, err := Declaration(got, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"gitea", "keycloak", "umami"} {
+		var seen bool
+		for _, r := range out {
+			if r["path"] != "/var/lib/"+want+"/db.secret" {
+				continue
+			}
+			seen = true
+			if r["sealed"] != "sealed-for-"+want {
+				t.Errorf("%s was given %v, which belongs to something else", want, r["sealed"])
+			}
+		}
+		if !seen {
+			t.Errorf("%s resolved and its credential file was never written", want)
+		}
+	}
+}
+
+// The provider is told about all three, separately, and names each grant after the module.
+func TestAProviderIsToldAboutEveryConsumerOnOneMachine(t *testing.T) {
+	provider, err := Resolve(shelf(mcat.Manifest{
+		Module: "postgres", Version: "1", Provides: mcat.FromAnywhere("postgres-database"),
+		Grants:   map[string]string{"postgres-database": "/var/lib/postgres/grants"},
+		Receives: map[string]string{"postgres-database": "/var/lib/postgres/grants/mesh.json"},
+	}), []string{"postgres"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var grants []mcat.Grant
+	for _, who := range []string{"gitea", "keycloak", "umami"} {
+		grants = append(grants, mcat.Grant{
+			Provision: "postgres-database", Consumer: "anchor", From: who,
+			Values: map[string]any{"name": who}, Sealed: "sealed-for-" + who})
+	}
+	out, err := Declaration(provider, mcat.Rendering{Grants: grants})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, who := range []string{"gitea", "keycloak", "umami"} {
+		path := "/var/lib/postgres/grants/anchor." + who + ".secret"
+		var found bool
+		for _, r := range out {
+			if r["path"] == path {
+				found = true
+				if r["sealed"] != "sealed-for-"+who {
+					t.Errorf("%s's grant holds %v", who, r["sealed"])
+				}
+			}
+		}
+		if !found {
+			t.Errorf("the provider was never told to create a login for %s", who)
+		}
+	}
+
+	// And all three appear in the readable manifest, so the provisioner sees three consumers
+	// where there are three. Named after one machine, they were one path and the last won.
+	for _, r := range out {
+		if r["path"] != "/var/lib/postgres/grants/mesh.json" {
+			continue
+		}
+		body := r["content"].(string)
+		for _, who := range []string{"gitea", "keycloak", "umami"} {
+			if !strings.Contains(body, `"`+who+`"`) {
+				t.Errorf("the provider's manifest never mentions %s: %s", who, body)
+			}
+		}
+	}
+}
diff --git a/internal/compose/resolution/two_resolvers_test.go b/internal/compose/resolution/two_resolvers_test.go
new file mode 100644
index 0000000..db21634
--- /dev/null
+++ b/internal/compose/resolution/two_resolvers_test.go
@@ -0,0 +1,160 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// resolverMachines is the anchor and the home server holding the resolver, and a laptop holding nothing.
+var resolverMachines = map[string]string{
+	"anchor.internal": "10.42.0.1", "laptop.internal": "10.42.0.2", "home.internal": "10.42.0.3"}
+
+// bothResolvers is the two holders on record, as `seat mesh-dns-resolver --add` leaves them.
+var bothResolvers = []mcat.Held{
+	{Claim: "mesh-dns-resolver", Scope: mcat.ScopeMesh, Node: "anchor", Module: "dnsmasq"},
+	{Claim: "mesh-dns-resolver", Scope: mcat.ScopeMesh, Node: "home", Module: "dnsmasq"},
+}
+
+// uplinks is every module in the catalogue holding node-uplink, and so writing the machine's resolver
+// file (novox/hq ADR 0223 part 2): the program that would otherwise rewrite it is the one that writes it.
+// dhcpcd's left the catalogue with ADR 0226, held by no machine.
+var uplinks = []string{"networkmanager", "systemd-networkd"}
+
+// managing is a machine as each uplink module needs it: able to install, run a service and run the
+// manager that module is for.
+func managing(node string) mcat.Node {
+	caps := map[string]bool{"package-manager": true, "service-manager": true}
+	for _, u := range uplinks {
+		caps["uplink-"+u] = true
+	}
+	return mcat.Node{Name: node, At: node + ".internal", Capabilities: caps}
+}
+
+// twoResolverShelf is the resolver, the uplink modules that write what a machine asks, and a stand-in
+// answering `mesh-addressing`.
+func twoResolverShelf(t *testing.T) map[string]mcat.Manifest {
+	t.Helper()
+	out := map[string]mcat.Manifest{
+		"net":     {Module: "net", Version: "1", Provides: []mcat.Offer{{Name: "mesh-addressing"}}},
+		"dnsmasq": catalogueManifest(t, "dnsmasq"),
+	}
+	for _, u := range uplinks {
+		out[u] = catalogueManifest(t, u)
+	}
+	return out
+}
+
+// worldWithout is the rest of the mesh as a plan for one machine sees it: every other holder's claim
+// and offer, and both holders on record.
+func worldWithout(node string) mcat.World {
+	w := mcat.World{Holdings: bothResolvers, Offered: map[string][]mcat.Provider{}}
+	for _, h := range bothResolvers {
+		if h.Node == node {
+			continue
+		}
+		w.Held = append(w.Held, h)
+		w.Offered["wildcard-resolution"] = append(w.Offered["wildcard-resolution"], mcat.Provider{Node: h.Node, At: h.Node + ".internal", Module: h.Module})
+	}
+	return w
+}
+
+// The requirement stays with what writes the file (ADR 0223 part 1): a machine is refused when nothing
+// in the mesh resolves, rather than given a file listing nothing.
+func TestEveryUplinkRequiresTheMeshsResolver(t *testing.T) {
+	for _, uplink := range uplinks {
+		found := false
+		for _, r := range catalogueManifest(t, uplink).Requires {
+			found = found || r == "wildcard-resolution"
+		}
+		if !found {
+			t.Errorf("%s writes the resolver file and does not require wildcard-resolution", uplink)
+		}
+	}
+	_, err := Resolve(twoResolverShelf(t), []string{"networkmanager"}, managing("laptop"), mcat.World{})
+	if err == nil || !strings.Contains(err.Error(), "wildcard-resolution") {
+		t.Errorf("an uplink was composed on a mesh with no resolver: %v", err)
+	}
+}
+
+// A holder answers its own requirement, even though the other holder sorts first (issue 258 kept).
+func TestAHolderAnswersItsOwnRequirement(t *testing.T) {
+	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq", "networkmanager"},
+		managing("home"), worldWithout("home"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range got.Needs {
+		if n.Name == "wildcard-resolution" && n.From != "home" {
+			t.Errorf("the home server's uplink is bound to %s; it holds the seat itself", n.From)
+		}
+	}
+}
+
+// A seat held once is still held once: a second claimant on another machine is refused while
+// nothing is on record, and a store recording two holders of it is refused, naming the seat.
+func TestASingleHolderMeshSeatStillRefusesASecondHolder(t *testing.T) {
+	store := shelf(mod("postgres", nil, nil, nil, mcat.Claim{Name: "mesh-store", Scope: mcat.ScopeMesh}))
+	other := mcat.Held{Claim: "mesh-store", Scope: mcat.ScopeMesh, Node: "anchor", Module: "postgres"}
+	if _, err := Resolve(store, []string{"postgres"}, workstation(), mcat.World{Held: []mcat.Held{other}}); err == nil ||
+		!strings.Contains(err.Error(), "one per mesh") {
+		t.Errorf("a second claimant of a seat held once was not refused: %v", err)
+	}
+	here := mcat.Held{Claim: "mesh-store", Scope: mcat.ScopeMesh, Node: workstation().Name, Module: "postgres"}
+	_, err := Resolve(store, []string{"postgres"}, workstation(), mcat.World{Held: []mcat.Held{other}, Holdings: []mcat.Held{other, here}})
+	if err == nil || !strings.Contains(err.Error(), "on record as held by 2") {
+		t.Errorf("two holders on record for a seat held once were not refused: %v", err)
+	}
+}
+
+// Replicated is not "whoever is assigned": two claimants with nothing on record are refused, as for
+// any mesh seat, and each holder is added by an act.
+func TestTwoUnrecordedClaimantsOfTheReplicatedSeatAreRefused(t *testing.T) {
+	w := worldWithout("home")
+	w.Holdings = nil
+	_, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, mcat.Node{Name: "home", At: "home.internal"}, w)
+	if err == nil || !strings.Contains(err.Error(), "seat mesh-dns-resolver --to") {
+		t.Errorf("a second resolver with nothing on record was not refused, naming the handover: %v", err)
+	}
+}
+
+// Every consumer is bound to the same holder whatever order the mesh resolved its machines in.
+func TestTheFirstHolderIsTheFirstProvider(t *testing.T) {
+	providers := []mcat.Provider{{Node: "anchor", Module: "dnsmasq"}, {Node: "home", Module: "dnsmasq"}}
+	for _, held := range [][]mcat.Held{bothResolvers, {bothResolvers[1], bothResolvers[0]}} {
+		if p, ok := HolderAmong("wildcard-resolution", providers, held); !ok || p.Node != "anchor" {
+			t.Errorf("held in order %v answered %v", held, p)
+		}
+	}
+}
+
+// One host record per machine, beside its wildcard (novox/hq issue 262): a name with a host record
+// says it exists and has no IPv6 address, where the wildcard alone said there is no such name, and
+// musl reads that as final.
+func TestTheResolverHasOneHostRecordPerMachine(t *testing.T) {
+	got, err := Resolve(twoResolverShelf(t), []string{"dnsmasq"}, mcat.Node{Name: "anchor", At: "anchor.internal"}, mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{Names: resolverMachines, Machines: resolverMachines, Suffix: "internal",
+		Needed: map[string]map[string]string{"dnsmasq": {"broker": "sealed"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	content, _ := byID(out)["dnsmasq.fact-node-zones"]["content"].(string)
+	records := map[string]int{}
+	for _, line := range strings.Split(content, "\n") {
+		if strings.HasPrefix(line, "host-record=") {
+			records[strings.TrimPrefix(line, "host-record=")]++
+		}
+	}
+	for name, at := range resolverMachines {
+		if records[name+","+at] != 1 {
+			t.Errorf("%s has %d host records at %s, and has one:\n%s", name, records[name+","+at], at, content)
+		}
+	}
+	if len(records) != len(resolverMachines) {
+		t.Errorf("%d host records for %d machines:\n%s", len(records), len(resolverMachines), content)
+	}
+}
diff --git a/internal/compose/resolution/unconsumed_placeholder.go b/internal/compose/resolution/unconsumed_placeholder.go
new file mode 100644
index 0000000..b83fe4c
--- /dev/null
+++ b/internal/compose/resolution/unconsumed_placeholder.go
@@ -0,0 +1,146 @@
+package resolution
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// filler is one namespace's pass: the patterns it fills with, and the fields it reads them in, by
+// resource type ("*" for any type).
+type filler struct {
+	namespace string
+	patterns  []*regexp.Regexp
+	fields    map[string][]string
+	// why, when set, is the rule that keeps the namespace out of every other field, said with a
+	// refusal of one written there.
+	why string
+}
+
+// fillers is the table of what each pass fills where — read from the passes themselves: settingInto,
+// dirInto, accessInto, intoFile (whose ${secret:…} the node-engine fills), boundInto, portInto,
+// seatInto, machineInto and contributionsInto. A pass that comes to read another field adds it here,
+// or the sweep refuses the placeholder it would have filled.
+var fillers = []filler{
+	{namespace: "setting", patterns: []*regexp.Regexp{settingRef}, fields: map[string][]string{"file": {"content"}, "service": {"unit"}, "directory": {"owner"}, "container": {"groups"}}},
+	{namespace: "dir", patterns: []*regexp.Regexp{dirRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file"}}},
+	{namespace: "access", patterns: []*regexp.Regexp{accessRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file"}}},
+	{namespace: "secret", patterns: []*regexp.Regexp{placeholder}, fields: map[string][]string{"file": {"content"}},
+		why: "a secret is never filled into an environment variable or any other field: put it in a file the " +
+			"module declares and mount that (novox/hq ADR 0086)"},
+	{namespace: "bound", patterns: []*regexp.Regexp{bound}, fields: map[string][]string{"file": {"content"}}},
+	{namespace: "port", patterns: []*regexp.Regexp{ofPort}, fields: map[string][]string{"file": {"content"}, "container": {"env"}, "process": {"env"}}},
+	{namespace: "seat", patterns: []*regexp.Regexp{ofSeat, ofSeatReach}, fields: map[string][]string{"file": {"content"}, "container": {"env"}, "process": {"env"}}},
+	{namespace: "machine", patterns: []*regexp.Regexp{ofMachine}, fields: map[string][]string{"*": {"path", "owner", "content", "name", "user", "root", "home"}}},
+	// Placed in a file's content by their holders, and judged there by their own rules
+	// (placeholderProblems, seatPlaceholderProblems).
+	{namespace: "environment", patterns: []*regexp.Regexp{ofEnvironment}, fields: map[string][]string{"*": {"content"}}},
+	{namespace: "shell", patterns: []*regexp.Regexp{ofShell}, fields: map[string][]string{"*": {"content"}}},
+	{namespace: "contribution", patterns: []*regexp.Regexp{ofContribution}, fields: map[string][]string{"*": {"content"}}},
+	// What the machine's modules back up, placed by the backup holder's file (backup_placement.go, issue 794).
+	{namespace: mcat.BackupNamespace, patterns: []*regexp.Regexp{ofBackup}, fields: map[string][]string{"*": {"content"}}},
+	// A collection, placed by its collector (collections.go): filled by the provisioner's client.
+	{namespace: mcat.CollectedNamespace, patterns: []*regexp.Regexp{ofCollected}, fields: map[string][]string{"*": {"content"}}},
+	// A provider's consumers' credentials (consumers.go): filled by the provisioner's client.
+	{namespace: mcat.ConsumersNamespace, patterns: []*regexp.Regexp{ofConsumers}, fields: map[string][]string{"file": {"content"}}},
+	// Filled in what a provider serves (consumer_into_serves.go), never in a resource.
+	{namespace: "consumer", patterns: []*regexp.Regexp{consumerFact}},
+}
+
+// reads is whether this pass fills a field of a resource of this type.
+func (f filler) reads(kind, field string) bool {
+	return oneOf(f.fields[kind], field) || oneOf(f.fields["*"], field)
+}
+
+// ofKnownNamespace is any `${<known namespace>:` and what follows it up to its brace or the end of
+// its line, whatever its case, unless what follows the colon is a shell's parameter operator (`-`,
+// `=`, `+`, `?`): what remains of one once every pass's pattern is set aside is a misspelling.
+var ofKnownNamespace = regexp.MustCompile(`(?im)\$\{(?:` + strings.Join(namespacesOf(fillers), "|") +
+	`):(?:[^-=+?}\n][^}\n]*\}?|\}|$)`)
+
+// namespaceShaped is a placeholder in the mesh's shape: a lower-case word, a colon, and a key that
+// begins with a letter or a digit and holds no space, brace or `$`.
+var namespaceShaped = regexp.MustCompile(`\$\{[a-z][a-z0-9_-]*:[A-Za-z0-9][^\s{}$]*\}`)
+
+func namespacesOf(fs []filler) []string {
+	out := make([]string, len(fs))
+	for i, f := range fs {
+		out[i] = f.namespace
+	}
+	return out
+}
+
+// unconsumedPlaceholders is every placeholder in one resource of a definition that no pass fills
+// where it stands, each named with the module, the resource, the field and the token. The same
+// function at the catalogue check and at composition, over the resource as the manifest wrote it.
+func unconsumedPlaceholders(module string, r map[string]any) []string {
+	kind := fmt.Sprint(r["type"])
+	var problems []string
+	var sweep func(top, field string, v any)
+	sweep = func(top, field string, v any) {
+		switch v := v.(type) {
+		case string:
+			rest := v
+			for _, f := range fillers {
+				for _, p := range f.patterns {
+					if !f.reads(kind, top) {
+						for _, token := range p.FindAllString(rest, -1) {
+							problems = append(problems, fmt.Sprintf(
+								"%s's resource %v holds %s in its %s, and ${%s:…} is not filled in this field: "+
+									"it would reach the machine as that text (novox/hq issue 231)%s",
+								module, r["id"], token, field, f.namespace, whereFilled(f)))
+						}
+					}
+					rest = p.ReplaceAllString(rest, "")
+				}
+			}
+			for _, token := range ofKnownNamespace.FindAllString(rest, -1) {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v holds %s in its %s, which is no placeholder the mesh fills: a "+
+						"misspelt key, or a namespace in the wrong case, would reach the machine as that "+
+						"text (novox/hq issue 231)", module, r["id"], token, field))
+			}
+			rest = ofKnownNamespace.ReplaceAllString(rest, "")
+			for _, token := range namespaceShaped.FindAllString(rest, -1) {
+				problems = append(problems, fmt.Sprintf(
+					"%s's resource %v holds %s in its %s, and no pass of the mesh fills it: a misspelt "+
+						"placeholder would reach the machine as that text (novox/hq issue 231). The mesh "+
+						"fills ${%s:…}; the shell's own syntax belongs in the module's shell code (ADR 0204)",
+					module, r["id"], token, field, strings.Join(namespacesOf(fillers), ":…}, ${")))
+			}
+		case []any:
+			for i, e := range v {
+				sweep(top, fmt.Sprintf("%s[%d]", field, i), e)
+			}
+		case map[string]any:
+			for _, k := range sortedKeys(v) {
+				sweep(top, field+"."+k, v[k])
+			}
+		}
+	}
+	for _, k := range sortedKeys(r) {
+		sweep(k, k, r[k])
+	}
+	return problems
+}
+
+// whereFilled says where a namespace's pass does fill, for a refusal of one written elsewhere.
+func whereFilled(f filler) string {
+	if f.why != "" {
+		return ". " + strings.ToUpper(f.why[:1]) + f.why[1:]
+	}
+	if len(f.fields) == 0 {
+		return "; it is filled only in what a provider serves"
+	}
+	var where []string
+	for _, kind := range sortedKeys(f.fields) {
+		of := "a " + kind + "'s"
+		if kind == "*" {
+			of = "any resource's"
+		}
+		where = append(where, of+" "+strings.Join(f.fields[kind], ", "))
+	}
+	return "; it is filled in " + strings.Join(where, "; ")
+}
diff --git a/internal/compose/resolution/unconsumed_placeholder_test.go b/internal/compose/resolution/unconsumed_placeholder_test.go
new file mode 100644
index 0000000..082bcdc
--- /dev/null
+++ b/internal/compose/resolution/unconsumed_placeholder_test.go
@@ -0,0 +1,111 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+const misspelledShell = "${shel:zsh:first}"
+
+const undeclaredSetting = "${setting:Undeclared}"
+
+const misspelledMachine = "${machnie:address}"
+
+const shellsOwn = "${XDG_CACHE_HOME:-x}"
+
+// The shell's operators after a word the mesh also uses, in any case: the shell's, and passed.
+const shellsOperators = "${PORT:-8080} ${SHELL:-/bin/sh} ${SECRET:?unset} ${dir:-/tmp}"
+
+// Composition refuses the same placeholders in the same words — a manifest the store already holds
+// was never parsed by this binary — and a namespace the mesh knows, written in a field its pass does
+// not read, is refused there too, because it would reach the machine as the same literal text.
+func TestAMisspelledPlaceholderIsRefusedAtComposition(t *testing.T) {
+	for _, c := range []struct {
+		field string
+		r     map[string]any
+		token string
+	}{
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "a=" + misspelledShell + "\n"}, misspelledShell},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "b=" + undeclaredSetting + "\n"}, undeclaredSetting},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "c=" + misspelledMachine + "\n"}, misspelledMachine},
+		{"env.NAME", map[string]any{"id": "rc", "type": "process", "name": "speller", "env": map[string]any{"NAME": "${machine:name}"}}, "${machine:name}"},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${Machine:address}"}, "${Machine:address}"},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${machine:.address}"}, "${machine:.address}"},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${machine: address}"}, "${machine: address}"},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "${Dir:x}"}, "${Dir:x}"},
+		{"content", map[string]any{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "a=${machine:address\nb=1"}, "${machine:address"},
+	} {
+		m := mcat.Manifest{Module: "speller", Version: "1", Resources: []map[string]any{c.r}}
+		r := mcat.Resolution{Node: "workstation", Account: "op", Modules: []mcat.Manifest{m}}
+		_, err := Declaration(r, mcat.Rendering{})
+		if err == nil || !strings.Contains(err.Error(), "speller's resource rc holds "+c.token+" in its "+c.field) {
+			t.Errorf("%s in its %s was composed rather than refused by name: %v", c.token, c.field, err)
+		}
+	}
+
+	m := mcat.Manifest{Module: "speller", Version: "1", Resources: []map[string]any{
+		{"id": "rc", "type": "file", "path": "/etc/speller.rc", "content": "d=" + shellsOwn + " " + shellsOperators + "\n"},
+		{"id": "server", "type": "process", "name": "server", "env": map[string]any{"PORT": "${PORT:-80}"}},
+	}}
+	out, err := Declaration(mcat.Resolution{Node: "workstation", Account: "op", Modules: []mcat.Manifest{m}}, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("the shell's own syntax was refused: %v", err)
+	}
+	if got := contentOf(t, out, "speller.rc"); got != "d="+shellsOwn+" "+shellsOperators+"\n" {
+		t.Fatalf("the shell's own syntax did not pass through as written: %q", got)
+	}
+}
+
+// contentOf is the content of the composed resource with this id, failing when it was not composed.
+func contentOf(t *testing.T, out []map[string]any, id string) string {
+	t.Helper()
+	for _, res := range out {
+		if res["id"] == id {
+			return plainly(res["content"])
+		}
+	}
+	t.Fatalf("%s was not composed: %v", id, out)
+	return ""
+}
+
+// What a value puts into a file is its software's text, not the definition's, and is never swept
+// (review of mesh-controller #211): an operator's setting holding `${labels:instance}` filled through
+// ${setting:…}, and a JSON setting `${level:upper}` merged into a mergeable file, reach the machine as
+// set — software that templates its own configuration (Log4j's `${env:…}`, Spring's `${timeout:30}`)
+// is configured exactly this way.
+func TestAValueHoldingAPlaceholderShapeComposesUnchanged(t *testing.T) {
+	m := mcat.Manifest{Module: "templater", Version: "1", Resources: []map[string]any{
+		{"id": "conf", "type": "file", "path": "/etc/templater.conf", "content": "template=${setting:template}\n"},
+		{"id": "json", "type": "file", "path": "/etc/templater.json", "merge": mcat.MergeJSON, "content": `{"fmt":"plain"}`},
+	}}
+	settings := mcat.SettingsBy{"templater": {{From: "the operator", Values: map[string]any{
+		"template": "${labels:instance}", "fmt": "${level:upper}",
+	}}}}
+	out, err := Declaration(mcat.Resolution{Node: "workstation", Account: "op", Modules: []mcat.Manifest{m}}, mcat.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatalf("a value holding a placeholder's shape was refused as the definition's: %v", err)
+	}
+	if got := contentOf(t, out, "templater.conf"); got != "template=${labels:instance}\n" {
+		t.Errorf("the setting did not reach the file as set: %q", got)
+	}
+	if got := contentOf(t, out, "templater.json"); !strings.Contains(got, `${level:upper}`) {
+		t.Errorf("the merged setting did not reach the file as set: %q", got)
+	}
+}
+
+// Contributed shell code is the shell's, and no pass reads it (novox/hq ADR 0204): zsh's own
+// `${path:t}` is namespace-shaped, and reaches the holder's file untouched.
+func TestContributedShellCodeIsNotSwept(t *testing.T) {
+	modules := []mcat.Manifest{zshHolder(), {Module: "modifier", Shell: []mcat.ShellCode{
+		{For: "zsh", Slot: "normal", Code: "echo ${path:t} ${shel:zsh:first}"},
+	}}}
+	out, err := Declaration(mcat.Resolution{Node: "workstation", Account: "op", Modules: modules}, mcat.Rendering{})
+	if err != nil {
+		t.Fatalf("contributed shell code was swept: %v", err)
+	}
+	if got := contentOf(t, out, "zsh.zshrc"); !strings.Contains(got, "echo ${path:t} ${shel:zsh:first}") {
+		t.Fatalf("the contributed code did not reach the holder's file as written: %q", got)
+	}
+}
diff --git a/internal/compose/resolution/unknown_field.go b/internal/compose/resolution/unknown_field.go
new file mode 100644
index 0000000..6d1ee23
--- /dev/null
+++ b/internal/compose/resolution/unknown_field.go
@@ -0,0 +1,36 @@
+package resolution
+
+import (
+	"fmt"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// UnknownFieldReason is why a module whose stored manifest has a key this reader does not know is left out of a
+// machine's declaration, or "" when it is not. **A field set aside no longer leaves the module out** (novox/hq ADR 0578
+// §6, which changes ADR 0262 here): the lenient decoder reads the rest, the reader names the field (SetAside), and the
+// part that needs the field takes the newer package. Only a manifest not read past the field, which holds its name and
+// version alone (ReadNoFurther), is still left out, since nothing of it could be composed.
+func UnknownFieldReason(m mcat.Manifest) string {
+	if !m.ReadNoFurther() {
+		return ""
+	}
+	return m.Module + " uses a field this controller does not know (" + m.UnknownField() + "); it is left out " +
+		"until the controller is updated: nothing of it is changed on its machines and its contributions to " +
+		"other modules and its open ports stop. Its data is still backed up as this controller reads it, " +
+		"which may not be what its newer manifest asks, and it still provides what it provides " +
+		"(novox/hq ADR 0262)"
+}
+
+// backupView is what of a left-out module still reaches its machine: its data, so the backup holder
+// keeps copying it, and the directories and accesses its data items name. No contribution, shell code
+// or environment of its own: those are what leaving it out stops.
+func backupView(m mcat.Manifest) mcat.Manifest {
+	view := mcat.Manifest{Module: m.Module, Data: m.Data, Accesses: m.Accesses, BestEffort: true}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			view.Resources = append(view.Resources, r)
+		}
+	}
+	return view
+}
diff --git a/internal/compose/resolution/verbs.go b/internal/compose/resolution/verbs.go
new file mode 100644
index 0000000..a57913e
--- /dev/null
+++ b/internal/compose/resolution/verbs.go
@@ -0,0 +1,59 @@
+package resolution
+
+import (
+	"maps"
+	"slices"
+)
+
+// schema is a JSON schema for an object of string properties, which is every argument the verbs
+// above take. Kept small on purpose: a schema an agent cannot read is a tool it cannot call. The
+// switches are the properties that are "true" or "false" and nothing else, said in the schema as an
+// enum so a caller sees it and the verb can refuse any other word rather than read it as false.
+//
+// **The schema is the whole of what a verb takes** (novox/hq issue 244): an argument it does not
+// name is refused when the verb is called, never passed over.
+// withObject adds to a verb's input s the property name, an object of the string fields given, each required.
+func withObject(s map[string]any, name, description string, fields map[string]string) map[string]any {
+	inner := schema(fields, slices.Sorted(maps.Keys(fields)))
+	inner["description"], inner["additionalProperties"] = description, false
+	s["properties"].(map[string]any)[name] = inner
+	return s
+}
+
+func schema(properties map[string]string, required []string, switches ...string) map[string]any {
+	isSwitch := map[string]bool{}
+	for _, s := range switches {
+		if _, declared := properties[s]; !declared {
+			panic("a switch that is not a property: " + s)
+		}
+		isSwitch[s] = true
+	}
+	props := map[string]any{}
+	for name, description := range properties {
+		p := map[string]any{"type": "string", "description": description}
+		if isSwitch[name] {
+			p["enum"] = []string{"true", "false"}
+		}
+		props[name] = p
+	}
+	out := map[string]any{"type": "object", "properties": props}
+	if len(required) > 0 {
+		out["required"] = required
+	}
+	return out
+}
+
+// listed makes the named properties of a schema lists of text: a caller gives them as a JSON array (or, as
+// any argument, one text separated by commas).
+func listed(in map[string]any, names ...string) map[string]any {
+	props, _ := in["properties"].(map[string]any)
+	for _, n := range names {
+		p, _ := props[n].(map[string]any)
+		if p == nil {
+			panic("a list that is not a property: " + n)
+		}
+		props[n] = map[string]any{"type": "array", "items": map[string]any{"type": "string"},
+			"description": p["description"]}
+	}
+	return in
+}
diff --git a/internal/compose/resolution/while_stopped_test.go b/internal/compose/resolution/while_stopped_test.go
new file mode 100644
index 0000000..8324746
--- /dev/null
+++ b/internal/compose/resolution/while_stopped_test.go
@@ -0,0 +1,64 @@
+package resolution
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// A composed declaration names the step's held containers the way the machine knows them.
+//
+// **The gap that let a bug through to the control node.** The manifest says `while-stopped:
+// ["store"]`, because a module names its own resources locally; the declaration a machine
+// receives calls that container `distribution.store`, because every resource is composed under
+// its module. `restart-on` and `reload-on` are rewritten for exactly this reason, and
+// `while-stopped` was not — so the host found no container by that id and refused the whole
+// declaration, every push, until it was fixed.
+//
+// It passed every test on both sides: the controller's tests read manifests, the host's read
+// hand-written declarations with bare ids. Only composing one and judging the result catches it.
+func TestAComposedWindowNamesTheContainerAsTheMachineKnowsIt(t *testing.T) {
+	store := mcat.Manifest{
+		Module: "distribution", Version: "1",
+		Provides: mcat.FromAnywhere("artifact-store"),
+		Listens:  []mcat.Listening{{Port: 5000, Protocol: "tcp", From: mcat.FromMesh}},
+		Serves:   map[string]map[string]any{"artifact-store": {"port": 5000}},
+		Resources: []map[string]any{
+			{"id": "store", "type": "container", "name": "mesh-registry",
+				"image": "registry@sha256:" + strings.Repeat("a", 64), "ports": []any{"5000"}},
+			{"id": "collect", "type": "container", "name": "mesh-registry-collect",
+				"image":    "registry@sha256:" + strings.Repeat("a", 64),
+				"schedule": "30 3 * * *", mcat.WhileStopped: []any{"store"}},
+		},
+	}
+	r, err := Resolve(shelf(store), []string{"distribution"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(r, mcat.Rendering{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	collect := fileNamed(out, "distribution.collect")
+	if collect == nil {
+		for _, res := range out {
+			if res["id"] == "distribution.collect" {
+				collect = res
+			}
+		}
+	}
+	if collect == nil {
+		t.Fatalf("the step was not composed at all: %v", out)
+	}
+	held, _ := collect[mcat.WhileStopped].([]any)
+	if len(held) != 1 {
+		t.Fatalf("the composed step holds %v still; want one container", collect[mcat.WhileStopped])
+	}
+	if got := fmt.Sprint(held[0]); got != "distribution.store" {
+		t.Fatalf("the composed step says it holds %q still, and the machine's container is "+
+			"called %q — the host refuses a declaration naming a container it does not have, "+
+			"whole, so the machine would take nothing at all", got, "distribution.store")
+	}
+}
diff --git a/internal/compose/resolution/yields.go b/internal/compose/resolution/yields.go
new file mode 100644
index 0000000..32f70cf
--- /dev/null
+++ b/internal/compose/resolution/yields.go
@@ -0,0 +1,69 @@
+package resolution
+
+import (
+	"strconv"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// yieldsOf is how the runtime of its own a module is served by gives way on this node (novox/hq ADR 0553), or nil when
+// it does not, and the word its steps size their threads from:
+//
+//   - a module holding a seat that yields (Seat.Yields, the build seats) runs at idle priority under the node's one share
+//     of its processors: the node-engine's own config build-cpu-share (BuildCPUShareSetting) as this node's layers give
+//     it, its default where none does. Every yielding module of the node carries the same share, so the node-engine's
+//     one yielding slice has one quota (ADR 0553 §2, §3).
+//   - its word: that share (BuildCPUShareWord), which a step divides by its own module's capacity (ADR 0553 §4).
+//
+// Never a refusal: a share out of range is the default, so a mistyped value bounds the builds at the default and never
+// stops the node's whole composition.
+func resolutionYieldsOf(r mcat.Resolution, m mcat.Manifest, with mcat.Rendering) (map[string]any, map[string]string) {
+	if !yields(m) {
+		return nil, nil
+	}
+	engine := mcat.Manifest{Module: engineModule}
+	for _, e := range r.Modules {
+		if e.Module == engineModule {
+			engine = e
+		}
+	}
+	share := mcat.BuildCPUDefaultPercent
+	for _, s := range Effective(engine, with.Settings[engineModule]) {
+		if s.Key == mcat.BuildCPUShareSetting {
+			if n, ok := percentOf(s.Value); ok {
+				share = n
+			}
+		}
+	}
+	return map[string]any{"priority": "idle", "cpu-share": share},
+		map[string]string{mcat.BuildCPUShareWord: strconv.Itoa(share)}
+}
+
+// yields is whether a module claims a seat that yields.
+func yields(m mcat.Manifest) bool {
+	for _, c := range m.Claims {
+		if s, ok := mcat.SeatNamed(c.Name); ok && s.Yields {
+			return true
+		}
+	}
+	return false
+}
+
+// percentOf is a setting's value as a percent from 1 to 100: a number, or a string holding one.
+func percentOf(v any) (int, bool) {
+	var n int
+	switch x := v.(type) {
+	case float64:
+		n = int(x)
+	case int:
+		n = x
+	case string:
+		var err error
+		if n, err = strconv.Atoi(x); err != nil {
+			return 0, false
+		}
+	default:
+		return 0, false
+	}
+	return n, n >= 1 && n <= 100
+}
diff --git a/internal/compose/resolution/zones.go b/internal/compose/resolution/zones.go
new file mode 100644
index 0000000..d6072f1
--- /dev/null
+++ b/internal/compose/resolution/zones.go
@@ -0,0 +1,63 @@
+package resolution
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// ZoneOn is one module's zone as one node places it: the name settled from the node's settings, the
+// port its answering listen is published on there. Nothing when the module declares no zone.
+func ZoneOn(m mcat.Manifest, layers []mcat.Layer, published map[int]int, node, address string) (*mcat.ZoneAt, error) {
+	if m.Zone == nil {
+		return nil, nil
+	}
+	settled, err := Settle(map[string]any{"zone": m.Zone.Name}, layers)
+	if err != nil {
+		return nil, fmt.Errorf("%s's zone on %s: %w", m.Module, node, err)
+	}
+	zone := strings.Trim(strings.ToLower(fmt.Sprint(settled["zone"])), ".")
+	var port int
+	for _, l := range m.Listens {
+		if l.Name == m.Zone.Listen {
+			port = l.Port
+			if at, given := published[l.Port]; given {
+				port = at
+			}
+		}
+	}
+	return &mcat.ZoneAt{Zone: zone, Node: node, Module: m.Module, Address: address, Port: port}, nil
+}
+
+// ZonesProblems is what the mesh refuses about its zones together: one zone declared twice, a zone
+// that is the mesh's suffix or under it, a zone that is a node's public domain or under one. A module
+// may not shadow names the mesh's resolver or the public DNS answers.
+func ZonesProblems(zones []mcat.ZoneAt, suffix string, publicDomains []string) []string {
+	var problems []string
+	under := func(zone, domain string) bool {
+		domain = strings.Trim(strings.ToLower(domain), ".")
+		return domain != "" && (zone == domain || strings.HasSuffix(zone, "."+domain))
+	}
+	seen := map[string]mcat.ZoneAt{}
+	for _, z := range zones {
+		if other, twice := seen[z.Zone]; twice && (other.Node != z.Node || other.Module != z.Module) {
+			problems = append(problems, fmt.Sprintf("zone %q is declared by %s on %s and by %s on %s; one module answers a zone",
+				z.Zone, other.Module, other.Node, z.Module, z.Node))
+		}
+		seen[z.Zone] = z
+		if under(z.Zone, suffix) {
+			problems = append(problems, fmt.Sprintf("%s on %s declares zone %q, which is the mesh's own suffix or under it",
+				z.Module, z.Node, z.Zone))
+		}
+		for _, d := range publicDomains {
+			if under(z.Zone, d) {
+				problems = append(problems, fmt.Sprintf("%s on %s declares zone %q, which is the public domain %q or under it",
+					z.Module, z.Node, z.Zone, d))
+			}
+		}
+	}
+	sort.Strings(problems)
+	return problems
+}
diff --git a/internal/compose/resolution/zones_test.go b/internal/compose/resolution/zones_test.go
new file mode 100644
index 0000000..18d47f3
--- /dev/null
+++ b/internal/compose/resolution/zones_test.go
@@ -0,0 +1,47 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The zone is the operator's (a setting) and the port is where this machine publishes the listen —
+// neither is the definition's to state.
+func TestAZoneIsPlacedFromTheNodesSettingAndPublishedPort(t *testing.T) {
+	m := mcat.Manifest{Module: "lab", Zone: &mcat.Zone{Name: "${setting:zone}", Listen: "dns"},
+		Listens: []mcat.Listening{{Name: "dns", Port: 5353, From: mcat.FromMesh}}}
+	z, err := ZoneOn(m, []mcat.Layer{{From: "node", Values: map[string]any{"zone": "Incus."}}},
+		map[int]int{5353: 15353}, "workstation", "10.77.0.3")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if z.Zone != "incus" || z.Address != "10.77.0.3" || z.Port != 15353 || z.Node != "workstation" {
+		t.Fatalf("the zone was placed as %+v", *z)
+	}
+	if _, err := ZoneOn(m, nil, nil, "workstation", "10.77.0.3"); err == nil {
+		t.Fatal("a zone nobody named was placed")
+	}
+}
+
+// One module answers a zone, and none may shadow the mesh's names or a public domain.
+func TestTheMeshRefusesAZoneTwiceOrOneThatShadows(t *testing.T) {
+	one := mcat.ZoneAt{Zone: "incus", Node: "workstation", Module: "lab", Address: "10.77.0.3", Port: 53}
+	if p := ZonesProblems([]mcat.ZoneAt{one}, "internal", []string{"example.tld"}); len(p) != 0 {
+		t.Fatalf("one ordinary zone was refused: %v", p)
+	}
+	twice := one
+	twice.Node, twice.Module = "laptop", "other"
+	cases := map[string][]mcat.ZoneAt{
+		"declared by":       {one, twice},
+		"mesh's own suffix": {{Zone: "lab.internal", Node: "a", Module: "m"}},
+		"public domain":     {{Zone: "dev.example.tld", Node: "a", Module: "m"}},
+	}
+	for want, zones := range cases {
+		p := strings.Join(ZonesProblems(zones, "internal", []string{"example.tld"}), "\n")
+		if !strings.Contains(p, want) {
+			t.Errorf("not refused for %q: %q", want, p)
+		}
+	}
+}
diff --git a/internal/compose/resolve.go b/internal/compose/resolve.go
new file mode 100644
index 0000000..117e907
--- /dev/null
+++ b/internal/compose/resolve.go
@@ -0,0 +1,348 @@
+package compose
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// LicenceProvision is what a module requires in order to be given a licence (the controller's licences.Provision).
+const LicenceProvision = "model-access"
+
+// Resolved is what one node should run, from what was assigned to it, with the settings of everything that resolved.
+type Resolved struct {
+	Plan     catalogue.Resolution
+	Settings catalogue.SettingsBy
+	// Foreseen are the needs composed with a stand-in for a credential the next send makes (or holds with no value given
+	// here), as "<module> on <node> needs <provision> from <provider>". Nothing was made.
+	Foreseen []string
+	// NotGiven are the words of each credential only a person gives that nobody has: the consumer still resolves without it
+	// (novox/hq ADR 0337 clause 4).
+	NotGiven []string
+}
+
+// Resolve works out everything a node should run, from what was assigned to it (the controller's planFor, plan.go): the
+// resolution over the rest of the mesh, the credential of each thing the node takes from elsewhere, and the settings of
+// every module that resolved. It makes and writes nothing: a credential not held is composed with a stand-in and named
+// foreseen, one only a person gives and nobody has is left out and said, one the send would refuse is refused with the
+// controller's words. A failure to compose the node's own modules is an error that satisfies IsUnresolvable, told apart
+// from an unreadable Input (novox/hq 04-ISSUES/152).
+func Resolve(in Input, node string) (Resolved, error) {
+	return newComposer(in).planFor(node)
+}
+
+// IsUnresolvable reports whether err is a node's own set failing to compose, rather than the mesh being unable to answer.
+func IsUnresolvable(err error) bool { return unresolvable(err) }
+
+// planFor is the controller's planFor, worked out once per node in one composition (issue 1954): each caller has its
+// own copy of what a caller may set (a need's fields, as Resolution.Compose sets its Serves), the rest only read.
+func (c *composer) planFor(nodeName string) (Resolved, error) {
+	p, ok := c.plans[nodeName]
+	if !ok {
+		p.resolved, p.err = c.planForNow(nodeName)
+		if c.plans == nil {
+			c.plans = map[string]planOf{}
+		}
+		c.plans[nodeName] = p
+	}
+	if p.err != nil {
+		return Resolved{}, p.err
+	}
+	return p.resolved.copied(), nil
+}
+
+// planOf is planFor's answer for one node, kept.
+type planOf struct {
+	resolved Resolved
+	err      error
+}
+
+// copied is r with its own needs, words and settings lists: what a caller may change of it.
+func (r Resolved) copied() Resolved {
+	out := r
+	out.Plan.Needs = slices.Clone(r.Plan.Needs)
+	out.Foreseen = slices.Clone(r.Foreseen)
+	out.NotGiven = slices.Clone(r.NotGiven)
+	if r.Settings != nil {
+		out.Settings = make(catalogue.SettingsBy, len(r.Settings))
+		for m, layers := range r.Settings {
+			out.Settings[m] = slices.Clone(layers)
+		}
+	}
+	return out
+}
+
+// planForNow is planFor worked out.
+func (c *composer) planForNow(nodeName string) (Resolved, error) {
+	resolved, err := c.resolution(nodeName)
+	if err != nil {
+		return Resolved{}, err
+	}
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return Resolved{}, err
+	}
+	shelf := c.shelfFor(node)
+	var out Resolved
+
+	// The credential for each thing this node takes from elsewhere.
+	for i, n := range resolved.Needs {
+		// Issued for this holder alone and kept by the vault (issue 757).
+		resolved.Needs[i].IssuedToHolder = issuedToHolder(shelf, n)
+		resolved.Needs[i].ProviderMoved = providerMoved(shelf, n)
+		resolved.Needs[i].AnsweredByHelper = answeredByHelper(shelf, n)
+		if n.ByRecord {
+			// Answered by something the mesh holds, so there is no pair-wise secret between two machines.
+			licence, _ := c.licence(n.From)
+			if licence.Keys == nil {
+				// The keys are not given: composed with a stand-in and named, not failed for a value only a send reads.
+				resolved.Needs[i].Sealed = catalogue.ForeseenSealed
+				out.Foreseen = append(out.Foreseen, fmt.Sprintf("%s on %s needs %s from %s", n.For, nodeName, n.Name, n.From))
+			} else {
+				// Given, and none for this holder: the mesh holds none.
+				resolved.Needs[i].Sealed = licence.Keys[Holder{Node: nodeName, Module: n.For}]
+			}
+			// If this holder is the licence's manager, hand it the manager node's PUBLIC sealing key in its bound facts
+			// (novox/hq ADR 0050).
+			if pub := c.managerPublicKeyFor(licence, nodeName, n.For); pub != "" {
+				serves := map[string]any{}
+				for k, v := range resolved.Needs[i].Serves {
+					serves[k] = v
+				}
+				serves["manager_public_key"] = pub
+				resolved.Needs[i].Serves = serves
+				// The manager holder: its empty pre-adoption refresh token is a waiting state, not a missing consumer key.
+				resolved.Needs[i].Manager = true
+			}
+			continue
+		}
+		if credentialless(n) {
+			// Its provider's offer presents no credential (form none): nothing is sealed, made or stood in for (issue 1126).
+			continue
+		}
+		cred, held := c.credential(n, nodeName)
+		_, outside := issuedOutsideBy(shelf, n)
+		switch {
+		case cred.State == CredentialRefused:
+			// Said rather than skipped. A machine that resolves cleanly and receives no credential is one that will fail to
+			// authenticate at some later, less obvious moment.
+			return Resolved{}, fmt.Errorf("%s on %s needs %s from %s and no credential could be made for it: %s",
+				n.For, nodeName, n.Name, n.From, cred.Why)
+		case cred.State == CredentialNotGiven, outside && !(held && cred.State == CredentialHeld):
+			// Not given, and the rest of the consumer runs (ADR 0337 clause 4): no credential file, so the module can tell
+			// it was not given; nothing the mesh made stands in for it.
+			why := cred.Why
+			if why == "" {
+				why = "nobody gave it"
+			}
+			out.NotGiven = append(out.NotGiven, fmt.Sprintf("%s on %s holds no %s from %s: %s", n.For, nodeName, n.Name, n.From, why))
+			continue
+		case cred.State == CredentialHeld && cred.Sealed != "":
+			resolved.Needs[i].Sealed = cred.Sealed
+		default:
+			// Held with no value here, or none held: the next send makes it (or reads it), and a stand-in is composed.
+			resolved.Needs[i].Sealed = catalogue.ForeseenSealed
+			out.Foreseen = append(out.Foreseen, fmt.Sprintf("%s on %s needs %s from %s", n.For, nodeName, n.Name, n.From))
+		}
+	}
+
+	// Settings for everything that resolved, including modules nobody assigned directly: a requirement pulled in by
+	// something else is still configurable.
+	settings := catalogue.SettingsBy{}
+	for _, m := range resolved.Modules {
+		layers := node.Settings[m.Module]
+		if len(layers) == 0 {
+			continue
+		}
+		settings[m.Module] = append([]catalogue.Layer(nil), layers...)
+	}
+	out.Plan, out.Settings = resolved, settings
+	return out, nil
+}
+
+// credential is how the pair credential of one need stands in the Input, and whether the Input names it at all.
+func (c *composer) credential(n catalogue.Needed, consumer string) (Credential, bool) {
+	for _, cr := range c.in.Credentials {
+		if cr.Provision == n.Name && cr.Consumer == consumer && cr.ConsumerModule == n.For && cr.Provider == n.From && cr.Local == n.Local {
+			return cr, true
+		}
+	}
+	return Credential{State: CredentialWouldMake}, false
+}
+
+// licence is the licence of that name.
+func (c *composer) licence(name string) (Licence, bool) {
+	for _, l := range c.in.Licences {
+		if l.Name == name {
+			return l, true
+		}
+	}
+	return Licence{}, false
+}
+
+// managerPublicKeyFor is the manager node's public sealing key, but only when (node, module) is the licence's manager holder
+// and empty otherwise (plan.go managerPublicKeyFor): delivered to the manager module in its bound facts so it can re-seal a
+// rotated refresh token to this node (novox/hq ADR 0050), and to no consumer.
+func (c *composer) managerPublicKeyFor(l Licence, node, module string) string {
+	if l.Manager == (Holder{}) || node != l.Manager.Node || module != l.Manager.Module {
+		return ""
+	}
+	n, err := c.in.node(node)
+	if err != nil {
+		return ""
+	}
+	return n.SealingKey
+}
+
+// issuedOutsideBy is whether a need's provision is offered by its provider with a credential issued outside the mesh
+// (novox/hq ADR 0337), and that provider module: the one answering it when known, else any that offers it so.
+func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (string, bool) {
+	if n.Module != "" {
+		if m, known := shelf[n.Module]; known {
+			return n.Module, m.IssuedOutsideOf(n.Name)
+		}
+	}
+	return resolution.OffersIssuedOutside(shelf, n.Name)
+}
+
+// issuedToHolder is whether the vault keeps a need's credential for its holder alone (issues 749, 757 and 779).
+func issuedToHolder(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
+	if n.ByRecord || n.Module == "" {
+		return false
+	}
+	provider, known := shelf[n.Module]
+	if !known || !movedProvider(provider) {
+		return false
+	}
+	if _, issued := provider.IssuedCredentialOf(n.Name); issued {
+		return true
+	}
+	return provider.CredentialFormOf(n.Name) == catalogue.CredentialFormPair
+}
+
+// providerMoved is whether a need is answered by a module marked moved (issue 788), or by one whose offer of the provision
+// says the provider helper answers it (issue 792).
+func providerMoved(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
+	if n.ByRecord || n.Module == "" {
+		return false
+	}
+	provider, known := shelf[n.Module]
+	return known && (movedProvider(provider) || provider.AnsweredByHelperFor(n.Name))
+}
+
+// answeredByHelper is whether a need's provider offers it answered by the provider helper (issue 792): keyed by the seat
+// mesh-provisioner for every consumer, handed or not (catalogue.Keyed, issue 774).
+func answeredByHelper(shelf map[string]catalogue.Manifest, n catalogue.Needed) bool {
+	if n.ByRecord || n.Module == "" {
+		return false
+	}
+	provider, known := shelf[n.Module]
+	return known && provider.AnsweredByHelperFor(n.Name)
+}
+
+// movedProvider is whether a provider's credentials are the vault's: the module is marked moved, or it holds the
+// mesh-vault seat (issue 793).
+func movedProvider(m catalogue.Manifest) bool {
+	return m.Moved || slices.ContainsFunc(m.Claims, func(c catalogue.Claim) bool { return c.Name == "mesh-vault" })
+}
+
+// resolution works out what one node should run, from what was assigned to it: the controller's planFor up to and
+// including the resolution (plan.go planFor), and no further. A failure to compose the node's own modules is wrapped as
+// notResolvable; every other failure is returned as it is.
+func (c *composer) resolution(nodeName string) (catalogue.Resolution, error) {
+	node, err := c.in.node(nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+	shelf := c.shelfFor(node)
+	world, _, left, err := c.theRestOfTheMesh(nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+	world.Pinned = node.Pins
+	// Where each of its consumers of a provision that keeps data was last sent (novox/hq ADR 0232).
+	world.Bound = node.Bound
+
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return catalogue.Resolution{}, err
+	}
+
+	// What this mesh can answer with a record rather than a machine, and which record each of this node's modules was
+	// put on.
+	world.Licences, world.Using = c.licencesFor(nodeName)
+
+	resolved, err := resolution.Resolve(shelf, node.Assigned,
+		catalogue.Node{Name: nodeName, Site: node.Place.Site, Capabilities: node.Capabilities,
+			At: onNetwork[nodeName], PublicDomain: node.PublicDomain,
+			Account: node.Account, AccountHome: node.AccountHome,
+			AgentAccount: node.AgentAccount, AgentAccountHome: node.AgentAccountHome}, world)
+	if err != nil {
+		// What another node's set would have offered is missing when that set does not resolve here: said with the
+		// refusal, so "nothing provides" is read beside why (issue 1126, probe #532).
+		if len(left) > 0 {
+			var why []string
+			for _, l := range left {
+				why = append(why, l.String())
+			}
+			err = fmt.Errorf("%w\n\nand %d node(s) offer nothing here, as they could not be resolved: %s", err, len(left), strings.Join(why, "; "))
+		}
+		if len(c.unhostable) > 0 {
+			err = fmt.Errorf("%w\n\nand these modules offer nothing here, as their node cannot run them in this composition: %s",
+				err, strings.Join(c.unhostable, "; "))
+		}
+		// The node's own set does not compose: the only failure a mesh-wide gatherer may pass over.
+		return catalogue.Resolution{}, notResolvable{err}
+	}
+	return resolved, nil
+}
+
+// shelfFor is the catalogue as one node composes its own set: the Input's, with each recorded or core module the node keeps at the
+// build it runs put in place of the current one (plan.go keepRecorded). A copy: the Input's catalogue is untouched. Only the node's own planFor and
+// resolution use it; the rest of the mesh and who is on the network are read with the current manifests, as the controller reads them
+// before it keeps a recorded module.
+func (c *composer) shelfFor(node Node) map[string]catalogue.Manifest {
+	if len(node.Kept) == 0 {
+		return c.in.Catalogue
+	}
+	shelf := make(map[string]catalogue.Manifest, len(c.in.Catalogue)+len(node.Kept))
+	for name, m := range c.in.Catalogue {
+		shelf[name] = m
+	}
+	for name, m := range node.Kept {
+		shelf[name] = m
+	}
+	return shelf
+}
+
+// licencesFor is what this node can be answered with by record, and what it was put on. A mesh with no licences at all
+// is the ordinary case and not an error.
+func (c *composer) licencesFor(node string) (map[string][]catalogue.Record, map[string]map[string]catalogue.Record) {
+	all := c.in.Licences
+	if len(all) == 0 {
+		return nil, nil
+	}
+	offered := map[string][]catalogue.Record{}
+	byName := map[string]catalogue.Record{}
+	for _, one := range all {
+		record := catalogue.Record{Name: one.Name, Serves: one.Serves}
+		offered[LicenceProvision] = append(offered[LicenceProvision], record)
+		byName[one.Name] = record
+	}
+	using := map[string]map[string]catalogue.Record{}
+	for _, one := range all {
+		for _, h := range one.Holders {
+			if h.Node != node {
+				continue
+			}
+			if using[h.Module] == nil {
+				using[h.Module] = map[string]catalogue.Record{}
+			}
+			using[h.Module][LicenceProvision] = byName[one.Name]
+		}
+	}
+	return offered, using
+}
diff --git a/internal/compose/resolve_test.go b/internal/compose/resolve_test.go
new file mode 100644
index 0000000..0696afb
--- /dev/null
+++ b/internal/compose/resolve_test.go
@@ -0,0 +1,389 @@
+package compose
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// storeManifests is mesh-controller's bindings_test.go storeManifests (cmd/mesh-controller at 6c2a8d62): a store holding the
+// mesh-store seat, a resolver holding mesh-dns-resolver, a network that requires wildcard resolution, and a board that
+// requires a database.
+func storeManifests() []catalogue.Manifest {
+	return []catalogue.Manifest{
+		{Module: "store", Version: "1",
+			Provides: []catalogue.Offer{{Name: "postgres-database", Scope: catalogue.ScopeMesh}},
+			Claims:   []catalogue.Claim{{Name: "mesh-store", Scope: catalogue.ScopeMesh}},
+			Serves:   map[string]map[string]any{"postgres-database": {"port": 5432}},
+			Grants:   map[string]string{"postgres-database": "/var/lib/mesh/store/grants"}},
+		{Module: "resolver", Version: "1",
+			Provides: []catalogue.Offer{{Name: "wildcard-resolution", Scope: catalogue.ScopeMesh}},
+			Claims:   []catalogue.Claim{{Name: "mesh-dns-resolver", Scope: catalogue.ScopeMesh}}},
+		{Module: "network", Version: "1", Requires: []string{"wildcard-resolution"}},
+		{Module: "board", Version: "1", Requires: []string{"postgres-database"}},
+	}
+}
+
+func need(t *testing.T, plan catalogue.Resolution, consumer, provision string) catalogue.Needed {
+	t.Helper()
+	for _, n := range plan.Needs {
+		if n.For == consumer && n.Name == provision {
+			return n
+		}
+	}
+	t.Fatalf("no %s for %s: %+v", provision, consumer, plan.Needs)
+	return catalogue.Needed{}
+}
+
+// theStoreMesh is the mesh of mesh-controller's bindings_integration_test.go
+// TestTheIncidentAConsumerStaysBesideItsDataUntilAPersonPinsIt: the anchor's store and resolver hold the mesh's seats on
+// record; the laptop runs its own of each, and a network and a board.
+func theStoreMesh(t *testing.T) Input {
+	t.Helper()
+	in := aMesh(t)
+	for _, m := range storeManifests() {
+		in.Catalogue[m.Module] = m
+	}
+	anchor, laptop := nodeOf(t, &in, "anchor"), nodeOf(t, &in, "laptop")
+	anchor.Assigned = append(anchor.Assigned, "store", "resolver")
+	laptop.Assigned = append(laptop.Assigned, "store", "resolver", "network", "board")
+	in.Holdings = []catalogue.Held{
+		{Claim: "mesh-store", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "store", Site: "here"},
+		{Claim: "mesh-dns-resolver", Scope: catalogue.ScopeMesh, Node: "anchor", Module: "resolver", Site: "here"},
+	}
+	return in
+}
+
+// 1362/AC7 and AC4 (bindings_integration_test.go): a consumer of a provision that keeps its data stays beside its data, one that
+// does not follows the seat; the laptop's store taken away, the consumer bound there on record is refused, not moved to the
+// anchor's empty one; a person's pin moves it.
+func TestAConsumerStaysBesideItsDataUntilAPersonPinsIt(t *testing.T) {
+	in := theStoreMesh(t)
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "board", "postgres-database"); n.From != "laptop" || n.Module != "store" || !n.KeepsData {
+		t.Fatalf("the consumer was bound to %s/%s (keeps data: %v); its data is beside it", n.From, n.Module, n.KeepsData)
+	}
+	if n := need(t, got.Plan, "network", "wildcard-resolution"); n.From != "anchor" || n.KeepsData {
+		t.Fatalf("the resolver was bound to %s (keeps data: %v); its seat is held on anchor (issue 258)", n.From, n.KeepsData)
+	}
+
+	// Sent, and recorded: the binding to data. The laptop's store taken away: refused, not moved to the anchor's empty one.
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Bound = map[string]map[string]catalogue.Chosen{"board": {"postgres-database": {Node: "laptop", Module: "store"}}}
+	laptop.Assigned = []string{overlay.Name, "resolver", "network", "board"}
+	_, err = Resolve(in, "laptop")
+	if err == nil || !IsUnresolvable(err) ||
+		!strings.Contains(err.Error(), "board on laptop is bound to laptop/store") ||
+		!strings.Contains(err.Error(), "pin laptop postgres-database anchor store") {
+		t.Fatalf("the consumer's store went and it was answered elsewhere: %v", err)
+	}
+
+	// A person pins the anchor's: it moves, and the resolution says where it was bound (Kept is empty, as it moves).
+	laptop.Pins = map[string]catalogue.Chosen{"postgres-database": {Node: "anchor", Module: "store"}}
+	got, err = Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "board", "postgres-database"); n.From != "anchor" {
+		t.Fatalf("pinned to the anchor and bound to %s", n.From)
+	}
+}
+
+// 1362/AC4: a data-keeping consumer bound on record to a provider elsewhere is kept on that provider, and the resolution says
+// so (Resolution.Kept) when the mesh would answer it otherwise.
+func TestADataKeepingConsumerBoundElsewhereIsKeptThereAndSaid(t *testing.T) {
+	in := theStoreMesh(t)
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = []string{overlay.Name, "resolver", "network", "board"} // no store of its own
+	laptop.Bound = map[string]map[string]catalogue.Chosen{"board": {"postgres-database": {Node: "anchor", Module: "store"}}}
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "board", "postgres-database"); n.From != "anchor" || !n.KeepsData {
+		t.Fatalf("the consumer is bound to %s (keeps data: %v), not where it was sent", n.From, n.KeepsData)
+	}
+	if len(got.Plan.Kept) != 0 {
+		t.Errorf("a binding that was kept where it is is said as a kept move: %+v", got.Plan.Kept)
+	}
+	// And bound somewhere else on record while the mesh would answer from the anchor: kept, and said.
+	laptop.Bound = map[string]map[string]catalogue.Chosen{"board": {"postgres-database": {Node: "home", Module: "store"}}}
+	home := Node{Name: "home", Place: Place{Site: "there", Address: "10.77.0.7"}, Assigned: []string{overlay.Name, "store"},
+		Capabilities: map[string]bool{"container-runtime": true, "wireguard": true, "systemd": true}}
+	in.Nodes = append(in.Nodes, home)
+	got, err = Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "board", "postgres-database"); n.From != "home" {
+		t.Errorf("the consumer was moved from where it was sent: %s", n.From)
+	}
+}
+
+// A provider module whose offer says only a person gives its credential (ADR 0337), and a consumer of it.
+func outsideObjects() catalogue.Manifest {
+	m := objects()
+	m.Provides[0].Credential = &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}
+	return m
+}
+
+func theObjectsMesh(t *testing.T, provider catalogue.Manifest) Input {
+	t.Helper()
+	in := aMesh(t)
+	in.Catalogue[provider.Module], in.Catalogue["files"] = provider, files()
+	nodeOf(t, &in, "anchor").Assigned = append(nodeOf(t, &in, "anchor").Assigned, provider.Module)
+	nodeOf(t, &in, "laptop").Assigned = append(nodeOf(t, &in, "laptop").Assigned, "files")
+	nodeOf(t, &in, "anchor").SealingKey = "anchor-key"
+	nodeOf(t, &in, "laptop").SealingKey = "laptop-key"
+	return in
+}
+
+func theFilesNeed(t *testing.T, got Resolved) catalogue.Needed {
+	t.Helper()
+	return need(t, got.Plan, "files", "s3-bucket")
+}
+
+// 1362/AC1: a pair credential the Input names as existing with no value, and one it names not at all, are composed with a
+// stand-in and named foreseen, and nothing is made; one with a value is composed with it and foreseen is empty.
+func TestAPairCredentialNotHeldIsComposedWithAStandInAndNamedForeseen(t *testing.T) {
+	mk := func() Input { return theObjectsMesh(t, objects()) }
+	for name, creds := range map[string][]Credential{
+		"no entry":           nil,
+		"held with no value": {{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialHeld}},
+		"to be made":         {{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialWouldMake}},
+	} {
+		in := mk()
+		in.Credentials = creds
+		got, err := Resolve(in, "laptop")
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if n := theFilesNeed(t, got); n.Sealed != catalogue.ForeseenSealed {
+			t.Errorf("%s: the credential is %q, not the stand-in", name, n.Sealed)
+		}
+		if len(got.Foreseen) != 1 || got.Foreseen[0] != "files on laptop needs s3-bucket from anchor" {
+			t.Errorf("%s: foreseen is %v", name, got.Foreseen)
+		}
+	}
+	in := mk()
+	in.Credentials = []Credential{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor",
+		State: CredentialHeld, Sealed: "sealed-to-laptop"}}
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := theFilesNeed(t, got); n.Sealed != "sealed-to-laptop" || len(got.Foreseen) != 0 {
+		t.Errorf("a held credential: %q foreseen %v", n.Sealed, got.Foreseen)
+	}
+	unchanged(t, mk, func(in Input) {
+		if _, err := Resolve(in, "laptop"); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
+
+// 1362/AC2: a credential only a person gives and nobody has is not given and not made: the consumer still resolves without it
+// (novox/hq ADR 0337 clause 4), said with the controller's words; one given is composed with it.
+func TestACredentialOnlyAPersonGivesIsNotMadeAndTheConsumerStillResolves(t *testing.T) {
+	for name, creds := range map[string][]Credential{
+		"no entry": nil,
+		"to be made (never, for one issued outside)": {{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialWouldMake}},
+		"not given": {{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor", State: CredentialNotGiven,
+			Why: "the value held was made by the mesh, which objects's software would refuse"}},
+	} {
+		in := theObjectsMesh(t, outsideObjects())
+		in.Credentials = creds
+		got, err := Resolve(in, "laptop")
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if n := theFilesNeed(t, got); n.Sealed != "" {
+			t.Errorf("%s: a value stands in for what nobody gave: %q", name, n.Sealed)
+		}
+		if len(got.Foreseen) != 0 || len(got.NotGiven) != 1 || !strings.Contains(got.NotGiven[0], "files on laptop holds no s3-bucket from anchor: ") {
+			t.Errorf("%s: foreseen %v not given %v", name, got.Foreseen, got.NotGiven)
+		}
+		if len(got.Plan.Modules) == 0 {
+			t.Errorf("%s: the machine did not resolve", name)
+		}
+	}
+	in := theObjectsMesh(t, outsideObjects())
+	in.Credentials = []Credential{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor",
+		State: CredentialHeld, Sealed: "given-and-sealed"}}
+	got, err := Resolve(in, "laptop")
+	if err != nil || theFilesNeed(t, got).Sealed != "given-and-sealed" || len(got.NotGiven) != 0 {
+		t.Fatalf("a value a person gave: %+v %v", got.NotGiven, err)
+	}
+}
+
+// 1362/AC3: a credential the send would refuse, a given value sealed to a key a machine no longer has, refuses the resolution with
+// today's words, and is not a node whose set does not compose.
+func TestACredentialTheSendWouldRefuseRefusesTheResolutionInTheSendsWords(t *testing.T) {
+	why := "files's \"s3-bucket\" credential from anchor was accepted from a person, and a sealing key at one end has changed since. " +
+		"The mesh cannot re-seal a value it does not hold: accept it again with `secret accept laptop files s3-bucket --provider anchor`"
+	in := theObjectsMesh(t, objects())
+	in.Credentials = []Credential{{Provision: "s3-bucket", Consumer: "laptop", ConsumerModule: "files", Provider: "anchor",
+		State: CredentialRefused, Why: why}}
+	_, err := Resolve(in, "laptop")
+	want := "files on laptop needs s3-bucket from anchor and no credential could be made for it: " + why
+	if err == nil || err.Error() != want {
+		t.Fatalf("got %v, want %q", err, want)
+	}
+	if IsUnresolvable(err) {
+		t.Error("a refused credential is a node whose set does not compose")
+	}
+}
+
+// A record-answered need is filled with the licence key sealed to this holder, and the manager holder is handed the manager node's
+// public sealing key (novox/hq ADR 0050) and no other.
+func TestARecordAnsweredNeedGetsItsKeyAndTheManagerItsPublicKey(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["assistant"] = catalogue.Manifest{Module: "assistant", Version: "1", Requires: []string{LicenceProvision}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "assistant")
+	laptop.SealingKey = "laptop-key"
+	in.Licences = []Licence{{Name: "personal", Serves: map[string]any{"model": "x"},
+		Holders: []Holder{{Node: "laptop", Module: "assistant"}},
+		Keys:    map[Holder]string{{Node: "laptop", Module: "assistant"}: "key-sealed-to-laptop"}}}
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := need(t, got.Plan, "assistant", LicenceProvision)
+	if !n.ByRecord || n.Sealed != "key-sealed-to-laptop" || n.Manager || n.Serves["manager_public_key"] != nil {
+		t.Fatalf("the record-answered need is %+v", n)
+	}
+	in.Licences[0].Manager = Holder{Node: "laptop", Module: "assistant"}
+	got, err = Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	n = need(t, got.Plan, "assistant", LicenceProvision)
+	if !n.Manager || n.Serves["manager_public_key"] != "laptop-key" || n.Serves["model"] != "x" {
+		t.Fatalf("the manager is %+v", n)
+	}
+	if len(got.Foreseen) != 0 || len(got.NotGiven) != 0 {
+		t.Errorf("a record-answered need needs no pair credential: %v %v", got.Foreseen, got.NotGiven)
+	}
+}
+
+// 1362/AC5: a node whose own set does not compose returns an error callers can tell from an unreadable Input.
+func TestANodeWhoseOwnSetDoesNotComposeIsToldApartFromAnUnreadableInput(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["rival-one"] = catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-two"] = catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "rival-one", "rival-two")
+	if _, err := Resolve(in, "laptop"); err == nil || !IsUnresolvable(err) {
+		t.Fatalf("a set that does not compose: %v", err)
+	}
+	if _, err := Resolve(in, "nowhere"); err == nil || IsUnresolvable(err) || !errors.Is(err, ErrNoSuchNode) {
+		t.Fatalf("a node the mesh does not have: %v", err)
+	}
+	in.Catalogue = nil
+	if _, err := Resolve(in, "anchor"); err == nil || IsUnresolvable(err) {
+		t.Fatalf("an Input without the catalogue: %v", err)
+	}
+}
+
+// 1362/AC6: settings are returned for every resolved module that has layers in the Input, including one pulled in by another.
+func TestSettingsAreReturnedForEveryResolvedModuleIncludingOneThatWasPulledIn(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["lib"] = catalogue.Manifest{Module: "lib", Version: "1", Provides: catalogue.Offers("blob")}
+	in.Catalogue["app"] = catalogue.Manifest{Module: "app", Version: "1", Requires: []string{"blob"}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "app")
+	laptop.Settings = map[string][]catalogue.Layer{
+		"lib":   {{From: "mesh", Values: map[string]any{"x": 1}}},
+		"app":   {{From: "laptop", Values: map[string]any{"y": 2}}},
+		"other": {{From: "laptop", Values: map[string]any{"z": 3}}}, // not resolved here: no settings come of it
+		"empty": nil,
+	}
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pulled := false
+	for _, m := range got.Plan.Modules {
+		pulled = pulled || m.Module == "lib"
+	}
+	if !pulled {
+		t.Fatalf("lib was not pulled in: %+v", got.Plan.Modules)
+	}
+	if len(got.Settings) != 2 || got.Settings["lib"][0].Values["x"] != 1 || got.Settings["app"][0].Values["y"] != 2 {
+		t.Errorf("settings are %+v", got.Settings)
+	}
+	// The settings returned are copies: changing them does not change the Input.
+	got.Settings["app"][0].From = "changed"
+	if laptop.Settings["app"][0].From != "laptop" {
+		t.Error("the settings returned share the Input's layers")
+	}
+}
+
+// Round 1, finding 3: a licence key the Input does not carry (Keys not given) is composed with a stand-in and named foreseen, so the
+// node still composes; Keys given that lack the holder is the mesh holding none, and the need stays empty.
+func TestALicenceKeyTheInputDoesNotCarryIsAStandInAndNamedForeseen(t *testing.T) {
+	in := aMesh(t)
+	in.Catalogue["assistant"] = catalogue.Manifest{Module: "assistant", Version: "1", Requires: []string{LicenceProvision}}
+	laptop := nodeOf(t, &in, "laptop")
+	laptop.Assigned = append(laptop.Assigned, "assistant")
+	in.Licences = []Licence{{Name: "personal", Serves: map[string]any{"model": "x"}, Holders: []Holder{{Node: "laptop", Module: "assistant"}}}}
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "assistant", LicenceProvision); n.Sealed != catalogue.ForeseenSealed {
+		t.Errorf("a key not given is composed as %q", n.Sealed)
+	}
+	if len(got.Foreseen) != 1 || !strings.Contains(got.Foreseen[0], "assistant on laptop needs model-access") {
+		t.Errorf("foreseen %v", got.Foreseen)
+	}
+	// And a whole node composes with it.
+	if _, problems, err := Compose(in, "laptop"); err != nil || len(problems) != 0 {
+		t.Errorf("a node using a licence whose key is not carried: %v %v", err, problems)
+	}
+	// Keys given, and none for this holder: the mesh holds none.
+	in.Licences[0].Keys = map[Holder]string{}
+	got, err = Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "assistant", LicenceProvision); n.Sealed != "" || len(got.Foreseen) != 0 {
+		t.Errorf("a key the mesh holds none of: %q %v", n.Sealed, got.Foreseen)
+	}
+}
+
+// A consumer not handed of a provision whose provider's offer says the helper answers it has that provision in a plan of
+// its own (issue 774: grafana's route): the composition marks the need answered by the helper, and the plan keys it.
+func TestANeedAnsweredByTheHelperIsInTheConsumersPlan(t *testing.T) {
+	in := theStoreMesh(t)
+	store := in.Catalogue["store"]
+	store.Provides = []catalogue.Offer{{Name: "postgres-database", Scope: catalogue.ScopeMesh, AnsweredBy: catalogue.AnsweredByHelper}}
+	in.Catalogue["store"] = store
+	got, err := Resolve(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := need(t, got.Plan, "board", "postgres-database"); !n.AnsweredByHelper {
+		t.Fatalf("the need is not marked answered by the helper: %+v", n)
+	}
+	with := rendered(t, in, "laptop", Foreseeing).Rendering
+	with.Hands, with.Provisioner = true, "mesh-provisioner-client"
+	if with.Generators, err = newComposer(in).generators(); err != nil {
+		t.Fatal(err)
+	}
+	c, err := resolution.Compose(got.Plan, with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p := c.Plans["board"].Provisions; len(p) != 1 || p[0].Provision != "postgres-database" || p[0].ProviderModule != "store" {
+		t.Fatalf("board's plan is %+v", c.Plans["board"])
+	}
+}
diff --git a/internal/compose/rest.go b/internal/compose/rest.go
new file mode 100644
index 0000000..c2e4708
--- /dev/null
+++ b/internal/compose/rest.go
@@ -0,0 +1,256 @@
+package compose
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+)
+
+// notResolvable marks the one failure in a node's resolution that is a statement about the node: its assigned modules
+// do not compose. Every other failure means the mesh could not be asked. Whoever gathers across the mesh skips a node
+// that cannot resolve and never a node that could not be read (novox/hq 04-ISSUES/152).
+type notResolvable struct{ err error }
+
+func (n notResolvable) Error() string { return n.err.Error() }
+func (n notResolvable) Unwrap() error { return n.err }
+
+// unresolvable reports whether err is a node's own set failing to compose.
+func unresolvable(err error) bool {
+	var n notResolvable
+	return errors.As(err, &n)
+}
+
+// Passes is what a composition found that the mesh must record, and did not: each seat held once whose holder on record
+// is assigned nowhere that exactly one claimant takes over (novox/hq ADR 0449 clause 4), and the lines that say what was
+// found. The caller records a pass and writes its hand act; this package does neither.
+type Passes struct {
+	// Passes are the seats to pass, in the order they were found.
+	Passes []catalogue.SeatPass
+	// Said are the lines the finding says (a seat two claimants could take, one nothing can).
+	Said []string
+}
+
+// LeftOut is a node that does not resolve in the view of the rest of the mesh, with why: it offers nothing and holds
+// nothing as far as every other machine's plan can tell (novox/hq issue 188).
+type LeftOut struct {
+	Node string
+	Err  error
+}
+
+// String is the line the controller says of it.
+func (l LeftOut) String() string {
+	return fmt.Sprintf("%s is left out of the rest of the mesh: it does not resolve: %v", l.Node, l.Err)
+}
+
+// TheRestOfTheMesh is what every other node holds and offers, as the controller works it out (plan.go theRestOfTheMesh):
+// two passes over the others, because what a node offers needs it resolved and resolving it may need what the mesh
+// offers. The first takes brokered requirements on trust and answers only what each node offers; the second answers
+// everything with that in hand. Nothing is declared from the first.
+//
+// It writes nothing. A seat the mesh passes on is returned in Passes for the caller to record; the World carries the
+// holdings as they stand after the passes, and Input's own are unchanged. A node left out is returned with its reason, in
+// the order the controller said them (the first pass's, then the second's when no node is excluded).
+func TheRestOfTheMesh(in Input, exclude string) (catalogue.World, Passes, []LeftOut, error) {
+	c := newComposer(in)
+	return c.theRestOfTheMesh(exclude)
+}
+
+func (c *composer) theRestOfTheMesh(exclude string) (catalogue.World, Passes, []LeftOut, error) {
+	r, ok := c.rest[exclude]
+	if !ok {
+		r.world, r.passes, r.left, r.err = c.theRestOfTheMeshNow(exclude)
+		r.unhostable = c.unhostable
+		if c.rest == nil {
+			c.rest = map[string]restOf{}
+		}
+		c.rest[exclude] = r
+	}
+	// Each caller has its own copy of what it may set or add to; the maps and the slices within are only read.
+	c.unhostable = slices.Clone(r.unhostable)
+	return r.world, r.passes, slices.Clone(r.left), r.err
+}
+
+// theRestOfTheMeshNow is theRestOfTheMesh worked out: every other machine's set resolved, twice.
+func (c *composer) theRestOfTheMeshNow(exclude string) (catalogue.World, Passes, []LeftOut, error) {
+	shelf := c.in.Catalogue
+	holdings := append([]catalogue.Held(nil), c.in.Holdings...)
+	nodes := c.in.sorted()
+
+	onNetwork, err := c.whereEveryoneIs()
+	if err != nil {
+		return catalogue.World{}, Passes{}, nil, err
+	}
+
+	type candidate struct {
+		node     catalogue.Node
+		assigned []string
+		pins     map[string]catalogue.Chosen
+	}
+	var others []candidate
+	// Every machine's assignments, before the holdings are read by any resolution (novox/hq ADR 0449 clause 4): a seat
+	// held once whose holder on record is assigned on no machine passes to its only claimant here.
+	everyAssigned := map[string][]string{}
+	for _, n := range nodes {
+		if len(n.Assigned) > 0 {
+			everyAssigned[n.Name] = n.Assigned
+		}
+	}
+	var passes Passes
+	holdings, passes = passSeatsOn(holdings, assignmentsOf(shelf, everyAssigned))
+	for _, n := range nodes {
+		if n.Name == exclude {
+			continue
+		}
+		theirs := everyAssigned[n.Name]
+		if len(theirs) == 0 {
+			continue
+		}
+		others = append(others, candidate{
+			node: catalogue.Node{Name: n.Name, Site: n.Place.Site, Capabilities: n.Capabilities,
+				At: onNetwork[n.Name], PublicDomain: n.PublicDomain},
+			assigned: theirs, pins: n.Pins})
+	}
+
+	var left []LeftOut
+	offered := map[string][]catalogue.Provider{}
+	var firstHeld []catalogue.Held
+	c.unhostable = nil
+	for _, o := range others {
+		got, err := resolution.Resolve(shelf, o.assigned, o.node, catalogue.World{Unchecked: true, Holdings: holdings})
+		if err != nil {
+			// Said, not skipped: a machine dropped here offers nothing and holds nothing.
+			left = append(left, LeftOut{Node: o.node.Name, Err: err})
+			continue
+		}
+		for _, u := range got.Unhostable {
+			c.unhostable = append(c.unhostable, fmt.Sprintf("%s on %s lacks %s", u.Module, o.node.Name, strings.Join(u.Missing, ", ")))
+		}
+		firstHeld = append(firstHeld, got.Claims...)
+		for _, m := range got.Modules {
+			for _, name := range m.OffersAt(catalogue.ScopeMesh) {
+				// What that module says a consumer needs to know, with that node's settings on it.
+				serves, layers, err := c.servedOnNode(o.node.Name, m, name)
+				if err != nil {
+					return catalogue.World{}, Passes{}, nil, err
+				}
+				// And its own composed names, as that node composes them (novox/hq ADR 0346).
+				serves, leftOut, err := resolution.ServedOwnNames(got, m, name, serves, resolution.WithDefaults(m, layers))
+				if err != nil {
+					return catalogue.World{}, Passes{}, nil, err
+				}
+				offered[name] = append(offered[name], catalogue.Provider{
+					Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
+			}
+		}
+	}
+	for k := range offered {
+		sort.Slice(offered[k], func(i, j int) bool {
+			return offered[k][i].Node < offered[k][j].Node
+		})
+	}
+
+	// The second pass is given the first pass's holdings (novox/hq ADR 0110).
+	world := catalogue.World{Offered: offered, Held: firstHeld, Holdings: holdings}
+	var held []catalogue.Held
+	for _, o := range others {
+		// Each machine is resolved with its own pins, as its plan is.
+		theirs := world
+		theirs.Pinned = o.pins
+		got, err := resolution.Resolve(shelf, o.assigned, o.node, theirs)
+		if err != nil {
+			// Said only for the whole-mesh view: with one machine excluded, the view is partial by design.
+			if exclude == "" {
+				left = append(left, LeftOut{Node: o.node.Name, Err: err})
+			}
+			continue
+		}
+		held = append(held, got.Claims...)
+	}
+	world.Held = held
+	return world, passes, left, nil
+}
+
+// passSeatsOn finds, in the composition that finds it, the new holder of each seat held once whose holder on record is
+// assigned nowhere and which has exactly one claimant able to hold it (novox/hq ADR 0449 clause 4), and answers the
+// holdings as they are after it, with the passes. Nothing is recorded.
+func passSeatsOn(holdings []catalogue.Held, assignments []catalogue.Assignment) ([]catalogue.Held, Passes) {
+	passes, said := resolution.SeatsToPassOn(holdings, assignments)
+	out := Passes{Said: said}
+	for _, p := range passes {
+		out.Passes = append(out.Passes, p)
+		var next []catalogue.Held
+		for _, h := range holdings {
+			if hs, ok := catalogue.SeatNamed(h.Claim); ok && hs.Name == p.Seat.Name {
+				continue
+			}
+			next = append(next, h)
+		}
+		p.To.Site = p.From.Site
+		holdings = append(next, p.To)
+	}
+	return holdings, out
+}
+
+// assignmentsOf are the assignments of every machine, as the passing of a seat reads them. A module assigned and
+// missing from the shelf is still assigned: an assignment with no claims, so its holder is not taken for gone.
+func assignmentsOf(shelf map[string]catalogue.Manifest, assigned map[string][]string) []catalogue.Assignment {
+	var out []catalogue.Assignment
+	names := make([]string, 0, len(assigned))
+	for node := range assigned {
+		names = append(names, node)
+	}
+	sort.Strings(names)
+	for _, node := range names {
+		for _, module := range assigned[node] {
+			m, ok := shelf[module]
+			if !ok {
+				m = catalogue.Manifest{Module: module}
+			}
+			out = append(out, catalogue.Assignment{Node: node, Manifest: m})
+		}
+	}
+	return out
+}
+
+// servedOnNode is what a module on a node tells a consumer of one of its provisions, with THAT node's ports on it: the
+// port the node was given over the one the mesh assigned over the manifest's own, settled with the node's settings
+// layers. The one derivation for every reader of a provider's address.
+func (c *composer) servedOnNode(node string, m catalogue.Manifest, provision string) (map[string]any, []catalogue.Layer, error) {
+	ports, layers, err := c.portsGivenOn(node, m)
+	if err != nil {
+		return nil, nil, err
+	}
+	serves := resolution.ServedOn(m, provision, ports)
+	if len(serves) > 0 {
+		serves, err = resolution.Settle(serves, resolution.WithDefaults(m, layers))
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	return serves, layers, nil
+}
+
+// portsGivenOn is where a node puts a module's ports — assigned, then given over them — and the node's settings layers
+// for the module.
+func (c *composer) portsGivenOn(node string, m catalogue.Manifest) (map[int]int, []catalogue.Layer, error) {
+	n, err := c.in.node(node)
+	if err != nil {
+		return nil, nil, err
+	}
+	ports := map[int]int{}
+	for wanted, at := range n.Ports[m.Module] {
+		ports[wanted] = at
+	}
+	layers := n.Settings[m.Module]
+	if given, err := resolution.GivenPorts(m, layers); err == nil {
+		for wanted, at := range given {
+			ports[wanted] = at
+		}
+	}
+	return ports, layers, nil
+}
diff --git a/internal/compose/rest_test.go b/internal/compose/rest_test.go
new file mode 100644
index 0000000..f771c10
--- /dev/null
+++ b/internal/compose/rest_test.go
@@ -0,0 +1,232 @@
+package compose
+
+import (
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"github.com/novox/mesh-host/internal/compose/resolution"
+	"github.com/novox/mesh-host/internal/overlay"
+)
+
+// objects and files are the provider and consumer of mesh-controller's facts_test.go aMeshWithSecrets (cmd/mesh-controller at
+// 6c2a8d62): a module providing s3-bucket at mesh scope with an identity bound, and one requiring it.
+func objects() catalogue.Manifest {
+	return catalogue.Manifest{Module: "objects", Version: "1",
+		Provides: []catalogue.Offer{{Name: "s3-bucket", Scope: catalogue.ScopeMesh,
+			Identity: &catalogue.OfferIdentity{Max: 20, In: "an S3 access key"}}},
+		Receives: map[string]string{"s3-bucket": "/var/lib/mesh/objects/mesh.json"}}
+}
+
+func files() catalogue.Manifest {
+	return catalogue.Manifest{Module: "files", Version: "1", Requires: []string{"s3-bucket"},
+		Resources: []map[string]any{{"id": "config", "type": "file", "path": "/etc/files/config.json",
+			"mode": "0600", "content": "{}", "merge": "json"}}}
+}
+
+// threeNodes is aMesh and a third node `ace` running a database, so the mesh has three nodes that each offer something:
+// anchor objects, ace a database, laptop a consumer of the first.
+func threeNodes(t *testing.T) Input {
+	t.Helper()
+	in := aMesh(t)
+	db := catalogue.Manifest{Module: "pg", Version: "1", Provides: catalogue.FromAnywhere("postgres-database")}
+	in.Catalogue["objects"], in.Catalogue["files"], in.Catalogue["pg"] = objects(), files(), db
+	anchor, laptop := nodeOf(t, &in, "anchor"), nodeOf(t, &in, "laptop")
+	anchor.Assigned = append(anchor.Assigned, "objects")
+	laptop.Assigned = append(laptop.Assigned, "files")
+	in.Nodes = append(in.Nodes, Node{Name: "ace", Place: Place{Site: "there", Address: "10.77.0.3"},
+		Assigned: []string{"pg"}, Capabilities: map[string]bool{}})
+	return in
+}
+
+func providers(w catalogue.World, provision string) []string {
+	var out []string
+	for _, p := range w.Offered[provision] {
+		out = append(out, p.Node+"/"+p.Module)
+	}
+	return out
+}
+
+// 1361/AC1: three nodes each offering a provision; the rest of the mesh, for one of them, offers every other node's and none of its
+// own, and holds what they hold.
+func TestTheRestOfTheMeshOffersEveryOtherNodesProvisionsAndNoneOfTheExcluded(t *testing.T) {
+	in := threeNodes(t)
+	w, passes, left, err := TheRestOfTheMesh(in, "laptop")
+	if err != nil || len(left) != 0 || len(passes.Passes) != 0 {
+		t.Fatalf("%v %v %+v", err, left, passes)
+	}
+	if got := providers(w, "s3-bucket"); len(got) != 1 || got[0] != "anchor/objects" {
+		t.Errorf("s3-bucket is offered by %v", got)
+	}
+	if got := providers(w, "postgres-database"); len(got) != 1 || got[0] != "ace/pg" {
+		t.Errorf("postgres-database is offered by %v", got)
+	}
+	if p := w.Offered["s3-bucket"][0]; p.At != "anchor.internal" {
+		t.Errorf("anchor is at %q on the private network", p.At)
+	}
+	// Excluding anchor takes its offer away and keeps the others'.
+	w, _, _, err = TheRestOfTheMesh(in, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := providers(w, "s3-bucket"); len(got) != 0 {
+		t.Errorf("the excluded node's offer is in the world: %v", got)
+	}
+	if got := providers(w, "postgres-database"); len(got) != 1 {
+		t.Errorf("another node's offer is missing: %v", got)
+	}
+	// With nobody excluded, every offer is there, and everyone's claims are held.
+	w, _, _, err = TheRestOfTheMesh(in, "")
+	if err != nil || len(providers(w, "s3-bucket")) != 1 || len(providers(w, "postgres-database")) != 1 {
+		t.Fatalf("%v %v", providers(w, "s3-bucket"), err)
+	}
+	// Each machine is resolved with its own pins, as its plan is: the world is the same for any pin of the excluded node.
+	nodeOf(t, &in, "laptop").Pins = map[string]catalogue.Chosen{"s3-bucket": {Node: "anchor", Module: "objects"}}
+	if _, _, _, err := TheRestOfTheMesh(in, "laptop"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 1361/AC2: a node whose assigned set does not resolve is left out and named with today's reason, and the others still offer.
+func TestANodeWhoseSetDoesNotResolveIsLeftOutAndTheOthersStillOffer(t *testing.T) {
+	in := threeNodes(t)
+	rivalOne := catalogue.Manifest{Module: "rival-one", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	rivalTwo := catalogue.Manifest{Module: "rival-two", Version: "1", Claims: []catalogue.Claim{{Name: "the-seat", Scope: catalogue.ScopeNode}}}
+	in.Catalogue["rival-one"], in.Catalogue["rival-two"] = rivalOne, rivalTwo
+	ace := nodeOf(t, &in, "ace")
+	ace.Assigned = append(ace.Assigned, "rival-one", "rival-two")
+	w, _, left, err := TheRestOfTheMesh(in, "laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(left) == 0 {
+		t.Fatal("a node whose set does not resolve was not left out")
+	}
+	for _, l := range left {
+		if l.Node != "ace" || !strings.Contains(l.String(), "ace is left out of the rest of the mesh: it does not resolve: ") {
+			t.Errorf("left out %q", l.String())
+		}
+	}
+	if got := providers(w, "s3-bucket"); len(got) != 1 {
+		t.Errorf("the others do not offer: %v", got)
+	}
+	if got := providers(w, "postgres-database"); len(got) != 0 {
+		t.Errorf("the node left out offers: %v", got)
+	}
+	// Said for the whole-mesh view in both passes (as the controller says it), and for a view with one machine excluded in the first only.
+	_, _, whole, _ := TheRestOfTheMesh(in, "")
+	if len(whole) != 2 {
+		t.Errorf("the whole-mesh view says %d line(s), want the two passes'", len(whole))
+	}
+	if len(left) != 1 {
+		t.Errorf("a view with one excluded says %d line(s), want the first pass's", len(left))
+	}
+}
+
+// 1361/AC3 and AC4 (mesh-controller seat_pass_test.go TestACompositionPassesTheSeatAndWritesOneHandActByTheController, in
+// the part that is not a write): a seat held once whose holder on record is assigned nowhere and one claimant: the seat
+// passes to that claimant in the World, and is returned as a pass; Input's holdings are unchanged.
+func TestASeatWhoseHolderIsAssignedNowhereGoesToItsOnlyClaimant(t *testing.T) {
+	withSeat(t)
+	mk := func() Input {
+		return Input{
+			Catalogue: map[string]catalogue.Manifest{"gate": aBrokerClaiming("gate")},
+			Nodes:     []Node{{Name: "novox", Place: Place{Site: "here"}, Assigned: []string{"gate"}}},
+			Holdings:  []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker", Site: "here"}},
+		}
+	}
+	in := mk()
+	w, passes, _, err := TheRestOfTheMesh(in, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(w.Holdings) != 1 || w.Holdings[0].Module != "gate" || w.Holdings[0].Node != "novox" {
+		t.Fatalf("the holdings after the composition do not name the gate: %+v", w.Holdings)
+	}
+	if len(passes.Passes) != 1 {
+		t.Fatalf("passes=%d, want one", len(passes.Passes))
+	}
+	p := passes.Passes[0]
+	if p.Seat.Name != "mesh-broker" || p.From.Module != "old-broker" || p.To.Module != "gate" || p.To.Node != "novox" {
+		t.Errorf("the pass is %+v", p)
+	}
+	unchanged(t, mk, func(in Input) {
+		if _, _, _, err := TheRestOfTheMesh(in, ""); err != nil {
+			t.Fatal(err)
+		}
+	})
+}
+
+// 1317/AC2 (seat_pass_test.go TestACompositionWithTwoClaimantsRecordsNoneAndSaysSo): two claimants, no pass, the refusal said with
+// both and the remedy. 1317/AC3 and AC4 (TestACompositionChangesNothingWhileTheHolderIsAssignedOrNobodyClaims): nothing changes while
+// the holder is assigned, nor with no claimant.
+func TestNoSeatIsPassedForTwoClaimantsAnAssignedHolderOrNoClaimant(t *testing.T) {
+	withSeat(t)
+	held := []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}
+	_, passes := passSeatsOn(held, []catalogue.Assignment{
+		{Node: "novox", Manifest: aBrokerClaiming("gate")}, {Node: "ace", Manifest: aBrokerClaiming("other")}})
+	said := strings.Join(passes.Said, "\n")
+	if len(passes.Passes) != 0 || !strings.Contains(said, "gate") || !strings.Contains(said, "other") ||
+		!strings.Contains(said, "seat mesh-broker --to") {
+		t.Fatalf("passes %+v said %q", passes.Passes, said)
+	}
+	got, passes := passSeatsOn(held, []catalogue.Assignment{
+		{Node: "novox", Manifest: aBrokerClaiming("old-broker")}, {Node: "novox", Manifest: aBrokerClaiming("gate")}})
+	if len(passes.Passes) != 0 || len(got) != 1 || got[0].Module != "old-broker" {
+		t.Fatalf("holder assigned: %+v %+v", got, passes)
+	}
+	got, passes = passSeatsOn(held, nil)
+	if len(passes.Passes) != 0 || len(got) != 1 || got[0].Module != "old-broker" {
+		t.Fatalf("no claimant: %+v %+v", got, passes)
+	}
+}
+
+// seat_pass_test.go TestAHolderAssignedButNotOnTheShelfIsNotTakenForGone.
+func TestAHolderAssignedButNotOnTheShelfIsNotTakenForGone(t *testing.T) {
+	withSeat(t)
+	as := assignmentsOf(map[string]catalogue.Manifest{"gate": aBrokerClaiming("gate")},
+		map[string][]string{"novox": {"gate", "old-broker"}})
+	passes, _ := resolution.SeatsToPassOn(
+		[]catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}}, as)
+	if len(passes) != 0 {
+		t.Fatalf("a holder missing from the shelf lost its seat: %+v", passes)
+	}
+}
+
+// The not-resolving node of a view with a holder on record: holdings reach the first pass (novox/hq ADR 0131), so a node running
+// the next holder beside the current one is not refused as a second holder.
+func TestAHolderOnRecordSettlesTheSeatInTheRestOfTheMesh(t *testing.T) {
+	withSeat(t)
+	in := Input{
+		Catalogue: map[string]catalogue.Manifest{"old-broker": aBrokerClaiming("old-broker"), "gate": aBrokerClaiming("gate")},
+		Nodes: []Node{
+			{Name: "novox", Assigned: []string{"old-broker", "gate"}},
+			{Name: "ace", Assigned: []string{}}},
+		Holdings: []catalogue.Held{{Claim: "mesh-broker", Scope: catalogue.ScopeMesh, Node: "novox", Module: "old-broker"}},
+	}
+	_, passes, left, err := TheRestOfTheMesh(in, "ace")
+	if err != nil || len(left) != 0 || len(passes.Passes) != 0 {
+		t.Fatalf("%v %v %+v", err, left, passes)
+	}
+	in.Holdings = nil
+	_, _, left, err = TheRestOfTheMesh(in, "ace")
+	if err != nil || len(left) == 0 {
+		t.Fatalf("two claimants with nothing on record were not refused: %v %v", err, left)
+	}
+}
+
+// Each machine is resolved in the second pass with its own pins, as its plan is (novox/hq issue 188): a pin to a provider that
+// does not answer is its own refusal, so the machine is left out for it; the same machine without the pin is not.
+func TestEachNodeIsResolvedWithItsOwnPinsInTheRestOfTheMesh(t *testing.T) {
+	in := threeNodes(t)
+	in.Nodes = append(in.Nodes, Node{Name: "newt", Place: Place{Site: "there", Address: "10.77.0.4"}, Assigned: []string{overlay.Name, "files"}, Capabilities: map[string]bool{}})
+	_, _, left, err := TheRestOfTheMesh(in, "")
+	if err != nil || len(left) != 0 {
+		t.Fatalf("without a pin the consumer is left out: %v %v", left, err)
+	}
+	nodeOf(t, &in, "newt").Pins = map[string]catalogue.Chosen{"s3-bucket": {Node: "ace", Module: "nothing"}}
+	_, _, left, err = TheRestOfTheMesh(in, "")
+	if err != nil || len(left) != 1 || left[0].Node != "newt" || !strings.Contains(left[0].String(), "was told to get \"s3-bucket\" from") {
+		t.Fatalf("a pin to a provider that does not answer did not leave the consumer out: %v %v", left, err)
+	}
+}
diff --git a/internal/compose/seats_test.go b/internal/compose/seats_test.go
new file mode 100644
index 0000000..a07e0c2
--- /dev/null
+++ b/internal/compose/seats_test.go
@@ -0,0 +1,22 @@
+package compose
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// aBrokerClaiming is mesh-controller's seat_pass_test.go helper of the same name.
+func aBrokerClaiming(module string) catalogue.Manifest {
+	return catalogue.Manifest{Module: module,
+		Provides: []catalogue.Offer{{Name: "mesh-bus", Scope: catalogue.ScopeMesh}},
+		Claims:   []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
+}
+
+// withSeat is mesh-controller's withBusSeat: a single mesh seat, mesh-broker, for the test.
+func withSeat(t *testing.T) {
+	t.Helper()
+	was := catalogue.Seats()
+	t.Cleanup(func() { catalogue.UseSeats(was) })
+	catalogue.UseSeats([]catalogue.Seat{{Name: "mesh-broker", Scope: catalogue.ScopeMesh, Delivers: "mesh-bus", Decision: "test"}})
+}
diff --git a/internal/composer/composer.go b/internal/composer/composer.go
new file mode 100644
index 0000000..d5bba7c
--- /dev/null
+++ b/internal/composer/composer.go
@@ -0,0 +1,236 @@
+// Package composer is the node-engine's composition as one function over a plain request (novox/hq ADR 0482 clause 4,
+// ADR 0593 §7): what the command mesh-compose runs, so a group that changes the node-engine's composition is composed by
+// the composer built at that group's head of the node-engine's repository, in a build module's sandbox.
+//
+// **It reads its request and nothing else.** No bus, store, network, file or environment: the manifests come inside the
+// request (raw, as their repository holds them), the rest of the mesh is the request's input, and the answer is a value.
+// The request's and the verdict's shapes are mesh-sdk's composer package; their logic, which composes, is here.
+package composer
+
+import (
+	"encoding/json"
+	"fmt"
+	"slices"
+	"sort"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	sdk "git.novox.be/novox/mesh-sdk/go/composer"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"git.novox.be/novox/mesh-sdk/go/sdkversion"
+
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+)
+
+// The shapes of mesh-sdk's composer package, by the names this package's code was written with.
+type (
+	Request      = sdk.Request
+	Case         = sdk.Case
+	Manifest     = sdk.Manifest
+	Verdict      = sdk.Verdict
+	CaseVerdict  = sdk.CaseVerdict
+	ManifestRead = sdk.ManifestRead
+	Machine      = sdk.Machine
+	Path         = sdk.Path
+)
+
+const (
+	Version      = sdk.Version
+	DepthResolve = sdk.DepthResolve
+	DepthCompose = sdk.DepthCompose
+)
+
+// ErrUnfilled is a manifest named by a digest that nobody replaced by its bytes (sdk.ErrUnfilled).
+var ErrUnfilled = sdk.ErrUnfilled
+
+// inputOf is the request's input as this composer's composition input: the request carries it as JSON (mesh-sdk holds no
+// composition), the same bytes either way.
+func inputOf(r Request) (compose.Input, error) {
+	var in compose.Input
+	raw, err := json.Marshal(r.Input)
+	if err != nil {
+		return in, fmt.Errorf("composer: the request's input cannot be read: %w", err)
+	}
+	if len(raw) == 0 || string(raw) == "null" {
+		return in, nil
+	}
+	if err := json.Unmarshal(raw, &in); err != nil {
+		return in, fmt.Errorf("composer: the request's input is not a composition input: %w", err)
+	}
+	return in, nil
+}
+
+// Run composes every case of r and answers the verdict, its SDK this binary's mesh-sdk. An error is a request it
+// cannot run (an unknown depth, a case named twice, a manifest left as a digest); a machine that does not compose is a
+// verdict.
+func Run(r Request) (Verdict, error) {
+	depth := r.Depth
+	if depth == "" {
+		depth = DepthCompose
+	}
+	if depth != DepthResolve && depth != DepthCompose {
+		return Verdict{}, fmt.Errorf("composer: the depth %q is not resolve or compose", r.Depth)
+	}
+	v := Verdict{V: Version, SDK: sdkversion.Version()}
+	seen := map[string]bool{}
+	for _, c := range r.Cases {
+		if seen[c.Name] {
+			return Verdict{}, fmt.Errorf("composer: the case %q is named twice", c.Name)
+		}
+		seen[c.Name] = true
+		cv, err := runCase(r, c, depth)
+		if err != nil {
+			return Verdict{}, err
+		}
+		v.Cases = append(v.Cases, cv)
+	}
+	return v, nil
+}
+
+// parse decodes every manifest leniently and takes its verdict (novox/hq ADR 0578 §3, §5): the composer judges none. A
+// manifest refused by its verdict is held, composed as its stub without its items (as the bus reader holds one); bytes
+// that do not decode are left out. Both are named in reads.
+func parse(m map[string]Manifest, reads map[string]ManifestRead, verdicts map[string]delivery.ManifestVerdict) (map[string]catalogue.Manifest, error) {
+	out := map[string]catalogue.Manifest{}
+	for name, man := range m {
+		if len(man.Raw) == 0 {
+			return nil, fmt.Errorf("%w: %s (digest %s)", ErrUnfilled, name, man.Digest)
+		}
+		decoded, err := catalogue.Decode(man.Raw)
+		read := ManifestRead{Accepted: err == nil, SetAside: decoded.SetAside()}
+		if err != nil {
+			read.Refused = fmt.Sprintf("the manifest of %s does not decode: %v", name, err)
+		} else if v, ok := verdicts[name]; ok {
+			if refused, _ := delivery.TakeManifestVerdict(&v); refused {
+				if v.Module == "" {
+					v.Module = name
+				}
+				read = ManifestRead{Refused: v.Why()}
+				decoded.Items = nil
+				decoded = compose.Stub(decoded)
+			}
+		}
+		if reads != nil {
+			reads[name] = read
+		}
+		if err == nil {
+			out[name] = decoded
+		}
+	}
+	return out, nil
+}
+
+func runCase(r Request, c Case, depth string) (CaseVerdict, error) {
+	cv := CaseVerdict{Name: c.Name, Manifests: map[string]ManifestRead{}}
+	shelf, err := parse(c.Manifests, cv.Manifests, c.Verdicts)
+	if err != nil {
+		return CaseVerdict{}, err
+	}
+	base, err := inputOf(r)
+	if err != nil {
+		return CaseVerdict{}, err
+	}
+	in, err := frombus.Placed(base, c.Placements)
+	if err != nil {
+		return CaseVerdict{}, fmt.Errorf("composer: the case %q: %w", c.Name, err)
+	}
+	in.Catalogue = shelf
+	in.Nodes = slices.Clone(in.Nodes)
+	in.Holdings = slices.Clone(in.Holdings)
+	for i := range in.Nodes {
+		in.Nodes[i].Kept = nil
+		if kept := c.Kept[in.Nodes[i].Name]; len(kept) > 0 {
+			k, err := parse(kept, nil, nil)
+			if err != nil {
+				return CaseVerdict{}, err
+			}
+			in.Nodes[i].Kept = k
+		}
+	}
+	if r.HoldingsFromClaims {
+		in.Holdings = append(in.Holdings, HoldingsOf(shelf, in.Nodes)...)
+	}
+	if len(r.Machines) == 0 {
+		return cv, nil
+	}
+	cv.Machines = map[string]Machine{}
+	for _, node := range r.Machines {
+		cv.Machines[node] = machine(in, node, depth, r.Declarations)
+	}
+	return cv, nil
+}
+
+// HoldingsOf is every seat an assigned module claims, held on the node it is assigned to, in node order: the holdings
+// of an input that has none of record (the assigner's, mesh-delivery-assigner internal/assign input).
+func HoldingsOf(shelf map[string]catalogue.Manifest, nodes []compose.Node) []catalogue.Held {
+	var out []catalogue.Held
+	sorted := slices.Clone(nodes)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Name < sorted[j].Name })
+	for _, n := range sorted {
+		for _, mod := range n.Assigned {
+			for _, cl := range shelf[mod].Claims {
+				scope := cl.Scope
+				if seat, ok := catalogue.SeatNamed(cl.Name); ok && scope == "" {
+					scope = seat.Scope
+				}
+				out = append(out, catalogue.Held{Claim: cl.Name, Scope: scope, Node: n.Name, Module: mod})
+			}
+		}
+	}
+	return out
+}
+
+func machine(in compose.Input, node, depth string, declarations bool) Machine {
+	if depth == DepthResolve {
+		if _, err := compose.Resolve(in, node); err != nil {
+			return Machine{Reason: err.Error()}
+		}
+		return Machine{Composes: true}
+	}
+	d, problems, err := compose.Compose(in, node)
+	if err != nil {
+		return Machine{Reason: err.Error()}
+	}
+	m := Machine{Composes: len(problems) == 0, Problems: problems, Refusals: d.Refusals()}
+	if len(problems) > 0 {
+		m.Reason = "the node-engine's validator refuses the declaration"
+	}
+	if declarations {
+		m.Declared = pathsOf(d)
+	}
+	return m
+}
+
+// pathsOf is every resource of a declaration that names a path, with its owner, group and mode as declared, sorted by
+// path.
+func pathsOf(d compose.Declared) []Path {
+	var out []Path
+	str := func(r map[string]any, key string) string {
+		if v, ok := r[key]; ok && v != nil {
+			return fmt.Sprint(v)
+		}
+		return ""
+	}
+	for _, r := range d.Resources {
+		p := str(r, "path")
+		if p == "" {
+			continue
+		}
+		out = append(out, Path{Path: p, Kind: str(r, "type"), Owner: str(r, "owner"), Group: str(r, "group"),
+			Mode: str(r, "mode"), Module: d.ModuleOf[str(r, "id")]})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Path != out[j].Path {
+			return out[i].Path < out[j].Path
+		}
+		return out[i].Kind < out[j].Kind
+	})
+	return out
+}
+
+// Package is the import path of the command, which a build module builds at the node-engine's repository's head of a
+// group that changes the node-engine's composition (novox/hq ADR 0593 §7): mesh-sdk's composer.Package names the same.
+const Package = "github.com/novox/mesh-host/cmd/mesh-compose"
+
+// Decode reads a request (sdk.Decode); it refuses one that is not JSON or of another version.
+func Decode(data []byte) (Request, error) { return sdk.Decode(data) }
diff --git a/internal/composer/composer_test.go b/internal/composer/composer_test.go
new file mode 100644
index 0000000..dcce0ac
--- /dev/null
+++ b/internal/composer/composer_test.go
@@ -0,0 +1,100 @@
+package composer
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+)
+
+const demo = `{"module": "demo", "version": "1", "claims": [{"name": "node-files"}]}`
+
+// withInput is r with in as its input, as a caller puts it on the wire: the request's shape carries the input as JSON.
+func withInput(t *testing.T, r Request, in compose.Input) Request {
+	t.Helper()
+	raw, err := json.Marshal(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(raw, &r.Input); err != nil {
+		t.Fatal(err)
+	}
+	return r
+}
+
+// The seats a node's assigned modules claim are held there when the request says the holdings come from the claims.
+func TestHoldingsComeFromTheClaims(t *testing.T) {
+	m, err := catalogue.Decode([]byte(demo))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := HoldingsOf(map[string]catalogue.Manifest{"demo": m}, []compose.Node{{Name: "b", Assigned: []string{"demo"}}, {Name: "a", Assigned: []string{"demo"}}})
+	if len(got) != 2 || got[0].Node != "a" || got[0].Claim != "node-files" || got[0].Scope != "node" {
+		t.Fatalf("holdings = %+v", got)
+	}
+}
+
+// A request the command cannot run is refused, never answered as a verdict: a case named twice, an unknown depth.
+func TestARequestItCannotRunIsRefused(t *testing.T) {
+	if _, err := Run(Request{V: Version, Cases: []Case{{Name: "a"}, {Name: "a"}}}); err == nil {
+		t.Error("a case named twice runs")
+	}
+	if _, err := Run(Request{V: Version, Depth: "deep"}); err == nil {
+		t.Error("an unknown depth runs")
+	}
+	// A case's own placement (issue 1126) composes over a node the input holds, and is refused for one it does not.
+	placed := withInput(t, Request{V: Version, Machines: []string{"a"}, Depth: DepthResolve,
+		Cases: []Case{{Name: "trunk", Manifests: map[string]Manifest{"demo": {Raw: json.RawMessage(demo)}}},
+			{Name: "change", Manifests: map[string]Manifest{"demo": {Raw: json.RawMessage(demo)}},
+				Placements: map[string]*delivery.Placement{"a": {Node: "a", Modules: []delivery.PlacedModule{{Module: "ghost"}}}}}}},
+		compose.Input{Nodes: []compose.Node{{Name: "a"}}})
+	if v, err := Run(placed); err != nil || !v.Cases[0].Machines["a"].Composes || v.Cases[1].Machines["a"].Composes ||
+		!strings.Contains(v.Cases[1].Machines["a"].Reason, "ghost") {
+		t.Errorf("a case composes its own placement: %+v, %v", v, err)
+	}
+	placed.Cases[1].Placements = map[string]*delivery.Placement{"z": {Node: "z"}}
+	if _, err := Run(placed); err == nil || !strings.Contains(err.Error(), "holds no node for") {
+		t.Errorf("a case placing a node the input lacks: %v", err)
+	}
+	v, err := Run(Request{V: Version, Cases: []Case{{Name: "only-read", Manifests: map[string]Manifest{"demo": {Raw: json.RawMessage(demo)}}}}})
+	if err != nil || len(v.Cases) != 1 || !v.Cases[0].Manifests["demo"].Accepted || v.Cases[0].Machines != nil || v.SDK == "" {
+		t.Fatalf("a request with no machines: %+v, %v", v, err)
+	}
+}
+
+// The composer judges no manifest (novox/hq ADR 0578 §5): xterm's module.json from mesh-catalog at 835bf22b, whose
+// config value falls back to "font-size", is read whatever list of predefined keys a request carries (a group touching
+// xterm failed its composition on this, group check 18df81380db3); a module whose verdict in the input refuses it is
+// held, composed as its stub, and named in the verdict's words.
+func TestTheComposerTakesTheVerdictsOfItsInput(t *testing.T) {
+	raw, err := os.ReadFile("testdata/catalogue-835bf22b-xterm.module.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := Request{V: Version, Predefined: catalogue.PredefinedList{"something-else": {Type: "string", Description: "x"}},
+		Cases: []Case{{Name: "change", Manifests: map[string]Manifest{"xterm": {Raw: raw}}}}}
+	v, err := Run(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := v.Cases[0].Manifests["xterm"]; !got.Accepted {
+		t.Fatalf("xterm: %+v, want accepted", got)
+	}
+	r.Cases[0].Verdicts = map[string]delivery.ManifestVerdict{"xterm": {Module: "xterm", State: delivery.VerdictRefused,
+		Problems: []string{"falls back to a key not listed"}, Judge: "src2:j"}}
+	shelf, err := parse(r.Cases[0].Manifests, map[string]ManifestRead{}, r.Cases[0].Verdicts)
+	if err != nil || !shelf["xterm"].Stubbed {
+		t.Fatalf("the refused module is not held as its stub: %+v %v", shelf["xterm"], err)
+	}
+	if v, err = Run(r); err != nil {
+		t.Fatal(err)
+	}
+	if got := v.Cases[0].Manifests["xterm"]; got.Accepted ||
+		!strings.Contains(got.Refused, "the indexer's judge (src2:j) refused the manifest of xterm: falls back to a key not listed") {
+		t.Fatalf("xterm refused by its verdict: %+v, want refused in the verdict's words", got)
+	}
+}
diff --git a/internal/composer/testdata/catalogue-835bf22b-xterm.module.json b/internal/composer/testdata/catalogue-835bf22b-xterm.module.json
new file mode 100644
index 0000000..b65be8e
--- /dev/null
+++ b/internal/composer/testdata/catalogue-835bf22b-xterm.module.json
@@ -0,0 +1,236 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "config": {
+    "face": {
+      "type": "string",
+      "description": "The font family xterm draws with, as fc-list names it: JetBrainsMono Nerd Font, because research 026/04 chose it for its glyphs the prompt uses. A family the machine does not have falls back to the nearest installed face (xterm_font says which).",
+      "pattern": "[A-Za-z0-9 ._-]{1,64}",
+      "default": "JetBrainsMono Nerd Font"
+    },
+    "size": {
+      "type": "number",
+      "description": "The size of xterm's text, in points: 12 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+      "minimum": 6,
+      "maximum": 72,
+      "predefined": "font-size",
+      "default": 12
+    },
+    "save-lines": {
+      "type": "number",
+      "description": "How many lines of scrollback xterm keeps per terminal: 10000 holds a long build log, and each line costs memory in every open terminal.",
+      "minimum": 0,
+      "maximum": 1000000,
+      "default": 10000
+    },
+    "term-name": {
+      "type": "string",
+      "description": "The TERM value xterm sets for the programs it runs: xterm-256color, because the palette has 256 colours and every program knows the name.",
+      "pattern": "[A-Za-z0-9._-]{1,64}",
+      "default": "xterm-256color"
+    },
+    "render-font": {
+      "type": "boolean",
+      "description": "Whether xterm draws with fontconfig faces (true) or the old X core fonts (false): true, because the face is a fontconfig family and core fonts cannot show it.",
+      "default": true
+    },
+    "bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm draws bold text by overstriking the normal face (true): false, because the face has a real bold style and overstriking blurs it.",
+      "default": false
+    },
+    "always-bold-mode": {
+      "type": "boolean",
+      "description": "Whether xterm overstrikes bold even where the face has a bold style (true): false, for the same reason as bold-mode.",
+      "default": false
+    },
+    "allow-bold-fonts": {
+      "type": "boolean",
+      "description": "Whether xterm may use the face's bold style for bold text (true): true, so bold text is drawn with the real bold weight.",
+      "default": true
+    },
+    "background": {
+      "type": "string",
+      "description": "The terminal's background colour, as #rrggbb: black, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "foreground": {
+      "type": "string",
+      "description": "The terminal's text colour, as #rrggbb: a light grey, easier on the eyes than white on black.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a8a8a8"
+    },
+    "color0": {
+      "type": "string",
+      "description": "Palette entry 0, the normal black, as #rrggbb: #000000, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#000000"
+    },
+    "color1": {
+      "type": "string",
+      "description": "Palette entry 1, the normal red, as #rrggbb: #9e1828, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#9e1828"
+    },
+    "color2": {
+      "type": "string",
+      "description": "Palette entry 2, the normal green, as #rrggbb: #008800, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#008800"
+    },
+    "color3": {
+      "type": "string",
+      "description": "Palette entry 3, the normal yellow, as #rrggbb: #d2bb4b, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#d2bb4b"
+    },
+    "color4": {
+      "type": "string",
+      "description": "Palette entry 4, the normal blue, as #rrggbb: #414171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#414171"
+    },
+    "color5": {
+      "type": "string",
+      "description": "Palette entry 5, the normal magenta, as #rrggbb: #963c59, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#963c59"
+    },
+    "color6": {
+      "type": "string",
+      "description": "Palette entry 6, the normal cyan, as #rrggbb: #418179, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#418179"
+    },
+    "color7": {
+      "type": "string",
+      "description": "Palette entry 7, the normal white, as #rrggbb: #bebebe, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bebebe"
+    },
+    "color8": {
+      "type": "string",
+      "description": "Palette entry 8, the bright black, as #rrggbb: #666666, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#666666"
+    },
+    "color9": {
+      "type": "string",
+      "description": "Palette entry 9, the bright red, as #rrggbb: #bc5766, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#bc5766"
+    },
+    "color10": {
+      "type": "string",
+      "description": "Palette entry 10, the bright green, as #rrggbb: #61a171, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#61a171"
+    },
+    "color11": {
+      "type": "string",
+      "description": "Palette entry 11, the bright yellow, as #rrggbb: #e7db52, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#e7db52"
+    },
+    "color12": {
+      "type": "string",
+      "description": "Palette entry 12, the bright blue, as #rrggbb: #5085af, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#5085af"
+    },
+    "color13": {
+      "type": "string",
+      "description": "Palette entry 13, the bright magenta, as #rrggbb: #a97a99, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#a97a99"
+    },
+    "color14": {
+      "type": "string",
+      "description": "Palette entry 14, the bright cyan, as #rrggbb: #6ba4a4, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#6ba4a4"
+    },
+    "color15": {
+      "type": "string",
+      "description": "Palette entry 15, the bright white, as #rrggbb: #ffffff, as both workstations ran it.",
+      "pattern": "#[0-9a-fA-F]{6}",
+      "default": "#ffffff"
+    },
+    "copy-binding": {
+      "type": "string",
+      "description": "The key combination that copies the selection to the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> C, so a plain Ctrl+C still interrupts the program. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> C"
+    },
+    "paste-binding": {
+      "type": "string",
+      "description": "The key combination that pastes the clipboard, in X translation syntax: Ctrl Shift ~Alt <Key> V, the pair of copy-binding. It holds no colon, backslash or line break, which would end the resource.",
+      "pattern": "[^:\\\\\\n]+",
+      "default": "Ctrl Shift ~Alt <Key> V"
+    }
+  },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/internal/judge/aliases.go b/internal/judge/aliases.go
new file mode 100644
index 0000000..589de07
--- /dev/null
+++ b/internal/judge/aliases.go
@@ -0,0 +1,24 @@
+// Package judge is the node-engine's judgement of a move (novox/hq ADR 0377 §3, ADR 0547 §3): what moving a module from
+// the composition it runs to a new one does, and how a placement candidate's answer is fitted to the node's key. It
+// moved here from mesh-sdk's delivery package (novox/hq ADR 0593 §1, §7), since only the node-engine judges a move;
+// the shapes it judges (a composition, a judgement's words, a candidate's answer) stay in mesh-sdk.
+package judge
+
+import "git.novox.be/novox/mesh-sdk/go/delivery"
+
+// The shapes of mesh-sdk's delivery package this package judges, by the names its code was written with.
+type (
+	Composed        = delivery.Composed
+	Judgement       = delivery.Judgement
+	CandidateAnswer = delivery.CandidateAnswer
+	ModuleDiffers   = delivery.ModuleDiffers
+	ResourceBodies  = delivery.ResourceBodies
+)
+
+const (
+	JudgedRecreates = delivery.JudgedRecreates
+	JudgedMovesData = delivery.JudgedMovesData
+	JudgedNeither   = delivery.JudgedNeither
+	JudgedCannot    = delivery.JudgedCannot
+	JudgedUnchanged = delivery.JudgedUnchanged
+)
diff --git a/internal/judge/answer.go b/internal/judge/answer.go
new file mode 100644
index 0000000..d8502c3
--- /dev/null
+++ b/internal/judge/answer.go
@@ -0,0 +1,48 @@
+package judge
+
+import (
+	"encoding/json"
+	"strconv"
+	"strings"
+)
+
+// FitAnswer is a with its shown bodies cut until its JSON is within limit bytes (MaxAnswerBytes for the node's key):
+// first the bodies' texts, from the last differing module back, keeping their paths; then the paths too. What is cut
+// is said in the answer's note. The verdict and every list of modules are never cut.
+func FitAnswer(a CandidateAnswer, limit int) CandidateAnswer {
+	size := func() int {
+		raw, err := json.Marshal(a)
+		if err != nil {
+			return 0
+		}
+		return len(raw)
+	}
+	if size() <= limit {
+		return a
+	}
+	a.Differs = append([]ModuleDiffers(nil), a.Differs...)
+	for i := range a.Differs {
+		a.Differs[i].Bodies = append([]ResourceBodies(nil), a.Differs[i].Bodies...)
+	}
+	cutTexts, cutPaths := false, false
+	for i := len(a.Differs) - 1; i >= 0 && size() > limit; i-- {
+		for j := range a.Differs[i].Bodies {
+			a.Differs[i].Bodies[j].Composed, a.Differs[i].Bodies[j].Running = "", ""
+		}
+		cutTexts = true
+	}
+	for i := len(a.Differs) - 1; i >= 0 && size() > limit; i-- {
+		for j := range a.Differs[i].Bodies {
+			a.Differs[i].Bodies[j].Paths = nil
+		}
+		cutPaths = true
+	}
+	why := "the bodies shown were cut to keep the answer within " + strconv.Itoa(limit>>10) + " KiB"
+	if cutPaths {
+		why += ", their paths too"
+	}
+	if cutTexts {
+		a.Note = strings.TrimPrefix(a.Note+"; ", "; ") + why
+	}
+	return a
+}
diff --git a/internal/judge/answer_test.go b/internal/judge/answer_test.go
new file mode 100644
index 0000000..62535c6
--- /dev/null
+++ b/internal/judge/answer_test.go
@@ -0,0 +1,25 @@
+package judge
+
+import (
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// An answer too large for the node's key is fitted: the texts go first, the verdict and the paths stay, and the answer
+// given is not changed (moved from mesh-sdk's placement test with FitAnswer, novox/hq ADR 0593 §7).
+func TestFitAnswer(t *testing.T) {
+	long := strings.Repeat("x", delivery.MaxBody)
+	big := CandidateAnswer{Proposal: "p-x1", Revision: 1, Verdict: delivery.CandidateDiffers, Differs: []ModuleDiffers{{
+		Module: "nats", Why: "differs", Bodies: []ResourceBodies{{ID: "conf", Why: "changed",
+			Paths: []string{"content.links.1", "content.password"}, Composed: long, Running: long}}}}}
+	if same := FitAnswer(big, 1<<20); same.Note != "" || same.Differs[0].Bodies[0].Composed != long {
+		t.Errorf("an answer within the bound was cut: %+v", same.Note)
+	}
+	fitted := FitAnswer(big, 4<<10)
+	if len(fitted.Differs[0].Bodies[0].Composed) != 0 || len(fitted.Differs[0].Bodies[0].Paths) != 2 ||
+		fitted.Verdict != delivery.CandidateDiffers || !strings.Contains(fitted.Note, "cut") || big.Differs[0].Bodies[0].Composed == "" {
+		t.Errorf("fitted as %+v", fitted)
+	}
+}
diff --git a/internal/judge/judge.go b/internal/judge/judge.go
new file mode 100644
index 0000000..99ab051
--- /dev/null
+++ b/internal/judge/judge.go
@@ -0,0 +1,365 @@
+package judge
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"path"
+	"sort"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+)
+
+// The judgement of a move (ADR 0377 §3), as a pure function over two compositions of one module, so the node agent that
+// composes its own modules judges what it would apply (novox/hq ADR 0547 §3; issue 1126's S8). Moved from
+// mesh-controller cmd/mesh-controller/composed_judge.go at origin/main (the controller keeps its copy, unchanged, until
+// it loses the lease, ADR 0547 §1): judged, onlyTheUserList and sameResources, with their helpers, are its code.
+//
+// ADR 0377 §3 over two compositions of one module: **recreates** when a container resource is changed, added or
+// removed; **moves data** when, with no container changed, a directory or file resource is changed, added or removed
+// that a container of the module mounts or that holds or lies within one of its directories (where a module keeps its
+// data), when its `data` declaration changes, or, for a module that declares data, when one of its long-running
+// processes changes; **neither** otherwise, and for a module the node has never run.
+
+// Judged is one move's judgement: what it does, its words, and whether only the bus's user list changes (ADR 0539 §7:
+// a file change and a reload of the bus, no move of it, never asked).
+type Judged struct {
+	Judgement    Judgement
+	Words        string
+	UserListOnly bool
+}
+
+// JudgeMove judges moving a node's module from the composition it runs to the one composed for it. Running is nil when the
+// node runs no composition of the module. A composition equal to the one running (resource for resource, each
+// canonical) is unchanged: no move, and no ask (ADR 0547 §3).
+func JudgeMove(running *Composed, composed Composed) Judged {
+	if composed.Module == "" {
+		return Judged{Judgement: JudgedNeither, Words: "the node's own composition"}
+	}
+	if running == nil {
+		return Judged{Judgement: JudgedNeither, Words: "the node runs no composition of " + composed.Module}
+	}
+	if running.Data == composed.Data && SameComposedResources(*running, composed) {
+		return Judged{Judgement: JudgedUnchanged, Words: "equal to the composition the node runs"}
+	}
+	if onlyTheUserList(*running, composed) {
+		return Judged{Judgement: JudgedNeither, Words: "only the bus's user list changes", UserListOnly: true}
+	}
+	j, words := judged(*running, composed)
+	return Judged{Judgement: j, Words: words}
+}
+
+// busUsersSuffix ends the id of the bus module's user list as the composer writes it: `<module>.bus-users`.
+const busUsersSuffix = ".bus-users"
+
+// onlyTheUserList says two compositions of a module differ, and only in its file of the bus's user list.
+func onlyTheUserList(from, to Composed) bool {
+	if from.Data != to.Data {
+		return false
+	}
+	before, after := judgedResourcesByID(from), judgedResourcesByID(to)
+	if len(before) != len(after) {
+		return false
+	}
+	changed := false
+	for id, now := range after {
+		was, ok := before[id]
+		if !ok {
+			return false
+		}
+		if bytes.Equal(was.raw, now.raw) {
+			continue
+		}
+		if !strings.HasSuffix(id, busUsersSuffix) || now.kind != string(declaration.TypeFile) {
+			return false
+		}
+		changed = true
+	}
+	return changed
+}
+
+// judged applies ADR 0377 §3 to two compositions of one module.
+func judged(from, to Composed) (Judgement, string) {
+	before, after := judgedResourcesByID(from), judgedResourcesByID(to)
+	if ids := changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeContainer) }); len(ids) > 0 {
+		return JudgedRecreates, "it recreates " + strings.Join(ids, ", ")
+	}
+	places := dataPlaces(before, after)
+	held := func(kind string) bool {
+		return kind == string(declaration.TypeDirectory) || kind == string(declaration.TypeFile)
+	}
+	var moved []string
+	for _, id := range changedOf(before, after, held) {
+		r := before[id]
+		if r == nil {
+			r = after[id]
+		}
+		if withinPlaces(r.path, places) {
+			moved = append(moved, id)
+		}
+	}
+	if to.Data || from.Data {
+		moved = append(moved, changedOf(before, after, func(kind string) bool { return kind == string(declaration.TypeProcess) })...)
+	}
+	// A data flag that differs is no move of data by itself: data moves only when a data item does (issue 1126, 2026-10-29:
+	// a running composition read back from the kept declaration carries no flag, and mongodb's toolchain move asked a yes for
+	// moving its data). It is said loudly in the words, and never hides an item that moved.
+	if len(moved) > 0 {
+		sort.Strings(moved)
+		// A file the mesh makes for the module's provisions (what its consumers contribute, what it is bound to, the
+		// secret it is given) is said as the consumers that join or leave, not as its data moving (issue 774,
+		// 2026-10-31: postgres's yes said "where its data is kept" when nextcloud left its grants). Still a move: the
+		// yes it asks is what keeps a consumer's login while that consumer is held.
+		var kept, made []string
+		for _, id := range moved {
+			if who := consumersOf(id, before[id], after[id]); who != nil {
+				made = append(made, who...)
+			} else {
+				kept = append(kept, id)
+			}
+		}
+		var parts []string
+		if len(kept) > 0 {
+			parts = append(parts, "it changes where its data is kept: "+strings.Join(kept, ", "))
+		}
+		if len(made) > 0 {
+			parts = append(parts, "consumers join or leave: "+strings.Join(made, ", "))
+		}
+		words := strings.Join(parts, "; ")
+		if from.Data != to.Data {
+			words += fmt.Sprintf("; its data flag differs too (running %v, composed %v)", from.Data, to.Data)
+		}
+		return JudgedMovesData, words
+	}
+	if from.Data != to.Data {
+		return JudgedNeither, fmt.Sprintf("it recreates no container and moves no data; WARNING: its data flag differs "+
+			"(running %v, composed %v) while no data item does, so one side's flag is wrong", from.Data, to.Data)
+	}
+	return JudgedNeither, "it recreates no container and moves no data"
+}
+
+// ResourceChange is one resource that differs between two compositions of a module: its id, its kind, whether it is
+// added, removed or changed, and for a file the mesh makes for a provision (received-, bound-, secret-) the consumers
+// that join or leave, in words.
+type ResourceChange struct {
+	ID        string   `json:"id"`
+	Kind      string   `json:"kind"`
+	Change    string   `json:"change"`
+	Consumers []string `json:"consumers,omitempty"`
+}
+
+// ChangedResources is every resource added, removed or changed from running to composed, by id, each compared
+// canonical (issue 774: the engine's verb composition shows what a move waiting for a yes would change). Running nil
+// is every resource added.
+func ChangedResources(running *Composed, composed Composed) []ResourceChange {
+	var from Composed
+	if running != nil {
+		from = *running
+	}
+	before, after := judgedResourcesByID(from), judgedResourcesByID(composed)
+	var out []ResourceChange
+	for _, id := range changedOf(before, after, func(string) bool { return true }) {
+		was, now := before[id], after[id]
+		c := ResourceChange{ID: id, Change: "changed"}
+		switch {
+		case was == nil:
+			c.Change, c.Kind = "added", now.kind
+		case now == nil:
+			c.Change, c.Kind = "removed", was.kind
+		default:
+			c.Kind = now.kind
+		}
+		c.Consumers = consumersOf(id, was, now)
+		out = append(out, c)
+	}
+	return out
+}
+
+// consumersOf is, for a changed file the mesh makes for a provision (received-, bound- or secret-, catalogue.ReceivedID,
+// BoundID, SecretID), what changes of it in words: each consumer that joins or leaves a received file, by the given
+// list's from and node; else that what it is given for the provision changes. Nil for any other resource.
+func consumersOf(id string, before, after *judgedResource) []string {
+	_, local, _ := strings.Cut(id, ".")
+	r := after
+	if r == nil {
+		r = before
+	}
+	if r == nil || r.kind != string(declaration.TypeFile) {
+		return nil
+	}
+	if provision, ok := strings.CutPrefix(local, "received-"); ok {
+		was, now := givenIn(before), givenIn(after)
+		var out []string
+		for _, c := range sortedGiven(was) {
+			if !now[c] {
+				out = append(out, c+" leaves "+provision)
+			}
+		}
+		for _, c := range sortedGiven(now) {
+			if !was[c] {
+				out = append(out, c+" joins "+provision)
+			}
+		}
+		if len(out) == 0 {
+			out = append(out, "what "+provision+"'s consumers are given changes")
+		}
+		return out
+	}
+	for _, prefix := range []string{"bound-", "secret-"} {
+		if provision, ok := strings.CutPrefix(local, prefix); ok {
+			return []string{"what it is given for " + provision + " changes"}
+		}
+	}
+	return nil
+}
+
+// givenIn is the consumers a received file's content names, each as "<from> on <node>".
+func givenIn(r *judgedResource) map[string]bool {
+	out := map[string]bool{}
+	if r == nil {
+		return out
+	}
+	var file struct {
+		Content string `json:"content"`
+	}
+	var received struct {
+		Given []struct {
+			From string `json:"from"`
+			Node string `json:"node"`
+		} `json:"given"`
+	}
+	if json.Unmarshal(r.raw, &file) != nil || json.Unmarshal([]byte(file.Content), &received) != nil {
+		return out
+	}
+	for _, g := range received.Given {
+		out[g.From+" on "+g.Node] = true
+	}
+	return out
+}
+
+func sortedGiven(m map[string]bool) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// judgedResource is a resource as the judgement reads it: its kind, the path it acts on, what its containers mount,
+// and its canonical bytes.
+type judgedResource struct {
+	kind   string
+	path   string
+	mounts []string
+	raw    []byte
+}
+
+func judgedResourcesByID(c Composed) map[string]*judgedResource {
+	out := map[string]*judgedResource{}
+	for _, raw := range c.Resources {
+		var head struct {
+			ID   string `json:"id"`
+			Type string `json:"type"`
+			Path string `json:"path"`
+			// A container's volumes, `<path on the machine>:<path inside>[:<options>]`.
+			Volumes []string `json:"volumes"`
+		}
+		if err := json.Unmarshal(raw, &head); err != nil {
+			continue
+		}
+		r := &judgedResource{kind: head.Type, path: head.Path, raw: compactResource(raw)}
+		for _, v := range head.Volumes {
+			source, _, _ := strings.Cut(v, ":")
+			r.mounts = append(r.mounts, source)
+		}
+		out[head.ID] = r
+	}
+	return out
+}
+
+// compactResource is a resource's bytes canonical: its keys sorted, its spacing dropped, its numbers as written, so two
+// compositions that say the same compare equal however each was written.
+func compactResource(raw []byte) []byte {
+	var v any
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.UseNumber()
+	if err := d.Decode(&v); err != nil {
+		return raw
+	}
+	out, err := json.Marshal(v)
+	if err != nil {
+		return raw
+	}
+	return out
+}
+
+// changedOf are the ids of the resources of the kinds counted that are changed, added or removed, sorted.
+func changedOf(before, after map[string]*judgedResource, counted func(kind string) bool) []string {
+	var out []string
+	for id, now := range after {
+		if !counted(now.kind) {
+			continue
+		}
+		if was, ok := before[id]; !ok || !bytes.Equal(was.raw, now.raw) {
+			out = append(out, id)
+		}
+	}
+	for id, was := range before {
+		if _, ok := after[id]; !ok && counted(was.kind) {
+			out = append(out, id)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// dataPlaces are the paths where the module keeps what a move must not lose: what its containers mount, and its
+// directories, before and after.
+func dataPlaces(before, after map[string]*judgedResource) []string {
+	var out []string
+	for _, rs := range []map[string]*judgedResource{before, after} {
+		for _, r := range rs {
+			if r.kind == string(declaration.TypeContainer) {
+				out = append(out, r.mounts...)
+			}
+			if r.kind == string(declaration.TypeDirectory) && r.path != "" {
+				out = append(out, r.path)
+			}
+		}
+	}
+	return out
+}
+
+// withinPlaces says p is one of places, or lies within one, or holds one.
+func withinPlaces(p string, places []string) bool {
+	if p == "" {
+		return false
+	}
+	p = path.Clean(p)
+	for _, place := range places {
+		if place == "" || !strings.HasPrefix(place, "/") {
+			continue
+		}
+		place = path.Clean(place)
+		if p == place || strings.HasPrefix(p, place+"/") || strings.HasPrefix(place, p+"/") {
+			return true
+		}
+	}
+	return false
+}
+
+// SameComposedResources says two compositions of a module hold the same resources in the same order, each compared
+// canonical.
+func SameComposedResources(a, b Composed) bool {
+	if len(a.Resources) != len(b.Resources) {
+		return false
+	}
+	for i := range a.Resources {
+		if !bytes.Equal(compactResource(a.Resources[i]), compactResource(b.Resources[i])) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/judge/judge_test.go b/internal/judge/judge_test.go
new file mode 100644
index 0000000..2a5b7e3
--- /dev/null
+++ b/internal/judge/judge_test.go
@@ -0,0 +1,96 @@
+package judge
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+func composedOf(module string, c byte, data bool, resources ...string) Composed {
+	out := Composed{Node: "ace", Module: module, FP: delivery.SourcePrefix2 + strings.Repeat(string(c), 64), Data: data}
+	for _, r := range resources {
+		out.Resources = append(out.Resources, json.RawMessage(r))
+	}
+	return out
+}
+
+// The pairs mesh-controller's composed_judge_test.go captured (issue 1945 AC12), and the bus's user list, judged as the
+// controller judges them (ADR 0377 §3, ADR 0539 §7), by the node agent's function (ADR 0547 §3, issue 1126 S8).
+func TestJudgeMove(t *testing.T) {
+	const (
+		container  = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:1111111111111111111111111111111111111111111111111111111111111111","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
+		container2 = `{"id":"mesh-mail.server","type":"container","module":"mesh-mail","name":"mail","image":"mail@sha256:2222222222222222222222222222222222222222222222222222222222222222","volumes":["/var/lib/mesh-mail/spool:/spool"]}`
+		spool      = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/var/lib/mesh-mail/spool"}`
+		spoolMoved = `{"id":"mesh-mail.spool","type":"directory","module":"mesh-mail","path":"/srv/mesh-mail/spool"}`
+		tools      = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"a"}`
+		tools2     = `{"id":"mesh-mail.tools","type":"file","module":"mesh-mail","path":"/usr/lib/mesh-mail/tools.json","content":"b"}`
+		config     = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"a"}`
+		config2    = `{"id":"mesh-mail.conf","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/conf","content":"b"}`
+		process    = `{"id":"mesh-mail.daemon","type":"process","module":"mesh-mail","exec":"/usr/bin/a"}`
+		process2   = `{"id":"mesh-mail.daemon","type":"process","module":"mesh-mail","exec":"/usr/bin/b"}`
+		received   = `{"id":"mesh-mail.received-smtp","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/received.json","content":"{\"given\":[{\"from\":\"cloud\",\"node\":\"novox\"},{\"from\":\"photos\",\"node\":\"novox\"}]}"}`
+		received2  = `{"id":"mesh-mail.received-smtp","type":"file","module":"mesh-mail","path":"/var/lib/mesh-mail/spool/received.json","content":"{\"given\":[{\"from\":\"photos\",\"node\":\"novox\"},{\"from\":\"wiki\",\"node\":\"ace\"}]}"}`
+		users      = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users","content":"a"}`
+		users2     = `{"id":"nats.bus-users","type":"file","module":"nats","path":"/etc/nats/users","content":"b"}`
+		natsConf   = `{"id":"nats.conf","type":"file","module":"nats","path":"/etc/nats/conf","content":"a"}`
+		natsConf2  = `{"id":"nats.conf","type":"file","module":"nats","path":"/etc/nats/conf","content":"b"}`
+	)
+	mail := func(c byte, data bool, rs ...string) *Composed {
+		m := composedOf("mesh-mail", c, data, rs...)
+		return &m
+	}
+	bus := func(rs ...string) *Composed { m := composedOf("nats", 'b', false, rs...); return &m }
+	for _, c := range []struct {
+		name     string
+		from, to *Composed
+		want     Judgement
+		userList bool
+		words    string // what the words must say, when given
+	}{
+		{"a new image", mail('a', true, container, spool, tools), mail('b', true, container2, spool, tools), JudgedRecreates, false, ""},
+		{"a container gone", mail('a', true, container, spool), mail('b', true, spool), JudgedRecreates, false, ""},
+		{"its spool moved", mail('a', true, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false, ""},
+		{"a file in its spool", mail('a', true, container, spool, config), mail('b', true, container, spool, config2), JudgedMovesData, false, "it changes where its data is kept: mesh-mail.conf"},
+		// A received file the mesh makes, in its data's place, names its consumers joining or leaving, not its data moving
+		// (issue 774, 2026-10-31: postgres asked a yes for "where its data is kept" when nextcloud left its grants).
+		{"a consumer leaves", mail('a', true, container, spool, received), mail('b', true, container, spool, received2), JudgedMovesData, false,
+			"consumers join or leave: cloud on novox leaves smtp, wiki on ace joins smtp"},
+		{"a consumer leaves and a file moves", mail('a', true, container, spool, received, config), mail('b', true, container, spool, received2, config2), JudgedMovesData, false,
+			"it changes where its data is kept: mesh-mail.conf; consumers join or leave: cloud on novox leaves smtp, wiki on ace joins smtp"},
+		{"its data flag alone", mail('a', false, container, spool), mail('b', true, container, spool), JudgedNeither, false, ""},
+		{"its data flag and its spool", mail('a', false, container, spool), mail('b', true, container, spoolMoved), JudgedMovesData, false, ""},
+		{"a process of a module with data", mail('a', true, spool, process), mail('b', true, spool, process2), JudgedMovesData, false, ""},
+		{"a process of a module without", mail('a', false, process), mail('b', false, process2), JudgedNeither, false, ""},
+		{"its tools only", mail('a', true, container, spool, tools), mail('b', true, container, spool, tools2), JudgedNeither, false, ""},
+		{"never ran", nil, mail('b', true, container), JudgedNeither, false, ""},
+		{"equal, written otherwise", mail('a', true, `{"type":"directory","id":"mesh-mail.spool","module":"mesh-mail","path":"/var/lib/mesh-mail/spool"}`), mail('b', true, spool), JudgedUnchanged, false, ""},
+		{"only the user list", bus(natsConf, users), bus(natsConf, users2), JudgedNeither, true, ""},
+		{"the user list and more", bus(natsConf, users), bus(natsConf2, users2), JudgedNeither, false, ""},
+	} {
+		got := JudgeMove(c.from, *c.to)
+		if got.Judgement != c.want || got.UserListOnly != c.userList || got.Words == "" {
+			t.Errorf("%s: %+v, want %s (user list only %v)", c.name, got, c.want, c.userList)
+		}
+		if c.words != "" && got.Words != c.words {
+			t.Errorf("%s: says %q, want %q", c.name, got.Words, c.words)
+		}
+		if strings.Contains(c.name, "data flag alone") && !strings.Contains(got.Words, "WARNING: its data flag differs") {
+			t.Errorf("%s: the flag's difference is not said: %q", c.name, got.Words)
+		}
+	}
+	// The resources that differ, as the engine's verb composition lists them (issue 774): a provider's received file
+	// names its consumers, a file changed and one added are said as such, and nothing equal is listed.
+	changes := ChangedResources(mail('a', true, container, spool, received, config), *mail('b', true, container, spool, received2, config2, tools))
+	if want := `[{mesh-mail.conf file changed []} {mesh-mail.received-smtp file changed [cloud on novox leaves smtp wiki on ace joins smtp]} {mesh-mail.tools file added []}]`; fmt.Sprint(changes) != want {
+		t.Errorf("changed resources: %v, want %s", changes, want)
+	}
+	if got := ChangedResources(nil, *mail('b', true, spool)); len(got) != 1 || got[0].Change != "added" {
+		t.Errorf("never ran: %v, want its one resource added", got)
+	}
+	if got := JudgeMove(nil, Composed{Node: "ace"}); got.Judgement != JudgedNeither {
+		t.Errorf("the node's own composition: %+v", got)
+	}
+}
diff --git a/internal/link/composedstate.go b/internal/link/composedstate.go
new file mode 100644
index 0000000..b069208
--- /dev/null
+++ b/internal/link/composedstate.go
@@ -0,0 +1,103 @@
+package link
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/nats-io/nats.go"
+
+	"github.com/novox/mesh-host/internal/selfcompose"
+)
+
+// ---- this node's composition state, in the bus's own storage (novox/hq ADR 0593 §6) --------------------------------
+
+// composedStore binds the node's composition state `composed-<node>` over the link open now: bound, never created (the
+// grants part creates it, create-only, history delivery.ComposedHistory).
+func composedStore(js nats.JetStreamContext, node string) (nats.KeyValue, error) {
+	bucket, err := delivery.ComposedBucketFor(node)
+	if err != nil {
+		return nil, err
+	}
+	kv, err := js.KeyValue(bucket)
+	if err != nil {
+		return nil, fmt.Errorf("this node's composition state %s cannot be bound (the grants part creates it; written "+
+			"again at the next pass that composes): %w", bucket, err)
+	}
+	return kv, nil
+}
+
+func (l *natsLink) composedStore(node string) (nats.KeyValue, error) {
+	return composedStore(l.js, node)
+}
+
+func (b OverNATS) composedStore(node string) (nats.KeyValue, error) { return composedStore(b.JS, node) }
+
+// EngineComposed is this node's composition state over whichever link the session has open (selfcompose.ComposedStore);
+// with none open every read and write is refused, and nothing is kept anywhere else.
+type EngineComposed struct {
+	Session *Session
+	Node    string
+}
+
+var _ selfcompose.ComposedStore = EngineComposed{}
+
+func (e EngineComposed) kv() (nats.KeyValue, error) {
+	e.Session.init()
+	e.Session.mu.Lock()
+	bus := e.Session.bus
+	e.Session.mu.Unlock()
+	l, ok := bus.(interface {
+		composedStore(node string) (nats.KeyValue, error)
+	})
+	if bus == nil || !ok {
+		return nil, ErrNoLink
+	}
+	return l.composedStore(e.Node)
+}
+
+// Entries is every key the state holds with its latest value and revision.
+func (e EngineComposed) Entries(ctx context.Context) (map[string]selfcompose.ComposedEntry, error) {
+	kv, err := e.kv()
+	if err != nil {
+		return nil, err
+	}
+	keys, err := kv.Keys(nats.Context(ctx))
+	if errors.Is(err, nats.ErrNoKeysFound) {
+		return map[string]selfcompose.ComposedEntry{}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	out := make(map[string]selfcompose.ComposedEntry, len(keys))
+	for _, key := range keys {
+		got, err := kv.Get(key)
+		if errors.Is(err, nats.ErrKeyNotFound) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		out[key] = selfcompose.ComposedEntry{Value: got.Value(), Revision: got.Revision()}
+	}
+	return out, nil
+}
+
+// Put writes a key and answers its revision.
+func (e EngineComposed) Put(_ context.Context, key string, value []byte) (uint64, error) {
+	kv, err := e.kv()
+	if err != nil {
+		return 0, err
+	}
+	return kv.Put(key, value)
+}
+
+// Delete deletes a key (a delete marker, kept with the key's history).
+func (e EngineComposed) Delete(_ context.Context, key string) error {
+	kv, err := e.kv()
+	if err != nil {
+		return err
+	}
+	return kv.Delete(key)
+}
diff --git a/internal/link/handacts.go b/internal/link/handacts.go
index 2a0f538..3412de9 100644
--- a/internal/link/handacts.go
+++ b/internal/link/handacts.go
@@ -45,6 +45,8 @@ const (
 	// ActPackages reads the packages this node's compositions declare, and with write writes its key again (novox/hq
 	// ADR 0565 §6, §15).
 	ActPackages = "packages"
+	// ActComposeCandidate composes a check's candidate on this node in shadow, read-only (novox/hq ADR 0593 §7).
+	ActComposeCandidate = "compose-candidate"
 )
 
 // The states of an act.
@@ -143,6 +145,10 @@ type HandActs struct {
 	// Packages answers the node's key of the engine's state packages beside the controller's mirror's key and their
 	// difference, and with write writes the key again from what the engine composed (the verb packages, ADR 0565 §6, §15).
 	Packages func(write bool) (any, error)
+	// ComposeCandidate composes a check's candidate (the indexer's candidate key) on this node in shadow and answers per
+	// module, applying and writing nothing; with input, also the composition input it composed from (the verb
+	// compose-candidate, ADR 0593 §7).
+	ComposeCandidate func(candidate string, input bool) (any, error)
 	// Say says one of the seat's events, asked, done or refused; nil says nothing.
 	Say func(event string, body any)
 	Now func() time.Time
@@ -215,6 +221,15 @@ func (h *HandActs) Call(c EngineCall) (any, error) {
 			write = b
 		}
 		return h.Packages(write)
+	case ActComposeCandidate:
+		if h.ComposeCandidate == nil {
+			return nil, errors.New("this engine composes no candidate yet: its node agent has not started")
+		}
+		input := arg("input") == "true"
+		if b, ok := c.Args["input"].(bool); ok {
+			input = b
+		}
+		return h.ComposeCandidate(arg("candidate"), input)
 	case "acts":
 		if id := arg("id"); id != "" {
 			return h.Act(id)
diff --git a/internal/nodegrant/nodegrant.go b/internal/nodegrant/nodegrant.go
new file mode 100644
index 0000000..5553804
--- /dev/null
+++ b/internal/nodegrant/nodegrant.go
@@ -0,0 +1,49 @@
+// Package nodegrant is the grant the grants part composes for a node's engine (its principal of kind node), as a golden
+// file the node-engine's tests run under (novox/hq ADR 0593 §1): the composer of the bus's user list is the grants
+// part's own, so this repository holds what it composes for a node rather than calling it. testdata/node.json is that
+// grant for the node NODE, captured from mesh-sdk's buscompose.PermissionsFor at 3d87ddc, with what this release adds
+// to it (ADR 0593 §6, §7): the node's writes of its own composition state, and its reads of the indexer's candidates
+// and of its verdicts on their manifests.
+// When the grants part changes a node's grant, this file changes with it in the same group.
+package nodegrant
+
+import (
+	_ "embed"
+	"encoding/json"
+	"strings"
+)
+
+//go:embed testdata/node.json
+var golden []byte
+
+// Permissions is a node's grant: the subjects it may publish to, those refused though an allow covers them, those it
+// may subscribe to, and whether it may answer a request once on its reply subject.
+type Permissions struct {
+	Publish        []string
+	PublishDeny    []string
+	Subscribe      []string
+	AllowResponses bool
+}
+
+// For is the grant of node, with the served keys (`<node>.<module>.<key>` of mesh-config's resolved values) it may
+// read of another node: each one read by its watch and by a direct get, as the grants part grants a served read.
+func For(node string, servedReads ...string) Permissions {
+	var p Permissions
+	if err := json.Unmarshal(golden, &p); err != nil {
+		panic("nodegrant: the golden grant is not JSON: " + err.Error())
+	}
+	swap := func(in []string) []string {
+		out := make([]string, len(in))
+		for i, s := range in {
+			out[i] = strings.ReplaceAll(s, "NODE", node)
+		}
+		return out
+	}
+	p.Publish, p.PublishDeny, p.Subscribe = swap(p.Publish), swap(p.PublishDeny), swap(p.Subscribe)
+	for _, key := range servedReads {
+		p.Publish = append(p.Publish,
+			"$JS.API.CONSUMER.CREATE.KV_mesh-config_resolved.*.$KV.mesh-config_resolved."+key,
+			"$JS.API.DIRECT.GET.KV_mesh-config_resolved.$KV.mesh-config_resolved."+key)
+	}
+	return p
+}
diff --git a/internal/nodegrant/testdata/node.json b/internal/nodegrant/testdata/node.json
new file mode 100644
index 0000000..16ce048
--- /dev/null
+++ b/internal/nodegrant/testdata/node.json
@@ -0,0 +1,137 @@
+{
+  "Publish": [
+    "$JS.ACK.NODES.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_composed-NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-config_resolved.*.$KV.mesh-config_resolved.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_candidates.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_placement.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-assigner_wants.*.$KV.mesh-delivery-assigner_wants.want.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-builder_builds.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_candidates.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_manifests.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_modules.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-delivery-indexer_verdicts.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-host_acts.*.$KV.mesh-host_acts.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-host_data.*.$KV.mesh-host_data.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-host_health.*.$KV.mesh-host_health.NODE",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-host_packages.*.$KV.mesh-host_packages.NODE",
+    "$JS.API.CONSUMER.CREATE.KV_mesh-provisioner_provisions.*.$KV.mesh-provisioner_provisions.NODE.>",
+    "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.*.node",
+    "$JS.API.CONSUMER.CREATE.KV_node-engine_have.*.$KV.node-engine_have.NODE.>",
+    "$JS.API.CONSUMER.CREATE.OBJ_declaration-files-NODE.*.$O.declaration-files-NODE.C.*",
+    "$JS.API.CONSUMER.DELETE.KV_composed-NODE.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-config_resolved.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_candidates.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_placement.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-assigner_wants.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-builder_builds.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_candidates.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_manifests.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_modules.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-delivery-indexer_verdicts.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-host_acts.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-host_data.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-host_health.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-host_packages.>",
+    "$JS.API.CONSUMER.DELETE.KV_mesh-provisioner_provisions.>",
+    "$JS.API.CONSUMER.DELETE.KV_node-engine_have.>",
+    "$JS.API.CONSUMER.DELETE.OBJ_declaration-files-NODE.*",
+    "$JS.API.CONSUMER.INFO.NODES.NODE",
+    "$JS.API.DIRECT.GET.KV_composed-NODE.>",
+    "$JS.API.DIRECT.GET.KV_mesh-config_resolved.$KV.mesh-config_resolved.NODE.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_candidates.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_placement.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-assigner_wants.$KV.mesh-delivery-assigner_wants.want.NODE.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-builder_builds.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_candidates.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_manifests.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_modules.>",
+    "$JS.API.DIRECT.GET.KV_mesh-delivery-indexer_verdicts.>",
+    "$JS.API.DIRECT.GET.KV_mesh-host_acts.$KV.mesh-host_acts.NODE.>",
+    "$JS.API.DIRECT.GET.KV_mesh-host_data.$KV.mesh-host_data.NODE.>",
+    "$JS.API.DIRECT.GET.KV_mesh-host_health.$KV.mesh-host_health.NODE",
+    "$JS.API.DIRECT.GET.KV_mesh-host_packages.$KV.mesh-host_packages.NODE",
+    "$JS.API.DIRECT.GET.KV_mesh-provisioner_provisions.$KV.mesh-provisioner_provisions.NODE.>",
+    "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.*.node",
+    "$JS.API.DIRECT.GET.KV_node-engine_have.$KV.node-engine_have.NODE.>",
+    "$JS.API.DIRECT.GET.OBJ_declaration-files-NODE.$O.declaration-files-NODE.M.*",
+    "$JS.API.STREAM.INFO.KV_composed-NODE",
+    "$JS.API.STREAM.INFO.KV_mesh-config_resolved",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_candidates",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_placement",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-assigner_wants",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_builds",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_candidates",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_manifests",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_modules",
+    "$JS.API.STREAM.INFO.KV_mesh-delivery-indexer_verdicts",
+    "$JS.API.STREAM.INFO.KV_mesh-host_acts",
+    "$JS.API.STREAM.INFO.KV_mesh-host_data",
+    "$JS.API.STREAM.INFO.KV_mesh-host_health",
+    "$JS.API.STREAM.INFO.KV_mesh-host_packages",
+    "$JS.API.STREAM.INFO.KV_mesh-provisioner_provisions",
+    "$JS.API.STREAM.INFO.KV_node-engine_have",
+    "$JS.FC.KV_composed-NODE.>",
+    "$JS.FC.KV_mesh-config_resolved.>",
+    "$JS.FC.KV_mesh-delivery-assigner_candidates.>",
+    "$JS.FC.KV_mesh-delivery-assigner_placement.>",
+    "$JS.FC.KV_mesh-delivery-assigner_wants.>",
+    "$JS.FC.KV_mesh-delivery-builder_builds.>",
+    "$JS.FC.KV_mesh-delivery-indexer_candidates.>",
+    "$JS.FC.KV_mesh-delivery-indexer_manifests.>",
+    "$JS.FC.KV_mesh-delivery-indexer_modules.>",
+    "$JS.FC.KV_mesh-delivery-indexer_verdicts.>",
+    "$JS.FC.KV_mesh-host_acts.>",
+    "$JS.FC.KV_mesh-host_data.>",
+    "$JS.FC.KV_mesh-host_health.>",
+    "$JS.FC.KV_mesh-host_packages.>",
+    "$JS.FC.KV_mesh-provisioner_provisions.>",
+    "$JS.FC.KV_node-engine_have.>",
+    "$JS.FC.OBJ_declaration-files-NODE.>",
+    "$KV.composed-NODE.>",
+    "$KV.mesh-host_acts.NODE.>",
+    "$KV.mesh-host_data.NODE.>",
+    "$KV.mesh-host_health.NODE",
+    "$KV.mesh-host_packages.NODE",
+    "$KV.node-engine_have.NODE.>",
+    "$SRV.INFO",
+    "$SRV.INFO.>",
+    "$SRV.PING",
+    "$SRV.PING.>",
+    "$SRV.PING.node-tools.NODE",
+    "mesh.control.NODE.>",
+    "mesh.seat.node-backup.call.backed-up.NODE.node~NODE",
+    "mesh.seat.node-backup.call.now.NODE.node~NODE",
+    "mesh.seat.node-backup.tool.backed-up.NODE",
+    "mesh.seat.node-backup.tool.now.NODE",
+    "mesh.seat.node-engine.event.*.NODE"
+  ],
+  "PublishDeny": null,
+  "Subscribe": [
+    "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_candidates",
+    "$JS.EVENT.ADVISORY.STREAM.CREATED.KV_mesh-delivery-assigner_placement",
+    "$SRV.INFO",
+    "$SRV.INFO.node-engine",
+    "$SRV.INFO.node-engine.>",
+    "$SRV.PING",
+    "$SRV.PING.node-engine",
+    "$SRV.PING.node-engine.>",
+    "$SRV.STATS",
+    "$SRV.STATS.node-engine",
+    "$SRV.STATS.node-engine.>",
+    "_DELIVER.NODE",
+    "_DELIVER.NODE.>",
+    "_INBOX.node.NODE.>",
+    "mesh.mod.restic.event.backed-up",
+    "mesh.node.NODE.ask.access-act",
+    "mesh.node.NODE.ask.hand-over",
+    "mesh.node.NODE.ask.judge-directories",
+    "mesh.node.NODE.ask.move-secret",
+    "mesh.node.NODE.ask.report",
+    "mesh.node.NODE.ask.setuid-search",
+    "mesh.node.NODE.declare",
+    "mesh.seat.node-engine.call.*.NODE.*",
+    "mesh.seat.node-engine.tool.*.NODE"
+  ],
+  "AllowResponses": true
+}
\ No newline at end of file
diff --git a/internal/overlay/declaration.go b/internal/overlay/declaration.go
new file mode 100644
index 0000000..b248bdd
--- /dev/null
+++ b/internal/overlay/declaration.go
@@ -0,0 +1,187 @@
+package overlay
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// The overlay is delivered as an ordinary declaration.
+//
+// novox/hq 08-connectivity: what the host receives is an interface configuration and a peer list,
+// as files. It does not compute them and it does not know what a private network is — the shapes
+// it already has are enough, which is why connectivity needs nothing new from tier 0.
+//
+// **No private key travels.** The configuration points at a file the node wrote from a key the
+// mesh has never seen, using WireGuard's own ability to set one after the interface is up. So the
+// control plane composes a complete configuration for a node it cannot impersonate.
+
+// Resource is one entry in a declaration, built here and read by the host.
+type Resource map[string]any
+
+// Declaration is what the mesh sends a node to put it on the network.
+//
+// Three resources and nothing clever: the tools, the configuration, and the interface running. A
+// person can read it, which is the point — this is the first thing a node is ever told, and if it
+// is wrong the node is unreachable and the mistake has to be findable by eye.
+func Declaration(node Node, peers []Peer, keyPath string) ([]byte, error) {
+	if node.Address == "" {
+		return nil, fmt.Errorf("%s has no address on the overlay, so there is nothing to configure",
+			node.Name)
+	}
+	if keyPath == "" {
+		keyPath = DefaultKeyPath
+	}
+
+	up := Resource{
+		"id": "overlay-up", "type": "service", "unit": Unit,
+		"state": "running",
+		// Enabled, so the node comes back onto the network after a reboot without waiting to
+		// be told again. A node whose overlay only exists while something is watching is not
+		// a node that survives being switched off and on.
+		"boot": "enabled",
+		// And restarted when the peer list changes, because a running interface does not
+		// re-read its configuration.
+		//
+		// This is the whole of it: a node joins, every existing node's peer list changes,
+		// each file is replaced — and without this the service is already running, nothing
+		// reloads it, and every node keeps a network that no longer matches the mesh. It
+		// reports complete success. The lab found it the moment a third node arrived.
+		//
+		// Declared state rather than a command. The service must reflect the file; the host
+		// works out that it does not. A command to restart would be an action, and the link
+		// may not carry one (novox/hq ADR 0005) — the host refused exactly that, correctly,
+		// which is how this shape was arrived at.
+		"restart-on": []string{"overlay-config"},
+	}
+	if node.TakesOver != nil {
+		// The private network takes over the tunnel it found (novox/hq ADR 0105): before this
+		// unit starts, the host stops and disables the found one — never flushing it — and keeps
+		// its configuration like any held file. The key is already the found one: the node took
+		// it as its own overlay key when it enrolled, which is why the mesh's peer list for it
+		// carries the found peers under the key they know.
+		up["takes-over"] = map[string]any{
+			"interface": node.TakesOver.Interface,
+			"unit":      node.TakesOver.Unit,
+			"config":    node.TakesOver.Config,
+		}
+	}
+
+	resources := []Resource{
+		{
+			"id": "overlay-tools", "type": "package", "package": "wireguard-tools",
+		},
+		{
+			"id": "overlay-config", "type": "file", "path": ConfigPath,
+			// Readable only by root: it lists every peer's key and endpoint, which is a map of
+			// the mesh. Not secret in the way a private key is, and not something to leave
+			// world-readable on a machine somebody else also uses.
+			"mode":    "0600",
+			"content": config(node, peers, keyPath),
+		},
+		up,
+	}
+
+	// The names used to be appended here, on the argument that a node with peers and no names is
+	// half on the network. True, and the wrong place to fix it: names would be identical over a
+	// different private network, so bundling them with WireGuard made one module out of two
+	// things. They are their own module now, requiring this one — which is what keeps them
+	// arriving together without pretending they are the same concern.
+	return json.Marshal(map[string]any{"declaration": 1, "resources": resources})
+}
+
+// config writes the interface file.
+//
+// Deliberately in the order a person would read it: who I am, then who I talk to, each with a
+// line saying why it is there. A generated file that cannot be understood by the person it
+// confuses is a generated file that gets edited by hand.
+func config(node Node, peers []Peer, keyPath string) string {
+	var b strings.Builder
+	b.WriteString("# Generated by the mesh. Do not edit — this file is replaced whenever the\n")
+	b.WriteString("# peer graph changes, and an edit would survive until the next change and\n")
+	b.WriteString("# then vanish, which is worse than not being applied at all.\n")
+	fmt.Fprintf(&b, "#\n# node %s", node.Name)
+	if node.Site != "" {
+		fmt.Fprintf(&b, ", at %s", node.Site)
+	}
+	if !node.Reachable() {
+		b.WriteString(", not dialable — it opens every path itself")
+	}
+	b.WriteString("\n\n[Interface]\n")
+	fmt.Fprintf(&b, "Address = %s/32\n", node.Address)
+	if node.Reachable() {
+		if port := portOf(node.Endpoint); port != "" {
+			fmt.Fprintf(&b, "ListenPort = %s\n", port)
+		}
+	} else if node.TakesOver != nil && node.TakesOver.Port != 0 {
+		// Not dialable from the hub, but a LAN peer dials this node on the tunnel it took over,
+		// so the mesh's interface must listen on that same port (novox/hq: a taken tunnel brings
+		// its port). Without this the takeover guard refuses overlay-up, and re-placing the node
+		// with an endpoint — the guard's suggested remedy — breaks a NAT'd node's path.
+		fmt.Fprintf(&b, "ListenPort = %d\n", node.TakesOver.Port)
+	}
+	// The MTU the found tunnel carried, when it set one: a path tuned to 1380 (say) stalls TLS
+	// and hangs transfers if the mesh's interface comes up at the 1420 default, and no ping shows
+	// it (novox/hq: a taken tunnel carries its MTU).
+	if node.TakesOver != nil && node.TakesOver.MTU != 0 {
+		fmt.Fprintf(&b, "MTU = %d\n", node.TakesOver.MTU)
+	}
+	// The private key is set from a file the node wrote, so it never appears here and never
+	// travelled. Everything else in this file came from the mesh; this one line is the node's.
+	fmt.Fprintf(&b, "PostUp = wg set %%i private-key %s\n", keyPath)
+
+	if node.Hub {
+		// A hub carries traffic *between* its spokes, and a Linux machine does not forward
+		// packets unless it is told to. Without this every spoke reaches the hub perfectly and
+		// no spoke reaches any other — which is exactly how it failed in the lab, and it looks
+		// like a peering problem rather than a kernel setting.
+		//
+		// Here rather than in a separate resource because it is part of what being a hub means,
+		// and because it should last exactly as long as the interface does: a machine that stops
+		// being the hub should stop forwarding, and PostDown below is how that happens.
+		b.WriteString("PostUp = sysctl -q -w net.ipv4.ip_forward=1\n")
+		b.WriteString("PostDown = sysctl -q -w net.ipv4.ip_forward=0\n")
+
+		// And past the machine's own firewall, which on any node with a container runtime is
+		// closed. Docker sets the FORWARD policy to DROP and inserts its chains, so the foundation
+		// this mesh installs at tier 1 silently breaks the network it builds at tier 2: every
+		// spoke reaches the hub, no spoke reaches any other, and every part of it reports
+		// success. Found in the lab; nothing about it is visible from the mesh's own state.
+		//
+		// Inserted at the top so it precedes those chains, and removed on the way down so a
+		// machine that stops being the hub stops carrying other people's traffic. Guarded on
+		// iptables existing: a machine without it has no policy to get past.
+		for _, direction := range []string{"-i", "-o"} {
+			fmt.Fprintf(&b,
+				"PostUp = command -v iptables >/dev/null && iptables -I FORWARD 1 %s %%i -j ACCEPT || true\n",
+				direction)
+		}
+		for _, direction := range []string{"-i", "-o"} {
+			fmt.Fprintf(&b,
+				"PostDown = command -v iptables >/dev/null && iptables -D FORWARD %s %%i -j ACCEPT || true\n",
+				direction)
+		}
+	}
+
+	for _, p := range peers {
+		fmt.Fprintf(&b, "\n# %s — %s\n[Peer]\n", p.Name, p.Why)
+		fmt.Fprintf(&b, "PublicKey = %s\n", p.Key)
+		fmt.Fprintf(&b, "AllowedIPs = %s\n", p.Allowed)
+		if p.Endpoint != "" {
+			fmt.Fprintf(&b, "Endpoint = %s\n", p.Endpoint)
+		} else {
+			b.WriteString("# no endpoint: this peer cannot be dialled and opens the path itself\n")
+		}
+		if p.Keepalive {
+			b.WriteString("PersistentKeepalive = 25\n")
+		}
+	}
+	return b.String()
+}
+
+func portOf(endpoint string) string {
+	if i := strings.LastIndex(endpoint, ":"); i >= 0 {
+		return endpoint[i+1:]
+	}
+	return ""
+}
diff --git a/internal/overlay/declaration_test.go b/internal/overlay/declaration_test.go
new file mode 100644
index 0000000..af54dcd
--- /dev/null
+++ b/internal/overlay/declaration_test.go
@@ -0,0 +1,305 @@
+package overlay
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func declarationFor(t *testing.T, node Node, peers []Peer) (string, []map[string]any) {
+	t.Helper()
+	raw, err := Declaration(node, peers, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var d struct {
+		Declaration int              `json:"declaration"`
+		Resources   []map[string]any `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &d); err != nil {
+		t.Fatal(err)
+	}
+	if d.Declaration != 1 {
+		t.Fatalf("declaration version %d", d.Declaration)
+	}
+	for _, r := range d.Resources {
+		if r["type"] == "file" {
+			return r["content"].(string), d.Resources
+		}
+	}
+	t.Fatal("the declaration has no configuration file in it")
+	return "", nil
+}
+
+func TestNoPrivateKeyEverTravels(t *testing.T) {
+	// The property the whole design rests on: the node generated its keypair and kept the private
+	// half, so the mesh composes a configuration for a node it cannot impersonate. A private key
+	// appearing here would mean the control plane had one — and a copy of its database would then
+	// be every node's network identity.
+	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
+		[]Peer{{Name: "anchor", Key: "HUB", Allowed: "10.42.0.0/16", Endpoint: "198.51.100.1:51820"}})
+
+	if strings.Contains(config, "PrivateKey") {
+		t.Error("the configuration carries a PrivateKey line; the mesh must never hold one")
+	}
+	if !strings.Contains(config, "private-key "+DefaultKeyPath) {
+		t.Error("the configuration does not point at the key file the node wrote, so the " +
+			"interface would come up with no key at all")
+	}
+}
+
+func TestTheDeclarationUsesOnlyShapesTheHostAlreadyHas(t *testing.T) {
+	// Connectivity needs nothing new from tier 0, and that is worth holding: the host does not
+	// know what a private network is, and should not learn.
+	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+
+	allowed := map[string]bool{"package": true, "file": true, "service": true,
+		"directory": true, "container": true, "action": true}
+	for _, r := range resources {
+		if !allowed[r["type"].(string)] {
+			t.Errorf("the overlay declaration uses %q, which the host does not have", r["type"])
+		}
+	}
+}
+
+func TestTheInterfaceComesBackAfterAReboot(t *testing.T) {
+	// A node whose overlay only exists while something is watching is not a node that survives
+	// being switched off and on — and it would come back unreachable, which is the worst way to
+	// come back.
+	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	for _, r := range resources {
+		if r["type"] == "service" {
+			if r["boot"] != "enabled" {
+				t.Error("the overlay interface is not enabled at boot")
+			}
+			if r["state"] != "running" {
+				t.Error("the overlay interface is not asked to be running")
+			}
+			return
+		}
+	}
+	t.Error("nothing in the declaration brings the interface up")
+}
+
+func TestTheConfigurationIsNotWorldReadable(t *testing.T) {
+	// It lists every peer's key and endpoint, which is a map of the mesh. Not secret the way a
+	// private key is, and not something to leave readable on a machine somebody else also uses.
+	// The peer list specifically, not every file. `/etc/hosts` is in here too and must be
+	// world-readable, or nothing on the machine resolves anything — a check that swept all files
+	// would force it to 0600 and break the machine to protect a file that is not secret.
+	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	for _, r := range resources {
+		if r["id"] == "overlay-config" && r["mode"] != "0600" {
+			t.Errorf("the peer list is mode %v", r["mode"])
+		}
+		if r["id"] == "mesh-names" && r["mode"] != "0644" {
+			t.Errorf("the name file is mode %v; nothing on the machine could read it", r["mode"])
+		}
+	}
+}
+
+func TestAPeerThatCannotBeDialledSaysSo(t *testing.T) {
+	// A [Peer] with no Endpoint is correct and looks like a mistake. Saying why stops somebody
+	// helpfully adding one that cannot work.
+	config, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
+		Endpoint: "198.51.100.1:51820", Hub: true},
+		[]Peer{{Name: "laptop", Key: "PUB", Allowed: "10.42.0.2/32", Why: "routes through this hub"}})
+
+	if strings.Contains(config, "Endpoint =") {
+		t.Error("an endpoint was written for a peer that has none")
+	}
+	if !strings.Contains(config, "cannot be dialled") {
+		t.Error("the file does not say why that peer has no endpoint")
+	}
+}
+
+func TestTheFileSaysNotToEditIt(t *testing.T) {
+	// It is replaced whenever the graph changes. An edit survives until then and vanishes, which
+	// is worse than never being applied — the machine works, then stops, and nothing changed
+	// that anybody remembers.
+	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	if !strings.Contains(config, "Do not edit") {
+		t.Error("a generated file does not say it is generated")
+	}
+}
+
+func TestANodeWithNoAddressIsRefused(t *testing.T) {
+	// Rather than a configuration with a blank address, which wg-quick would reject on the
+	// machine, at boot, where the failure is much harder to see.
+	if _, err := Declaration(Node{Name: "laptop", Key: "PUB"}, nil, ""); err == nil {
+		t.Fatal("a node with no overlay address was given a configuration")
+	}
+}
+
+func TestOnlyAReachableNodeListens(t *testing.T) {
+	// A ListenPort on a node nothing can dial is a port open for no reason.
+	config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	if strings.Contains(config, "ListenPort") {
+		t.Error("a node that cannot be dialled was told to listen")
+	}
+	config, _ = declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
+		Endpoint: "198.51.100.1:51820"}, nil)
+	if !strings.Contains(config, "ListenPort = 51820") {
+		t.Error("a reachable node does not listen on the port its endpoint names")
+	}
+}
+
+func TestTheServiceIsRestartedWhenThePeerListChanges(t *testing.T) {
+	// The fault this exists to catch, found in the lab the moment a third node arrived: a running
+	// WireGuard interface does not re-read its configuration. The file was replaced, the service
+	// was already running so nothing reloaded it, and every existing node kept a network that no
+	// longer matched the mesh — while looking entirely successful.
+	//
+	// So the declaration has to verify what the interface is *carrying*, not what the file says.
+	//
+	// And it must be declared state rather than a command: the host refuses an action arriving
+	// over the link (novox/hq ADR 0005), correctly, which is how this shape was arrived at. There
+	// is a test below that no action is ever in here.
+	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
+		[]Peer{{Name: "anchor", Key: "HUBKEY", Allowed: "10.42.0.0/16"}})
+
+	for _, r := range resources {
+		if r["type"] != "service" {
+			continue
+		}
+		reflects := fmt.Sprint(r["restart-on"])
+		if !strings.Contains(reflects, "overlay-config") {
+			t.Errorf("the interface does not restart when its configuration changes: %v", reflects)
+		}
+		return
+	}
+	t.Error("nothing in the declaration brings the interface up")
+}
+
+func TestTheOverlayDeclarationCarriesNoAction(t *testing.T) {
+	// The link may not carry an action, and the host refuses a declaration containing one — whole,
+	// not in part. An overlay declaration with an action in it does not half-apply: it leaves the
+	// node with no network at all.
+	_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	for _, r := range resources {
+		if r["type"] == "action" {
+			t.Errorf("the declaration contains an action (%v); the host will refuse the whole "+
+				"thing and the node will have no network", r["id"])
+		}
+	}
+}
+
+func TestTheHubForwardsAndNobodyElseDoes(t *testing.T) {
+	// A hub carries traffic between its spokes, and Linux does not forward packets unless told
+	// to. Without it every spoke reaches the hub perfectly and no spoke reaches any other — which
+	// is how it failed in the lab, and it presents as a peering problem rather than a kernel
+	// setting, so it is worth being sure of.
+	hub, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
+		Endpoint: "198.51.100.1:51820", Hub: true}, nil)
+	if !strings.Contains(hub, "ip_forward=1") {
+		t.Error("the hub does not enable forwarding, so its spokes cannot reach each other")
+	}
+	if !strings.Contains(hub, "ip_forward=0") {
+		t.Error("the hub never stops forwarding; a machine that stops being the hub would keep " +
+			"passing traffic it is no longer part of")
+	}
+
+	// And past the machine's own firewall. Any node with a container runtime has FORWARD set to
+	// DROP by Docker, so enabling ip_forward alone changes nothing — which is exactly how it
+	// failed, with every spoke reaching the hub and no spoke reaching any other.
+	// Checked as PostUp specifically. "contains FORWARD" passes on the PostDown line alone,
+	// which would leave a hub that tears down rules it never put up.
+	if !strings.Contains(hub, "PostUp = command -v iptables") {
+		t.Error("the hub does not open its own firewall, so a container runtime's DROP policy " +
+			"silently eats everything it was supposed to carry")
+	}
+	if !strings.Contains(hub, "PostDown = command -v iptables") {
+		t.Error("the hub never removes those rules, so a machine that stops being the hub keeps " +
+			"passing traffic it is no longer part of")
+	}
+
+	spoke, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
+	if strings.Contains(spoke, "FORWARD") {
+		t.Error("a spoke was given forwarding rules it has no use for")
+	}
+	if strings.Contains(spoke, "ip_forward") {
+		t.Error("a spoke was told to forward packets, which is not its job and widens what a " +
+			"compromised one could do")
+	}
+}
+
+// novox/hq ADR 0105: a node whose private network takes over the tunnel it found is told so on
+// the interface's service, and nothing else about the declaration changes — the key is already
+// the found one, taken at enrolment.
+func TestTakingOverAFoundTunnelIsSaidOnTheInterfacesService(t *testing.T) {
+	node := Node{Name: "anchor", Key: "PUB", Address: "192.0.2.1", Hub: true,
+		Endpoint:  "198.51.100.1:51900",
+		TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Config: "/etc/wireguard/wg0.conf"}}
+	config, resources := declarationFor(t, node, nil)
+
+	var up map[string]any
+	for _, r := range resources {
+		if r["type"] == "service" {
+			up = r
+		}
+	}
+	takes, ok := up["takes-over"].(map[string]any)
+	if !ok {
+		t.Fatalf("the interface's service does not say what it takes over: %+v", up)
+	}
+	if takes["unit"] != "wg-quick@wg0" || takes["config"] != "/etc/wireguard/wg0.conf" || takes["interface"] != "wg0" {
+		t.Errorf("the takeover names the wrong tunnel: %+v", takes)
+	}
+	if !strings.Contains(config, "ListenPort = 51900") {
+		t.Errorf("the hub's interface does not listen on the tunnel's port:\n%s", config)
+	}
+	if strings.Contains(config, "PrivateKey") {
+		t.Error("the found key travelled in the configuration; it is the node's own, set from its key file")
+	}
+
+	_, plain := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "192.0.2.4"}, nil)
+	for _, r := range plain {
+		if _, says := r["takes-over"]; says {
+			t.Error("a node taking over nothing was told to take something over")
+		}
+	}
+}
+
+func TestATakenTunnelBringsItsListenPortEvenWhenNotDialable(t *testing.T) {
+	// A home node behind NAT (no Endpoint, so not Reachable) that took over a tunnel must still
+	// listen on that tunnel's port, because its LAN peers dial it there (novox/hq: a taken tunnel
+	// brings its port). Without this the takeover guard refuses overlay-up.
+	config, _ := declarationFor(t, Node{
+		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
+		TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Port: 51820},
+	}, nil)
+
+	if !strings.Contains(config, "ListenPort = 51820") {
+		t.Fatalf("a taken tunnel's port must be the mesh interface's ListenPort:\n%s", config)
+	}
+	if strings.Contains(config, "Endpoint =") {
+		t.Error("a node that only listens for LAN peers must not advertise an endpoint")
+	}
+}
+
+func TestANodeWithNoTunnelAndNoEndpointStillListensOnNothing(t *testing.T) {
+	// The guard against over-emitting: a plain spoke with neither an endpoint nor a taken tunnel
+	// writes no ListenPort — it purely dials out.
+	config, _ := declarationFor(t, Node{Name: "laptop", Key: "K", Address: "10.10.0.9"}, nil)
+	if strings.Contains(config, "ListenPort") {
+		t.Fatalf("a dial-only node needs no ListenPort:\n%s", config)
+	}
+}
+
+// A path tuned to a smaller MTU (1380 here) survives the takeover: the mesh interface comes up with the same MTU, or
+// transfers hang silently (novox/hq: a taken tunnel carries its MTU). A tunnel that set none gets no MTU line.
+func TestATakenTunnelCarriesItsMTU(t *testing.T) {
+	for _, c := range []struct {
+		mtu  int
+		want string
+	}{{1380, "MTU = 1380"}, {0, ""}} {
+		config, _ := declarationFor(t, Node{
+			Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
+			TakesOver: &TakeOver{Interface: "wg0", Port: 51820, MTU: c.mtu},
+		}, nil)
+		if c.want != "" && !strings.Contains(config, c.want) || c.want == "" && strings.Contains(config, "MTU") {
+			t.Errorf("a tunnel of MTU %d gives:\n%s", c.mtu, config)
+		}
+	}
+}
diff --git a/internal/overlay/generator.go b/internal/overlay/generator.go
new file mode 100644
index 0000000..eb56a43
--- /dev/null
+++ b/internal/overlay/generator.go
@@ -0,0 +1,151 @@
+package overlay
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// The private network as a module rather than as code beside the module system.
+//
+// A machine's peer list is derived from every other machine, so it differs on each one and
+// changes when any of them changes — there is nothing that could be written in a manifest. So the
+// module says its resources are computed, and this computes them.
+//
+// What that buys, beyond one mechanism instead of two: **a machine is on the private network
+// because it was assigned the module.** Before this, every machine with a key and an address was
+// on it, and there was no way to say a machine should stay off.
+//
+// It is worth saying what is *not* here, because networking looks like it should be foundational.
+// The host needs none of this. It has an address and a route to the broker before the mesh exists
+// — that is the machine's own networking — and the broker's address is carried in the enrolment
+// token rather than resolved. So the private network is something the mesh installs on top, like
+// anything else, and a node without it is an ordinary node that nothing reaches directly.
+
+// **A resolver's data went the same way as the names.** Two constants used to sit here — a
+// `mesh-resolver` module that would write the machines as wildcards, and a `resolver-data`
+// requirement a daemon would ask for. Nothing ever provided or consumed either: a module that
+// answers names asks for the `node-zones` fact in its own manifest (catalogue.FactsInto) and
+// requires Addressing, since the file is made of the mesh's addresses and means nothing off the
+// network. A requirement nothing provides is refused at resolution, so leaving the names here
+// would only have documented a mechanism that does not exist.
+
+// **There is no bundle any more** (novox/hq ADR 0226). A `networking` module requiring this one and
+// nothing else used to be what a machine was assigned, so that "get the network working" was one
+// word and a second VPN could be chosen by assigning it instead. The mesh has one private network,
+// every machine is on it, and the bundle was a second name for this module that every machine
+// carried. A machine is assigned Name directly; another VPN is still chosen by assigning it in its
+// place, which is all the bundle ever did.
+
+// Generator answers what one node's network configuration is.
+type Generator struct {
+	nodes []Node
+	graph Graph
+	// keyPath is where each node keeps the private half it generated. Named rather than carried:
+	// the mesh has never seen it and never will.
+	keyPath string
+	// No registry. Being on the network is still what grants a machine the right to pull from the
+	// mesh's artifact store in the clear (novox/hq ADR 0082), but the runtime's file is the runtime's
+	// module's: the private network writes nothing into it, and that module states the registry
+	// itself, told where the store is reached by ${seat:mesh-artifact-store:reach} (novox/hq ADR
+	// 0222, issue 190).
+}
+
+// From builds a generator over the machines that are part of the network.
+//
+// The nodes given are the ones assigned the module — not every node the mesh knows. A machine
+// that was never given it is absent from everybody's peer list and from the names, which is what
+// "not on the network" has to mean.
+func From(nodes []Node, cidr, keyPath string) (*Generator, error) {
+	graph, err := Compute(nodes, cidr)
+	if err != nil {
+		return nil, err
+	}
+	return &Generator{nodes: nodes, graph: graph, keyPath: keyPath}, nil
+}
+
+// Resources is one node's interface, peers and names.
+func (g *Generator) Resources(node string) ([]map[string]any, bool, error) {
+	peers, part := g.graph[node]
+	if !part {
+		// Assigned and not yet placed on the network. Ordinary and brief, so it is an answer
+		// rather than an error.
+		return nil, false, nil
+	}
+	var self Node
+	for _, n := range g.nodes {
+		if n.Name == node {
+			self = n
+		}
+	}
+
+	raw, err := Declaration(self, peers, g.keyPath)
+	if err != nil {
+		return nil, false, err
+	}
+	var parsed struct {
+		Resources []map[string]any `json:"resources"`
+	}
+	if err := json.Unmarshal(raw, &parsed); err != nil {
+		return nil, false, err
+	}
+	return parsed.Resources, true, nil
+}
+
+// Nodes are the machines this generator was built over, so a caller can say who is on the network.
+func (g *Generator) Nodes() []Node { return g.nodes }
+
+// Graph is the peer list per node, for showing.
+func (g *Generator) Graph() Graph { return g.graph }
+
+// Empty is a network nobody is on.
+//
+// A mesh where no machine was given the module. Legitimate rather than broken — every node still
+// reaches the broker, which is what being in the mesh is — so it answers "not part of this" for
+// everyone instead of refusing for want of a hub.
+func Empty() *Generator { return &Generator{graph: Graph{}} }
+
+// Listens is the port this node accepts the private network on, which only a hub has.
+//
+// **A fact about this machine's place in the mesh, not about the module.** Every machine on the
+// network runs the same module; a hub is dialled by every node at other sites and needs its port
+// open, and a machine that is not a hub dials out and needs nothing open at all. A static field in
+// a manifest is one answer for every machine that runs it, so it cannot say this — and the machine
+// it would get wrong is the one facing the public internet, which is the machine that most needs
+// filtering.
+//
+// The port is the one in the endpoint, which is also where the interface takes its ListenPort
+// from. One source, so a rule set cannot open a port the interface is not on.
+func (g *Generator) Listens(node string) ([]catalogue.Listening, error) {
+	for _, n := range g.nodes {
+		if n.Name != node {
+			continue
+		}
+		if !n.Reachable() {
+			// It dials out and nothing dials it. Opening a port here would be opening one on a
+			// machine nothing connects to, which is not harmless — it is a rule with no source
+			// that somebody later has to work out the reason for.
+			return nil, nil
+		}
+		port := portOf(n.Endpoint)
+		if port == "" {
+			return nil, fmt.Errorf(
+				"%s is reachable at %q and no port can be read from it, so what it must accept "+
+					"the private network on is unknown", node, n.Endpoint)
+		}
+		number, err := strconv.Atoi(port)
+		if err != nil {
+			return nil, fmt.Errorf("%s is reachable at %q, and %q is not a port", node, n.Endpoint, port)
+		}
+		return []catalogue.Listening{{
+			Port: number, Protocol: "udp", From: catalogue.FromEverywhere,
+			// From everywhere, and deliberately: a node at another site is not on the private
+			// network until this port lets it on, so restricting this to the mesh would be a
+			// rule that can never be satisfied by the thing it exists for.
+			Why: "the private network — a node at another site has no other way in",
+		}}, nil
+	}
+	return nil, nil
+}
diff --git a/internal/overlay/generator_test.go b/internal/overlay/generator_test.go
new file mode 100644
index 0000000..569322b
--- /dev/null
+++ b/internal/overlay/generator_test.go
@@ -0,0 +1,30 @@
+package overlay
+
+import (
+	"testing"
+)
+
+// novox/hq ADR 0222, issue 190: the runtime's file and service are the runtime's module's. The
+// private network writes nothing into either — being on it still grants the right to pull from the
+// mesh's store in the clear (ADR 0082), and the runtime's module states that trust itself.
+func TestTheNetworkWritesNothingOfTheRuntimes(t *testing.T) {
+	nodes := []Node{
+		{Name: "anchor", Site: "lab", Hub: true, Endpoint: "192.0.2.10:51820", Key: "k1", Address: "10.42.0.1"},
+		{Name: "node2", Site: "lab", Key: "k2", Address: "10.42.0.2"},
+	}
+	g, err := From(nodes, "10.42.0.0/16", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, node := range []string{"anchor", "node2"} {
+		resources, part, err := g.Resources(node)
+		if err != nil || !part {
+			t.Fatalf("%s: resources: %v part=%v", node, err, part)
+		}
+		for _, r := range resources {
+			if r["path"] == "/etc/docker/daemon.json" || r["unit"] == "docker.service" {
+				t.Errorf("%s: the private network declares the runtime's %v", node, r)
+			}
+		}
+	}
+}
diff --git a/internal/overlay/graph.go b/internal/overlay/graph.go
new file mode 100644
index 0000000..4be1a43
--- /dev/null
+++ b/internal/overlay/graph.go
@@ -0,0 +1,231 @@
+// Package overlay computes the private network every node runs on.
+//
+// novox/hq 08-connectivity. This is control-plane work by definition: a peer list is derived from
+// every node at once, and no node has that. A node computes nothing about the mesh — it generates
+// a keypair, publishes the public half, and receives the rest.
+//
+// The shape is a hub, with direct peering between nodes at the same site. Not a full mesh, and
+// the reason is a property of WireGuard rather than a preference: there is no failover. A more
+// specific route to a dead endpoint blackholes; it does not fall back to the general one. So a
+// node gets exactly one path to any peer, because two would mean one of them silently swallowing
+// traffic.
+package overlay
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// Node is one machine's place on the network, as the mesh holds it.
+type Node struct {
+	Name     string
+	Key      string
+	Endpoint string
+	Site     string
+	Hub      bool
+	Address  string
+
+	// Carried are the peers of the tunnel this node took over (novox/hq ADR 0105): machines the
+	// mesh has no record of, each known by the public key and the address the found tunnel routed
+	// to it. Only a hub has any. They stay in its peer list until a node enrols with that key —
+	// from then on the node is the peer.
+	Carried []Carried
+	// TakesOver names the found tunnel this node's private network replaces: its unit is stopped
+	// and disabled, never flushed, and its configuration kept, before the mesh's interface comes
+	// up with the found key. Nil on a node that raises the mesh's interface beside whatever it has.
+	TakesOver *TakeOver
+}
+
+// Carried is one peer of an adopted tunnel that has not enrolled: a peer of the tunnel, not a
+// node of the mesh.
+type Carried struct {
+	Key     string
+	Address string
+}
+
+// TakeOver is the found tunnel a node's private network takes over, as the host is told it.
+type TakeOver struct {
+	Interface string
+	Unit      string
+	Config    string
+	// MTU is the found tunnel's, when it set one — emitted so a tuned path keeps its MTU.
+	MTU int
+	// Port is the port the found tunnel listened on. The mesh's interface must listen on it too,
+	// even on a node that is not dialable from the hub: a home node's LAN peers dial it there
+	// (novox/hq: a taken tunnel brings its port). Listening is "a peer dials me here"; it is not
+	// "the hub can dial me", which is Reachable — the two were conflated.
+	Port int
+}
+
+// HostPrefix is one address as a route: /32 for IPv4, /128 for IPv6.
+func HostPrefix(address string) string {
+	if strings.Contains(address, ":") {
+		return address + "/128"
+	}
+	return address + "/32"
+}
+
+// CarriedName is how a carried peer is named in a peer list: it has no node name, so it is named
+// by the key its packets arrive under.
+func CarriedName(key string) string {
+	short := key
+	if len(short) > 8 {
+		short = short[:8] + "…"
+	}
+	return "a peer of the tunnel (" + short + ")"
+}
+
+// Reachable reports whether other nodes can dial this one. Declared, never inferred.
+func (n Node) Reachable() bool { return strings.TrimSpace(n.Endpoint) != "" }
+
+// Peer is one entry in a node's peer list.
+type Peer struct {
+	Name string
+	Key  string
+	// Endpoint is empty when this peer cannot be dialled — it must dial us instead.
+	Endpoint string
+	// Allowed is what traffic goes down this tunnel. A single address for a direct peer; the
+	// whole overlay for the hub, which is what makes it the route of last resort.
+	Allowed string
+	// Keepalive matters only on the side behind NAT: a node that cannot be dialled has to keep
+	// the path open from its end, or the peer's first packet arrives at a mapping that has
+	// already expired.
+	Keepalive bool
+	// Why this peer is in the list, for a person reading a generated file and wondering.
+	Why string
+}
+
+// Graph is every node's peer list.
+type Graph map[string][]Peer
+
+// ErrNoHub means nobody has said which node is the hub.
+//
+// Its own error rather than an empty graph: a mesh with no hub has no path between sites, and
+// answering with "no peers" would look like a working mesh where nothing can reach anything.
+var ErrNoHub = errors.New("this mesh has no hub, so there is no path between sites")
+
+// Compute derives every node's peer list.
+//
+// Nodes without a key or an address are skipped rather than refused: a node that has enrolled and
+// not yet been given a place on the network is an ordinary in-between state, and failing the whole
+// graph because one node is half-configured would mean no node gets a network.
+func Compute(nodes []Node, overlayCIDR string) (Graph, error) {
+	var hub *Node
+	usable := make([]Node, 0, len(nodes))
+	for i := range nodes {
+		n := nodes[i]
+		if n.Key == "" || n.Address == "" {
+			continue
+		}
+		usable = append(usable, n)
+		if n.Hub {
+			hub = &usable[len(usable)-1]
+		}
+	}
+	if len(usable) == 0 {
+		return Graph{}, nil
+	}
+	if hub == nil {
+		return nil, ErrNoHub
+	}
+	if !hub.Reachable() {
+		return nil, fmt.Errorf(
+			"%s is the hub and has no endpoint, so nothing can dial it. The hub is the one node "+
+				"that must be reachable from wherever the others are", hub.Name)
+	}
+
+	graph := Graph{}
+	for _, self := range usable {
+		var peers []Peer
+
+		// A node may share a site with the hub, and then the hub is one peer rather than two.
+		// Written before the loop because it changes what that loop may emit: WireGuard takes one
+		// entry per public key, so a hub appearing twice is a configuration it refuses — and the
+		// mesh would have produced it silently. The lab found this on the first two machines that
+		// shared a site with their hub.
+		hubIsHere := !self.Hub && self.Site != "" && self.Site == hub.Site
+
+		for _, other := range usable {
+			if other.Name == self.Name || (hubIsHere && other.Name == hub.Name) {
+				continue
+			}
+			// Two nodes at the same site peer directly — but only if one of them can be
+			// dialled. If neither can, nobody opens the path, and the direct route is more
+			// specific than the hub's, so it wins and blackholes. That is this design's own
+			// stated hazard arriving in it: *a more specific route to a dead endpoint
+			// blackholes; it does not fall back to the general one.*
+			//
+			// Found in the lab with two machines at one site behind no reachable address, which
+			// is the ordinary shape of a home: they were given each other as peers, neither
+			// could start, and they could not reach each other at all while both reached the hub
+			// perfectly.
+			if self.Site != "" && self.Site == other.Site && (self.Reachable() || other.Reachable()) {
+				peers = append(peers, Peer{
+					Name: other.Name, Key: other.Key,
+					Endpoint:  other.Endpoint,
+					Allowed:   other.Address + "/32",
+					Keepalive: !self.Reachable(),
+					Why:       "at the same site",
+				})
+			}
+		}
+
+		if !self.Hub {
+			// Everything else goes through the hub, including a node that roams. AllowedIPs is
+			// the whole overlay, so this is the route of last resort — and because direct peers
+			// above are single addresses, they win on specificity without either being ambiguous.
+			why := "the hub — everything not at this site"
+			if hubIsHere {
+				// One entry doing both jobs: the direct path to a machine that happens to be
+				// here, and the route to everywhere else. Splitting them would need two entries
+				// for one key, which is the thing being avoided.
+				why = "the hub, which is also at this site — everything goes here"
+			}
+			peers = append(peers, Peer{
+				Name: hub.Name, Key: hub.Key,
+				Endpoint:  hub.Endpoint,
+				Allowed:   overlayCIDR,
+				Keepalive: !self.Reachable(),
+				Why:       why,
+			})
+		} else {
+			// The hub holds every node that does not share a site with it, because those nodes
+			// route through it and it must know where to send the replies. Ones it cannot dial
+			// will dial it.
+			enrolled := map[string]bool{}
+			for _, other := range usable {
+				enrolled[other.Key] = true
+				if other.Name == self.Name || (self.Site != "" && self.Site == other.Site) {
+					continue
+				}
+				peers = append(peers, Peer{
+					Name: other.Name, Key: other.Key,
+					Endpoint: other.Endpoint,
+					Allowed:  other.Address + "/32",
+					Why:      "routes through this hub",
+				})
+			}
+			// And every peer of the tunnel it took over that has not enrolled (novox/hq ADR
+			// 0105): the same key and the same address the found tunnel had for it, so the
+			// machine behind it cannot tell the tunnel changed hands. No endpoint — it dials in,
+			// as it always did. Once a node enrols with that key, the node's entry above is the
+			// peer, and WireGuard takes one entry per key.
+			for _, c := range self.Carried {
+				if enrolled[c.Key] {
+					continue
+				}
+				peers = append(peers, Peer{
+					Name: CarriedName(c.Key), Key: c.Key,
+					Allowed: HostPrefix(c.Address),
+					Why:     "carried from the tunnel this hub took over — a peer of the tunnel, not yet a node of the mesh",
+				})
+			}
+		}
+
+		sort.Slice(peers, func(i, j int) bool { return peers[i].Name < peers[j].Name })
+		graph[self.Name] = peers
+	}
+	return graph, nil
+}
diff --git a/internal/overlay/graph_test.go b/internal/overlay/graph_test.go
new file mode 100644
index 0000000..eb8c4e1
--- /dev/null
+++ b/internal/overlay/graph_test.go
@@ -0,0 +1,333 @@
+package overlay
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+const cidr = "10.42.0.0/16"
+
+func at(name, site, address, endpoint string, hub bool) Node {
+	return Node{Name: name, Key: "key-" + name, Site: site, Address: address,
+		Endpoint: endpoint, Hub: hub}
+}
+
+func peersOf(t *testing.T, g Graph, node string) map[string]Peer {
+	t.Helper()
+	out := map[string]Peer{}
+	for _, p := range g[node] {
+		out[p.Name] = p
+	}
+	return out
+}
+
+func TestEveryNodeReachesTheHub(t *testing.T) {
+	// The property that makes this a network at all. Without it a node has no route to anything
+	// it does not share a site with.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+		at("home", "house", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, node := range []string{"laptop", "home"} {
+		hub, ok := peersOf(t, g, node)["anchor"]
+		if !ok {
+			t.Fatalf("%s has no route to the hub", node)
+		}
+		if hub.Allowed != cidr {
+			t.Errorf("%s routes %s through the hub; it must be the whole overlay or the hub is "+
+				"not a route of last resort", node, hub.Allowed)
+		}
+	}
+}
+
+func TestNodesAtOneSitePeerDirectly(t *testing.T) {
+	// Machines that share a site have a path that does not need the hub, and using it keeps their
+	// traffic off a link that may be on another continent.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
+		at("server", "house", "10.42.0.3", "192.0.2.3:51820", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	direct, ok := peersOf(t, g, "desk")["server"]
+	if !ok {
+		t.Fatal("two machines at one site do not peer directly")
+	}
+	if direct.Allowed != "10.42.0.3/32" {
+		t.Errorf("the direct peer allows %s; a single address is what makes it win on "+
+			"specificity over the hub's whole-overlay route", direct.Allowed)
+	}
+}
+
+func TestARoamingNodeGetsExactlyOnePath(t *testing.T) {
+	// Hub-only, and not as a simplification. WireGuard has no failover: a more specific route to
+	// a dead endpoint blackholes rather than falling back, so two paths would mean one of them
+	// silently swallowing traffic.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+		at("other", "", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := len(g["laptop"]); got != 1 {
+		t.Fatalf("a roaming node has %d peers; it gets exactly one path", got)
+	}
+	if g["laptop"][0].Name != "anchor" {
+		t.Errorf("a roaming node's single path is %s, not the hub", g["laptop"][0].Name)
+	}
+}
+
+func TestTwoRoamingNodesDoNotPeerWithEachOther(t *testing.T) {
+	// An empty site is not a site. Nodes that roam have no shared location, and treating "" as
+	// one would have every roaming machine try to dial every other, none of which can be dialled.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+		at("phone", "", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := peersOf(t, g, "laptop")["phone"]; ok {
+		t.Error("two nodes with no site peered as though they shared one")
+	}
+}
+
+func TestOnlyTheSideThatCannotBeDialledKeepsThePathOpen(t *testing.T) {
+	// Keepalive matters exactly once: on the node behind NAT. Without it the peer's first packet
+	// arrives at a mapping that has already expired. On the reachable side it is pointless
+	// traffic for ever.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !peersOf(t, g, "laptop")["anchor"].Keepalive {
+		t.Error("a node that cannot be dialled does not keep its path open")
+	}
+	if peersOf(t, g, "anchor")["laptop"].Keepalive {
+		t.Error("a reachable node sends keepalives it does not need")
+	}
+
+	// And between two direct peers at one site, where whether to keep the path open depends on
+	// which end you are. Checked here because the hub's own peer list happens not to set the
+	// field at all, so asserting only against the hub tests an absence rather than the rule.
+	same, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
+		at("server", "house", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !peersOf(t, same, "server")["desk"].Keepalive {
+		t.Error("the peer that cannot be dialled does not keep the path open")
+	}
+	if peersOf(t, same, "desk")["server"].Keepalive {
+		t.Error("the peer that can be dialled sends keepalives it does not need")
+	}
+}
+
+func TestTheHubKnowsEveryoneItRoutesFor(t *testing.T) {
+	// The replies have to get back. A hub that does not hold a peer cannot answer it.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+		at("home", "house", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	hub := peersOf(t, g, "anchor")
+	for _, want := range []string{"laptop", "home"} {
+		if _, ok := hub[want]; !ok {
+			t.Errorf("the hub does not hold %s, so replies to it have nowhere to go", want)
+		}
+	}
+}
+
+func TestANodeWithNoPlaceYetIsSkippedRatherThanFatal(t *testing.T) {
+	// A node that has enrolled and not yet been given an address is an ordinary in-between state.
+	// Failing the whole graph over it would mean no node gets a network because one is half done.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("laptop", "", "10.42.0.2", "", false),
+		{Name: "newcomer", Key: "", Address: ""},
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := g["newcomer"]; ok {
+		t.Error("a node with no key or address was given a peer list")
+	}
+	if _, ok := peersOf(t, g, "laptop")["newcomer"]; ok {
+		t.Error("a node with no key was put in somebody's peer list")
+	}
+}
+
+func TestAHubAtYourOwnSiteAppearsOnceNotTwice(t *testing.T) {
+	// WireGuard takes one entry per public key. A hub that shares a site with a spoke was being
+	// emitted twice — once as a direct peer and once as the route of last resort — producing a
+	// configuration the interface refuses, from a mesh that thought it had succeeded.
+	//
+	// Found in the lab on the first two machines that shared a site with their hub, which is the
+	// ordinary case for a small mesh and was in none of the tests above.
+	g, err := Compute([]Node{
+		at("anchor", "lab", "10.42.0.1", "192.0.2.10:51820", true),
+		at("laptop", "lab", "10.42.0.2", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	seen := map[string]int{}
+	for _, p := range g["laptop"] {
+		seen[p.Key]++
+	}
+	for key, count := range seen {
+		if count > 1 {
+			t.Errorf("the key %s appears %d times; WireGuard takes one entry per key", key, count)
+		}
+	}
+
+	if len(g["laptop"]) != 1 {
+		t.Fatalf("laptop has %d peers; the hub at its own site is one peer, not two", len(g["laptop"]))
+	}
+	// And that single entry has to carry everything, or the node keeps a direct path to the hub
+	// and loses its route to everywhere else.
+	if got := g["laptop"][0].Allowed; got != cidr {
+		t.Errorf("the single entry allows %s; it is both the direct path and the route of last "+
+			"resort, so it carries the whole overlay", got)
+	}
+	// And nobody peers with themselves, here or in a site of two dialable nodes.
+	other, err := Compute([]Node{
+		at("anchor", "house", "10.42.0.1", "198.51.100.1:51820", true),
+		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, graph := range []Graph{g, other} {
+		for node, peers := range graph {
+			for _, p := range peers {
+				if p.Name == node {
+					t.Errorf("%s peers with itself", node)
+				}
+			}
+		}
+	}
+}
+
+func TestTwoUnreachableNodesAtOneSiteDoNotPeerDirectly(t *testing.T) {
+	// Nobody would open the path, and the direct route is more specific than the hub's — so it
+	// wins and blackholes. Both nodes would reach the hub perfectly and be unable to reach each
+	// other, which is the worst arrangement available: it looks configured and is not.
+	//
+	// This is the design's own warning arriving in its implementation, and the lab found it with
+	// two machines at one site behind no reachable address — the ordinary shape of a house.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("desk", "house", "10.42.0.2", "", false),
+		at("server", "house", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, ok := peersOf(t, g, "desk")["server"]; ok {
+		t.Error("two nodes that neither can be dialled were peered directly; neither could open " +
+			"the path and the route is more specific than the hub's, so it blackholes")
+	}
+	// And they must still be able to reach each other — through the hub.
+	if hub := peersOf(t, g, "desk")["anchor"]; hub.Allowed != cidr {
+		t.Errorf("desk's route to everything else allows %s", hub.Allowed)
+	}
+}
+
+func TestOneReachableNodeIsEnoughToPeerDirectly(t *testing.T) {
+	// The other side of it: if either end can be dialled, the path can be opened, and using it
+	// keeps their traffic off a hub that may be on another continent.
+	g, err := Compute([]Node{
+		at("anchor", "datacentre", "10.42.0.1", "198.51.100.1:51820", true),
+		at("desk", "house", "10.42.0.2", "192.0.2.2:51820", false),
+		at("server", "house", "10.42.0.3", "", false),
+	}, cidr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := peersOf(t, g, "server")["desk"]; !ok {
+		t.Error("a node did not peer with a reachable neighbour at its own site")
+	}
+	if _, ok := peersOf(t, g, "desk")["server"]; !ok {
+		t.Error("the reachable node did not hold its unreachable neighbour, so replies have " +
+			"nowhere to go")
+	}
+}
+
+// novox/hq ADR 0105: a hub that took over the predecessor's tunnel carries every peer that tunnel
+// had, under the key and at the address the peer knows, until a node enrols with that key.
+func TestTheHubCarriesTheTunnelsPeersUntilTheyEnrol(t *testing.T) {
+	hub := at("anchor", "hosting", "192.0.2.1", "198.51.100.1:51900", true)
+	hub.Carried = []Carried{
+		{Key: "key-home", Address: "192.0.2.2"},
+		{Key: "key-workstation", Address: "192.0.2.3"},
+	}
+	// The machine behind key-home enrolled: it is a node now, at the address it kept.
+	home := at("home", "house", "192.0.2.2", "", false)
+	home.Key = "key-home"
+
+	g, err := Compute([]Node{hub, home}, "192.0.2.0/24")
+	if err != nil {
+		t.Fatal(err)
+	}
+	peers := peersOf(t, g, "anchor")
+	carried, ok := peers[CarriedName("key-workstation")]
+	if !ok {
+		t.Fatalf("the hub does not carry the peer that has not enrolled: %+v", g["anchor"])
+	}
+	if carried.Allowed != "192.0.2.3/32" || carried.Endpoint != "" || carried.Key != "key-workstation" {
+		t.Errorf("a carried peer is not the tunnel's own entry — same key, its one address, no endpoint: %+v", carried)
+	}
+	if _, twice := peers[CarriedName("key-home")]; twice {
+		t.Error("a peer that enrolled is carried as well as listed as a node: WireGuard takes one entry per key")
+	}
+	if node, ok := peers["home"]; !ok || node.Key != "key-home" || node.Allowed != "192.0.2.2/32" {
+		t.Errorf("the enrolled peer is not the node it became: %+v", node)
+	}
+	// Carried peers are the hub's business only: a spoke routes everything through the hub.
+	if _, leaked := peersOf(t, g, "home")[CarriedName("key-workstation")]; leaked {
+		t.Error("a carried peer appeared in a spoke's peer list")
+	}
+}
+
+// A mesh whose hub cannot carry the paths between sites is refused, never answered as an empty graph: with no hub there
+// is no path between sites, and a hub with no endpoint is a peer every node is given and none can reach. Either would
+// look configured and be silent, which is how the old arrangement failed when nobody knew the address convention.
+func TestAHubThatCannotCarryThePathsIsRefused(t *testing.T) {
+	for _, c := range []struct {
+		name  string
+		nodes []Node
+		says  func(error) bool
+	}{
+		{"no hub", []Node{at("a", "", "10.42.0.1", "", false), at("b", "", "10.42.0.2", "", false)},
+			func(err error) bool { return errors.Is(err, ErrNoHub) }},
+		{"a hub with no endpoint", []Node{at("anchor", "datacentre", "10.42.0.1", "", true), at("laptop", "", "10.42.0.2", "", false)},
+			func(err error) bool { return err != nil && strings.Contains(err.Error(), "must be reachable") }},
+	} {
+		if _, err := Compute(c.nodes, cidr); !c.says(err) {
+			t.Errorf("%s: %v", c.name, err)
+		}
+	}
+}
diff --git a/internal/overlay/names.go b/internal/overlay/names.go
new file mode 100644
index 0000000..3aba422
--- /dev/null
+++ b/internal/overlay/names.go
@@ -0,0 +1,30 @@
+package overlay
+
+import (
+	sdk "git.novox.be/novox/mesh-sdk/go/overlay"
+)
+
+// The private network's names and the shape of its module stay in mesh-sdk's overlay package, which more parts read
+// (novox/hq ADR 0593 §1); the generator of each node's network configuration is the node-engine's own, here. These
+// are those names, so the generator and the composition read one package.
+const (
+	Requirement    = sdk.Requirement
+	Name           = sdk.Name
+	Addressing     = sdk.Addressing
+	TheNetwork     = sdk.TheNetwork
+	SuffixVar      = sdk.SuffixVar
+	DefaultSuffix  = sdk.DefaultSuffix
+	Interface      = sdk.Interface
+	ConfigPath     = sdk.ConfigPath
+	Unit           = sdk.Unit
+	DefaultKeyPath = sdk.DefaultKeyPath
+)
+
+// Manifest is the module the mesh provides for itself (sdk.Manifest).
+func Manifest() map[string]any { return sdk.Manifest() }
+
+// Suffix is the internal names' suffix (sdk.Suffix).
+func Suffix() string { return sdk.Suffix() }
+
+// InternalName is a node's internal name (sdk.InternalName).
+func InternalName(node string) string { return sdk.InternalName(node) }
diff --git a/internal/overlay/opens_test.go b/internal/overlay/opens_test.go
new file mode 100644
index 0000000..7abf1bd
--- /dev/null
+++ b/internal/overlay/opens_test.go
@@ -0,0 +1,113 @@
+package overlay
+
+import (
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func networkOf(t *testing.T, nodes []Node) *Generator {
+	t.Helper()
+	made, err := From(nodes, "10.42.0.0/16", "/var/lib/mesh-host/overlay.key")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return made
+}
+
+// A hub is dialled by every node at other sites, and needs its port open. A machine that is not a
+// hub dials out and needs nothing open at all.
+//
+// They are the same module, which is why a static field in a manifest cannot say it — and the
+// machine it gets wrong is the one facing the public internet, which is the machine that most
+// needs filtering.
+func TestOnlyAMachineThatCanBeDialledOpensTheOverlaysPort(t *testing.T) {
+	network := networkOf(t, []Node{
+		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:51820", Site: "one", Hub: true},
+		{Name: "laptop", Key: "b", Site: "one"},
+	})
+
+	opens, err := network.Listens("anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(opens) != 1 {
+		t.Fatalf("the machine every other one dials opens %d ports", len(opens))
+	}
+	if opens[0].Port != 51820 || opens[0].At() != "udp" {
+		t.Fatalf("the port is not the one the interface listens on: %+v", opens[0])
+	}
+	// From everywhere, and deliberately: a node at another site is not on the private network
+	// until this port lets it on, so restricting it to the mesh would be a rule that can never be
+	// satisfied by the thing it exists for.
+	if opens[0].From != catalogue.FromEverywhere {
+		t.Fatalf("the way onto the private network is restricted to the private network: %+v", opens[0])
+	}
+	if opens[0].Why == "" {
+		t.Fatal("a port is opened and nothing says why, which is what makes a rule set unreadable")
+	}
+
+	// And the machine nothing dials opens nothing. Not harmless to get wrong: a rule with no
+	// reason is one somebody later has to work out the reason for.
+	quiet, err := network.Listens("laptop")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(quiet) != 0 {
+		t.Fatalf("a machine nothing dials opened %d port(s)", len(quiet))
+	}
+}
+
+// The port comes from the endpoint, which is where the interface takes its ListenPort from. One
+// source, so a rule set cannot open a port the interface is not on.
+func TestTheOpenedPortIsTheOneTheInterfaceListensOn(t *testing.T) {
+	network := networkOf(t, []Node{
+		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:60000", Site: "one", Hub: true},
+	})
+	opens, err := network.Listens("anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(opens) != 1 || opens[0].Port != 60000 {
+		t.Fatalf("the rule set would open a port the interface is not on: %+v", opens)
+	}
+
+	written, err := Declaration(Node{Name: "anchor", Key: "a", Address: "10.42.0.1",
+		Endpoint: "198.51.100.10:60000", Hub: true}, nil, "/k")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(written), "ListenPort = 60000") {
+		t.Fatalf("the interface and the rule set disagree about the port:\n%s", written)
+	}
+}
+
+// An endpoint with no port is refused rather than treated as a machine that opens nothing.
+//
+// A generator that cannot say what a machine opens is not one that says it opens nothing, and
+// closing a port on the evidence of a failure to look is how a machine is severed by a fault
+// somewhere else entirely.
+func TestAnEndpointWithNoPortIsRefusedRatherThanTakenAsSilence(t *testing.T) {
+	network := networkOf(t, []Node{
+		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10", Site: "one", Hub: true},
+	})
+	if _, err := network.Listens("anchor"); err == nil {
+		t.Fatal("a machine whose port could not be read was treated as opening nothing")
+	}
+}
+
+// A machine the network has never heard of opens nothing, and that is an answer rather than an
+// error: a node assigned the module before it is placed is in exactly that state.
+func TestAMachineNotOnTheNetworkOpensNothing(t *testing.T) {
+	network := networkOf(t, []Node{
+		{Name: "anchor", Key: "a", Endpoint: "198.51.100.10:51820", Site: "one", Hub: true},
+	})
+	opens, err := network.Listens("a-stranger")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(opens) != 0 {
+		t.Fatalf("a machine not on the network opened %d port(s)", len(opens))
+	}
+}
diff --git a/internal/selfcompose/candidate.go b/internal/selfcompose/candidate.go
new file mode 100644
index 0000000..de8eca4
--- /dev/null
+++ b/internal/selfcompose/candidate.go
@@ -0,0 +1,296 @@
+package selfcompose
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"maps"
+	"sort"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/agent"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+)
+
+// **A check's candidate, composed in shadow on a call** (novox/hq ADR 0593 §7): the node seat's verb compose-candidate.
+// Given the key of the indexer's candidate (delivery.CandidatesBucket, `<group>.<heads hash>`), the node composes itself
+// twice from what its shadow holds (placement, records, the indexer's modules, its config values), with its own sealed
+// values: once as it is, and once with the candidate's modules laid over the indexer's (each at the candidate's
+// fingerprint, its manifest by digest and the indexer's verdict on it, ADR 0578 §3; a module the candidate removes left
+// out). It answers per module placed here composed (its digest, and whether the candidate changes it), refused by the
+// candidate, or held without it too, and the verdict of its own composition. It applies nothing and writes nothing: it
+// composes on a copy of the shadow's inputs, so neither the shadow's answers nor the node's own composer move.
+
+// errNotReady is a shadow that has not read every input yet.
+var errNotReady = errors.New("this node's shadow has not read every input yet")
+
+// ComposeCandidate is the node's answer to ask, within delivery.ComposeAnswerBound (or ctx's deadline, if sooner).
+func (s *Shadow) ComposeCandidate(ctx context.Context, ask delivery.ComposeCandidateAsk) delivery.ComposeCandidateAnswer {
+	began := time.Now()
+	s.mu.Lock()
+	c := s.c
+	s.mu.Unlock()
+	node := c.env.Node
+	a := delivery.ComposeCandidateAnswer{Node: node, Candidate: ask.Candidate}
+	refuse := func(why string) delivery.ComposeCandidateAnswer {
+		a.Verdict, a.Refused, a.Modules, a.Own = delivery.ComposeCandidateRefused, why, nil, delivery.ModuleComposed{}
+		a.Took = time.Since(began).Milliseconds()
+		return a
+	}
+	// A node that cannot compose now (its shadow not ready, a read the bus did not answer, the bound passed) answers
+	// unready: the checker takes it as no answer (ADR 0593 §9) by the verdict, the words only saying why.
+	unready := func(why string) delivery.ComposeCandidateAnswer {
+		a = refuse(why)
+		a.Verdict = delivery.ComposeCandidateUnready
+		return a
+	}
+	if _, _, err := delivery.ParseCompositionKey(ask.Candidate); err != nil {
+		return refuse(err.Error())
+	}
+	ctx, cancel := context.WithTimeout(ctx, delivery.ComposeAnswerBound)
+	defer cancel()
+	if !s.ready.Load() {
+		return unready(errNotReady.Error())
+	}
+	base := c.scratch()
+	raw, err := base.get(ctx, delivery.CandidatesBucket, ask.Candidate)
+	if err != nil {
+		return unready(fmt.Sprintf("the indexer's candidate %s cannot be read: %v", ask.Candidate, err))
+	}
+	if raw == nil {
+		return refuse("the indexer holds no candidate " + ask.Candidate)
+	}
+	cand, err := delivery.DecodeCandidate(raw)
+	if err != nil {
+		return refuse(fmt.Sprintf("the indexer's candidate %s cannot be read: %v", ask.Candidate, err))
+	}
+	laid := c.scratch()
+	touched, err := laid.layCandidate(ctx, cand)
+	if err != nil {
+		return unready(err.Error())
+	}
+
+	var running []delivery.Composed
+	if c.env.Running != nil {
+		running = c.env.Running()
+	}
+	baseComps, baseHeld, baseErr := base.composeShadow(ctx, running, nil, nil)
+	laidComps, laidHeld, laidErr := laid.composeShadow(ctx, running, touched, func(scope frombus.Scope) {
+		if !ask.Input {
+			return
+		}
+		in, err := frombus.Input(ctx, reader{c: laid}, laid.env.Mesh, scope)
+		if err != nil {
+			return
+		}
+		// The request's input carries no catalogue (composer.Request.Input): the cases give the manifests.
+		in.Catalogue = nil
+		for i := range in.Nodes {
+			in.Nodes[i].Kept = nil
+		}
+		if body, err := json.Marshal(in); err == nil {
+			a.Input = body
+		}
+	})
+	if ctx.Err() != nil {
+		return unready(fmt.Sprintf("the bound of %s passed before the node composed the candidate", delivery.ComposeAnswerBound))
+	}
+	switch {
+	case laidErr != nil && BusFailed(laidErr):
+		return unready("a read on the bus did not answer: " + laidErr.Error())
+	case laidErr != nil && baseErr != nil:
+		// The node composes none of its own without the candidate either: the candidate changes nothing of that.
+		a.Verdict, a.Modules = delivery.ComposeCandidateComposed, []delivery.ModuleComposed{}
+		a.Own = delivery.ModuleComposed{Module: delivery.HaveNodeWord, State: delivery.ModuleHeldState, Words: laidErr.Error()}
+		a.Took = time.Since(began).Milliseconds()
+		return a
+	case laidErr != nil:
+		return refuse(laidErr.Error())
+	}
+	byModule := func(comps map[string]delivery.Composed) map[string]delivery.Composed {
+		out := map[string]delivery.Composed{}
+		for _, comp := range comps {
+			out[comp.Module] = comp
+		}
+		return out
+	}
+	was, now := byModule(baseComps), byModule(laidComps)
+	one := func(module string) (delivery.ModuleComposed, bool) {
+		m := delivery.ModuleComposed{Module: module}
+		if module == "" {
+			m.Module = delivery.HaveNodeWord
+		}
+		if why, held := laidHeld[module]; held {
+			m.State, m.Words = delivery.ModuleRefusedState, why
+			if _, before := baseHeld[module]; before || baseErr != nil {
+				m.State = delivery.ModuleHeldState
+			}
+			return m, true
+		}
+		comp, ok := now[module]
+		if !ok {
+			return m, false
+		}
+		dig, err := delivery.ComposedDigestOf(comp)
+		if err != nil {
+			m.State, m.Words = delivery.ModuleRefusedState, err.Error()
+			return m, true
+		}
+		m.State, m.FP, m.Digest = delivery.ModuleComposedState, comp.FP, dig
+		if before, ok := was[module]; !ok {
+			m.Changed = true
+		} else if d, err := delivery.ComposedDigestOf(before); err != nil || d != dig {
+			m.Changed = true
+		}
+		return m, true
+	}
+	modules := map[string]bool{}
+	for m := range now {
+		modules[m] = m != ""
+	}
+	for m := range laidHeld {
+		modules[m] = m != "" && m != agent.NodeModule
+	}
+	names := make([]string, 0, len(modules))
+	for m, isModule := range modules {
+		if isModule {
+			names = append(names, m)
+		}
+	}
+	sort.Strings(names)
+	a.Modules = []delivery.ModuleComposed{}
+	refused := false
+	for _, m := range names {
+		if mc, ok := one(m); ok {
+			a.Modules = append(a.Modules, mc)
+			refused = refused || mc.State == delivery.ModuleRefusedState
+		}
+	}
+	if own, ok := one(""); ok {
+		a.Own = own
+	} else {
+		a.Own = delivery.ModuleComposed{Module: delivery.HaveNodeWord, State: delivery.ModuleHeldState,
+			Words: "the node composes no composition of its own"}
+	}
+	refused = refused || a.Own.State == delivery.ModuleRefusedState
+	a.Verdict = delivery.ComposeCandidateComposed
+	if refused {
+		a.Verdict = delivery.ComposeCandidateRefused
+	}
+	a.Took = time.Since(began).Milliseconds()
+	return a
+}
+
+// scratch is a composer over a copy of what c holds of its inputs, for composing in shadow without moving c.
+func (c *Composer) scratch() *Composer {
+	out := New(c.env)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	out.placements = maps.Clone(c.placements)
+	out.records = maps.Clone(c.records)
+	out.inOwn = maps.Clone(c.inOwn)
+	out.modules = maps.Clone(c.modules)
+	out.values = maps.Clone(c.values)
+	out.manifests = maps.Clone(c.manifests)
+	out.archives = maps.Clone(c.archives)
+	out.builds = maps.Clone(c.builds)
+	out.sealedOwn = maps.Clone(c.sealedOwn)
+	out.ownHanded = maps.Clone(c.ownHanded)
+	out.certified = c.certified
+	out.placementKeys = c.placementKeys
+	return out
+}
+
+// layCandidate lays the candidate's modules over the indexer's: each at its fingerprint, with its manifest's digest and
+// the indexer's verdict on it (read from its verdicts, none read taken as accepted); a module the candidate removes goes.
+// It answers the modules laid.
+func (c *Composer) layCandidate(ctx context.Context, cand delivery.Candidate) (map[string]bool, error) {
+	touched := map[string]bool{}
+	for _, pull := range cand.Pulls {
+		for module, cm := range pull.Fps {
+			if cm.None2 == delivery.CandidateNoneNoModule {
+				c.mu.Lock()
+				delete(c.modules, module)
+				c.mu.Unlock()
+				continue
+			}
+			if cm.FP2 == "" {
+				continue // no fingerprint at the preview: composed as the trunk holds it
+			}
+			m := delivery.Module{FP2: cm.FP2, Manifest: cm.Manifest, Repository: pull.Repository, Commit: pull.Head.Head}
+			if cm.Manifest != "" {
+				key, err := delivery.VerdictsKey(cm.Manifest)
+				if err != nil {
+					return nil, err
+				}
+				raw, err := c.get(ctx, delivery.VerdictsBucket, key)
+				if err != nil {
+					return nil, fmt.Errorf("the indexer's verdict on %s's manifest cannot be read: %w", module, err)
+				}
+				if raw != nil {
+					v, err := delivery.DecodeManifestVerdict(raw)
+					if err != nil {
+						return nil, fmt.Errorf("the indexer's verdict on %s's manifest cannot be read: %w", module, err)
+					}
+					m.Verdict, m.Problems, m.Warnings = v.State, v.Problems, v.Warnings
+				}
+			}
+			c.mu.Lock()
+			c.modules[module] = m
+			c.mu.Unlock()
+			touched[module] = true
+		}
+	}
+	return touched, nil
+}
+
+// composeShadow composes this node from what c holds, as the shadow composes it (shadowBuilds): each module at the build
+// it runs, one placed and not run at the indexer's, and one the candidate laid (laid) at the candidate's. input, when
+// given, is handed the scope.
+func (c *Composer) composeShadow(ctx context.Context, running []delivery.Composed, laid map[string]bool, input func(frombus.Scope)) (map[string]delivery.Composed, map[string]string, error) {
+	node := c.env.Node
+	c.mu.Lock()
+	placement, placed := c.placements[node]
+	modules := maps.Clone(c.modules)
+	inOwn := c.inOwnOf(placement)
+	c.mu.Unlock()
+	if !placed {
+		return nil, nil, errors.New("this node's key in the seat's placement state is gone: it composes nothing of its own")
+	}
+	fps := shadowBuilds(running, placement, modules, inOwn)
+	// A module the laid candidate changes is composed at the candidate's build, though the node runs another.
+	for module := range fps {
+		if mod, ok := modules[module]; ok && laid[module] {
+			fps[module] = mod.FP2
+		}
+	}
+	kept := map[string]string{}
+	for module, fp := range fps {
+		if mod, ok := modules[module]; ok && mod.FP2 == fp {
+			continue
+		}
+		kept[module] = fp
+	}
+	wants := map[string]delivery.Want{agent.NodeModule: {}}
+	for module, fp := range fps {
+		wants[module] = delivery.Want{FP: fp}
+	}
+	c.mu.Lock()
+	c.wants = wants
+	c.mu.Unlock()
+	scope := frombus.Scope{Node: node, KeptAt: kept, InOwn: inOwn, Running: running, SameValue: c.sameValue}
+	if input != nil {
+		input(scope)
+	}
+	comps, _, held, err := frombus.Compose(ctx, reader{c: c}, c.env.Mesh, scope, fps)
+	if err != nil {
+		return nil, nil, err
+	}
+	for key, comp := range comps {
+		comps[key] = c.keepRunning(comp, running)
+	}
+	return comps, held, nil
+}
diff --git a/internal/selfcompose/candidate_test.go b/internal/selfcompose/candidate_test.go
new file mode 100644
index 0000000..aec1323
--- /dev/null
+++ b/internal/selfcompose/candidate_test.go
@@ -0,0 +1,125 @@
+package selfcompose
+
+import (
+	"context"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/agent"
+)
+
+// novox/hq ADR 0593 §7: the verb compose-candidate composes a check's candidate on this node in shadow. A candidate that
+// changes a placed module composes it at the candidate's build, changed; one whose manifest the indexer refused is
+// answered refused, naming the module and the judge's words, and the verdict is refused; a candidate the indexer does not
+// hold is refused in words. Nothing is applied, nothing is written, no placement answer is handed, and the answer comes
+// within the bound; a shadow not ready and an ended bound answer unready at once, which the checker takes as no answer.
+func TestTheNodeComposesACandidateOnAsk(t *testing.T) {
+	b := newFakeBus()
+	fp := delivery.SourcePrefix2 + strings.Repeat("a", 64)
+	fpNew := delivery.SourcePrefix2 + strings.Repeat("b", 64)
+	digest := delivery.ManifestDigest([]byte(lemurs))
+	lemurs2 := strings.Replace(lemurs, `"version":"1"`, `"version":"2"`, 1)
+	digest2 := delivery.ManifestDigest([]byte(lemurs2))
+	for d, body := range map[string]string{digest: lemurs, digest2: lemurs2} {
+		man, _ := delivery.EncodeManifest(delivery.Manifest{Module: "lemurs", JSON: body})
+		key, _ := delivery.ManifestsKey(d)
+		b.kv[delivery.ManifestsBucket+"/"+key] = man
+	}
+	candidateOf := func(manifest string) string {
+		head := delivery.Head{Repository: "novox/x", Number: 7, Head: "c0ffee" + manifest[len(manifest)-6:]}
+		heads, _ := delivery.HeadsHash([]delivery.Head{head})
+		pulls := []delivery.CandidatePull{{Head: head, Modules: []string{"lemurs"},
+			Fps: map[string]delivery.CandidateModule{"lemurs": {FP2: fpNew, Manifest: manifest}}}}
+		raw, err := delivery.EncodeCandidate(delivery.Candidate{Group: "novox/x#7", HeadsHash: heads, Pulls: pulls,
+			FPSet: delivery.FingerprintSet(pulls)})
+		if err != nil {
+			t.Fatal(err)
+		}
+		key, _ := delivery.CompositionKey("novox/x#7", heads)
+		b.kv[delivery.CandidatesBucket+"/"+key] = raw
+		return key
+	}
+	accepted, refusedKey := candidateOf(digest2), ""
+	{
+		// The same change, its manifest refused by the indexer's judge.
+		refusedMan := strings.Replace(lemurs2, `"version":"2"`, `"version":"3"`, 1)
+		d3 := delivery.ManifestDigest([]byte(refusedMan))
+		man, _ := delivery.EncodeManifest(delivery.Manifest{Module: "lemurs", JSON: refusedMan})
+		key, _ := delivery.ManifestsKey(d3)
+		b.kv[delivery.ManifestsBucket+"/"+key] = man
+		vkey, _ := delivery.VerdictsKey(d3)
+		v, err := delivery.EncodeManifestVerdict(delivery.ManifestVerdict{Module: "lemurs", State: delivery.VerdictRefused,
+			Problems: []string{"a field the judge refuses"}, Judge: "src2:j", At: time.Now()})
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.kv[delivery.VerdictsBucket+"/"+vkey] = v
+		refusedKey = candidateOf(d3)
+	}
+
+	env := b.env()
+	state := &fakeComposed{kv: map[string]ComposedEntry{}}
+	env.ComposedState = state
+	var applied atomic.Int64
+	env.Refused = func(string, map[string]string) { applied.Add(1) }
+	var handed atomic.Int64
+	s := NewShadow(env, func(context.Context, map[string]delivery.CandidateAnswer) { handed.Add(1) })
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() { _ = s.Run(ctx) }()
+	if a := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: accepted}); a.Verdict != delivery.ComposeCandidateUnready || a.Refused == "" {
+		t.Errorf("a shadow not ready answered %+v", a)
+	}
+	place, _ := delivery.EncodePlacement(delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"},
+		Modules: []delivery.PlacedModule{{Module: "lemurs"}}})
+	have, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "n1", TunnelKey: "k", SealingKey: "sk", Capabilities: []string{"systemd"}}})
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/x", Commit: "c"})
+	deadline := time.Now().Add(5 * time.Second)
+	watching := func() int { b.mu.Lock(); defer b.mu.Unlock(); return len(b.watches) }
+	for watching() < 6 && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+	b.put(t, delivery.PlacementBucket, "placement.n1", place)
+	b.put(t, delivery.HaveBucket, "n1.node", have)
+	b.put(t, delivery.ModulesBucket, "lemurs", mod)
+	for _, bucket := range []string{delivery.PlacementCandidatesBucket, delivery.PlacementBucket, delivery.HaveBucket, delivery.ModulesBucket, ResolvedBucket} {
+		b.send(bucket, agent.Update{Caught: true})
+	}
+	for !s.ready.Load() && time.Now().Before(deadline) {
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	a := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: accepted})
+	if _, err := delivery.EncodeComposeCandidateAnswer(a); err != nil {
+		t.Fatalf("the answer does not fit the seat's shape: %v (%+v)", err, a)
+	}
+	if a.Verdict != delivery.ComposeCandidateComposed || len(a.Modules) != 1 || a.Modules[0].Module != "lemurs" ||
+		a.Modules[0].State != delivery.ModuleComposedState || a.Modules[0].FP != fpNew || !a.Modules[0].Changed ||
+		a.Own.Module != delivery.HaveNodeWord || a.Took > delivery.ComposeAnswerBound.Milliseconds() {
+		t.Errorf("an accepted candidate answered %+v", a)
+	}
+	r := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: refusedKey})
+	if r.Verdict != delivery.ComposeCandidateRefused || len(r.Modules) != 1 || r.Modules[0].State != delivery.ModuleRefusedState ||
+		!strings.Contains(r.Modules[0].Words, "a field the judge refuses") {
+		t.Errorf("a candidate whose manifest the indexer refused answered %+v", r)
+	}
+	if _, err := delivery.EncodeComposeCandidateAnswer(r); err != nil {
+		t.Errorf("the refused answer does not fit the seat's shape: %v", err)
+	}
+	missing, _ := delivery.CompositionKey("novox/x#8", "0123456789ab")
+	if m := s.ComposeCandidate(ctx, delivery.ComposeCandidateAsk{Candidate: missing}); !strings.Contains(m.Refused, "holds no candidate") {
+		t.Errorf("a candidate the indexer does not hold answered %+v", m)
+	}
+	ended, end := context.WithCancel(ctx)
+	end()
+	if e := s.ComposeCandidate(ended, delivery.ComposeCandidateAsk{Candidate: accepted}); e.Verdict != delivery.ComposeCandidateUnready {
+		t.Errorf("an ended bound answered %+v", e)
+	}
+	if len(state.written()) != 0 || applied.Load() != 0 || handed.Load() != 0 {
+		t.Errorf("composing candidates wrote %v, marked %d have(s), handed %d answer(s); want nothing", state.written(), applied.Load(), handed.Load())
+	}
+}
diff --git a/internal/selfcompose/composedstate.go b/internal/selfcompose/composedstate.go
new file mode 100644
index 0000000..8da3ea6
--- /dev/null
+++ b/internal/selfcompose/composedstate.go
@@ -0,0 +1,320 @@
+package selfcompose
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"maps"
+	"sort"
+	"strings"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/agent"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+)
+
+// **The compositions this node makes, published in its composition state** (novox/hq ADR 0593 §6). The node's engine
+// alone composes, and it writes every composition it makes into `composed-<node>` (delivery.ComposedBucketFor), a
+// record for the provisioner, the assigner and the view, never an instruction: the engine applies only what it composes
+// itself, never a value read from the state, so a value carries no signature. After a pass that composed, it writes:
+//
+//   - each module at the fingerprint its want names, as the agent applies it (`<node>.<module>.<fp>`), and the node's own
+//     composition (`<node>.node`) when its want exists;
+//   - each module placed on the node at its newest done build: the indexer's fingerprint once the builder holds a done
+//     build of it, so the plan exists before the want moves (build done, the node composes and writes, the provisioner
+//     reads, the providers provide, the assigner moves the want); a module it runs that no want names, at what runs;
+//   - each module's plan (catalogue.Plan) exactly when the provisioner's plans name it, from the same pass's builds;
+//   - a module refused alone at a fingerprint as that key with its refusal (Refused), and no resources.
+//
+// A key is written only when its value differs from what the state holds (read once per run), and a module's key is
+// deleted once its fingerprint is not among the five it wrote last (delivery.ComposedKeep) and no want names it. A pass
+// refused whole, or a bus that did not answer, writes nothing: what was written stands, and each module's have says why.
+
+// ComposedStore is this node's composition state, bound and never created (the grants part creates it).
+type ComposedStore interface {
+	// Entries is every key the state holds with its value and revision.
+	Entries(ctx context.Context) (map[string]ComposedEntry, error)
+	Put(ctx context.Context, key string, value []byte) (revision uint64, err error)
+	Delete(ctx context.Context, key string) error
+}
+
+// ComposedEntry is one key's value and revision in the state.
+type ComposedEntry struct {
+	Value    []byte
+	Revision uint64
+}
+
+// published is what a pass composed at the wanted builds, for publishComposed: under mu.
+type published struct {
+	scope frombus.Scope
+	fps   map[string]string // by module, the wanted fingerprint
+	comps map[string]delivery.Composed
+	held  map[string]string
+	// placed is the modules the node's placement puts here, ran what runs of each module (by its composition's FP).
+	placed []string
+	ran    map[string]string
+}
+
+// publishComposed writes the node's composition state from the last pass that composed, when one asked it (pubDue).
+func (c *Composer) publishComposed(ctx context.Context) {
+	c.mu.Lock()
+	due, at := c.pubDue, c.pubAt
+	c.pubDue = false
+	c.mu.Unlock()
+	if !due || c.env.ComposedState == nil || at == nil {
+		return
+	}
+	wrote, deleted, err := c.writeComposed(ctx, at)
+	if err != nil {
+		c.sayComposed("this node's compositions are not kept in its composition state; " + c.oweComposed() + ": " + err.Error())
+		return
+	}
+	c.mu.Lock()
+	c.pubTries = 0
+	c.mu.Unlock()
+	c.sayComposed("")
+	if wrote+deleted > 0 {
+		c.env.Say(fmt.Sprintf("this node's composition state: %d key(s) written, %d deleted", wrote, deleted))
+	}
+}
+
+// newestFPs is, of the modules placed here, the fingerprint each is composed at for the state beyond the wanted ones:
+// the indexer's, where the builder holds a done build of it; else the want's; else what runs of it. A module with none
+// is left out.
+func (c *Composer) newestFPs(ctx context.Context, at *published) map[string]string {
+	out := map[string]string{}
+	r := reader{c: c}
+	for _, module := range at.placed {
+		c.mu.Lock()
+		fp2 := c.modules[module].FP2
+		c.mu.Unlock()
+		if fp2 != "" {
+			if b, err := r.Build(ctx, module, fp2); err == nil && b != nil && b.State == delivery.BuildDone {
+				out[module] = fp2
+				continue
+			}
+		}
+		if fp, ok := at.fps[module]; ok {
+			out[module] = fp
+		} else if fp, ok := at.ran[module]; ok {
+			out[module] = fp
+		}
+	}
+	return out
+}
+
+// writeComposed works out the state's keys from at and writes those that differ, then deletes what is past keeping.
+func (c *Composer) writeComposed(ctx context.Context, at *published) (wrote, deleted int, err error) {
+	values, err := c.composedValues(ctx, at)
+	if err != nil {
+		return 0, 0, err
+	}
+	c.pubWrite.Lock()
+	defer c.pubWrite.Unlock()
+	if c.pubKept == nil {
+		kept, err := c.env.ComposedState.Entries(ctx)
+		if err != nil {
+			return 0, 0, fmt.Errorf("the state cannot be read: %w", err)
+		}
+		c.pubKept = kept
+	}
+	keys := make([]string, 0, len(values))
+	for k := range values {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, key := range keys {
+		if bytes.Equal(c.pubKept[key].Value, values[key]) {
+			continue
+		}
+		rev, err := c.env.ComposedState.Put(ctx, key, values[key])
+		if err != nil {
+			return wrote, deleted, fmt.Errorf("%s cannot be written: %w", key, err)
+		}
+		c.pubKept[key] = ComposedEntry{Value: values[key], Revision: rev}
+		wrote++
+	}
+	for _, key := range c.pastKeeping() {
+		if err := c.env.ComposedState.Delete(ctx, key); err != nil {
+			return wrote, deleted, fmt.Errorf("%s cannot be deleted: %w", key, err)
+		}
+		delete(c.pubKept, key)
+		deleted++
+	}
+	return wrote, deleted, nil
+}
+
+// composedValues is every key the state should hold after the pass at, encoded.
+func (c *Composer) composedValues(ctx context.Context, at *published) (map[string][]byte, error) {
+	r := reader{c: c}
+	out := map[string][]byte{}
+	put := func(comp delivery.Composed, plans map[string]catalogue.Plan) error {
+		if comp.Module != "" && comp.Refused == "" {
+			if p, ok := plans[comp.Module]; ok {
+				p := p
+				comp.Plan = &p
+			}
+		}
+		key, err := composedKeyOf(comp)
+		if err != nil {
+			return err
+		}
+		raw, err := delivery.EncodeComposed(comp)
+		if err != nil {
+			return fmt.Errorf("the composition %s cannot be written: %w", key, err)
+		}
+		out[key] = raw
+		return nil
+	}
+	runs := []struct {
+		scope frombus.Scope
+		fps   map[string]string
+		comps map[string]delivery.Composed
+		held  map[string]string
+	}{{at.scope, at.fps, at.comps, at.held}}
+	// The newest builds, composed only where they differ from the wanted ones.
+	newest := c.newestFPs(ctx, at)
+	if !maps.Equal(newest, at.fps) {
+		scope := at.scope
+		scope.KeptAt = map[string]string{}
+		var inOwn []string
+		c.mu.Lock()
+		for module, fp := range newest {
+			if fp != c.modules[module].FP2 {
+				scope.KeptAt[module] = fp
+			}
+		}
+		c.mu.Unlock()
+		for _, m := range at.scope.InOwn {
+			if _, given := newest[m]; !given {
+				inOwn = append(inOwn, m)
+			}
+		}
+		scope.InOwn = inOwn
+		comps, _, held, err := frombus.Compose(ctx, r, c.env.Mesh, scope, newest)
+		switch {
+		case err != nil && BusFailed(err):
+			return nil, fmt.Errorf("the newest builds could not be composed: %w", err)
+		case err != nil:
+			// A refusal of the node at its newest builds is no refusal of what it applies: the wanted keys are written,
+			// and the newest are said (each module's have says what holds it when its want moves).
+			c.sayComposed("this node's newest builds do not compose, so its composition state holds the wanted ones alone: " + err.Error())
+		default:
+			for key, comp := range comps {
+				comps[key] = c.keepRunning(comp, scope.Running)
+			}
+			runs = append(runs, struct {
+				scope frombus.Scope
+				fps   map[string]string
+				comps map[string]delivery.Composed
+				held  map[string]string
+			}{scope, newest, comps, held})
+		}
+	}
+	for i, run := range runs {
+		plans, _, err := frombus.PlansHeld(ctx, r, c.env.Mesh, run.scope)
+		if err != nil && BusFailed(err) {
+			return nil, fmt.Errorf("the plans could not be composed: %w", err)
+		}
+		// A node whose plans refuse it whole hands the provisioner nothing, as the provisioner's own composing did: no
+		// key carries a plan then.
+		for _, comp := range run.comps {
+			if comp.Module == "" && i > 0 {
+				continue // the node's own composition is the wanted pass's alone
+			}
+			if err := put(comp, plans); err != nil {
+				return nil, err
+			}
+		}
+		for module, why := range run.held {
+			fp, ok := run.fps[module]
+			if !ok || module == agent.NodeModule {
+				continue
+			}
+			if err := put(delivery.Composed{Node: c.env.Node, Module: module, FP: fp, Refused: why}, nil); err != nil {
+				return nil, err
+			}
+		}
+	}
+	return out, nil
+}
+
+// composedKeyOf is a composition's key in the state.
+func composedKeyOf(comp delivery.Composed) (string, error) {
+	if comp.Module == "" {
+		return delivery.ComposedNodeKey(comp.Node)
+	}
+	return delivery.ComposedKey(comp.Node, comp.Module, comp.FP)
+}
+
+// pastKeeping is, of the module keys the state holds, those whose fingerprint is not among the five its module wrote
+// last (delivery.ComposedKeep, by revision) and that no want names (ADR 0593 §6). Under pubWrite.
+func (c *Composer) pastKeeping() []string {
+	c.mu.Lock()
+	wanted := map[string]string{}
+	for module, w := range c.wants {
+		wanted[module] = w.FP
+	}
+	c.mu.Unlock()
+	type kept struct {
+		key string
+		fp  string
+		rev uint64
+	}
+	byModule := map[string][]kept{}
+	for key, e := range c.pubKept {
+		_, module, fp, isNode, err := delivery.ParseComposedKey(key)
+		if err != nil || isNode {
+			continue
+		}
+		byModule[module] = append(byModule[module], kept{key, fp, e.Revision})
+	}
+	var out []string
+	for module, ks := range byModule {
+		sort.Slice(ks, func(i, j int) bool { return ks[i].rev > ks[j].rev })
+		for i, k := range ks {
+			if i < delivery.ComposedKeep || wanted[module] == k.fp {
+				continue
+			}
+			out = append(out, k.key)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// oweComposed keeps the state due and has the loop make a pass again after the growing bound, as owePackages does.
+func (c *Composer) oweComposed() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.pubDue = true
+	c.wait = LaterWait(c.pubTries)
+	c.pubTries++
+	c.owed.Store(true)
+	return fmt.Sprintf("tried again at %s (try %d)", time.Now().Add(c.wait).Format("15:04:05"), c.pubTries)
+}
+
+// sayComposed says a line about the state once until it changes; "" clears it.
+func (c *Composer) sayComposed(line string) {
+	c.mu.Lock()
+	same := c.pubSaid == line
+	c.pubSaid = line
+	c.mu.Unlock()
+	if !same && line != "" {
+		c.env.Say(line)
+	}
+}
+
+// ranOf is, of what runs, each module's fingerprint by its composition (the node's own left out).
+func ranOf(running []delivery.Composed) map[string]string {
+	out := map[string]string{}
+	for _, comp := range running {
+		if comp.Module != "" && comp.FP != "" && !strings.EqualFold(comp.Module, agent.NodeModule) {
+			out[comp.Module] = comp.FP
+		}
+	}
+	return out
+}
diff --git a/internal/selfcompose/composedstate_test.go b/internal/selfcompose/composedstate_test.go
new file mode 100644
index 0000000..0ea6d69
--- /dev/null
+++ b/internal/selfcompose/composedstate_test.go
@@ -0,0 +1,173 @@
+package selfcompose
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"github.com/novox/mesh-host/internal/agent"
+)
+
+// fakeComposed is a node's composition state: its keys, and every write and deletion made.
+type fakeComposed struct {
+	mu      sync.Mutex
+	kv      map[string]ComposedEntry
+	rev     uint64
+	puts    []string
+	deletes []string
+}
+
+func (f *fakeComposed) Entries(context.Context) (map[string]ComposedEntry, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := map[string]ComposedEntry{}
+	for k, v := range f.kv {
+		out[k] = v
+	}
+	return out, nil
+}
+
+func (f *fakeComposed) Put(_ context.Context, key string, value []byte) (uint64, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.rev++
+	f.kv[key] = ComposedEntry{Value: value, Revision: f.rev}
+	f.puts = append(f.puts, key)
+	return f.rev, nil
+}
+
+func (f *fakeComposed) Delete(_ context.Context, key string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.kv, key)
+	f.deletes = append(f.deletes, key)
+	return nil
+}
+
+func (f *fakeComposed) written() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return slices.Clone(f.puts)
+}
+
+// novox/hq ADR 0593 §6: the node publishes each composition it makes in its composition state, a record never applied:
+// the wanted module and the node's own at the first pass; nothing again for a pass that changes nothing; a done build
+// of a module placed here that no want names, at its trunk's build, written once as its own key (before any want moves);
+// the same build landing again writes nothing. And a module's keys are kept while among the five it wrote last or named
+// by a want, and deleted otherwise.
+func TestTheNodePublishesItsCompositions(t *testing.T) {
+	b := newFakeBus()
+	fp := delivery.SourcePrefix2 + strings.Repeat("a", 64)
+	ofp := delivery.SourcePrefix2 + strings.Repeat("c", 64)
+	digest := delivery.ManifestDigest([]byte(lemurs))
+	oldie := `{"module":"oldie","version":"1","capabilities":["systemd"],"resources":[{"id":"service","type":"service","unit":"oldie.service","state":"running","boot":"enabled"}]}`
+	odigest := delivery.ManifestDigest([]byte(oldie))
+	for d, json := range map[string]string{digest: lemurs, odigest: oldie} {
+		man, _ := delivery.EncodeManifest(delivery.Manifest{Module: map[string]string{digest: "lemurs", odigest: "oldie"}[d], JSON: json})
+		key, _ := delivery.ManifestsKey(d)
+		b.kv[delivery.ManifestsBucket+"/"+key] = man
+	}
+	state := &fakeComposed{kv: map[string]ComposedEntry{}}
+	env := b.env()
+	env.ComposedState = state
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	c := New(env)
+	out, err := c.Watch(ctx, "n1.>")
+	if err != nil {
+		t.Fatal(err)
+	}
+	place, _ := delivery.EncodePlacement(delivery.Placement{Node: "n1", Decided: delivery.NodeDecided{Hub: true, Address: "10.77.0.1"},
+		Modules: []delivery.PlacedModule{{Module: "lemurs"}, {Module: "oldie"}}})
+	have, _ := delivery.EncodeHaveNode(delivery.HaveNode{Record: &delivery.NodeRecord{Node: "n1", TunnelKey: "k", SealingKey: "sk", Capabilities: []string{"systemd"}}})
+	mod, _ := delivery.EncodeModule(delivery.Module{FP2: fp, Manifest: digest, Repository: "novox/x", Commit: "c"})
+	omod, _ := delivery.EncodeModule(delivery.Module{FP2: ofp, Manifest: odigest, Repository: "novox/o", Commit: "c"})
+	want, _ := delivery.EncodeWant(delivery.Want{FP: fp, Self: true})
+	nodeWant, _ := delivery.EncodeNodeWant(delivery.NodeWant{Self: true})
+	b.put(t, delivery.PlacementBucket, "placement.n1", place)
+	b.put(t, delivery.HaveBucket, "n1.node", have)
+	b.put(t, delivery.ModulesBucket, "lemurs", mod)
+	b.put(t, delivery.ModulesBucket, "oldie", omod)
+	b.put(t, delivery.AssignerWantsBucket, "want.n1.lemurs", want)
+	b.put(t, delivery.AssignerWantsBucket, "want.n1.node", nodeWant)
+	for _, bucket := range []string{delivery.AssignerWantsBucket, delivery.PlacementBucket, delivery.HaveBucket, delivery.ModulesBucket, ResolvedBucket, delivery.BuilderBuildsBucket} {
+		b.send(bucket, agent.Update{Caught: true})
+	}
+	for u := next(t, out); !u.Caught; u = next(t, out) {
+	}
+	lemursKey, _ := delivery.ComposedKey("n1", "lemurs", fp)
+	oldieKey, _ := delivery.ComposedKey("n1", "oldie", ofp)
+	waitFor := func(what string, ok func([]string) bool) []string {
+		t.Helper()
+		deadline := time.Now().Add(5 * time.Second)
+		for time.Now().Before(deadline) {
+			if got := state.written(); ok(got) {
+				return got
+			}
+			time.Sleep(10 * time.Millisecond)
+		}
+		b.mu.Lock()
+		t.Logf("said: %q", b.said)
+		b.mu.Unlock()
+		t.Fatalf("%s: written %v", what, state.written())
+		return nil
+	}
+	first := waitFor("the first pass", func(got []string) bool { return len(got) >= 2 })
+	if !slices.Equal(first, []string{lemursKey, "n1.node"}) {
+		t.Errorf("the first pass wrote %v, want the wanted module's key and the node's own", first)
+	}
+	if raw := state.kv[lemursKey].Value; raw != nil {
+		comp, err := delivery.DecodeComposed(raw)
+		if err != nil || comp.Module != "lemurs" || comp.FP != fp || len(comp.Resources) == 0 {
+			t.Errorf("the published composition of lemurs: %+v, %v", comp, err)
+		}
+	}
+	// A pass that changes nothing writes nothing.
+	setFor(t, &askedWithin, 0)
+	if _, err := c.ComposeNow(ctx); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(50 * time.Millisecond)
+	if got := state.written(); len(got) != 2 {
+		t.Errorf("a pass that changed nothing wrote %v", got[2:])
+	}
+	// oldie's trunk build is done: its key at that build is written once, though no want names it.
+	build, _ := delivery.EncodeBuilderBuild(delivery.BuilderBuild{State: delivery.BuildDone, Manifest: odigest})
+	bkey, _ := delivery.BuilderBuildKey("oldie", ofp)
+	b.mu.Lock()
+	b.kv[delivery.BuilderBuildsBucket+"/"+bkey] = build
+	b.mu.Unlock()
+	b.put(t, delivery.BuilderBuildsBucket, bkey, build)
+	got := waitFor("oldie's done build", func(got []string) bool { return len(got) >= 3 })
+	if got[2] != oldieKey {
+		t.Errorf("the done build of oldie wrote %v, want %s", got[2:], oldieKey)
+	}
+	b.put(t, delivery.BuilderBuildsBucket, bkey, build)
+	time.Sleep(100 * time.Millisecond)
+	if got := state.written(); len(got) != 3 {
+		t.Errorf("the same build landing again wrote %v", got[3:])
+	}
+
+	// What is kept: the five keys of a module written last, and one a want names; the rest is deleted.
+	keep := New(b.env())
+	keep.pubKept = map[string]ComposedEntry{}
+	var keys []string
+	for i, ch := range "123456" {
+		key, _ := delivery.ComposedKey("n1", "lemurs", delivery.SourcePrefix2+strings.Repeat(string(ch), 64))
+		keys = append(keys, key)
+		keep.pubKept[key] = ComposedEntry{Revision: uint64(10 + i)}
+	}
+	keep.pubKept["n1.node"] = ComposedEntry{Revision: 1}
+	if past := keep.pastKeeping(); !slices.Equal(past, []string{keys[0]}) {
+		t.Errorf("past keeping: %v, want the oldest of six, %s", past, keys[0])
+	}
+	keep.wants = map[string]delivery.Want{"lemurs": {FP: delivery.SourcePrefix2 + strings.Repeat("1", 64)}}
+	if past := keep.pastKeeping(); len(past) != 0 {
+		t.Errorf("past keeping with a want naming the oldest: %v, want none", past)
+	}
+}
diff --git a/internal/selfcompose/data.go b/internal/selfcompose/data.go
index bdcb148..6c1e86d 100644
--- a/internal/selfcompose/data.go
+++ b/internal/selfcompose/data.go
@@ -9,9 +9,9 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/frombus"
 )
 
 // **The data items of each module placed here, as this engine composed them** (novox/hq ADR 0577 clause 1). After a
diff --git a/internal/selfcompose/data_test.go b/internal/selfcompose/data_test.go
index 3b7112c..d88f0a1 100644
--- a/internal/selfcompose/data_test.go
+++ b/internal/selfcompose/data_test.go
@@ -10,8 +10,8 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose/frombus"
 
 	"github.com/novox/mesh-host/internal/agent"
 )
diff --git a/internal/selfcompose/selfcompose.go b/internal/selfcompose/selfcompose.go
index 67e9d66..41c4203 100644
--- a/internal/selfcompose/selfcompose.go
+++ b/internal/selfcompose/selfcompose.go
@@ -29,10 +29,11 @@ import (
 	"time"
 
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/overlay"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+	"github.com/novox/mesh-host/internal/compose/resolution"
 
 	"github.com/nats-io/nats.go"
 
@@ -93,6 +94,9 @@ type Env struct {
 	// Packages is this node's key of the engine's state packages (novox/hq ADR 0565 §6), written after a pass that
 	// handed something new when the packages its compositions declare differ. Nil keeps none.
 	Packages PackagesStore
+	// ComposedState is this node's composition state `composed-<node>` (novox/hq ADR 0593 §6), where every composition
+	// a pass makes is published for its readers (publishComposed). Nil keeps none.
+	ComposedState ComposedStore
 }
 
 // VaultSecretChanged is the vault's event that a secret changed: a name and its generation, never a value.
@@ -175,6 +179,15 @@ type Composer struct {
 	pkgsWrite    sync.Mutex
 	pkgsKept     []byte
 	pkgsRead     bool
+	// pubAt is what the last pass that composed made, and pubDue whether the composition state is to be written from it
+	// (publishComposed); pubTries and pubSaid are as the packages' are. Under mu. pubKept is what the state holds, read
+	// once per run, under pubWrite.
+	pubAt    *published
+	pubDue   bool
+	pubTries int
+	pubSaid  string
+	pubWrite sync.Mutex
+	pubKept  map[string]ComposedEntry
 }
 
 // Pass is how one pass went, as the node-engine's verb compose answers it.
@@ -323,7 +336,7 @@ func (c *Composer) inputs() []input {
 }
 
 // takeBuildDone says whether a build that landed is one this node composes from: done, of a module it wants at that
-// build or whose trunk's build it is. Every other build, and a build not done, moves nothing.
+// build, or wanted or placed here whose trunk's build it is. Every other build, and a build not done, moves nothing.
 func (c *Composer) takeBuildDone(u agent.Update) bool {
 	// Any write or delete of a build's key forgets the build kept as done: the builder claims a done key again as a new
 	// revision (a gone step, issue 1937), which lands done with other artifacts.
@@ -340,8 +353,14 @@ func (c *Composer) takeBuildDone(u agent.Update) bool {
 	c.mu.Lock()
 	w, wanted := c.wants[module]
 	m := c.modules[module]
+	placedHere := false
+	for _, pm := range c.placements[c.env.Node].Modules {
+		placedHere = placedHere || pm.Module == module
+	}
 	c.mu.Unlock()
-	if !wanted || (w.FP != fp && m.FP2 != fp) {
+	// A module placed here is composed at its trunk's build once that is done, for the composition state, before its
+	// want moves (ADR 0593 §6).
+	if !(wanted && w.FP == fp) && !((wanted || placedHere) && m.FP2 == fp) {
 		return false
 	}
 	b, err := delivery.DecodeBuilderBuild(u.Value)
@@ -468,6 +487,7 @@ func (c *Composer) Watch(ctx context.Context, _ string) (<-chan agent.Update, er
 			}
 			c.publishData(ctx)
 			c.publishPackages(ctx)
+			c.publishComposed(ctx)
 			if c.owed.Load() {
 				wait, _ := c.waitNow()
 				c.env.Say(fmt.Sprintf("the node composes again in %s: a read on the bus did not answer", wait))
@@ -734,7 +754,7 @@ func (c *Composer) takeValue(u agent.Update) {
 	defer c.mu.Unlock()
 	// Only a value its source lays: a default is the composition's already, as the controller reads them
 	// (catalogue.LaidValue, issue 1126, C2: Element's links blanked by a laid default).
-	v, laid := catalogue.LaidValue(u.Value)
+	v, laid := resolution.LaidValue(u.Value)
 	if u.Deleted || !laid {
 		delete(c.values[module], key)
 		return
@@ -935,6 +955,23 @@ func (c *Composer) compose(ctx context.Context) []agent.Update {
 		}
 	}
 	pass.Handed = len(out)
+	// The composition state is written from this pass (ADR 0593 §6): every pass that composed, since a build done or a
+	// plan changed moves what is published though nothing new is handed.
+	placedMods := make([]string, 0, len(own.Modules))
+	for _, m := range own.Modules {
+		placedMods = append(placedMods, m.Module)
+	}
+	sort.Strings(placedMods)
+	pubComps := make(map[string]delivery.Composed, len(compositions))
+	for key, comp := range compositions {
+		if comp.Module == "" && !nodeWanted {
+			continue
+		}
+		pubComps[key] = comp
+	}
+	c.pubAt = &published{scope: scope, fps: maps.Clone(fps), comps: pubComps, held: maps.Clone(held), placed: placedMods,
+		ran: ranOf(running)}
+	c.pubDue = true
 	// The data items are kept again after a pass that handed something new, and after the run's first (ADR 0577 clause 1).
 	c.dataDue = c.dataDue || len(out) > 0 || c.dataKept == nil
 	// And the node's packages after the same passes (ADR 0565 §6): written only when they differ.
@@ -1342,7 +1379,7 @@ func (r reader) Served(ctx context.Context, node, module string, keys []string)
 		if err != nil {
 			return nil, err
 		}
-		value, laid := catalogue.LaidValue(raw)
+		value, laid := resolution.LaidValue(raw)
 		if raw == nil || !laid {
 			continue
 		}
diff --git a/internal/selfcompose/selfcompose_test.go b/internal/selfcompose/selfcompose_test.go
index d14cde2..a9e663a 100644
--- a/internal/selfcompose/selfcompose_test.go
+++ b/internal/selfcompose/selfcompose_test.go
@@ -18,12 +18,12 @@ import (
 	"testing"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/buscompose"
-	"git.novox.be/novox/mesh-sdk/go/compose"
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/overlay"
 	"github.com/nats-io/nats.go"
+	"github.com/novox/mesh-host/internal/compose"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+	"github.com/novox/mesh-host/internal/nodegrant"
 
 	"github.com/novox/mesh-host/internal/agent"
 )
@@ -81,15 +81,12 @@ func (b *fakeBus) put(t *testing.T, bucket, key string, value []byte) {
 	b.send(bucket, agent.Update{Key: key, Value: value})
 }
 
-// grantAllows says whether the node's grant (buscompose.PermissionsFor, KindNode) lets it watch or read pattern of
+// grantAllows says whether the node's grant (the grants part's, nodegrant.For) lets it watch or read pattern of
 // bucket: the consumer a watch or a get makes (`$JS.API.CONSUMER.CREATE.KV_<bucket>.<name>.$KV.<bucket>.<pattern>`)
 // and the stream's information, matched as the bus matches a permission against a subject.
 func grantAllows(t *testing.T, node, bucket, pattern string) bool {
 	t.Helper()
-	perms, err := buscompose.PermissionsFor(buscompose.Principal{Kind: buscompose.KindNode, Node: node})
-	if err != nil {
-		t.Fatal(err)
-	}
+	perms := nodegrant.For(node)
 	allowed := func(subject string) bool {
 		for _, deny := range perms.PublishDeny {
 			if subjectMatches(deny, subject) {
@@ -529,7 +526,9 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 
 	// Issue 774, 2026-10-30 19:30: node-tools' want moved to a build not yet done, and the node stayed refused after it
 	// landed until another input moved. A done build of a module the node wants, at its want's or the trunk's build,
-	// makes a pass; a build not done, of another build or of a module not wanted, makes none.
+	// makes a pass, and so does one of a module placed here at its trunk's build though no want names it (novox/hq ADR 0593
+	// §6: the composition state holds it at its newest done build before its want moves); a build not done, of another
+	// build or of a module neither wanted nor placed here, makes none.
 	passes := func() int64 { return composed.Load() }
 	for _, row := range []struct {
 		name, module, fp, state string
@@ -538,7 +537,8 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		{"lemurs's wanted build, not done", "lemurs", fp, "building", false},
 		{"lemurs's wanted build lands", "lemurs", fp, delivery.BuildDone, true},
 		{"another build of lemurs", "lemurs", delivery.SourcePrefix2 + strings.Repeat("e", 64), delivery.BuildDone, false},
-		{"a module the node does not want", "oldie", delivery.SourcePrefix2 + strings.Repeat("c", 64), delivery.BuildDone, false},
+		{"a placed module no want names, at its trunk's build", "oldie", delivery.SourcePrefix2 + strings.Repeat("c", 64), delivery.BuildDone, true},
+		{"a module neither wanted nor placed here", "ghost", delivery.SourcePrefix2 + strings.Repeat("c", 64), delivery.BuildDone, false},
 	} {
 		before := passes()
 		key, _ := delivery.BuilderBuildKey(row.module, row.fp)
@@ -1455,10 +1455,7 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	if got, err := r.Served(ctx, "n2", "mailer", []string{"domain"}); err != nil || fmt.Sprint(got) != "map[domain:example.org]" {
 		t.Errorf("what n2's mailer serves: %v, %v", got, err)
 	}
-	served, err := buscompose.PermissionsFor(buscompose.Principal{Kind: buscompose.KindNode, Node: "n1", ServedReads: []string{"n2.mailer.domain"}})
-	if err != nil {
-		t.Fatal(err)
-	}
+	served := nodegrant.For("n1", "n2.mailer.domain")
 	b.mu.Lock()
 	for _, read := range b.reads {
 		ok := grantAllows(t, "n1", read[0], read[1])
diff --git a/internal/selfcompose/shadow.go b/internal/selfcompose/shadow.go
index bf6c878..4feed7c 100644
--- a/internal/selfcompose/shadow.go
+++ b/internal/selfcompose/shadow.go
@@ -7,10 +7,12 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
-	"git.novox.be/novox/mesh-sdk/go/compose/frombus"
 	"git.novox.be/novox/mesh-sdk/go/delivery"
+	"github.com/novox/mesh-host/internal/compose/frombus"
+	"github.com/novox/mesh-host/internal/judge"
 
 	"github.com/novox/mesh-host/internal/agent"
 )
@@ -53,6 +55,8 @@ type Shadow struct {
 	// after a bound (laterAgain), whether or not an input moves (issue 1126, 2026-10-28: ace kept "the vault's own: not
 	// yet ... no responders" in its answer to seed-7).
 	owed bool
+	// ready says this run read every input once: the verb compose-candidate composes only then (ComposeCandidate).
+	ready atomic.Bool
 }
 
 // answeredAt is what one proposal's answer was composed at: its keys' revisions, by node, and the changes of each input.
@@ -145,6 +149,8 @@ func (s *Shadow) Run(ctx context.Context) error {
 	s.retry = map[string]bool{}
 	s.c = New(s.c.env)
 	s.mu.Unlock()
+	s.ready.Store(false)
+	defer s.ready.Store(false)
 	c := s.c
 	node := c.env.Node
 	// In inputWords' order.
@@ -237,6 +243,7 @@ func (s *Shadow) Run(ctx context.Context) error {
 			if ready = all(caught); !ready {
 				continue
 			}
+			s.ready.Store(true)
 			dirty = true
 		}
 		if dirty {
@@ -459,7 +466,7 @@ func (s *Shadow) answerAll(ctx context.Context) {
 			}
 		}
 		if ok {
-			a = delivery.FitAnswer(a, delivery.MaxAnswerBytes)
+			a = judge.FitAnswer(a, delivery.MaxAnswerBytes)
 			next[proposal] = a
 			c.env.Say(fmt.Sprintf("answered placement candidate %s in %s: %s", proposal, took.Round(time.Millisecond), a.Verdict))
 		} else {
diff --git a/internal/takein/takein.go b/internal/takein/takein.go
new file mode 100644
index 0000000..657ab45
--- /dev/null
+++ b/internal/takein/takein.go
@@ -0,0 +1,134 @@
+// Package takein is the one rule that turns a builder's done key into the manifest the mesh composes a module from
+// (issue 1126): the module's manifest resolved with what its build made. It is mesh-controller's take-in of a done key
+// (cmd/mesh-controller/key_takein.go builtOfKey, unpackTexts and Manifest.Resolve) moved into the SDK, so a node agent
+// composing its own modules (novox/hq ADR 0547 §2) composes from the same built manifest the controller composes from:
+// every artifact a resource names resolved to its reference and digest, a TypeScript bundle's launchers, and, for a
+// moved module, each template's text read back from its templates archive and what its build keeps for the
+// provisioner (catalogue.Handed). Composing from the manifest the indexer read instead hands no moved module and
+// leaves every artifact unbuilt.
+//
+// It reads nothing itself: the archive is read through the caller's Archive, from wherever the caller reaches the
+// artifact store.
+package takein
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+)
+
+// Archive reads the archive a recorded reference names (catalogue.Recorded: the artifact store's address left out),
+// checked against its digest.
+type Archive func(ctx context.Context, reference, digest string) ([]byte, error)
+
+// Manifest is m, as its manifest at b's fingerprint reads, resolved with what b made: the built manifest. b must be done
+// and every artifact must name its reference.
+// A templated module's templates archive is read through archive; a module without templates reads none, and archive
+// may then be nil.
+func Manifest(ctx context.Context, m catalogue.Manifest, b delivery.BuilderBuild, archive Archive) (catalogue.Manifest, error) {
+	if b.State != delivery.BuildDone {
+		return catalogue.Manifest{}, fmt.Errorf("takein: the build of %s is %s, not done: nothing to resolve it with", m.Module, b.State)
+	}
+	// **A done key whose artifact names no reference is waited for, never composed from** (novox/hq ADR 0498 §8), in the
+	// controller's words (mesh-controller internal/builderkeys Key.Says): a key done before R4e, or a candidate's image or
+	// package not yet built again for the trunk.
+	var missing []string
+	for _, a := range b.Artifacts {
+		if strings.TrimSpace(a.Reference) == "" {
+			missing = append(missing, a.Name)
+		}
+	}
+	if len(missing) > 0 {
+		return catalogue.Manifest{}, fmt.Errorf("takein: the build of %s is done and waits for the reference of %s",
+			m.Module, strings.Join(missing, ", "))
+	}
+	built, err := Built(ctx, m, b.Artifacts, archive)
+	if err != nil {
+		return catalogue.Manifest{}, err
+	}
+	resolved, err := m.Resolve(built)
+	if err != nil {
+		return catalogue.Manifest{}, fmt.Errorf("takein: the build of %s does not resolve: %w", m.Module, err)
+	}
+	return resolved, nil
+}
+
+// Built is each of a done key's artifacts as catalogue.Manifest.Resolve reads it: its recorded reference and digest, a
+// TypeScript bundle's launchers by the build modules' one rule (catalogue.Launchers), and, for the archive a module packs
+// its templates into, each template's text read back from that archive.
+func Built(ctx context.Context, m catalogue.Manifest, artifacts []delivery.BuiltArtifact, archive Archive) ([]catalogue.Built, error) {
+	declared := map[string]catalogue.Artifact{}
+	if m.Build != nil {
+		for _, a := range m.Build.Artifacts {
+			declared[a.Name] = a
+		}
+	}
+	templates := ""
+	if m.Templated() {
+		templates = catalogue.TemplatesArtifact(m)
+	}
+	var out []catalogue.Built
+	for _, a := range artifacts {
+		d := declared[a.Name]
+		kind := a.Kind
+		if kind == "" {
+			kind = d.Kind
+		}
+		b := catalogue.Built{Name: a.Name, Kind: kind, Reference: catalogue.Recorded(a.Reference), Digest: a.Digest}
+		if launchers := catalogue.Launchers(d.Language, d.Entrypoints); len(launchers) > 0 {
+			b.Launchers = launchers
+		}
+		if a.Name == templates && templates != "" {
+			if archive == nil {
+				return nil, fmt.Errorf("takein: %s packs its templates into %q, and nothing here reads the artifact store",
+					m.Module, a.Name)
+			}
+			body, err := archive(ctx, b.Reference, b.Digest)
+			if err != nil {
+				return nil, fmt.Errorf("takein: the templates archive %q of %s cannot be read from the artifact store: %w",
+					a.Name, m.Module, err)
+			}
+			if b.Texts, err = UnpackTexts(body); err != nil {
+				return nil, fmt.Errorf("takein: the templates archive %q of %s cannot be read back: %w", a.Name, m.Module, err)
+			}
+		}
+		out = append(out, b)
+	}
+	return out, nil
+}
+
+// UnpackTexts is every regular file of a packed templates archive (gzip over tar), by its path inside it.
+func UnpackTexts(body []byte) (map[string]string, error) {
+	zipped, err := gzip.NewReader(bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	defer zipped.Close()
+	reader := tar.NewReader(zipped)
+	texts := map[string]string{}
+	for {
+		header, err := reader.Next()
+		if errors.Is(err, io.EOF) {
+			return texts, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+		if header.Typeflag != tar.TypeReg {
+			continue
+		}
+		text, err := io.ReadAll(io.LimitReader(reader, 16<<20))
+		if err != nil {
+			return nil, err
+		}
+		texts[strings.TrimPrefix(header.Name, "./")] = string(text)
+	}
+}
diff --git a/internal/validate/sdk_test.go b/internal/validate/sdk_test.go
new file mode 100644
index 0000000..d946fff
--- /dev/null
+++ b/internal/validate/sdk_test.go
@@ -0,0 +1,31 @@
+package validate
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+)
+
+// The SDK's validator speaks the copied parser's vocabulary version (issue 1353 AC3).
+func TestVersionIsTheParsersVersion(t *testing.T) {
+	if Version != declaration.Version {
+		t.Fatalf("validate.Version = %d, declaration.Version = %d", Version, declaration.Version)
+	}
+}
+
+// A body of another declaration version is refused whole, by both the validator and the parser (AC3). The body is
+// the shape mesh-host's validate_test.go uses for its good declaration, with the version changed.
+func TestAnotherVersionIsRefusedWhole(t *testing.T) {
+	body := `{"declaration": 99, "resources": [{"id": "d", "type": "directory", "path": "/var/lib/x", "mode": "0755"}]}`
+	problems := Declaration([]byte(body))
+	if len(problems) == 0 {
+		t.Fatal("a declaration of another version was taken")
+	}
+	_, err := declaration.Parse([]byte(body))
+	var refused *declaration.RefusalError
+	if !errors.As(err, &refused) || strings.Join(refused.Problems, "\n") != strings.Join(problems, "\n") {
+		t.Fatalf("the parser and the validator disagree: %v / %v", err, problems)
+	}
+}
diff --git a/internal/validate/validate.go b/internal/validate/validate.go
new file mode 100644
index 0000000..1291866
--- /dev/null
+++ b/internal/validate/validate.go
@@ -0,0 +1,42 @@
+// Package validate is the node-engine's own judgement of a declaration, for whoever must know before
+// a declaration is sent whether a machine would take it (novox/hq to-be 45 §4, D1; §9, the merge gate).
+//
+// **One validator.** The controller composed declarations the host then refused whole — a manifest
+// the catalogue check passed (novox/hq issue 236), a consumer's identity too long for the machine's
+// names (issue 263) — because the only validator was the one the host runs as it applies. A second,
+// written in the controller from the host's rules, would drift from them the first time either
+// changed. So the host's own parsing is exported here, unchanged: what the controller's self-check and
+// the merge gate run is what every machine runs.
+//
+// Copied from mesh-host at commit 619e14aa8e572c5056e3d2a2412c7f8b364bf840 (validate/validate.go), unchanged but for
+// the import path of the parser, which is mesh-sdk's go/declaration (novox/hq ADR 0453 clause 3, ADR 0446 clause 4).
+// mesh-host keeps its own copy until release 4b.
+//
+// It judges a declaration as it arrives over the link: actions are refused, as the host refuses them
+// from the link (novox/hq ADR 0005). Nothing here touches a machine.
+package validate
+
+import (
+	"errors"
+
+	"git.novox.be/novox/mesh-sdk/go/declaration"
+)
+
+// Declaration is every problem the node-engine would refuse a declaration for, each in its own words;
+// nil when it would take it. The body is the declaration as the controller composes it — the bytes a
+// signature is made over — not the signed envelope.
+func Declaration(raw []byte) []string {
+	_, err := declaration.Parse(raw)
+	if err == nil {
+		return nil
+	}
+	var refused *declaration.RefusalError
+	if errors.As(err, &refused) {
+		return refused.Problems
+	}
+	return []string{err.Error()}
+}
+
+// Version is the declaration vocabulary this validator speaks: a declaration of another version is
+// refused whole by Declaration, as by the host.
+const Version = declaration.Version
diff --git a/internal/validate/validate_test.go b/internal/validate/validate_test.go
new file mode 100644
index 0000000..51ade73
--- /dev/null
+++ b/internal/validate/validate_test.go
@@ -0,0 +1,50 @@
+package validate
+
+import (
+	"strings"
+	"testing"
+)
+
+// **The validator a controller imports is the host's**: a declaration the host takes passes, and one
+// it refuses is refused with the host's own words, every problem at once.
+func TestTheValidatorIsTheHosts(t *testing.T) {
+	good := `{"declaration": 1, "resources": [{"id": "d", "type": "directory", "path": "/var/lib/x", "mode": "0755"}]}`
+	if problems := Declaration([]byte(good)); problems != nil {
+		t.Fatalf("a declaration the host takes was refused: %v", problems)
+	}
+	// And one carrying the lease epoch and sequence the controller sends it under (novox/hq to-be 45
+	// §6): a controller validating with this package may send them.
+	ordered := `{"declaration": 1, "epoch": 57, "sequence": 3, "resources": [{"id": "d", "type": "directory", "path": "/var/lib/x", "mode": "0755"}]}`
+	if problems := Declaration([]byte(ordered)); problems != nil {
+		t.Fatalf("a declaration carrying its order was refused: %v", problems)
+	}
+	// And one carrying a file's owner-at-runtime and the files the provisioner fills (novox/hq ADR 0349 §5): the
+	// reader takes them before any controller sends them.
+	owned := `{"declaration": 1, "filled_files": ["/etc/x"], "resources": [{"id": "f", "type": "file", "path": "/etc/x", "content": "a", "owner-at-runtime": "owned"}]}`
+	if problems := Declaration([]byte(owned)); problems != nil {
+		t.Fatalf("a declaration saying who owns a file at runtime was refused: %v", problems)
+	}
+	// And one naming the provisioner client's account (novox/hq ADR 0349 §4).
+	named := `{"declaration": 1, "provisioner_account": "mesh-node-provisioner", "filled_files": ["/etc/x"], "resources": [{"id": "f", "type": "file", "path": "/etc/x", "content": "a", "owner-at-runtime": "owned"}]}`
+	if problems := Declaration([]byte(named)); problems != nil {
+		t.Fatalf("a declaration naming the provisioner client's account was refused: %v", problems)
+	}
+	for _, bad := range []string{
+		`{"declaration": 1, "provisioner_account": "root", "resources": [{"id": "f", "type": "file", "path": "/etc/x", "content": "a"}]}`,
+		`{"declaration": 1, "filled_files": ["/etc/none"], "resources": [{"id": "f", "type": "file", "path": "/etc/x", "content": "a", "owner-at-runtime": "owned"}]}`,
+		`{"declaration": 1, "resources": []}`,
+		`{"declaration": 99, "resources": [{"id": "d", "type": "directory", "path": "/x"}]}`,
+		`{"declaration": 1, "resources": [{"id": "d", "type": "nothing-the-host-knows"}]}`,
+		`not json`,
+	} {
+		problems := Declaration([]byte(bad))
+		if len(problems) == 0 {
+			t.Errorf("a declaration the host refuses was passed: %s", bad)
+		}
+		for _, p := range problems {
+			if strings.TrimSpace(p) == "" {
+				t.Errorf("a problem said nothing, for %s", bad)
+			}
+		}
+	}
+}
diff --git a/testdata/beside/CAPTURED b/testdata/beside/CAPTURED
new file mode 100644
index 0000000..ae5b79a
--- /dev/null
+++ b/testdata/beside/CAPTURED
@@ -0,0 +1,30 @@
+What a test reads of another repository when no merge check has cloned it beside this one (internal/beside,
+novox/hq issue 432). Copied from the repositories at the commits below, never written by hand. Each
+module.json is kept as module.json.captured: a module.json in this repository is a module of it to the
+forge and the planner, and a merge would build and register it.
+
+The copy carries the catalogue's private details: domains, first names in module names, a node name and
+private addresses. That is acceptable while mesh-sdk is private; if it ever goes public, this copy is
+a second place to clean besides the catalogue itself.
+
+Only what go/catalogue's tests read is captured (R4b, issue 1379). Refreshed 2026-10-21 from the mains of both
+repositories; before that it was mesh-controller's copy, which still held two modules that had left the catalogue.
+
+mesh-catalog  b5dbfbb784507e211372a7c9640d91f7d6dadd84  modules/*/module.json, modules/*/files/**, modules/*/templates/**, predefined.json
+mesh-host     cdcba9ca73755854d21e4e657d7e46c32b9b5265  internal/apply/placement_guard.go
+
+To move them, from this repository's go/ directory, with the two repositories checked out beside mesh-sdk:
+
+  rm -rf testdata/beside/mesh-catalog testdata/beside/mesh-host
+  mkdir -p testdata/beside/mesh-catalog testdata/beside/mesh-host/internal/apply
+  git -C ../../mesh-catalog archive <commit> -- predefined.json ':(glob)modules/*/module.json' \
+    ':(glob)modules/*/files/**' ':(glob)modules/*/templates/**' | tar -x -C testdata/beside/mesh-catalog
+  find testdata/beside -name module.json -exec mv {} {}.captured \;
+  git -C ../../mesh-host show <commit>:internal/apply/placement_guard.go \
+    > testdata/beside/mesh-host/internal/apply/placement_guard.go.captured
+
+and write the commits here. The placement guard is kept as .captured so no Go tool reads it as this
+repository's code.
+
+mesh-networking  a74f9db508687f6fbf3c8074a2a8e195824a500a  modules/route-proxy/module.json, modules/route-proxy/files/*.env
+(route-proxy's manifest, for the node-engine's proof that it composes; sdk1-host, 2026-11-02)
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/cursor-index.theme b/testdata/beside/mesh-catalog/modules/adwaita/files/cursor-index.theme
new file mode 100644
index 0000000..d848240
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/cursor-index.theme
@@ -0,0 +1,5 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208): the default cursor theme, for programs that
+# read neither XCURSOR_THEME nor the X resources.
+[Icon Theme]
+Name=Default
+Inherits=Adwaita
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk-theme b/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk-theme
new file mode 100644
index 0000000..b98c809
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk-theme
@@ -0,0 +1 @@
+Adwaita:dark
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk2-rc-files b/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk2-rc-files
new file mode 100644
index 0000000..8a782fb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-gtk2-rc-files
@@ -0,0 +1 @@
+/usr/share/themes/Adwaita-dark/gtk-2.0/gtkrc
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-qpa-platformtheme b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-qpa-platformtheme
new file mode 100644
index 0000000..349e5d6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-qpa-platformtheme
@@ -0,0 +1 @@
+qt6ct
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-select b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-select
new file mode 100644
index 0000000..1e8b314
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-select
@@ -0,0 +1 @@
+6
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-style-override b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-style-override
new file mode 100644
index 0000000..a0da7db
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-qt-style-override
@@ -0,0 +1 @@
+Fusion
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-size b/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-size
new file mode 100644
index 0000000..a45fd52
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-size
@@ -0,0 +1 @@
+24
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-theme b/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-theme
new file mode 100644
index 0000000..cb9676b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/env-xcursor-theme
@@ -0,0 +1 @@
+Adwaita
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/gtk-settings.ini b/testdata/beside/mesh-catalog/modules/adwaita/files/gtk-settings.ini
new file mode 100644
index 0000000..a535ba4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/gtk-settings.ini
@@ -0,0 +1,9 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208), for GTK 3 and GTK 4 alike. Replaced at
+# every push; adwaita_appearance switches dark and light for the running session.
+[Settings]
+gtk-theme-name=Adwaita
+gtk-icon-theme-name=Adwaita
+gtk-cursor-theme-name=Adwaita
+gtk-cursor-theme-size=24
+gtk-font-name=Inter 11
+gtk-application-prefer-dark-theme=1
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/portals.conf b/testdata/beside/mesh-catalog/modules/adwaita/files/portals.conf
new file mode 100644
index 0000000..d2e813f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/portals.conf
@@ -0,0 +1,11 @@
+# Written by the mesh (module adwaita, novox/hq ADR 0208). Replaced at every push.
+#
+# Which portal backend answers each interface. i3 is not a desktop xdg-desktop-portal knows, so with
+# no preference it uses whichever backend happens to be installed: fine while gtk is the only one,
+# wrong the day another arrives as somebody else's dependency. Named instead. gtk also serves
+# org.freedesktop.appearance (dark or light) from GSettings, which the session's start sets.
+[preferred]
+default=gtk
+# Secrets for sandboxed programs come from the keyring's backend. Without this line no backend answers
+# the interface: gtk does not implement it, and gnome-keyring's names only GNOME as its desktop.
+org.freedesktop.impl.portal.Secret=gnome-keyring
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/qt6ct.conf b/testdata/beside/mesh-catalog/modules/adwaita/files/qt6ct.conf
new file mode 100644
index 0000000..7f396d2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/qt6ct.conf
@@ -0,0 +1,29 @@
+[Appearance]
+color_scheme_path=/usr/share/qt6ct/colors/darker.conf
+custom_palette=true
+icon_theme=Adwaita
+standard_dialogs=default
+style=Fusion
+
+[Fonts]
+fixed="JetBrainsMono Nerd Font,11,-1,5,50,0,0,0,0,0"
+general="Inter,11,-1,5,50,0,0,0,0,0"
+
+[Interface]
+activate_item_on_single_click=1
+buttonbox_layout=0
+cursor_flash_time=1000
+dialog_buttons_have_icons=1
+double_click_interval=400
+gui_effects=@Invalid()
+keyboard_scheme=2
+menus_have_icons=true
+show_shortcuts_in_context_menus=true
+stylesheets=@Invalid()
+toolbutton_style=4
+underline_shortcut=1
+wheel_scroll_lines=3
+
+[Troubleshooting]
+force_raster_widgets=1
+ignored_applications=@Invalid()
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/xinitrc-normal b/testdata/beside/mesh-catalog/modules/adwaita/files/xinitrc-normal
new file mode 100644
index 0000000..864b3cf
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/xinitrc-normal
@@ -0,0 +1,10 @@
+# The appearance (module adwaita): GSettings is where the portal reads dark or light, and the portal is
+# the only way it reaches Electron, Chromium, Firefox and flatpaks. Set at every session start to the
+# module's default; adwaita_appearance switches it for a session.
+gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark' || true
+gsettings set org.gnome.desktop.interface gtk-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface icon-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface cursor-theme 'Adwaita' || true
+gsettings set org.gnome.desktop.interface cursor-size 24 || true
+gsettings set org.gnome.desktop.interface font-name 'Inter 11' || true
+gsettings set org.gnome.desktop.interface monospace-font-name 'JetBrainsMono Nerd Font 11' || true
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/files/xresources-normal b/testdata/beside/mesh-catalog/modules/adwaita/files/xresources-normal
new file mode 100644
index 0000000..02e7ec3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/files/xresources-normal
@@ -0,0 +1,3 @@
+! adwaita: the cursor, for X programs that take it from the resources.
+Xcursor.theme: Adwaita
+Xcursor.size: 24
diff --git a/testdata/beside/mesh-catalog/modules/adwaita/module.json.captured b/testdata/beside/mesh-catalog/modules/adwaita/module.json.captured
new file mode 100644
index 0000000..bf81c83
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/adwaita/module.json.captured
@@ -0,0 +1,176 @@
+{
+  "module": "adwaita",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "adwaita_appearance",
+    "adwaita_cursor",
+    "adwaita_icons",
+    "adwaita_portal_check"
+  ],
+  "items": [
+    {
+      "collection": "environment",
+      "name": "gtk-theme",
+      "attributes": {
+        "kind": "variable",
+        "name": "GTK_THEME"
+      },
+      "template": "files/env-gtk-theme"
+    },
+    {
+      "collection": "environment",
+      "name": "gtk2-rc-files",
+      "attributes": {
+        "kind": "variable",
+        "name": "GTK2_RC_FILES"
+      },
+      "template": "files/env-gtk2-rc-files"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-qpa-platformtheme",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_QPA_PLATFORMTHEME"
+      },
+      "template": "files/env-qt-qpa-platformtheme"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-style-override",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_STYLE_OVERRIDE"
+      },
+      "template": "files/env-qt-style-override"
+    },
+    {
+      "collection": "environment",
+      "name": "qt-select",
+      "attributes": {
+        "kind": "variable",
+        "name": "QT_SELECT"
+      },
+      "template": "files/env-qt-select"
+    },
+    {
+      "collection": "environment",
+      "name": "xcursor-theme",
+      "attributes": {
+        "kind": "variable",
+        "name": "XCURSOR_THEME"
+      },
+      "template": "files/env-xcursor-theme"
+    },
+    {
+      "collection": "environment",
+      "name": "xcursor-size",
+      "attributes": {
+        "kind": "variable",
+        "name": "XCURSOR_SIZE"
+      },
+      "template": "files/env-xcursor-size"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    },
+    {
+      "collection": "shell:xinitrc:normal",
+      "name": "xinitrc-normal",
+      "template": "files/xinitrc-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package-gnome-themes-extra",
+      "type": "package",
+      "package": "gnome-themes-extra"
+    },
+    {
+      "id": "package-adwaita-icon-theme",
+      "type": "package",
+      "package": "adwaita-icon-theme"
+    },
+    {
+      "id": "package-adwaita-cursors",
+      "type": "package",
+      "package": "adwaita-cursors"
+    },
+    {
+      "id": "package-qt6ct",
+      "type": "package",
+      "package": "qt6ct"
+    },
+    {
+      "id": "package-xdg-desktop-portal-gtk",
+      "type": "package",
+      "package": "xdg-desktop-portal-gtk"
+    },
+    {
+      "id": "gtk3",
+      "type": "file",
+      "path": "${machine:account-home}/.config/gtk-3.0/settings.ini",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/gtk-settings.ini"
+    },
+    {
+      "id": "gtk4",
+      "type": "file",
+      "path": "${machine:account-home}/.config/gtk-4.0/settings.ini",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/gtk-settings.ini"
+    },
+    {
+      "id": "qt6ct",
+      "type": "file",
+      "path": "${machine:account-home}/.config/qt6ct/qt6ct.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/qt6ct.conf"
+    },
+    {
+      "id": "portals",
+      "type": "file",
+      "path": "${machine:account-home}/.config/xdg-desktop-portal/portals.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/portals.conf"
+    },
+    {
+      "id": "cursor",
+      "type": "file",
+      "path": "${machine:account-home}/.icons/default/index.theme",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/cursor-index.theme"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/adwaita-tools",
+        "binary": "adwaita-tools",
+        "loads": [
+          "adwaita-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/artifact-store-tools/files/store-names b/testdata/beside/mesh-catalog/modules/artifact-store-tools/files/store-names
new file mode 100644
index 0000000..29cab31
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/artifact-store-tools/files/store-names
@@ -0,0 +1,4 @@
+# The names the artifact store had before, from the setting older-store-names, written by the mesh.
+# artifact_store_references reads every definition under these too (novox/hq issue 323).
+# Replaced on every push; change the setting, never this file.
+older=${config:older-store-names}
diff --git a/testdata/beside/mesh-catalog/modules/artifact-store-tools/module.json.captured b/testdata/beside/mesh-catalog/modules/artifact-store-tools/module.json.captured
new file mode 100644
index 0000000..208329c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/artifact-store-tools/module.json.captured
@@ -0,0 +1,65 @@
+{
+  "module": "artifact-store-tools",
+  "version": "1",
+  "invokes": [
+    "seat:mesh-controller.artifacts",
+    "seat:mesh-controller.collect",
+    "mesh-catalog.catalog_modules",
+    "mesh-catalog.catalog_module"
+  ],
+  "tools": [
+    "artifact_store_repositories",
+    "artifact_store_usage",
+    "artifact_store_references",
+    "artifact_store_collect"
+  ],
+    "config": {
+      "older-store-names": {
+        "type": "string",
+        "description": "The names the artifact store had before, as host names or host:port separated by spaces, or none when it had no other. artifact_store_references reads every definition under these as well as under the store's current name, so an image a definition pins under one is said to be named by a definition (novox/hq issue 323).",
+        "pattern": "none|[A-Za-z0-9.:-]+( [A-Za-z0-9.:-]+)*",
+        "default": "none"
+      }
+    },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "store-names",
+      "type": "file",
+      "path": "${dir:state}/store-names",
+      "mode": "0600",
+      "trusted": false,
+      "template": "files/store-names"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/artifact-store-tools",
+        "binary": "artifact-store-tools",
+        "loads": [
+          "artifact-store-tools"
+        ],
+        "env": {
+          "MESH_ARTIFACT_STORE_CONTAINER": "mesh-registry",
+          "MESH_ARTIFACT_STORE_NAMES_FILE": "${dir:state}/store-names"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-backlight b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-backlight
new file mode 100755
index 0000000..1a3ec31
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-backlight
@@ -0,0 +1,33 @@
+#!/bin/bash
+# zephyrus-backlight + | - | PERCENT — step or set the internal panel's backlight, never below 1 %.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# The panel is the backlight beneath the eDP connector, not a name: in hybrid mode this model also
+# registers the discrete GPU's backlight (nvidia_0), which moves nothing. Writable by the video group
+# through the module's udev rule, so the vendor-key trigger needs no root.
+set -u
+STEP=5
+dev=""
+for d in /sys/class/backlight/*; do
+	[ -e "$d" ] || continue
+	case "$(readlink -f "$d")" in *-eDP-*) dev=$d; break ;; esac
+done
+if [ -z "$dev" ]; then
+	for d in /sys/class/backlight/*; do [ -e "$d" ] && { dev=$d; break; }; done
+fi
+[ -n "$dev" ] || { echo "zephyrus-backlight: no backlight" >&2; exit 1; }
+cur=$(cat "$dev/brightness")
+max=$(cat "$dev/max_brightness")
+pct=$(( cur * 100 / max ))
+case "${1:-}" in
+	+|up|Up) pct=$(( pct + STEP )) ;;
+	-|down|Down) pct=$(( pct - STEP )) ;;
+	''|*[!0-9]*) echo "usage: zephyrus-backlight + | - | PERCENT" >&2; exit 2 ;;
+	*) pct=$1 ;;
+esac
+(( pct < 1 )) && pct=1
+(( pct > 100 )) && pct=100
+new=$(( max * pct / 100 ))
+(( new < 1 )) && new=1
+printf '%s' "$new" >"$dev/brightness" || exit 1
+exec "$(dirname "$0")/zephyrus-notify" 5555 "Brightness: ${pct}%"
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-display b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-display
new file mode 100755
index 0000000..0b7d21b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-display
@@ -0,0 +1,41 @@
+#!/bin/bash
+# zephyrus-display primary | order — the laptop's internal panel among the outputs.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+#   primary  makes the internal panel X's primary output, where the bars' tray goes.
+#   order    the display key (Fn+F9, which the firmware sends as Super+P): odd workspaces to the
+#            internal panel, even ones to the first external output, or all to the panel when it
+#            is alone. The predecessor's orden-workspaces.
+#
+# The panel is found, not named: the connected output whose name starts with eDP. The predecessor
+# wrote eDP-1, which is what this model calls it today and not a promise.
+set -u
+here=$(dirname "$0")
+panel=$(xrandr --query 2>/dev/null | awk '$2 == "connected" && $1 ~ /^eDP/ { print $1; exit }')
+[ -n "$panel" ] || { echo "zephyrus-display: no internal panel connected" >&2; exit 1; }
+case "${1:-}" in
+primary)
+	exec xrandr --output "$panel" --primary
+	;;
+order)
+	external=$(xrandr --listmonitors 2>/dev/null | awk -v p="$panel" 'NR > 1 && $NF != p { print $NF; exit }')
+	[ -n "$external" ] || external=$panel
+	# i3's workspace list, one object per workspace; num and output read from each. No jq: the
+	# fields are flat strings and numbers, and rect, the only nested value, holds neither name.
+	i3-msg -t get_workspaces 2>/dev/null | sed 's/},{"id"/}\n{"id"/g' |
+		while read -r ws; do
+			num=$(printf '%s' "$ws" | grep -o '"num":-\?[0-9]*' | cut -d: -f2)
+			out=$(printf '%s' "$ws" | grep -o '"output":"[^"]*"' | cut -d'"' -f4)
+			[ -n "$num" ] && [ "$num" -ge 0 ] || continue
+			if [ $((num % 2)) -eq 0 ]; then dest=$external; else dest=$panel; fi
+			[ "$out" = "$dest" ] && continue
+			i3-msg "workspace number $num; move workspace to output $dest" >/dev/null
+		done
+	if [ "$external" = "$panel" ]; then
+		"$here/zephyrus-notify" 7780 "Workspaces: all on the panel"
+	else
+		"$here/zephyrus-notify" 7780 "Workspaces: odd on the panel, even on $external"
+	fi
+	;;
+*) echo "usage: zephyrus-display primary | order" >&2; exit 2 ;;
+esac
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-kbd-notify b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-kbd-notify
new file mode 100755
index 0000000..aee878b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-kbd-notify
@@ -0,0 +1,20 @@
+#!/bin/bash
+# zephyrus-kbd-notify — shows the keyboard backlight's level when it changes. The level itself is set
+# by the firmware and asusd (Fn+F2/F3), which tell UPower; this only listens and notifies. Started once
+# per session from the module's i3 fragment. Shipped by the mesh's asus-zephyrus-g14 module.
+#
+# One instance per session: i3 runs its `exec` lines again on an in-place restart, and the
+# predecessor's listener ran twice after one, showing every change twice.
+set -u
+here=$(dirname "$0")
+lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-kbd-notify.lock"
+exec 9>"$lock"
+flock -n 9 || exit 0
+levels=(Off Low Med High)
+dbus-monitor --system "type='signal',interface='org.freedesktop.UPower.KbdBacklight',member='BrightnessChanged'" 2>/dev/null |
+	while read -r line; do
+		if [[ $line =~ int32\ ([0-9]+) ]]; then
+			v=${BASH_REMATCH[1]}
+			"$here/zephyrus-notify" 5556 "Keyboard: ${levels[$v]:-$v}"
+		fi
+	done
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-media b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-media
new file mode 100755
index 0000000..8b77d79
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-media
@@ -0,0 +1,27 @@
+#!/bin/bash
+# zephyrus-media play-pause | next | previous — the media keys, through MPRIS (playerctl), with a short
+# notification of what happened. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# From the predecessor's media-control, kept: the lock against a double fire (the vendor keys can
+# repeat), and the notification. Dropped: its fallback to a media server's local API, which needed a
+# token from a file of secrets (novox/hq research 027 question 2). A player that speaks MPRIS is
+# reached; one that does not says so.
+set -u
+here=$(dirname "$0")
+action=${1:-play-pause}
+case "$action" in play-pause | next | previous) ;; *) echo "usage: zephyrus-media play-pause | next | previous" >&2; exit 2 ;; esac
+lock="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/zephyrus-media.lock"
+exec 9>"$lock"
+flock -n 9 || exit 0
+if ! playerctl status >/dev/null 2>&1; then
+	"$here/zephyrus-notify" 7777 "Media: no player"
+	exit 0
+fi
+playerctl "$action" 2>/dev/null
+if [ "$action" = play-pause ]; then
+	sleep 0.2
+	[ "$(playerctl status 2>/dev/null)" = Playing ] && label=Playing || label=Paused
+else
+	label=${action^}
+fi
+"$here/zephyrus-notify" 7777 "Media: $label"
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-notify b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-notify
new file mode 100755
index 0000000..1e8273f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-notify
@@ -0,0 +1,12 @@
+#!/bin/bash
+# zephyrus-notify ID SUMMARY — a short desktop notification that replaces the previous one with the
+# same ID, through the session's notification service on its bus. busctl is the service manager's
+# own client, so nothing is installed for it. Shipped by the mesh's asus-zephyrus-g14 module.
+set -u
+id=${1:-0}
+summary=${2:-}
+uid=$(id -u)
+DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/${uid}/bus" \
+	busctl --user call org.freedesktop.Notifications /org/freedesktop/Notifications \
+	org.freedesktop.Notifications Notify susssasa{sv}i \
+	asus-zephyrus-g14 "$id" "" "$summary" "" 0 1 urgency y 0 1500 >/dev/null 2>&1 || true
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-session b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-session
new file mode 100755
index 0000000..0f21f91
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-session
@@ -0,0 +1,46 @@
+#!/bin/bash
+# zephyrus-session COMMAND [ARG...] — run a command in the operator's graphical session from outside
+# it: from a vendor-key trigger, which triggerhappy runs as the operator's account but with none of
+# the session's environment. Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# What it replaces: the predecessor's `as-user`, which triggerhappy ran as root and which `su`-ed to
+# a named person with a hard-coded user id and display, and sourced a file of secrets on the way.
+# Here the account is whoever runs it, the bus is that account's, and the display is the one the
+# account's own session uses. Nothing is sourced.
+set -u
+uid=$(id -u)
+export XDG_RUNTIME_DIR="/run/user/${uid}"
+export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"
+home=$(getent passwd "$uid" | cut -d: -f6)
+[ -n "$home" ] && export HOME="$home"
+# The session's own window manager says best which display and authority the session uses: read
+# them from its environment, as the desktop modules' session finder does. Then logind, then any
+# process of this account that has a display.
+from_environ() {
+	env=$(tr '\0' '\n' <"/proc/$1/environ" 2>/dev/null) || return 1
+	d=$(printf '%s\n' "$env" | sed -n 's/^DISPLAY=//p' | head -n1)
+	[ -n "$d" ] || return 1
+	export DISPLAY="$d"
+	a=$(printf '%s\n' "$env" | sed -n 's/^XAUTHORITY=//p' | head -n1)
+	[ -n "$a" ] && export XAUTHORITY="$a"
+	return 0
+}
+if [ -z "${DISPLAY:-}" ]; then
+	for pid in $(pgrep -xu "$uid" i3 2>/dev/null); do
+		from_environ "$pid" && break
+	done
+fi
+if [ -z "${DISPLAY:-}" ]; then
+	for s in $(loginctl list-sessions --no-legend 2>/dev/null | awk -v u="$uid" '$2 == u { print $1 }'); do
+		d=$(loginctl show-session "$s" -p Display --value 2>/dev/null)
+		if [ -n "$d" ]; then export DISPLAY="$d"; break; fi
+	done
+fi
+if [ -z "${DISPLAY:-}" ]; then
+	for pid in $(pgrep -u "$uid" 2>/dev/null); do
+		from_environ "$pid" && break
+	done
+fi
+: "${XAUTHORITY:=${HOME}/.Xauthority}"
+export XAUTHORITY
+exec "$@"
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-touchpad b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-touchpad
new file mode 100755
index 0000000..637be36
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/files/bin/zephyrus-touchpad
@@ -0,0 +1,29 @@
+#!/bin/bash
+# zephyrus-touchpad reset | toggle — apply the touchpad's settings again, or switch it on or off.
+# Shipped by the mesh's asus-zephyrus-g14 module; edit the catalogue.
+#
+# The settings themselves are an X input class (/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf),
+# which X applies every time the device appears — after a resume too, which is what the predecessor's
+# sleep hook existed for. This is the manual form, bound to the touchpad key.
+set -u
+here=$(dirname "$0")
+name=$("$here/zephyrus-session" xinput list --name-only 2>/dev/null | grep -m1 -i 'touchpad')
+[ -n "$name" ] || { echo "zephyrus-touchpad: no touchpad in this session" >&2; exit 1; }
+x() { "$here/zephyrus-session" xinput "$@"; }
+case "${1:-reset}" in
+	reset)
+		x set-prop "$name" "libinput Tapping Enabled" 1
+		x set-prop "$name" "libinput Natural Scrolling Enabled" 1
+		x set-prop "$name" "libinput Accel Speed" 0.15
+		x enable "$name"
+		"$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: reset"
+		;;
+	toggle)
+		if x list-props "$name" | grep -q 'Device Enabled ([0-9]*):[[:space:]]*1'; then
+			x disable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: off"
+		else
+			x enable "$name"; "$here/zephyrus-session" "$here/zephyrus-notify" 7779 "Touchpad: on"
+		fi
+		;;
+	*) echo "usage: zephyrus-touchpad reset | toggle" >&2; exit 2 ;;
+esac
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/module.json.captured b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/module.json.captured
new file mode 100644
index 0000000..d1ee8d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/module.json.captured
@@ -0,0 +1,229 @@
+{
+  "module": "asus-zephyrus-g14",
+  "version": "1",
+  "moved": true,
+  "templates": "templates",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "emits": [
+    "profile.switched"
+  ],
+  "tools": [
+    "zephyrus_brightness",
+    "zephyrus_battery",
+    "zephyrus_charge_limit",
+    "zephyrus_gpu_mode",
+    "zephyrus_profile",
+    "zephyrus_thermals",
+    "zephyrus_power_draw",
+    "zephyrus_profile_policy",
+    "zephyrus_fan_curves",
+    "zephyrus_keys",
+    "zephyrus_check"
+  ],
+  "resources": [
+    {
+      "id": "asusctl",
+      "type": "package",
+      "package": "asusctl"
+    },
+    {
+      "id": "playerctl",
+      "type": "package",
+      "package": "playerctl"
+    },
+    {
+      "id": "asusd",
+      "type": "service",
+      "unit": "asusd.service",
+      "state": "running"
+    },
+    {
+      "id": "supergfxd",
+      "type": "service",
+      "unit": "supergfxd.service",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "scripts",
+      "type": "archive",
+      "path": "/usr/local/lib/asus-zephyrus-g14",
+      "artifact": "scripts",
+      "unknown": "program"
+    },
+    {
+      "id": "nvidia-options",
+      "type": "file",
+      "path": "/etc/modprobe.d/g14-nvidia-power.conf",
+      "mode": "0644",
+      "template": "templates/modprobe.d/g14-nvidia-power.conf"
+    },
+    {
+      "id": "video-options",
+      "type": "file",
+      "path": "/etc/modprobe.d/video-brightness-switch.conf",
+      "mode": "0644",
+      "template": "templates/modprobe.d/video-brightness-switch.conf"
+    },
+    {
+      "id": "suspend-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/systemd-suspend.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "nvidia-on-suspend",
+      "type": "file",
+      "path": "/etc/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf"
+    },
+    {
+      "id": "hibernate-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/systemd-hibernate.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "nvidia-on-hibernate",
+      "type": "file",
+      "path": "/etc/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
+    },
+    {
+      "id": "suspend-then-hibernate-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "nvidia-on-suspend-then-hibernate",
+      "type": "file",
+      "path": "/etc/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf"
+    },
+    {
+      "id": "powerd-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/nvidia-powerd.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "powerd-opt-in",
+      "type": "file",
+      "path": "/etc/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf"
+    },
+    {
+      "id": "backlight-rule",
+      "type": "file",
+      "path": "/etc/udev/rules.d/90-backlight.rules",
+      "mode": "0644",
+      "template": "templates/udev/rules.d/90-backlight.rules"
+    },
+    {
+      "id": "udev",
+      "type": "service",
+      "unit": "systemd-udevd.service",
+      "reload-on": [
+        "backlight-rule"
+      ]
+    },
+    {
+      "id": "upower-package",
+      "type": "package",
+      "package": "upower"
+    },
+    {
+      "id": "upower-drop-ins",
+      "type": "directory",
+      "path": "/etc/UPower/UPower.conf.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "low-battery",
+      "type": "file",
+      "path": "/etc/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf",
+      "mode": "0644",
+      "template": "templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf"
+    },
+    {
+      "id": "upower",
+      "type": "service",
+      "unit": "upower.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "low-battery"
+      ]
+    },
+    {
+      "id": "xorg-drop-ins",
+      "type": "directory",
+      "path": "/etc/X11/xorg.conf.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "touchpad",
+      "type": "file",
+      "path": "/etc/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf",
+      "mode": "0644",
+      "template": "templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:after-wake:normal",
+      "template": "templates/after-wake"
+    },
+    {
+      "collection": "contribution:node-hotkeys:trigger",
+      "template": "templates/hotkeys-triggers"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "templates/display-session"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/zephyrus",
+        "binary": "zephyrus",
+        "loads": [
+          "zephyrus"
+        ]
+      },
+      {
+        "name": "scripts",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "templates",
+        "kind": "archive",
+        "from": "templates"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf
new file mode 100644
index 0000000..f3d6bef
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/UPower/UPower.conf.d/50-asus-zephyrus-g14.conf
@@ -0,0 +1,11 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# On low battery the machine suspends rather than powering off, at 7 % — s2idle still draws a little,
+# so it leaves headroom. A drop-in over the package's own UPower.conf, which stays the package's.
+[UPower]
+UsePercentageForPolicy=true
+PercentageLow=15.0
+PercentageCritical=10.0
+PercentageAction=7.0
+CriticalPowerAction=Suspend
+AllowRiskyCriticalPowerAction=true
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf
new file mode 100644
index 0000000..f30830c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/X11/xorg.conf.d/30-asus-zephyrus-g14-touchpad.conf
@@ -0,0 +1,12 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The touchpad's settings, applied by X every time the device appears — at login and after every
+# resume, when the device is initialised again. This replaces the predecessor's sleep hook, which ran
+# xinput after a resume as a named person on a guessed display.
+Section "InputClass"
+    Identifier "asus-zephyrus-g14 touchpad"
+    MatchIsTouchpad "on"
+    Option "Tapping" "on"
+    Option "NaturalScrolling" "true"
+    Option "AccelSpeed" "0.15"
+EndSection
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/after-wake b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/after-wake
new file mode 100644
index 0000000..af60a9d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/after-wake
@@ -0,0 +1,7 @@
+# The touchpad's settings again after waking, in the operator's session: X applies the module's
+# input class when the device appears, and this covers a wake that does not initialise it again.
+# Runs as root from the power module; the reset itself runs as the session's owner.
+sleep 2
+owner=$(ps -o user= -C i3 | head -n 1)
+[ -n "$owner" ] && runuser -u "$owner" -- /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
+true
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/display-session b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/display-session
new file mode 100644
index 0000000..38f9e5b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/display-session
@@ -0,0 +1,30 @@
+# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
+# mesh: replaced at every push. Once the controller places contributions to node-display-session
+# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
+#
+# The keys the firmware turns into ordinary key presses. The vendor keys that reach no X client are
+# triggerhappy's (/etc/triggerhappy/triggers.d/asus-g14.conf): M4 and Fn+F4/F5 for media, Fn+F7/F8 for
+# the panel, Fn+F10 for the touchpad. The keyboard backlight (Fn+F2/F3) is the firmware's and asusd's.
+
+# Fn+F6, the screenshot key: the firmware sends Super+Shift+S. Released before it runs, because the
+# screenshot grabs the pointer to select a region, which fails while the key is still held.
+bindsym --release $mod+Shift+s exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh
+
+# Fn+F9, the display key: the firmware sends Super+P. Odd workspaces to the panel, even ones to the
+# external output.
+bindsym $mod+p exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display order
+
+# The keyboard backlight's level, shown when it changes.
+exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-kbd-notify
+# The laptop's own lines in i3 (module asus-zephyrus-g14, novox/hq ADR 0208, ADR 0210). Owned by the
+# mesh: replaced at every push. Once the controller places contributions to node-display-session
+# (ADR 0210), these become the module's contribution instead of a file in i3's directory.
+#
+# The model's panel and touchpad.
+
+# The internal panel is the primary output, where the bars' tray goes. Which monitors are on and where
+# is the display server's (autorandr, run at every session start).
+exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-display primary
+
+# The touchpad's settings again, by hand. X applies them itself whenever the device appears.
+bindsym $mod+Shift+x exec --no-startup-id /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/hotkeys-triggers b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/hotkeys-triggers
new file mode 100644
index 0000000..5e4d165
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/hotkeys-triggers
@@ -0,0 +1,10 @@
+# The ROG Zephyrus G14's vendor keys, which reach no X client: media (the M-keys), panel brightness,
+# and the touchpad key. Each runs this module's own script, as the operator's account.
+KEY_PROG1	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media play-pause
+KEY_PROG3	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media previous
+KEY_PROG4	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-session /usr/local/lib/asus-zephyrus-g14/bin/zephyrus-media next
+KEY_BRIGHTNESSDOWN	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSDOWN	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight -
+KEY_BRIGHTNESSUP	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_BRIGHTNESSUP	2	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-backlight +
+KEY_F21	1	/usr/local/lib/asus-zephyrus-g14/bin/zephyrus-touchpad reset
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/g14-nvidia-power.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/g14-nvidia-power.conf
new file mode 100644
index 0000000..7894102
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/g14-nvidia-power.conf
@@ -0,0 +1,16 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The discrete GPU's driver options on the ROG Zephyrus G14 (GA403, RTX 40 series, hybrid graphics).
+#
+# NVreg_DynamicPowerManagement=0x00 turns runtime D3 off. With it on, a change of power source sends
+# the driver an ACPI notification it fails to handle on this model ("RmHandleDNotifierEvent: Failed to
+# handle ACPI D-Notifier event, status=0x62"), and the GPU stops making progress until the machine is
+# powered off. Off costs a few idle watts in hybrid mode and keeps the machine up.
+#
+# NVreg_PreserveVideoMemoryAllocations=1 saves video memory across suspend, so what used the GPU still
+# works after waking. It needs nvidia-suspend, -hibernate and -resume to run around a sleep, which this
+# module's drop-ins on the sleep services ask for.
+#
+# A change here applies when the driver next loads: at the next boot.
+options nvidia NVreg_PreserveVideoMemoryAllocations=1
+options nvidia NVreg_DynamicPowerManagement=0x00
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/video-brightness-switch.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/video-brightness-switch.conf
new file mode 100644
index 0000000..5b2de1d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/modprobe.d/video-brightness-switch.conf
@@ -0,0 +1,6 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The ACPI video driver does not change the backlight itself on the brightness keys: on this model it
+# moves the wrong one. The keys are triggerhappy's (see /etc/triggerhappy/triggers.d/asus-g14.conf).
+# Applies when the module next loads: at the next boot.
+options video brightness_switch_enabled=0
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf
new file mode 100644
index 0000000..4466dd0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/nvidia-powerd.service.d/asus-zephyrus-g14.conf
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# nvidia-powerd (Dynamic Boost) was the first error in the chain that hung this model's GPU on a change
+# of power source, and asusd starts it on mains. It runs only when the kernel command line says
+# zephyrus.nvidia-powerd — an explicit opt-in, at boot.
+[Unit]
+ConditionKernelCommandLine=zephyrus.nvidia-powerd
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf
new file mode 100644
index 0000000..1f56e3b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-hibernate.service.d/asus-zephyrus-g14-nvidia.conf
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-hibernate.service nvidia-resume.service
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf
new file mode 100644
index 0000000..5813188
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend-then-hibernate.service.d/asus-zephyrus-g14-nvidia.conf
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-suspend-then-hibernate.service nvidia-resume.service
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf
new file mode 100644
index 0000000..92a0111
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/systemd/system/systemd-suspend.service.d/asus-zephyrus-g14-nvidia.conf
@@ -0,0 +1,7 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The NVIDIA driver's own sleep actions, asked for by the sleep itself rather than enabled as
+# links: the mesh declares files and never makes links (novox/hq ADR 0012), and the host's service
+# shape must not start these units by hand, which would put the GPU to sleep with the machine awake.
+[Unit]
+Wants=nvidia-suspend.service nvidia-resume.service
diff --git a/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/udev/rules.d/90-backlight.rules b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/udev/rules.d/90-backlight.rules
new file mode 100644
index 0000000..0a9a894
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/asus-zephyrus-g14/templates/udev/rules.d/90-backlight.rules
@@ -0,0 +1,5 @@
+# Managed by the mesh (module asus-zephyrus-g14). Replaced on every push; edit the catalogue instead.
+#
+# The backlights are writable by the video group, so the brightness keys and the module's brightness tool
+# move the panel without root.
+ACTION=="add", SUBSYSTEM=="backlight", RUN+="/usr/bin/chgrp video /sys/class/backlight/%k/brightness", RUN+="/usr/bin/chmod g+w /sys/class/backlight/%k/brightness"
diff --git a/testdata/beside/mesh-catalog/modules/audit-logger/module.json.captured b/testdata/beside/mesh-catalog/modules/audit-logger/module.json.captured
new file mode 100644
index 0000000..122b94e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/audit-logger/module.json.captured
@@ -0,0 +1,69 @@
+{
+  "module": "audit-logger",
+  "version": "1",
+  "slug": "audit",
+  "consumes": [
+    "**"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "AUDIT_LOG": "${dir:trail}/audit.log",
+          "AUDIT_SPOOL": "${dir:spool}"
+        }
+      }
+    ]
+  },
+  "data": {
+    "own": [
+      {
+        "id": "trail",
+        "path": "${dir:trail}",
+        "class": "valuable",
+        "why": "the audit trail, written nowhere else"
+      },
+      {
+        "id": "spool",
+        "path": "${dir:spool}",
+        "class": "valuable",
+        "why": "events the trail could not take yet; after the bus gives one up, the only copy"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "trail",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "spool",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/avahi/module.json.captured b/testdata/beside/mesh-catalog/modules/avahi/module.json.captured
new file mode 100644
index 0000000..de99c7c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/avahi/module.json.captured
@@ -0,0 +1,43 @@
+{
+  "module": "avahi",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "avahi_status",
+    "avahi_browse",
+    "avahi_resolve",
+    "avahi_services"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "avahi"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "avahi-daemon.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/avahi-tools",
+        "binary": "avahi-tools",
+        "loads": [
+          "avahi-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/baserow/files/config.json b/testdata/beside/mesh-catalog/modules/baserow/files/config.json
new file mode 100644
index 0000000..955ac24
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/baserow/files/config.json
@@ -0,0 +1,4 @@
+{
+  "password": "${secret:admin}",
+  "host": "${bound:route:name}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/baserow/files/server.env b/testdata/beside/mesh-catalog/modules/baserow/files/server.env
new file mode 100644
index 0000000..7b716b4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/baserow/files/server.env
@@ -0,0 +1,7 @@
+DATABASE_HOST=${bound:postgres-database:at}
+DATABASE_PORT=${bound:postgres-database:port}
+DATABASE_NAME=${bound:postgres-database:as}
+DATABASE_USER=${bound:postgres-database:as}
+DATABASE_PASSWORD_FILE=/run/secrets/database
+DISABLE_EMBEDDED_PSQL=true
+BASEROW_PUBLIC_URL=https://${bound:route:name}
diff --git a/testdata/beside/mesh-catalog/modules/baserow/module.json.captured b/testdata/beside/mesh-catalog/modules/baserow/module.json.captured
new file mode 100644
index 0000000..8119621
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/baserow/module.json.captured
@@ -0,0 +1,158 @@
+{
+  "module": "baserow",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "baserow"
+    },
+    "route": {
+      "label": "baserow",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "own-secrets": {
+    "admin": "${dir:state}/admin.secret"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Baserow web UI and REST API, served by the image's own Caddy; a public name is the route's"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "uploaded files and media; the tables are in the database"
+      }
+    ]
+  },
+  "config": {
+    "host": {
+      "type": "string",
+      "description": "The Host header the module's tools send to Baserow, a host name; the file's default is the name the module's route was given.",
+      "trusted": true,
+      "default": "${bound:route:name}"
+    },
+    "email": {
+      "type": "string",
+      "description": "The email address of the Baserow account the module's tools sign in as; unset, the code falls back to its environment.",
+      "trusted": true,
+      "default": ""
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Baserow at, as a URL; unset, the code falls back to its environment, else this machine's Baserow on port 80.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0755",
+      "owner": "9999:9999",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "baserow"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "baserow",
+      "image": "baserow/baserow@sha256:263ea6c4b72c9eccabcd975ffe9fdebf23913a293a514bec6a3897a5e0a5a080",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "baserow",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "80"
+      ],
+      "volumes": [
+        "${dir:data}:/baserow/data",
+        "${dir:state}/database.secret:/run/secrets/database:ro"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["host", "email", "url"],
+      "protected": ["password"]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_BASEROW_URL": "http://127.0.0.1:${port:80}",
+          "MESH_BASEROW_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/accounts.json b/testdata/beside/mesh-catalog/modules/betterbird/files/accounts.json
new file mode 100644
index 0000000..e182cc3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/accounts.json
@@ -0,0 +1,3 @@
+{
+  "accounts": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/betterbird b/testdata/beside/mesh-catalog/modules/betterbird/files/betterbird
new file mode 100755
index 0000000..3ce088a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/betterbird
@@ -0,0 +1,10 @@
+#!/bin/sh
+# Betterbird's start, written by the mesh (module betterbird, novox/hq ADR 0316). Replaced at every push.
+#
+# Before Betterbird starts, the module's tools place its user.js in the profile (the settings prefs, accounts, identities, calendars,
+# address-books and tags) and write what Betterbird rewrites itself: the account lists and each declared account's filters. They do
+# it only while no Betterbird of this account runs, because Betterbird rewrites its saved preferences when it quits; a
+# second start while one runs only hands over to it. What the preparation could not do it says here, and
+# betterbird_check says it too. Betterbird starts either way: its configuration never holds the mail back.
+/usr/local/lib/mesh-betterbird/betterbird-tools prepare || echo "betterbird: the mesh's preparation did not complete; betterbird_check says why" >&2
+exec /opt/betterbird/betterbird "$@"
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/configuration.json b/testdata/beside/mesh-catalog/modules/betterbird/files/configuration.json
new file mode 100644
index 0000000..7020446
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/configuration.json
@@ -0,0 +1,6 @@
+{
+  "identities": {},
+  "calendars": {},
+  "address-books": {},
+  "filters": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/eu.betterbird.Betterbird.desktop b/testdata/beside/mesh-catalog/modules/betterbird/files/eu.betterbird.Betterbird.desktop
new file mode 100644
index 0000000..e409fcf
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/eu.betterbird.Betterbird.desktop
@@ -0,0 +1,25 @@
+[Desktop Entry]
+Version=1.0
+Type=Application
+Name=Betterbird
+GenericName=Mail Client
+Comment=Send and receive mail with Betterbird
+Exec=/usr/local/bin/betterbird %u
+Icon=/opt/betterbird/chrome/icons/default/default128.png
+Terminal=false
+Categories=Network;Email;
+MimeType=message/rfc822;x-scheme-handler/mailto;application/x-xpinstall;application/x-extension-ics;text/calendar;text/vcard;text/x-vcard;x-scheme-handler/webcal;x-scheme-handler/webcals;x-scheme-handler/mid;
+StartupNotify=true
+StartupWMClass=eu.betterbird.Betterbird
+Keywords=Email;E-mail;Calendar;Thunderbird;
+Actions=ComposeMessage;OpenAddressBook;
+# Written by the mesh (module betterbird, novox/hq ADR 0316 §3), in place of the community package's entry:
+# it starts Betterbird through the module's start, and names the icon in the installation, with no link.
+
+[Desktop Action ComposeMessage]
+Name=Write new message
+Exec=/usr/local/bin/betterbird -compose
+
+[Desktop Action OpenAddressBook]
+Name=Open address book
+Exec=/usr/local/bin/betterbird -addressbook
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/prefs.json b/testdata/beside/mesh-catalog/modules/betterbird/files/prefs.json
new file mode 100644
index 0000000..45fd973
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/prefs.json
@@ -0,0 +1,3 @@
+{
+  "prefs": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/files/tags.json b/testdata/beside/mesh-catalog/modules/betterbird/files/tags.json
new file mode 100644
index 0000000..4772f09
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/files/tags.json
@@ -0,0 +1,3 @@
+{
+  "tags": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/betterbird/module.json.captured b/testdata/beside/mesh-catalog/modules/betterbird/module.json.captured
new file mode 100644
index 0000000..891f883
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/betterbird/module.json.captured
@@ -0,0 +1,253 @@
+{
+  "module": "betterbird",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "a new build may remove the community package betterbird-bin and replaces the installation in /opt/betterbird, which a running Betterbird has open: the switch on each node and every upgrade wait for the operator, who quits Betterbird first and then pushes (novox/hq ADR 0316 §4, §5)"
+  },
+  "requires": [
+    "x11-display"
+  ],
+  "invokes": [
+    "seat:mesh-controller.settings",
+    "seat:mesh-controller.nodes",
+    "seat:mesh-controller.node",
+    "betterbird.betterbird_derive"
+  ],
+  "tools": [
+    "betterbird_status",
+    "betterbird_prefs",
+    "betterbird_config",
+    "betterbird_config_apply",
+    "betterbird_user_js",
+    "betterbird_log",
+    "betterbird_restart",
+    "betterbird_check",
+    "betterbird_accounts",
+    "betterbird_identities",
+    "betterbird_calendars",
+    "betterbird_address_books",
+    "betterbird_filters",
+    "betterbird_tags",
+    "betterbird_derive",
+    "betterbird_drift",
+    "betterbird_reminder_test"
+  ],
+  "config": {
+    "prefs": {
+      "type": "object",
+      "description": "Betterbird's preferences the operator sets, by their own names (mailnews.*, calendar.* and the like), laid into prefs.json; an account's, a server's and a tag's are refused, as accounts, the four kinds and tags own them (novox/hq ADR 0329 §6).",
+      "trusted": true,
+      "default": {}
+    },
+    "accounts": {
+      "type": "object",
+      "description": "The mail accounts Betterbird is set up with, each by a name of the operator's: its address, its sender's name and its incoming and outgoing servers; no password, token or cookie (novox/hq ADR 0329 §2).",
+      "trusted": true,
+      "default": {}
+    },
+    "identities": {
+      "type": "object",
+      "description": "The identities beside an account's own, each by a name of the operator's: the address and name it sends as, its signature as a list of lines, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "calendars": {
+      "type": "object",
+      "description": "The calendars Betterbird shows, each by a name of the operator's: where it is and how it is reached, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "address-books": {
+      "type": "object",
+      "description": "The address books Betterbird uses, each by a name of the operator's: where it is and how it is reached, and the profile's key to adopt on a node.",
+      "trusted": true,
+      "default": {}
+    },
+    "filters": {
+      "type": "object",
+      "description": "The message filters of each account, by account: what each matches and what it does with the mail.",
+      "trusted": true,
+      "default": {}
+    },
+    "tags": {
+      "type": "object",
+      "description": "The tags Betterbird offers, each by its own key: its name, colour and order; trusted since issue 751, so a change to it is the operator's to approve.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/betterbird",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["accounts-record.json", "configuration-record.json", "kept/"]
+    },
+    {
+      "id": "prefs",
+      "type": "file",
+      "path": "${machine:account-home}/.config/betterbird/prefs.json",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": [
+        "prefs"
+      ],
+      "template": "files/prefs.json",
+      "trusted": true
+    },
+    {
+      "id": "accounts",
+      "type": "file",
+      "path": "${machine:account-home}/.config/betterbird/accounts.json",
+      "owner": "${machine:account}",
+      "mode": "0600",
+      "merge": "json",
+      "takes-config": [
+        "accounts"
+      ],
+      "template": "files/accounts.json",
+      "trusted": true
+    },
+    {
+      "id": "configuration",
+      "type": "file",
+      "path": "${machine:account-home}/.config/betterbird/configuration.json",
+      "owner": "${machine:account}",
+      "mode": "0600",
+      "merge": "json",
+      "takes-config": [
+        "identities",
+        "calendars",
+        "address-books",
+        "filters"
+      ],
+      "template": "files/configuration.json",
+      "trusted": true
+    },
+    {
+      "id": "tags",
+      "type": "file",
+      "path": "${machine:account-home}/.config/betterbird/tags.json",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": [
+        "tags"
+      ],
+      "template": "files/tags.json",
+      "trusted": true
+    },
+    {
+      "id": "community-package",
+      "type": "package",
+      "package": "betterbird-bin",
+      "absent": true
+    },
+    {
+      "id": "installation",
+      "type": "archive",
+      "path": "/opt/betterbird",
+      "artifact": "archive",
+      "unknown": "program"
+    },
+    {
+      "id": "owl",
+      "type": "archive",
+      "path": "/opt/betterbird/owl",
+      "artifact": "owl",
+      "unknown": "program"
+    },
+    {
+      "id": "policies",
+      "type": "archive",
+      "path": "/opt/betterbird/distribution",
+      "artifact": "distribution",
+      "unknown": "program"
+    },
+    {
+      "id": "spelling",
+      "type": "archive",
+      "path": "/opt/betterbird/defaults/pref",
+      "artifact": "defaults",
+      "unknown": "program"
+    },
+    {
+      "id": "preparation",
+      "type": "archive",
+      "path": "/usr/local/lib/mesh-betterbird",
+      "artifact": "tools",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/betterbird",
+      "mode": "0755",
+      "template": "files/betterbird"
+    },
+    {
+      "id": "launcher",
+      "type": "file",
+      "path": "/usr/local/share/applications/eu.betterbird.Betterbird.desktop",
+      "mode": "0644",
+      "template": "files/eu.betterbird.Betterbird.desktop"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/betterbird-tools",
+        "binary": "betterbird-tools",
+        "loads": [
+          "betterbird-tools"
+        ]
+      },
+      {
+        "name": "archive",
+        "kind": "archive",
+        "url": "https://www.betterbird.eu/downloads/LinuxArchive/betterbird-153.4.0esr-bb10.en-US.linux-x86_64.tar.xz",
+        "sha256": "38dd24890a66b4cf9a45bc24e15192e00c26b929e1bb8df7974c16a4539129e2",
+        "version": "153.4.0esr-bb10",
+        "within": "betterbird",
+        "names-on-purpose": {
+          "www.betterbird.eu": "Betterbird's project publishes its Linux release there; the build seat fetches it once, by its pinned sha256 (novox/hq ADR 0316 §2)"
+        }
+      },
+      {
+        "name": "owl",
+        "kind": "archive",
+        "url": "https://www.beonex.com/owl/owl.xpi",
+        "sha256": "a54cc3d52113b34f97942ee19190947dee23561e2217f18db3d80ac023991221",
+        "version": "1.5.6.1",
+        "file": "owl.xpi",
+        "names-on-purpose": {
+          "www.beonex.com": "Owl's vendor publishes its xpi there; the build seat fetches it once, by its pinned sha256 (novox/hq ADR 0316 §6)"
+        }
+      },
+      {
+        "name": "distribution",
+        "kind": "archive",
+        "from": "install/distribution"
+      },
+      {
+        "name": "defaults",
+        "kind": "archive",
+        "from": "install/defaults-pref"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/blueman/module.json.captured b/testdata/beside/mesh-catalog/modules/blueman/module.json.captured
new file mode 100644
index 0000000..73a7640
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/blueman/module.json.captured
@@ -0,0 +1,37 @@
+{
+  "module": "blueman",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "blueman_status",
+    "blueman_restart",
+    "blueman_check"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "blueman"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/blueman-tools",
+        "binary": "blueman-tools",
+        "loads": [
+          "blueman-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/bluetooth/module.json.captured b/testdata/beside/mesh-catalog/modules/bluetooth/module.json.captured
new file mode 100644
index 0000000..dfaabf1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/bluetooth/module.json.captured
@@ -0,0 +1,53 @@
+{
+  "module": "bluetooth",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "bluetooth_controller",
+    "bluetooth_power",
+    "bluetooth_devices",
+    "bluetooth_scan",
+    "bluetooth_connect",
+    "bluetooth_disconnect",
+    "bluetooth_trust",
+    "bluetooth_pair",
+    "bluetooth_remove"
+  ],
+  "resources": [
+    {
+      "id": "stack",
+      "type": "package",
+      "package": "bluez"
+    },
+    {
+      "id": "utilities",
+      "type": "package",
+      "package": "bluez-utils"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "bluetooth.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/bluetooth-tools",
+        "binary": "bluetooth-tools",
+        "loads": [
+          "bluetooth-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/brother/files/settings.json b/testdata/beside/mesh-catalog/modules/brother/files/settings.json
new file mode 100644
index 0000000..80aed32
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/brother/files/settings.json
@@ -0,0 +1,9 @@
+{
+  "scanner": "",
+  "scan-folder": "",
+  "printer": "",
+  "printer-certificate": "",
+  "resolution": 300,
+  "color-mode": "color",
+  "crop": true
+}
diff --git a/testdata/beside/mesh-catalog/modules/brother/files/store.json b/testdata/beside/mesh-catalog/modules/brother/files/store.json
new file mode 100644
index 0000000..8c2075d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/brother/files/store.json
@@ -0,0 +1,9 @@
+{
+  "scheme": "${bound:s3-bucket:scheme}",
+  "at": "${bound:s3-bucket:at}",
+  "port": "${bound:s3-bucket:port}",
+  "bucket": "${bound:s3-bucket:bucket}",
+  "region": "${bound:s3-bucket:region}",
+  "key": "${bound:s3-bucket:as}",
+  "secret": "${secret:s3-bucket}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/brother/module.json.captured b/testdata/beside/mesh-catalog/modules/brother/module.json.captured
new file mode 100644
index 0000000..57559d5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/brother/module.json.captured
@@ -0,0 +1,280 @@
+{
+  "module": "brother",
+  "version": "1",
+  "requires": [
+    "s3-bucket"
+  ],
+  "binds": {
+    "s3-bucket": "${dir:state}/store-binding.json"
+  },
+  "secrets": {
+    "s3-bucket": "${dir:state}/store.secret"
+  },
+  "config": {
+    "scanner": {
+      "type": "string",
+      "description": "The network scanner's eSCL address, such as http://192.0.2.10/eSCL: the scanner's own address and the path its eSCL service answers on; the operator's, with no default.",
+      "pattern": "^https?://.+",
+      "trusted": true,
+      "required": true
+    },
+    "scan-folder": {
+      "type": "string",
+      "description": "The absolute path of the folder the scans are filed in as PDF files; the module makes it when it files the first scan, and never touches a file in it that it did not write. The operator's, with no default.",
+      "pattern": "^/.+$",
+      "trusted": true,
+      "required": true
+    },
+    "printer": {
+      "type": "string",
+      "description": "The printer's host, such as 192.0.2.10: where its admin page (HTTPS) and its IPP service answer. The device is the scanner's own; the operator's, with no default.",
+      "pattern": "^[A-Za-z0-9.:-]+$",
+      "trusted": true,
+      "required": true
+    },
+    "printer-certificate": {
+      "type": "string",
+      "description": "The SHA-256 fingerprint of the certificate the printer's admin page serves, as 32 upper-case hex pairs joined by colons; several, separated by commas, when the printer serves more than one (it serves an ECDSA and an RSA certificate for one name). The module trusts those certificates alone and refuses any other; the operator's, with no default.",
+      "pattern": "^([0-9A-F]{2}:){31}[0-9A-F]{2}(, *([0-9A-F]{2}:){31}[0-9A-F]{2})*$",
+      "trusted": true,
+      "required": true
+    },
+    "resolution": {
+      "type": "number",
+      "description": "The resolution asked of the scanner, in dpi: 100, 200, 300 or 600. A scanner may give another; the scan is filed at the resolution it gave.",
+      "enum": [
+        100,
+        200,
+        300,
+        600
+      ],
+      "trusted": false,
+      "default": 300
+    },
+    "color-mode": {
+      "type": "string",
+      "description": "Whether the scan is in colour or in grays: color or gray.",
+      "enum": [
+        "color",
+        "gray"
+      ],
+      "trusted": false,
+      "default": "color"
+    },
+    "crop": {
+      "type": "boolean",
+      "description": "Whether the document is cut out of the platen's white lid; false files the whole platen. A feeder scan is never cropped.",
+      "trusted": false,
+      "default": true
+    }
+  },
+  "own-secrets": {
+    "admin-password": {
+      "path": "${dir:state}/admin-password.secret",
+      "issued-by": "outside",
+      "prompt": "the admin password of the Brother printer",
+      "owner": "brother-device"
+    },
+    "broker-device": {
+      "path": "${dir:state}/broker-device.secret",
+      "owner": "brother-device"
+    }
+  },
+  "streams": [
+    {
+      "name": "device-asks",
+      "events": [
+        "device.asked"
+      ],
+      "max-age-days": 1,
+      "max-mib": 8,
+      "retention": "work-queue",
+      "max-deliveries": 3,
+      "duplicates": 24
+    }
+  ],
+  "state": [
+    {
+      "name": "device-answers",
+      "ttl-seconds": 600
+    }
+  ],
+  "seats": [
+    {
+      "name": "scanner",
+      "scope": "mesh",
+      "serves": [
+        "scan",
+        "status",
+        "list",
+        "document"
+      ]
+    },
+    {
+      "name": "printer",
+      "scope": "mesh",
+      "serves": [
+        "status",
+        "settings",
+        "print",
+        "upload"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "scanner",
+      "scope": "mesh",
+      "serves": [
+        "scan",
+        "status",
+        "list",
+        "document"
+      ]
+    },
+    {
+      "name": "printer",
+      "scope": "mesh",
+      "serves": [
+        "status",
+        "settings",
+        "print",
+        "upload"
+      ]
+    }
+  ],
+  "emits": [
+    "scan.added"
+  ],
+  "tools": [
+    "scanner.scan",
+    "scanner.status",
+    "scanner.list",
+    "scanner.document",
+    "printer.status",
+    "printer.settings",
+    "printer.print",
+    "printer.upload",
+    "brother_health"
+  ],
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "brother-device",
+      "shell": "/usr/bin/nologin"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0711",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "takes-config": [
+        "scanner",
+        "scan-folder",
+        "printer",
+        "printer-certificate",
+        "resolution",
+        "color-mode",
+        "crop"
+      ],
+      "merge": "json",
+      "template": "files/settings.json",
+      "trusted": true
+    },
+    {
+      "id": "store",
+      "type": "file",
+      "path": "${dir:state}/store.json",
+      "owner": "brother-device",
+      "mode": "0600",
+      "template": "files/store.json"
+    },
+    {
+      "id": "device",
+      "type": "process",
+      "name": "brother-device",
+      "artifact": "tools",
+      "run": [
+        "./brother",
+        "device"
+      ],
+      "user": "brother-device",
+      "env": {
+        "BROTHER_SETTINGS": "${dir:state}/settings.json",
+        "BROTHER_ADMIN_PASSWORD": "${dir:state}/admin-password.secret",
+        "BROTHER_BROKER": "${dir:state}/broker-device.secret",
+        "BROTHER_STORE": "${dir:state}/store.json"
+      },
+      "restart-on": [
+        "settings",
+        "store"
+      ],
+      "bus": {
+        "queues": [
+          "device-asks"
+        ],
+        "state": [
+          "device-answers"
+        ],
+        "emits": [
+          "scan.added"
+        ]
+      },
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "brother-watch",
+      "artifact": "tools",
+      "run": [
+        "./brother",
+        "watch"
+      ],
+      "user": "brother-device",
+      "health": {
+        "kind": "tool",
+        "tool": "brother_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/brother",
+        "binary": "brother",
+        "loads": [
+          "brother"
+        ],
+        "env": {
+          "BROTHER_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/ca-trust/files/anchor b/testdata/beside/mesh-catalog/modules/ca-trust/files/anchor
new file mode 100755
index 0000000..72576d2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ca-trust/files/anchor
@@ -0,0 +1,58 @@
+#!/bin/sh
+# The mesh's internal certificate authority, trusted by this machine.
+#
+# Written by the mesh from the ca-trust module's manifest (novox/hq ADR 0147).
+# Editing it here lasts until the next apply.
+#
+# There is no prior trust to verify the fetch against — this is the thing that
+# establishes it — so it is made over the mesh's own private network, which is
+# what authenticates it (novox/hq ADR 0098, the same reasoning that lets the
+# route proxy fetch this root for itself). What comes back is checked here: a
+# body that is not a certificate is refused now, rather than believed and then
+# failed by whatever reads the trust store next.
+set -eu
+
+ROOTS='https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}'
+ANCHORS=/etc/ca-certificates/trust-source/anchors
+ANCHOR="$ANCHORS/mesh-internal-ca.crt"
+
+# Arch's layout, said out loud rather than assumed: a machine that keeps its
+# anchors elsewhere fails here, visibly, instead of writing a file nothing
+# reads. That failure is the signal that this belongs in the host, where one
+# operating system's difference lives (novox/hq ADR 0147, option 2).
+[ -d "$ANCHORS" ] || {
+	echo "this machine keeps no trust anchors in $ANCHORS; ca-trust is written for that layout" >&2
+	exit 1
+}
+
+case "${1:-}" in
+install)
+	tmp=$(mktemp)
+	trap 'rm -f "$tmp"' EXIT
+	# The authority may still be starting, or this machine may have come up
+	# before it: two minutes of asking, then an honest failure.
+	n=0
+	while [ "$n" -lt 60 ]; do
+		if curl --fail --silent --show-error --insecure --max-time 10 \
+			--output "$tmp" "$ROOTS" &&
+			grep -q 'BEGIN CERTIFICATE' "$tmp"; then
+			install -m 0644 "$tmp" "$ANCHOR"
+			update-ca-trust
+			exit 0
+		fi
+		n=$((n + 1))
+		sleep 2
+	done
+	echo "the authority at $ROOTS did not serve a certificate within two minutes" >&2
+	exit 1
+	;;
+remove)
+	# What stopping the unit does, and therefore what being unassigned does.
+	rm -f "$ANCHOR"
+	update-ca-trust
+	;;
+*)
+	echo "usage: $(basename "$0") install|remove" >&2
+	exit 2
+	;;
+esac
diff --git a/testdata/beside/mesh-catalog/modules/ca-trust/files/mesh-ca-trust.service b/testdata/beside/mesh-catalog/modules/ca-trust/files/mesh-ca-trust.service
new file mode 100644
index 0000000..2411560
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ca-trust/files/mesh-ca-trust.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=The mesh's internal certificate authority, trusted by this machine
+# novox/hq ADR 0147. Starting this unit places the mesh's root among this
+# machine's trust anchors; stopping it takes the root away again, which is what
+# the host does when the module is no longer assigned here.
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${dir:state}/anchor install
+ExecStop=${dir:state}/anchor remove
+
+[Install]
+WantedBy=multi-user.target
diff --git a/testdata/beside/mesh-catalog/modules/ca-trust/module.json.captured b/testdata/beside/mesh-catalog/modules/ca-trust/module.json.captured
new file mode 100644
index 0000000..b3c9dc9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ca-trust/module.json.captured
@@ -0,0 +1,66 @@
+{
+  "module": "ca-trust",
+  "version": "1",
+  "slug": "catrust",
+  "capabilities": [
+    "service-manager"
+  ],
+  "requires": [
+    "internal-acme-ca"
+  ],
+  "seats": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "claims": [
+    {
+      "name": "the-mesh-trust-anchor",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "anchor",
+      "type": "file",
+      "path": "${dir:state}/anchor",
+      "mode": "0755",
+      "template": "files/anchor"
+    },
+    {
+      "id": "unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-ca-trust.service",
+      "mode": "0644",
+      "template": "files/mesh-ca-trust.service"
+    },
+    {
+      "id": "trust",
+      "type": "service",
+      "unit": "mesh-ca-trust.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "anchor",
+        "unit"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/files/agent-account b/testdata/beside/mesh-catalog/modules/claude-code/files/agent-account
new file mode 100644
index 0000000..b081a6c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/files/agent-account
@@ -0,0 +1 @@
+${machine:agent-account}
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/files/claude-agent b/testdata/beside/mesh-catalog/modules/claude-code/files/claude-agent
new file mode 100755
index 0000000..e3d330f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/files/claude-agent
@@ -0,0 +1,13 @@
+#!/bin/sh
+# The mesh's (module claude-code, novox/hq ADR 0266): start the agent as the account agents run as on this
+# machine. Written whole at every push: an edit here is overwritten.
+agent='${machine:agent-account}'
+if [ "$(id -un)" = "$agent" ]; then
+	exec claude "$@"
+fi
+# Another account, the operator's, becomes the agent's through its own sudo: the person is the authority. The
+# operator's override of the guard travels only when it is set in this shell, as it would reach claude.
+if [ -n "$MESH_GUARD_OVERRIDE" ]; then
+	exec sudo -iu "$agent" env MESH_GUARD_OVERRIDE="$MESH_GUARD_OVERRIDE" claude "$@"
+fi
+exec sudo -iu "$agent" claude "$@"
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/files/facts.json b/testdata/beside/mesh-catalog/modules/claude-code/files/facts.json
new file mode 100644
index 0000000..7fd72bd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/files/facts.json
@@ -0,0 +1,4 @@
+{
+  "node": "${machine:name}",
+  "console": "http://127.0.0.1:${bound:mcp-endpoint:port}/mcp"
+}
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/files/settings.json b/testdata/beside/mesh-catalog/modules/claude-code/files/settings.json
new file mode 100644
index 0000000..8284e66
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/files/settings.json
@@ -0,0 +1,10 @@
+{
+  "role": "",
+  "mcp_servers": {},
+  "managed_settings": {},
+  "instructions": {},
+  "output_styles": {},
+  "skills": {},
+  "commands": {},
+  "agents": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/files/zsh-normal b/testdata/beside/mesh-catalog/modules/claude-code/files/zsh-normal
new file mode 100644
index 0000000..b90b85f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/files/zsh-normal
@@ -0,0 +1,12 @@
+# The agent's session (module claude-code, novox/hq ADR 0266): where this machine names an account of the
+# agents' own, claude in an interactive zsh is claude-agent, which starts the session as that account. Where
+# agents run as the operator's account the file names that account, and nothing is added. claude-agent runs
+# the real claude: exec, sudo and its sh see no alias.
+if [[ -r /etc/claude-code/agent-account ]]; then
+	() {
+		local agent=$(</etc/claude-code/agent-account)
+		if [[ -n $agent && $agent != $USERNAME ]]; then
+			alias claude=claude-agent
+		fi
+	}
+fi
diff --git a/testdata/beside/mesh-catalog/modules/claude-code/module.json.captured b/testdata/beside/mesh-catalog/modules/claude-code/module.json.captured
new file mode 100644
index 0000000..b869d01
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-code/module.json.captured
@@ -0,0 +1,247 @@
+{
+  "module": "claude-code",
+  "version": "1",
+  "moved": true,
+  "slug": "agent",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "mcp-endpoint",
+    {
+      "name": "gitea-read",
+      "optional": true
+    }
+  ],
+  "binds": {
+    "mcp-endpoint": "${dir:state}/mcp-endpoint.json"
+  },
+  "secrets": {
+    "gitea-read": "${dir:state}/gitea-read.secret"
+  },
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "servers",
+    "holdings",
+    "config",
+    "proposals",
+    "questions",
+    "memory"
+  ],
+  "reads": [
+    "claude-licence-manager.bindings"
+  ],
+  "tools": [
+    "claude_code_status",
+    "claude_code_render",
+    "claude_code_guard",
+    "claude_code_pull",
+    "claude_code_grant",
+    "claude_code_add_api_key",
+    "claude_code_registrations",
+    "claude_code_memory",
+    "claude_code_mcp_list",
+    "claude_code_mcp_register",
+    "claude_code_mcp_unregister",
+    "claude_code_skill_list",
+    "claude_code_skill_register",
+    "claude_code_skill_unregister",
+    "claude_code_agent_list",
+    "claude_code_agent_register",
+    "claude_code_agent_unregister",
+    "claude_code_command_list",
+    "claude_code_command_register",
+    "claude_code_command_unregister",
+    "claude_code_hook_list",
+    "claude_code_hook_register",
+    "claude_code_hook_unregister",
+    "claude_code_output_style_list",
+    "claude_code_output_style_register",
+    "claude_code_output_style_unregister",
+    "claude_code_instructions_list",
+    "claude_code_instructions_register",
+    "claude_code_instructions_unregister",
+    "claude_code_instructions_propose",
+    "claude_code_proposals",
+    "claude_code_ask",
+    "claude_code_answer",
+    "claude_code_settings_get",
+    "claude_code_settings_set",
+    "claude_code_settings_clear",
+    "claude_code_permission_add",
+    "claude_code_permission_remove",
+    "claude_code_config_list",
+    "claude_code_config_show",
+    "claude_code_config_status",
+    "claude_code_config_import",
+    "claude_code_home_show",
+    "claude_code_home_remove",
+    "claude_code_home_removed",
+    "claude_code_home_restore",
+    "claude_code_judge",
+    "claude_code_judged"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "agent-home",
+        "path": "${dir:agent-home}",
+        "class": "valuable",
+        "why": "the operator's agent's own files: its memory, history and projects"
+      }
+    ]
+  },
+  "config": {
+    "role": {
+      "type": "string",
+      "description": "What this machine is for, in a sentence, written into the instructions every Claude Code session on it reads; empty says nothing.",
+      "trusted": true,
+      "default": ""
+    },
+    "mcp_servers": {
+      "type": "object",
+      "description": "The tool servers every session on this machine is given beside the mesh's own, by name, each as Claude Code's managed MCP configuration takes it; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "managed_settings": {
+      "type": "object",
+      "description": "Keys of Claude Code's managed settings every session on this machine obeys, such as spinnerTipsEnabled, laid over the mesh's own; empty adds none. Falls back to agent-managed-settings, the mesh's or this node's.",
+      "trusted": true,
+      "predefined": "agent-managed-settings",
+      "default": {}
+    },
+    "instructions": {
+      "type": "object",
+      "description": "The instructions every session on this machine reads, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "output_styles": {
+      "type": "object",
+      "description": "The output styles offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "skills": {
+      "type": "object",
+      "description": "The skills offered to every session on this machine, by name, each its files by path, a text as one line or a list of its lines; a skill without its SKILL.md is left out; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "commands": {
+      "type": "object",
+      "description": "The slash commands offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    },
+    "agents": {
+      "type": "object",
+      "description": "The agents offered to every session on this machine, by name, each a text as one line or a list of its lines; empty adds none.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "claude-code"
+    },
+    {
+      "id": "managed",
+      "type": "directory",
+      "path": "/etc/claude-code",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "/usr/local/bin/claude-agent",
+      "mode": "0755",
+      "template": "files/claude-agent"
+    },
+    {
+      "id": "agent-account-name",
+      "type": "file",
+      "path": "/etc/claude-code/agent-account",
+      "mode": "0644",
+      "template": "files/agent-account"
+    },
+    {
+      "id": "agent-account",
+      "type": "user",
+      "name": "${machine:agent-account}",
+      "home": "${machine:agent-home}",
+      "root": "${machine:agent-root}"
+    },
+    {
+      "id": "agent-home",
+      "type": "directory",
+      "path": "${machine:agent-home}/.claude",
+      "mode": "0700",
+      "owner": "${machine:agent-account}",
+      "unknown": "module"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "${machine:account}",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "facts",
+      "type": "file",
+      "path": "${dir:state}/facts.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "template": "files/facts.json"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "${machine:account}",
+      "takes-config": ["role", "mcp_servers", "managed_settings", "instructions", "output_styles", "skills", "commands", "agents"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-code",
+        "binary": "claude-code",
+        "loads": [
+          "claude-code"
+        ],
+        "env": {
+          "MESH_CLAUDE_CODE_STATE": "${dir:state}",
+          "MESH_CLAUDE_CODE_FACTS": "${dir:state}/facts.json",
+          "MESH_CLAUDE_CODE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/database.url b/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/database.url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/database.url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/settings.json b/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/settings.json
new file mode 100644
index 0000000..5d4aed5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-licence-manager/files/settings.json
@@ -0,0 +1,7 @@
+{
+  "cadence_minutes": 240,
+  "floor_minutes": 60,
+  "failures_to_notify": 3,
+  "cooldown_hours": 24,
+  "refresh_warn_days": 3
+}
diff --git a/testdata/beside/mesh-catalog/modules/claude-licence-manager/module.json.captured b/testdata/beside/mesh-catalog/modules/claude-licence-manager/module.json.captured
new file mode 100644
index 0000000..a55da31
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/claude-licence-manager/module.json.captured
@@ -0,0 +1,184 @@
+{
+  "module": "claude-licence-manager",
+  "version": "1",
+  "slug": "licmgr",
+  "requires": [
+    "postgres-database",
+    "secret"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "claude_licences",
+      "readable": [
+        "audit",
+        "binding"
+      ]
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "secret": {
+      "grant-key": "${dir:state}/grant.key"
+    }
+  },
+  "seats": [
+    {
+      "name": "anthropic-licence-manager",
+      "scope": "mesh",
+      "serves": [
+        "licences",
+        "bindings",
+        "bind",
+        "switch",
+        "release",
+        "refresh",
+        "usage",
+        "adopt",
+        "current",
+        "public-key"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "anthropic-licence-manager",
+      "scope": "mesh",
+      "serves": [
+        "licences",
+        "bindings",
+        "bind",
+        "switch",
+        "release",
+        "refresh",
+        "usage",
+        "adopt",
+        "current",
+        "public-key"
+      ]
+    }
+  ],
+  "emits": [
+    "licence.adopted",
+    "licence.refused",
+    "licence.bound",
+    "licence.switched",
+    "licence.released",
+    "licence.rotated",
+    "licence.failing",
+    "usage.read"
+  ],
+  "state": [
+    "bindings"
+  ],
+  "reads": [
+    "claude-code.holdings"
+  ],
+  "config": {
+    "cadence_minutes": {
+      "type": "number",
+      "description": "How old a licence's grant may grow before it is rotated, in minutes; 0 keeps 240.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 240
+    },
+    "floor_minutes": {
+      "type": "number",
+      "description": "How little time a grant may have left before it is refreshed in any case, in minutes; 0 keeps 60.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 60
+    },
+    "failures_to_notify": {
+      "type": "number",
+      "description": "How many refreshes of a licence fail in a row before the operator is told, a count; 0 keeps 3.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 3
+    },
+    "cooldown_hours": {
+      "type": "number",
+      "description": "How long after telling the operator about a licence nothing more is said about it, in hours; 0 keeps 24.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 24
+    },
+    "refresh_warn_days": {
+      "type": "number",
+      "description": "How long before a licence's refresh token itself expires the operator is warned, in days; 0 keeps 3.",
+      "minimum": 0,
+      "trusted": true,
+      "default": 3
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "template": "files/database.url"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "takes-config": ["cadence_minutes", "floor_minutes", "failures_to_notify", "cooldown_hours", "refresh_warn_days"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "claude-licence-manager-prepare",
+      "artifact": "code",
+      "run": [
+        "./claude-licence-manager",
+        "prepare"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/claude-licence-manager",
+        "binary": "claude-licence-manager",
+        "loads": [
+          "claude-licence-manager"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url",
+          "MESH_LICENCE_STATE": "${dir:state}",
+          "MESH_LICENCE_KEY_FILE": "${dir:state}/grant.key",
+          "MESH_LICENCE_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/clipmenud-session b/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/clipmenud-session
new file mode 100644
index 0000000..5bd40ee
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/clipmenud-session
@@ -0,0 +1,41 @@
+#!/bin/sh
+# clipmenud as the operator's user unit starts it, written by the mesh (module clipmenu). Replaced at every push.
+#
+# The account's service manager starts before the X server does, and has a DISPLAY only once the session's
+# xinitrc has handed it over (module xorg). So this waits, quietly, until the display is known, and exits
+# only when the session ends with it: a quick exit would run the unit into its start limit. DISPLAY, when
+# the manager has it, wins. Without it, exactly one X socket names the display; none or several (a
+# second server beside the session) wait for the session's own to arrive.
+# A running process does not see what the session hands the manager later, so each pass asks the manager.
+until [ -n "$DISPLAY" ]; do
+	for pair in $(systemctl --user show-environment 2>/dev/null | grep -E '^(DISPLAY|XAUTHORITY)='); do
+		export "$pair"
+	done
+	[ -n "$DISPLAY" ] && break
+	set -- /tmp/.X11-unix/X*
+	if [ $# -eq 1 ] && [ -S "$1" ]; then
+		DISPLAY=":${1##*/X}"
+		export DISPLAY
+	else
+		sleep 1
+	fi
+done
+if [ -z "$XAUTHORITY" ] && [ -r "$HOME/.Xauthority" ]; then
+	XAUTHORITY="$HOME/.Xauthority"
+	export XAUTHORITY
+fi
+# clipmenud allows one daemon per account: it takes an exclusive flock on its session_lock file and exits
+# with status 2 when that is held. After a delivery without a new login, the session's older clipmenud (from
+# its xinitrc) still holds it, and a start would run the unit round its restart loop. So this waits, quietly,
+# until the lock is free: it looks at the same file clipmenud locks (the directory is clipmenud's own rule)
+# and lets go at once. Exit status 1 is "held" for util-linux and BusyBox flock alike (no -E: BusyBox lacks it); any other outcome starts clipmenud, which says its own
+# error. Another daemon winning the gap between look and start costs one restart, not a loop.
+lock="${CM_DIR:-${XDG_RUNTIME_DIR-${TMPDIR-/tmp}}}/clipmenu.6.$USER/session_lock"
+while [ -e "$lock" ]; do
+	flock -n "$lock" true
+	[ $? -eq 1 ] || break
+	sleep 2
+done
+PATH="/usr/local/lib/mesh-clipmenu:$PATH"
+export PATH
+exec clipmenud
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/xsel b/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/xsel
new file mode 100755
index 0000000..10f9bbd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/bin/xsel
@@ -0,0 +1,20 @@
+#!/bin/sh
+# xsel as clipmenud sees it, written by the mesh (module clipmenu). Replaced at every push.
+#
+# clipmenud records text, and reads a selection with `timeout 1 xsel -o`. A selection holding an
+# image (a screenshot copied as image/png) is sent in pieces; one second is too short for megabytes,
+# timeout kills xsel half way, and the program owning the image waits for ever for a reader that is
+# gone. From then on nothing can ask the clipboard anything: pastes hang, and an Electron app that
+# asks on its main thread freezes. So a read goes ahead only when the selection offers text.
+case " $* " in
+*" -o "* | *" --output "*)
+	selection=clipboard
+	case " $* " in
+	*" --primary "* | *" -p "*) selection=primary ;;
+	*" --secondary "* | *" -s "*) selection=secondary ;;
+	esac
+	targets=$(timeout 1 xclip -selection "$selection" -t TARGETS -o 2>/dev/null) || exit 1
+	printf '%s\n' "$targets" | grep -qxE 'UTF8_STRING|STRING|TEXT|text/plain(;charset=utf-8)?' || exit 1
+	;;
+esac
+exec /usr/bin/xsel "$@"
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-histlength b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-histlength
new file mode 100644
index 0000000..60d3b2f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-histlength
@@ -0,0 +1 @@
+15
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-max-clips b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-max-clips
new file mode 100644
index 0000000..1b79f38
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-max-clips
@@ -0,0 +1 @@
+500
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-selections b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-selections
new file mode 100644
index 0000000..613d81a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/env-cm-selections
@@ -0,0 +1 @@
+clipboard
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/i3/50-clipmenu.conf b/testdata/beside/mesh-catalog/modules/clipmenu/files/i3/50-clipmenu.conf
new file mode 100644
index 0000000..41835e6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/i3/50-clipmenu.conf
@@ -0,0 +1,5 @@
+# The clipboard's history key (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at
+# every push. clipmenu shows the history through `dmenu`, the node's dmenu-compatible command, which
+# the holder of node-launcher answers (rofi on the workstations); the chosen entry is put back on the
+# clipboard.
+bindsym $mod+period exec --no-startup-id clipmenu -p Clipboard
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/files/systemd/clipmenud-mesh.conf b/testdata/beside/mesh-catalog/modules/clipmenu/files/systemd/clipmenud-mesh.conf
new file mode 100644
index 0000000..799e22d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/files/systemd/clipmenud-mesh.conf
@@ -0,0 +1,14 @@
+# clipmenud in the operator's account (module clipmenu, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# The package's unit starts clipmenud with no DISPLAY; the module's launcher finds the display and puts the
+# text-only xsel first on the PATH. The settings repeat the module's environment, which the account's
+# service manager does not read.
+[Unit]
+StartLimitIntervalSec=0
+
+[Service]
+RestartSec=2s
+Environment=CM_SELECTIONS=clipboard
+Environment=CM_MAX_CLIPS=500
+Environment=CM_HISTLENGTH=15
+ExecStart=
+ExecStart=/usr/local/lib/mesh-clipmenu/clipmenud-session
diff --git a/testdata/beside/mesh-catalog/modules/clipmenu/module.json.captured b/testdata/beside/mesh-catalog/modules/clipmenu/module.json.captured
new file mode 100644
index 0000000..30ec9c0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/clipmenu/module.json.captured
@@ -0,0 +1,135 @@
+{
+  "module": "clipmenu",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-clipboard",
+      "scope": "node",
+      "serves": [
+        "history",
+        "copy"
+      ]
+    }
+  ],
+  "tools": [
+    "clipmenu_paste",
+    "clipmenu_clear",
+    "clipmenu_delete"
+  ],
+  "items": [
+    {
+      "collection": "environment",
+      "name": "cm-selections",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_SELECTIONS"
+      },
+      "template": "files/env-cm-selections"
+    },
+    {
+      "collection": "environment",
+      "name": "cm-max-clips",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_MAX_CLIPS"
+      },
+      "template": "files/env-cm-max-clips"
+    },
+    {
+      "collection": "environment",
+      "name": "cm-histlength",
+      "attributes": {
+        "kind": "variable",
+        "name": "CM_HISTLENGTH"
+      },
+      "template": "files/env-cm-histlength"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-clipmenu.conf"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "clipmenu"
+    },
+    {
+      "id": "greenclip",
+      "type": "package",
+      "package": "rofi-greenclip",
+      "absent": true
+    },
+    {
+      "id": "text-only",
+      "type": "file",
+      "path": "/usr/local/lib/mesh-clipmenu/xsel",
+      "mode": "0755",
+      "template": "files/bin/xsel"
+    },
+    {
+      "id": "daemon-dropins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/systemd/user/clipmenud.service.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "daemon-dropin",
+      "type": "file",
+      "path": "${machine:account-home}/.config/systemd/user/clipmenud.service.d/mesh.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/systemd/clipmenud-mesh.conf"
+    },
+    {
+      "id": "launcher",
+      "type": "file",
+      "path": "/usr/local/lib/mesh-clipmenu/clipmenud-session",
+      "mode": "0755",
+      "template": "files/bin/clipmenud-session"
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "clipmenud.service",
+      "scope": "user",
+      "user": "${machine:account}",
+      "state": "running",
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/clipmenu-tools",
+        "binary": "clipmenu-tools",
+        "loads": [
+          "clipmenu-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/confluence/files/config.json b/testdata/beside/mesh-catalog/modules/confluence/files/config.json
new file mode 100644
index 0000000..9e26dfe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/confluence/files/config.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/confluence/module.json.captured b/testdata/beside/mesh-catalog/modules/confluence/module.json.captured
new file mode 100644
index 0000000..caa0d1b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/confluence/module.json.captured
@@ -0,0 +1,76 @@
+{
+  "module": "confluence",
+  "version": "1",
+  "slug": "confl",
+  "own-secrets": {
+    "token": "${dir:state}/token"
+  },
+  "config": {
+    "atlassian-url": {
+      "type": "string",
+      "description": "The address of the operator's Atlassian site the confluence tools call, as a URL such as https://example.atlassian.net, laid into the file as ATLASSIAN_URL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    },
+    "atlassian-email": {
+      "type": "string",
+      "description": "The email address of the Atlassian account the confluence tools sign in as with its API token, laid into the file as ATLASSIAN_EMAIL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "merge": "json",
+      "template": "files/config.json",
+      "mode": "0600",
+      "takes-config": [
+        {
+          "key": "atlassian-url",
+          "as": "ATLASSIAN_URL"
+        },
+        {
+          "key": "atlassian-email",
+          "as": "ATLASSIAN_EMAIL"
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_CONFLUENCE_TOKEN_FILE": "${dir:state}/token",
+          "MESH_CONFLUENCE_CONFIG_FILE": "${dir:state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/cups/module.json.captured b/testdata/beside/mesh-catalog/modules/cups/module.json.captured
new file mode 100644
index 0000000..01a4822
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/cups/module.json.captured
@@ -0,0 +1,58 @@
+{
+  "module": "cups",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "cups_printers",
+    "cups_queue",
+    "cups_cancel",
+    "cups_print",
+    "cups_default",
+    "cups_resume",
+    "cups_drivers"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "cups"
+    },
+    {
+      "id": "driverless",
+      "type": "package",
+      "package": "cups-filters"
+    },
+    {
+      "id": "socket",
+      "type": "service",
+      "unit": "cups.socket",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "scheduler",
+      "type": "service",
+      "unit": "cups.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/cups-tools",
+        "binary": "cups-tools",
+        "loads": [
+          "cups-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/dbus/module.json.captured b/testdata/beside/mesh-catalog/modules/dbus/module.json.captured
new file mode 100644
index 0000000..c0e28b3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dbus/module.json.captured
@@ -0,0 +1,67 @@
+{
+  "module": "dbus",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-message-bus",
+      "scope": "node"
+    }
+  ],
+  "emits": [
+    "bus.stalled",
+    "bus.recovered",
+    "bus.restarted",
+    "service.appeared",
+    "service.left",
+    "policy.denied"
+  ],
+  "tools": [
+    "dbus_names",
+    "dbus_introspect",
+    "dbus_monitor",
+    "dbus_check",
+    "dbus_health"
+  ],
+  "resources": [
+    {
+      "id": "dbus",
+      "type": "package",
+      "package": "dbus"
+    },
+    {
+      "id": "broker",
+      "type": "package",
+      "package": "dbus-broker"
+    },
+    {
+      "id": "broker-units",
+      "type": "package",
+      "package": "dbus-broker-units"
+    },
+    {
+      "id": "system-bus",
+      "type": "service",
+      "unit": "dbus-broker.service",
+      "state": "running"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dbus-tools",
+        "binary": "dbus-tools",
+        "loads": [
+          "dbus-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/desk-channel/files/settings.json b/testdata/beside/mesh-catalog/modules/desk-channel/files/settings.json
new file mode 100644
index 0000000..1ef16fd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/desk-channel/files/settings.json
@@ -0,0 +1,3 @@
+{
+  "desktop-machines": []
+}
diff --git a/testdata/beside/mesh-catalog/modules/desk-channel/module.json.captured b/testdata/beside/mesh-catalog/modules/desk-channel/module.json.captured
new file mode 100644
index 0000000..115ce62
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/desk-channel/module.json.captured
@@ -0,0 +1,106 @@
+{
+  "module": "desk-channel",
+  "version": "1",
+  "slug": "desk",
+  "runs-as": "desk-channel",
+  "claims": [
+    {
+      "name": "channel",
+      "scope": "mesh",
+      "kind": "desktop",
+      "capabilities": [
+        "deliver",
+        "silent",
+        "loud",
+        "edit",
+        "private",
+        "choice",
+        "exact-render"
+      ]
+    },
+    {
+      "name": "intake",
+      "scope": "mesh",
+      "kind": "desktop"
+    }
+  ],
+  "consumes": [
+    "dunst.action-chosen",
+    "dunst.started",
+    "dunst.paused"
+  ],
+  "invokes": [
+    "seat:node-notifier.send"
+  ],
+  "state": [
+    {
+      "name": "shown",
+      "ttl-seconds": 2592000
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "desk-channel",
+  "tools": [
+    "desk_channel_status"
+  ],
+  "config": {
+    "desktop-machines": {
+      "type": "list",
+      "description": "The machines, by node name, whose desktop shows the operator's questions and notifications, in the order they are tried; empty shows them on none.",
+      "trusted": true,
+      "default": []
+    }
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "desk-channel",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/desk-channel"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "desk-channel",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "desk-channel",
+      "takes-config": ["desktop-machines"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/desk-channel",
+        "binary": "desk-channel",
+        "loads": [
+          "desk-channel"
+        ],
+        "env": {
+          "MESH_DESK_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/dev-tools/module.json.captured b/testdata/beside/mesh-catalog/modules/dev-tools/module.json.captured
new file mode 100644
index 0000000..094f833
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dev-tools/module.json.captured
@@ -0,0 +1,38 @@
+{
+  "module": "dev-tools",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "go-toolchain",
+    "node-toolchain"
+  ],
+  "resources": [
+    {
+      "id": "c-compiler",
+      "type": "package",
+      "package": "gcc"
+    },
+    {
+      "id": "make",
+      "type": "package",
+      "package": "make"
+    },
+    {
+      "id": "python",
+      "type": "package",
+      "package": "python"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    },
+    {
+      "id": "jq",
+      "type": "package",
+      "package": "jq"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/disk-load/module.json.captured b/testdata/beside/mesh-catalog/modules/disk-load/module.json.captured
new file mode 100644
index 0000000..e50253e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/disk-load/module.json.captured
@@ -0,0 +1,26 @@
+{
+  "module": "disk-load",
+  "version": "1",
+  "tools": [
+    "disk_load",
+    "disk_top",
+    "disk_filesystems",
+    "disk_devices",
+    "cpu_top"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/disk-load",
+        "binary": "disk-load",
+        "loads": [
+          "disk-load"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/distribution/module.json.captured b/testdata/beside/mesh-catalog/modules/distribution/module.json.captured
new file mode 100644
index 0000000..eb9f7c2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/distribution/module.json.captured
@@ -0,0 +1,96 @@
+{
+  "module": "distribution",
+  "version": "1",
+  "provides": [
+    {
+      "name": "artifact-store",
+      "scope": "mesh"
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-artifact-store",
+      "scope": "mesh"
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "own-secrets": {
+    "broker": "/var/lib/mesh/registry/broker"
+  },
+  "serves": {
+    "artifact-store": {
+      "port": 5000
+    }
+  },
+  "listens": [
+    {
+      "name": "registry",
+      "port": 5000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "every machine pulls images and artifacts from here"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "registry",
+        "path": "${dir:registry-data}",
+        "class": "rebuildable",
+        "backup": "none",
+        "measure": "shallow",
+        "why": "the artifact store: every image is built again from its source, and too large to copy every night (ADR 0214 left it out)"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/mesh/registry",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "registry-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-registry",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "store",
+      "type": "container",
+      "name": "mesh-registry",
+      "image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
+      "ports": [
+        "5000:5000"
+      ],
+      "volumes": [
+        "/var/lib/mesh-registry:/var/lib/registry"
+      ],
+      "env": {
+        "REGISTRY_STORAGE_DELETE_ENABLED": "true"
+      }
+    },
+    {
+      "id": "collect",
+      "type": "container",
+      "name": "mesh-registry-collect",
+      "image": "registry@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
+      "volumes": [
+        "/var/lib/mesh-registry:/var/lib/registry"
+      ],
+      "args": [
+        "garbage-collect",
+        "/etc/docker/registry/config.yml"
+      ],
+      "schedule": "30 3 * * *",
+      "while-stopped": [
+        "store"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/dmenu/module.json.captured b/testdata/beside/mesh-catalog/modules/dmenu/module.json.captured
new file mode 100644
index 0000000..aeeb3ce
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dmenu/module.json.captured
@@ -0,0 +1,33 @@
+{
+  "module": "dmenu",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "dmenu_menu",
+    "dmenu_session"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dmenu"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dmenu-tools",
+        "binary": "dmenu-tools",
+        "loads": [
+          "dmenu-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/dnsmasq/files/dnsmasq.conf b/testdata/beside/mesh-catalog/modules/dnsmasq/files/dnsmasq.conf
new file mode 100644
index 0000000..10f3926
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dnsmasq/files/dnsmasq.conf
@@ -0,0 +1,87 @@
+# Managed by the mesh. dnsmasq's own defaults are replaced whole rather than
+# patched, because this module owns the file and a patch would leave whatever
+# was there before to be discovered later.
+#
+# This is one of the mesh's resolvers (novox/hq ADR 0194, 0223): it holds the
+# `mesh-dns-resolver` seat, which more than one machine may hold, each answering
+# the same names from the same roster. Every node and every container lists every
+# holder and no public resolver, so whichever answers first gives the one answer.
+# It holds the mesh's own names and nothing else (ADR 0191) — the roster is the
+# mesh's, rendered into each holder; no other copy lives on any machine.
+
+# What the mesh computed: one wildcard per machine — its name and everything
+# under it — and the mesh's own suffix as a local domain, so a name under it is
+# answered here or not at all and is never asked upstream. Rewritten whenever a
+# machine joins or leaves, which is why the service below restarts on it: a
+# reload makes dnsmasq re-read hosts files, not its configuration, and a
+# wildcard is configuration.
+conf-file=/etc/mesh-resolver/nodes.conf
+
+# Every zone a module answers itself (ADR 0199): one forwarding line per zone, to
+# the private address of the machine its module runs on and the port its
+# answerer is published on. Nothing in a zone is answered here; what names a zone
+# holds is the module's. Rewritten whenever a zone is declared or moves, and the
+# service restarts on it for the same reason as above.
+conf-file=/etc/mesh-resolver/zones.conf
+
+# Where it answers: this machine's private address, so every node — and every
+# container on every node, which copies its machine's resolvers — can ask; and
+# loopback, for this machine's own use. Never a LAN address: a device that is
+# not a member cannot reach what the mesh's names point at, and a LAN's resolver
+# is its router's (ADR 0194).
+#
+# Named as an ADDRESS and not as the interface that carries it, on purpose. A
+# container's query is addressed to this address but arrives on the runtime's
+# bridge, and dnsmasq checks every query against what it was told to answer on:
+# an `interface=` line admits queries by the interface they arrive on, a
+# `listen-address=` line by the address they are sent to. With `interface=mesh0`
+# alone, a query from a container was received and dropped without a word
+# (novox/hq 04-ISSUES/110). The address admits it whatever bridge it comes in on.
+#
+# bind-interfaces, and never bind-dynamic (novox/hq issue 348). bind-dynamic
+# re-reads the machine's addresses on every change of any link and closes each
+# listener whose interface that reading did not find; a reading made while the
+# container runtime deletes a bridge's virtual links fails ("index gone"), and
+# then every listener is closed until a later change reads cleanly. On
+# 2026-10-09 the private address was left unbound for twenty minutes, the daemon
+# running and silent. bind-interfaces binds each address once, at start, and
+# never closes it. It cannot bind an address that is not there yet, so the unit
+# waits for it (the drop-in below); a new private address restarts the unit, as
+# this file changing always did.
+bind-interfaces
+listen-address=${machine:address}
+listen-address=127.0.0.1
+
+# **It must never read resolv.conf to find out where to forward.** This
+# machine's resolv.conf names this resolver — so a resolver that read it for
+# upstreams would find itself, and every query it could not answer locally would
+# loop until its receive queue filled. That is not theoretical: it filled with
+# 15KB of queries and every lookup on the machine hung. no-resolv makes that loop
+# impossible: the upstreams are the two lines below, and nothing on the machine
+# can redirect them. The mesh's own names never reach them: the local= line in
+# the file above stops them here, answered or refused.
+no-resolv
+server=1.1.1.1
+server=8.8.8.8
+
+# Both upstreams validate DNSSEC and say so with the Authenticated Data bit,
+# and this passes that bit down rather than dropping it, which dnsmasq does
+# unless told. It does not validate itself: an answer's trust is the upstream's
+# and the path to it, which is what a forwarding resolver's trust always was.
+# Without it a program that refuses to run behind a resolver that does not
+# validate — a mail system's admin does exactly that check at start — cannot
+# use this resolver (novox/hq 04-ISSUES/171).
+proxy-dnssec
+
+# A name without a dot is never forwarded, and reverse lookups of private ranges
+# are answered here rather than asking the world who 10.x is.
+domain-needed
+bogus-priv
+
+# **No hosts file, and no operator's files.** This machine's /etc/hosts is its
+# own — the hosts module's block and the operator's lines (ADR 0199) — and the
+# mesh's resolver answers every node, so a line written for one machine's own
+# programs must not become an answer for all of them. Every per-node resolver
+# went wrong exactly here: a hosts file read once at start, an operator's old
+# line beside the mesh's, a drop-in read from a directory nobody owned.
+no-hosts
diff --git a/testdata/beside/mesh-catalog/modules/dnsmasq/files/mesh.conf b/testdata/beside/mesh-catalog/modules/dnsmasq/files/mesh.conf
new file mode 100644
index 0000000..96d8d7d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dnsmasq/files/mesh.conf
@@ -0,0 +1,14 @@
+# Written by the mesh (module dnsmasq, novox/hq issue 348). Replaced on every push.
+#
+# The resolver binds its addresses once, at start (bind-interfaces), so it starts only once this
+# machine's private address is there: it waits up to 80 seconds for it, and a start that found it
+# missing is tried again every ten seconds rather than left failed.
+[Unit]
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=0
+
+[Service]
+ExecStartPre=/usr/bin/sh -c 'for i in $(seq 1 80); do ip -4 -o addr show to ${machine:address} | grep -q . && exit 0; sleep 1; done; echo "${machine:address} is not on this machine" >&2; exit 1'
+Restart=on-failure
+RestartSec=10s
diff --git a/testdata/beside/mesh-catalog/modules/dnsmasq/module.json.captured b/testdata/beside/mesh-catalog/modules/dnsmasq/module.json.captured
new file mode 100644
index 0000000..58cc0da
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dnsmasq/module.json.captured
@@ -0,0 +1,162 @@
+{
+  "module": "dnsmasq",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the mesh's resolver: a build that breaks it can stop a machine resolving the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236, issue 260)"
+  },
+  "provides": [
+    {
+      "name": "wildcard-resolution",
+      "scope": "mesh",
+      "identity": false
+    }
+  ],
+  "requires": [
+    "mesh-addressing"
+  ],
+  "emits": [
+    "name.added",
+    "name.removed",
+    "restarted",
+    "restart-judged"
+  ],
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "claims": [
+    {
+      "name": "mesh-dns-resolver",
+      "scope": "mesh"
+    }
+  ],
+  "tools": [
+    "dnsmasq_health",
+    "dnsmasq_names",
+    "dnsmasq_resolve"
+  ],
+  "listens": [
+    {
+      "name": "dns-udp",
+      "port": 53,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "one of the mesh's resolvers (ADR 0194, 0223): every node's and every container's resolver, beside any other holder of the seat — the mesh's own names answered here, a module's zone forwarded to it, the rest forwarded upstream",
+      "fixed": true
+    },
+    {
+      "name": "dns-tcp",
+      "port": 53,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the same names over tcp, which a resolver answers on as well and is asked for whenever an answer will not fit in a datagram. Declared because the daemon serves it: a declaration that covers one of the two protocols its own service listens on leaves the other closed while everything reports success",
+      "fixed": true
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dnsmasq"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/dnsmasq.conf",
+      "mode": "0644",
+      "template": "files/dnsmasq.conf"
+    },
+    {
+      "id": "drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/dnsmasq.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "wait-for-address",
+      "type": "file",
+      "path": "/etc/systemd/system/dnsmasq.service.d/mesh.conf",
+      "mode": "0644",
+      "template": "files/mesh.conf"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "dnsmasq.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "config",
+        "wait-for-address",
+        "dnsmasq.fact-node-zones",
+        "dnsmasq.fact-zones"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch-dir",
+      "type": "directory",
+      "path": "/var/lib/dnsmasq-watch",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "dnsmasq-watch",
+      "artifact": "tools",
+      "run": [
+        "./dnsmasq-tools",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "dnsmasq_health",
+        "interval": "20s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    }
+  ],
+  "facts": {
+    "node-zones": {
+      "path": "/etc/mesh-resolver/nodes.conf",
+      "template": "# Generated by the mesh. Do not edit — this file is replaced whenever a machine\n# joins or leaves, and an edit would survive until then and vanish.\n\nlocal=/{{.Suffix}}/\n# A machine's own name is a host record as well as a wildcard: asked for an IPv6 address, the\n# resolver then says the name exists and has none, where the wildcard alone said there is no such\n# name — and a resolver that reads that as final (musl, so every Alpine container) failed to find\n# the machine at all (novox/hq issue 262).\n{{range .Machines}}address=/{{.FQDN}}/{{.Address}}\nhost-record={{.FQDN}},{{.Address}}\n{{end}}"
+    },
+    "zones": {
+      "path": "/etc/mesh-resolver/zones.conf",
+      "template": "# Generated by the mesh. Do not edit — this file is replaced whenever a module declares a zone or\n# its machine moves (novox/hq ADR 0199). One forwarding line per zone, to the module answering it.\n\n{{range .Zones}}server=/{{.Zone}}/{{.Address}}#{{.Port}}\n{{end}}"
+    }
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dnsmasq-tools",
+        "binary": "dnsmasq-tools",
+        "loads": [
+          "dnsmasq-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/docker-compose/module.json.captured b/testdata/beside/mesh-catalog/modules/docker-compose/module.json.captured
new file mode 100644
index 0000000..2f576b4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker-compose/module.json.captured
@@ -0,0 +1,40 @@
+{
+  "module": "docker-compose",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "docker_compose_projects",
+    "docker_compose_ps",
+    "docker_compose_logs",
+    "docker_compose_config",
+    "docker_compose_up",
+    "docker_compose_down",
+    "docker_compose_restart",
+    "docker_compose_pull",
+    "docker_compose_job"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "docker-compose"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/docker-compose-tools",
+        "binary": "docker-compose-tools",
+        "loads": [
+          "docker-compose-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/docker/files/daemon.json b/testdata/beside/mesh-catalog/modules/docker/files/daemon.json
new file mode 100644
index 0000000..83750f4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker/files/daemon.json
@@ -0,0 +1 @@
+{"live-restore": true, "insecure-registries": ["${seat:mesh-artifact-store:reach}"], "log-driver": "json-file", "log-opts": {"max-size": "${config:log-max-size}", "max-file": "${config:log-max-file}"}}
diff --git a/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.service b/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.service
new file mode 100644
index 0000000..b9b92c1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.service
@@ -0,0 +1,15 @@
+# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
+[Unit]
+Description=Prune dangling images and unused build cache (the mesh's docker module)
+# Never volumes, never a container, never an image a container uses: dangling
+# images and build cache nothing refers to, unused for a week. What a person
+# prunes beyond that is docker_prune's, by hand.
+After=docker.service
+ConditionPathExists=/run/docker.sock
+
+[Service]
+Type=oneshot
+Nice=19
+IOSchedulingClass=idle
+ExecStart=/usr/bin/docker image prune --force --filter until=168h
+ExecStart=/usr/bin/docker builder prune --force --filter until=168h
diff --git a/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.timer b/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.timer
new file mode 100644
index 0000000..82befd1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker/files/docker-prune.timer
@@ -0,0 +1,11 @@
+# Generated by the mesh. Do not edit — module docker writes this file and replaces it at every push.
+[Unit]
+Description=Weekly prune of dangling images and unused build cache (the mesh's docker module)
+
+[Timer]
+OnCalendar=weekly
+RandomizedDelaySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/testdata/beside/mesh-catalog/modules/docker/files/log-rotation.conf b/testdata/beside/mesh-catalog/modules/docker/files/log-rotation.conf
new file mode 100644
index 0000000..3919036
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker/files/log-rotation.conf
@@ -0,0 +1,5 @@
+# The log rotation daemon.json takes, written by the mesh from this machine's settings log-max-size and
+# log-max-file, and judged by the step log-rotation-check before daemon.json is written (novox/hq issue 452).
+# Replaced on every push; change the settings, never this file.
+size=${config:log-max-size}
+files=${config:log-max-file}
diff --git a/testdata/beside/mesh-catalog/modules/docker/module.json.captured b/testdata/beside/mesh-catalog/modules/docker/module.json.captured
new file mode 100644
index 0000000..a3a75e0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/docker/module.json.captured
@@ -0,0 +1,179 @@
+{
+  "module": "docker",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager",
+    "privileged"
+  ],
+  "invokes": [
+    "seat:mesh-controller.images"
+  ],
+  "claims": [
+    {
+      "name": "node-container-runtime",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "docker_list",
+    "docker_inspect",
+    "docker_resolv_conf",
+    "docker_logs",
+    "docker_secrets_in_logs",
+    "docker_secrets_in_events",
+    "docker_stats",
+    "docker_start",
+    "docker_stop",
+    "docker_restart",
+    "docker_top",
+    "docker_images",
+    "docker_prune",
+    "docker_prune_images",
+    "docker_disk_usage",
+    "docker_networks",
+    "docker_volumes",
+    "docker_events",
+    "docker_daemon_config",
+    "docker_unlabelled",
+    "docker_problems",
+    "docker_ports"
+  ],
+  "replaces": {
+    "docker_resolv_conf": [
+      "docker exec cat /etc/resolv.conf"
+    ]
+  },
+    "config": {
+      "log-max-size": {
+        "type": "string",
+        "description": "The size each container's log is cut at, a whole number from 1 with k, m or g after it; the runtime keeps log-max-file of them, so 100m and 10 hold about 1 GB per container (novox/hq issue 452). The runtime reads it only at its next start, which the mesh never forces, and a container created before that keeps the options it was created with until it is created again.",
+        "pattern": "[1-9][0-9]*[kmg]",
+        "trusted": true,
+        "default": "100m"
+      },
+      "log-max-file": {
+        "type": "number",
+        "description": "How many of a container's log files of log-max-size the runtime keeps, a count from 1 to 99, the oldest dropped first; taken at the runtime's next start and by containers created after it, like log-max-size (novox/hq issue 452).",
+        "minimum": 1,
+        "maximum": 99,
+        "trusted": true,
+        "default": 10
+      }
+    },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "docker"
+    },
+    {
+      "id": "buildx",
+      "type": "package",
+      "package": "docker-buildx"
+    },
+    {
+      "id": "socket",
+      "type": "service",
+      "unit": "docker.socket",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "log-rotation",
+      "type": "file",
+      "path": "${dir:state}/log-rotation.conf",
+      "mode": "0600",
+      "trusted": true,
+      "template": "files/log-rotation.conf"
+    },
+    {
+      "id": "log-rotation-check",
+      "type": "process",
+      "name": "docker-log-rotation-check",
+      "artifact": "tools",
+      "run": [
+        "./docker-tools",
+        "check-log-rotation"
+      ],
+      "run-once": true,
+      "env": {
+        "DOCKER_LOG_ROTATION": "${dir:state}/log-rotation.conf"
+      },
+      "restart-on": [
+        "log-rotation"
+      ]
+    },
+    {
+      "id": "daemon",
+      "type": "file",
+      "path": "/etc/docker/daemon.json",
+      "mode": "0644",
+      "into": "json",
+      "trusted": true,
+      "template": "files/daemon.json"
+    },
+    {
+      "id": "runtime",
+      "type": "service",
+      "unit": "docker.service",
+      "state": "running",
+      "boot": "enabled",
+      "reload-on": [
+        "daemon"
+      ]
+    },
+    {
+      "id": "prune-service",
+      "type": "file",
+      "path": "/etc/systemd/system/docker-prune.service",
+      "mode": "0644",
+      "template": "files/docker-prune.service"
+    },
+    {
+      "id": "prune-timer",
+      "type": "file",
+      "path": "/etc/systemd/system/docker-prune.timer",
+      "mode": "0644",
+      "template": "files/docker-prune.timer"
+    },
+    {
+      "id": "prune",
+      "type": "service",
+      "unit": "docker-prune.timer",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "prune-service",
+        "prune-timer"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/docker-tools",
+        "binary": "docker-tools",
+        "loads": [
+          "docker-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/dunst/files/dunstrc b/testdata/beside/mesh-catalog/modules/dunst/files/dunstrc
new file mode 100644
index 0000000..afba676
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dunst/files/dunstrc
@@ -0,0 +1,110 @@
+# dunst, the notifier (module dunst, novox/hq ADR 0208). Owned by the mesh: this file is replaced
+# at every push. Adopted from the laptop's file of 2026-10-04 (the two workstations differed in
+# position, transparency and corner radius; the laptop's square, opaque, top-right one matches the
+# rest of the desktop). Only what differs from dunst's defaults, and what the desktop relies on.
+#
+# Other modules' rules go in ~/.config/dunst/dunstrc.d/*.conf, which dunst reads after this file,
+# so a drop-in outranks it. dunst is started by D-Bus on the first notification: nothing starts it.
+# When the mesh rewrites this file (a font-size or width setting changed), it tells a running dunst
+# to read it again (its unit's reload, dunstctl reload); what is on screen stays.
+
+[global]
+    monitor = 0
+    follow = none
+
+    # Geometry
+    width = ${config:width}
+    height = (0, 300)
+    origin = top-right
+    offset = (10, 50)
+    notification_limit = 20
+
+    progress_bar = true
+    progress_bar_height = 10
+    progress_bar_frame_width = 1
+    progress_bar_min_width = 150
+    progress_bar_max_width = 300
+
+    indicate_hidden = yes
+    transparency = 0
+    separator_height = 2
+    padding = 8
+    horizontal_padding = 8
+    text_icon_padding = 0
+    frame_width = 3
+    frame_color = "#de5200"
+    gap_size = 0
+    separator_color = frame
+    sort = yes
+    corner_radius = 0
+
+    # Text: the interface face (research 026/04)
+    font = Inter ${config:font-size}
+    line_height = 0
+    markup = full
+    format = "<b>%s</b>\n%b"
+    alignment = left
+    vertical_alignment = center
+    show_age_threshold = 60
+    ellipsize = middle
+    ignore_newline = no
+    stack_duplicates = true
+    hide_duplicate_count = false
+    show_indicators = yes
+
+    # Icons, from the desktop's icon theme
+    enable_recursive_icon_lookup = true
+    icon_theme = Adwaita
+    icon_position = left
+    min_icon_size = 32
+    max_icon_size = 128
+
+    # History
+    sticky_history = yes
+    history_length = 20
+
+    # The context menu is rofi (installed by the rofi module); -no-custom keeps typed text from becoming a choice. Not `dmenu`, the node-launcher's command in
+    # ~/.local/bin: dunst runs in the account's service manager, whose PATH does not hold that
+    # directory (seen on the laptop on 2026-10-10), so the menu never opened. Links open in the
+    # desktop's default browser.
+    dmenu = rofi -dmenu -no-custom -p dunst
+    browser = /usr/bin/xdg-open
+    always_run_script = true
+
+    title = Dunst
+    class = Dunst
+    ignore_dbusclose = false
+
+    # A tap answers (the touchpads have no middle button). do_action runs the notification's only
+    # action, or opens the context menu when it has several; without actions it opens its one link,
+    # if it has one. The notification then closes; a menu dismissed with Escape leaves it shown.
+    mouse_left_click = do_action, close_current
+    mouse_middle_click = do_action, close_current
+    mouse_right_click = close_all
+
+[urgency_low]
+    background = "#000000"
+    foreground = "#ffffff"
+    timeout = 10
+
+[urgency_normal]
+    background = "#000000"
+    foreground = "#ffffff"
+    timeout = 10
+
+[urgency_critical]
+    background = "#000000"
+    foreground = "#ffffff"
+    frame_color = "#ff0000"
+    timeout = 0
+
+# What is shown once is never kept (the review of 2026-10-09): a notification marked secret (a link's
+# code, category mesh.secret) and any transient one leave no entry in the history, which
+# node-notifier.history serves to every caller of the mesh's verbs.
+[mesh-secret]
+    category = "mesh.secret"
+    history_ignore = yes
+
+[transient-history-ignore]
+    match_transient = yes
+    history_ignore = yes
diff --git a/testdata/beside/mesh-catalog/modules/dunst/files/i3/50-dunst.conf b/testdata/beside/mesh-catalog/modules/dunst/files/i3/50-dunst.conf
new file mode 100644
index 0000000..fec1f8d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dunst/files/i3/50-dunst.conf
@@ -0,0 +1,4 @@
+# The notifications' key (module dunst, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# Super+N opens the menu (rofi) of the actions and links of every notification on screen, so one is
+# chosen from the keyboard as a tap chooses it on the notification.
+bindsym $mod+n exec --no-startup-id dunstctl context
diff --git a/testdata/beside/mesh-catalog/modules/dunst/module.json.captured b/testdata/beside/mesh-catalog/modules/dunst/module.json.captured
new file mode 100644
index 0000000..0c6983b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/dunst/module.json.captured
@@ -0,0 +1,123 @@
+{
+  "module": "dunst",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-notifier",
+      "scope": "node",
+      "serves": [
+        "send",
+        "history"
+      ]
+    }
+  ],
+  "tools": [
+    "dunst_pause",
+    "dunst_resume",
+    "dunst_close_all",
+    "dunst_rules",
+    "dunst_count",
+    "dunst_reload"
+  ],
+    "config": {
+      "font-size": {
+        "type": "number",
+        "description": "The size of a notification's text, in points of Inter: 10 reads well on a screen of about 100 DPI, and a denser screen needs a larger size.",
+        "minimum": 6,
+        "maximum": 72,
+        "predefined": "font-size",
+        "default": 10
+      },
+      "width": {
+        "type": "number",
+        "description": "The width of a notification, in pixels: 250 fits a title of about forty characters at 10 points, and a larger font needs a wider notification.",
+        "minimum": 50,
+        "maximum": 4000,
+        "default": 250
+      }
+    },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "dunst"
+    },
+    {
+      "id": "client",
+      "type": "package",
+      "package": "libnotify"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "dropins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/dunst/dunstrc.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["50-slack.conf"]
+    },
+    {
+      "id": "configuration",
+      "trusted": false,
+      "type": "file",
+      "path": "${machine:account-home}/.config/dunst/dunstrc",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/dunstrc"
+    },
+    {
+      "id": "notifier",
+      "type": "service",
+      "unit": "dunst.service",
+      "scope": "user",
+      "user": "${machine:account}",
+      "reload-on": [
+        "configuration"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/dunst-tools",
+        "binary": "dunst-tools",
+        "loads": [
+          "dunst-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "emits": [
+    "action-chosen",
+    "started",
+    "paused"
+  ],
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-dunst.conf"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/fail2ban b/testdata/beside/mesh-catalog/modules/fail2ban/files/fail2ban
new file mode 100644
index 0000000..b5395db
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/fail2ban
@@ -0,0 +1,7 @@
+/var/log/fail2ban.log {
+    missingok
+    notifempty
+    postrotate
+      /usr/bin/fail2ban-client flushlogs >/dev/null || true
+    endscript
+}
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/iptables-allports-dualchain.conf b/testdata/beside/mesh-catalog/modules/fail2ban/files/iptables-allports-dualchain.conf
new file mode 100644
index 0000000..2c9fc73
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/iptables-allports-dualchain.conf
@@ -0,0 +1,40 @@
+# Fail2Ban action: ban in both INPUT and DOCKER-USER chains
+# Used by recidive to block repeat offenders from both host and Docker services
+
+[INCLUDES]
+
+before = iptables.conf
+
+[Definition]
+
+type = allports
+
+actionstart = { <iptables> -C f2b-<name> -j <returntype> >/dev/null 2>&1; } || { <iptables> -N f2b-<name> || true; <iptables> -A f2b-<name> -j <returntype>; }
+              { <iptables> -C INPUT -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I INPUT -p <protocol> -j f2b-<name>; }
+              { <iptables> -C DOCKER-USER -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I DOCKER-USER -p <protocol> -j f2b-<name>; }
+
+actionstop = <iptables> -D INPUT -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -D DOCKER-USER -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -F f2b-<name>
+             <iptables> -X f2b-<name>
+
+actioncheck = <iptables> -n -L f2b-<name> >/dev/null
+
+actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+
+actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+
+[Init]
+
+chain = INPUT
+name = default
+protocol = tcp
+blocktype = REJECT --reject-with icmp-port-unreachable
+returntype = RETURN
+lockingopt = -w
+iptables = iptables <lockingopt>
+
+[Init?family=inet6]
+
+blocktype = REJECT --reject-with icmp6-port-unreachable
+iptables = ip6tables <lockingopt>
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/jail.local b/testdata/beside/mesh-catalog/modules/fail2ban/files/jail.local
new file mode 100644
index 0000000..1fa0ffe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/jail.local
@@ -0,0 +1,48 @@
+[INCLUDES]
+
+before = paths-arch.conf
+
+[DEFAULT]
+
+# Never act on the machine itself or on a tunnel peer: the mesh's private range is
+# ${machine:mesh-range}, named here rather than written as a value the module cannot
+# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.
+# **A ban list never holds a neighbour.** The mesh's own range is named rather than written
+# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own
+# network, not the internet. On a machine behind a router that reflects local traffic, every
+# client in the house arrives as the gateway's address — so one mistyped local request banned
+# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).
+#
+# **Nor the operator's own addresses** (novox/hq ADR 0339, issue 238): the public addresses the operator names
+# as theirs, in the mesh-wide setting own-addresses. An agent polling the forge from the operator's home banned
+# that home for four weeks on 2026-10-04, and nothing in the house reached the control-node until it was found
+# among 400 bans. The file is written by this module's watch from the setting, one entry per line; fail2ban
+# reads it again within a second of a change, so a new value needs no restart. Empty until the operator
+# fills the setting. A jail that sets its own ignoreip leaves all of this out; the watch says so.
+ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10 file:/var/lib/mesh-fail2ban/own-addresses
+
+# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace
+# themselves at one try every ten minutes, under any ten-minute window; a day's window counts
+# them, and a day's ban costs a person who mistyped three times once, from one address, while
+# the mesh's own range is never banned at all.
+bantime  = 1d
+findtime = 1d
+maxretry = 3
+
+# Ban through iptables, not through a firewall front-end the machine may not have. ufw is
+# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out
+# only at ban time: the service reports healthy, the jail counts the attempt, the ban command
+# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a
+# machine the mesh reported as protected.
+#
+# The action below is this module's own, already used by the recidive jail on every machine
+# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is
+# covered too.
+banaction = iptables-allports-dualchain
+banaction_allports = iptables-allports-dualchain
+
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/mesh-own-addresses.json b/testdata/beside/mesh-catalog/modules/fail2ban/files/mesh-own-addresses.json
new file mode 100644
index 0000000..0eb9604
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/mesh-own-addresses.json
@@ -0,0 +1,3 @@
+{
+  "own-addresses": []
+}
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/own-addresses b/testdata/beside/mesh-catalog/modules/fail2ban/files/own-addresses
new file mode 100644
index 0000000..e69de29
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/recidive.conf b/testdata/beside/mesh-catalog/modules/fail2ban/files/recidive.conf
new file mode 100644
index 0000000..1f8786f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/recidive.conf
@@ -0,0 +1,9 @@
+[recidive]
+enabled = true
+logpath  = /var/log/fail2ban.log
+# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)
+banaction = iptables-allports-dualchain
+# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).
+bantime  = 4w
+findtime = 2w
+maxretry = 2
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/files/sshd.conf b/testdata/beside/mesh-catalog/modules/fail2ban/files/sshd.conf
new file mode 100644
index 0000000..c8a30f2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/files/sshd.conf
@@ -0,0 +1,8 @@
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+maxretry = 3
+findtime = 1d
+bantime  = 1d
diff --git a/testdata/beside/mesh-catalog/modules/fail2ban/module.json.captured b/testdata/beside/mesh-catalog/modules/fail2ban/module.json.captured
new file mode 100644
index 0000000..446395f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fail2ban/module.json.captured
@@ -0,0 +1,195 @@
+{
+  "module": "fail2ban",
+  "version": "1",
+  "capabilities": [
+    "firewall"
+  ],
+  "claims": [
+    {
+      "name": "node-intrusion-prevention",
+      "scope": "node",
+      "serves": [
+        "status",
+        "banned",
+        "ban",
+        "unban"
+      ]
+    }
+  ],
+  "tools": [
+    "fail2ban_settings",
+    "fail2ban_health"
+  ],
+  "jailing": {
+    "into": "/etc/fail2ban/jail.d/mesh.conf",
+    "filter-into": "/etc/fail2ban/filter.d"
+  },
+  "config": {
+    "own-addresses": {
+      "type": "list",
+      "description": "The addresses and networks outside the mesh that are the operator's own, each an IP address or a CIDR network: every jail ignores them beside the private ranges, the ban verb refuses them, and a failure a jail counted from one is said as a warning; empty is none.",
+      "trusted": true,
+      "default": []
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "fail2ban"
+    },
+    {
+      "id": "state-dir",
+      "type": "directory",
+      "path": "/var/lib/mesh-fail2ban",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "own-addresses-list",
+      "type": "file",
+      "path": "/var/lib/mesh-fail2ban/own-addresses",
+      "mode": "0644",
+      "create-once": true,
+      "template": "files/own-addresses"
+    },
+    {
+      "id": "jail-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/jail.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "action-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/action.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "filter-d",
+      "type": "directory",
+      "path": "/etc/fail2ban/filter.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "run-dir",
+      "type": "directory",
+      "path": "/var/run/fail2ban",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "jail-local",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.local",
+      "mode": "0644",
+      "template": "files/jail.local"
+    },
+    {
+      "id": "jail-sshd",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.d/sshd.conf",
+      "mode": "0644",
+      "template": "files/sshd.conf"
+    },
+    {
+      "id": "own-addresses",
+      "type": "file",
+      "path": "/etc/fail2ban/mesh-own-addresses.json",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": [
+        "own-addresses"
+      ],
+      "trusted": true,
+      "template": "files/mesh-own-addresses.json"
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "fail2ban-watch",
+      "artifact": "tools",
+      "run": [
+        "./fail2ban-tools",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "fail2ban_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    },
+    {
+      "id": "log",
+      "type": "file",
+      "path": "/var/log/fail2ban.log",
+      "mode": "0640",
+      "create-once": true,
+      "template": "files/own-addresses"
+    },
+    {
+      "id": "jail-recidive",
+      "type": "file",
+      "path": "/etc/fail2ban/jail.d/recidive.conf",
+      "mode": "0644",
+      "template": "files/recidive.conf"
+    },
+    {
+      "id": "action-dualchain",
+      "type": "file",
+      "path": "/etc/fail2ban/action.d/iptables-allports-dualchain.conf",
+      "mode": "0644",
+      "template": "files/iptables-allports-dualchain.conf"
+    },
+    {
+      "id": "logrotate",
+      "type": "file",
+      "path": "/etc/logrotate.d/fail2ban",
+      "mode": "0644",
+      "template": "files/fail2ban"
+    },
+    {
+      "id": "run",
+      "type": "service",
+      "unit": "fail2ban.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "jail-local",
+        "jail-sshd",
+        "jail-recidive",
+        "action-dualchain",
+        "composed-jails"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/fail2ban-tools",
+        "binary": "fail2ban-tools",
+        "loads": [
+          "fail2ban-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/feh/files/fehbg b/testdata/beside/mesh-catalog/modules/feh/files/fehbg
new file mode 100755
index 0000000..a3159bb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/feh/files/fehbg
@@ -0,0 +1,6 @@
+#!/bin/sh
+# The wallpaper (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push. The
+# session's start runs it, and so may anything that wants the declared wallpaper back. The image is
+# the module's own, in ~/.local/share/feh/wallpapers. feh_set changes the wallpaper for a session
+# without touching this file.
+feh --no-fehbg --bg-fill "$HOME/.local/share/feh/wallpapers/default.jpg"
diff --git a/testdata/beside/mesh-catalog/modules/feh/files/i3/50-feh.conf b/testdata/beside/mesh-catalog/modules/feh/files/i3/50-feh.conf
new file mode 100644
index 0000000..40ac7da
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/feh/files/i3/50-feh.conf
@@ -0,0 +1,3 @@
+# The wallpaper's key (module feh, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# It puts the declared wallpaper back, after a monitor change or a wallpaper set for the session.
+bindsym $mod+Shift+b exec --no-startup-id ~/.fehbg
diff --git a/testdata/beside/mesh-catalog/modules/feh/files/xinitrc-normal b/testdata/beside/mesh-catalog/modules/feh/files/xinitrc-normal
new file mode 100644
index 0000000..8e91e82
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/feh/files/xinitrc-normal
@@ -0,0 +1,2 @@
+# The wallpaper (module feh, novox/hq ADR 0208): the declared one, set once per session.
+"$HOME/.fehbg"
diff --git a/testdata/beside/mesh-catalog/modules/feh/module.json.captured b/testdata/beside/mesh-catalog/modules/feh/module.json.captured
new file mode 100644
index 0000000..d6e4407
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/feh/module.json.captured
@@ -0,0 +1,75 @@
+{
+  "module": "feh",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "feh_set",
+    "feh_current"
+  ],
+  "items": [
+    {
+      "collection": "shell:xinitrc:normal",
+      "name": "xinitrc-normal",
+      "template": "files/xinitrc-normal"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-feh.conf"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "feh"
+    },
+    {
+      "id": "wallpapers",
+      "type": "archive",
+      "path": "${machine:account-home}/.local/share/feh/wallpapers",
+      "owner": "${machine:account}",
+      "artifact": "wallpapers",
+      "unknown": "move-out"
+    },
+    {
+      "id": "fehbg",
+      "type": "file",
+      "path": "${machine:account-home}/.fehbg",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/fehbg"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "wallpapers",
+        "kind": "archive",
+        "from": "wallpaper"
+      },
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/feh-tools",
+        "binary": "feh-tools",
+        "loads": [
+          "feh-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/flatpak/module.json.captured b/testdata/beside/mesh-catalog/modules/flatpak/module.json.captured
new file mode 100644
index 0000000..76d4721
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/flatpak/module.json.captured
@@ -0,0 +1,42 @@
+{
+  "module": "flatpak",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "flatpak_list",
+    "flatpak_runtimes",
+    "flatpak_remotes",
+    "flatpak_updates",
+    "flatpak_unused",
+    "flatpak_disk_usage",
+    "flatpak_install",
+    "flatpak_remove",
+    "flatpak_update",
+    "flatpak_remove_unused",
+    "flatpak_job"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "flatpak"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/flatpak-tools",
+        "binary": "flatpak-tools",
+        "loads": [
+          "flatpak-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/fonts/files/50-mesh-fonts.conf b/testdata/beside/mesh-catalog/modules/fonts/files/50-mesh-fonts.conf
new file mode 100644
index 0000000..76d0c87
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fonts/files/50-mesh-fonts.conf
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<!--
+  The mesh's file (module fonts, novox/hq research 026/04): which face each generic family means for
+  this account, so every program that asks for monospace, sans-serif, serif or emoji gets the same
+  face. Replaced at every push. Other files in this directory are yours.
+-->
+<fontconfig>
+  <description>The mesh: the faces monospace, sans-serif, serif and emoji mean</description>
+
+  <!--
+    Families the desktop's files named before this module, mapped to monospace for as long as they
+    are not installed: a configuration still naming one gets the chosen monospace face rather than
+    fontconfig's last resort, sans-serif. Where the family is still installed, it is used as before.
+    Placed first, so the monospace they lead to is resolved by the rule below.
+  -->
+  <alias><family>Hack Nerd Font</family><accept><family>monospace</family></accept></alias>
+  <alias><family>MesloLGS NF</family><accept><family>monospace</family></accept></alias>
+  <alias><family>Iosevka Nerd Font</family><accept><family>monospace</family></accept></alias>
+  <alias><family>JetBrains Mono Nerd Font</family><accept><family>JetBrainsMono Nerd Font</family></accept></alias>
+
+  <!--
+    The decided faces, bound the same as the request: a program asking for monospace asks strongly,
+    and a face added weakly loses to the distribution's own choice (measured with fontconfig 2.18).
+  -->
+  <alias binding="same"><family>monospace</family><prefer><family>JetBrainsMono Nerd Font</family></prefer></alias>
+  <alias binding="same"><family>sans-serif</family><prefer><family>Inter</family><family>Noto Sans</family></prefer></alias>
+  <alias binding="same"><family>system-ui</family><prefer><family>Inter</family></prefer></alias>
+  <alias binding="same"><family>serif</family><prefer><family>Noto Serif</family></prefer></alias>
+  <alias binding="same"><family>emoji</family><prefer><family>Noto Color Emoji</family></prefer></alias>
+
+  <!--
+    Fallbacks for any face: an icon a face lacks comes from the Nerd Fonts symbols, an emoji from
+    Noto Color Emoji. Appended last, so they never displace a face that has the character.
+  -->
+  <match target="pattern">
+    <edit name="family" mode="append_last"><string>Symbols Nerd Font</string></edit>
+    <edit name="family" mode="append_last"><string>Noto Color Emoji</string></edit>
+  </match>
+</fontconfig>
diff --git a/testdata/beside/mesh-catalog/modules/fonts/module.json.captured b/testdata/beside/mesh-catalog/modules/fonts/module.json.captured
new file mode 100644
index 0000000..b2958da
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/fonts/module.json.captured
@@ -0,0 +1,70 @@
+{
+  "module": "fonts",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "fonts_families",
+    "fonts_match",
+    "fonts_glyph",
+    "fonts_sources",
+    "fonts_config",
+    "fonts_cache_rebuild"
+  ],
+  "resources": [
+    {
+      "id": "monospace",
+      "type": "package",
+      "package": "ttf-jetbrains-mono-nerd"
+    },
+    {
+      "id": "interface",
+      "type": "package",
+      "package": "inter-font"
+    },
+    {
+      "id": "symbols",
+      "type": "package",
+      "package": "ttf-nerd-fonts-symbols"
+    },
+    {
+      "id": "noto",
+      "type": "package",
+      "package": "noto-fonts"
+    },
+    {
+      "id": "emoji",
+      "type": "package",
+      "package": "noto-fonts-emoji"
+    },
+    {
+      "id": "defaults",
+      "type": "file",
+      "path": "${machine:account-home}/.config/fontconfig/conf.d/50-mesh-fonts.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/50-mesh-fonts.conf"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/fonts-tools",
+        "binary": "fonts-tools",
+        "loads": [
+          "fonts-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/forticlient/module.json.captured b/testdata/beside/mesh-catalog/modules/forticlient/module.json.captured
new file mode 100644
index 0000000..631d3fa
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/forticlient/module.json.captured
@@ -0,0 +1,57 @@
+{
+  "module": "forticlient",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "its adapter routes the company's domains on the machine a person works on: a build that breaks it cuts the person off from work names until a person pushes the next (hq ADR 0236, ADR 0247)"
+  },
+  "capabilities": [
+    "service-manager"
+  ],
+  "requires": [
+    "x11-display",
+    "split-dns"
+  ],
+  "tools": [
+    "forticlient_status",
+    "forticlient_restart",
+    "forticlient_check"
+  ],
+  "resources": [
+    {
+      "id": "scheduler",
+      "type": "service",
+      "unit": "forticlient.service",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "split-dns",
+      "type": "process",
+      "name": "forticlient-split-dns",
+      "artifact": "tools",
+      "run": [
+        "./forticlient-tools",
+        "split-dns"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/forticlient-tools",
+        "binary": "forticlient-tools",
+        "loads": [
+          "forticlient-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/agent-teams.json b/testdata/beside/mesh-catalog/modules/gitea/files/agent-teams.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/agent-teams.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/config.json b/testdata/beside/mesh-catalog/modules/gitea/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/consumers.json b/testdata/beside/mesh-catalog/modules/gitea/files/consumers.json
new file mode 100644
index 0000000..790b51f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/consumers.json
@@ -0,0 +1 @@
+${consumers:forge-account}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/origins b/testdata/beside/mesh-catalog/modules/gitea/files/origins
new file mode 100644
index 0000000..6bbfb35
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/origins
@@ -0,0 +1 @@
+https://${bound:route:name-web}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/repositories.json b/testdata/beside/mesh-catalog/modules/gitea/files/repositories.json
new file mode 100644
index 0000000..36626cc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/repositories.json
@@ -0,0 +1 @@
+{"repositories": ${config:repositories}}
diff --git a/testdata/beside/mesh-catalog/modules/gitea/files/server.env b/testdata/beside/mesh-catalog/modules/gitea/files/server.env
new file mode 100644
index 0000000..8cb88e2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/files/server.env
@@ -0,0 +1,7 @@
+GITEA__security__INTERNAL_TOKEN=${secret:internal-token}
+GITEA__database__DB_TYPE=postgres
+GITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}
+GITEA__database__NAME=${bound:postgres-database:as}
+GITEA__database__USER=${bound:postgres-database:as}
+GITEA__database__PASSWD=${secret:postgres-database}
+GITEA__webhook__ALLOWED_HOST_LIST=172.17.0.1
diff --git a/testdata/beside/mesh-catalog/modules/gitea/module.json.captured b/testdata/beside/mesh-catalog/modules/gitea/module.json.captured
new file mode 100644
index 0000000..118224c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitea/module.json.captured
@@ -0,0 +1,547 @@
+{
+  "module": "gitea",
+  "version": "1",
+  "moved": true,
+  "requires": [
+    "postgres-database",
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "gitea"
+    },
+    "route": {
+      "web": {
+        "label": "git",
+        "endpoint": "web"
+      },
+      "internal-api-refused": {
+        "label": "git",
+        "path": "/api/internal",
+        "deny": true,
+        "priority": 100000
+      }
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "secret": {
+      "internal-token": "${dir:state}/internal-token.secret",
+      "admin": "${dir:state}/admin.secret"
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "repo.created",
+    "issue.opened",
+    "pull.merged",
+    "pull.updated",
+    "pull.closed",
+    "forge.push",
+    "forge.create",
+    "forge.delete",
+    "forge.fork",
+    "forge.status",
+    "forge.pull-request.opened",
+    "forge.pull-request.reopened",
+    "forge.pull-request.synchronized",
+    "forge.pull-request.edited",
+    "forge.pull-request.closed",
+    "forge.pull-request.merged",
+    "forge.pull-request.labeled",
+    "forge.pull-request.unlabeled",
+    "forge.pull-request.assigned",
+    "forge.pull-request.unassigned",
+    "forge.pull-request.reviewed",
+    "forge.pull-request.review-requested",
+    "forge.pull-request.commented",
+    "forge.pull-request.changed",
+    "forge.issue-comment.created",
+    "forge.issue-comment.edited",
+    "forge.issue-comment.deleted",
+    "forge.issues.opened",
+    "forge.issues.reopened",
+    "forge.issues.closed",
+    "forge.issues.edited",
+    "forge.issues.labeled",
+    "forge.issues.unlabeled",
+    "forge.issues.assigned",
+    "forge.issues.unassigned",
+    "forge.issues.changed",
+    "forge.release.published",
+    "forge.release.updated",
+    "forge.release.deleted",
+    "forge.release.changed",
+    "forge.repository.created",
+    "forge.repository.deleted",
+    "forge.repository.changed",
+    "forge.wiki.changed",
+    "forge.other"
+  ],
+  "consumes": [
+    "mesh-controller.checked",
+    "node-build-agent.started"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 3000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the forge, over http"
+    },
+    {
+      "name": "ssh",
+      "port": 22,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "git over ssh, gitea's own unmodified sshd. Published on the machine's own side at 222, the mesh's fixed public convention — not 22, which the machine's own daemon holds and a module does not take"
+    },
+    {
+      "name": "forge-events",
+      "port": 3047,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "the forge's system webhook, every event signed with a secret the module keeps, from the forge's container on the docker bridge to the module's receiver at the bridge's gateway 172.17.0.1 (novox/hq issue 729)"
+    }
+  ],
+  "serves": {
+    "npm-package-registry": {
+      "scheme": "http",
+      "port": 3000,
+      "npm-path": "/api/packages/novox/npm/",
+      "public-root": "https://${bound:route:name-web}/api/packages/novox/npm/"
+    },
+    "git": {
+      "scheme": "http",
+      "port": 3000
+    }
+  },
+  "receives": {
+    "npm-package-registry": "${dir:grants}/npm.json"
+  },
+  "grants": {
+    "npm-package-registry": "${dir:grants}"
+  },
+  "claims": [
+    {
+      "name": "npm-package-registry",
+      "scope": "mesh"
+    },
+    {
+      "name": "git",
+      "scope": "mesh"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "every repository, its issues and attachments, and the package registry"
+      }
+    ],
+    "consumers": {
+      "npm-package-registry": {
+        "class": "rebuildable",
+        "in": "data",
+        "why": "a consumer's packages are published again from its source"
+      }
+    }
+  },
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach the forge at, as a URL; unset, the code falls back to its environment, else this machine's gitea on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "agent-read-teams": {
+      "type": "object",
+      "description": "The read teams of the agents' forge accounts (ADR 0365 clause 3): each team by name, {\"<team>\": {\"repos\": [\"<owner>/<repo>\", ...], \"members\": [\"<node>\", ...]}}. The forge gets a team agent-read-<team> that reads only, with exactly those repositories and the accounts agent-<node>; a team taken out of the value is emptied. Nothing else on the forge is touched; an agent account is in no team until it is listed here.",
+      "trusted": true,
+      "default": {}
+    },
+    "repositories": {
+      "type": "object",
+      "description": "The repositories of the organisation novox the mesh holds (ADR 0428): each by name, {\"<name>\": {\"private\": true, \"description\": \"...\"}}. One that does not exist is made by the module's setup login under its own account, its main protected and given a first commit (a README naming the description and a merge-check.sh), its rule narrowed to no push and the tools' merge requiring mesh/repo-check and mesh/merge-gate, and only then moved into the organisation; one that exists only has main's rule put right, its statuses kept. A repository taken out of the value is never touched.",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "facts": {
+    "forge-host": {
+      "path": "/etc/gitea/forge-host",
+      "template": "{{range .Machines}}{{if eq .Name $.Node}}{{.FQDN}}{{end}}{{end}}\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "runtime-state",
+      "type": "directory",
+      "path": "${dir:mesh-state}/state",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "forge-patches",
+      "type": "directory",
+      "path": "/var/lib/mesh/forge-patches",
+      "mode": "0733",
+      "owner": "${machine:account}",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/api/healthz",
+        "status": 200,
+        "needs": "postgres-database"
+      },
+      "name": "gitea",
+      "image": "gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef",
+      "env": {
+        "DB_TYPE": "postgres",
+        "USER_UID": "1000",
+        "USER_GID": "1000"
+      },
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "3000",
+        "222:22"
+      ],
+      "volumes": [
+        "${dir:data}:/data"
+      ],
+      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it",
+      "logging": "journald"
+    },
+    {
+      "id": "admin-bootstrap",
+      "type": "container",
+      "name": "mesh-gitea-admin",
+      "image": "gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef",
+      "run-once": true,
+      "env": {
+        "USER_UID": "1000",
+        "USER_GID": "1000",
+        "MESH_GITEA_ADMIN_USER": "mesh-admin"
+      },
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "volumes": [
+        "${dir:data}:/data",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro"
+      ],
+      "args": [
+        "/bin/sh",
+        "-c",
+        "su-exec git gitea admin user create --admin --username \"$MESH_GITEA_ADMIN_USER\" --email mesh-admin@localhost --password \"$(cat /run/secrets/admin)\" --must-change-password=false || true"
+      ],
+      "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
+    },
+    {
+      "id": "origins",
+      "type": "file",
+      "path": "${dir:mesh-state}/origins",
+      "mode": "0644",
+      "template": "files/origins"
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": [
+        "url"
+      ]
+    },
+    {
+      "id": "agent-teams-file",
+      "type": "file",
+      "path": "${dir:mesh-state}/agent-teams.json",
+      "mode": "0600",
+      "template": "files/agent-teams.json",
+      "merge": "json",
+      "takes-config": [
+        "agent-read-teams"
+      ]
+    },
+    {
+      "id": "repositories-file",
+      "type": "file",
+      "path": "${dir:mesh-state}/repositories.json",
+      "mode": "0600",
+      "template": "files/repositories.json"
+    },
+    {
+      "id": "consumers",
+      "type": "file",
+      "path": "${dir:state}/consumers.json",
+      "mode": "0600",
+      "template": "files/consumers.json"
+    },
+    {
+      "id": "agent-teams",
+      "type": "process",
+      "name": "gitea-agent-teams",
+      "artifact": "agent-teams",
+      "run": [
+        "./agent-teams"
+      ],
+      "run-once": true,
+      "env": {
+        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+        "MESH_GITEA_ADMIN_USER": "mesh-admin",
+        "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+        "MESH_AGENT_TEAMS_FILE": "${dir:mesh-state}/agent-teams.json"
+      },
+      "restart-on": [
+        "agent-teams-file"
+      ]
+    },
+    {
+      "id": "repositories",
+      "type": "process",
+      "name": "gitea-repositories",
+      "artifact": "repositories",
+      "run": [
+        "./repositories",
+        "sync"
+      ],
+      "run-once": true,
+      "env": {
+        "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+        "MESH_GITEA_ADMIN_USER": "mesh-admin",
+        "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+        "MESH_GITEA_TOOLS_USER": "mesh-tools",
+        "MESH_REPOSITORIES_FILE": "${dir:mesh-state}/repositories.json",
+        "MESH_REPOSITORIES_OUTCOME": "${dir:runtime-state}/repositories-outcome.json"
+      },
+      "restart-on": [
+        "repositories-file"
+      ]
+    }
+  ],
+  "provides": [
+    {
+      "name": "npm-package-registry",
+      "scope": "mesh",
+      "identity": {
+        "max": 40,
+        "in": "a Gitea user name"
+      }
+    },
+    {
+      "name": "git",
+      "scope": "mesh"
+    },
+    {
+      "name": "gitea-read",
+      "scope": "mesh",
+      "credential": {
+        "issued-by": "software",
+        "tool": "gitea_agent_token"
+      }
+    },
+    {
+      "name": "forge-account",
+      "scope": "mesh"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_TOOLS_USER": "mesh-tools",
+          "MESH_GITEA_STATE_DIR": "${dir:runtime-state}",
+          "MESH_RECEIVES": "${dir:grants}/npm.json",
+          "MESH_GITEA_HOOK_URL": "http://172.17.0.1:3047",
+          "MESH_GITEA_HOOK_PORT": "3047",
+          "MESH_GITEA_HOOK_HOST": "172.17.0.1"
+        }
+      },
+      {
+        "name": "npm-registry",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/npm-registry",
+        "binary": "npm-registry",
+        "loads": [
+          "npm-registry"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_NPM_OWNER": "novox"
+        }
+      },
+      {
+        "name": "forge",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/forge",
+        "binary": "forge",
+        "loads": [
+          "forge"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_TOOLS_USER": "mesh-tools",
+          "MESH_GITEA_TOKEN_FILE": "${dir:runtime-state}/token",
+          "MESH_GITEA_PATCH_DIR": "${dir:forge-patches}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "agent-token",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/agent-token",
+        "binary": "agent-token",
+        "loads": [
+          "agent-token"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_ORIGINS_FILE": "${dir:mesh-state}/origins"
+        }
+      },
+      {
+        "name": "agent-teams",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/agent-teams",
+        "binary": "agent-teams",
+        "loads": [
+          "agent-teams"
+        ]
+      },
+      {
+        "name": "repositories",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/repositories",
+        "binary": "repositories",
+        "loads": [
+          "repositories"
+        ]
+      },
+      {
+        "name": "forge-account-provider",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/forge-account-provider",
+        "binary": "forge-account-provider",
+        "loads": [
+          "forge-account-provider"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_GITEA_ORIGINS_FILE": "${dir:mesh-state}/origins",
+          "MESH_GITEA_SSH_PORT": "222",
+          "MESH_FORGE_HOST_FILE": "/etc/gitea/forge-host"
+        }
+      }
+    ]
+  },
+  "jails": [
+    {
+      "name": "gitea",
+      "failregex": "^.*Failed authentication attempt for .* from <HOST>(?::\\d+)?\\s*$\n            ^.*Invalid user .* from <HOST> port \\d+\\s*$\n            ^.*User \\S+ from <HOST> not allowed because .*$",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=gitea\nport = http,https,222\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
+    }
+  ],
+  "state": [
+    "bound",
+    "announced"
+  ],
+  "reads": [
+    "mesh-controller.assignments",
+    "ssh-client.keys",
+    "mesh-build-go.keys",
+    "mesh-build-node.keys"
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/gitlab/files/config.json b/testdata/beside/mesh-catalog/modules/gitlab/files/config.json
new file mode 100644
index 0000000..9e26dfe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitlab/files/config.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/gitlab/module.json.captured b/testdata/beside/mesh-catalog/modules/gitlab/module.json.captured
new file mode 100644
index 0000000..3cb33fb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gitlab/module.json.captured
@@ -0,0 +1,65 @@
+{
+  "module": "gitlab",
+  "version": "1",
+  "own-secrets": {
+    "token": "${dir:state}/token"
+  },
+  "config": {
+    "gitlab-url": {
+      "type": "string",
+      "description": "The address of the GitLab instance the gitlab tools call, as a URL such as https://gitlab.com, laid into the file as GITLAB_URL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "merge": "json",
+      "template": "files/config.json",
+      "mode": "0600",
+      "takes-config": [
+        {
+          "key": "gitlab-url",
+          "as": "GITLAB_URL"
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_GITLAB_TOKEN_FILE": "${dir:state}/token",
+          "MESH_GITLAB_CONFIG_FILE": "${dir:state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/login b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/login
new file mode 100644
index 0000000..47833d9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/login
@@ -0,0 +1,4 @@
+# The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): the password typed at the
+# login screen unlocks the keyring, and the login session starts the keyring daemon with it.
+auth       optional     pam_gnome_keyring.so
+session    optional     pam_gnome_keyring.so auto_start
diff --git a/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/passwd b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/passwd
new file mode 100644
index 0000000..dd43bb8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/pam/passwd
@@ -0,0 +1,3 @@
+# The login keyring (module gnome-keyring, novox/hq ADR 0208, ADR 0102): changing the account's
+# password changes the login keyring's with it, so the next login still unlocks it.
+password   optional     pam_gnome_keyring.so
diff --git a/testdata/beside/mesh-catalog/modules/gnome-keyring/files/xinitrc-first b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/xinitrc-first
new file mode 100644
index 0000000..5fb92b8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gnome-keyring/files/xinitrc-first
@@ -0,0 +1,5 @@
+# The ssh agent (module gnome-keyring, novox/hq ADR 0208): gcr's, which the account's service manager
+# starts on first use from its socket. Named here, for the session and every terminal it starts, until
+# the account's environment can say a path under the runtime directory (see the module's README).
+SSH_AUTH_SOCK="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gcr/ssh"
+export SSH_AUTH_SOCK
diff --git a/testdata/beside/mesh-catalog/modules/gnome-keyring/module.json.captured b/testdata/beside/mesh-catalog/modules/gnome-keyring/module.json.captured
new file mode 100644
index 0000000..9f75b9f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/gnome-keyring/module.json.captured
@@ -0,0 +1,82 @@
+{
+  "module": "gnome-keyring",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-secret-service",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "gnome_keyring_unlocked",
+    "gnome_keyring_lock",
+    "gnome_keyring_collections",
+    "gnome_keyring_ssh_keys"
+  ],
+  "items": [
+    {
+      "collection": "shell:xinitrc:first",
+      "name": "xinitrc-first",
+      "template": "files/xinitrc-first"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "gnome-keyring"
+    },
+    {
+      "id": "library",
+      "type": "package",
+      "package": "libsecret"
+    },
+    {
+      "id": "manager",
+      "type": "package",
+      "package": "seahorse"
+    },
+    {
+      "id": "pam-login",
+      "type": "file",
+      "path": "/etc/pam.d/login",
+      "mode": "0644",
+      "into": "block",
+      "at": "end",
+      "template": "files/pam/login"
+    },
+    {
+      "id": "pam-passwd",
+      "type": "file",
+      "path": "/etc/pam.d/passwd",
+      "mode": "0644",
+      "into": "block",
+      "at": "end",
+      "template": "files/pam/passwd"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/gnome-keyring-tools",
+        "binary": "gnome-keyring-tools",
+        "loads": [
+          "gnome-keyring-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/go/module.json.captured b/testdata/beside/mesh-catalog/modules/go/module.json.captured
new file mode 100644
index 0000000..48a6bf5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/go/module.json.captured
@@ -0,0 +1,20 @@
+{
+  "module": "go",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "provides": [
+    {
+      "name": "go-toolchain",
+      "reach": "machine"
+    }
+  ],
+  "resources": [
+    {
+      "id": "go",
+      "type": "package",
+      "package": "go"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/admin.secret b/testdata/beside/mesh-catalog/modules/grafana/files/admin.secret
new file mode 100644
index 0000000..51bf424
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/admin.secret
@@ -0,0 +1 @@
+${secret:admin}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/config.json b/testdata/beside/mesh-catalog/modules/grafana/files/config.json
new file mode 100644
index 0000000..567df9a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/config.json
@@ -0,0 +1,4 @@
+{
+  "user": "admin",
+  "password": "${secret:admin}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/influxdb-api b/testdata/beside/mesh-catalog/modules/grafana/files/influxdb-api
new file mode 100644
index 0000000..8329ab7
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/influxdb-api
@@ -0,0 +1 @@
+${secret:influxdb-api}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/mesh-influxdb.yaml b/testdata/beside/mesh-catalog/modules/grafana/files/mesh-influxdb.yaml
new file mode 100644
index 0000000..e341005
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/mesh-influxdb.yaml
@@ -0,0 +1,19 @@
+apiVersion: 1
+# Written by the mesh from grafana's influxdb-api binding, only while it is bound (novox/hq ADR 0330):
+# without influxdb, grafana runs with no mesh data source. grafana reads it at start. Its own name and
+# uid, so a data source somebody made in the UI is never overwritten, and read-only in the UI because
+# the mesh resets it. The password is read from the file the mesh delivers, never written here.
+datasources:
+  - name: InfluxDB (mesh)
+    uid: mesh-influxdb-api
+    type: influxdb
+    access: proxy
+    url: ${bound:influxdb-api:scheme}://${bound:influxdb-api:at}:${bound:influxdb-api:port}
+    user: ${bound:influxdb-api:as}
+    isDefault: false
+    editable: false
+    jsonData:
+      dbName: ${bound:influxdb-api:bucket}
+      httpMode: POST
+    secureJsonData:
+      password: $__file{/run/secrets/influxdb/influxdb-api}
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/oidc-client.secret b/testdata/beside/mesh-catalog/modules/grafana/files/oidc-client.secret
new file mode 100644
index 0000000..9146dc1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/oidc-client.secret
@@ -0,0 +1 @@
+${secret:oidc-client}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/grafana/files/oidc.env b/testdata/beside/mesh-catalog/modules/grafana/files/oidc.env
new file mode 100644
index 0000000..bcc1e9c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/files/oidc.env
@@ -0,0 +1,13 @@
+GF_SERVER_ROOT_URL=https://${bound:route:name}
+GF_AUTH_GENERIC_OAUTH_ENABLED=true
+GF_AUTH_GENERIC_OAUTH_NAME=Keycloak
+GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${bound:oidc-client:as}
+GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE=/run/secrets/oidc-client
+GF_AUTH_GENERIC_OAUTH_SCOPES=openid email profile roles
+GF_AUTH_GENERIC_OAUTH_AUTH_URL=${bound:oidc-client:issuer}${bound:oidc-client:authorization-path}
+GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${bound:oidc-client:issuer}${bound:oidc-client:token-path}
+GF_AUTH_GENERIC_OAUTH_API_URL=${bound:oidc-client:issuer}${bound:oidc-client:userinfo-path}
+GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(roles[*], 'admin') && 'Admin' || contains(realm_access.roles[*], 'admin') && 'Admin' || 'Viewer'
+GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
+GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
+GF_AUTH_GENERIC_OAUTH_ALLOW_ASSIGN_GRAFANA_ADMIN=true
diff --git a/testdata/beside/mesh-catalog/modules/grafana/module.json.captured b/testdata/beside/mesh-catalog/modules/grafana/module.json.captured
new file mode 100644
index 0000000..1cbf995
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/grafana/module.json.captured
@@ -0,0 +1,225 @@
+{
+  "module": "grafana",
+  "version": "1",
+  "emits": [
+    "alert.firing"
+  ],
+  "own-secrets": {
+    "admin": "${dir:mesh-state}/admin"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 3000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the dashboards. Also 3000 inside, like the forge - which is the mesh's port assignment earning its keep"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "dashboards, users and alert rules"
+      }
+    ]
+  },
+  "config": {
+    "user": {
+      "type": "string",
+      "description": "The Grafana account the module's tools sign in as with the vault's password; the file's default is admin.",
+      "trusted": true,
+      "default": "admin"
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Grafana at, as a URL; unset, the code falls back to its environment, else this machine's Grafana on its port.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "472:472",
+      "unknown": "program"
+    },
+    {
+      "id": "admin-secret",
+      "type": "file",
+      "path": "${dir:state}/admin.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "template": "files/admin.secret"
+    },
+    {
+      "id": "oidc-secret",
+      "type": "file",
+      "path": "${dir:state}/oidc-client.secret",
+      "mode": "0400",
+      "owner": "472:472",
+      "template": "files/oidc-client.secret"
+    },
+    {
+      "id": "oidc-env",
+      "type": "file",
+      "path": "${dir:state}/oidc.env",
+      "mode": "0644",
+      "template": "files/oidc.env"
+    },
+    {
+      "id": "influxdb-datasources",
+      "type": "directory",
+      "path": "${dir:state}/datasources",
+      "mode": "0755",
+      "owner": "472:472",
+      "unknown": "program"
+    },
+    {
+      "id": "influxdb-credential",
+      "type": "directory",
+      "path": "${dir:state}/influxdb",
+      "mode": "0700",
+      "owner": "472:472",
+      "unknown": "program"
+    },
+    {
+      "id": "influxdb-secret",
+      "type": "file",
+      "path": "${dir:influxdb-credential}/influxdb-api",
+      "mode": "0400",
+      "owner": "472:472",
+      "template": "files/influxdb-api",
+      "only-when-bound": "influxdb-api"
+    },
+    {
+      "id": "influxdb-datasource",
+      "type": "file",
+      "path": "${dir:influxdb-datasources}/mesh-influxdb.yaml",
+      "mode": "0644",
+      "template": "files/mesh-influxdb.yaml",
+      "only-when-bound": "influxdb-api"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "grafana",
+      "image": "grafana/grafana@sha256:ac461fb352abc50da10a51c7d02462e9c05488f11f53f14b3ad79a8145f638a0",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/"
+      },
+      "ports": [
+        "3000"
+      ],
+      "volumes": [
+        "${dir:data}:/var/lib/grafana",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
+        "${dir:state}/oidc-client.secret:/run/secrets/oidc-client:ro",
+        "${dir:influxdb-credential}:/run/secrets/influxdb:ro",
+        "${dir:influxdb-datasources}:/etc/grafana/provisioning/datasources:ro"
+      ],
+      "env": {
+        "GF_SECURITY_ADMIN_PASSWORD__FILE": "/run/secrets/admin"
+      },
+      "env-file": [
+        "${dir:state}/oidc.env"
+      ],
+      "restart-on": [
+        "oidc-env",
+        "oidc-secret",
+        "influxdb-datasource",
+        "influxdb-secret"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["user", "url"],
+      "protected": ["password", "token"]
+    }
+  ],
+  "requires": [
+    "route",
+    "oidc-client",
+    {
+      "name": "influxdb-api",
+      "optional": true
+    }
+  ],
+  "contributes": {
+    "route": {
+      "label": "grafana",
+      "endpoint": "web"
+    },
+    "oidc-client": {
+      "label": "grafana",
+      "endpoint": "web",
+      "callback": "/login/generic_oauth"
+    },
+    "influxdb-api": {
+      "access": "read"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json",
+    "oidc-client": "${dir:state}/oidc.json",
+    "influxdb-api": "${dir:state}/influxdb.json"
+  },
+  "secrets": {
+    "oidc-client": "${dir:mesh-state}/oidc-client",
+    "influxdb-api": "${dir:mesh-state}/influxdb-api"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_GRAFANA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GRAFANA_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/hello-web/files/index.html b/testdata/beside/mesh-catalog/modules/hello-web/files/index.html
new file mode 100644
index 0000000..0d513fd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/hello-web/files/index.html
@@ -0,0 +1 @@
+hello from hello-web, routed by the mesh
diff --git a/testdata/beside/mesh-catalog/modules/hello-web/module.json.captured b/testdata/beside/mesh-catalog/modules/hello-web/module.json.captured
new file mode 100644
index 0000000..005578c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/hello-web/module.json.captured
@@ -0,0 +1,82 @@
+{
+  "module": "hello-web",
+  "slug": "hello",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "hello",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the demo web page; only the route-proxy reaches it, and the public name is a route grant"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "page",
+      "type": "file",
+      "path": "${dir:state}/index.html",
+      "mode": "0644",
+      "template": "files/index.html"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "hello-web"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "hello-web",
+      "network": "hello-web",
+      "ports": [
+        "8080"
+      ],
+      "volumes": [
+        "${dir:state}/index.html:/www/index.html:ro"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "while true; do { printf 'HTTP/1.1 200 OK\\r\\nContent-Type: text/plain\\r\\nConnection: close\\r\\n\\r\\n'; cat /www/index.html; } | nc -l -p 8080; done"
+      ],
+      "artifact": "server"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "upstream",
+        "from": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/home-assistant/files/config.json b/testdata/beside/mesh-catalog/modules/home-assistant/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/home-assistant/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/home-assistant/files/provisions.env b/testdata/beside/mesh-catalog/modules/home-assistant/files/provisions.env
new file mode 100644
index 0000000..93aba0c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/home-assistant/files/provisions.env
@@ -0,0 +1,4 @@
+MESH_HOMEASSISTANT_URL=http://127.0.0.1:${port:8123}
+MESH_HOMEASSISTANT_TOKEN_FILE=${dir:mesh-state}/token
+MESH_PROVISIONS_DIR=${dir:state}
+MESH_WRITTEN_DIR=${dir:written}
diff --git a/testdata/beside/mesh-catalog/modules/home-assistant/module.json.captured b/testdata/beside/mesh-catalog/modules/home-assistant/module.json.captured
new file mode 100644
index 0000000..9c4f99d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/home-assistant/module.json.captured
@@ -0,0 +1,209 @@
+{
+  "module": "home-assistant",
+  "version": "1",
+  "slug": "hass",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "state.changed"
+  ],
+  "own-secrets": {
+    "token": "${dir:mesh-state}/token"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8123,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the dashboard, the API and the companion apps"
+    },
+    {
+      "name": "sonos-events",
+      "port": 1400,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Sonos integration's event callback: speakers push their state changes here"
+    },
+    {
+      "name": "webrtc",
+      "port": 18555,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the bundled go2rtc's WebRTC port, which camera streams to a browser use"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "config",
+        "path": "${dir:config}",
+        "class": "valuable",
+        "active": "1d",
+        "why": "the house's configuration, automations and history; written all the time"
+      }
+    ]
+  },
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Home Assistant at, as a URL; unset, the code falls back to its environment, else this machine's Home Assistant on its port.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "written",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "home-assistant",
+      "image": "ghcr.io/home-assistant/home-assistant@sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196",
+      "network": "host",
+      "env": {
+        "TZ": "Etc/UTC"
+      },
+      "volumes": [
+        "${dir:config}:/config"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["url"]
+    },
+    {
+      "id": "provisions-env",
+      "type": "file",
+      "path": "${dir:state}/provisions.env",
+      "mode": "0600",
+      "template": "files/provisions.env"
+    },
+    {
+      "id": "provisions",
+      "type": "process",
+      "name": "home-assistant-provisions",
+      "artifact": "code",
+      "run": [
+        "node",
+        "provisions/index.js"
+      ],
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/provisions.env"
+      ],
+      "restart-on": [
+        "provisions-env",
+        "bound-mqtt-topic",
+        "secret-mqtt-topic",
+        "bound-sonarr-api",
+        "secret-sonarr-api",
+        "bound-radarr-api",
+        "secret-radarr-api",
+        "bound-lidarr-api",
+        "secret-lidarr-api"
+      ]
+    }
+  ],
+  "requires": [
+    {
+      "name": "lidarr-api",
+      "optional": true
+    },
+    {
+      "name": "mqtt-topic",
+      "optional": true
+    },
+    {
+      "name": "radarr-api",
+      "optional": true
+    },
+    "route",
+    {
+      "name": "sonarr-api",
+      "optional": true
+    }
+  ],
+  "contributes": {
+    "mqtt-topic": {
+      "topics": [
+        "#"
+      ]
+    },
+    "route": {
+      "label": "home-assistant",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json",
+    "mqtt-topic": "${dir:state}/mqtt-topic.json",
+    "sonarr-api": "${dir:state}/sonarr-api.json",
+    "radarr-api": "${dir:state}/radarr-api.json",
+    "lidarr-api": "${dir:state}/lidarr-api.json"
+  },
+  "secrets": {
+    "mqtt-topic": "${dir:state}/mqtt-topic.secret",
+    "sonarr-api": "${dir:state}/sonarr-api.secret",
+    "radarr-api": "${dir:state}/radarr-api.secret",
+    "lidarr-api": "${dir:state}/lidarr-api.secret"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisions/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:${port:8123}",
+          "MESH_HOMEASSISTANT_TOKEN_FILE": "${dir:mesh-state}/token",
+          "MESH_HOMEASSISTANT_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/hostname/files/hostname b/testdata/beside/mesh-catalog/modules/hostname/files/hostname
new file mode 100644
index 0000000..34c12a4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/hostname/files/hostname
@@ -0,0 +1 @@
+${config:hostname}
diff --git a/testdata/beside/mesh-catalog/modules/hostname/files/hosts b/testdata/beside/mesh-catalog/modules/hostname/files/hosts
new file mode 100644
index 0000000..7c9c073
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/hostname/files/hosts
@@ -0,0 +1,7 @@
+# The machine's own names (module hostname, novox/hq ADR 0199, ADR 0223). Every line outside this
+# block is the operator's: kept across every push, changed through the node-hostname verbs add and
+# remove, and given back when this module goes. The mesh's names are not here: the mesh's resolver
+# answers them.
+127.0.0.1	localhost
+::1	localhost
+127.0.1.1	${machine:name}
diff --git a/testdata/beside/mesh-catalog/modules/hostname/module.json.captured b/testdata/beside/mesh-catalog/modules/hostname/module.json.captured
new file mode 100644
index 0000000..e84e7be
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/hostname/module.json.captured
@@ -0,0 +1,61 @@
+{
+  "module": "hostname",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-hostname",
+      "scope": "node",
+      "serves": [
+        "entries",
+        "add",
+        "remove"
+      ]
+    }
+  ],
+    "config": {
+      "hostname": {
+        "type": "string",
+        "description": "The machine's host name, written to /etc/hostname: the operator's name for this machine, with no default (novox/hq ADR 0112).",
+        "trusted": true,
+        "required": true
+      }
+    },
+  "resources": [
+    {
+      "id": "own",
+      "type": "file",
+      "path": "/etc/hosts",
+      "mode": "0644",
+      "into": "block",
+      "at": "start",
+      "template": "files/hosts"
+    },
+    {
+      "id": "name",
+      "type": "file",
+      "path": "/etc/hostname",
+      "mode": "0644",
+      "template": "files/hostname"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/hostname-tools",
+        "binary": "hostname-tools",
+        "loads": [
+          "hostname-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/i3/files/config b/testdata/beside/mesh-catalog/modules/i3/files/config
new file mode 100644
index 0000000..c49398c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/files/config
@@ -0,0 +1,201 @@
+# i3 config file (v4), written by the mesh (module i3, novox/hq ADR 0208). Replaced at every push;
+# change the module instead. i3's user guide is the reference.
+#
+# Other modules add to this configuration as contributions to node-display-session (novox/hq ADR
+# 0212): the mesh places their lines near the end, each module's under a line naming it, where every
+# variable set here ($mod, $ws1 … $ws10) is in scope. A file of yours in ~/.config/i3/config.d/ is read
+# after them, by the include at the very end, and is yours.
+#
+# The reload watcher of this module reloads i3 when this file or a drop-in changes, after checking the
+# result with i3 -C; it never reloads into a configuration with errors.
+
+# Font for window titles, and the bars below: the mesh's monospace face (research 026/04).
+font pango:JetBrainsMono Nerd Font 11
+
+# XDG autostart entries (~/.config/autostart, /etc/xdg/autostart), started once at login.
+exec --no-startup-id dex --autostart --environment i3
+
+#########################################
+######             Keys              ####
+#########################################
+# To find key symbols: xmodmap -pke / xmodmap -pm
+set $mod Mod4
+set $alt Mod1
+set $shift Shift
+set $ctrl Control
+
+# use these keys for focus, movement, and resize directions when reaching for
+# the arrows is not convenient
+set $left h
+set $down j
+set $up k
+set $right l
+
+# use Mouse+$mod to drag floating windows to their wanted position
+floating_modifier $mod
+
+# move tiling windows via drag & drop by left-clicking into the title bar,
+# or left-clicking anywhere into the window while holding the floating modifier.
+tiling_drag modifier titlebar
+
+# start a terminal: whichever the terminal module names in $TERMINAL
+bindsym $mod+Return exec i3-sensible-terminal
+
+# kill focused window
+bindsym $mod+$shift+q kill
+
+# change focus
+bindsym $mod+$left focus left
+bindsym $mod+$down focus down
+bindsym $mod+$up focus up
+bindsym $mod+$right focus right
+
+bindsym $mod+Left focus left
+bindsym $mod+Down focus down
+bindsym $mod+Up focus up
+bindsym $mod+Right focus right
+
+# move focused window
+bindsym $mod+$shift+$left move left
+bindsym $mod+$shift+$down move down
+bindsym $mod+$shift+$up move up
+bindsym $mod+$shift+$right move right
+
+bindsym $mod+$shift+Left move left
+bindsym $mod+$shift+Down move down
+bindsym $mod+$shift+Up move up
+bindsym $mod+$shift+Right move right
+
+# split in horizontal orientation
+bindsym $mod+c split h
+# split in vertical orientation
+bindsym $mod+v split v
+
+# enter fullscreen mode for the focused container
+bindsym $mod+f fullscreen toggle
+
+# change container layout (stacked, tabbed, toggle split)
+bindsym $mod+s layout stacking
+bindsym $mod+w layout tabbed
+bindsym $mod+e layout toggle split
+
+# toggle tiling / floating
+bindsym $mod+$shift+space floating toggle
+
+# change focus between tiling / floating windows
+bindsym $mod+space focus mode_toggle
+
+# focus the parent container
+bindsym $mod+a focus parent
+
+# alt-tab functionality
+bindsym $mod+Tab workspace back_and_forth
+
+#########################################
+######        Workspace mgmt         ####
+#########################################
+set $ws1 "1"
+set $ws2 "2"
+set $ws3 "3"
+set $ws4 "4"
+set $ws5 "5"
+set $ws6 "6"
+set $ws7 "7"
+set $ws8 "8"
+set $ws9 "9"
+set $ws10 "10"
+
+bindsym $mod+1 workspace number $ws1
+bindsym $mod+2 workspace number $ws2
+bindsym $mod+3 workspace number $ws3
+bindsym $mod+4 workspace number $ws4
+bindsym $mod+5 workspace number $ws5
+bindsym $mod+6 workspace number $ws6
+bindsym $mod+7 workspace number $ws7
+bindsym $mod+8 workspace number $ws8
+bindsym $mod+9 workspace number $ws9
+bindsym $mod+0 workspace number $ws10
+
+bindsym $mod+$shift+1 move container to workspace number $ws1
+bindsym $mod+$shift+2 move container to workspace number $ws2
+bindsym $mod+$shift+3 move container to workspace number $ws3
+bindsym $mod+$shift+4 move container to workspace number $ws4
+bindsym $mod+$shift+5 move container to workspace number $ws5
+bindsym $mod+$shift+6 move container to workspace number $ws6
+bindsym $mod+$shift+7 move container to workspace number $ws7
+bindsym $mod+$shift+8 move container to workspace number $ws8
+bindsym $mod+$shift+9 move container to workspace number $ws9
+bindsym $mod+$shift+0 move container to workspace number $ws10
+
+#########################################
+######           Window mgmt         ####
+#########################################
+set $resize_px 10 px
+bindsym $mod+$ctrl+$left resize shrink width $resize_px
+bindsym $mod+$ctrl+$down resize grow height $resize_px
+bindsym $mod+$ctrl+$up resize shrink height $resize_px
+bindsym $mod+$ctrl+$right resize grow width $resize_px
+
+#########################################
+######          Session mgmt         ####
+#########################################
+bindsym $mod+$shift+e exec "i3-nagbar -t warning -m 'You pressed the exit shortcut. Do you really want to exit i3? This will end your X session.' -B 'Yes, exit i3' 'i3-msg exit'"
+
+# Lock the screen through logind, so the one locker the lock screen's module runs handles it (and
+# suspend and lid close too).
+bindsym $mod+Delete exec --no-startup-id loginctl lock-session
+
+# reload the configuration file
+bindsym $mod+$shift+c reload
+
+# restart i3 inplace (preserves your layout/session, can be used to upgrade i3)
+bindsym $mod+$shift+r restart
+
+#########################################
+######              Borders          ####
+#########################################
+default_border pixel 1
+smart_borders on
+
+#########################################
+######               Gaps            ####
+#########################################
+gaps inner 0
+gaps outer 0
+
+# Only the accent-bearing slots are themed; background and text keep i3's own defaults. Borders are
+# `pixel`, so no title bar shows: the colour says which window has focus.
+#                       border  background text    indicator child_border
+client.focused          #de5200 #de5200    #1E2127 #de5200   #de5200
+client.urgent           #900000 #900000    #ffffff #900000   #900000
+
+#########################################
+######  Until their modules carry them ##
+#########################################
+# Each line below belongs to something other than i3, named on its line. When that module is written
+# it contributes the line to node-display-session, and the line goes from here in the same change.
+# The launcher, the clipboard, the wallpaper, the bars, a machine model's keys and the peripherals'
+# tray already contribute theirs (rofi, clipmenu, feh, i3status-rust, asus-zephyrus-g14,
+# polychromatic).
+
+# the operator's scripts: volume, games volume, sessions, screenshot
+bindsym XF86AudioRaiseVolume exec --no-startup-id volume-notify up
+bindsym XF86AudioLowerVolume exec --no-startup-id volume-notify down
+bindsym XF86AudioMute exec --no-startup-id volume-notify mute
+bindsym XF86AudioMicMute exec --no-startup-id mic-notify
+bindsym $ctrl+XF86AudioRaiseVolume exec --no-startup-id set-games-volume 5
+bindsym $ctrl+XF86AudioLowerVolume exec --no-startup-id set-games-volume -5
+bindsym $mod+$shift+Return exec --no-startup-id ~/scripts/i3-sessions/launcher.sh
+bindsym --release $ctrl+$shift+x exec --no-startup-id $XDG_CONFIG_HOME/i3/scripts/screenshot.sh
+
+#########################################
+######   Other modules' lines        ####
+#########################################
+# Placed by the mesh from every other module's contribution (novox/hq ADR 0212): the launcher, the
+# clipboard, the wallpaper, the bars, a machine model's keys, the peripherals' tray. Each module's
+# under a line naming it.
+${contribution:node-display-session:config}
+#########################################
+######   Your own files              ####
+#########################################
+include ~/.config/i3/config.d/*.conf
diff --git a/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-current-desktop b/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-current-desktop
new file mode 100644
index 0000000..04ad29f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-current-desktop
@@ -0,0 +1 @@
+i3
diff --git a/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-session-desktop b/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-session-desktop
new file mode 100644
index 0000000..04ad29f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/files/env-xdg-session-desktop
@@ -0,0 +1 @@
+i3
diff --git a/testdata/beside/mesh-catalog/modules/i3/files/wms/i3 b/testdata/beside/mesh-catalog/modules/i3/files/wms/i3
new file mode 100755
index 0000000..4e269ad
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/files/wms/i3
@@ -0,0 +1,9 @@
+#!/bin/sh
+# The i3 session (module i3, novox/hq ADR 0208), offered by the login manager. It runs the session's
+# start, ~/.xinitrc, which the display server's module writes and which ends by starting i3.
+# Replaced at every push.
+#
+# The login manager hands the session a stdout and stderr whose reading end nobody holds, so a
+# program that writes to them dies of EPIPE (an Electron tray app shows it as an error dialog).
+# The session's output goes to the journal instead, under `journalctl -t x-session`.
+exec systemd-cat -t x-session /bin/sh "$HOME/.xinitrc"
diff --git a/testdata/beside/mesh-catalog/modules/i3/files/xinitrc-last b/testdata/beside/mesh-catalog/modules/i3/files/xinitrc-last
new file mode 100644
index 0000000..e84ff3d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/files/xinitrc-last
@@ -0,0 +1,2 @@
+# The session: i3, with 25 MiB of debug log kept in memory for i3-dump-log.
+exec i3 --shmlog-size=26214400
diff --git a/testdata/beside/mesh-catalog/modules/i3/module.json.captured b/testdata/beside/mesh-catalog/modules/i3/module.json.captured
new file mode 100644
index 0000000..1ec9242
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3/module.json.captured
@@ -0,0 +1,124 @@
+{
+  "module": "i3",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-display-session",
+      "scope": "node",
+      "serves": [
+        "reload",
+        "workspaces",
+        "windows"
+      ]
+    }
+  ],
+  "tools": [
+    "i3_focus",
+    "i3_move",
+    "i3_layout_save",
+    "i3_layout_restore",
+    "i3_exec",
+    "i3_kill",
+    "i3_bindings",
+    "i3_config_check",
+    "i3_marks",
+    "i3_scratchpad"
+  ],
+  "items": [
+    {
+      "collection": "environment",
+      "name": "xdg-current-desktop",
+      "attributes": {
+        "kind": "variable",
+        "name": "XDG_CURRENT_DESKTOP"
+      },
+      "template": "files/env-xdg-current-desktop"
+    },
+    {
+      "collection": "environment",
+      "name": "xdg-session-desktop",
+      "attributes": {
+        "kind": "variable",
+        "name": "XDG_SESSION_DESKTOP"
+      },
+      "template": "files/env-xdg-session-desktop"
+    },
+    {
+      "collection": "shell:xinitrc:last",
+      "name": "xinitrc-last",
+      "template": "files/xinitrc-last"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "i3-wm"
+    },
+    {
+      "id": "package-dex",
+      "type": "package",
+      "package": "dex"
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/i3",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["scripts/"]
+    },
+    {
+      "id": "drop-ins",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/i3/config.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["10-asus.conf", "20-g14.conf"]
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${machine:account-home}/.config/i3/config",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/config"
+    },
+    {
+      "id": "session",
+      "type": "file",
+      "path": "/etc/lemurs/wms/i3",
+      "mode": "0755",
+      "template": "files/wms/i3"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/i3-tools",
+        "binary": "i3-tools",
+        "loads": [
+          "i3-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3bar-watchdog b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3bar-watchdog
new file mode 100755
index 0000000..63b2b02
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3bar-watchdog
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# i3bar-watchdog [session-pid] (module i3status-rust, novox/hq ADR 0208): respawns a bar that died.
+#
+# i3 starts one i3bar per `bar { }` block and never restarts one that exits, and a reload does not
+# either. Changing the monitor setup reliably kills the bar that owns the tray. This brings back the
+# one missing i3bar, without restarting i3, and logs the outputs at that moment: the evidence for the
+# cause, which is i3bar's.
+#
+# Started once per session from the session's start, with the session's own pid; it ends when that
+# process does. Adopted from the predecessor's i3-bar-watchdog user unit of 2026-10-04.
+set -uo pipefail
+
+session_pid="${1:-}"
+interval="${I3_BAR_WATCHDOG_INTERVAL:-5}"
+# Two misses in a row before acting: an i3 restart tears every bar down and starts them again.
+confirm="${I3_BAR_WATCHDOG_CONFIRM:-2}"
+# Never respawn the same bar more often than this, so a bar that dies at once is not a tight loop.
+cooldown="${I3_BAR_WATCHDOG_COOLDOWN:-30}"
+
+log() { printf 'i3bar-watchdog: %s\n' "$*" >&2; }
+
+for tool in i3-msg i3bar pgrep; do
+	command -v "$tool" >/dev/null 2>&1 || {
+		log "$tool is missing; not watching"
+		exit 1
+	}
+done
+
+declare -A missed=() fixed=()
+
+bar_ids() { i3-msg -t get_bar_config 2>/dev/null | grep -oE '"[^"]+"' | tr -d '"'; }
+outputs() { xrandr --listmonitors 2>/dev/null | tail -n +2 | awk '{print $2" "$3}' | tr '\n' ' '; }
+session_alive() { [ -z "$session_pid" ] || kill -0 "$session_pid" 2>/dev/null; }
+
+while session_alive; do
+	sleep "$interval"
+	socket="$(i3 --get-socketpath 2>/dev/null)"
+	[ -n "$socket" ] && [ -S "$socket" ] || continue
+	ids="$(bar_ids)"
+	[ -n "$ids" ] || continue
+	while read -r id; do
+		[ -n "$id" ] || continue
+		if pgrep -u "$EUID" -f -- "i3bar --bar_id=$id" >/dev/null 2>&1; then
+			missed[$id]=0
+			continue
+		fi
+		missed[$id]=$((${missed[$id]:-0} + 1))
+		[ "${missed[$id]}" -ge "$confirm" ] || continue
+		now="$(date +%s)"
+		if [ $((now - ${fixed[$id]:-0})) -lt "$cooldown" ]; then
+			continue
+		fi
+		log "$id is gone; respawning it. Outputs now: $(outputs)"
+		nohup i3bar --bar_id="$id" --socket="$socket" >/dev/null 2>&1 &
+		disown 2>/dev/null || true
+		fixed[$id]="$now"
+		sleep 2
+		if pgrep -u "$EUID" -f -- "i3bar --bar_id=$id" >/dev/null 2>&1; then
+			missed[$id]=0
+		else
+			log "$id exited within 2s of respawning; check its status_command"
+		fi
+	done <<<"$ids"
+done
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-updates b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-updates
new file mode 100755
index 0000000..1a70cf9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-updates
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# i3status-updates [threshold] (module i3status-rust, novox/hq ADR 0208): the pending updates, for
+# the bottom bar's custom block (json = true). Emits one JSON line.
+#
+# Adopted from the operator's pkg-updates of 2026-10-04. The native `packages` block showed a raw
+# red error on every transient network failure, which on a roaming laptop is often. This keeps the
+# last good result through a failure and shows an error only after `threshold` failures in a row
+# (default 10). Official packages through checkupdates (pacman-contrib, a temporary database, no
+# root); AUR packages through paru when it is installed, and none counted when it is not.
+set -uo pipefail
+
+threshold="${1:-10}"
+icon="update"
+state_dir="${XDG_RUNTIME_DIR:-/tmp}/i3status-updates"
+mkdir -p "$state_dir"
+last="$state_dir/last_good.json"
+failures="$state_dir/failures"
+
+json() { printf '{"icon":"%s","state":"%s","text":"%s","short_text":"%s"}' "$icon" "$1" "$2" "$3"; }
+count() { [ -n "$1" ] && printf '%s\n' "$1" | grep -c . || echo 0; }
+
+official="$(checkupdates 2>/dev/null)"
+official_rc=$?
+aur="" aur_rc=0
+if command -v paru >/dev/null 2>&1; then
+	aur="$(paru -Qua 2>/dev/null)"
+	aur_rc=$?
+fi
+
+# checkupdates: 0 updates listed, 2 none pending; anything else is a failure.
+if { [ "$official_rc" -eq 0 ] || [ "$official_rc" -eq 2 ]; } && [ "$aur_rc" -eq 0 ]; then
+	o="$(count "$official")"
+	a="$(count "$aur")"
+	total=$((o + a))
+	if [ "$total" -eq 0 ]; then
+		payload="$(json Good "up to date" "")"
+	else
+		# A kernel update wants a reboot: the one worth not putting off.
+		state=Info
+		printf '%s\n' "$official" | grep -qE '^(linux|linux-lts|linux-zen) ' && state=Warning
+		label="$o + $a = $total updates"
+		[ "$a" -eq 0 ] && label="$total updates"
+		[ "$total" -eq 1 ] && label="1 update"
+		payload="$(json "$state" "$label" "$total")"
+	fi
+	printf '%s' "$payload" >"$last"
+	printf '0' >"$failures"
+	printf '%s\n' "$payload"
+	exit 0
+fi
+
+n=$(($(cat "$failures" 2>/dev/null || echo 0) + 1))
+printf '%s' "$n" >"$failures"
+if [ "$n" -ge "$threshold" ]; then
+	json Critical "update check failing (${n}x)" "!"
+	echo
+elif [ -s "$last" ]; then
+	cat "$last"
+	echo
+else
+	json Idle "" ""
+	echo
+fi
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-value b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-value
new file mode 100755
index 0000000..8fea95e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bin/i3status-value
@@ -0,0 +1,13 @@
+#!/bin/sh
+# i3status-value <state> <key> (module i3status-rust, novox/hq ADR 0260): one value another module keeps
+# on the bus, for a block it contributed.
+#
+# This module's own tools bundle watches the state on the bus (the mesh grants it the read) and leaves
+# the value's text in this module's own directory; this prints it. A value not refreshed for thirty
+# seconds is one its module stopped giving, and prints nothing, so the block hides rather than show an
+# old number as if it were now.
+dir="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/i3status-rust/values"
+f="$dir/$1@$2"
+if [ -r "$f" ] && [ $(( $(date +%s) - $(stat -c %Y "$f") )) -le 30 ]; then
+	head -n 1 "$f"
+fi
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/bottom-bar.toml b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bottom-bar.toml
new file mode 100644
index 0000000..12e6805
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/bottom-bar.toml
@@ -0,0 +1,109 @@
+# The bottom bar (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. Adopted from the workstations of 2026-10-04 with what follows a machine's hardware or one
+# person's devices left out: a block that depends on the hardware is contributed by the module that
+# knows it (novox/hq ADR 0255), and a headset's address is not the bar's to know. Every block written
+# here works the same on any machine.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "tea_timer"
+format = "$icon{ $minutes:$seconds|}"
+done_cmd = "notify-send 'Timer finished'"
+
+# Pending updates: official and, where an AUR helper is installed, AUR. The script keeps the last good
+# count through a network gap and shows an error only after ten failed checks in a row. Click: the
+# list, in the launcher's menu.
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-updates 10"
+json = true
+interval = 1800
+[[block.click]]
+button = "left"
+cmd = "checkupdates | dmenu -l 20 -p Updates"
+
+[[block]]
+block = "cpu"
+
+[[block]]
+block = "disk_space"
+path = "/"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon / $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "disk_space"
+path = "/home"
+info_type = "used"
+alert_unit = "GB"
+interval = 20
+warning = 850
+alert = 920
+format = "$icon /home $used.eng(w:2) ($percentage.eng(w:2))"
+
+[[block]]
+block = "memory"
+# What programs hold, without the cache the kernel gives back when asked: the figure the memory-pressure
+# module judges by. Counting the cache as used read near full on a machine with room to spare.
+format = "$icon $mem_used.eng(w:2) ($mem_used_percents.eng(w:2))"
+format_alt = "$icon_swap $swap_used.eng(w:2) ($swap_used_percents.eng(w:2))"
+
+# Blocks other modules contribute beside the machine's resources (novox/hq ADR 0255), rendered from
+# what they show by this module's template, and only on a machine that has what they show.
+${collected:contribution:node-bar:block:bar=bottom,place=resources}
+[[block]]
+block = "docker"
+interval = 2
+format = "$icon $running/$total"
+
+[[block]]
+block = "sound"
+[[block.click]]
+button = "left"
+cmd = "pavucontrol"
+
+# Blocks other modules contribute beside the sound (novox/hq ADR 0255): the power module's battery and
+# power draw, where the machine has them.
+${collected:contribution:node-bar:block:bar=bottom,place=status}
+# The weather from the Norwegian Meteorological Institute, which needs no key, where the machine is.
+[[block]]
+block = "weather"
+format = "$icon  $weather_verbose ($location) $temp"
+autolocate = true
+autolocate_interval = 600
+[block.service]
+name = "metno"
+
+[[block]]
+block = "notify"
+driver = "dunst"
+format = " $icon {($notification_count.eng(w:1))|}"
+
+[[block]]
+block = "time"
+interval = 1
+format = "$timestamp.datetime(f:'%a %d/%m %H:%M:%S')"
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/i3/60-i3status-rust.conf b/testdata/beside/mesh-catalog/modules/i3status-rust/files/i3/60-i3status-rust.conf
new file mode 100644
index 0000000..20acbb1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/i3/60-i3status-rust.conf
@@ -0,0 +1,34 @@
+# The bars (module i3status-rust, novox/hq ADR 0208). Owned by the mesh: replaced at every push.
+# i3 reads this file through its configuration's `include ~/.config/i3/config.d/*.conf`. The bottom
+# bar shows the machine; the top bar the focused window and the tray, on the primary output. The
+# face is the monospace one every desktop module names.
+bar {
+        font pango:JetBrainsMono Nerd Font 11
+        position bottom
+        status_command i3status-rs ~/.config/i3status-rust/bottom-bar.toml
+        tray_output none
+        colors {
+                separator #ffffff
+                background #000000
+                statusline #ffffff
+                # The text on an accent-coloured button is dark: light text on the accent was barely
+                # legible.
+                focused_workspace #de5200 #de5200 #000000
+                active_workspace #de5200 #de5200 #000000
+                inactive_workspace #000000 #000000 #ffffff
+                urgent_workspace #2f343a #900000 #ffffff
+        }
+}
+
+bar {
+        font pango:JetBrainsMono Nerd Font 11
+        position top
+        status_command i3status-rs ~/.config/i3status-rust/top-bar.toml
+        workspace_buttons no
+        tray_output primary
+        colors {
+                separator #ffffff
+                background #000000
+                statusline #ffffff
+        }
+}
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/icons/custom-icons.toml b/testdata/beside/mesh-catalog/modules/i3status-rust/files/icons/custom-icons.toml
new file mode 100644
index 0000000..9636a82
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/icons/custom-icons.toml
@@ -0,0 +1,135 @@
+# Icons for the bars (module i3status-rust, novox/hq ADR 0208), from the JetBrains Mono Nerd Font.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+# Material from NerdFont
+# Codepoints from the Nerd Fonts cheat sheet
+backlight = [
+    "\ue38d", # nf-weather-moon_new
+    "\ue3d4", # nf-weather-moon_alt_waxing_gibbous_6
+    "\ue3d3", # nf-weather-moon_alt_waxing_gibbous_5
+    "\ue3d2", # nf-weather-moon_alt_waxing_gibbous_4
+    "\ue3d1", # nf-weather-moon_alt_waxing_gibbous_3
+    "\ue3d0", # nf-weather-moon_alt_waxing_gibbous_2
+    "\ue3cf", # nf-weather-moon_alt_waxing_gibbous_1
+    "\ue3ce", # nf-weather-moon_alt_first_quarter
+    "\ue3cd", # nf-weather-moon_alt_waxing_crescent_6
+    "\ue3cc", # nf-weather-moon_alt_waxing_crescent_5
+    "\ue3cb", # nf-weather-moon_alt_waxing_crescent_4
+    "\ue3ca", # nf-weather-moon_alt_waxing_crescent_3
+    "\ue3c9", # nf-weather-moon_alt_waxing_crescent_2
+    "\ue3c8", # nf-weather-moon_alt_waxing_crescent_1
+    "\ue39b", # nf-weather-moon_full
+]
+bat_charging = "\U000f0084" # nf-md-battery_charging
+bat_not_available = "\U000f0091" # nf-md-battery_unknown
+bat = [
+    "\U000f007a", # nf-md-battery_10
+    "\U000f007b", # nf-md-battery_20
+    "\U000f007c", # nf-md-battery_30
+    "\U000f007d", # nf-md-battery_40
+    "\U000f007e", # nf-md-battery_50
+    "\U000f007f", # nf-md-battery_60
+    "\U000f0080", # nf-md-battery_70
+    "\U000f0081", # nf-md-battery_80
+    "\U000f0082", # nf-md-battery_90
+    "\U000f0079", # nf-md-battery
+]
+bell = "\U000f009c" # nf-md-bell_outline
+bell-slash = "\U000f009b" # nf-md-bell_off
+blackberry = "\uf307" # nf-md-blackberry
+bluetooth = "\U000f00af" # nf-md-bluetooth
+calendar = "\U000f00ed" # nf-md-calendar
+cogs = "\U000f0493" # nf-md-cog
+cpu = [
+	"\U000F0F86", # nf-md-speedometer_slow
+	"\U000F0F85", # nf-md-speedometer_medium
+	"\U000F04C5", # nf-md-speedometer
+]
+cpu_boost_on = "\U000f0521" # nf-md-toggle_switch
+cpu_boost_off = "\U000f0a19" # nf-md-toggle_switch_off_outline
+disk_drive = "\U000f02ca" # nf-md-harddisk
+docker = "\uf308" # nf-linux-docker
+github = "\U000f02a4" # nf-md-github
+gpu = "\U000f0379" # nf-md-monitor
+headphones = "\U000f02cb" # nf-md-headphones
+joystick = "\U000f0297" # nf-md-gamepad_variant
+keyboard = "\U000f030c" # nf-md-keyboard
+mail = "\U000f01ee" # nf-md-email
+memory_mem = "\U000f035b" # nf-md-memory
+memory_swap = "\U000f02ca" # nf-md-harddisk
+mouse = "\U000f037d" # nf-md-mouse
+music = "\U000f075a" # nf-md-music
+music_next = "\U000f04ad" # nf-md-skip_next
+music_pause = "\U000f03e4" # nf-md-pause
+music_play = "\U000f040a" # nf-md-play
+music_prev = "\U000f04ae" # nf-md-skip_previous
+net_bridge = "\U000f04aa" # nf-md-sitemap
+net_down = "\U000f01da" # nf-md-download
+net_loopback = "\U000f006f" # nf-md-backup_restore
+net_modem = "\U000f03f2" # nf-md-phone
+net_cellular = [
+        "\U000F08FD", # nf-md-network_strength_off_outline
+        "\U000F08FE", # nf-md-network_strength_outline
+        "\U000F08F4", # nf-md-network_strength_1
+        "\U000F08F6", # nf-md-network_strength_2
+        "\U000F08F8", # nf-md-network_strength_3
+        "\U000F08FA", # nf-md-network_strength_4
+]
+net_up = "\U000f0552" # nf-md-upload
+net_vpn = "\U000f0582" # nf-md-vpn
+net_wired = "\U000f0200" # nf-md-ethernet
+net_wireless = [
+	"\U000F092F", # nf-md-wifi_strength_outline
+	"\U000F091F", # nf-md-wifi_strength_1
+	"\U000F0922", # nf-md-wifi_strength_2
+	"\U000F0925", # nf-md-wifi_strength_3
+	"\U000F0928", # nf-md-wifi_strength_4
+]
+notification = "\U000f009c" # nf-md-bell_outline
+phone = "\U000f03f2" # nf-md-phone
+phone_disconnected = "\U000f0658" # nf-md-phone_minus
+ping = "\U000f051f" # nf-md-timer_sand
+pomodoro = "\ue001" # nf-pom-pomodoro_done
+pomodoro_break = "\U000f0176" # nf-md-coffee
+pomodoro_paused = "\U000f03e4" # nf-md-pause
+pomodoro_started = "\U000f040a" # nf-md-play
+pomodoro_stopped = "\U000f04db" # nf-md-stop
+resolution = "\U000f0293" # nf-md-fullscreen
+tasks = "\U000f05c7" # nf-md-playlist_check
+tea = "\U000f0d9e" # nf-md-tea
+thermometer = [
+    "\U000f10c3", # nf-md-thermometer_low
+    "\U000f050f", # nf-md-thermometer
+    "\U000f10c2", # nf-md-thermometer_high
+]
+time = "\U000f0150" # nf-md-clock_outline
+toggle_off = "\U000f0a19" # nf-md-toggle_switch_off_outline
+toggle_on = "\U000f0521" # nf-md-toggle_switch
+unknown = "\U000f0186" # nf-md-comment_question_outline | TODO: Make default?
+update = "\U000f03d5" # nf-md-package_up
+uptime = "\U000f0153" # nf-md-clock_in
+volume_muted = "\U000f075f" # nf-md-volume_mute
+volume = [
+    "\U000f057f", # nf-md-volume_low
+    "\U000f0580", # nf-md-volume_medium
+    "\U000f057e", # nf-md-volume_high
+]
+microphone_muted = "\U000f036d" # nf-md-microphone_off
+microphone = [
+	"\U000f036e", # nf-md-microphone_outline
+    "\U000f036c", # nf-md-microphone
+    "\U000f036c", # nf-md-microphone
+]
+xrandr = "\U000f037a" # nf-md-monitor_multiple
+
+# Weather icons (the names the weather block documents)
+weather_sun = "\ue30d" # nf-weather-day_sunny (when weather is reported as “Clear” during the day)
+weather_moon = "\ue32b" # nf-weather-night_clear (when weather is reported as “Clear” at night)
+weather_clouds = "\ue312" # nf-weather-cloudy (when weather is reported as “Clouds” during the day)
+weather_clouds_night = "\ue37e" # nf-weather-night_alt_cloudy (when weather is reported as “Clouds” at night)
+weather_fog = "\ue313" # nf-weather-fog (when weather is reported as “Fog” or “Mist” during the day)
+weather_fog_night = "\ue346" # nf-weather-night_fog (when weather is reported as “Fog” or “Mist” at night)
+weather_rain = "\ue318" # nf-weather-rain (when weather is reported as “Rain” or “Drizzle” during the day)
+weather_rain_night = "\ue325" # nf-weather-night_alt_rain (when weather is reported as “Rain” or “Drizzle” at night)
+weather_snow = "\ue31a" # nf-weather-snow (when weather is reported as “Snow”)
+weather_thunder = "\ue31d" # nf-weather-thunderstorm (when weather is reported as “Thunderstorm” during the day)
+weather_thunder_night = "\ue32a" # nf-weather-night_alt_thunderstorm (when weather is reported as “Thunderstorm” at night)
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/top-bar.toml b/testdata/beside/mesh-catalog/modules/i3status-rust/files/top-bar.toml
new file mode 100644
index 0000000..be198e8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/top-bar.toml
@@ -0,0 +1,37 @@
+# The top bar (module i3status-rust, novox/hq ADR 0208): the focused window's title and the uptime.
+# Owned by the mesh: replaced at every push. Adopted unchanged from the workstations of 2026-10-04.
+icons_format = "{icon}"
+
+[theme]
+theme = "plain"
+[theme.overrides]
+idle_bg = "#000000"
+idle_fg = "#f1f1f1"
+info_bg = "#000000"
+info_fg = "#f1f1f1"
+good_bg = "#000000"
+good_fg = "#859900"
+warning_bg = "#000000"
+warning_fg = "#de5200"
+critical_bg = "#000000"
+critical_fg = "#ff0000"
+separator = " | "
+separator_fg = "#ffffff"
+separator_bg = "#000000"
+
+[icons]
+icons = "custom-icons"
+
+[[block]]
+block = "focused_window"
+[block.format]
+full = " $title.str(max_w:50) |"
+short = " $title.str(max_w:100) |"
+
+[[block]]
+block = "uptime"
+interval = 60
+
+# Blocks other modules contribute to the top bar (novox/hq ADR 0255). None do yet; both places are kept
+# so that one that does is never dropped.
+${collected:contribution:node-bar:block:bar=top,place=resources}${collected:contribution:node-bar:block:bar=top,place=status}
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/files/xinitrc-normal b/testdata/beside/mesh-catalog/modules/i3status-rust/files/xinitrc-normal
new file mode 100644
index 0000000..888acdb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/files/xinitrc-normal
@@ -0,0 +1,3 @@
+# The bar watchdog (module i3status-rust, novox/hq ADR 0208): i3 never restarts a bar that dies; this
+# brings it back. Once per session, ending with the session's own process ($$).
+"$HOME/.local/bin/i3bar-watchdog" "$$" &
diff --git a/testdata/beside/mesh-catalog/modules/i3status-rust/module.json.captured b/testdata/beside/mesh-catalog/modules/i3status-rust/module.json.captured
new file mode 100644
index 0000000..1e07556
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/i3status-rust/module.json.captured
@@ -0,0 +1,126 @@
+{
+  "module": "i3status-rust",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-bar",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "i3status_rust_reload",
+    "i3status_rust_blocks",
+    "i3status_rust_block_run",
+    "i3status_rust_themes"
+  ],
+  "items": [
+    {
+      "collection": "shell:xinitrc:normal",
+      "name": "xinitrc-normal",
+      "template": "files/xinitrc-normal"
+    },
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/60-i3status-rust.conf"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "i3status-rust"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/i3status-rust",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "icons-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/i3status-rust/icons",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "top-bar",
+      "type": "file",
+      "path": "${machine:account-home}/.config/i3status-rust/top-bar.toml",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/top-bar.toml"
+    },
+    {
+      "id": "bottom-bar",
+      "type": "file",
+      "path": "${machine:account-home}/.config/i3status-rust/bottom-bar.toml",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/bottom-bar.toml"
+    },
+    {
+      "id": "icons",
+      "type": "file",
+      "path": "${machine:account-home}/.config/i3status-rust/icons/custom-icons.toml",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/icons/custom-icons.toml"
+    },
+    {
+      "id": "updates",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/i3status-updates",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/i3status-updates"
+    },
+    {
+      "id": "watchdog",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/i3bar-watchdog",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/i3bar-watchdog"
+    },
+    {
+      "id": "value",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/i3status-value",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/i3status-value"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/i3status-rust-tools",
+        "binary": "i3status-rust-tools",
+        "loads": [
+          "i3status-rust-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/icecast/files/config.json b/testdata/beside/mesh-catalog/modules/icecast/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/icecast/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/icecast/files/icecast.xml b/testdata/beside/mesh-catalog/modules/icecast/files/icecast.xml
new file mode 100644
index 0000000..de4dd79
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/icecast/files/icecast.xml
@@ -0,0 +1,56 @@
+<icecast>
+    <!-- Written by the mesh (modules/icecast). Passwords arrive as secrets rendered into this file,
+         never as environment: the image's entrypoint seds ICECAST_* variables into the file only
+         when they are set, and none are. -->
+    <location>Earth</location>
+    <admin>icemaster@localhost</admin>
+    <limits>
+        <clients>100</clients>
+        <sources>2</sources>
+        <queue-size>524288</queue-size>
+        <client-timeout>30</client-timeout>
+        <header-timeout>15</header-timeout>
+        <source-timeout>10</source-timeout>
+        <burst-on-connect>1</burst-on-connect>
+        <burst-size>65535</burst-size>
+    </limits>
+    <authentication>
+        <source-password>${secret:source}</source-password>
+        <relay-password>${secret:relay}</relay-password>
+        <admin-user>admin</admin-user>
+        <admin-password>${secret:admin}</admin-password>
+    </authentication>
+    <!-- The name icecast writes into playlists (.m3u/.xspf: http://<hostname>:<port>/<mount>) and
+         would announce to YP (none configured). A machine's own name belongs to its assignment, and
+         an assignment merges only into JSON; this XML cannot take it, so the neutral default stays. -->
+    <hostname>localhost</hostname>
+    <listen-socket>
+        <port>8000</port>
+    </listen-socket>
+    <http-headers>
+        <header name="Access-Control-Allow-Origin" value="*" />
+    </http-headers>
+    <fileserve>1</fileserve>
+    <paths>
+        <basedir>/usr/share/icecast</basedir>
+        <logdir>/var/log/icecast</logdir>
+        <webroot>/usr/share/icecast/web</webroot>
+        <adminroot>/usr/share/icecast/admin</adminroot>
+        <alias source="/" destination="/status.xsl"/>
+    </paths>
+    <logging>
+        <accesslog>access.log</accesslog>
+        <errorlog>error.log</errorlog>
+        <loglevel>3</loglevel>
+        <logsize>10000</logsize>
+    </logging>
+    <security>
+        <chroot>0</chroot>
+        <!-- Starts as root, reads this 0600 root-owned file, then drops to the image's icecast user
+             (uid 100, group icecast 101) before serving. -->
+        <changeowner>
+            <user>icecast</user>
+            <group>icecast</group>
+        </changeowner>
+    </security>
+</icecast>
diff --git a/testdata/beside/mesh-catalog/modules/icecast/module.json.captured b/testdata/beside/mesh-catalog/modules/icecast/module.json.captured
new file mode 100644
index 0000000..6f9ab54
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/icecast/module.json.captured
@@ -0,0 +1,152 @@
+{
+  "module": "icecast",
+  "version": "1",
+  "requires": [
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "route": {
+      "label": "icecast",
+      "endpoint": "stream"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "secret": {
+      "source": "${dir:state}/source.secret",
+      "admin": "${dir:state}/admin.secret",
+      "relay": "${dir:state}/relay.secret"
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "stream.started",
+    "stream.stopped"
+  ],
+  "listens": [
+    {
+      "name": "stream",
+      "port": 8000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "streams in from sources (HTTP PUT) and out to listeners, plus the status and admin pages; a public name is its route"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "logs",
+        "path": "${dir:logs}",
+        "class": "cache",
+        "why": "the streaming server's logs"
+      }
+    ]
+  },
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Icecast at, as a URL; unset, the code falls back to its environment, else this machine's Icecast on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "user": {
+      "type": "string",
+      "description": "The Icecast admin account the module's tools sign in as; unset, the code falls back to its environment, else admin.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "logs",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "100:101",
+      "unknown": "program"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "${dir:state}/icecast.xml",
+      "mode": "0600",
+      "template": "files/icecast.xml"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "icecast"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "icecast",
+      "image": "infiniteproject/icecast@sha256:cd506cf3dfe31ce05fd37d7e672dbd1213e7255cc93d28ecf5a3b547af4e162c",
+      "network": "icecast",
+      "ports": [
+        "8000"
+      ],
+      "volumes": [
+        "${dir:state}/icecast.xml:/etc/icecast.xml:ro",
+        "${dir:logs}:/var/log/icecast"
+      ],
+      "restart-on": [
+        "server-conf"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["url", "user"]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_ICECAST_URL": "http://127.0.0.1:${port:8000}",
+          "MESH_ICECAST_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_ICECAST_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/influxdb/files/config.json b/testdata/beside/mesh-catalog/modules/influxdb/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/influxdb/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/influxdb/files/server.env b/testdata/beside/mesh-catalog/modules/influxdb/files/server.env
new file mode 100644
index 0000000..d2552e0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/influxdb/files/server.env
@@ -0,0 +1,6 @@
+DOCKER_INFLUXDB_INIT_MODE=setup
+DOCKER_INFLUXDB_INIT_USERNAME=admin
+DOCKER_INFLUXDB_INIT_PASSWORD_FILE=/run/secrets/admin
+DOCKER_INFLUXDB_INIT_ADMIN_TOKEN_FILE=/run/secrets/admin-token
+DOCKER_INFLUXDB_INIT_ORG=mesh
+DOCKER_INFLUXDB_INIT_BUCKET=default
diff --git a/testdata/beside/mesh-catalog/modules/influxdb/module.json.captured b/testdata/beside/mesh-catalog/modules/influxdb/module.json.captured
new file mode 100644
index 0000000..53389a5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/influxdb/module.json.captured
@@ -0,0 +1,198 @@
+{
+  "module": "influxdb",
+  "version": "1",
+  "provides": [
+    {
+      "name": "influxdb-api",
+      "scope": "mesh",
+      "identity": {
+        "in": "an InfluxDB v1 authorization"
+      }
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "own-secrets": {
+    "admin": "${dir:state}/admin.secret",
+    "admin-token": "${dir:state}/admin-token.secret"
+  },
+  "listens": [
+    {
+      "name": "api",
+      "port": 8086,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "queries, writes and the web UI, over http; consumers granted influxdb-api sign in with the mesh's credential, and a name is a route grant"
+    }
+  ],
+  "config": {
+    "org": {
+      "type": "string",
+      "description": "The organisation influxdb-api names to its consumers and the module's tools write to; mesh is the one influxdb makes at its first start (server.env), and a machine whose server was set up with another sets its own (novox/hq issue 696, ADR 0348 clause 11).",
+      "trusted": true,
+      "default": "mesh"
+    },
+    "bucket": {
+      "type": "string",
+      "description": "The bucket influxdb-api names to its consumers and the module's tools write to; default is the one influxdb makes at its first start (server.env), and a machine whose server was set up with another sets its own (novox/hq issue 696, ADR 0348 clause 11).",
+      "trusted": true,
+      "default": "default"
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach influxdb at, as a URL; empty is this machine's influxdb on its port.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "serves": {
+    "influxdb-api": {
+      "scheme": "http",
+      "port": 8086,
+      "org": "${config:org}",
+      "bucket": "${config:bucket}"
+    }
+  },
+  "receives": {
+    "influxdb-api": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "influxdb-api": "${dir:grants}"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "every consumer's time series"
+      },
+      {
+        "id": "config",
+        "path": "${dir:config}",
+        "class": "valuable",
+        "why": "the server's own configuration and its operator token, made at its first start"
+      }
+    ],
+    "consumers": {
+      "influxdb-api": {
+        "class": "valuable",
+        "in": "data",
+        "why": "a consumer's measurements are the only copy"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "influxdb",
+      "image": "influxdb@sha256:f75e48af0598e8aec7986e991a848d19a119101a7d563a2e5db1dfaac9c45daa",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "8086"
+      ],
+      "volumes": [
+        "${dir:data}:/var/lib/influxdb2",
+        "${dir:config}:/etc/influxdb2",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
+        "${dir:state}/admin-token.secret:/run/secrets/admin-token:ro"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": [
+        "bucket",
+        "org",
+        "url"
+      ],
+      "trusted": true
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "influxdb",
+      "endpoint": "api"
+    }
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_INFLUXDB_URL": "http://127.0.0.1:${port:8086}",
+          "MESH_INFLUXDB_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_INFLUXDB_TOKEN_FILE": "${dir:state}/admin-token.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/invoicing/files/api.env b/testdata/beside/mesh-catalog/modules/invoicing/files/api.env
new file mode 100644
index 0000000..8eaee6f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/invoicing/files/api.env
@@ -0,0 +1,9 @@
+NODE_ENV=production
+PORT=9000
+MONGO_URL=mongodb://${bound:mongodb-database:as}:${secret:mongodb-database}@${bound:mongodb-database:at}:${bound:mongodb-database:port}/${bound:mongodb-database:as}?authSource=${bound:mongodb-database:as}
+MONGO_DB=${bound:mongodb-database:as}
+MINIO_BUCKET=${bound:s3-bucket:bucket}
+MINIO_ENDPOINT=${bound:s3-bucket:at}
+MINIO_PORT=${bound:s3-bucket:port}
+MINIO_ACCESSKEY=${bound:s3-bucket:as}
+MINIO_SECRET=${secret:s3-bucket}
diff --git a/testdata/beside/mesh-catalog/modules/invoicing/module.json.captured b/testdata/beside/mesh-catalog/modules/invoicing/module.json.captured
new file mode 100644
index 0000000..29670a3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/invoicing/module.json.captured
@@ -0,0 +1,128 @@
+{
+  "module": "invoicing",
+  "version": "1",
+  "slug": "invoice",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "mongodb-database",
+    "s3-bucket",
+    "route"
+  ],
+  "contributes": {
+    "mongodb-database": {
+      "name": "invoicing"
+    },
+    "route": {
+      "site": {
+        "label": "invoicing",
+        "endpoint": "web"
+      },
+      "api": {
+        "label": "invoicing-api",
+        "endpoint": "api"
+      }
+    }
+  },
+  "binds": {
+    "mongodb-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "mongodb-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the invoicing web frontend; a public name is a route grant later"
+    },
+    {
+      "name": "api",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the invoicing REST API the frontend and integrations call"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "api-env",
+      "type": "file",
+      "path": "${dir:state}/api.env",
+      "mode": "0600",
+      "template": "files/api.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "invoicing"
+    },
+    {
+      "id": "app",
+      "type": "container",
+      "name": "invoicing-app",
+      "image": "registry-api.novox.be/novox/invoicing-app@sha256:1e6ed40822f07169b24867cbfe8fc1ab3ef6a15ad642f3b3a2882a8e15c3dbec",
+      "network": "invoicing",
+      "env": {
+        "UID": "2201",
+        "GID": "2201"
+      },
+      "ports": [
+        "80"
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
+    },
+    {
+      "id": "api",
+      "type": "container",
+      "name": "invoicing-api",
+      "image": "registry-api.novox.be/novox/invoicing-api@sha256:efa6fba1fa9ba78849e94e958d33793a76654df0468e3012da9c02c54c265354",
+      "network": "invoicing",
+      "env": {
+        "UID": "2201",
+        "GID": "2201"
+      },
+      "env-file": [
+        "${dir:state}/api.env"
+      ],
+      "ports": [
+        "9000"
+      ],
+      "secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (invoicing-app server/src/config.js); converting is that repository's change",
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/jira/files/config.json b/testdata/beside/mesh-catalog/modules/jira/files/config.json
new file mode 100644
index 0000000..9e26dfe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/jira/files/config.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/jira/module.json.captured b/testdata/beside/mesh-catalog/modules/jira/module.json.captured
new file mode 100644
index 0000000..9f98dd8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/jira/module.json.captured
@@ -0,0 +1,75 @@
+{
+  "module": "jira",
+  "version": "1",
+  "own-secrets": {
+    "token": "${dir:state}/token"
+  },
+  "config": {
+    "atlassian-url": {
+      "type": "string",
+      "description": "The address of the operator's Atlassian site the jira tools call, as a URL such as https://example.atlassian.net, laid into the file as ATLASSIAN_URL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    },
+    "atlassian-email": {
+      "type": "string",
+      "description": "The email address of the Atlassian account the jira tools sign in as with its API token, laid into the file as ATLASSIAN_EMAIL; unset, the code falls back to its environment and answers no calls until it is given.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "merge": "json",
+      "template": "files/config.json",
+      "mode": "0600",
+      "takes-config": [
+        {
+          "key": "atlassian-url",
+          "as": "ATLASSIAN_URL"
+        },
+        {
+          "key": "atlassian-email",
+          "as": "ATLASSIAN_EMAIL"
+        }
+      ]
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_JIRA_TOKEN_FILE": "${dir:state}/token",
+          "MESH_JIRA_CONFIG_FILE": "${dir:state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/kernel/files/huge-pages.sh b/testdata/beside/mesh-catalog/modules/kernel/files/huge-pages.sh
new file mode 100644
index 0000000..e0a9815
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/kernel/files/huge-pages.sh
@@ -0,0 +1,84 @@
+#!/bin/sh
+# Transparent huge pages as the mesh sets them on this machine (module kernel, novox/hq issue 746).
+# Written by the mesh from this machine's setting transparent-huge-pages and run by
+# mesh-kernel-huge-pages.service: `apply` at boot and whenever the setting changes, `restore` when the
+# unit stops (the module unassigned, or the machine shutting down). Replaced on every push; change the
+# setting, never this file. A change of the setting reloads the unit, which runs `apply` again: the mode
+# moves straight to the new value and never passes back through the one the machine was found with.
+#
+#   huge-pages apply|restore [<the kernel's transparent_hugepage directory> [<this module's state>]]
+#
+# The two directories are arguments only so the module's tests can run this against a stand-in tree.
+set -eu
+
+want='${config:transparent-huge-pages}'
+sys=/sys/kernel/mm/transparent_hugepage
+state='${dir:state}'
+[ $# -ge 2 ] && sys=$2
+[ $# -ge 3 ] && state=$3
+
+case "$want" in
+always | madvise | never) ;;
+*)
+	echo "the setting transparent-huge-pages is '$want'; the kernel takes always, madvise or never" >&2
+	exit 2
+	;;
+esac
+[ -f "$sys/enabled" ] || {
+	echo "this kernel has no $sys/enabled: it was built without transparent huge pages, so there is nothing to set" >&2
+	exit 1
+}
+
+# The mode in force is the word the kernel brackets: "always [madvise] never". A file holding one bare
+# word (the stand-in tree of the tests) is read as that word.
+mode() { sed -n -e 's/.*\[\([a-z]*\)\].*/\1/p' -e t -e 's/^ *\([a-z]*\) *$/\1/p' "$sys/enabled"; }
+
+[ $# -ge 1 ] || set -- usage
+case "$1" in
+apply)
+	now=$(mode)
+	# What the machine had before the mesh first set it, kept once, so `restore` gives it back.
+	[ -s "$state/found" ] || printf '%s\n' "$now" >"$state/found"
+	if [ "$now" = "$want" ]; then
+		echo "transparent huge pages: $want, as set"
+		exit 0
+	fi
+	printf '%s\n' "$want" >"$sys/enabled"
+	got=$(mode)
+	[ "$got" = "$want" ] || {
+		echo "wrote $want to $sys/enabled and the kernel says $got" >&2
+		exit 1
+	}
+	echo "transparent huge pages: $now -> $want"
+	# A file folio already in the page cache keeps its size: the active journal files, mapped by journald
+	# and by every reader, stay in 2 MiB folios until they are archived (issue 746). Rotating starts new
+	# files that are mapped under the new mode. A failed rotation is said and does not fail the setting.
+	# At boot nothing is in huge folios yet, and the persistent journal opens only after this unit: no rotation
+	# while the service manager is still bringing the machine up.
+	booting=$(systemctl is-system-running 2>/dev/null || true)
+	case "$booting" in
+	initializing | starting) echo "the machine is still starting: nothing to rotate yet" ;;
+	*)
+		if [ "$want" != always ] && command -v journalctl >/dev/null 2>&1; then
+			journalctl --rotate || echo "the journal could not be rotated: its active files keep their huge pages until they are archived" >&2
+		fi
+		;;
+	esac
+	;;
+restore)
+	found=$(cat "$state/found" 2>/dev/null || true)
+	case "$found" in
+	always | madvise | never)
+		printf '%s\n' "$found" >"$sys/enabled"
+		echo "transparent huge pages: back to $found, as the machine had them"
+		;;
+	*) echo "transparent huge pages: nothing recorded as found, left at $(mode)" ;;
+	esac
+	# Unassigned or shut down: nothing of the module is kept; the next start records what it finds again.
+	rm -f "$state/found"
+	;;
+*)
+	echo "usage: huge-pages apply|restore [<transparent_hugepage directory> [<state directory>]]" >&2
+	exit 2
+	;;
+esac
diff --git a/testdata/beside/mesh-catalog/modules/kernel/files/mesh-kernel-huge-pages.service b/testdata/beside/mesh-catalog/modules/kernel/files/mesh-kernel-huge-pages.service
new file mode 100644
index 0000000..77a9059
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/kernel/files/mesh-kernel-huge-pages.service
@@ -0,0 +1,25 @@
+[Unit]
+Description=Transparent huge pages as the mesh sets them on this machine
+# Module kernel, novox/hq issue 746. Starting this unit sets the mode from the setting
+# transparent-huge-pages; reloading it (the setting changed) sets the new mode; stopping it gives back the
+# mode the machine had before. It runs early in boot, before the services that fill the page cache.
+DefaultDependencies=no
+After=local-fs.target
+Before=sysinit.target shutdown.target
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${dir:state}/huge-pages apply
+ExecReload=${dir:state}/huge-pages apply
+ExecStop=${dir:state}/huge-pages restore
+# It writes one file under /sys and its own state, and asks the journal daemon to rotate over its socket.
+ProtectSystem=strict
+ReadWritePaths=${dir:state}
+ProtectHome=yes
+PrivateNetwork=yes
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=sysinit.target
diff --git a/testdata/beside/mesh-catalog/modules/kernel/module.json.captured b/testdata/beside/mesh-catalog/modules/kernel/module.json.captured
new file mode 100644
index 0000000..67d3215
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/kernel/module.json.captured
@@ -0,0 +1,78 @@
+{
+  "module": "kernel",
+  "version": "1",
+  "capabilities": [
+    "service-manager"
+  ],
+  "config": {
+    "transparent-huge-pages": {
+      "type": "string",
+      "description": "madvise is the value the mesh chose for every node (novox/hq ADR 0381), not the always the distribution's kernel boots with; a machine that needs another value is given it as its own setting; madvise gives huge pages only to programs that ask for them, which stops a small write to a mapped file (the journal) dirtying and writing back a whole 2 MiB page on a machine whose disks are slow (novox/hq issue 746)",
+      "trusted": true,
+      "default": "madvise"
+    }
+  },
+  "tools": [
+    "kernel_huge_pages"
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "huge-pages",
+      "type": "file",
+      "path": "${dir:state}/huge-pages",
+      "mode": "0755",
+      "trusted": true,
+      "template": "files/huge-pages.sh"
+    },
+    {
+      "id": "unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-kernel-huge-pages.service",
+      "mode": "0644",
+      "template": "files/mesh-kernel-huge-pages.service"
+    },
+    {
+      "id": "apply",
+      "type": "service",
+      "unit": "mesh-kernel-huge-pages.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "unit"
+      ],
+      "reload-on": [
+        "huge-pages"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/kernel-tools",
+        "binary": "kernel-tools",
+        "loads": [
+          "kernel-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/files/admin.env b/testdata/beside/mesh-catalog/modules/keycloak/files/admin.env
new file mode 100644
index 0000000..3e52ae5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/files/admin.env
@@ -0,0 +1,2 @@
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=${secret:admin}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/files/config.json b/testdata/beside/mesh-catalog/modules/keycloak/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/files/consumers.json b/testdata/beside/mesh-catalog/modules/keycloak/files/consumers.json
new file mode 100644
index 0000000..b0af957
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/files/consumers.json
@@ -0,0 +1 @@
+${consumers:oidc-client}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/files/database.env b/testdata/beside/mesh-catalog/modules/keycloak/files/database.env
new file mode 100644
index 0000000..454ee99
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/files/database.env
@@ -0,0 +1,3 @@
+KC_DB_URL=jdbc:postgresql://${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
+KC_DB_USERNAME=${bound:postgres-database:as}
+KC_DB_PASSWORD=${secret:postgres-database}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/files/hostname.env b/testdata/beside/mesh-catalog/modules/keycloak/files/hostname.env
new file mode 100644
index 0000000..92f061a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/files/hostname.env
@@ -0,0 +1 @@
+KC_HOSTNAME=https://${bound:route:name}
diff --git a/testdata/beside/mesh-catalog/modules/keycloak/module.json.captured b/testdata/beside/mesh-catalog/modules/keycloak/module.json.captured
new file mode 100644
index 0000000..847d5f4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/keycloak/module.json.captured
@@ -0,0 +1,245 @@
+{
+  "module": "keycloak",
+  "version": "1",
+  "moved": true,
+  "upgrade": {
+    "policy": "record",
+    "why": "every person's sign-in to every site goes through it, and its new version migrates its database on start: a person takes each build, after a backup (hq ADR 0236)"
+  },
+  "provides": [
+    {
+      "name": "oidc-client",
+      "scope": "mesh",
+      "identity": {
+        "max": 255,
+        "in": "a Keycloak client id"
+      }
+    }
+  ],
+  "requires": [
+    "postgres-database",
+    "route"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "keycloak"
+    },
+    "route": {
+      "label": "keycloak",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "user.created",
+    "user.deleted",
+    "password.reset",
+    "client.created",
+    "client.retired",
+    "group.created",
+    "role.created",
+    "admin.repaired",
+    "admin.unrepaired"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "anything the mesh runs that authenticates a person"
+    }
+  ],
+  "serves": {
+    "oidc-client": {
+      "authorization-path": "/protocol/openid-connect/auth",
+      "token-path": "/protocol/openid-connect/token",
+      "userinfo-path": "/protocol/openid-connect/userinfo",
+      "issuer": "${config:issuer}"
+    }
+  },
+  "receives": {
+    "oidc-client": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "oidc-client": "${dir:grants}"
+  },
+  "own-secrets": {
+    "admin": "${dir:state}/admin.secret"
+  },
+  "data": {
+    "consumers": {
+      "oidc-client": {
+        "class": "rebuildable",
+        "in": "postgres-database",
+        "why": "a consumer's client is made again from its declaration, with a new secret"
+      }
+    }
+  },
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's provider reaches Keycloak's admin API at, as a URL; empty is this machine's Keycloak on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "user": {
+      "type": "string",
+      "description": "The Keycloak administrator the module's provider signs in as; empty is admin.",
+      "trusted": true,
+      "default": ""
+    },
+    "realm": {
+      "type": "string",
+      "description": "The realm the module's provider makes its consumers' clients in; empty is master.",
+      "trusted": true,
+      "default": ""
+    },
+    "issuer": {
+      "type": "string",
+      "description": "The issuer Keycloak's tokens name and oidc consumers are told, as the realm's URL, such as https://keycloak.example.org/realms/Example; the operator's, with no default (novox/hq ADR 0112, ADR 0155).",
+      "trusted": true,
+      "required": true
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "consumers",
+      "type": "file",
+      "path": "${dir:state}/consumers.json",
+      "mode": "0600",
+      "template": "files/consumers.json"
+    },
+    {
+      "id": "admin-env",
+      "type": "file",
+      "path": "${dir:state}/admin.env",
+      "mode": "0600",
+      "template": "files/admin.env"
+    },
+    {
+      "id": "database-env",
+      "type": "file",
+      "path": "${dir:state}/database.env",
+      "mode": "0600",
+      "template": "files/database.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "keycloak"
+    },
+    {
+      "id": "hostname",
+      "type": "file",
+      "path": "${dir:state}/hostname.env",
+      "mode": "0644",
+      "template": "files/hostname.env"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "keycloak",
+      "image": "quay.io/keycloak/keycloak@sha256:ecd43971114b0c764f8a3288dddab73f98cb473daccc4feaffe4dc14adeaf866",
+      "network": "keycloak",
+      "args": [
+        "start-dev"
+      ],
+      "env": {
+        "KC_DB": "postgres",
+        "KC_HTTP_ENABLED": "true",
+        "KC_HEALTH_ENABLED": "true",
+        "KC_PROXY_HEADERS": "xforwarded"
+      },
+      "env-file": [
+        "${dir:state}/admin.env",
+        "${dir:state}/database.env",
+        "${dir:state}/hostname.env"
+      ],
+      "ports": [
+        "8080"
+      ],
+      "secrets-in-environment": "KC_DB_PASSWORD is convertible through a generated keycloak.conf (db-password=); KEYCLOAK_ADMIN_PASSWORD is env-only before Keycloak 26; not yet converted",
+      "restart-on": [
+        "hostname"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": [
+        "url",
+        "user",
+        "realm",
+        "issuer"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/keycloak-provider",
+        "binary": "keycloak-provider",
+        "loads": [
+          "keycloak-provider"
+        ],
+        "env": {
+          "MESH_KEYCLOAK_URL": "http://127.0.0.1:${port:8080}",
+          "MESH_KEYCLOAK_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_KEYCLOAK_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_KEYCLOAK_CONTAINER": "keycloak",
+          "MESH_CONSUMERS_FILE": "${dir:state}/consumers.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "state": [
+    "bound"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/lab/files/lab.env b/testdata/beside/mesh-catalog/modules/lab/files/lab.env
new file mode 100644
index 0000000..35aa1a2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/lab/files/lab.env
@@ -0,0 +1,3 @@
+MESH_LAB_FORGE=${config:forge}
+MESH_LAB_FORGE_BINDING=${dir:state}/package-registry.json
+MESH_LAB_FORGE_SECRET=${dir:state}/package-registry.secret
diff --git a/testdata/beside/mesh-catalog/modules/lab/module.json.captured b/testdata/beside/mesh-catalog/modules/lab/module.json.captured
new file mode 100644
index 0000000..ef82b87
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/lab/module.json.captured
@@ -0,0 +1,121 @@
+{
+  "module": "lab",
+  "version": "1",
+  "capabilities": [
+    "container-runtime",
+    "virtualisation"
+  ],
+  "requires": [
+    "npm-package-registry",
+    "go-toolchain",
+    "node-toolchain"
+  ],
+  "contributes": {
+    "npm-package-registry": {
+      "access": "read"
+    }
+  },
+  "binds": {
+    "npm-package-registry": "${dir:state}/package-registry.json"
+  },
+  "secrets": {
+    "npm-package-registry": "${dir:state}/package-registry.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "work",
+        "path": "${dir:work}",
+        "class": "cache",
+        "why": "the lab's runs, each thrown away"
+      }
+    ]
+  },
+    "config": {
+      "forge": {
+        "type": "string",
+        "description": "The forge the lab's machines take their packages from, as its address: the operator's, with no default (novox/hq ADR 0112).",
+        "trusted": true,
+        "required": true
+      }
+    },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "work",
+      "type": "directory",
+      "path": "/var/lib/mesh-lab-runs",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "runtime-env",
+      "type": "file",
+      "path": "${dir:state}/lab.env",
+      "mode": "0600",
+      "template": "files/lab.env"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    },
+    {
+      "id": "make",
+      "type": "package",
+      "package": "make"
+    },
+    {
+      "id": "python",
+      "type": "package",
+      "package": "python"
+    },
+    {
+      "id": "file",
+      "type": "package",
+      "package": "file"
+    },
+    {
+      "id": "iproute2",
+      "type": "package",
+      "package": "iproute2"
+    },
+    {
+      "id": "incus",
+      "type": "package",
+      "package": "incus"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_LAB_WORK": "${dir:work}",
+          "MESH_LAB_ENV_FILE": "${dir:state}/lab.env",
+          "MESH_LAB_FORGE_BINDING": "${dir:state}/package-registry.json",
+          "MESH_LAB_FORGE_SECRET": "${dir:state}/package-registry.secret"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/lemurs/files/config.toml b/testdata/beside/mesh-catalog/modules/lemurs/files/config.toml
new file mode 100644
index 0000000..6e5667d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/lemurs/files/config.toml
@@ -0,0 +1,369 @@
+# The login manager's configuration, written by the mesh (module lemurs, novox/hq ADR 0208). Replaced
+# at every push; change the module instead. The structure is lemurs 0.4's own (the shipped file, with
+# every option, as lemurs requires); what the mesh changes from it is marked "mesh:".
+#
+# The sessions offered are the executable files other modules place in the two scripts directories
+# below (/etc/lemurs/wms for X, /etc/lemurs/wayland for Wayland), one per session module. A file there
+# is named as the session is offered. Desktop entries that packages install (/usr/share/xsessions) are
+# not offered: they start the window manager bare, skipping the session's start (~/.xinitrc), which is
+# where the account's environment, the X resources and every module's session lines are.
+#
+# Lemurs configuration file.
+# Contains all the customization options of lemurs.
+#
+# Note: that as of now you need to have all options in the selected
+# configuration file. Otherwise Lemurs will not work.
+#
+# Colors:
+# ---------
+# There is a list of predefined colors. These include:
+# - black
+# - white
+# - (dark) gray
+# - (light) red
+# - (light) blue
+# - (light) green
+# - (light) magenta
+# - (light) cyan
+# - (light) yellow
+# - orange
+#
+# You can also utilize custom colors with hex color codes.
+# "#87CEEB" will create a Sky Blue color.
+#
+# Note: If the color wasn't recognized, it will default to white.
+# ---------
+#
+# Modifiers:
+# ---------
+# There is a number of modifiers you can use. These can be combined by
+# delimiting them with a comma (e.g. "bold,italic"). The modifiers are:
+# - bold
+# - dim
+# - italic
+# - underlined
+# - reverse
+# - crossed out
+# - hidden
+# ---------
+#
+
+# The tty which contains lemurs. This has to be mirrored in the lemurs.service
+tty = 2
+
+# Where to log the main lemurs control flow.
+main_log_path = "/var/log/lemurs.log"
+
+# Where to log to for the client. The Client is the Desktop Environment or
+# Window Manager for Xorg, the Compositor for Wayland and the Shell for TTY.
+client_log_path = "/var/log/lemurs.client.log"
+
+# At which point to point the cache. If you want to disable the cache globally
+# you can use `/dev/null`.
+cache_path = "/var/cache/lemurs"
+
+# Disable all logging. This is overwritten by the `--no-log` flag.
+do_log = true
+
+# The PAM service that should be used to login
+pam_service = "lemurs"
+
+# Path to system shell that gets used to execute linux commands. In almost all
+# cases, this should refer to a bash shell.
+system_shell = "/bin/sh"
+
+# Initial state of the `PATH` environment variable.
+initial_path = "/usr/local/sbin:/usr/local/bin:/usr/bin"
+
+# The type flag that will be appended to the shell that calls the session
+# environment. This may depend on your shell. Options:
+# - 'none'. Disables calling a login shell
+# - 'short'. Produces the `-l` flag. Supported by most shells.
+# - 'long'. This produces the `--login` flag and is suited for bash and zsh.
+shell_login_flag = "short"
+
+# Focus behaviour of fields when Lemurs is initially started
+#
+# Possible values:
+# - default: Initially focus on first non-cached value
+# - no-focus: No initial focus
+# - environment: Initially focus on the environment selector
+# - username: Initially focus on the username field
+# - password: Initially focus on the password field
+focus_behaviour = "default"
+
+# General settings for background style
+[background]
+
+# Control whether to render background widget or not
+show_background = false
+
+[background.style]
+# Allow to set the default background color for the login shell
+color = "black"
+# Settings for the background block's borders
+show_border = true
+border_color = "white"
+
+[power_controls]
+# The margin between hints
+hint_margin = 2
+
+# There are no additional entries by default
+entries = []
+
+# Example
+# Reboot to another os option
+#[[power_controls.entries]]
+## The text in the top-left to display how to reboot.
+#hint = "Reboot to OS"
+#
+## The color and modifiers of the hint in the top-left corner
+#hint_color = "dark gray"
+#hint_modifiers = ""
+#
+## The key used to reboot. Possibilities are F1 to F12.
+#key = "F3"
+## The command that is executed when the key is pressed
+#cmd = "efibootmgr -n0 && systemctl reboot -l"
+
+
+# If you want to remove the base_entries
+# base_entries = []
+
+# Shutdown option
+[[power_controls.base_entries]]
+# The text in the top-left to display how to shutdown.
+hint = "Shutdown"
+
+# The color and modifiers of the hint in the top-left corner
+hint_color = "dark gray"
+hint_modifiers = ""
+
+# The key used to shutdown. Possibilities are F1 to F12.
+key = "F1"
+# The command that is executed when the key is pressed
+cmd = "systemctl poweroff -l"
+
+# Reboot option
+[[power_controls.base_entries]]
+# The text in the top-left to display how to reboot.
+hint = "Reboot"
+
+# The color and modifiers of the hint in the top-left corner
+hint_color = "dark gray"
+hint_modifiers = ""
+
+# The key used to reboot. Possibilities are F1 to F12.
+key = "F2"
+# The command that is executed when the key is pressed
+cmd = "systemctl reboot -l"
+
+# Setting for the selector of the desktop environment you are using.
+[environment_switcher]
+# Terms:
+# ---------
+# Movers: indicators which show which direction one can move whilst selecting
+# the desktop environment
+# Selected: The currently selected desktop environment.
+# Neighbours: The adjacent desktop environment to the one current selected
+#
+# Visualisation:
+#
+#    <     i3       bspwm     awesome   >
+#
+#    ^      ^         ^          ^      ^
+#    |      |         |          |      |
+#  mover    |      selected      |    mover
+#           |                    |
+#       neighbour            neighbour
+# ---------
+#
+
+# Control the visibility of the switcher
+# Options:
+# - "visible" - Always show the switcher [default]
+# - "hidden"  - Always hide the switcher
+# - [key]     - F1-F12 to be able to toggle the visibility
+# mesh: hidden, as both workstations had it, but F3 shows it, so a second session can be chosen.
+switcher_visibility = "F3"
+
+# The text in the top-left to display how to toggle the switcher. The text
+# '%key%' will be replaced with the switcher_visibility key. This is not shown
+# if switcher_visibility is set to "visible" or "hidden".
+toggle_hint = "Switcher %key%"
+
+# The color and modifiers of the hint in the top-left corner
+toggle_hint_color = "dark gray"
+toggle_hint_modifiers = ""
+
+
+# Show an option for the TTY shell when logging in as one of the environments.
+# NOTE: it is always shown when no viable options are found.
+include_tty_shell = false
+
+# Remember the selected environment after logging in for the next time
+remember = true
+
+# Enables showing the movers
+show_movers = true
+
+# Mover's color and modifiers whilst the selector is unfocused
+mover_color = "dark gray"
+mover_modifiers = ""
+
+# Mover's color and modifiers whilst the selector is focused
+mover_color_focused = "orange"
+mover_modifiers_focused = "bold"
+
+# The characters used to display the movers. Suggestions are:
+# -  "<"  ">"
+# - "<-"  "->"
+# - "<<"  ">>"
+# -  "["  "]"
+left_mover = "<"
+right_mover = ">"
+
+# The margin between the movers and the neighbours or selected (depending on
+# `show_neighbours`)
+mover_margin = 1
+
+# Enables showing the neighbours
+show_neighbours = true
+
+# Neighbours' color and modifiers whilst the selector is unfocused
+neighbour_color = "dark gray"
+neighbour_modifiers = ""
+
+# Neighbours' color and modifiers whilst the selector is focused
+neighbour_color_focused = "gray"
+neighbour_modifiers_focused = ""
+
+# Margin between neighbours and selected
+neighbour_margin = 1
+
+# Selected's color and modifiers whilst the selector is unfocused
+selected_color = "gray"
+selected_modifiers = "underlined"
+
+# Selected's color and modifiers whilst the selector is focused
+selected_color_focused = "white"
+selected_modifiers_focused = "bold"
+
+# The length of the name of the desktop environment which is displayed.
+max_display_length = 8
+
+# The text used when no desktop environments are available
+no_envs_text = "No environments..."
+
+# The color and modifiers of the 'no desktop environments available text'
+# whilst the selector is unfocused
+no_envs_color = "white"
+no_envs_modifiers = ""
+
+# The color and modifiers of the 'no desktop environments available text'
+# whilst the selector is focused
+no_envs_color_focused = "red"
+no_envs_modifiers_focused = ""
+
+[username_field]
+
+# Remember the username for the next time after a successful login attempt.
+remember = true
+
+[username_field.style]
+# Enables showing a title
+show_title = true
+# The text used within the title
+title = "Login"
+
+# The title's color and modifiers whilst the username field is unfocused
+title_color = "white"
+content_color = "white"
+
+# The title's color and modifiers whilst the username field is focused
+title_color_focused = "orange"
+content_color_focused = "orange"
+
+# Enables showing the borders
+show_border = true
+# The borders' color and modifiers whilst the username field is unfocused
+border_color = "white"
+# The borders' color and modifiers whilst the username field is focused
+border_color_focused = "orange"
+
+# Constrain the width of the username field
+use_max_width = true
+# The constraint of the username field's width
+max_width = 48
+
+[password_field]
+
+# The character used for replacement when typing a password. Leave empty for no
+# feedback.
+# Note: Only one character is accepted.
+content_replacement_character = "*"
+
+[password_field.style]
+# Enables showing a title
+show_title = true
+# The text used within the title
+title = "Password"
+
+# The title's color and modifiers whilst the password field is unfocused
+title_color = "white"
+content_color = "white"
+
+# The title's color and modifiers whilst the password field is focused
+title_color_focused = "orange"
+content_color_focused = "orange"
+
+# Enables showing the borders
+show_border = true
+# The borders' color and modifiers whilst the password field is unfocused
+border_color = "white"
+# The borders' color and modifiers whilst the password field is focused
+border_color_focused = "orange"
+
+# Constrain the width of the password field
+use_max_width = true
+# The constraint of the password field's width
+max_width = 48
+
+[x11]
+# Where to log to for the XServer.
+xserver_log_path = "/var/log/lemurs.xorg.log"
+
+# The value of the `DISPLAY` environment variable for X11 sessions
+x11_display = ":1"
+
+# How many seconds to give the X server to start. To make it infinitely, put it
+# to 0.
+xserver_timeout_secs = 60
+
+# Where to find the X11 server binary
+# mesh: the server through the wrapper below, which adds -noreset.
+xserver_path = "/etc/lemurs/xserver"
+
+# Where to find the X11 xauth binary
+xauth_path = "/usr/bin/xauth"
+
+# Path to the directory where the startup scripts for the X11 sessions are found
+scripts_path = "/etc/lemurs/wms"
+
+# Path to the xsetup script that is needed for the environment setup of the
+# window manager.
+xsetup_path = "/etc/lemurs/xsetup.sh"
+
+# The directory to use for desktop entries X11 sessions.
+# mesh: an empty directory of the module's own, so no package's desktop entry is offered.
+xsessions_path = "/etc/lemurs/xsessions"
+
+[wayland]
+# Path to the directory where the startup scripts for the Wayland sessions are
+# found
+scripts_path = "/etc/lemurs/wayland"
+
+# The directory to use for desktop entries wayland sessions.
+# mesh: likewise for Wayland.
+wayland_sessions_path = "/etc/lemurs/wayland-sessions"
diff --git a/testdata/beside/mesh-catalog/modules/lemurs/files/xserver b/testdata/beside/mesh-catalog/modules/lemurs/files/xserver
new file mode 100755
index 0000000..5908f22
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/lemurs/files/xserver
@@ -0,0 +1,8 @@
+#!/bin/sh
+# The X server as lemurs starts it, written by the mesh (module lemurs). Replaced at every push.
+#
+# -noreset: without it, X resets whenever its last client disconnects, and a reset empties the
+# resource database. The session's start merges the X resources with xrdb before any long-lived
+# client is connected, so the server reset twice in the four seconds after a login and threw the
+# resources away: xterm fell back to the bitmap "fixed" font, without the mesh's face and colours.
+exec /usr/bin/X "$@" -noreset
diff --git a/testdata/beside/mesh-catalog/modules/lemurs/module.json.captured b/testdata/beside/mesh-catalog/modules/lemurs/module.json.captured
new file mode 100644
index 0000000..702a959
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/lemurs/module.json.captured
@@ -0,0 +1,84 @@
+{
+  "module": "lemurs",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager",
+    "seat"
+  ],
+  "claims": [
+    {
+      "name": "node-login-manager",
+      "scope": "node",
+      "serves": [
+        "sessions"
+      ]
+    }
+  ],
+  "tools": [
+    "lemurs_default_session",
+    "lemurs_logins"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "lemurs"
+    },
+    {
+      "id": "xserver",
+      "type": "file",
+      "path": "/etc/lemurs/xserver",
+      "mode": "0755",
+      "template": "files/xserver"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/lemurs/config.toml",
+      "mode": "0644",
+      "template": "files/config.toml"
+    },
+    {
+      "id": "xsessions",
+      "type": "directory",
+      "path": "/etc/lemurs/xsessions",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "wayland-sessions",
+      "type": "directory",
+      "path": "/etc/lemurs/wayland-sessions",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "lemurs.service",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/lemurs-tools",
+        "binary": "lemurs-tools",
+        "loads": [
+          "lemurs-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/letta/files/config.json b/testdata/beside/mesh-catalog/modules/letta/files/config.json
new file mode 100644
index 0000000..8ed994d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/letta/files/config.json
@@ -0,0 +1,3 @@
+{
+  "password": "${secret:server-password}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/letta/files/pgpass b/testdata/beside/mesh-catalog/modules/letta/files/pgpass
new file mode 100644
index 0000000..cd41b66
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/letta/files/pgpass
@@ -0,0 +1 @@
+*:*:*:${bound:postgres-database:as}:${secret:postgres-database}
diff --git a/testdata/beside/mesh-catalog/modules/letta/files/server.env b/testdata/beside/mesh-catalog/modules/letta/files/server.env
new file mode 100644
index 0000000..fe2acb9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/letta/files/server.env
@@ -0,0 +1,6 @@
+LETTA_PG_URI=postgresql://${bound:postgres-database:as}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
+PGPASSFILE=/run/secrets/pgpass
+LETTA_SERVER_PASSWORD=${secret:server-password}
+OPENAI_API_KEY=${secret:openai-api-key}
+SECURE=true
+TZ=Europe/Brussels
diff --git a/testdata/beside/mesh-catalog/modules/letta/files/start.sh b/testdata/beside/mesh-catalog/modules/letta/files/start.sh
new file mode 100644
index 0000000..9955592
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/letta/files/start.sh
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Generated by the mesh. Do not edit: module letta writes this file and replaces it at every push.
+#
+# letta 0.6.8 prints secrets it is given to its log (novox/hq issue 268):
+#   letta/server/rest_api/app.py prints its server password when it starts in secure mode;
+#   startup.sh, alembic/env.py and letta/server/server.py print LETTA_PG_URI whole.
+# The URI carries no password (libpq reads it from PGPASSFILE), and the one print of the server
+# password is rewritten before the server starts. Either one failing refuses the start: a letta
+# that does not start says why here, and one that leaks says nothing.
+set -e
+app=/app/letta/server/rest_api/app.py
+sed -i 's/Using secure mode with password: {random_password}/Using secure mode (the password is not printed)/' "$app"
+if grep -q 'print(.*random_password' "$app"; then
+  echo "letta: $app still prints the server password; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+case "$LETTA_PG_URI" in
+  *://*:*@*)
+    echo "letta: LETTA_PG_URI carries a password, and letta prints that URI; not starting (novox/hq issue 268)" >&2
+    exit 1
+    ;;
+esac
+exec ./letta/server/startup.sh
diff --git a/testdata/beside/mesh-catalog/modules/letta/module.json.captured b/testdata/beside/mesh-catalog/modules/letta/module.json.captured
new file mode 100644
index 0000000..de7baf6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/letta/module.json.captured
@@ -0,0 +1,156 @@
+{
+  "module": "letta",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "letta",
+      "extensions": [
+        "vector"
+      ]
+    },
+    "route": {
+      "label": "letta",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "own-secrets": {
+    "server-password": {
+      "path": "${dir:state}/server-password.secret",
+      "taken": "at-start"
+    },
+    "openai-api-key": {
+      "path": "${dir:state}/openai-api-key.secret",
+      "taken": "at-start",
+      "issued-by": "outside"
+    }
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8283,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Letta agent server REST API and web UI, password-protected (--secure); a public name is the route's"
+    }
+  ],
+  "config": {
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Letta at, as a URL; unset, the code falls back to its environment, else this machine's Letta on port 8283.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "pgpass",
+      "type": "file",
+      "path": "${dir:state}/pgpass",
+      "mode": "0600",
+      "template": "files/pgpass"
+    },
+    {
+      "id": "start",
+      "type": "file",
+      "path": "${dir:state}/start.sh",
+      "mode": "0644",
+      "template": "files/start.sh"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "letta"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "letta",
+      "image": "letta/letta@sha256:bfd1e49ce45b9a208c941e832c1d1d194017ff210a3784b0ca6c323aed767a29",
+      "network": "letta",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "8283"
+      ],
+      "volumes": [
+        "${dir:state}/pgpass:/run/secrets/pgpass:ro",
+        "${dir:state}/start.sh:/run/letta/start.sh:ro"
+      ],
+      "args": [
+        "sh",
+        "/run/letta/start.sh"
+      ],
+      "secrets-in-environment": "letta 0.6.x reads its settings from the environment only (pydantic settings, no secrets_dir or _FILE twin): LETTA_SERVER_PASSWORD and OPENAI_API_KEY have no file source. The database password is not here: LETTA_PG_URI, which letta prints at start, names no password, and libpq reads it from the mounted pgpass file (PGPASSFILE)"
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["url"],
+      "protected": ["password"]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_LETTA_URL": "http://127.0.0.1:${port:8283}",
+          "MESH_LETTA_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/local-model-consumer/files/openai.env b/testdata/beside/mesh-catalog/modules/local-model-consumer/files/openai.env
new file mode 100644
index 0000000..9aca396
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/local-model-consumer/files/openai.env
@@ -0,0 +1,3 @@
+OPENAI_BASE_URL=http://${bound:model-access:at}:${bound:model-access:port}/v1
+OPENAI_MODEL=${bound:model-access:model}
+OPENAI_API_KEY=local
diff --git a/testdata/beside/mesh-catalog/modules/local-model-consumer/module.json.captured b/testdata/beside/mesh-catalog/modules/local-model-consumer/module.json.captured
new file mode 100644
index 0000000..7300209
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/local-model-consumer/module.json.captured
@@ -0,0 +1,42 @@
+{
+  "module": "local-model-consumer",
+  "version": "1",
+  "slug": "local",
+  "requires": [
+    "model-access"
+  ],
+  "binds": {
+    "model-access": "${dir:state}/model.json"
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "openai-env",
+      "type": "file",
+      "path": "${dir:config}/openai.env",
+      "mode": "0600",
+      "template": "files/openai.env"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/localization/files/locale.conf b/testdata/beside/mesh-catalog/modules/localization/files/locale.conf
new file mode 100644
index 0000000..fe405b5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/localization/files/locale.conf
@@ -0,0 +1,3 @@
+# The mesh's (module localization, novox/hq to-be 42): the system locale. Written whole at every
+# push; an edit here is overwritten. Read at the next login.
+LANG=en_US.UTF-8
diff --git a/testdata/beside/mesh-catalog/modules/localization/files/vconsole.conf b/testdata/beside/mesh-catalog/modules/localization/files/vconsole.conf
new file mode 100644
index 0000000..88d96f6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/localization/files/vconsole.conf
@@ -0,0 +1,3 @@
+# The mesh's (module localization, novox/hq to-be 42): the console keymap. Written whole at every
+# push; an edit here is overwritten. Read at the next boot.
+KEYMAP=us
diff --git a/testdata/beside/mesh-catalog/modules/localization/module.json.captured b/testdata/beside/mesh-catalog/modules/localization/module.json.captured
new file mode 100644
index 0000000..0974ed3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/localization/module.json.captured
@@ -0,0 +1,61 @@
+{
+  "module": "localization",
+  "version": "1",
+  "capabilities": [
+    "service-manager"
+  ],
+  "tools": [
+    "localization_get",
+    "localization_time_zone",
+    "localization_locales",
+    "localization_keymaps"
+  ],
+  "resources": [
+    {
+      "id": "locale",
+      "type": "file",
+      "path": "/etc/locale.conf",
+      "mode": "0644",
+      "template": "files/locale.conf"
+    },
+    {
+      "id": "keymap",
+      "type": "file",
+      "path": "/etc/vconsole.conf",
+      "mode": "0644",
+      "template": "files/vconsole.conf"
+    },
+    {
+      "id": "time-zone",
+      "type": "process",
+      "name": "localization-time-zone",
+      "artifact": "tools",
+      "run": [
+        "./localization-tools",
+        "set-time-zone",
+        "Europe/Brussels"
+      ],
+      "run-once": true
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/localization-tools",
+        "binary": "localization-tools",
+        "loads": [
+          "localization-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/logrotate/files/logrotate.conf b/testdata/beside/mesh-catalog/modules/logrotate/files/logrotate.conf
new file mode 100644
index 0000000..d646137
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/logrotate/files/logrotate.conf
@@ -0,0 +1,32 @@
+# The mesh's (module logrotate, novox/hq to-be 42): the base configuration every rotation inherits.
+# Written whole at every push; an edit here is overwritten. Each package's own rules are in
+# /etc/logrotate.d and stay the packages'.
+
+# Weekly, four weeks kept, a new empty log created after each rotation.
+weekly
+rotate 4
+create
+
+# Rotated logs are compressed, one rotation late, so a program still writing to the file it had open
+# loses nothing to the compression.
+compress
+delaycompress
+
+# A package's replaced configuration is never read as a rule.
+tabooext + .pacorig .pacnew .pacsave
+
+include /etc/logrotate.d
+
+/var/log/wtmp {
+    monthly
+    create 0664 root utmp
+    minsize 1M
+    rotate 1
+}
+
+/var/log/btmp {
+    missingok
+    monthly
+    create 0600 root utmp
+    rotate 1
+}
diff --git a/testdata/beside/mesh-catalog/modules/logrotate/module.json.captured b/testdata/beside/mesh-catalog/modules/logrotate/module.json.captured
new file mode 100644
index 0000000..8318451
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/logrotate/module.json.captured
@@ -0,0 +1,58 @@
+{
+  "module": "logrotate",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "logrotate_status",
+    "logrotate_configs",
+    "logrotate_check",
+    "logrotate_big_logs",
+    "logrotate_force",
+    "logrotate_journal_usage",
+    "logrotate_journal_vacuum"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "logrotate"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/logrotate.conf",
+      "mode": "0644",
+      "template": "files/logrotate.conf"
+    },
+    {
+      "id": "timer",
+      "type": "service",
+      "unit": "logrotate.timer",
+      "state": "running",
+      "boot": "enabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/logrotate-tools",
+        "binary": "logrotate-tools",
+        "loads": [
+          "logrotate-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mailu/files/admin.env b/testdata/beside/mesh-catalog/modules/mailu/files/admin.env
new file mode 100644
index 0000000..f066bb5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/files/admin.env
@@ -0,0 +1,2 @@
+INITIAL_ADMIN_PW=${secret:admin}
+API_TOKEN=${secret:api-token}
diff --git a/testdata/beside/mesh-catalog/modules/mailu/files/config.json b/testdata/beside/mesh-catalog/modules/mailu/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/mailu/files/database.env b/testdata/beside/mesh-catalog/modules/mailu/files/database.env
new file mode 100644
index 0000000..ba70d3d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/files/database.env
@@ -0,0 +1,5 @@
+DB_FLAVOR=postgresql
+DB_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}
+DB_USER=${bound:postgres-database:as}
+DB_NAME=${bound:postgres-database:as}
+DB_PW=${secret:postgres-database}
diff --git a/testdata/beside/mesh-catalog/modules/mailu/files/mailu.env b/testdata/beside/mesh-catalog/modules/mailu/files/mailu.env
new file mode 100644
index 0000000..2c977d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/files/mailu.env
@@ -0,0 +1,78 @@
+ADMIN_ADDRESS=mailu-admin
+ANTISPAM_ADDRESS=mailu-antispam
+ANTIVIRUS_ADDRESS=mailu-antivirus
+IMAP_ADDRESS=mailu-imap
+SMTP_ADDRESS=mailu-smtp
+FRONT_ADDRESS=mailu-front
+WEBMAIL_ADDRESS=mailu-webmail
+WEBDAV_ADDRESS=mailu-webdav
+REDIS_ADDRESS=mailu-redis
+PORTS=25,80,443,465,993,995,4190,110,143,587
+DOMAIN=${config:domain}
+HOSTNAMES=${bound:route:name-web}
+POSTMASTER=admin
+SITENAME=${config:sitename}
+WEBSITE=${config:website}
+TLS_FLAVOR=letsencrypt
+SUBNET=192.168.203.0/24
+COMPOSE_PROJECT_NAME=mailu
+ANTIVIRUS=clamav
+WEBMAIL=roundcube
+WEBDAV=radicale
+FETCHMAIL_ENABLED=True
+FETCHMAIL_DELAY=600
+ADMIN=true
+WEB_ADMIN=/admin
+WEB_WEBMAIL=/webmail
+WEBROOT_REDIRECT=/webmail
+API=true
+WEB_API=/api
+AUTH_RATELIMIT_IP=6000/hour
+AUTH_RATELIMIT_USER=1000/day
+CREDENTIAL_ROUNDS=12
+PASSWORD_SCHEME=PBKDF2
+DISABLE_STATISTICS=True
+MESSAGE_SIZE_LIMIT=50000000
+MESSAGE_RATELIMIT=200/day
+RECIPIENT_DELIMITER=+
+POSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128
+RELAYNETS=
+RELAYHOST=
+REJECT_UNLISTED_RECIPIENT=
+DB_FLAVOR=postgresql
+INITIAL_ADMIN_ACCOUNT=admin
+INITIAL_ADMIN_DOMAIN=${config:domain}
+INITIAL_ADMIN_MODE=ifmissing
+SMTP_PORT=25
+SMTPS_PORT=465
+SUBMISSION_PORT=587
+POP3_PORT=110
+POP3S_PORT=995
+IMAP_PORT=143
+IMAPS_PORT=993
+HTTP_PORT=7080
+HTTPS_PORT=7443
+AUTOMX_PORT=4243
+AMX_SMTP_ADDRESS=${bound:route:name-web}
+AMX_SMTP_PORT=587
+AMX_IMAP_ADDRESS=${bound:route:name-web}
+AMX_IMAP_PORT=143
+AMX_MAIL_DOMAINS=${config:domain}
+DMARC_RUA=admin
+DMARC_RUF=admin
+LETSENCRYPT_SHORTCHAIN=True
+TZ=Etc/UTC
+LOG_LEVEL=INFO
+WELCOME=false
+REAL_IP_HEADER=X-Real-IP
+REAL_IP_FROM=${config:proxy-address}
+COMPRESSION=
+COMPRESS_LEVEL=
+COMPRESSION_LEVEL=
+BIND_ADDRESS4=127.0.0.1
+BIND_ADDRESS6=::1
+MAILU_VERSION=1.9
+DOCKER_ORG=mailu
+DOCKER_PREFIX=
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
diff --git a/testdata/beside/mesh-catalog/modules/mailu/files/secret.env b/testdata/beside/mesh-catalog/modules/mailu/files/secret.env
new file mode 100644
index 0000000..c6f6b66
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/files/secret.env
@@ -0,0 +1 @@
+SECRET_KEY=${secret:secret-key}
diff --git a/testdata/beside/mesh-catalog/modules/mailu/module.json.captured b/testdata/beside/mesh-catalog/modules/mailu/module.json.captured
new file mode 100644
index 0000000..568be14
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mailu/module.json.captured
@@ -0,0 +1,772 @@
+{
+  "module": "mailu",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "people's mail: any change to how its containers are declared recreates them together in one send, and the mail is down for everyone until they are up again — a person chooses the moment (hq ADR 0242, issue 295)"
+  },
+  "unhealthy": {
+    "severity": "urgent",
+    "why": "while mailu is broken, mail is refused or stuck for everyone with a mailbox here (hq ADR 0355, issue 687)"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "mailu"
+    },
+    "route": {
+      "web": {
+        "label": "mail",
+        "endpoint": "web-tls",
+        "scheme": "https",
+        "insecure": true
+      },
+      "acme": {
+        "label": "mail",
+        "path": "/.well-known/acme-challenge",
+        "endpoint": "web",
+        "priority": 100
+      },
+      "autoconfig": {
+        "label": "autoconfig",
+        "endpoint": "autoconfig"
+      },
+      "autodiscover": {
+        "label": "autodiscover",
+        "endpoint": "autoconfig"
+      },
+      "automx": {
+        "label": "automx",
+        "endpoint": "autoconfig"
+      }
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "secret": {
+      "secret-key": "${dir:state}/secret-key.secret",
+      "admin": "${dir:state}/admin.secret",
+      "api-token": "${dir:state}/api-token.secret"
+    }
+  },
+  "tools": [
+    "mailu_list_users",
+    "mailu_create_user",
+    "mailu_change_password",
+    "mailu_delete_user",
+    "mailu_list_aliases",
+    "mailu_create_alias",
+    "mailu_delete_alias",
+    "mailu_list_domains",
+    "mailu_read_mail",
+    "mailu_search_mail",
+    "mailu_health"
+  ],
+  "emits": [
+    "user.created",
+    "user.deleted",
+    "alias.created",
+    "alias.deleted"
+  ],
+  "listens": [
+    {
+      "name": "smtp",
+      "port": 25,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "mail from other mail servers",
+      "fixed": true
+    },
+    {
+      "name": "pop3",
+      "port": 110,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "POP3, kept at parity with the predecessor; pruning legacy protocols is its own deliberate change",
+      "fixed": true
+    },
+    {
+      "name": "imap",
+      "port": 143,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "IMAP with STARTTLS, kept at parity",
+      "fixed": true
+    },
+    {
+      "name": "smtps",
+      "port": 465,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "submission over TLS",
+      "fixed": true
+    },
+    {
+      "name": "submission",
+      "port": 587,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "submission; also what the smtp provision serves consumers",
+      "fixed": true
+    },
+    {
+      "name": "imaps",
+      "port": 993,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "IMAP over TLS",
+      "fixed": true
+    },
+    {
+      "name": "pop3s",
+      "port": 995,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "POP3 over TLS, kept at parity",
+      "fixed": true
+    },
+    {
+      "name": "web",
+      "port": 7080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here — everything else 301s to https and would loop a proxy"
+    },
+    {
+      "name": "web-tls",
+      "port": 7443,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the web front over its own TLS (admin, webmail, API); its public name is a route grant reaching it here"
+    },
+    {
+      "name": "autoconfig",
+      "port": 4243,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "automx: mail client autoconfiguration; the autoconfig, autodiscover and automx names are route grants reaching it here"
+    },
+    {
+      "name": "admin-api",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "the admin API, which this module's own code reaches on loopback from the node's runtime now that it runs outside the mailu network"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "mail",
+        "path": "${dir:data-mail}",
+        "class": "valuable",
+        "why": "every mailbox"
+      },
+      {
+        "id": "dkim",
+        "path": "${dir:data-dkim}",
+        "class": "valuable",
+        "why": "the domain's signing keys; a new one means a new DNS record"
+      },
+      {
+        "id": "data",
+        "path": "${dir:data-data}",
+        "class": "valuable",
+        "why": "the server's own data"
+      },
+      {
+        "id": "dav",
+        "path": "${dir:data-dav}",
+        "class": "valuable",
+        "why": "calendars and contacts"
+      },
+      {
+        "id": "webmail",
+        "path": "${dir:data-webmail}",
+        "class": "valuable",
+        "why": "the webmail's own data: its users' settings and address books"
+      },
+      {
+        "id": "queue",
+        "path": "${dir:data-mailqueue}",
+        "class": "valuable",
+        "why": "mail accepted and not yet delivered, kept nowhere else"
+      },
+      {
+        "id": "filter",
+        "path": "${dir:data-filter}",
+        "class": "rebuildable",
+        "why": "the spam filter's learned statistics; it learns again"
+      },
+      {
+        "id": "certs",
+        "path": "${dir:data-certs}",
+        "class": "rebuildable",
+        "why": "certificates, issued again"
+      },
+      {
+        "id": "automx",
+        "path": "${dir:data-automx}",
+        "class": "rebuildable",
+        "why": "client autoconfiguration, written again"
+      },
+      {
+        "id": "fetchmail",
+        "path": "${dir:data-fetchmail}",
+        "class": "rebuildable",
+        "why": "which remote messages were fetched; lost, some are fetched twice"
+      },
+      {
+        "id": "clamav",
+        "path": "${dir:data-clamav}",
+        "class": "cache",
+        "why": "virus signatures, downloaded again"
+      },
+      {
+        "id": "redis",
+        "path": "${dir:data-redis}",
+        "class": "cache",
+        "why": "the filter's working set"
+      }
+    ],
+    "consumers": {
+      "smtp": {
+        "class": "valuable",
+        "in": "mail",
+        "why": "a consumer's mailbox holds the only copy of its mail"
+      }
+    }
+  },
+  "config": {
+    "domain": {
+      "type": "string",
+      "description": "The mail domain Mailu serves, such as example.org: its first mail domain, the postmaster's and the one consumers send as; the operator's, with no default (novox/hq ADR 0112).",
+      "trusted": true,
+      "required": true
+    },
+    "proxy-address": {
+      "type": "string",
+      "description": "The address of the reverse proxy in front of Mailu, whose X-Real-IP header Mailu believes; the operator's, with no default.",
+      "trusted": true,
+      "required": true
+    },
+    "sitename": {
+      "type": "string",
+      "description": "The name Mailu's web pages show for the mail service; the operator's, with no default.",
+      "trusted": true,
+      "required": true
+    },
+    "website": {
+      "type": "string",
+      "description": "The address of the website Mailu's web pages link to, as a URL; the operator's, with no default.",
+      "trusted": true,
+      "required": true
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Mailu's API at, as a URL; empty leaves them to MESH_MAILU_URL.",
+      "trusted": true,
+      "default": ""
+    },
+    "container": {
+      "type": "string",
+      "description": "The name of the container holding Mailu's mailboxes, which the module's tools read mail in; empty is mailu-imap.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-automx",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "config-env",
+      "type": "file",
+      "path": "${dir:state}/mailu.env",
+      "mode": "0644",
+      "template": "files/mailu.env"
+    },
+    {
+      "id": "secret-env",
+      "type": "file",
+      "path": "${dir:state}/secret.env",
+      "mode": "0600",
+      "template": "files/secret.env"
+    },
+    {
+      "id": "database-env",
+      "type": "file",
+      "path": "${dir:state}/database.env",
+      "mode": "0600",
+      "template": "files/database.env"
+    },
+    {
+      "id": "admin-env",
+      "type": "file",
+      "path": "${dir:state}/admin.env",
+      "mode": "0600",
+      "template": "files/admin.env"
+    },
+    {
+      "id": "data-certs",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-data",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-dkim",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-mail",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-mailqueue",
+      "type": "directory",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "data-filter",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-clamav",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-redis",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-webmail",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-dav",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-fetchmail",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-overrides-nginx",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-overrides-dovecot",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-overrides-postfix",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-overrides-rspamd",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data-overrides-roundcube",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "mailu"
+    },
+    {
+      "id": "resolver",
+      "type": "container",
+      "name": "mailu-resolver",
+      "image": "ghcr.io/mailu/unbound@sha256:2c037bc5c988b5c0ab7e1b6e6ffa762e14ba1e45c96281ac87f8b9be8eee8b6e",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
+      ],
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "ip": "192.168.203.254"
+    },
+    {
+      "id": "redis",
+      "type": "container",
+      "name": "mailu-redis",
+      "image": "redis@sha256:4bed291aa5efb9f0d77b76ff7d4ab71eee410962965d052552db1fb80576431d",
+      "network": "mailu",
+      "volumes": [
+        "${dir:data-redis}:/data"
+      ]
+    },
+    {
+      "id": "admin",
+      "type": "container",
+      "name": "mailu-admin",
+      "image": "ghcr.io/mailu/admin@sha256:6dbfdadc4a9590dcb7652357b505200115b689b74008653bbf369e4599a3be5a",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "ports": [
+        "8080"
+      ],
+      "env-file": [
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env",
+        "${dir:state}/database.env",
+        "${dir:state}/admin.env"
+      ],
+      "volumes": [
+        "${dir:data-data}:/data",
+        "${dir:data-dkim}:/dkim"
+      ],
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified"
+    },
+    {
+      "id": "imap",
+      "type": "container",
+      "name": "mailu-imap",
+      "image": "ghcr.io/mailu/dovecot@sha256:7f0ed5db996fbdc00adc5c5e38a08492e04f7eb4a9fbd66a03aa9a28ddf23993",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env"
+      ],
+      "volumes": [
+        "${dir:data-mail}:/mail",
+        "${dir:data-overrides-dovecot}:/overrides:ro"
+      ],
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "smtp",
+      "type": "container",
+      "name": "mailu-smtp",
+      "image": "ghcr.io/mailu/postfix@sha256:e2e49f39e53b80eac9e7a2f18d9df11edeb4914fd62dbba89b3155e8e034f62e",
+      "health": {
+        "kind": "tool",
+        "tool": "mailu_health",
+        "interval": "60s",
+        "timeout": "30s",
+        "looks": 3,
+        "grace": "120s"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env"
+      ],
+      "volumes": [
+        "${dir:data-mailqueue}:/queue",
+        "${dir:data-overrides-postfix}:/overrides:ro"
+      ],
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "antispam",
+      "type": "container",
+      "name": "mailu-antispam",
+      "image": "ghcr.io/mailu/rspamd@sha256:ff3666d8a61f17d309c5c6f6bcf4d40470b82299ca706ac650301175bb1a079d",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env"
+      ],
+      "volumes": [
+        "${dir:data-filter}:/var/lib/rspamd",
+        "${dir:data-overrides-rspamd}:/etc/rspamd/override.d:ro"
+      ],
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "antivirus",
+      "type": "container",
+      "name": "mailu-antivirus",
+      "image": "clamav/clamav-debian@sha256:b12ef8fefddbba7d88de59bea8a32622f365339154adf02d38fd089112e6745a",
+      "network": "mailu",
+      "volumes": [
+        "${dir:data-clamav}:/var/lib/clamav"
+      ],
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "webmail",
+      "type": "container",
+      "name": "mailu-webmail",
+      "image": "ghcr.io/mailu/webmail@sha256:bdbee44cdb05a4658f0e3b62cc448de55ca8f8aea172279fda594826144c04f6",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
+      ],
+      "volumes": [
+        "${dir:data-webmail}:/data",
+        "${dir:data-overrides-roundcube}:/overrides:ro"
+      ],
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "webdav",
+      "type": "container",
+      "name": "mailu-webdav",
+      "image": "ghcr.io/mailu/radicale@sha256:690ed6edf189dfef100a5a8b37c195ebf5d9241ac5f23f2f44b8b7b75726e3de",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
+      ],
+      "volumes": [
+        "${dir:data-dav}:/data"
+      ],
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "fetchmail",
+      "type": "container",
+      "name": "mailu-fetchmail",
+      "image": "ghcr.io/mailu/fetchmail@sha256:f881c8412d3bbe73d638469b48321558d6403a9d45bfa043c1e52c752103d42d",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env",
+        "${dir:state}/secret.env"
+      ],
+      "volumes": [
+        "${dir:data-fetchmail}:/data"
+      ],
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "dns": [
+        "192.168.203.254"
+      ]
+    },
+    {
+      "id": "front",
+      "type": "container",
+      "name": "mailu-front",
+      "image": "ghcr.io/mailu/nginx@sha256:36f98897cd1bc9d27628bbb4e04bdf60147af2ec7507d6da77f002c4f256896d",
+      "health": {
+        "kind": "exec",
+        "command": "curl -m3 -skfLo /dev/null http://127.0.0.1:10204/health && kill -0 $(cat /run/dovecot/master.pid) && python3 -c \"import smtplib; s = smtplib.SMTP('127.0.0.1', 25, timeout=5); s.ehlo('health'); s.quit()\" && openssl x509 -checkend 1209600 -noout -in /certs/letsencrypt/live/mailu/nginx-chain.pem",
+        "interval": "60s",
+        "timeout": "15s",
+        "looks": 3,
+        "grace": "120s"
+      },
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env"
+      ],
+      "ports": [
+        "25",
+        "110",
+        "143",
+        "465",
+        "587",
+        "993",
+        "995",
+        "7080:80",
+        "7443:443"
+      ],
+      "volumes": [
+        "${dir:data-certs}:/certs",
+        "${dir:data-overrides-nginx}:/overrides:ro"
+      ],
+      "dns": [
+        "192.168.203.254"
+      ],
+      "logging": "journald"
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "takes-config": ["domain", "proxy-address", "sitename", "website", "url", "container"],
+      "merge": "json"
+    },
+    {
+      "id": "automx",
+      "type": "container",
+      "name": "mailu-automx",
+      "artifact": "automx",
+      "network": "mailu",
+      "env-file": [
+        "${dir:state}/mailu.env"
+      ],
+      "ports": [
+        "4243"
+      ],
+      "volumes": [
+        "${dir:data-automx}:/data"
+      ]
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "PYTHON_BASE",
+        "image": "python@sha256:25f3cfeaceca14921366af4d1240b56457ef46273bdb508c7b0e8f469f6fd228"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MAILU_URL": "http://127.0.0.1:${port:8080}/api/v1",
+          "MESH_MAILU_API_KEY_FILE": "${dir:state}/api-token.secret",
+          "MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
+          "MESH_MAILU_SMTP_CONTAINER": "mailu-smtp",
+          "MESH_MAILU_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
+      },
+      {
+        "name": "automx",
+        "kind": "image",
+        "from": "automx/Dockerfile"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "provides": [
+    {
+      "name": "smtp",
+      "scope": "mesh",
+      "identity": {
+        "max": 64,
+        "in": "a mailbox's local part"
+      }
+    }
+  ],
+  "serves": {
+    "smtp": {
+      "port": 587,
+      "domain": "${config:domain}"
+    }
+  },
+  "receives": {
+    "smtp": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "smtp": "${dir:grants}"
+  },
+  "jails": [
+    {
+      "name": "mailu-front",
+      "failregex": "^.*(?:imap|pop3|submission|managesieve)-login: .*\\(auth failed, \\d+ attempts(?: in \\d+ secs)?\\):.*rip=<HOST>(?:,|$)\n            ^.*client login failed: \"AUTH not supported\" while in http auth state, client: <HOST>, server: \\S+:25,",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=mailu-front\nport = smtp,submission,submissions,imap,imaps,pop3,pop3s\nmaxretry = 3\nfindtime = 1d\nbantime = 1d"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/marrytts/module.json.captured b/testdata/beside/mesh-catalog/modules/marrytts/module.json.captured
new file mode 100644
index 0000000..ed242aa
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/marrytts/module.json.captured
@@ -0,0 +1,37 @@
+{
+  "module": "marrytts",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "api",
+      "port": 59125,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the MaryTTS text-to-speech HTTP API and web interface"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "marrytts",
+      "image": "synesthesiam/marytts@sha256:45970ecb3e21a2981c66c60563a70cf00be8e95c02565e7d74b3a73dcec7db2c",
+      "env": {
+        "TZ": "Europe/Brussels"
+      },
+      "ports": [
+        "59125"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/matrix/files/conduit.toml b/testdata/beside/mesh-catalog/modules/matrix/files/conduit.toml
new file mode 100644
index 0000000..9b72401
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/matrix/files/conduit.toml
@@ -0,0 +1,15 @@
+# Written by the mesh (modules/matrix). Conduit reads this file (CONDUIT_CONFIG); nothing comes
+# from the environment. server_name is the homeserver's permanent identity: every user id, room id
+# and signature in the database carries it, so it is the name this module is served under
+# (${bound:route:name-homeserver}) and never changes once a database exists.
+[global]
+server_name = "${bound:route:name-homeserver}"
+database_backend = "rocksdb"
+database_path = "/var/lib/matrix-conduit/"
+address = "0.0.0.0"
+port = 6167
+max_request_size = 20000000
+allow_registration = false
+allow_federation = true
+allow_check_for_updates = true
+trusted_servers = ["matrix.org"]
diff --git a/testdata/beside/mesh-catalog/modules/matrix/files/element.json b/testdata/beside/mesh-catalog/modules/matrix/files/element.json
new file mode 100644
index 0000000..305a89f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/matrix/files/element.json
@@ -0,0 +1,53 @@
+{
+  "default_server_name": "${bound:route:name-homeserver}",
+  "default_server_config": {
+    "m.homeserver": {
+      "base_url": "https://${bound:route:name-homeserver}"
+    },
+    "m.identity_server": {
+      "base_url": "https://vector.im"
+    }
+  },
+  "brand": "Element",
+  "integrations_ui_url": "https://scalar.vector.im/",
+  "integrations_rest_url": "https://scalar.vector.im/api",
+  "integrations_widgets_urls": [
+    "https://scalar.vector.im/_matrix/integrations/v1",
+    "https://scalar.vector.im/api",
+    "https://scalar-staging.vector.im/_matrix/integrations/v1",
+    "https://scalar-staging.vector.im/api",
+    "https://scalar-staging.riot.im/scalar/api"
+  ],
+  "bug_report_endpoint_url": "https://element.io/bugreports/submit",
+  "uisi_autorageshake_app": "element-auto-uisi",
+  "show_labs_settings": true,
+  "room_directory": {
+    "servers": [
+      "${bound:route:name-homeserver}",
+      "matrix.org",
+      "gitter.im",
+      "libera.chat"
+    ]
+  },
+  "enable_presence_by_hs_url": {
+    "https://matrix.org": false,
+    "https://matrix-client.matrix.org": false
+  },
+  "terms_and_conditions_links": [
+    {
+      "url": "https://element.io/privacy",
+      "text": "Privacy Policy"
+    },
+    {
+      "url": "https://element.io/cookie-policy",
+      "text": "Cookie Policy"
+    }
+  ],
+  "features": {
+    "feature_video_rooms": true,
+    "feature_rust_crypto": true
+  },
+  "element_call": {
+    "url": "https://call.element.dev"
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/matrix/module.json.captured b/testdata/beside/mesh-catalog/modules/matrix/module.json.captured
new file mode 100644
index 0000000..170719c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/matrix/module.json.captured
@@ -0,0 +1,257 @@
+{
+  "module": "matrix",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "client",
+      "port": 6167,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Conduit's client-server and federation APIs over plain HTTP. Both arrive through the route on 443: Conduit answers /.well-known/matrix/server with <its name>:443, so other homeservers federate through the proxy and nothing needs the traditional 8448"
+    },
+    {
+      "name": "web",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Element Web, the static browser client, served by the image's nginx; reached through its route"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "homeserver": {
+        "label": "matrix",
+        "endpoint": "client"
+      },
+      "element": {
+        "label": "element",
+        "endpoint": "web"
+      }
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "db",
+        "path": "${dir:db}",
+        "class": "valuable",
+        "why": "every room, message and account"
+      }
+    ]
+  },
+  "config": {
+    "default_server_name": {
+      "type": "string",
+      "description": "Element's default_server_name setting of config.json: the homeserver Element signs in to by default, by name; the file's default is the module's own route.",
+      "trusted": true,
+      "default": "${bound:route:name-homeserver}"
+    },
+    "default_server_config": {
+      "type": "object",
+      "description": "Element's default_server_config setting of config.json: the homeserver and identity server Element uses by default, by URL.",
+      "trusted": true,
+      "default": {
+        "m.homeserver": {
+          "base_url": "https://${bound:route:name-homeserver}"
+        },
+        "m.identity_server": {
+          "base_url": "https://vector.im"
+        }
+      }
+    },
+    "brand": {
+      "type": "string",
+      "description": "Element's brand setting of config.json: the name Element shows itself as.",
+      "trusted": true,
+      "default": "Element"
+    },
+    "integrations_ui_url": {
+      "type": "string",
+      "description": "Element's integrations_ui_url setting of config.json: the integration manager's page, a URL.",
+      "trusted": true,
+      "default": "https://scalar.vector.im/"
+    },
+    "integrations_rest_url": {
+      "type": "string",
+      "description": "Element's integrations_rest_url setting of config.json: the integration manager's API, a URL.",
+      "trusted": true,
+      "default": "https://scalar.vector.im/api"
+    },
+    "integrations_widgets_urls": {
+      "type": "list",
+      "description": "Element's integrations_widgets_urls setting of config.json: the URLs whose widgets Element trusts as the integration manager's.",
+      "trusted": true,
+      "default": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+      ]
+    },
+    "bug_report_endpoint_url": {
+      "type": "string",
+      "description": "Element's bug_report_endpoint_url setting of config.json: where Element sends a bug report, a URL; its default here is empty, and the file's own value (Element's, naming outside servers) stays in the file and is never replaced unless this is set.",
+      "trusted": true,
+      "default": ""
+    },
+    "uisi_autorageshake_app": {
+      "type": "string",
+      "description": "Element's uisi_autorageshake_app setting of config.json: the app name Element files an automatic report of an undecryptable message under.",
+      "trusted": true,
+      "default": "element-auto-uisi"
+    },
+    "show_labs_settings": {
+      "type": "boolean",
+      "description": "Element's show_labs_settings setting of config.json: whether Element shows its Labs settings.",
+      "trusted": true,
+      "default": true
+    },
+    "room_directory": {
+      "type": "object",
+      "description": "Element's room_directory setting of config.json: the servers whose room directories Element offers; its default here is empty, and the file's own value (Element's, naming outside servers) stays in the file and is never replaced unless this is set.",
+      "trusted": true,
+      "default": {}
+    },
+    "enable_presence_by_hs_url": {
+      "type": "object",
+      "description": "Element's enable_presence_by_hs_url setting of config.json: whether Element shows presence, per homeserver URL.",
+      "trusted": true,
+      "default": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+      }
+    },
+    "terms_and_conditions_links": {
+      "type": "list",
+      "description": "Element's terms_and_conditions_links setting of config.json: the links Element shows as its terms, each a URL and its text; its default here is empty, and the file's own value (Element's, naming outside servers) stays in the file and is never replaced unless this is set.",
+      "trusted": true,
+      "default": []
+    },
+    "features": {
+      "type": "object",
+      "description": "Element's features setting of config.json: Element's feature switches, each on or off.",
+      "trusted": true,
+      "default": {
+        "feature_video_rooms": true,
+        "feature_rust_crypto": true
+      }
+    },
+    "element_call": {
+      "type": "object",
+      "description": "Element's element_call setting of config.json: where Element starts a call with Element Call, a URL.",
+      "trusted": true,
+      "default": {
+        "url": "https://call.element.dev"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "db",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "conduit-conf",
+      "type": "file",
+      "path": "${dir:state}/conduit.toml",
+      "mode": "0644",
+      "template": "files/conduit.toml",
+      "names-on-purpose": {
+        "matrix.org": "the federation's public key server, trusted by default; the world's, not this mesh's"
+      }
+    },
+    {
+      "id": "element-conf",
+      "type": "file",
+      "path": "${dir:state}/element.json",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": ["default_server_name", "default_server_config", "brand", "integrations_ui_url", "integrations_rest_url", "integrations_widgets_urls", "bug_report_endpoint_url", "uisi_autorageshake_app", "show_labs_settings", "room_directory", "enable_presence_by_hs_url", "terms_and_conditions_links", "features", "element_call"],
+      "template": "files/element.json",
+      "names-on-purpose": {
+        "matrix.org": "the public room directory and the federation's largest homeserver; the world's",
+        "matrix-client.matrix.org": "the same homeserver's client endpoint; the world's",
+        "vector.im": "Element's public identity server; the world's",
+        "scalar.vector.im": "Element's public integration manager; the world's",
+        "scalar-staging.vector.im": "Element's staging integration manager, named by the upstream default config; the world's",
+        "scalar-staging.riot.im": "the same, under its former name; the world's",
+        "element.io": "Element's bug reports, privacy and cookie pages; the world's",
+        "gitter.im": "a public room directory; the world's",
+        "libera.chat": "a public room directory; the world's",
+        "call.element.dev": "Element Call's public instance; the world's"
+      }
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "matrix"
+    },
+    {
+      "id": "homeserver",
+      "type": "container",
+      "name": "matrix",
+      "image": "matrixconduit/matrix-conduit@sha256:b0d24248e94f944ca49f90f10c429e3d65f4472bdde25661ecea9840134fb133",
+      "network": "matrix",
+      "env": {
+        "CONDUIT_CONFIG": "/etc/conduit/conduit.toml"
+      },
+      "ports": [
+        "6167"
+      ],
+      "volumes": [
+        "${dir:db}:/var/lib/matrix-conduit",
+        "${dir:state}/conduit.toml:/etc/conduit/conduit.toml:ro"
+      ],
+      "restart-on": [
+        "conduit-conf"
+      ]
+    },
+    {
+      "id": "element",
+      "type": "container",
+      "name": "element-web",
+      "image": "vectorim/element-web@sha256:a8f415462ab8d2600a592ba1b92bea51efe5a4d10eb738aab9bed769f7099613",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "matrix",
+      "ports": [
+        "80"
+      ],
+      "volumes": [
+        "${dir:state}/element.json:/app/config.json:ro"
+      ],
+      "restart-on": [
+        "element-conf"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/files/oomd.conf b/testdata/beside/mesh-catalog/modules/memory-pressure/files/oomd.conf
new file mode 100644
index 0000000..39af6de
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/files/oomd.conf
@@ -0,0 +1,8 @@
+# Managed by the mesh (module memory-pressure). Replaced on every push; edit the catalogue instead.
+#
+# systemd-oomd kills the worst unit before the kernel's OOM killer freezes the machine: when swap is
+# 90 % used, or when a watched unit stalls on memory for 20 s above its limit.
+[OOM]
+SwapUsedLimit=90%
+DefaultMemoryPressureLimit=60%
+DefaultMemoryPressureDurationSec=20s
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/files/root-slice.conf b/testdata/beside/mesh-catalog/modules/memory-pressure/files/root-slice.conf
new file mode 100644
index 0000000..edae3de
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/files/root-slice.conf
@@ -0,0 +1,5 @@
+# Managed by the mesh (module memory-pressure). Replaced on every push; edit the catalogue instead.
+#
+# systemd-oomd may act on swap exhaustion across the whole machine.
+[Slice]
+ManagedOOMSwap=kill
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/files/sysctl.conf b/testdata/beside/mesh-catalog/modules/memory-pressure/files/sysctl.conf
new file mode 100644
index 0000000..678251c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/files/sysctl.conf
@@ -0,0 +1,9 @@
+# Managed by the mesh (module memory-pressure). Replaced on every push; edit the catalogue instead.
+#
+# Swap-in reads one page, not eight: read-ahead exists to amortise a disk's seek, and compressed swap in
+# RAM has none — the speculation only costs decompression and memory.
+vm.page-cluster = 0
+#
+# vm.swappiness is deliberately left alone. The usual zram advice (150-180) holds only while the
+# compressed swap has room; once it is full, a higher swappiness moves pages to the disk swap, the thing
+# being avoided. Raise it only together with zram-size.
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/files/user-manager.conf b/testdata/beside/mesh-catalog/modules/memory-pressure/files/user-manager.conf
new file mode 100644
index 0000000..8ef300c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/files/user-manager.conf
@@ -0,0 +1,7 @@
+# Managed by the mesh (module memory-pressure). Replaced on every push; edit the catalogue instead.
+#
+# systemd-oomd may kill the worst unit in a person's service manager when its memory pressure stays
+# above 80 % — instead of the kernel freezing the machine.
+[Service]
+ManagedOOMMemoryPressure=kill
+ManagedOOMMemoryPressureLimit=80%
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/files/zram-generator.conf b/testdata/beside/mesh-catalog/modules/memory-pressure/files/zram-generator.conf
new file mode 100644
index 0000000..cccfb05
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/files/zram-generator.conf
@@ -0,0 +1,11 @@
+# Managed by the mesh (module memory-pressure). Replaced on every push; edit the catalogue instead.
+#
+# Compressed swap in RAM: fast, at a higher priority than any swap on disk, so it takes the everyday
+# pressure before anything spills to a disk. Half the RAM, at most 16 GiB, compressed with zstd.
+# The swap on disk, its size and whether one exists at all are the machine's, not this module's.
+#
+# Read by the generator at boot: a change applies at the next boot.
+[zram0]
+zram-size = min(ram / 2, 16384)
+compression-algorithm = zstd
+swap-priority = 100
diff --git a/testdata/beside/mesh-catalog/modules/memory-pressure/module.json.captured b/testdata/beside/mesh-catalog/modules/memory-pressure/module.json.captured
new file mode 100644
index 0000000..1af96e3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/memory-pressure/module.json.captured
@@ -0,0 +1,130 @@
+{
+  "module": "memory-pressure",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "emits": [
+    "pressure.high",
+    "pressure.cleared"
+  ],
+  "tools": [
+    "memory_status",
+    "memory_top",
+    "memory_oom_history",
+    "memory_zram",
+    "memory_oomd",
+    "memory_guard"
+  ],
+  "resources": [
+    {
+      "id": "zram-generator",
+      "type": "package",
+      "package": "zram-generator"
+    },
+    {
+      "id": "zram",
+      "type": "file",
+      "path": "/etc/systemd/zram-generator.conf",
+      "mode": "0644",
+      "template": "files/zram-generator.conf"
+    },
+    {
+      "id": "sysctl-drop-ins",
+      "type": "directory",
+      "path": "/etc/sysctl.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "swap-tunables",
+      "type": "file",
+      "path": "/etc/sysctl.d/90-memory-pressure.conf",
+      "mode": "0644",
+      "template": "files/sysctl.conf"
+    },
+    {
+      "id": "sysctl",
+      "type": "service",
+      "unit": "systemd-sysctl.service",
+      "restart-on": [
+        "swap-tunables"
+      ]
+    },
+    {
+      "id": "oomd-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/oomd.conf.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "oomd-limits",
+      "type": "file",
+      "path": "/etc/systemd/oomd.conf.d/memory-pressure.conf",
+      "mode": "0644",
+      "template": "files/oomd.conf"
+    },
+    {
+      "id": "root-slice-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/-.slice.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "root-slice",
+      "type": "file",
+      "path": "/etc/systemd/system/-.slice.d/10-oomd.conf",
+      "mode": "0644",
+      "template": "files/root-slice.conf"
+    },
+    {
+      "id": "user-manager-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/user@.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "user-manager",
+      "type": "file",
+      "path": "/etc/systemd/system/user@.service.d/10-oomd.conf",
+      "mode": "0644",
+      "template": "files/user-manager.conf"
+    },
+    {
+      "id": "oomd",
+      "type": "service",
+      "unit": "systemd-oomd.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "oomd-limits",
+        "root-slice",
+        "user-manager"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/memory-pressure",
+        "binary": "memory-pressure",
+        "loads": [
+          "memory-pressure"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-go/files/forge b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/forge
new file mode 100644
index 0000000..6bbf4e2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/forge
@@ -0,0 +1,7 @@
+Host ${bound:forge-account:ssh_alias}
+  HostName ${bound:forge-account:ssh_host}
+  Port ${bound:forge-account:ssh_port}
+  HostKeyAlias ${bound:forge-account:ssh_alias}
+  User git
+  IdentityFile ~/.ssh/mesh_ed25519
+  IdentitiesOnly yes
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-go/files/gitconfig b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/gitconfig
new file mode 100644
index 0000000..0525230
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/gitconfig
@@ -0,0 +1,2 @@
+[url "ssh://${bound:forge-account:ssh_alias}/"]
+	insteadOf = ${bound:forge-account:https_base}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-go/files/known_hosts b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/known_hosts
new file mode 100644
index 0000000..e0df6d8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-go/files/known_hosts
@@ -0,0 +1 @@
+${bound:forge-account:ssh_alias} ${bound:forge-account:host_key}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-go/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-build-go/module.json.captured
new file mode 100644
index 0000000..9f0fd7f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-go/module.json.captured
@@ -0,0 +1,148 @@
+{
+  "module": "mesh-build-go",
+  "version": "1",
+  "moved": true,
+  "runs-as": "mesh-build-go",
+  "capabilities": [
+    "package-manager",
+    "user-namespaces"
+  ],
+  "state": [
+    "toolchains",
+    "keys",
+    "steps"
+  ],
+  "tools": [
+    "build_go_fetch",
+    "build_go_test",
+    "build_go_digest",
+    "build_go_build",
+    "build_go_step",
+    "build_go_steps",
+    "build_go_toolchains",
+    "build_go_status",
+    "build_go_health"
+  ],
+  "streams": [
+    {
+      "name": "toolchains-go",
+      "events": ["toolchain.**"]
+    }
+  ],
+  "requires": [
+    "forge-account",
+    "go-toolchain"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-build-go",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "build_go_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-build-go",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-build-go"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-build-go",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "work",
+      "type": "directory",
+      "path": "/var/lib/mesh-build-go-work",
+      "mode": "0700",
+      "owner": "mesh-build-go",
+      "unknown": "program"
+    },
+    {
+      "id": "cache",
+      "type": "directory",
+      "path": "/var/lib/mesh-build-go-cache",
+      "mode": "0700",
+      "owner": "mesh-build-go",
+      "unknown": "program"
+    },
+    {
+      "id": "ssh-dir",
+      "type": "directory",
+      "path": "${dir:state}/.ssh",
+      "mode": "0700",
+      "owner": "mesh-build-go",
+      "unknown": "program"
+    },
+    {
+      "id": "ssh-config",
+      "type": "file",
+      "path": "${dir:ssh-dir}/config",
+      "owner": "mesh-build-go",
+      "mode": "0600",
+      "template": "files/forge"
+    },
+    {
+      "id": "known-hosts",
+      "type": "file",
+      "path": "${dir:ssh-dir}/known_hosts",
+      "owner": "mesh-build-go",
+      "mode": "0644",
+      "template": "files/known_hosts"
+    },
+    {
+      "id": "git-config",
+      "type": "file",
+      "path": "${dir:state}/.config/git/config",
+      "owner": "mesh-build-go",
+      "mode": "0644",
+      "template": "files/gitconfig"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    },
+    {
+      "id": "openssh",
+      "type": "package",
+      "package": "openssh"
+    },
+    {
+      "id": "postgresql",
+      "type": "package",
+      "package": "postgresql"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-build-go",
+        "binary": "mesh-build-go",
+        "loads": [
+          "mesh-build-go"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-node/files/forge b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/forge
new file mode 100644
index 0000000..6bbf4e2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/forge
@@ -0,0 +1,7 @@
+Host ${bound:forge-account:ssh_alias}
+  HostName ${bound:forge-account:ssh_host}
+  Port ${bound:forge-account:ssh_port}
+  HostKeyAlias ${bound:forge-account:ssh_alias}
+  User git
+  IdentityFile ~/.ssh/mesh_ed25519
+  IdentitiesOnly yes
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-node/files/gitconfig b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/gitconfig
new file mode 100644
index 0000000..0525230
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/gitconfig
@@ -0,0 +1,2 @@
+[url "ssh://${bound:forge-account:ssh_alias}/"]
+	insteadOf = ${bound:forge-account:https_base}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-node/files/known_hosts b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/known_hosts
new file mode 100644
index 0000000..e0df6d8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-node/files/known_hosts
@@ -0,0 +1 @@
+${bound:forge-account:ssh_alias} ${bound:forge-account:host_key}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-build-node/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-build-node/module.json.captured
new file mode 100644
index 0000000..b92212a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-build-node/module.json.captured
@@ -0,0 +1,169 @@
+{
+  "module": "mesh-build-node",
+  "version": "1",
+  "moved": true,
+  "runs-as": "mesh-build-node",
+  "capabilities": [
+    "package-manager",
+    "user-namespaces"
+  ],
+  "state": [
+    "toolchains",
+    "keys",
+    "steps"
+  ],
+  "tools": [
+    "build_node_fetch",
+    "build_node_test",
+    "build_node_build",
+    "build_node_step",
+    "build_node_steps",
+    "build_node_toolchains",
+    "build_node_status",
+    "build_node_health"
+  ],
+  "streams": [
+    {
+      "name": "toolchains-node",
+      "events": [
+        "toolchain.**"
+      ]
+    }
+  ],
+  "requires": [
+    "forge-account",
+    "npm-package-registry",
+    "node-toolchain"
+  ],
+  "contributes": {
+    "npm-package-registry": {
+      "access": "read"
+    }
+  },
+  "binds": {
+    "npm-package-registry": "${dir:state}/package-registry.json"
+  },
+  "secrets": {
+    "npm-package-registry": "${dir:state}/package-registry.secret"
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-build-node",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "build_node_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-build-node",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-build-node"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-build-node",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "work",
+      "type": "directory",
+      "path": "/var/lib/mesh-build-node-work",
+      "mode": "0700",
+      "owner": "mesh-build-node",
+      "unknown": "program"
+    },
+    {
+      "id": "cache",
+      "type": "directory",
+      "path": "/var/lib/mesh-build-node-cache",
+      "mode": "0700",
+      "owner": "mesh-build-node",
+      "unknown": "program"
+    },
+    {
+      "id": "ssh-dir",
+      "type": "directory",
+      "path": "${dir:state}/.ssh",
+      "mode": "0700",
+      "owner": "mesh-build-node",
+      "unknown": "program"
+    },
+    {
+      "id": "ssh-config",
+      "type": "file",
+      "path": "${dir:ssh-dir}/config",
+      "owner": "mesh-build-node",
+      "mode": "0600",
+      "template": "files/forge"
+    },
+    {
+      "id": "known-hosts",
+      "type": "file",
+      "path": "${dir:ssh-dir}/known_hosts",
+      "owner": "mesh-build-node",
+      "mode": "0644",
+      "template": "files/known_hosts"
+    },
+    {
+      "id": "git-config",
+      "type": "file",
+      "path": "${dir:state}/.config/git/config",
+      "owner": "mesh-build-node",
+      "mode": "0644",
+      "template": "files/gitconfig"
+    },
+    {
+      "id": "toolchain-dir",
+      "type": "archive",
+      "path": "${dir:state}/toolchain",
+      "owner": "mesh-build-node",
+      "artifact": "toolchain",
+      "unknown": "program"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    },
+    {
+      "id": "openssh",
+      "type": "package",
+      "package": "openssh"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-build-node",
+        "binary": "mesh-build-node",
+        "loads": [
+          "mesh-build-node"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "toolchain",
+        "kind": "archive",
+        "from": "toolchain"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-catalog/files/database.url b/testdata/beside/mesh-catalog/modules/mesh-catalog/files/database.url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-catalog/files/database.url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-catalog/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-catalog/module.json.captured
new file mode 100644
index 0000000..8d8c659
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-catalog/module.json.captured
@@ -0,0 +1,98 @@
+{
+  "module": "mesh-catalog",
+  "slug": "catalog",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "claims": [
+    {
+      "name": "mesh-catalog",
+      "scope": "mesh"
+    }
+  ],
+  "requires": [
+    "postgres-database"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "mesh_catalog"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "consumes": [
+    "node-build-agent.built",
+    "mesh-build-machine.built",
+    "mesh-controller.built-before"
+  ],
+  "emits": [
+    "registered",
+    "upgraded",
+    "rebuild-needed",
+    "catching-up"
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "template": "files/database.url"
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "mesh-catalog-prepare",
+      "artifact": "code",
+      "run": [
+        "node",
+        "prepare/index.js"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "prepare/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-cli/files/zsh-normal b/testdata/beside/mesh-catalog/modules/mesh-cli/files/zsh-normal
new file mode 100644
index 0000000..117f2a5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-cli/files/zsh-normal
@@ -0,0 +1,3 @@
+# The operator's command (module mesh-cli, novox/hq ADR 0272): nox is mesh-cli, in interactive zsh only.
+# A script, sudo and a document meant to work everywhere say mesh-cli.
+alias nox=mesh-cli
diff --git a/testdata/beside/mesh-catalog/modules/mesh-cli/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-cli/module.json.captured
new file mode 100644
index 0000000..681a3e5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-cli/module.json.captured
@@ -0,0 +1,37 @@
+{
+  "module": "mesh-cli",
+  "version": "1",
+  "moved": true,
+  "resources": [
+    {
+      "id": "program",
+      "type": "archive",
+      "artifact": "program",
+      "path": "/usr/local/bin",
+      "unknown": "program"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "program",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-cli",
+        "binary": "mesh-cli"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-config/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-config/module.json.captured
new file mode 100644
index 0000000..e03e891
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-config/module.json.captured
@@ -0,0 +1,74 @@
+{
+  "module": "mesh-config",
+  "version": "1",
+  "runs-as": "mesh-config",
+  "claims": [
+    {
+      "name": "mesh-config",
+      "scope": "mesh",
+      "serves": [
+        "config"
+      ]
+    }
+  ],
+  "emits": [
+    "config-changed"
+  ],
+  "uses": [
+    "operator-channel"
+  ],
+  "invokes": [
+    "seat:mesh-controller.hand-act",
+    "seat:mesh-controller.warranted"
+  ],
+  "reads": [
+    "mesh-controller.assignments",
+    "mesh-controller.declared-config",
+    "mesh-controller.predefined"
+  ],
+  "state": [
+    "values",
+    "resolved",
+    "predefined",
+    "proposals"
+  ],
+  "logs": [
+    "history"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-config",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-config",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-config"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-config",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-config",
+        "binary": "mesh-config",
+        "loads": [
+          "mesh-config"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-delivery-gate/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-delivery-gate/module.json.captured
new file mode 100644
index 0000000..ec83852
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-delivery-gate/module.json.captured
@@ -0,0 +1,110 @@
+{
+  "module": "mesh-delivery-gate",
+  "version": "1",
+  "slug": "gate",
+  "claims": [
+    {
+      "name": "mesh-delivery",
+      "scope": "mesh",
+      "serves": [
+        "deliveries",
+        "times",
+        "show",
+        "groups",
+        "what-if",
+        "checks",
+        "table",
+        "stalled",
+        "recheck",
+        "release",
+        "stop",
+        "close",
+        "retire-history"
+      ]
+    }
+  ],
+  "consumes": [
+    "gitea.pull.updated",
+    "gitea.pull.merged",
+    "gitea.pull.closed",
+    "gitea.forge.status",
+    "gitea.forge.pull-request.edited",
+    "gitea.forge.pull-request.closed",
+    "mesh-controller.checked",
+    "mesh-controller.plan-moved",
+    "mesh-delivery-forge-bridge.forge.**"
+  ],
+  "emits": [
+    "transition",
+    "group",
+    "merged"
+  ],
+  "invokes": [
+    "seat:mesh-controller.deliver",
+    "seat:mesh-controller.delivery-stop",
+    "seat:mesh-controller.delivery-backups-again",
+    "seat:mesh-controller.delivery-walks",
+    "seat:mesh-controller.delivery-check",
+    "seat:mesh-controller.forget-checks",
+    "seat:mesh-controller.plans",
+    "gitea.gitea_commit_statuses",
+    "gitea.gitea_contains",
+    "gitea.gitea_open_pulls"
+  ],
+  "state": [
+    "deliveries",
+    "groups",
+    "pulls",
+    {
+      "name": "asks",
+      "history": 5
+    },
+    {
+      "name": "merges",
+      "history": 10
+    },
+    {
+      "name": "owed",
+      "history": 5
+    },
+    {
+      "name": "source",
+      "history": 64
+    }
+  ],
+  "reads": [
+    "mesh-delivery.deliveries",
+    "mesh-delivery.groups",
+    "mesh-delivery.pulls",
+    "mesh-delivery-teller.answers",
+    "mesh-controller.assignments",
+    "node-engine.have"
+  ],
+  "tools": [
+    "delivery_status"
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-delivery-gate",
+        "binary": "mesh-delivery-gate",
+        "loads": [
+          "mesh-delivery-gate"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-files/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-files/module.json.captured
new file mode 100644
index 0000000..cc1df16
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-files/module.json.captured
@@ -0,0 +1,57 @@
+{
+  "module": "mesh-files",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-files",
+      "scope": "node",
+      "serves": [
+        "stat",
+        "readlink",
+        "list",
+        "read",
+        "search",
+        "account",
+        "write",
+        "copy",
+        "move",
+        "delete",
+        "mkdir",
+        "chmod",
+        "chown",
+        "trash",
+        "restore"
+      ]
+    }
+  ],
+  "invokes": [
+    "seat:operator-channel.tell"
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-files",
+        "binary": "mesh-files",
+        "loads": [
+          "mesh-files"
+        ],
+        "env": {
+          "MESH_FILES_STATE": "${dir:state}"
+        }
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-issues/files/settings.json b/testdata/beside/mesh-catalog/modules/mesh-issues/files/settings.json
new file mode 100644
index 0000000..66abd38
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-issues/files/settings.json
@@ -0,0 +1,147 @@
+{
+  "first-number": 365,
+  "owners": [
+    "hq",
+    "mesh-catalog",
+    "mesh-catalog modules/adwaita",
+    "mesh-catalog modules/artifact-store-tools",
+    "mesh-catalog modules/asus-zephyrus-g14",
+    "mesh-catalog modules/audit-logger",
+    "mesh-catalog modules/avahi",
+    "mesh-catalog modules/baserow",
+    "mesh-catalog modules/betterbird",
+    "mesh-catalog modules/blueman",
+    "mesh-catalog modules/bluetooth",
+    "mesh-catalog modules/ca-trust",
+    "mesh-catalog modules/claude-code",
+    "mesh-catalog modules/claude-licence-manager",
+    "mesh-catalog modules/clipmenu",
+    "mesh-catalog modules/confluence",
+    "mesh-catalog modules/cups",
+    "mesh-catalog modules/dbus",
+    "mesh-catalog modules/desk-channel",
+    "mesh-catalog modules/disk-load",
+    "mesh-catalog modules/distribution",
+    "mesh-catalog modules/dmenu",
+    "mesh-catalog modules/dnsmasq",
+    "mesh-catalog modules/docker",
+    "mesh-catalog modules/docker-compose",
+    "mesh-catalog modules/dunst",
+    "mesh-catalog modules/fail2ban",
+    "mesh-catalog modules/feh",
+    "mesh-catalog modules/flatpak",
+    "mesh-catalog modules/fonts",
+    "mesh-catalog modules/forticlient",
+    "mesh-catalog modules/gitea",
+    "mesh-catalog modules/gitlab",
+    "mesh-catalog modules/gnome-keyring",
+    "mesh-catalog modules/grafana",
+    "mesh-catalog modules/hello-web",
+    "mesh-catalog modules/home-assistant",
+    "mesh-catalog modules/hostname",
+    "mesh-catalog modules/i3",
+    "mesh-catalog modules/i3status-rust",
+    "mesh-catalog modules/icecast",
+    "mesh-catalog modules/influxdb",
+    "mesh-catalog modules/invoicing",
+    "mesh-catalog modules/jira",
+    "mesh-catalog modules/keycloak",
+    "mesh-catalog modules/lab",
+    "mesh-catalog modules/lemurs",
+    "mesh-catalog modules/letta",
+    "mesh-catalog modules/local-model-consumer",
+    "mesh-catalog modules/localization",
+    "mesh-catalog modules/logrotate",
+    "mesh-catalog modules/mailu",
+    "mesh-catalog modules/marrytts",
+    "mesh-catalog modules/matrix",
+    "mesh-catalog modules/memory-pressure",
+    "mesh-catalog modules/mesh-catalog",
+    "mesh-catalog modules/mesh-cli",
+    "mesh-catalog modules/mesh-delivery",
+    "mesh-catalog modules/mesh-delivery-gate",
+    "mesh-catalog modules/mesh-issues",
+    "mesh-catalog modules/mesh-vault",
+    "mesh-catalog modules/mesh-watcher",
+    "mesh-catalog modules/messenger",
+    "mesh-catalog modules/minio",
+    "mesh-catalog modules/model-usage",
+    "mesh-catalog modules/mongodb",
+    "mesh-catalog modules/mosquitto",
+    "mesh-catalog modules/mounts",
+    "mesh-catalog modules/mssql",
+    "mesh-catalog modules/n8n",
+    "mesh-catalog modules/nats",
+    "mesh-catalog modules/netcheck",
+    "mesh-catalog modules/networkmanager",
+    "mesh-catalog modules/nextcloud",
+    "mesh-catalog modules/nextcloud-client",
+    "mesh-catalog modules/nfs-server",
+    "mesh-catalog modules/nftables",
+    "mesh-catalog modules/nm-applet",
+    "mesh-catalog modules/node-env",
+    "mesh-catalog modules/nodered",
+    "mesh-catalog modules/ollama",
+    "mesh-catalog modules/only-office",
+    "mesh-catalog modules/openai-consumer",
+    "mesh-catalog modules/openrazer",
+    "mesh-catalog modules/pacman",
+    "mesh-catalog modules/photos-eef",
+    "mesh-catalog modules/photos-filip",
+    "mesh-catalog modules/picom",
+    "mesh-catalog modules/polychromatic",
+    "mesh-catalog modules/postgres",
+    "mesh-catalog modules/power",
+    "mesh-catalog modules/powerlevel10k",
+    "mesh-catalog modules/records",
+    "mesh-catalog modules/redis",
+    "mesh-catalog modules/restic",
+    "mesh-catalog modules/rofi",
+    "mesh-catalog modules/route-adapter",
+    "mesh-catalog modules/screen-lock",
+    "mesh-catalog modules/searxng",
+    "mesh-catalog modules/sensors",
+    "mesh-catalog modules/showcase",
+    "mesh-catalog modules/slack",
+    "mesh-catalog modules/snapd",
+    "mesh-catalog modules/ssh-client",
+    "mesh-catalog modules/sshd",
+    "mesh-catalog modules/step-ca",
+    "mesh-catalog modules/sudo",
+    "mesh-catalog modules/supabase",
+    "mesh-catalog modules/systemd",
+    "mesh-catalog modules/systemd-networkd",
+    "mesh-catalog modules/systemd-resolved",
+    "mesh-catalog modules/telegram",
+    "mesh-catalog modules/time-sync",
+    "mesh-catalog modules/triggerhappy",
+    "mesh-catalog modules/umami",
+    "mesh-catalog modules/unifi",
+    "mesh-catalog modules/website",
+    "mesh-catalog modules/xclip",
+    "mesh-catalog modules/xdg",
+    "mesh-catalog modules/xorg",
+    "mesh-catalog modules/xterm",
+    "mesh-catalog modules/zfs",
+    "mesh-catalog modules/zsh",
+    "mesh-catalog modules/zsh-autosuggestions",
+    "mesh-catalog modules/zsh-syntax-highlighting",
+    "mesh-controller",
+    "mesh-controller modules/build-agent",
+    "mesh-controller modules/route-proxy",
+    "mesh-delivery",
+    "mesh-host",
+    "mesh-lab",
+    "mesh-media-catalog",
+    "mesh-sdk",
+    "mesh-tools"
+  ],
+  "duplicate-check": "on",
+  "judge-model": "sonnet",
+  "forge-owner": "novox",
+  "stuck-after": "2h",
+  "worker-stale-after": "24h",
+  "delivered-not-resolved-after": "1h",
+  "decision-floor": 293,
+  "research-floor": 45
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-issues/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-issues/module.json.captured
new file mode 100644
index 0000000..dcfc71c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-issues/module.json.captured
@@ -0,0 +1,329 @@
+{
+  "module": "mesh-issues",
+  "version": "1",
+  "slug": "issues",
+  "seats": [
+    {
+      "name": "issue-tracker",
+      "scope": "mesh",
+      "serves": [
+        "open",
+        "get",
+        "list",
+        "move",
+        "note",
+        "link",
+        "import",
+        "groom",
+        "set",
+        "tracking",
+        "reserve",
+        "fix-times"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "issue-tracker",
+      "scope": "mesh",
+      "serves": [
+        "open",
+        "get",
+        "list",
+        "move",
+        "note",
+        "link",
+        "import",
+        "groom",
+        "set",
+        "tracking",
+        "reserve",
+        "fix-times"
+      ]
+    }
+  ],
+  "emits": [
+    "opened",
+    "moved",
+    "noted",
+    "linked",
+    "imported",
+    "set",
+    "triaged",
+    "ready",
+    "ready-to-verify",
+    "reserved"
+  ],
+  "consumes": [
+    "mesh-issues.opened",
+    "mesh-issues.moved",
+    "mesh-delivery-gate.transition"
+  ],
+  "invokes": [
+    "claude-code.claude_code_judge",
+    "seat:mesh-delivery.checks",
+    "seat:operator-channel.notify",
+    "gitea.gitea_pull_reviews",
+    "records.records_status",
+    "records.records_list",
+    "records.records_read",
+    "mesh-knowledge.knowledge_highest"
+  ],
+  "logs": [
+    "changes"
+  ],
+  "state": [
+    {
+      "name": "issues",
+      "history": 2
+    },
+    "counters",
+    "grooming",
+    "reservations"
+  ],
+  "config": {
+    "first-number": {
+      "type": "number",
+      "description": "The number the first issue the tracker numbers gets, read once when its counter starts and never again; the import reads it as the boundary between the folders hq numbered and the tracker's issues.",
+      "minimum": 1,
+      "trusted": true,
+      "default": 365
+    },
+    "owners": {
+      "type": "list",
+      "description": "The registered places an issue's located-in may name: a repository, or a repository and a folder in it separated by a space.",
+      "trusted": true,
+      "default": [
+        "hq",
+        "mesh-catalog",
+        "mesh-catalog modules/adwaita",
+        "mesh-catalog modules/artifact-store-tools",
+        "mesh-catalog modules/asus-zephyrus-g14",
+        "mesh-catalog modules/audit-logger",
+        "mesh-catalog modules/avahi",
+        "mesh-catalog modules/baserow",
+        "mesh-catalog modules/betterbird",
+        "mesh-catalog modules/blueman",
+        "mesh-catalog modules/bluetooth",
+        "mesh-catalog modules/ca-trust",
+        "mesh-catalog modules/claude-code",
+        "mesh-catalog modules/claude-licence-manager",
+        "mesh-catalog modules/clipmenu",
+        "mesh-catalog modules/confluence",
+        "mesh-catalog modules/cups",
+        "mesh-catalog modules/dbus",
+        "mesh-catalog modules/desk-channel",
+        "mesh-catalog modules/disk-load",
+        "mesh-catalog modules/distribution",
+        "mesh-catalog modules/dmenu",
+        "mesh-catalog modules/dnsmasq",
+        "mesh-catalog modules/docker",
+        "mesh-catalog modules/docker-compose",
+        "mesh-catalog modules/dunst",
+        "mesh-catalog modules/fail2ban",
+        "mesh-catalog modules/feh",
+        "mesh-catalog modules/flatpak",
+        "mesh-catalog modules/fonts",
+        "mesh-catalog modules/forticlient",
+        "mesh-catalog modules/gitea",
+        "mesh-catalog modules/gitlab",
+        "mesh-catalog modules/gnome-keyring",
+        "mesh-catalog modules/grafana",
+        "mesh-catalog modules/hello-web",
+        "mesh-catalog modules/home-assistant",
+        "mesh-catalog modules/hostname",
+        "mesh-catalog modules/i3",
+        "mesh-catalog modules/i3status-rust",
+        "mesh-catalog modules/icecast",
+        "mesh-catalog modules/influxdb",
+        "mesh-catalog modules/invoicing",
+        "mesh-catalog modules/jira",
+        "mesh-catalog modules/keycloak",
+        "mesh-catalog modules/lab",
+        "mesh-catalog modules/lemurs",
+        "mesh-catalog modules/letta",
+        "mesh-catalog modules/local-model-consumer",
+        "mesh-catalog modules/localization",
+        "mesh-catalog modules/logrotate",
+        "mesh-catalog modules/mailu",
+        "mesh-catalog modules/marrytts",
+        "mesh-catalog modules/matrix",
+        "mesh-catalog modules/memory-pressure",
+        "mesh-catalog modules/mesh-catalog",
+        "mesh-catalog modules/mesh-cli",
+        "mesh-catalog modules/mesh-delivery",
+        "mesh-catalog modules/mesh-delivery-gate",
+        "mesh-catalog modules/mesh-issues",
+        "mesh-catalog modules/mesh-vault",
+        "mesh-catalog modules/mesh-watcher",
+        "mesh-catalog modules/messenger",
+        "mesh-catalog modules/minio",
+        "mesh-catalog modules/model-usage",
+        "mesh-catalog modules/mongodb",
+        "mesh-catalog modules/mosquitto",
+        "mesh-catalog modules/mounts",
+        "mesh-catalog modules/mssql",
+        "mesh-catalog modules/n8n",
+        "mesh-catalog modules/nats",
+        "mesh-catalog modules/netcheck",
+        "mesh-catalog modules/networkmanager",
+        "mesh-catalog modules/nextcloud",
+        "mesh-catalog modules/nextcloud-client",
+        "mesh-catalog modules/nfs-server",
+        "mesh-catalog modules/nftables",
+        "mesh-catalog modules/nm-applet",
+        "mesh-catalog modules/node-env",
+        "mesh-catalog modules/nodered",
+        "mesh-catalog modules/ollama",
+        "mesh-catalog modules/only-office",
+        "mesh-catalog modules/openai-consumer",
+        "mesh-catalog modules/openrazer",
+        "mesh-catalog modules/pacman",
+        "mesh-catalog modules/photos-eef",
+        "mesh-catalog modules/photos-filip",
+        "mesh-catalog modules/picom",
+        "mesh-catalog modules/polychromatic",
+        "mesh-catalog modules/postgres",
+        "mesh-catalog modules/power",
+        "mesh-catalog modules/powerlevel10k",
+        "mesh-catalog modules/records",
+        "mesh-catalog modules/redis",
+        "mesh-catalog modules/restic",
+        "mesh-catalog modules/rofi",
+        "mesh-catalog modules/route-adapter",
+        "mesh-catalog modules/screen-lock",
+        "mesh-catalog modules/searxng",
+        "mesh-catalog modules/sensors",
+        "mesh-catalog modules/showcase",
+        "mesh-catalog modules/slack",
+        "mesh-catalog modules/snapd",
+        "mesh-catalog modules/ssh-client",
+        "mesh-catalog modules/sshd",
+        "mesh-catalog modules/step-ca",
+        "mesh-catalog modules/sudo",
+        "mesh-catalog modules/supabase",
+        "mesh-catalog modules/systemd",
+        "mesh-catalog modules/systemd-networkd",
+        "mesh-catalog modules/systemd-resolved",
+        "mesh-catalog modules/telegram",
+        "mesh-catalog modules/time-sync",
+        "mesh-catalog modules/triggerhappy",
+        "mesh-catalog modules/umami",
+        "mesh-catalog modules/unifi",
+        "mesh-catalog modules/website",
+        "mesh-catalog modules/xclip",
+        "mesh-catalog modules/xdg",
+        "mesh-catalog modules/xorg",
+        "mesh-catalog modules/xterm",
+        "mesh-catalog modules/zfs",
+        "mesh-catalog modules/zsh",
+        "mesh-catalog modules/zsh-autosuggestions",
+        "mesh-catalog modules/zsh-syntax-highlighting",
+        "mesh-controller",
+        "mesh-controller modules/build-agent",
+        "mesh-controller modules/route-proxy",
+        "mesh-delivery",
+        "mesh-host",
+        "mesh-lab",
+        "mesh-media-catalog",
+        "mesh-sdk",
+        "mesh-tools"
+      ]
+    },
+    "duplicate-check": {
+      "type": "string",
+      "description": "Whether a new issue is checked against the open ones for a duplicate: off stops it, anything else is on (novox/hq ADR 0278 §7).",
+      "trusted": true,
+      "default": "on"
+    },
+    "judge-model": {
+      "type": "string",
+      "description": "The model the duplicate check asks, by the agent's name for it, such as sonnet; empty is the tracker's own default.",
+      "trusted": true,
+      "default": "sonnet"
+    },
+    "forge-owner": {
+      "type": "string",
+      "description": "The owner on the forge of the repositories an issue's fixed-by names, for asking after a pull request's delivery (novox/hq ADR 0279 §3); empty asks no forge.",
+      "trusted": true,
+      "default": "novox"
+    },
+    "stuck-after": {
+      "type": "string",
+      "description": "How long a fix may be merged and not delivered before it is said stuck, as a duration such as 2h (novox/hq ADR 0281); empty is the tracker's own default.",
+      "pattern": "|[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h)([0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))*",
+      "trusted": true,
+      "default": "2h"
+    },
+    "worker-stale-after": {
+      "type": "string",
+      "description": "How long an issue's worker stays current with nothing done on it, as a duration such as 24h (novox/hq ADR 0284 §4); empty is the tracker's own default.",
+      "pattern": "|[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h)([0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))*",
+      "trusted": true,
+      "default": "24h"
+    },
+    "delivered-not-resolved-after": {
+      "type": "string",
+      "description": "How long an issue may stay in fixing once every fix it names is delivered before the operator is warned, as a duration such as 1h (novox/hq issue 483); empty is the tracker's own default.",
+      "pattern": "|[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h)([0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))*",
+      "trusted": true,
+      "default": "1h"
+    },
+    "decision-floor": {
+      "type": "number",
+      "description": "The highest decision number already taken somewhere the tracker cannot read, such as an open branch of hq; the decision sequence's first number is one above it, read once when the counter starts (novox/hq issue 424).",
+      "minimum": 0,
+      "trusted": true,
+      "default": 293
+    },
+    "research-floor": {
+      "type": "number",
+      "description": "The highest research number already taken somewhere the tracker cannot read; the research sequence's first number is one above it, read once when the counter starts (novox/hq issue 424).",
+      "minimum": 0,
+      "trusted": true,
+      "default": 45
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "takes-config": ["first-number", "owners", "duplicate-check", "judge-model", "forge-owner", "stuck-after", "worker-stale-after", "delivered-not-resolved-after", "decision-floor", "research-floor"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-issues",
+        "binary": "mesh-issues",
+        "loads": [
+          "mesh-issues"
+        ],
+        "env": {
+          "MESH_ISSUES_SETTINGS": "${dir:state}/settings.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/database.url b/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/database.url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/database.url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/settings.json b/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/settings.json
new file mode 100644
index 0000000..6f682fe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-knowledge/files/settings.json
@@ -0,0 +1,5 @@
+{
+  "judge-model": "sonnet",
+  "drafting": "on",
+  "reserved-for": "168h"
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-knowledge/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-knowledge/module.json.captured
new file mode 100644
index 0000000..92b15f2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-knowledge/module.json.captured
@@ -0,0 +1,218 @@
+{
+  "module": "mesh-knowledge",
+  "version": "1",
+  "slug": "knowledge",
+  "requires": [
+    "postgres-database"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "knowledge"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "seats": [
+    {
+      "name": "knowledge-base",
+      "scope": "mesh",
+      "serves": [
+        "ask",
+        "get",
+        "list",
+        "findings",
+        "holds",
+        "links",
+        "history",
+        "reserve",
+        "propose",
+        "import",
+        "return",
+        "withdraw"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "knowledge-base",
+      "scope": "mesh",
+      "serves": [
+        "ask",
+        "get",
+        "list",
+        "findings",
+        "holds",
+        "links",
+        "history",
+        "reserve",
+        "propose",
+        "import",
+        "return",
+        "withdraw"
+      ]
+    }
+  ],
+  "tools": [
+    "knowledge_health",
+    "knowledge_highest"
+  ],
+  "emits": [
+    "reserved",
+    "proposed",
+    "reviewed",
+    "accepted",
+    "changed",
+    "imported",
+    "drafted",
+    "confirmed",
+    "returned"
+  ],
+  "uses": [
+    "operator-channel"
+  ],
+  "invokes": [
+    "seat:issue-tracker.reserve",
+    "claude-code.claude_code_judge",
+    "claude-code.claude_code_judged",
+    "records.records_status",
+    "records.records_list",
+    "records.records_read",
+    "seat:operator-channel.notify"
+  ],
+  "config": {
+    "judge-model": {
+      "type": "string",
+      "description": "The model the knowledge base's drafting and confirming judgements ask, by the agent's name for it, such as sonnet; empty is sonnet.",
+      "default": "sonnet"
+    },
+    "drafting": {
+      "type": "string",
+      "description": "Whether the knowledge base drafts and confirms clauses itself: off stops it, anything else is on.",
+      "default": "on"
+    },
+    "reserved-for": {
+      "type": "string",
+      "description": "How long a reserved number waits for its proposal before it is withdrawn, as a duration such as 168h; empty is the knowledge base's own default.",
+      "pattern": "|[0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h)([0-9]+(\\.[0-9]+)?(ns|us|µs|ms|s|m|h))*",
+      "default": "168h"
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "template": "files/database.url"
+    },
+    {
+      "id": "settings",
+      "trusted": false,
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "takes-config": ["judge-model", "drafting", "reserved-for"],
+      "merge": "json",
+      "template": "files/settings.json"
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "mesh-knowledge-prepare",
+      "artifact": "tools",
+      "run": [
+        "./mesh-knowledge",
+        "prepare"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    },
+    {
+      "id": "keep",
+      "type": "process",
+      "name": "mesh-knowledge-keep",
+      "artifact": "tools",
+      "run": [
+        "./mesh-knowledge",
+        "keep"
+      ],
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "mesh-knowledge-watch",
+      "artifact": "tools",
+      "run": [
+        "./mesh-knowledge",
+        "watch"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url",
+        "MESH_KNOWLEDGE_STATUS": "${dir:state}/health.json"
+      },
+      "restart-on": [
+        "database-url"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "knowledge_health",
+        "needs": "postgres-database",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "180s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-knowledge",
+        "binary": "mesh-knowledge",
+        "loads": [
+          "mesh-knowledge"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url",
+          "MESH_KNOWLEDGE_SETTINGS": "${dir:state}/settings.json",
+          "MESH_KNOWLEDGE_STATUS": "${dir:state}/health.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-notifier/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-mail-notifier/module.json.captured
new file mode 100644
index 0000000..9afba46
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-notifier/module.json.captured
@@ -0,0 +1,68 @@
+{
+  "module": "mesh-mail-notifier",
+  "version": "1",
+  "runs-as": "mesh-mail-notifier",
+  "claims": [
+    {
+      "name": "mail-notifier",
+      "scope": "node",
+      "serves": ["status"]
+    }
+  ],
+  "consumes": [
+    "mesh-mail.mail.*.message.added"
+  ],
+  "invokes": [
+    "seat:node-notifier.send",
+    "seat:mail-store.accounts"
+  ],
+  "emits": [
+    "shown"
+  ],
+  "state": [
+    {
+      "name": "shown",
+      "ttl-seconds": 2592000
+    }
+  ],
+  "tools": [
+    "mail-notifier.status",
+    "mail_notifier_health"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-mail-notifier",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-mail-notifier",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-mail-notifier"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-mail-notifier",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-mail-notifier",
+        "binary": "mesh-mail-notifier",
+        "loads": [
+          "mesh-mail-notifier"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/callers.json b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/callers.json
new file mode 100644
index 0000000..84dd800
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/callers.json
@@ -0,0 +1,3 @@
+{
+  "callers": ["mesh-mail-web"]
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/database-url b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/database-url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/files/database-url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-reader/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/module.json.captured
new file mode 100644
index 0000000..b83e8bb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-reader/module.json.captured
@@ -0,0 +1,141 @@
+{
+  "module": "mesh-mail-reader",
+  "version": "1",
+  "runs-as": "mesh-mail-reader",
+  "claims": [
+    {
+      "name": "mail-reading",
+      "scope": "mesh",
+      "serves": ["entries", "groups", "correct", "lessons", "undo", "status"]
+    }
+  ],
+  "consumes": [
+    "mesh-mail.mail.*.message.added"
+  ],
+  "invokes": [
+    "seat:mail-store.read",
+    "seat:mail-store.accounts",
+    "claude-code.claude_code_judge",
+    "claude-code.claude_code_judged",
+    "messenger.messenger_check",
+    "seat:operator-channel.tell"
+  ],
+  "requires": ["postgres-database"],
+  "contributes": {
+    "postgres-database": {
+      "name": "mail-reader"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "config": {
+    "callers": {
+      "type": "list",
+      "description": "Who may call one of mail-reading's six verbs (entries, groups, correct, lessons, undo, status): a module's name (on every machine), <machine>.<module>, or person.<name> (novox/hq ADR 0459 §2). mesh-mail-web alone by default.",
+      "trusted": true,
+      "default": ["mesh-mail-web"]
+    }
+  },
+  "tools": [
+    "mail-reading.entries",
+    "mail-reading.groups",
+    "mail-reading.correct",
+    "mail-reading.lessons",
+    "mail-reading.undo",
+    "mail-reading.status",
+    "mail_reader_health"
+  ],
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "mail_reader_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-mail-reader",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-mail-reader",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-mail-reader"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-mail-reader",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "callers",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/callers.json",
+      "mode": "0600",
+      "owner": "mesh-mail-reader",
+      "merge": "json",
+      "template": "files/callers.json",
+      "takes-config": ["callers"]
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "owner": "mesh-mail-reader",
+      "template": "files/database-url"
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "mesh-mail-reader-prepare",
+      "artifact": "tools",
+      "run": [
+        "./mesh-mail-reader",
+        "prepare"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-mail-reader",
+        "binary": "mesh-mail-reader",
+        "loads": [
+          "mesh-mail-reader"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url",
+          "MESH_MAIL_READER_CALLERS": "${dir:state}/callers.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/oidc.json b/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/oidc.json
new file mode 100644
index 0000000..f864608
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/oidc.json
@@ -0,0 +1,5 @@
+{
+  "client-id": "${bound:oidc-client:as}",
+  "client-secret": "${secret:oidc-client}",
+  "issuer": "${bound:oidc-client:issuer}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/operators.json b/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/operators.json
new file mode 100644
index 0000000..dea781c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-web/files/operators.json
@@ -0,0 +1,3 @@
+{
+  "operators": []
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail-web/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-mail-web/module.json.captured
new file mode 100644
index 0000000..c6c0d3d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail-web/module.json.captured
@@ -0,0 +1,131 @@
+{
+  "module": "mesh-mail-web",
+  "version": "1",
+  "slug": "mail-web",
+  "runs-as": "mesh-mail-web",
+  "claims": [
+    {
+      "name": "mail-webclient",
+      "scope": "mesh",
+      "serves": ["open", "status"]
+    }
+  ],
+  "invokes": [
+    "seat:mail-store.accounts",
+    "seat:mail-store.search",
+    "seat:mail-store.read",
+    "seat:mail-store.send",
+    "seat:mail-store.send-status",
+    "seat:mail-reading.entries",
+    "seat:mail-reading.groups",
+    "seat:mail-reading.status",
+    "seat:mail-reading.correct",
+    "seat:mail-reading.lessons",
+    "seat:mail-reading.undo"
+  ],
+  "reads": ["mesh-mail.accounts"],
+  "requires": ["route", "oidc-client"],
+  "contributes": {
+    "route": {
+      "label": "mail",
+      "endpoint": "web"
+    },
+    "oidc-client": {
+      "label": "mail",
+      "endpoint": "web",
+      "callback": "/signed-in"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json",
+    "oidc-client": "${dir:state}/oidc-bound.json"
+  },
+  "secrets": {
+    "oidc-client": "${dir:state}/oidc-bound.secret"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8099,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mail web client's pages, over http; only the route proxy reaches it, and the operator's own browser through the internal name (novox/hq ADR 0440 §2) — its public name, if any, is a route grant"
+    }
+  ],
+  "config": {
+    "operators": {
+      "type": "list",
+      "description": "The Keycloak identities (the ID token's preferred_username) let to sign in; nobody by default (novox/hq ADR 0440 §3).",
+      "trusted": true,
+      "default": []
+    }
+  },
+  "tools": [
+    "mail-webclient.open",
+    "mail-webclient.status",
+    "mail_web_health"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-mail-web",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-mail-web",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-mail-web"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-mail-web",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "operators",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/operators.json",
+      "mode": "0600",
+      "owner": "mesh-mail-web",
+      "merge": "json",
+      "template": "files/operators.json",
+      "takes-config": ["operators"]
+    },
+    {
+      "id": "oidc-config",
+      "type": "file",
+      "path": "${dir:state}/oidc.json",
+      "mode": "0600",
+      "owner": "mesh-mail-web",
+      "template": "files/oidc.json"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-mail-web",
+        "binary": "mesh-mail-web",
+        "loads": ["mesh-mail-web"],
+        "env": {
+          "MESH_MAIL_WEB_OPERATORS": "${dir:state}/operators.json",
+          "MESH_MAIL_WEB_OIDC": "${dir:state}/oidc.json",
+          "MESH_MAIL_WEB_LISTEN": "${port:8099}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail/files/accounts.json b/testdata/beside/mesh-catalog/modules/mesh-mail/files/accounts.json
new file mode 100644
index 0000000..e182cc3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail/files/accounts.json
@@ -0,0 +1,3 @@
+{
+  "accounts": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail/files/database-url b/testdata/beside/mesh-catalog/modules/mesh-mail/files/database-url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail/files/database-url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail/files/grants.json b/testdata/beside/mesh-catalog/modules/mesh-mail/files/grants.json
new file mode 100644
index 0000000..458eabb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail/files/grants.json
@@ -0,0 +1,3 @@
+{
+  "grants": {}
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail/files/store.json b/testdata/beside/mesh-catalog/modules/mesh-mail/files/store.json
new file mode 100644
index 0000000..8c2075d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail/files/store.json
@@ -0,0 +1,9 @@
+{
+  "scheme": "${bound:s3-bucket:scheme}",
+  "at": "${bound:s3-bucket:at}",
+  "port": "${bound:s3-bucket:port}",
+  "bucket": "${bound:s3-bucket:bucket}",
+  "region": "${bound:s3-bucket:region}",
+  "key": "${bound:s3-bucket:as}",
+  "secret": "${secret:s3-bucket}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-mail/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-mail/module.json.captured
new file mode 100644
index 0000000..735fbc5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-mail/module.json.captured
@@ -0,0 +1,317 @@
+{
+  "module": "mesh-mail",
+  "version": "1",
+  "slug": "mail",
+  "seats": [
+    {
+      "name": "mail-store",
+      "scope": "mesh",
+      "serves": ["accounts", "search", "read", "send", "send-status"]
+    },
+    {
+      "name": "mail-webclient",
+      "scope": "mesh",
+      "serves": ["open", "status"]
+    },
+    {
+      "name": "mail-notifier",
+      "scope": "node",
+      "needs": ["node-notifier"],
+      "serves": ["status"]
+    },
+    {
+      "name": "mail-reading",
+      "scope": "mesh",
+      "serves": ["entries", "groups", "correct", "lessons", "undo", "status"]
+    }
+  ],
+  "claims": [
+    {
+      "name": "mail-store",
+      "scope": "mesh",
+      "serves": ["accounts", "search", "read", "send", "send-status"]
+    }
+  ],
+  "requires": [
+    "postgres-database",
+    "s3-bucket"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "mail"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store-binding.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
+  },
+  "own-secrets": {
+    "mail-credential-*": {
+      "path": "${dir:state}/mail-credential-*.secret",
+      "issued-by": "outside",
+      "prompt": "the password of the mail account {member}",
+      "owner": "mesh-mail-send"
+    },
+    "broker-send": {
+      "path": "${dir:state}/broker-send.secret",
+      "owner": "mesh-mail-send"
+    }
+  },
+  "config": {
+    "accounts": {
+      "type": "object",
+      "description": "The mail accounts, each by a lower-case name that names it on the bus and its secret: its kind (imap), address, incoming and outgoing servers (host, port, security tls or starttls), and optionally the folders watched and the user it signs in as; no password, which is the own secret mail-credential-<account> (novox/hq ADR 0359 §5).",
+      "trusted": true,
+      "default": {}
+    },
+    "grants": {
+      "type": "object",
+      "description": "Per account, who may read its mail and who may send from it: a module's name (on every machine), <machine>.<module>, or person.<name>. Nobody by default; it restricts the stream MAIL and the tools mail_search, mail_read and mail_send alike (novox/hq ADR 0359 §4).",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "tools": [
+    "mail_accounts",
+    "mail_search",
+    "mail_read",
+    "mail_health",
+    "mail_send",
+    "mail_send_status",
+    "mail-store.accounts",
+    "mail-store.search",
+    "mail-store.read",
+    "mail-store.send",
+    "mail-store.send-status"
+  ],
+  "uses": [
+    "operator-channel"
+  ],
+  "state": [
+    "sends",
+    "accounts",
+    "mails"
+  ],
+  "emits": [
+    "mail.send.sent",
+    "mail.send.failed"
+  ],
+  "streams": [
+    {
+      "name": "mail",
+      "events": [
+        "mail.*.message.added",
+        "mail.*.message.changed",
+        "mail.*.message.removed"
+      ],
+      "max-age-days": 7,
+      "grant": {
+        "config": "grants",
+        "events": "mail.{key}.**"
+      }
+    },
+    {
+      "name": "mail-sends",
+      "events": [
+        "mail.send.approved"
+      ],
+      "max-age-days": 1,
+      "max-mib": 64,
+      "retention": "work-queue",
+      "max-deliveries": 5,
+      "duplicates": 24
+    }
+  ],
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-mail-send"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0711",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "template": "files/database-url"
+    },
+    {
+      "id": "store",
+      "type": "file",
+      "path": "${dir:state}/store.json",
+      "mode": "0600",
+      "template": "files/store.json"
+    },
+    {
+      "id": "accounts",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/accounts.json",
+      "mode": "0644",
+      "merge": "json",
+      "template": "files/accounts.json",
+      "takes-config": [
+        "accounts"
+      ]
+    },
+    {
+      "id": "grants",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/grants.json",
+      "mode": "0600",
+      "merge": "json",
+      "template": "files/grants.json",
+      "takes-config": [
+        "grants"
+      ]
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "mesh-mail-prepare",
+      "artifact": "tools",
+      "run": [
+        "./mesh-mail",
+        "prepare"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    },
+    {
+      "id": "keep",
+      "type": "process",
+      "name": "mesh-mail-keep",
+      "artifact": "tools",
+      "run": [
+        "./mesh-mail",
+        "keep"
+      ],
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url",
+        "MESH_MAIL_ACCOUNTS": "${dir:state}/accounts.json",
+        "MESH_MAIL_SECRETS": "${dir:state}",
+        "MESH_MAIL_STORE": "${dir:state}/store.json"
+      },
+      "restart-on": [
+        "database-url",
+        "store",
+        "accounts"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "mesh-mail-watch",
+      "artifact": "tools",
+      "run": [
+        "./mesh-mail",
+        "watch"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url",
+        "MESH_MAIL_ACCOUNTS": "${dir:state}/accounts.json",
+        "MESH_MAIL_SECRETS": "${dir:state}",
+        "MESH_MAIL_STATUS": "${dir:state}/health.json"
+      },
+      "restart-on": [
+        "database-url",
+        "accounts"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "mail_health",
+        "needs": "postgres-database",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "180s"
+      }
+    },
+    {
+      "id": "send",
+      "type": "process",
+      "name": "mesh-mail-send",
+      "artifact": "tools",
+      "run": [
+        "./mesh-mail",
+        "send"
+      ],
+      "user": "mesh-mail-send",
+      "env": {
+        "MESH_MAIL_ACCOUNTS": "${dir:state}/accounts.json",
+        "MESH_MAIL_SECRETS": "${dir:state}"
+      },
+      "restart-on": [
+        "accounts"
+      ],
+      "bus": {
+        "emits": [
+          "mail.send.sent",
+          "mail.send.failed"
+        ],
+        "queues": [
+          "mail-sends"
+        ],
+        "state": [
+          "sends"
+        ],
+        "asks": true,
+        "invokes": [
+          "seat:operator-channel.tell"
+        ]
+      },
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-mail",
+        "binary": "mesh-mail",
+        "loads": [
+          "mesh-mail"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url",
+          "MESH_MAIL_ACCOUNTS": "${dir:state}/accounts.json",
+          "MESH_MAIL_GRANTS": "${dir:state}/grants.json",
+          "MESH_MAIL_SECRETS": "${dir:state}",
+          "MESH_MAIL_STORE": "${dir:state}/store.json",
+          "MESH_MAIL_STATUS": "${dir:state}/health.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-provisioner-client/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-provisioner-client/module.json.captured
new file mode 100644
index 0000000..095128a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-provisioner-client/module.json.captured
@@ -0,0 +1,60 @@
+{
+  "module": "mesh-provisioner-client",
+  "version": "1",
+  "claims": [
+    {
+      "name": "node-provisioner",
+      "scope": "node"
+    }
+  ],
+  "own-secrets": {
+    "provisioner-broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-provisioner-client",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-provisioner-client",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-provisioner-client"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-provisioner-client",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "client",
+      "type": "process",
+      "name": "mesh-provisioner-client",
+      "artifact": "client",
+      "run": [
+        "./mesh-provisioner-client"
+      ],
+      "env": {
+        "MESH_PROVISIONER_CREDENTIAL": "${dir:state}/broker",
+        "MESH_PROVISIONER_STATE": "${dir:state}"
+      },
+      "user": "mesh-provisioner-client",
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "client",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-provisioner-client",
+        "binary": "mesh-provisioner-client"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-provisioner/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-provisioner/module.json.captured
new file mode 100644
index 0000000..650425b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-provisioner/module.json.captured
@@ -0,0 +1,56 @@
+{
+  "module": "mesh-provisioner",
+  "version": "1",
+  "runs-as": "mesh-provisioner",
+  "claims": [
+    {
+      "name": "mesh-provisioner",
+      "scope": "mesh",
+      "serves": [
+        "provisioning"
+      ]
+    }
+  ],
+  "state": [
+    "registry",
+    "needs",
+    "applied",
+    "collect"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-provisioner",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-provisioner",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-provisioner"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-provisioner",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-provisioner",
+        "binary": "mesh-provisioner",
+        "loads": [
+          "mesh-provisioner"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-reads/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-reads/module.json.captured
new file mode 100644
index 0000000..1806275
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-reads/module.json.captured
@@ -0,0 +1,55 @@
+{
+  "module": "mesh-reads",
+  "version": "1",
+  "runs-as": "mesh-reads",
+  "claims": [
+    {
+      "name": "node-reads",
+      "scope": "node",
+      "serves": [
+        "stat",
+        "readlink",
+        "list",
+        "read",
+        "search",
+        "account"
+      ]
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-reads",
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-reads",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-reads"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-reads",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-reads",
+        "binary": "mesh-reads",
+        "loads": [
+          "mesh-reads"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-vault/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-vault/module.json.captured
new file mode 100644
index 0000000..44944c9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-vault/module.json.captured
@@ -0,0 +1,173 @@
+{
+  "module": "mesh-vault",
+  "version": "1",
+  "runs-as": "mesh-vault",
+  "provides": [
+    {
+      "name": "secret",
+      "scope": "mesh",
+      "identity": {
+        "in": "a vault entry"
+      }
+    }
+  ],
+  "emits": [
+    "provisioned",
+    "rotated",
+    "secret-changed"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ],
+  "receives": {
+    "secret": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "secret": "${dir:grants}"
+  },
+  "keeps": "/var/lib/mesh-vault/root",
+  "data": {
+    "own": [
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "valuable",
+        "why": "the vault's own keys"
+      },
+      {
+        "id": "ledger",
+        "path": "${dir:ledger}",
+        "class": "valuable",
+        "why": "every secret the vault keeps"
+      },
+      {
+        "id": "root",
+        "path": "${dir:root}",
+        "class": "valuable",
+        "why": "the vault's root material"
+      },
+      {
+        "id": "store",
+        "path": "${dir:store}",
+        "class": "valuable",
+        "why": "every secret the vault holds, sealed to its own key and to the operator key"
+      }
+    ],
+    "consumers": {
+      "secret": {
+        "class": "valuable",
+        "in": "ledger",
+        "why": "a secret given to a consumer is kept nowhere else in the clear"
+      }
+    }
+  },
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "mesh-vault",
+  "runtime-health": {
+    "kind": "tool",
+    "tool": "vault_health",
+    "interval": "60s",
+    "timeout": "10s",
+    "looks": 2,
+    "grace": "60s"
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "mesh-vault",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/mesh-vault"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "ledger",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "root",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    },
+    {
+      "id": "store",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "mesh-vault",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-vault",
+        "binary": "mesh-vault",
+        "loads": [
+          "mesh-vault"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_VAULT_LEDGER": "${dir:ledger}",
+          "MESH_VAULT_ROOT": "${dir:root}",
+          "MESH_VAULT_STORE": "${dir:store}",
+          "MESH_VAULT_STATE": "${dir:state}"
+        }
+      }
+    ]
+  },
+  "tools": [
+    "secret_export",
+    "secret_holders",
+    "secret_verify",
+    "secret_handed",
+    "secret_asks",
+    "secret_vault_export",
+    "provisioner_retirement",
+    "provisioner_retire_approve",
+    "provisioner_retire_reject",
+    "provisioner_delete",
+    "vault_status",
+    "vault_health"
+  ],
+  "claims": [
+    {
+      "name": "mesh-vault",
+      "scope": "mesh",
+      "serves": [
+        "get",
+        "accept",
+        "secret-ask",
+        "issued",
+        "rotate",
+        "move-in",
+        "node-key",
+        "move-asks"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-watcher/files/settings.json b/testdata/beside/mesh-catalog/modules/mesh-watcher/files/settings.json
new file mode 100644
index 0000000..84b9ecc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-watcher/files/settings.json
@@ -0,0 +1,3 @@
+{
+  "telegram-chat-id": ""
+}
diff --git a/testdata/beside/mesh-catalog/modules/mesh-watcher/module.json.captured b/testdata/beside/mesh-catalog/modules/mesh-watcher/module.json.captured
new file mode 100644
index 0000000..e9543a5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mesh-watcher/module.json.captured
@@ -0,0 +1,71 @@
+{
+  "module": "mesh-watcher",
+  "version": "1",
+  "slug": "watch",
+  "consumes": [
+    "mesh-controller.doctor-heartbeat"
+  ],
+  "invokes": [
+    "mesh-watcher.watcher_ping",
+    "seat:mesh-controller.seats"
+  ],
+  "own-secrets": {
+    "telegram-token": "${dir:state}/telegram-token"
+  },
+  "tools": [
+    "watcher_status",
+    "watcher_last_heard",
+    "watcher_test",
+    "watcher_ping"
+  ],
+  "config": {
+    "telegram-chat-id": {
+      "type": "string",
+      "description": "The Telegram chat the watcher reports to: the chat's id, a number, or @name of a channel; empty reports to none.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "takes-config": ["telegram-chat-id"],
+      "merge": "json",
+      "template": "files/settings.json"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-watcher",
+        "binary": "mesh-watcher",
+        "loads": [
+          "mesh-watcher"
+        ],
+        "env": {
+          "MESH_WATCHER_SETTINGS": "${dir:state}/settings.json",
+          "MESH_WATCHER_TELEGRAM_TOKEN_FILE": "${dir:state}/telegram-token"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/messenger/files/settings.json b/testdata/beside/mesh-catalog/modules/messenger/files/settings.json
new file mode 100644
index 0000000..6d22854
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/messenger/files/settings.json
@@ -0,0 +1,5 @@
+{
+  "time-zone": "",
+  "only-what-needs-me": [],
+  "messages-per-hour": 100
+}
diff --git a/testdata/beside/mesh-catalog/modules/messenger/module.json.captured b/testdata/beside/mesh-catalog/modules/messenger/module.json.captured
new file mode 100644
index 0000000..6045195
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/messenger/module.json.captured
@@ -0,0 +1,196 @@
+{
+  "module": "messenger",
+  "version": "1",
+  "slug": "msgr",
+  "runs-as": "messenger",
+  "seats": [
+    {
+      "name": "operator-channel",
+      "scope": "mesh",
+      "serves": [
+        "open",
+        "history",
+        "notify",
+        "tell",
+        "asks"
+      ],
+      "accepts": [
+        "ask",
+        "cancel",
+        "condition"
+      ],
+      "emits": [
+        "decided"
+      ],
+      "by-caller": [
+        "ask",
+        "cancel",
+        "condition",
+        "decided"
+      ],
+      "records": [
+        "asks"
+      ]
+    },
+    {
+      "name": "channel",
+      "scope": "mesh",
+      "kinded": true,
+      "accepts": [
+        "show",
+        "edit",
+        "send"
+      ]
+    },
+    {
+      "name": "intake",
+      "scope": "mesh",
+      "kinded": true,
+      "emits": [
+        "choice",
+        "link",
+        "failed",
+        "standing"
+      ],
+      "proofs": [
+        "code"
+      ]
+    }
+  ],
+  "claims": [
+    {
+      "name": "operator-channel",
+      "scope": "mesh",
+      "serves": [
+        "open",
+        "history",
+        "notify",
+        "tell",
+        "asks"
+      ]
+    }
+  ],
+  "uses": [
+    "channel"
+  ],
+  "consumes": [
+    "mesh-controller.condition-raised",
+    "mesh-controller.condition-changed",
+    "mesh-controller.condition-cleared",
+    "mesh-controller.plan-moved",
+    "intake.choice",
+    "intake.link",
+    "intake.failed",
+    "intake.standing"
+  ],
+  "emits": [
+    "refused"
+  ],
+  "invokes": [
+    "seat:mesh-controller.conditions",
+    "seat:mesh-controller.root-free",
+    "seat:issue-tracker.tracking"
+  ],
+  "state": [
+    "open",
+    "sent",
+    {
+      "name": "asks",
+      "ttl-seconds": 2592000
+    },
+    "identities",
+    "walks"
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker"
+  },
+  "secrets-owner": "messenger",
+  "tools": [
+    "messenger_status",
+    "messenger_recent",
+    "messenger_test",
+    "messenger_preview",
+    "messenger_check",
+    "messenger_identities",
+    "messenger_unlink"
+  ],
+  "config": {
+    "time-zone": {
+      "type": "string",
+      "description": "The time zone every time a message says is said in, an IANA name such as Europe/Brussels; empty is this machine's own zone.",
+      "trusted": true,
+      "default": ""
+    },
+    "desktop-machines": {
+      "type": "list",
+      "description": "The machines whose desktop showed the operator's messages, by node name. Nothing in this module reads it since the desk channel took the desktop over; it is taken so the file stays as a layer that still sets it makes it, until that layer drops it.",
+      "trusted": true,
+      "default": []
+    },
+    "only-what-needs-me": {
+      "type": "list",
+      "description": "The kinds of channel set to say only what needs the operator: a walk that delivered with nothing held and nothing open is not told there (ADR 0308 §4); empty is none.",
+      "trusted": true,
+      "default": []
+    },
+    "messages-per-hour": {
+      "type": "number",
+      "description": "messages per channel per hour before the rest are held as one; 0 turns the pause off. The tell verb has its own cap of 10 and is not counted here.",
+      "minimum": 0,
+      "maximum": 1000,
+      "trusted": false,
+      "default": 100
+    }
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "messenger",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/messenger"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "owner": "messenger",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "takes-config": ["time-zone", "desktop-machines", "only-what-needs-me", "messages-per-hour"],
+      "merge": "json",
+      "template": "files/settings.json",
+      "owner": "messenger"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/messenger",
+        "binary": "messenger",
+        "loads": [
+          "messenger"
+        ],
+        "env": {
+          "MESH_MESSENGER_SETTINGS": "${dir:state}/settings.json",
+          "MESH_MESSENGER_STATE": "${dir:state}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/minio/files/root.env b/testdata/beside/mesh-catalog/modules/minio/files/root.env
new file mode 100644
index 0000000..2255260
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/minio/files/root.env
@@ -0,0 +1,2 @@
+MINIO_ROOT_USER=meshroot
+MINIO_BROWSER_REDIRECT_URL=https://${bound:route:name-console}
diff --git a/testdata/beside/mesh-catalog/modules/minio/module.json.captured b/testdata/beside/mesh-catalog/modules/minio/module.json.captured
new file mode 100644
index 0000000..85b8253
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/minio/module.json.captured
@@ -0,0 +1,188 @@
+{
+  "module": "minio",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "holds the photos themselves (irreplaceable, kept by photos) for its consumers: a person takes each build, after a backup (hq ADR 0236)"
+  },
+  "provides": [
+    {
+      "name": "s3-bucket",
+      "scope": "mesh",
+      "identity": {
+        "max": 20,
+        "in": "an S3 access key"
+      }
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "api": {
+        "label": "files-api",
+        "endpoint": "s3"
+      },
+      "console": {
+        "label": "files",
+        "endpoint": "console"
+      }
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "bucket.created",
+    "bucket.removed"
+  ],
+  "listens": [
+    {
+      "name": "s3",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the S3 endpoint"
+    },
+    {
+      "name": "console",
+      "port": 9001,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the admin console"
+    }
+  ],
+  "serves": {
+    "s3-bucket": {
+      "scheme": "http",
+      "region": "eu-west",
+      "port": 9000,
+      "bucket": "${consumer:as:dns}"
+    }
+  },
+  "receives": {
+    "s3-bucket": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "s3-bucket": "${dir:grants}"
+  },
+  "own-secrets": {
+    "root": "${dir:state}/root.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "every consumer's bucket and its objects"
+      }
+    ],
+    "consumers": {
+      "s3-bucket": {
+        "class": "valuable",
+        "in": "data",
+        "why": "a consumer's objects are the only copy of what it stored; a consumer that keeps something irreplaceable here says so (kept-by)"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "root-env",
+      "type": "file",
+      "path": "${dir:state}/root.env",
+      "mode": "0600",
+      "template": "files/root.env"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "path": "/var/lib/minio-store",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "minio-net"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "minio",
+      "image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
+      "network": "minio-net",
+      "args": [
+        "server",
+        "/data",
+        "--console-address",
+        ":9001"
+      ],
+      "env-file": [
+        "${dir:state}/root.env"
+      ],
+      "ports": [
+        "9000",
+        "9001"
+      ],
+      "volumes": [
+        "/var/lib/minio-store:/data",
+        "${dir:state}/root.secret:/run/secrets/root:ro"
+      ],
+      "env": {
+        "MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
+        "MINIO_REGION": "eu-west"
+      }
+    },
+    {
+      "id": "client",
+      "type": "package",
+      "package": "minio-client"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_MINIO_ENDPOINT": "http://127.0.0.1:${port:9000}",
+          "MESH_MINIO_ROOT_USER": "meshroot",
+          "MESH_MINIO_ROOT_PASSWORD_FILE": "${dir:state}/root.secret",
+          "MESH_MINIO_REGION": "eu-west",
+          "MESH_MINIO_MC_BIN": "mcli",
+          "MESH_MINIO_MC_CONFIG": "${dir:state}/mc",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/model-usage/files/database.url b/testdata/beside/mesh-catalog/modules/model-usage/files/database.url
new file mode 100644
index 0000000..dc59da9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/model-usage/files/database.url
@@ -0,0 +1 @@
+postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
diff --git a/testdata/beside/mesh-catalog/modules/model-usage/module.json.captured b/testdata/beside/mesh-catalog/modules/model-usage/module.json.captured
new file mode 100644
index 0000000..50743a3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/model-usage/module.json.captured
@@ -0,0 +1,107 @@
+{
+  "module": "model-usage",
+  "version": "1",
+  "slug": "usage",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "model_usage"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "consumes": [
+    "*.usage.*"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "cache",
+        "why": "the mesh's own files for it; its records are in its database"
+      },
+      {
+        "id": "spool",
+        "path": "${dir:spool}",
+        "class": "valuable",
+        "why": "usage events the store could not take yet; after the bus gives one up, the only copy"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "database-url",
+      "type": "file",
+      "path": "${dir:state}/database.url",
+      "mode": "0600",
+      "template": "files/database.url"
+    },
+    {
+      "id": "spool",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "prepare",
+      "type": "process",
+      "name": "model-usage-prepare",
+      "artifact": "code",
+      "run": [
+        "node",
+        "prepare/index.js"
+      ],
+      "run-once": true,
+      "env": {
+        "DATABASE_URL_FILE": "${dir:state}/database.url"
+      },
+      "restart-on": [
+        "database-url"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "prepare/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "DATABASE_URL_FILE": "${dir:state}/database.url",
+          "USAGE_SPOOL": "${dir:spool}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mongodb/files/server-root.secret b/testdata/beside/mesh-catalog/modules/mongodb/files/server-root.secret
new file mode 100644
index 0000000..0ccabee
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mongodb/files/server-root.secret
@@ -0,0 +1 @@
+${secret:root}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/mongodb/module.json.captured b/testdata/beside/mesh-catalog/modules/mongodb/module.json.captured
new file mode 100644
index 0000000..cbb1268
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mongodb/module.json.captured
@@ -0,0 +1,170 @@
+{
+  "module": "mongodb",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "a provider whose restart drops every consumer on its machine, and which holds the photos' albums (irreplaceable, kept by photos): a person takes each build, after a backup (hq ADR 0236)"
+  },
+  "provides": [
+    {
+      "name": "mongodb-database",
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a MongoDB database name"
+      }
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "database.provisioned",
+    "database.deprovisioned"
+  ],
+  "consumes": [
+    "mongodb.database.provisioned",
+    "mongodb.database.deprovisioned"
+  ],
+  "listens": [
+    {
+      "name": "database",
+      "port": 27017,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a database"
+    }
+  ],
+  "serves": {
+    "mongodb-database": {
+      "port": 27017
+    }
+  },
+  "receives": {
+    "mongodb-database": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "mongodb-database": "${dir:grants}"
+  },
+  "own-secrets": {
+    "root": "${dir:state}/root.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "backup": {
+          "dump": "docker exec mongodb-server sh -c 'printf \"password: %s\\n\" \"$(cat /run/secrets/root)\" > /tmp/.backup.yaml && mongodump --quiet --config /tmp/.backup.yaml --username root --authenticationDatabase admin --archive; s=$?; rm -f /tmp/.backup.yaml; exit $s' > ${dir:dumps}/all.archive.partial && mv ${dir:dumps}/all.archive.partial ${dir:dumps}/all.archive",
+          "into": "dumps"
+        },
+        "why": "every consumer's database; copied by the dump, not as live files"
+      },
+      {
+        "id": "dumps",
+        "path": "${dir:dumps}",
+        "class": "rebuildable",
+        "why": "last night's dump, made again every night"
+      }
+    ],
+    "consumers": {
+      "mongodb-database": {
+        "class": "valuable",
+        "in": "data",
+        "why": "a consumer's documents are the only copy of what it wrote; a consumer that keeps something irreplaceable here says so (kept-by)"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "dumps",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "mongodb"
+    },
+    {
+      "id": "server-root",
+      "type": "file",
+      "path": "${dir:state}/server-root.secret",
+      "mode": "0400",
+      "owner": "999:999",
+      "template": "files/server-root.secret"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mongodb-server",
+      "image": "mongo@sha256:e3fa459b4f4b72f3257c67a23c145e250b8b5700f033860392c68539b998bbe3",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "database"
+      },
+      "network": "mongodb",
+      "env": {
+        "MONGO_INITDB_ROOT_USERNAME": "root",
+        "MONGO_INITDB_ROOT_PASSWORD_FILE": "/run/secrets/root"
+      },
+      "ports": [
+        "27017"
+      ],
+      "volumes": [
+        "${dir:data}:/data/db",
+        "${dir:state}/server-root.secret:/run/secrets/root:ro"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_PROVISION_MONGODB": "mongodb://root@127.0.0.1:${port:27017}/admin?authSource=admin",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/root.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mosquitto/files/bootstrap.env b/testdata/beside/mesh-catalog/modules/mosquitto/files/bootstrap.env
new file mode 100644
index 0000000..65b710e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mosquitto/files/bootstrap.env
@@ -0,0 +1,7 @@
+MESH_PROVISION_MQTT=127.0.0.1:${port:1883}
+MESH_PROVISION_ADMIN_USER=mesh-admin
+MESH_PROVISION_PASSWORD_FILE=${dir:mesh-state}/admin
+MESH_DYNSEC_FILE=${dir:data}/dynamic-security.json
+MESH_MQTT_CTRL_IMAGE=eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408
+MESH_MQTT_CTRL_CONTAINER=mosquitto
+MESH_MQTT_ADMIN_APPLIED_FILE=${dir:state}/admin.applied
diff --git a/testdata/beside/mesh-catalog/modules/mosquitto/files/mosquitto.conf b/testdata/beside/mesh-catalog/modules/mosquitto/files/mosquitto.conf
new file mode 100644
index 0000000..500c2a6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mosquitto/files/mosquitto.conf
@@ -0,0 +1,20 @@
+persistence true
+persistence_location /mosquitto/data
+
+log_dest stdout
+log_type warning
+log_type error
+log_type notice
+
+# Every client authenticates; identities and their per-topic ACLs are managed
+# at runtime by the dynamic security plugin, whose store the plugin itself owns.
+allow_anonymous false
+plugin /usr/lib/mosquitto_dynamic_security.so
+plugin_opt_config_file /mosquitto/data/dynamic-security.json
+
+# MQTT listener
+listener 1883
+
+# MQTT-over-WebSockets listener
+listener 8081
+protocol websockets
diff --git a/testdata/beside/mesh-catalog/modules/mosquitto/module.json.captured b/testdata/beside/mesh-catalog/modules/mosquitto/module.json.captured
new file mode 100644
index 0000000..21058e0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mosquitto/module.json.captured
@@ -0,0 +1,194 @@
+{
+  "module": "mosquitto",
+  "version": "1",
+  "slug": "mosq",
+  "provides": [
+    {
+      "name": "mqtt-topic",
+      "scope": "mesh",
+      "identity": {
+        "in": "a Mosquitto client and topic prefix"
+      }
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "topic.provisioned",
+    "topic.deprovisioned"
+  ],
+  "consumes": [
+    "mosquitto.topic.provisioned",
+    "mosquitto.topic.deprovisioned"
+  ],
+  "serves": {
+    "mqtt-topic": {
+      "scheme": "mqtt",
+      "port": 1883
+    }
+  },
+  "receives": {
+    "mqtt-topic": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "mqtt-topic": "${dir:grants}"
+  },
+  "own-secrets": {
+    "admin": {
+      "path": "${dir:mesh-state}/admin",
+      "taken": "at-start"
+    }
+  },
+  "listens": [
+    {
+      "name": "mqtt",
+      "port": 1883,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a topic namespace"
+    },
+    {
+      "name": "mqtt-websockets",
+      "port": 8081,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the same broker over MQTT-on-WebSockets, for browser clients"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "rebuildable",
+        "why": "retained messages and sessions; devices publish them again"
+      }
+    ],
+    "consumers": {
+      "mqtt-topic": {
+        "class": "rebuildable",
+        "in": "data",
+        "why": "retained messages are published again by the devices"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1883:1883",
+      "unknown": "program"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "${dir:state}/mosquitto.conf",
+      "mode": "0600",
+      "owner": "1883:1883",
+      "template": "files/mosquitto.conf"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "mosquitto"
+    },
+    {
+      "id": "bootstrap-env",
+      "type": "file",
+      "path": "${dir:state}/bootstrap.env",
+      "mode": "0600",
+      "template": "files/bootstrap.env"
+    },
+    {
+      "id": "bootstrap",
+      "type": "process",
+      "name": "mosquitto-bootstrap",
+      "artifact": "code",
+      "run": [
+        "node",
+        "bootstrap/index.js"
+      ],
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/bootstrap.env"
+      ],
+      "restart-on": [
+        "bootstrap-env",
+        "needs-admin"
+      ]
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mosquitto",
+      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "mqtt"
+      },
+      "network": "mosquitto",
+      "ports": [
+        "1883",
+        "8081"
+      ],
+      "volumes": [
+        "${dir:data}:/mosquitto/data",
+        "${dir:state}/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js",
+          "bootstrap/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_MQTT": "127.0.0.1:${port:1883}",
+          "MESH_PROVISION_ADMIN_USER": "mesh-admin",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:mesh-state}/admin",
+          "MESH_MQTT_CTRL_CONTAINER": "mosquitto"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mounts/files/mounts.conf b/testdata/beside/mesh-catalog/modules/mounts/files/mounts.conf
new file mode 100644
index 0000000..1d5f87d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mounts/files/mounts.conf
@@ -0,0 +1,11 @@
+# Written by the mesh (module mounts, novox/hq ADR 0263) from this machine's assignment: the settings
+# shares and sources, and the binding of nfs-share. Replaced on every push; change the settings, not this.
+# The module's process reads it as root every 30 seconds and writes one .mount and .automount per entry.
+shares=${config:shares}
+sources=${config:sources}
+server=${bound:nfs-share:from}
+at=${bound:nfs-share:at}
+account=${machine:account}
+node=${machine:name}
+passwords=${dir:state}
+state=${dir:state}
diff --git a/testdata/beside/mesh-catalog/modules/mounts/module.json.captured b/testdata/beside/mesh-catalog/modules/mounts/module.json.captured
new file mode 100644
index 0000000..488ebb9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mounts/module.json.captured
@@ -0,0 +1,160 @@
+{
+  "module": "mounts",
+  "version": "1",
+  "requires": [
+    "nfs-share"
+  ],
+  "reads": [
+    "nfs-server.exports"
+  ],
+  "invokes": [
+    "seat:mesh-controller.data"
+  ],
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-mounts",
+      "scope": "node",
+      "serves": [
+        "list",
+        "test",
+        "mount",
+        "unmount",
+        "adopt"
+      ]
+    }
+  ],
+  "tools": [
+    "mounts_list",
+    "mounts_exports",
+    "mounts_health"
+  ],
+  "state": [
+    {
+      "name": "shares",
+      "per-machine": true
+    }
+  ],
+    "config": {
+      "shares": {
+        "type": "string",
+        "description": "The shares of another machine this machine mounts: space-separated name=mountpoint, each optionally :ro, or none (novox/hq ADR 0263 rule 5).",
+        "trusted": true,
+        "default": "none"
+      },
+      "sources": {
+        "type": "string",
+        "description": "The occasional sources this machine mounts: space-separated name=smb://[<user>@]<host>/<share>@<mountpoint> or name=disk:<uuid>@<mountpoint>, each optionally :ro, or none (novox/hq ADR 0263 rule 6); an SMB source's username is in its entry, its password the secret smb-password-<name> (novox/hq ADR 0283).",
+        "trusted": true,
+        "default": "none"
+      }
+    },
+  "own-secrets": {
+    "smb-password-*": {
+      "path": "${dir:state}/smb-password-*.secret",
+      "issued-by": "outside"
+    }
+  },
+  "resources": [
+    {
+      "id": "nfs-utils",
+      "type": "package",
+      "package": "nfs-utils"
+    },
+    {
+      "id": "cifs-utils",
+      "type": "package",
+      "package": "cifs-utils"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/mesh-mounts",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/mesh-mounts/mounts.conf",
+      "mode": "0644",
+      "template": "files/mounts.conf"
+    },
+    {
+      "id": "bus-dir-parent",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "bus-dir",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts/from-bus",
+      "mode": "0755",
+      "owner": "${machine:account}",
+      "unknown": "program"
+    },
+    {
+      "id": "apply",
+      "type": "process",
+      "name": "mesh-mounts-apply",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "apply"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "mesh-mounts-watch",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "mounts_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mounts",
+        "binary": "mounts",
+        "loads": [
+          "mounts"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/mssql/files/backup.sql b/testdata/beside/mesh-catalog/modules/mssql/files/backup.sql
new file mode 100644
index 0000000..fd2ecce
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mssql/files/backup.sql
@@ -0,0 +1,14 @@
+SET NOCOUNT ON;
+DECLARE @n sysname, @s nvarchar(max);
+DECLARE c CURSOR LOCAL FAST_FORWARD FOR
+  SELECT name FROM sys.databases WHERE database_id > 4 AND state = 0 AND source_database_id IS NULL;
+OPEN c;
+FETCH NEXT FROM c INTO @n;
+WHILE @@FETCH_STATUS = 0
+BEGIN
+  SET @s = N'BACKUP DATABASE ' + QUOTENAME(@n) + N' TO DISK = N''/var/opt/mssql/backup/' + REPLACE(@n, N'''', N'''''') + N'.bak'' WITH INIT, COPY_ONLY, CHECKSUM';
+  EXEC (@s);
+  FETCH NEXT FROM c INTO @n;
+END
+CLOSE c;
+DEALLOCATE c;
diff --git a/testdata/beside/mesh-catalog/modules/mssql/files/sa.env b/testdata/beside/mesh-catalog/modules/mssql/files/sa.env
new file mode 100644
index 0000000..e7dd444
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mssql/files/sa.env
@@ -0,0 +1,2 @@
+ACCEPT_EULA=Y
+MSSQL_SA_PASSWORD=${secret:sa}
diff --git a/testdata/beside/mesh-catalog/modules/mssql/module.json.captured b/testdata/beside/mesh-catalog/modules/mssql/module.json.captured
new file mode 100644
index 0000000..ed4e448
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/mssql/module.json.captured
@@ -0,0 +1,174 @@
+{
+  "module": "mssql",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "a provider whose restart drops every consumer on its machine, and whose new version may upgrade its databases in place: a person takes each build, after a backup (hq ADR 0236)"
+  },
+  "provides": [
+    {
+      "name": "mssql-database",
+      "scope": "mesh",
+      "identity": {
+        "max": 128,
+        "in": "a SQL Server login and database name"
+      }
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "database.provisioned",
+    "database.deprovisioned"
+  ],
+  "consumes": [
+    "mssql.database.provisioned",
+    "mssql.database.deprovisioned"
+  ],
+  "listens": [
+    {
+      "name": "database",
+      "port": 1433,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a database, and the people who were given its address; the machine port is the assignment's to pin"
+    }
+  ],
+  "serves": {
+    "mssql-database": {}
+  },
+  "receives": {
+    "mssql-database": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "mssql-database": "${dir:grants}"
+  },
+  "own-secrets": {
+    "sa": "${dir:state}/sa.secret",
+    "reader": "${dir:state}/reader.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "backup": {
+          "dump": "{ cat ${dir:state}/sa.secret; echo; cat ${dir:state}/backup.sql; } | docker exec -i mssql sh -c 'read -r p; SQLCMDPASSWORD=\"$p\" exec /opt/mssql-tools18/bin/sqlcmd -C -b -S localhost -U sa -i /dev/stdin'",
+          "into": "dumps"
+        },
+        "why": "every consumer's database; copied by the dump, not as live files"
+      },
+      {
+        "id": "dumps",
+        "path": "${dir:dumps}",
+        "class": "rebuildable",
+        "why": "last night's dump, made again every night"
+      }
+    ],
+    "consumers": {
+      "mssql-database": {
+        "class": "valuable",
+        "in": "data",
+        "why": "a consumer's rows are the only copy of what it wrote"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "sa-env",
+      "type": "file",
+      "path": "${dir:state}/sa.env",
+      "mode": "0600",
+      "template": "files/sa.env"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "10001:0",
+      "unknown": "program"
+    },
+    {
+      "id": "dumps",
+      "type": "directory",
+      "path": "${dir:data}/backup",
+      "mode": "0700",
+      "owner": "10001:0",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "mssql"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mssql",
+      "image": "mcr.microsoft.com/mssql/server@sha256:4402d880dd4c34bfa7d8705e56a86cd6c88da80a1f6bbbe741f999e76264a090",
+      "network": "mssql",
+      "env-file": [
+        "${dir:state}/sa.env"
+      ],
+      "ports": [
+        "1433"
+      ],
+      "volumes": [
+        "${dir:data}:/var/opt/mssql"
+      ],
+      "secrets-in-environment": "the image documents only MSSQL_SA_PASSWORD, no _FILE and no configuration field; not convertible without a wrapper entrypoint"
+    },
+    {
+      "id": "backup-sql",
+      "type": "file",
+      "path": "${dir:state}/backup.sql",
+      "mode": "0600",
+      "template": "files/backup.sql"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_PROVISION_MSSQL": "mssql://sa@127.0.0.1:${port:1433}/master",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/sa.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_MSSQL_READER_PASSWORD_FILE": "${dir:state}/reader.secret"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/n8n/files/n8n-database.secret b/testdata/beside/mesh-catalog/modules/n8n/files/n8n-database.secret
new file mode 100644
index 0000000..e811e88
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/n8n/files/n8n-database.secret
@@ -0,0 +1 @@
+${secret:postgres-database}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/n8n/files/server.env b/testdata/beside/mesh-catalog/modules/n8n/files/server.env
new file mode 100644
index 0000000..2f74e0f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/n8n/files/server.env
@@ -0,0 +1,12 @@
+N8N_HOST=${bound:route:name}
+N8N_PORT=5678
+N8N_PROTOCOL=https
+WEBHOOK_URL=https://${bound:route:name}/
+NODE_FUNCTION_ALLOW_BUILTIN=*
+NODE_FUNCTION_ALLOW_EXTERNAL=*
+DB_TYPE=postgresdb
+DB_POSTGRESDB_HOST=${bound:postgres-database:at}
+DB_POSTGRESDB_PORT=${bound:postgres-database:port}
+DB_POSTGRESDB_DATABASE=${bound:postgres-database:as}
+DB_POSTGRESDB_USER=${bound:postgres-database:as}
+DB_POSTGRESDB_PASSWORD_FILE=/run/secrets/database
diff --git a/testdata/beside/mesh-catalog/modules/n8n/module.json.captured b/testdata/beside/mesh-catalog/modules/n8n/module.json.captured
new file mode 100644
index 0000000..975247f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/n8n/module.json.captured
@@ -0,0 +1,173 @@
+{
+  "module": "n8n",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "n8n"
+    },
+    "route": {
+      "label": "n8n",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "accesses": [
+    {
+      "id": "media",
+      "mode": "read-write"
+    }
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 5678,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the n8n editor, its REST API and the webhook endpoints workflows are triggered through; a public name is the route's"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "the instance's encryption key, settings and binary data; workflows are in the database"
+      },
+      {
+        "id": "cache",
+        "path": "${dir:cache}",
+        "class": "cache",
+        "why": "scratch space"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "cache",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "999:999",
+      "unknown": "program"
+    },
+    {
+      "id": "database-secret",
+      "type": "file",
+      "path": "${dir:state}/n8n-database.secret",
+      "mode": "0400",
+      "owner": "1000:1000",
+      "template": "files/n8n-database.secret"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "n8n"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/healthz/readiness",
+        "status": 200,
+        "needs": "postgres-database"
+      },
+      "name": "n8n",
+      "artifact": "server",
+      "network": "n8n",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "5678"
+      ],
+      "volumes": [
+        "${dir:data}:/home/node/.n8n",
+        "${dir:state}/n8n-database.secret:/run/secrets/database:ro",
+        "${access:media}:/media-library"
+      ]
+    },
+    {
+      "id": "cache-server",
+      "type": "container",
+      "name": "n8n-redis",
+      "image": "redis@sha256:8a1efc5f479551822b47424ccae982026b633f28818eab0387348120a61e10e2",
+      "network": "n8n",
+      "args": [
+        "redis-server",
+        "--appendonly",
+        "yes"
+      ],
+      "volumes": [
+        "${dir:cache}:/data"
+      ]
+    },
+    {
+      "id": "browser",
+      "type": "container",
+      "name": "n8n-selenium",
+      "image": "selenium/standalone-chrome@sha256:9ae1c78e9b2ca9fe4b22e57873b5ee34aeb8e814e3122293eef4c3abe4c5f448",
+      "network": "n8n",
+      "env": {
+        "SE_ENABLE_TRACING": "false",
+        "SE_NODE_MAX_SESSIONS": "5",
+        "SE_NODE_OVERRIDE_MAX_SESSIONS": "true"
+      }
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "N8N_BASE",
+        "image": "n8nio/n8n@sha256:4846eb2f4b874ab04cde7fc1e249d2ddaec66e9aea64439beb2972cfea88e3c0"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nats/files/nats.conf b/testdata/beside/mesh-catalog/modules/nats/files/nats.conf
new file mode 100644
index 0000000..e1d33eb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nats/files/nats.conf
@@ -0,0 +1,46 @@
+# The nats module's own server settings. Declared by the module, because a port, a TLS path
+# and a store directory are properties of the container this module raises: they live in its
+# image and its mounts and change when it does.
+#
+# The mesh writes accounts.conf beside this one and nothing else. A controller that wrote the
+# whole file would have to be kept in step with a Dockerfile it never sees.
+
+port: 4222
+# Monitoring on every interface *inside* the container, so the publish below can reach it; the publish
+# is 127.0.0.1:8222 on the machine, so nothing beyond the machine reaches it, and the module guards 8222
+# too. Bound to the container's own loopback until 2026-10-04, the published port answered nothing
+# (connection reset), and the only way in was `docker exec`.
+http: 0.0.0.0:8222
+
+# The mesh's own broker certificate — the one every machine already pins by fingerprint and the
+# controller already trusts (MESH_BROKER_CERTIFICATE). Serving the new bus with it means no
+# machine's pin changes when it moves, and no second certificate exists to be wrong about.
+tls {
+  cert_file: "/tls/tls.crt"
+  key_file: "/tls/tls.key"
+}
+
+# **No `verify`, deliberately, and it was `verify: true` until a probe ran this image.** That
+# setting makes the server demand a *client* certificate, and nothing in the mesh presents one: a
+# host pins this server's exact certificate and authenticates with the password the mesh minted
+# (novox/hq ADR 0004, design 25 §4), and so does a module's runtime. With it on, every connection
+# in the mesh is refused at the TLS handshake, before any password is looked at — and the error is
+# "client didn't provide a certificate", which reads as a client fault.
+#
+# TLS is still required: a tls block is what makes it required, and verify only decides whether
+# client certificates are checked. What is given up is a second factor the mesh has no machinery
+# to issue or rotate — a certificate per module per node — and what is kept is stronger than a
+# name check in both directions: an exact pin outward, a per-user password inward.
+
+jetstream {
+  store_dir: "/data"
+}
+
+# Every user of the mesh, composed by the controller and rewritten whenever a module is
+# assigned, a node enrols or a person's access changes.
+#
+# **Relative, and in this same directory, because it has to be.** An absolute include path is
+# resolved relative to the including file's directory, not from the root: nats-server given
+# `include /etc/nats/accounts.conf` from /etc/nats-server/nats.conf looks for
+# /etc/nats-server/etc/nats/accounts.conf and refuses to start. Verified against the server.
+include accounts.conf
diff --git a/testdata/beside/mesh-catalog/modules/nats/module.json.captured b/testdata/beside/mesh-catalog/modules/nats/module.json.captured
new file mode 100644
index 0000000..3ad66bc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nats/module.json.captured
@@ -0,0 +1,171 @@
+{
+  "module": "nats",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the bus: replaced only as a planned step a person starts (`bus upgrade`), its streams snapshotted first and checked after (hq ADR 0236); the controller holds this whatever is said here"
+  },
+  "provides": [
+    {
+      "name": "mesh-bus",
+      "scope": "mesh"
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-broker",
+      "scope": "mesh"
+    }
+  ],
+  "bus-users": "/var/lib/nats-module/conf/accounts.conf",
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [],
+  "consumes": [],
+  "listens": [
+    {
+      "name": "bus",
+      "port": 4222,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the mesh bus — every link the mesh has, over TLS, reached across the overlay"
+    }
+  ],
+  "tools": [
+    "nats_server",
+    "nats_connections",
+    "nats_closed_connections",
+    "nats_subscriptions",
+    "nats_streams",
+    "nats_backlog",
+    "nats_buckets",
+    "nats_users",
+    "nats_user_can"
+  ],
+  "guards": [
+    8222
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "jetstream",
+        "path": "${dir:jetstream-data}",
+        "class": "valuable",
+        "active": "1d",
+        "backup": {
+          "dump": "docker exec -i mesh-broker-nats mesh-nats-snapshot snapshot < ${dir:mesh-state}/broker > ${dir:snapshots}/bus.tar.partial && mv ${dir:snapshots}/bus.tar.partial ${dir:snapshots}/bus.tar || { rm -f ${dir:snapshots}/bus.tar.partial; exit 1; }",
+          "into": "snapshots"
+        },
+        "why": "the bus's streams and key-value buckets: the hand-act log, conditions, every module's state; written all the time, so copied by the server's own snapshot of each stream (novox/hq ADR 0235), never as live files"
+      },
+      {
+        "id": "snapshots",
+        "path": "${dir:snapshots}",
+        "class": "rebuildable",
+        "why": "last night's snapshot of every stream with its manifest, made again every night"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "jetstream-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-broker-nats",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "conf-dir",
+      "type": "directory",
+      "path": "/var/lib/nats-module/conf",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "snapshots",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "/var/lib/nats-module/conf/nats.conf",
+      "template": "files/nats.conf",
+      "mode": "0644"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "mesh-broker-nats",
+      "ports": [
+        "4222:4222",
+        "127.0.0.1:8222:8222"
+      ],
+      "volumes": [
+        "/var/lib/mesh-broker-nats:/data",
+        "/var/lib/nats-module/conf:/etc/nats:ro",
+        "${access:tls}:/tls:ro"
+      ],
+      "artifact": "server"
+    }
+  ],
+  "accesses": [
+    {
+      "id": "tls",
+      "path": "/var/lib/mesh-broker-tls",
+      "mode": "read"
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "NATS_BASE",
+        "image": "nats@sha256:e4bf19f15fd3218814a4e3c9e0064e1334bd8aa20d5984b9f1a0afd084f8cc00"
+      },
+      {
+        "arg": "GO_BASE",
+        "image": "golang@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "image",
+        "from": "Dockerfile"
+      },
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/nats-tools",
+        "binary": "nats-tools",
+        "loads": [
+          "nats-tools"
+        ],
+        "env": {
+          "MESH_NATS_MONITOR": "http://127.0.0.1:8222",
+          "MESH_NATS_CONTAINER": "mesh-broker-nats",
+          "MESH_NATS_USERS_FILE": "/etc/nats/accounts.conf"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/netcheck/module.json.captured b/testdata/beside/mesh-catalog/modules/netcheck/module.json.captured
new file mode 100644
index 0000000..ec01003
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/netcheck/module.json.captured
@@ -0,0 +1,57 @@
+{
+  "module": "netcheck",
+  "version": "1",
+  "emits": [
+    "tunnel.endpoint-changed",
+    "tunnel.handshake-stale",
+    "tunnel.handshake-fresh"
+  ],
+  "tools": [
+    "netcheck_tunnel",
+    "netcheck_tcp",
+    "netcheck_dns",
+    "netcheck_http",
+    "netcheck_listening"
+  ],
+  "replaces": {
+    "netcheck_listening": [
+      "ss -lunt",
+      "ss -ltn",
+      "netstat -lnt"
+    ],
+    "netcheck_dns": [
+      "dig",
+      "nslookup"
+    ],
+    "netcheck_tunnel": [
+      "wg show",
+      "wg show mesh0 dump"
+    ]
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/netcheck",
+        "binary": "netcheck",
+        "loads": [
+          "netcheck"
+        ]
+      },
+      {
+        "name": "tools-typescript",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/networkmanager/files/50-mesh.conf b/testdata/beside/mesh-catalog/modules/networkmanager/files/50-mesh.conf
new file mode 100644
index 0000000..f8c8e8a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/networkmanager/files/50-mesh.conf
@@ -0,0 +1,63 @@
+# Managed by the mesh (module networkmanager). Replaced on every push; edit the
+# catalogue instead.
+#
+# This machine's uplink is NetworkManager's, and this file is the whole of what
+# the mesh asks of it (novox/hq ADR 0117): leave the resolver file to the mesh,
+# and leave the private network's interface alone. Nothing more. The mesh never
+# declares a connection profile, an address, a route, a wireless network or its
+# credentials — those are joined at the machine, by the person using it, and
+# the link they make is the only channel the mesh reaches this machine over. A
+# push that got a link wrong could not be undone by the next one.
+#
+# A drop-in of the mesh's own, beside NetworkManager.conf and whatever else the
+# operator keeps in this directory. NetworkManager reads the files here sorted by
+# name and a later one wins a key it sets again — so a file of the operator's
+# that sorts after this one (any name starting with a letter does) and sets dns=
+# or unmanaged-devices= overrides it. That is the operator's to decide, and the
+# reason this file sets nothing but the two keys it must.
+#
+# NetworkManager itself is the machine's: the mesh never starts, stops, enables
+# or disables it (its service is declared with no state), because stopping it
+# takes every link down, this machine's channel to the mesh included — and a
+# module unassigned by mistake must not be able to do that. When this file
+# changes, a running NetworkManager is reloaded (its D-Bus Reload call, which
+# re-reads its configuration — NetworkManager(8)), never restarted.
+
+[main]
+# The resolver file is the mesh's: this module writes /etc/resolv.conf itself,
+# listing the mesh's resolvers (novox/hq ADR 0223). Without this line
+# NetworkManager rewrites that file on
+# every connectivity change — every network joined, every lease renewed —
+# and the mesh's resolver is silently replaced while every surface of the mesh
+# still reads green. none: "NetworkManager will not modify resolv.conf. This
+# implies rc-manager unmanaged" (NetworkManager.conf(5), 1.58). On an adopted
+# machine the predecessor wrote the same line in a file of its own; both say one
+# thing, and the predecessor's is retired by hand after the take.
+#
+# Not NetworkManager's own global DNS ([global-dns-domain-*] with rc-manager=file):
+# it writes its own header and composes the options line itself, so it cannot
+# write the mesh's file byte for byte, and the three uplink modules would write
+# three different files for one fact. dns=none, and the file declared beside it.
+dns=none
+
+[keyfile]
+# mesh0 is the private network's interface: the mesh brings it up and the mesh
+# alone configures it. A manager that considers every interface its own could
+# try to configure it, or tear it down on a profile change.
+#
+# unmanaged-devices rather than a [device-mesh0] section with managed=0, because
+# NetworkManager.conf(5) says a device unmanaged by this key "is strictly
+# unmanaged and cannot be overruled by using the API like nmcli device set
+# $IFNAME managed yes", while device*.managed "can be overruled at runtime via
+# D-Bus". The same page adds that device*.managed "may be a better choice" for
+# exactly those reasons — for an interface the operator might want to hand back
+# at runtime. For the mesh's own interface, strict is the point.
+#
+# += rather than =: the same page documents appending to a list-valued key set
+# earlier ("plugins+=another-plugin") as an extension of its key file format,
+# and unmanaged-devices is a device list. = would replace whatever devices the
+# operator already keeps NetworkManager away from; += adds this one to them
+# (novox/hq ADR 0102: a list is added to, never replaced). A file of the
+# operator's read after this one that sets the key with = replaces it again;
+# that is the operator's to decide.
+unmanaged-devices+=interface-name:mesh0
diff --git a/testdata/beside/mesh-catalog/modules/networkmanager/module.json.captured b/testdata/beside/mesh-catalog/modules/networkmanager/module.json.captured
new file mode 100644
index 0000000..68ace34
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/networkmanager/module.json.captured
@@ -0,0 +1,71 @@
+{
+  "module": "networkmanager",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's network: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
+  },
+  "slug": "nm",
+  "requires": [
+    "wildcard-resolution"
+  ],
+  "capabilities": [
+    "package-manager",
+    "service-manager",
+    "uplink-networkmanager"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/uplink-tools",
+        "binary": "uplink-tools",
+        "loads": [
+          "uplink-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "facts": {
+    "resolvers": {
+      "path": "/etc/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's uplink:\n# the program that manages the machine's network would otherwise rewrite this\n# file on every change of network, so its holder is the one that writes it\n# (novox/hq ADR 0117, ADR 0223). Replaced on every push; edit nothing here.\n#\n# Every resolver of the mesh, by address, and nothing else (novox/hq ADR 0223) \u2014\n# this machine's own first when it holds one, then the others by name. Each\n# answers the mesh's names from the same roster and forwards every other name, so\n# whichever answers first gives the one answer. There is no public resolver here:\n# a C library that asks every listed server at once and takes the first reply \u2014\n# musl, so every Alpine container \u2014 took a public resolver's \"no such name\" for\n# a mesh name and failed. A machine that reaches none of these has no names until\n# it does. Containers copy these lines from their machine.\n{{range index .Holders \"mesh-dns-resolver\"}}nameserver {{.Address}}\n{{end}}options timeout:1 attempts:2 edns0\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "networkmanager"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/NetworkManager/conf.d/50-mesh.conf",
+      "mode": "0644",
+      "template": "files/50-mesh.conf"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "NetworkManager.service",
+      "reload-on": [
+        "config"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/nextcloud-client/module.json.captured b/testdata/beside/mesh-catalog/modules/nextcloud-client/module.json.captured
new file mode 100644
index 0000000..af71acb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nextcloud-client/module.json.captured
@@ -0,0 +1,38 @@
+{
+  "module": "nextcloud-client",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "nextcloud_status",
+    "nextcloud_log",
+    "nextcloud_restart",
+    "nextcloud_check"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "nextcloud-client"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/nextcloud-client-tools",
+        "binary": "nextcloud-client-tools",
+        "loads": [
+          "nextcloud-client-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nextcloud/files/config.json b/testdata/beside/mesh-catalog/modules/nextcloud/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nextcloud/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/nextcloud/files/server.env b/testdata/beside/mesh-catalog/modules/nextcloud/files/server.env
new file mode 100644
index 0000000..df6e20f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nextcloud/files/server.env
@@ -0,0 +1,14 @@
+POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}
+POSTGRES_DB=${bound:postgres-database:as}
+POSTGRES_USER=${bound:postgres-database:as}
+POSTGRES_PASSWORD=${secret:postgres-database}
+NEXTCLOUD_ADMIN_USER=mesh-admin
+NEXTCLOUD_ADMIN_PASSWORD=${secret:admin}
+OBJECTSTORE_S3_HOST=${bound:s3-bucket:at}
+OBJECTSTORE_S3_PORT=${bound:s3-bucket:port}
+OBJECTSTORE_S3_BUCKET=${bound:s3-bucket:bucket}
+OBJECTSTORE_S3_KEY=${bound:s3-bucket:as}
+OBJECTSTORE_S3_SECRET=${secret:s3-bucket}
+OBJECTSTORE_S3_SSL=false
+OBJECTSTORE_S3_USEPATH_STYLE=true
+OBJECTSTORE_S3_REGION=${bound:s3-bucket:region}
diff --git a/testdata/beside/mesh-catalog/modules/nextcloud/module.json.captured b/testdata/beside/mesh-catalog/modules/nextcloud/module.json.captured
new file mode 100644
index 0000000..2854a16
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nextcloud/module.json.captured
@@ -0,0 +1,168 @@
+{
+  "module": "nextcloud",
+  "version": "1",
+  "slug": "ncloud",
+  "requires": [
+    "postgres-database",
+    "s3-bucket",
+    "route"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "nextcloud"
+    },
+    "route": {
+      "label": "drive",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
+  },
+  "emits": [
+    "user.created",
+    "share.created"
+  ],
+  "own-secrets": {
+    "admin": "${dir:state}/admin.secret"
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "files and sync, over http; a public name is a route grant later"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "html",
+        "path": "${dir:html}",
+        "class": "valuable",
+        "why": "the instance's configuration, its secret and installed apps; the files are in the object store"
+      }
+    ]
+  },
+  "config": {
+    "container": {
+      "type": "string",
+      "description": "The name of the container the module's tools run Nextcloud's occ in; empty is nextcloud.",
+      "trusted": true,
+      "default": ""
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach Nextcloud's sharing API at, as a URL; empty is this machine's Nextcloud on its port.",
+      "trusted": true,
+      "default": ""
+    },
+    "user": {
+      "type": "string",
+      "description": "The Nextcloud account the module's tools act as; empty is admin.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "html",
+      "type": "directory",
+      "mode": "0750",
+      "owner": "33:33",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/status.php",
+        "status": 200,
+        "body": "\"installed\":true",
+        "needs": "postgres-database"
+      },
+      "name": "nextcloud",
+      "image": "nextcloud@sha256:fb966733647ea03f0446b0c22eac9733c8eb616d37b960caca9d4c3010e14a08",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "80"
+      ],
+      "volumes": [
+        "${dir:html}:/var/www/html"
+      ],
+      "secrets-in-environment": "the image honours POSTGRES_PASSWORD_FILE and NEXTCLOUD_ADMIN_PASSWORD_FILE (entrypoint file_env); OBJECTSTORE_S3_SECRET has none and needs a generated config fragment; convertible, awaiting a bed"
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "takes-config": ["container", "url", "user"],
+      "merge": "json"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NEXTCLOUD_URL": "http://127.0.0.1:${port:80}",
+          "MESH_NEXTCLOUD_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_NEXTCLOUD_ADMIN_USER": "mesh-admin",
+          "MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nfs-server/files/50-mesh.conf b/testdata/beside/mesh-catalog/modules/nfs-server/files/50-mesh.conf
new file mode 100644
index 0000000..2640a8b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nfs-server/files/50-mesh.conf
@@ -0,0 +1,12 @@
+# Written by the mesh (module nfs-server, novox/hq ADR 0263). Replaced on every push; a drop-in of
+# the operator's that sorts after this one overrides it, and is theirs.
+#
+# NFS version 4 only: a client needs port 2049 and nothing else, so the module opens nothing more
+# than that, to the private network. Version 3 needs rpcbind and mountd, on ports the mesh does not open.
+[nfsd]
+vers2=n
+vers3=n
+vers4=y
+vers4.0=n
+vers4.1=y
+vers4.2=y
diff --git a/testdata/beside/mesh-catalog/modules/nfs-server/files/shares.conf b/testdata/beside/mesh-catalog/modules/nfs-server/files/shares.conf
new file mode 100644
index 0000000..f25f026
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nfs-server/files/shares.conf
@@ -0,0 +1,10 @@
+# Written by the mesh (module nfs-server, novox/hq ADR 0263) from this machine's assignment.
+# Replaced on every push; change the `shares` setting, never this file.
+#
+# The shares: name=folder, or name=folder:ro, one share per folder. The grants: share=node:rw|ro[,…],
+# which nodes may mount each and how. The module's process exports a share to a node's private address
+# only when it is granted here and that node's mounts module wants it, every client mapped to the
+# folder's owner, and only to addresses inside the range below.
+shares=${config:shares}
+grants=${config:grants}
+range=${machine:mesh-range}
diff --git a/testdata/beside/mesh-catalog/modules/nfs-server/module.json.captured b/testdata/beside/mesh-catalog/modules/nfs-server/module.json.captured
new file mode 100644
index 0000000..f9994d1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nfs-server/module.json.captured
@@ -0,0 +1,191 @@
+{
+  "module": "nfs-server",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the folders other machines mount: a build that breaks the exports leaves every client's mount hanging or refused, and the gate on this one machine does not see the clients (hq ADR 0236, ADR 0263)"
+  },
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "provides": [
+    {
+      "name": "nfs-share",
+      "scope": "mesh",
+      "identity": false
+    }
+  ],
+  "data": {
+    "consumers": {
+      "nfs-share": {
+        "class": "none",
+        "why": "the shared folders are the operator's data (hq ADR 0051): what a client writes lands in them, and they are protected where the operator declares them, never by this module, which keeps nothing of a consumer's"
+      }
+    }
+  },
+  "claims": [
+    {
+      "name": "node-nfs-server",
+      "scope": "node",
+      "serves": [
+        "exports",
+        "clients",
+        "test",
+        "reload",
+        "adopt"
+      ]
+    }
+  ],
+  "state": [
+    {
+      "name": "exports",
+      "ttl-seconds": 120,
+      "per-machine": true
+    }
+  ],
+  "reads": [
+    "mounts.shares"
+  ],
+  "invokes": [
+    "seat:mesh-controller.seats",
+    "seat:mesh-controller.data"
+  ],
+    "config": {
+      "shares": {
+        "type": "string",
+        "description": "The folders this machine exports, as space-separated name=path; the operator's, with no default (novox/hq ADR 0263).",
+        "trusted": true,
+        "required": true
+      },
+      "grants": {
+        "type": "string",
+        "description": "Which nodes may mount which share, and how: share=node:rw|ro[,node:rw|ro], entries separated by spaces, or none to export to no node whatever a node wants (novox/hq ADR 0263).",
+        "trusted": true,
+        "default": "none"
+      }
+    },
+  "facts": {
+    "machines": {
+      "path": "/etc/nfs-server/machines",
+      "template": "# Written by the mesh (module nfs-server, novox/hq ADR 0263): every machine of the mesh and its private\n# address, from which the module takes a node's address. Replaced on every push.\n{{range .Machines}}{{.Name}} {{.Address}}\n{{end}}"
+    }
+  },
+  "tools": [
+    "nfs_health"
+  ],
+  "listens": [
+    {
+      "name": "nfs",
+      "port": 2049,
+      "protocol": "tcp",
+      "from": "mesh",
+      "fixed": true,
+      "why": "the shares, to the mesh's machines only (hq ADR 0263): NFS version 4 alone, which needs no other port, and never the home network, where a device that is not a node could claim any user id"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "nfs-utils"
+    },
+    {
+      "id": "nfs-conf",
+      "type": "file",
+      "path": "/etc/nfs.conf.d/50-mesh.conf",
+      "mode": "0644",
+      "template": "files/50-mesh.conf"
+    },
+    {
+      "id": "run-dir",
+      "type": "directory",
+      "path": "/run/nfs-server",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "service",
+      "unit": "nfs-server.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "nfs-conf"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "wants-dir-parent",
+      "type": "directory",
+      "path": "/var/lib/nfs-server",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "wants-dir",
+      "type": "directory",
+      "path": "/var/lib/nfs-server/from-bus",
+      "mode": "0755",
+      "owner": "${machine:account}",
+      "unknown": "program"
+    },
+    {
+      "id": "exports",
+      "type": "process",
+      "name": "nfs-server-exports",
+      "artifact": "tools",
+      "run": [
+        "./nfs-server",
+        "exports"
+      ],
+      "restart-on": [
+        "config"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "nfs_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/nfs-server",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/nfs-server/shares.conf",
+      "mode": "0644",
+      "template": "files/shares.conf"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/nfs-server",
+        "binary": "nfs-server",
+        "loads": [
+          "nfs-server"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nftables/files/mesh-filter.service b/testdata/beside/mesh-catalog/modules/nftables/files/mesh-filter.service
new file mode 100644
index 0000000..5a6cced
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nftables/files/mesh-filter.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=The mesh's packet filter, derived from what is assigned to this node
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=nft -f /etc/nftables.conf
+ExecReload=nft -f /etc/nftables.conf
+ExecStop=nft delete table inet mesh
+
+[Install]
+WantedBy=multi-user.target
diff --git a/testdata/beside/mesh-catalog/modules/nftables/files/mesh.conf b/testdata/beside/mesh-catalog/modules/nftables/files/mesh.conf
new file mode 100644
index 0000000..f1a7bb0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nftables/files/mesh.conf
@@ -0,0 +1,5 @@
+# The mesh: stopping the stock unit deletes only the mesh's table, never the whole ruleset
+# (novox/hq ADR 0100) — a flush would take the container runtime's rules and any firewall with it.
+[Service]
+ExecStop=
+ExecStop=nft delete table inet mesh
diff --git a/testdata/beside/mesh-catalog/modules/nftables/module.json.captured b/testdata/beside/mesh-catalog/modules/nftables/module.json.captured
new file mode 100644
index 0000000..b7b0c83
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nftables/module.json.captured
@@ -0,0 +1,91 @@
+{
+  "module": "nftables",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's packet filter: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
+  },
+  "capabilities": [
+    "firewall"
+  ],
+  "claims": [
+    {
+      "name": "node-packet-filter",
+      "scope": "node",
+      "serves": [
+        "rules",
+        "reload",
+        "remove"
+      ]
+    }
+  ],
+  "filtering": {
+    "into": "/etc/nftables.conf"
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "nftables"
+    },
+    {
+      "id": "legacy-tools",
+      "type": "package",
+      "package": "iptables"
+    },
+    {
+      "id": "unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-filter.service",
+      "template": "files/mesh-filter.service",
+      "mode": "0644"
+    },
+    {
+      "id": "stock-unit-stop",
+      "type": "file",
+      "path": "/etc/systemd/system/nftables.service.d/mesh.conf",
+      "template": "files/mesh.conf",
+      "mode": "0644"
+    },
+    {
+      "id": "load",
+      "type": "service",
+      "unit": "mesh-filter.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "unit",
+        "stock-unit-stop"
+      ],
+      "reload-on": [
+        "filtering"
+      ]
+    },
+    {
+      "id": "front-end",
+      "type": "package",
+      "package": "ufw",
+      "absent": true
+    }
+  ],
+  "tools": [
+    "firewall_rules"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nm-applet/module.json.captured b/testdata/beside/mesh-catalog/modules/nm-applet/module.json.captured
new file mode 100644
index 0000000..1c6764e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nm-applet/module.json.captured
@@ -0,0 +1,37 @@
+{
+  "module": "nm-applet",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "nm_applet_status",
+    "nm_applet_restart",
+    "nm_applet_check"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "network-manager-applet"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/nm-applet-tools",
+        "binary": "nm-applet-tools",
+        "loads": [
+          "nm-applet-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/node-env/files/50-mesh.conf b/testdata/beside/mesh-catalog/modules/node-env/files/50-mesh.conf
new file mode 100644
index 0000000..3aebc87
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/node-env/files/50-mesh.conf
@@ -0,0 +1,4 @@
+# The operator account's environment for its service manager and graphical session, generated by
+# the mesh (module node-env, novox/hq ADR 0203). Do not edit: this file is replaced at every push.
+# The same facts as ~/.config/mesh/environment.sh, in environment.d(5) syntax.
+${collected:environment:systemd}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/node-env/files/environment.sh b/testdata/beside/mesh-catalog/modules/node-env/files/environment.sh
new file mode 100644
index 0000000..c28adf3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/node-env/files/environment.sh
@@ -0,0 +1,5 @@
+# The operator account's environment, generated by the mesh (module node-env, novox/hq ADR 0203).
+# Do not edit: this file is replaced at every push. Every line names the module that contributed it.
+# Sourced by the login shell from its always-read startup file (for zsh, ~/.zshenv), so a script, a
+# login and the shell's execute verb all see it. Your own variables belong in your shell's own lines.
+${collected:environment:posix}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/node-env/module.json.captured b/testdata/beside/mesh-catalog/modules/node-env/module.json.captured
new file mode 100644
index 0000000..85fd7e5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/node-env/module.json.captured
@@ -0,0 +1,55 @@
+{
+  "module": "node-env",
+  "version": "1",
+  "moved": true,
+  "claims": [
+    {
+      "name": "node-environment",
+      "scope": "node"
+    }
+  ],
+  "resources": [
+    {
+      "id": "mesh-config-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/mesh",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["forge.credentials"]
+    },
+    {
+      "id": "environment-d",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/environment.d",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "posix",
+      "type": "file",
+      "path": "${machine:account-home}/.config/mesh/environment.sh",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/environment.sh"
+    },
+    {
+      "id": "systemd",
+      "type": "file",
+      "path": "${machine:account-home}/.config/environment.d/50-mesh.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/50-mesh.conf"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/nodejs/module.json.captured b/testdata/beside/mesh-catalog/modules/nodejs/module.json.captured
new file mode 100644
index 0000000..c357344
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodejs/module.json.captured
@@ -0,0 +1,25 @@
+{
+  "module": "nodejs",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "provides": [
+    {
+      "name": "node-toolchain",
+      "reach": "machine"
+    }
+  ],
+  "resources": [
+    {
+      "id": "nodejs",
+      "type": "package",
+      "package": "nodejs"
+    },
+    {
+      "id": "npm",
+      "type": "package",
+      "package": "npm"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/nodered/files/config.json b/testdata/beside/mesh-catalog/modules/nodered/files/config.json
new file mode 100644
index 0000000..a396fbd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodered/files/config.json
@@ -0,0 +1,3 @@
+{
+  "token": "${secret:api-token}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/nodered/files/mqtt.env b/testdata/beside/mesh-catalog/modules/nodered/files/mqtt.env
new file mode 100644
index 0000000..5331f3c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodered/files/mqtt.env
@@ -0,0 +1,4 @@
+MESH_NODERED_URL=http://127.0.0.1:${port:1880}
+MESH_NODERED_CONFIG_FILE=${dir:mesh-state}/config.json
+MESH_PROVISIONS_DIR=${dir:state}
+MESH_WRITTEN_DIR=${dir:written}
diff --git a/testdata/beside/mesh-catalog/modules/nodered/files/settings.js b/testdata/beside/mesh-catalog/modules/nodered/files/settings.js
new file mode 100644
index 0000000..0d0f351
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodered/files/settings.js
@@ -0,0 +1,48 @@
+// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change
+// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and
+// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user
+// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+
+const ADMIN_PASSWORD = "${secret:admin}";
+const API_TOKEN = "${secret:api-token}";
+const ADMIN = { username: "admin", permissions: "*" };
+
+const settings = JSON.parse(fs.readFileSync(path.join(__dirname, "settings.json"), "utf8"));
+// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the
+// assignment's way to set the zone flows schedule and format in; mqtt names the broker nodes the
+// module's MQTT step keeps pointed at the mesh's broker; topics is what nodered asks the broker for.
+if (settings.timeZone) process.env.TZ = settings.timeZone;
+delete settings.timeZone;
+delete settings.endpoints;
+delete settings.mqtt;
+delete settings.topics;
+
+function same(a, b) {
+  const x = crypto.createHash("sha256").update(String(a)).digest();
+  const y = crypto.createHash("sha256").update(String(b)).digest();
+  return crypto.timingSafeEqual(x, y);
+}
+
+// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its
+// settings held, so the password people already use keeps working.
+function passwordMatches(given) {
+  if (/^\$2[aby]\$\d\d\$/.test(ADMIN_PASSWORD)) return require("bcryptjs").compare(String(given), ADMIN_PASSWORD);
+  return Promise.resolve(same(given, ADMIN_PASSWORD));
+}
+
+module.exports = Object.assign(settings, {
+  uiPort: 1880,
+  adminAuth: {
+    type: "credentials",
+    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),
+    authenticate: (username, password) =>
+      username === ADMIN.username
+        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))
+        : Promise.resolve(null),
+    // The module's own tools call the admin API with this bearer token.
+    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: "mesh", permissions: "*" } : null),
+  },
+});
diff --git a/testdata/beside/mesh-catalog/modules/nodered/files/settings.json b/testdata/beside/mesh-catalog/modules/nodered/files/settings.json
new file mode 100644
index 0000000..93cf157
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodered/files/settings.json
@@ -0,0 +1,14 @@
+{
+  "flowFile": "flows.json",
+  "flowFilePretty": true,
+  "diagnostics": { "enabled": true, "ui": true },
+  "runtimeState": { "enabled": false, "ui": false },
+  "logging": { "console": { "level": "info", "metrics": false, "audit": false } },
+  "exportGlobalContextKeys": false,
+  "externalModules": {},
+  "editorTheme": { "projects": { "enabled": false } },
+  "functionExternalModules": true,
+  "debugMaxLength": 1000,
+  "mqttReconnectTime": 15000,
+  "serialReconnectTime": 15000
+}
diff --git a/testdata/beside/mesh-catalog/modules/nodered/module.json.captured b/testdata/beside/mesh-catalog/modules/nodered/module.json.captured
new file mode 100644
index 0000000..f8068dd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/nodered/module.json.captured
@@ -0,0 +1,297 @@
+{
+  "module": "nodered",
+  "version": "1",
+  "emits": [
+    "flows.deployed"
+  ],
+  "own-secrets": {
+    "admin": {
+      "path": "${dir:mesh-state}/admin",
+      "taken": "at-start"
+    },
+    "api-token": {
+      "path": "${dir:mesh-state}/api-token",
+      "taken": "at-start"
+    }
+  },
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 1880,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the flow editor and the endpoints flows expose"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "flows and their credentials"
+      }
+    ]
+  },
+  "config": {
+    "flow-file": {
+      "type": "string",
+      "description": "Node-RED's flowFile setting: the file in the user directory the flows are kept in.",
+      "trusted": true,
+      "default": "flows.json"
+    },
+    "flow-file-pretty": {
+      "type": "boolean",
+      "description": "Node-RED's flowFilePretty setting: whether the flows file is written indented.",
+      "trusted": true,
+      "default": true
+    },
+    "diagnostics": {
+      "type": "object",
+      "description": "Node-RED's diagnostics setting: whether its diagnostics report is on, and shown in the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": true,
+        "ui": true
+      }
+    },
+    "runtime-state": {
+      "type": "object",
+      "description": "Node-RED's runtimeState setting: whether flows may be started and stopped from the editor.",
+      "trusted": true,
+      "default": {
+        "enabled": false,
+        "ui": false
+      }
+    },
+    "logging": {
+      "type": "object",
+      "description": "Node-RED's logging setting: the console log's level, and whether metrics and audit events are logged.",
+      "trusted": true,
+      "default": {
+        "console": {
+          "level": "info",
+          "metrics": false,
+          "audit": false
+        }
+      }
+    },
+    "export-global-context-keys": {
+      "type": "boolean",
+      "description": "Node-RED's exportGlobalContextKeys setting: whether a function node may list the global context's keys.",
+      "trusted": true,
+      "default": false
+    },
+    "external-modules": {
+      "type": "object",
+      "description": "Node-RED's externalModules setting: which modules the editor may install, and from where.",
+      "trusted": true,
+      "default": {}
+    },
+    "editor-theme": {
+      "type": "object",
+      "description": "Node-RED's editorTheme setting: the editor's look and features, projects among them.",
+      "trusted": true,
+      "default": {
+        "projects": {
+          "enabled": false
+        }
+      }
+    },
+    "function-external-modules": {
+      "type": "boolean",
+      "description": "Node-RED's functionExternalModules setting: whether a function node may load modules of its own.",
+      "trusted": true,
+      "default": true
+    },
+    "debug-max-length": {
+      "type": "number",
+      "description": "Node-RED's debugMaxLength setting: the most characters a debug message shows, a count.",
+      "trusted": true,
+      "default": 1000
+    },
+    "mqtt-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's mqttReconnectTime setting: how long an MQTT node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "serial-reconnect-time": {
+      "type": "number",
+      "description": "Node-RED's serialReconnectTime setting: how long a serial node waits before reconnecting, in milliseconds.",
+      "trusted": true,
+      "default": 15000
+    },
+    "mqtt": {
+      "type": "object",
+      "description": "The broker nodes the module's MQTT step keeps pointed at the mesh's broker, as {\"brokers\": [their ids]}; empty, none.",
+      "trusted": true,
+      "default": {}
+    },
+    "time-zone": {
+      "type": "string",
+      "description": "The time zone the flows schedule and format in, an IANA name such as Europe/Brussels; unset, the container's UTC.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "written",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "settings-code",
+      "type": "file",
+      "path": "${dir:state}/settings.js",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "template": "files/settings.js"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "merge": "json",
+      "takes-config": [{"key": "flow-file", "as": "flowFile"}, {"key": "flow-file-pretty", "as": "flowFilePretty"}, "diagnostics", {"key": "runtime-state", "as": "runtimeState"}, "logging", {"key": "export-global-context-keys", "as": "exportGlobalContextKeys"}, {"key": "external-modules", "as": "externalModules"}, {"key": "editor-theme", "as": "editorTheme"}, {"key": "function-external-modules", "as": "functionExternalModules"}, {"key": "debug-max-length", "as": "debugMaxLength"}, {"key": "mqtt-reconnect-time", "as": "mqttReconnectTime"}, {"key": "serial-reconnect-time", "as": "serialReconnectTime"}, "mqtt", {"key": "time-zone", "as": "timeZone"}],
+      "template": "files/settings.json"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "nodered",
+      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
+      "health": {
+        "kind": "runtime"
+      },
+      "env": {
+        "TZ": "Etc/UTC"
+      },
+      "ports": [
+        "1880"
+      ],
+      "args": [
+        "--settings",
+        "/data/settings.js"
+      ],
+      "volumes": [
+        "${dir:data}:/data",
+        "${dir:state}/settings.js:/data/settings.js:ro",
+        "${dir:state}/settings.json:/data/settings.json:ro"
+      ],
+      "restart-on": [
+        "settings-code",
+        "settings"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json"
+    },
+    {
+      "id": "mqtt-env",
+      "type": "file",
+      "path": "${dir:state}/mqtt.env",
+      "mode": "0600",
+      "template": "files/mqtt.env"
+    },
+    {
+      "id": "mqtt",
+      "type": "process",
+      "name": "nodered-mqtt",
+      "artifact": "code",
+      "run": [
+        "node",
+        "mqtt/index.js"
+      ],
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/mqtt.env"
+      ],
+      "restart-on": [
+        "mqtt-env",
+        "bound-mqtt-topic",
+        "secret-mqtt-topic",
+        "settings"
+      ]
+    }
+  ],
+  "requires": [
+    "mqtt-topic",
+    "route"
+  ],
+  "contributes": {
+    "mqtt-topic": {
+      "topics": [
+        "#"
+      ]
+    },
+    "route": {
+      "label": "nodered",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json",
+    "mqtt-topic": "${dir:state}/mqtt-topic.json"
+  },
+  "secrets": {
+    "mqtt-topic": "${dir:state}/mqtt-topic.secret"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "mqtt/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+          "MESH_NODERED_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/ollama/module.json.captured b/testdata/beside/mesh-catalog/modules/ollama/module.json.captured
new file mode 100644
index 0000000..2d5fb48
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ollama/module.json.captured
@@ -0,0 +1,62 @@
+{
+  "module": "ollama",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "model-access",
+      "scope": "node"
+    }
+  ],
+  "listens": [
+    {
+      "name": "api",
+      "port": 11434,
+      "protocol": "tcp",
+      "from": "machine",
+      "why": "consumers on this machine reaching the local model server's OpenAI-compatible API"
+    }
+  ],
+  "serves": {
+    "model-access": {
+      "port": 11434,
+      "model": "llama3.2"
+    }
+  },
+  "data": {
+    "own": [
+      {
+        "id": "models",
+        "path": "${dir:state}",
+        "class": "rebuildable",
+        "backup": "none",
+        "measure": "shallow",
+        "why": "models, downloaded again, and too large to copy every night"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/services/ollama",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "ollama",
+      "image": "ollama/ollama@sha256:32931b46719f673c05fdbaa81ccb26da18ea4a1c57590a754874ab28ba269eb2",
+      "network": "host",
+      "env": {
+        "OLLAMA_HOST": "0.0.0.0:11434"
+      },
+      "volumes": [
+        "/services/ollama:/root/.ollama"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/only-office/files/server.env b/testdata/beside/mesh-catalog/modules/only-office/files/server.env
new file mode 100644
index 0000000..19fab11
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/only-office/files/server.env
@@ -0,0 +1,5 @@
+JWT_ENABLED=true
+JWT_SECRET=${secret:jwt}
+JWT_HEADER=Authorization
+JWT_IN_BODY=true
+ALLOW_PRIVATE_IP_ADDRESS=true
diff --git a/testdata/beside/mesh-catalog/modules/only-office/module.json.captured b/testdata/beside/mesh-catalog/modules/only-office/module.json.captured
new file mode 100644
index 0000000..4af651f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/only-office/module.json.captured
@@ -0,0 +1,173 @@
+{
+  "module": "only-office",
+  "version": "1",
+  "slug": "office",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "office",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "own-secrets": {
+    "jwt": "${dir:state}/jwt.secret"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 9070,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the document server over http; its public name is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "rebuildable",
+        "why": "documents being edited; the documents themselves are the file store's"
+      },
+      {
+        "id": "lib",
+        "path": "${dir:lib}",
+        "class": "rebuildable",
+        "why": "the document server's working files"
+      },
+      {
+        "id": "db",
+        "path": "${dir:db}",
+        "class": "rebuildable",
+        "why": "the document server's own database of editing sessions"
+      },
+      {
+        "id": "fonts",
+        "path": "${dir:fonts}",
+        "class": "rebuildable",
+        "why": "fonts, installed again"
+      },
+      {
+        "id": "logs",
+        "path": "${dir:logs}",
+        "class": "cache",
+        "why": "logs"
+      },
+      {
+        "id": "rabbitmq",
+        "path": "${dir:rabbitmq}",
+        "class": "cache",
+        "why": "its queue's working set"
+      },
+      {
+        "id": "redis",
+        "path": "${dir:redis}",
+        "class": "cache",
+        "why": "its cache"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "logs",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "lib",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "db",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "rabbitmq",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "redis",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "fonts",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "only-office"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "only-office",
+      "image": "onlyoffice/documentserver@sha256:3ab6ebc7c605e5a32b7ae3ff19daed4925090245acc8100ce2230bd766c88212",
+      "network": "only-office",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "9070:80"
+      ],
+      "volumes": [
+        "${dir:logs}:/var/log/onlyoffice",
+        "${dir:data}:/var/www/onlyoffice/Data",
+        "${dir:lib}:/var/lib/onlyoffice",
+        "${dir:db}:/var/lib/postgresql",
+        "${dir:rabbitmq}:/var/lib/rabbitmq",
+        "${dir:redis}:/var/lib/redis",
+        "${dir:fonts}:/usr/share/fonts/truetype/custom"
+      ],
+      "secrets-in-environment": "run-document-server.sh regenerates JWT_SECRET from the environment on every start and overwrites local.json; not convertible"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/openai-consumer/module.json.captured b/testdata/beside/mesh-catalog/modules/openai-consumer/module.json.captured
new file mode 100644
index 0000000..2e98414
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/openai-consumer/module.json.captured
@@ -0,0 +1,61 @@
+{
+  "module": "openai-consumer",
+  "version": "1",
+  "slug": "openai",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "model-access"
+  ],
+  "binds": {
+    "model-access": "${dir:state}/model.json"
+  },
+  "secrets": {
+    "model-access": "${dir:state}/api-key"
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "apply",
+      "type": "process",
+      "name": "openai-consumer-apply",
+      "artifact": "code",
+      "run": [
+        "node",
+        "apply/index.js"
+      ],
+      "schedule": "*/5 * * * *",
+      "env": {
+        "MESH_MODEL_ACCESS_SECRET_FILE": "${dir:state}/api-key",
+        "MESH_MODEL_ACCESS_BIND_FILE": "${dir:state}/model.json",
+        "MESH_OPENAI_ENV_FILE": "${dir:state}/config/openai.env",
+        "MESH_OPENAI_CREDENTIALS_FILE": "${dir:state}/config/auth.json"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "apply/index.js"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/openrazer/module.json.captured b/testdata/beside/mesh-catalog/modules/openrazer/module.json.captured
new file mode 100644
index 0000000..faa34f8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/openrazer/module.json.captured
@@ -0,0 +1,52 @@
+{
+  "module": "openrazer",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "openrazer_status",
+    "openrazer_restart",
+    "openrazer_check"
+  ],
+  "resources": [
+    {
+      "id": "driver",
+      "type": "package",
+      "package": "openrazer-driver-dkms"
+    },
+    {
+      "id": "daemon",
+      "type": "package",
+      "package": "openrazer-daemon"
+    },
+    {
+      "id": "library",
+      "type": "package",
+      "package": "python-openrazer"
+    },
+    {
+      "id": "account",
+      "type": "user",
+      "name": "${machine:account}",
+      "groups": [
+        "openrazer"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/openrazer-tools",
+        "binary": "openrazer-tools",
+        "loads": [
+          "openrazer-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.service b/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.service
new file mode 100644
index 0000000..69741dd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.service
@@ -0,0 +1,12 @@
+# Generated by the mesh. Do not edit — module pacman writes this file and replaces it at every push.
+[Unit]
+Description=Weekly full upgrade (the mesh's pacman module, ADR 0477)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+# The upgrade pacman_upgrade runs (pacman -Syu --noconfirm), as a oneshot whose result is the module's health
+# (pacman_upgrade_health). The mesh restarts no machine for an upgrade: a new kernel waits for the next restart.
+Type=oneshot
+Nice=10
+ExecStart=/usr/bin/pacman -Syu --noconfirm
diff --git a/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.timer b/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.timer
new file mode 100644
index 0000000..a8a9b4d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/pacman/files/mesh-pacman-weekly-upgrade.timer
@@ -0,0 +1,11 @@
+# Generated by the mesh. Do not edit — module pacman writes this file and replaces it at every push.
+[Unit]
+Description=Weekly full upgrade, Saturday 04:00 local time on every node (the mesh's pacman module, ADR 0477)
+
+[Timer]
+# The same moment on every node: no random delay. A node that was off or asleep then upgrades at its next start.
+OnCalendar=Sat *-*-* 04:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/testdata/beside/mesh-catalog/modules/pacman/files/pacman.conf b/testdata/beside/mesh-catalog/modules/pacman/files/pacman.conf
new file mode 100644
index 0000000..0390e25
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/pacman/files/pacman.conf
@@ -0,0 +1,29 @@
+# The mesh's (module pacman, novox/hq to-be 42): the package manager's configuration. Written
+# whole at every push: an edit here is overwritten, and the file a machine had before is kept once by
+# the host. Owned whole because [options] cannot take a block by appending: anything added at the end
+# of the file lands in the last repository's section.
+#
+# The repositories are the union of what the machines had enabled when the module was written
+# (core, extra, multilib). The options are the distribution's defaults with four more: colour on a
+# terminal, parallel downloads, package lists in columns, and downloads run as the unprivileged
+# alpm user, which pacman 7 creates.
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+Color
+VerbosePkgLists
+ParallelDownloads = 5
+DownloadUser = alpm
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
diff --git a/testdata/beside/mesh-catalog/modules/pacman/files/reflector.conf b/testdata/beside/mesh-catalog/modules/pacman/files/reflector.conf
new file mode 100644
index 0000000..eb9e731
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/pacman/files/reflector.conf
@@ -0,0 +1,8 @@
+# The mesh's (module pacman, novox/hq to-be 42): how reflector refreshes the mirror list, weekly,
+# through reflector.timer. Written whole at every push. Before the module, every machine's list was
+# generated once and never again.
+--save /etc/pacman.d/mirrorlist
+--protocol https
+--country Belgium,Netherlands,Luxembourg,Germany,France
+--latest 20
+--sort rate
diff --git a/testdata/beside/mesh-catalog/modules/pacman/module.json.captured b/testdata/beside/mesh-catalog/modules/pacman/module.json.captured
new file mode 100644
index 0000000..ca1a81a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/pacman/module.json.captured
@@ -0,0 +1,136 @@
+{
+  "module": "pacman",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-package-manager",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "pacman_search",
+    "pacman_info",
+    "pacman_installed",
+    "pacman_owns",
+    "pacman_files",
+    "pacman_updates",
+    "pacman_upgrade",
+    "pacman_upgrade_health",
+    "pacman_orphans",
+    "pacman_remove_orphans",
+    "pacman_cache",
+    "pacman_history",
+    "pacman_mirrors",
+    "pacman_foreign",
+    "pacman_news",
+    "pacman_config"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "pacman"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/pacman.conf",
+      "mode": "0644",
+      "template": "files/pacman.conf"
+    },
+    {
+      "id": "contrib",
+      "type": "package",
+      "package": "pacman-contrib"
+    },
+    {
+      "id": "reflector",
+      "type": "package",
+      "package": "reflector"
+    },
+    {
+      "id": "mirrors",
+      "type": "file",
+      "path": "/etc/xdg/reflector/reflector.conf",
+      "mode": "0644",
+      "template": "files/reflector.conf"
+    },
+    {
+      "id": "mirror-refresh",
+      "type": "service",
+      "unit": "reflector.timer",
+      "state": "running",
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "cache-cleaning",
+      "type": "service",
+      "unit": "paccache.timer",
+      "state": "running",
+      "boot": "enabled",
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "upgrade-service",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-pacman-weekly-upgrade.service",
+      "mode": "0644",
+      "template": "files/mesh-pacman-weekly-upgrade.service"
+    },
+    {
+      "id": "upgrade-timer",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-pacman-weekly-upgrade.timer",
+      "mode": "0644",
+      "template": "files/mesh-pacman-weekly-upgrade.timer"
+    },
+    {
+      "id": "weekly-upgrade",
+      "type": "service",
+      "unit": "mesh-pacman-weekly-upgrade.timer",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "upgrade-service",
+        "upgrade-timer"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "pacman_upgrade_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/pacman-tools",
+        "binary": "pacman-tools",
+        "loads": [
+          "pacman-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/photos-eef/module.json.captured b/testdata/beside/mesh-catalog/modules/photos-eef/module.json.captured
new file mode 100644
index 0000000..101bdc2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/photos-eef/module.json.captured
@@ -0,0 +1,56 @@
+{
+  "module": "photos-eef",
+  "version": "1",
+  "slug": "eef",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "eef",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 4012,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the eef photos client site over http; its public name is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "photos-eef"
+    },
+    {
+      "id": "client",
+      "type": "container",
+      "name": "photos-eef",
+      "image": "registry-api.novox.be/novox/photos-client@sha256:f87d63ee7bfb44c9f9748b99be6ba6dc0daf955a1d463699e9e7e3009693c0ab",
+      "network": "photos-eef",
+      "ports": [
+        "4012:80"
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/photos-filip/module.json.captured b/testdata/beside/mesh-catalog/modules/photos-filip/module.json.captured
new file mode 100644
index 0000000..9c1c83f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/photos-filip/module.json.captured
@@ -0,0 +1,56 @@
+{
+  "module": "photos-filip",
+  "version": "1",
+  "slug": "filip",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "filip",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 4013,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the filip photos client site over http; its public name is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "photos-filip"
+    },
+    {
+      "id": "client",
+      "type": "container",
+      "name": "photos-filip",
+      "image": "registry-api.novox.be/novox/photos-client@sha256:f87d63ee7bfb44c9f9748b99be6ba6dc0daf955a1d463699e9e7e3009693c0ab",
+      "network": "photos-filip",
+      "ports": [
+        "4013:80"
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/picom/files/picom.conf b/testdata/beside/mesh-catalog/modules/picom/files/picom.conf
new file mode 100644
index 0000000..c6b8555
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/picom/files/picom.conf
@@ -0,0 +1,38 @@
+# picom, the X compositor (module picom, novox/hq ADR 0208). Owned by the mesh: this file is
+# replaced at every push. Adopted from the two workstations' file of 2026-10-04 and moved to
+# picom's window rules, which supersede opacity-rule, inactive-opacity and inactive-dim.
+
+# The backend and damage tracking are each machine's settings (backend, use-damage; novox/hq research
+# 037, issue 345): the right ones depend on the machine's graphics driver. The defaults are what every
+# machine ran before: glx, and picom's own default of repainting only what changed. xrender, or
+# use-damage false (repaint the whole screen each frame), is what to try on a machine where a window is
+# left unpainted or stale.
+backend = "${config:backend}";
+use-damage = ${config:use-damage};
+vsync = true;
+
+fading = true;
+fade-in-step = 0.05;
+fade-out-step = 0.05;
+
+# Tiled windows hide their shadows and corners, so neither is drawn.
+shadow = false;
+corner-radius = 0;
+blur-method = "none";
+
+# "Focused" is i3's _NET_ACTIVE_WINDOW, not X focus events: under i3 those do not reliably reach
+# the toplevel picom tracks, and a terminal then never lifts to its focused opacity.
+use-ewmh-active-win = true;
+
+# Window rules are applied in order, and a later match wins. Only terminals are translucent:
+# nothing else on screen (browsers, video, games) is touched. A terminal is matched by its class;
+# the node's terminal emulator today is xterm (class XTerm). A window's own opacity property is
+# used wherever no rule sets one, which is what the window-opacity tool sets.
+rules = (
+  { match = "window_type = 'tooltip'"; fade = false; opacity = 0.95; },
+  { match = "window_type = 'dock' || window_type = 'desktop'"; fade = false; },
+  { match = "class_g = 'XTerm' && focused"; opacity = 0.95; },
+  { match = "class_g = 'XTerm' && !focused"; opacity = 0.75; },
+  # A full-screen window is opaque, a terminal included: a video or a game is never see-through.
+  { match = "fullscreen"; opacity = 1; }
+);
diff --git a/testdata/beside/mesh-catalog/modules/picom/module.json.captured b/testdata/beside/mesh-catalog/modules/picom/module.json.captured
new file mode 100644
index 0000000..cfdc397
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/picom/module.json.captured
@@ -0,0 +1,90 @@
+{
+  "module": "picom",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-compositor",
+      "scope": "node"
+    }
+  ],
+    "config": {
+      "backend": {
+        "type": "string",
+        "description": "How picom draws: glx with the graphics card, which has served every machine so far, or xrender on the CPU where glx leaves a window unpainted or stale on the machine's driver (novox/hq research 037, issue 345); xr_glx_hybrid and egl are picom's other backends.",
+        "enum": [
+          "glx",
+          "xrender",
+          "xr_glx_hybrid",
+          "egl"
+        ],
+        "trusted": true,
+        "default": "glx"
+      },
+      "use-damage": {
+        "type": "boolean",
+        "description": "Whether picom repaints only what changed (true, picom's own default) or the whole screen each frame (false), which costs work and cures a window left stale or unpainted on some drivers (novox/hq issue 345).",
+        "trusted": true,
+        "default": true
+      }
+    },
+  "tools": [
+    "picom_restart",
+    "picom_rules",
+    "picom_window_opacity",
+    "picom_toggle"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "picom"
+    },
+    {
+      "id": "window-properties",
+      "type": "package",
+      "package": "xorg-xprop"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/picom",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "configuration",
+      "type": "file",
+      "path": "${machine:account-home}/.config/picom/picom.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/picom.conf"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/picom-tools",
+        "binary": "picom-tools",
+        "loads": [
+          "picom-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/polychromatic/files/display-session b/testdata/beside/mesh-catalog/modules/polychromatic/files/display-session
new file mode 100644
index 0000000..bbdbd6f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/polychromatic/files/display-session
@@ -0,0 +1,6 @@
+# The Razer peripherals' tray (module polychromatic, novox/hq ADR 0208, ADR 0212). Owned by the mesh:
+# replaced at every push. This line is the tray's one start, at the session's start (exec, not
+# exec_always, so a reload starts nothing). The package's own login helper starts it too while the
+# application's setting "Start the tray applet when I log on" is ticked; polychromatic_check names
+# that as a second start.
+exec --no-startup-id polychromatic-tray-applet
diff --git a/testdata/beside/mesh-catalog/modules/polychromatic/module.json.captured b/testdata/beside/mesh-catalog/modules/polychromatic/module.json.captured
new file mode 100644
index 0000000..4d6ba4b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/polychromatic/module.json.captured
@@ -0,0 +1,40 @@
+{
+  "module": "polychromatic",
+  "version": "1",
+  "moved": true,
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "polychromatic_status",
+    "polychromatic_restart",
+    "polychromatic_check"
+  ],
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/display-session"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/polychromatic-tools",
+        "binary": "polychromatic-tools",
+        "loads": [
+          "polychromatic-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/postgres/files/consumers.json b/testdata/beside/mesh-catalog/modules/postgres/files/consumers.json
new file mode 100644
index 0000000..30d160e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/postgres/files/consumers.json
@@ -0,0 +1 @@
+${consumers:postgres-database}
diff --git a/testdata/beside/mesh-catalog/modules/postgres/module.json.captured b/testdata/beside/mesh-catalog/modules/postgres/module.json.captured
new file mode 100644
index 0000000..919df42
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/postgres/module.json.captured
@@ -0,0 +1,191 @@
+{
+  "module": "postgres",
+  "version": "1",
+  "moved": true,
+  "upgrade": {
+    "policy": "record",
+    "why": "a provider whose restart drops every consumer on its machine, and whose new major version changes its data's format: a person takes each build, after a backup (hq ADR 0236)"
+  },
+  "provides": [
+    {
+      "name": "postgres-database",
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a PostgreSQL role and database name"
+      }
+    }
+  ],
+  "claims": [
+    {
+      "name": "mesh-store",
+      "scope": "mesh",
+      "serves": [
+        "databases",
+        "query"
+      ]
+    }
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "database.provisioned",
+    "database.deprovisioned"
+  ],
+  "consumes": [
+    "postgres.database.provisioned",
+    "postgres.database.deprovisioned"
+  ],
+  "listens": [
+    {
+      "name": "database",
+      "port": 5432,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a database"
+    }
+  ],
+  "guards": [
+    5432
+  ],
+  "serves": {
+    "postgres-database": {
+      "port": 5432
+    }
+  },
+  "receives": {
+    "postgres-database": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "postgres-database": "${dir:grants}"
+  },
+  "own-secrets": {
+    "superuser": "${dir:state}/superuser.secret",
+    "reader": "${dir:state}/reader.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "store",
+        "path": "${dir:store-data}",
+        "class": "valuable",
+        "backup": {
+          "dump": "docker exec -u postgres postgres sh -c 'cd /var/lib/postgresql/data/dumps && for db in $(psql -Atc \"select datname from pg_database where oid >= 16384 order by 1\"); do pg_dump -Fc -f \"$db.dump.partial\" \"$db\" && mv \"$db.dump.partial\" \"$db.dump\" || exit 1; done'",
+          "into": "dumps"
+        },
+        "why": "every consumer's database; copied by the dump below, since a running store's files are not a consistent copy"
+      },
+      {
+        "id": "dumps",
+        "path": "${dir:dumps}",
+        "class": "rebuildable",
+        "why": "last night's dump of the store, made again every night"
+      }
+    ],
+    "consumers": {
+      "postgres-database": {
+        "class": "valuable",
+        "in": "store",
+        "why": "a consumer's rows are the only copy of what it wrote"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "consumers",
+      "type": "file",
+      "path": "${dir:state}/consumers.json",
+      "mode": "0600",
+      "template": "files/consumers.json"
+    },
+    {
+      "id": "store-data",
+      "type": "directory",
+      "path": "/var/lib/mesh-store",
+      "mode": "0700",
+      "owner": "999:70",
+      "unknown": "program"
+    },
+    {
+      "id": "dumps",
+      "type": "directory",
+      "path": "${dir:store-data}/dumps",
+      "mode": "0700",
+      "owner": "999:70",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "postgres",
+      "image": "pgvector/pgvector@sha256:cf134a767f474095eeba57e0117be8e568e011a63f33fbf252f14c9b760f8e6f",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "database"
+      },
+      "env": {
+        "POSTGRES_PASSWORD_FILE": "/run/secrets/superuser",
+        "PGDATA": "/var/lib/postgresql/data/pgdata"
+      },
+      "ports": [
+        "5432:5432"
+      ],
+      "volumes": [
+        "/var/lib/mesh-store:/var/lib/postgresql/data",
+        "${dir:state}/superuser.secret:/run/secrets/superuser:ro"
+      ]
+    },
+    {
+      "id": "client",
+      "type": "package",
+      "package": "postgresql-libs"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/postgres-provider",
+        "binary": "postgres-provider",
+        "loads": [
+          "postgres-provider"
+        ],
+        "env": {
+          "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/superuser.secret",
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_POSTGRES_READER_PASSWORD_FILE": "${dir:state}/reader.secret",
+          "MESH_CONSUMERS_FILE": "${dir:state}/consumers.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "state": [
+    "bound"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/power/files/bin/power-moment b/testdata/beside/mesh-catalog/modules/power/files/bin/power-moment
new file mode 100755
index 0000000..e7095e4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/files/bin/power-moment
@@ -0,0 +1,90 @@
+#!/bin/sh
+# power-moment MOMENT [--force] — run every module's code for one power moment (novox/hq ADR 0211).
+# Shipped by the mesh's power module; edit the catalogue.
+#
+# MOMENT is after-boot, before-sleep, after-wake, before-shutdown, on-mains or on-battery, or
+# `supply`, which reads the machine's power source and runs on-mains or on-battery once per change.
+#
+# The moment's file holds what the controller placed: each module's code under a line `# <module>`.
+# Each module's piece runs on its own, with sh, as root, bounded by MESH_POWER_BOUND seconds
+# (default 30) and killed 5 s after that, so one module that hangs cannot hold the machine awake or
+# stop the next module. Every outcome goes to the journal under the tag mesh-power.
+set -u
+
+moment=${1:-}
+force=${2:-}
+moments=/etc/mesh-power/moments
+bound=${MESH_POWER_BOUND:-30}
+runtime=/run/mesh-power
+
+say() { logger -t mesh-power -- "$*" 2>/dev/null || true; printf '%s\n' "$*"; }
+
+# The power source as the kernel says it: on mains when any Mains supply is online. A machine with
+# no Mains supply (a desktop, a server, a USB-C source only) has no source to change.
+source_now() {
+	found=no
+	for s in /sys/class/power_supply/*; do
+		[ "$(cat "$s/type" 2>/dev/null)" = Mains ] || continue
+		found=yes
+		[ "$(cat "$s/online" 2>/dev/null)" = 1 ] && { echo on-mains; return; }
+	done
+	[ "$found" = yes ] && echo on-battery || echo none
+}
+
+case "$moment" in
+supply)
+	now=$(source_now)
+	[ "$now" = none ] && exit 0
+	mkdir -p "$runtime"
+	last=$(cat "$runtime/source" 2>/dev/null || true)
+	[ "$now" = "$last" ] && [ "$force" != --force ] && exit 0
+	echo "$now" >"$runtime/source"
+	moment=$now
+	;;
+after-boot | before-sleep | after-wake | on-mains | on-battery) ;;
+before-shutdown)
+	# Run only while the machine is really going down. The unit that runs it is stopped at shutdown,
+	# and also when the module is taken off the machine; the second must not run anyone's shutdown code.
+	state=$(systemctl is-system-running 2>/dev/null || true)
+	if [ "$state" != stopping ] && [ "$force" != --force ]; then
+		say "moment=before-shutdown skipped: the system is $state, not stopping"
+		exit 0
+	fi
+	;;
+*)
+	echo "power-moment: no moment $moment (after-boot, before-sleep, after-wake, before-shutdown, on-mains, on-battery, supply)" >&2
+	exit 2
+	;;
+esac
+
+file="$moments/$moment"
+[ -r "$file" ] || { say "moment=$moment: nothing placed"; exit 0; }
+
+work=$(mktemp -d) || exit 1
+trap 'rm -rf "$work"' EXIT
+
+# One file per module piece, in the order the controller placed them. A line that is exactly
+# "# <module name>" opens a piece; lines before the first are the holder's own header.
+awk -v dir="$work" '
+	/^# [a-z0-9][a-z0-9-]*$/ { n++; name = substr($0, 3); out = sprintf("%s/%03d-%s", dir, n, name); next }
+	n > 0 { print > out }
+' "$file"
+
+ran=0 failed=0
+for piece in "$work"/*; do
+	[ -e "$piece" ] || continue
+	module=${piece##*/}
+	module=${module#*-}
+	start=$(date +%s)
+	timeout --kill-after=5 "$bound" sh "$piece" </dev/null >"$piece.out" 2>&1
+	rc=$?
+	took=$(($(date +%s) - start))
+	ran=$((ran + 1))
+	case $rc in
+	0) say "moment=$moment module=$module ok in ${took}s" ;;
+	124 | 137) failed=$((failed + 1)); say "moment=$moment module=$module ended after ${bound}s: it did not finish" ;;
+	*) failed=$((failed + 1)); say "moment=$moment module=$module exited $rc: $(tail -n 3 "$piece.out" | tr '\n' ' ')" ;;
+	esac
+done
+say "moment=$moment: $ran piece(s), $failed failed"
+exit 0
diff --git a/testdata/beside/mesh-catalog/modules/power/module.json.captured b/testdata/beside/mesh-catalog/modules/power/module.json.captured
new file mode 100644
index 0000000..a110d41
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/module.json.captured
@@ -0,0 +1,408 @@
+{
+  "module": "power",
+  "version": "1",
+  "moved": true,
+  "templates": "templates",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-power",
+      "scope": "node"
+    }
+  ],
+  "emits": [
+    "booted",
+    "sleeping",
+    "woke",
+    "shutting-down",
+    "on-mains",
+    "on-battery",
+    "battery-low"
+  ],
+  "state": [
+    {
+      "name": "draw",
+      "ttl-seconds": 30,
+      "per-machine": true
+    }
+  ],
+  "tools": [
+    "power_state",
+    "power_hooks",
+    "power_history",
+    "power_run",
+    "power_check"
+  ],
+    "config": {
+      "handle-power-key": {
+        "type": "string",
+        "description": "What logind does when the power key is pressed: one of logind's actions, such as suspend, ignore or poweroff (logind.conf(5)); the operator's choice for this machine, with no default.",
+        "enum": [
+          "ignore",
+          "poweroff",
+          "reboot",
+          "halt",
+          "kexec",
+          "suspend",
+          "hibernate",
+          "hybrid-sleep",
+          "suspend-then-hibernate",
+          "lock",
+          "factory-reset",
+          "sleep"
+        ],
+        "trusted": true,
+        "required": true
+      },
+      "handle-lid-switch": {
+        "type": "string",
+        "description": "What logind does when the lid is closed on battery: one of logind's actions, such as suspend, ignore or poweroff (logind.conf(5)); the operator's choice for this machine, with no default.",
+        "enum": [
+          "ignore",
+          "poweroff",
+          "reboot",
+          "halt",
+          "kexec",
+          "suspend",
+          "hibernate",
+          "hybrid-sleep",
+          "suspend-then-hibernate",
+          "lock",
+          "factory-reset",
+          "sleep"
+        ],
+        "trusted": true,
+        "required": true
+      },
+      "handle-lid-switch-external-power": {
+        "type": "string",
+        "description": "What logind does when the lid is closed on external power: one of logind's actions, such as suspend, ignore or poweroff (logind.conf(5)); the operator's choice for this machine, with no default.",
+        "enum": [
+          "ignore",
+          "poweroff",
+          "reboot",
+          "halt",
+          "kexec",
+          "suspend",
+          "hibernate",
+          "hybrid-sleep",
+          "suspend-then-hibernate",
+          "lock",
+          "factory-reset",
+          "sleep"
+        ],
+        "trusted": true,
+        "required": true
+      },
+      "handle-lid-switch-docked": {
+        "type": "string",
+        "description": "What logind does when the lid is closed while docked or with another screen attached: one of logind's actions, such as suspend, ignore or poweroff (logind.conf(5)); the operator's choice for this machine, with no default.",
+        "enum": [
+          "ignore",
+          "poweroff",
+          "reboot",
+          "halt",
+          "kexec",
+          "suspend",
+          "hibernate",
+          "hybrid-sleep",
+          "suspend-then-hibernate",
+          "lock",
+          "factory-reset",
+          "sleep"
+        ],
+        "trusted": true,
+        "required": true
+      }
+    },
+  "resources": [
+    {
+      "id": "polkit",
+      "type": "package",
+      "package": "polkit"
+    },
+    {
+      "id": "scripts",
+      "type": "archive",
+      "path": "/usr/local/lib/mesh-power",
+      "artifact": "scripts",
+      "unknown": "program"
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/mesh-power",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "moments-dir",
+      "type": "directory",
+      "path": "/etc/mesh-power/moments",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "moment-after-boot",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/after-boot",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/after-boot"
+    },
+    {
+      "id": "moment-before-sleep",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/before-sleep",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/before-sleep"
+    },
+    {
+      "id": "moment-after-wake",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/after-wake",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/after-wake"
+    },
+    {
+      "id": "moment-before-shutdown",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/before-shutdown",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/before-shutdown"
+    },
+    {
+      "id": "moment-on-mains",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/on-mains",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/on-mains"
+    },
+    {
+      "id": "moment-on-battery",
+      "type": "file",
+      "path": "/etc/mesh-power/moments/on-battery",
+      "mode": "0644",
+      "template": "templates/mesh-power/moments/on-battery"
+    },
+    {
+      "id": "logind-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/logind.conf.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "logind-power",
+      "type": "file",
+      "path": "/etc/systemd/logind.conf.d/power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/logind.conf.d/power.conf"
+    },
+    {
+      "id": "logind",
+      "type": "service",
+      "unit": "systemd-logind.service",
+      "reload-on": [
+        "logind-power"
+      ]
+    },
+    {
+      "id": "after-boot-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-power-after-boot.service",
+      "mode": "0644",
+      "template": "templates/systemd/system/mesh-power-after-boot.service"
+    },
+    {
+      "id": "before-shutdown-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-power-before-shutdown.service",
+      "mode": "0644",
+      "template": "templates/systemd/system/mesh-power-before-shutdown.service"
+    },
+    {
+      "id": "before-sleep-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-power-before-sleep.service",
+      "mode": "0644",
+      "template": "templates/systemd/system/mesh-power-before-sleep.service"
+    },
+    {
+      "id": "after-wake-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-power-after-wake.service",
+      "mode": "0644",
+      "template": "templates/systemd/system/mesh-power-after-wake.service"
+    },
+    {
+      "id": "supply-unit",
+      "type": "file",
+      "path": "/etc/systemd/system/mesh-power-supply.service",
+      "mode": "0644",
+      "template": "templates/systemd/system/mesh-power-supply.service"
+    },
+    {
+      "id": "sleep-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/sleep.target.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "sleep-wants",
+      "type": "file",
+      "path": "/etc/systemd/system/sleep.target.d/mesh-power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/sleep.target.d/mesh-power.conf"
+    },
+    {
+      "id": "suspend-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/suspend.target.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "suspend-wants",
+      "type": "file",
+      "path": "/etc/systemd/system/suspend.target.d/mesh-power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/suspend.target.d/mesh-power.conf"
+    },
+    {
+      "id": "hibernate-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/hibernate.target.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "hibernate-wants",
+      "type": "file",
+      "path": "/etc/systemd/system/hibernate.target.d/mesh-power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/hibernate.target.d/mesh-power.conf"
+    },
+    {
+      "id": "hybrid-sleep-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/hybrid-sleep.target.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "hybrid-sleep-wants",
+      "type": "file",
+      "path": "/etc/systemd/system/hybrid-sleep.target.d/mesh-power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/hybrid-sleep.target.d/mesh-power.conf"
+    },
+    {
+      "id": "suspend-then-hibernate-drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/suspend-then-hibernate.target.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "suspend-then-hibernate-wants",
+      "type": "file",
+      "path": "/etc/systemd/system/suspend-then-hibernate.target.d/mesh-power.conf",
+      "mode": "0644",
+      "template": "templates/systemd/system/suspend-then-hibernate.target.d/mesh-power.conf"
+    },
+    {
+      "id": "udev-rule",
+      "type": "file",
+      "path": "/etc/udev/rules.d/90-mesh-power.rules",
+      "mode": "0644",
+      "template": "templates/udev/rules.d/90-mesh-power.rules"
+    },
+    {
+      "id": "after-boot",
+      "type": "service",
+      "unit": "mesh-power-after-boot.service",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "before-shutdown",
+      "type": "service",
+      "unit": "mesh-power-before-shutdown.service",
+      "state": "running",
+      "boot": "enabled"
+    },
+    {
+      "id": "draw-dir",
+      "type": "directory",
+      "path": "/run/mesh-power",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "draw",
+      "type": "process",
+      "name": "mesh-power-draw",
+      "artifact": "tools-go",
+      "run": [
+        "./power",
+        "draw"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools-go",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/power",
+        "binary": "power",
+        "loads": [
+          "power"
+        ]
+      },
+      {
+        "name": "scripts",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "templates",
+        "kind": "archive",
+        "from": "templates"
+      }
+    ]
+  },
+  "items": [
+    {
+      "collection": "contribution:node-bar:block",
+      "name": "battery",
+      "if-capability": "battery",
+      "attributes": {
+        "bar": "bottom",
+        "place": "status",
+        "order": "40"
+      },
+      "template": "templates/bar-battery"
+    },
+    {
+      "collection": "contribution:node-bar:block",
+      "name": "power-draw",
+      "if-capability": "power-meter",
+      "attributes": {
+        "bar": "bottom",
+        "place": "status",
+        "order": "45"
+      },
+      "template": "templates/bar-power-draw"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/bar-battery b/testdata/beside/mesh-catalog/modules/power/templates/bar-battery
new file mode 100644
index 0000000..d2386ba
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/bar-battery
@@ -0,0 +1,9 @@
+[[block]]
+block = "battery"
+format = "$icon $percentage{ $time|}"
+charging_format = "$icon $percentage{ $time|}"
+not_charging_format = "$icon $percentage"
+full_format = "$icon $percentage"
+empty_format = "$icon $percentage"
+missing_format = ""
+
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/bar-power-draw b/testdata/beside/mesh-catalog/modules/power/templates/bar-power-draw
new file mode 100644
index 0000000..3d0d338
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/bar-power-draw
@@ -0,0 +1,6 @@
+[[block]]
+block = "custom"
+command = "~/.local/bin/i3status-value power.draw ${machine:name}"
+interval = 5
+hide_when_empty = true
+
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-boot b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-boot
new file mode 100644
index 0000000..c5a90f6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-boot
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment after-boot, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:after-boot:first}${shell:after-boot:normal}${shell:after-boot:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-wake b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-wake
new file mode 100644
index 0000000..2655c22
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/after-wake
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment after-wake, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:after-wake:first}${shell:after-wake:normal}${shell:after-wake:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-shutdown b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-shutdown
new file mode 100644
index 0000000..65cc76d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-shutdown
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment before-shutdown, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:before-shutdown:first}${shell:before-shutdown:normal}${shell:before-shutdown:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-sleep b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-sleep
new file mode 100644
index 0000000..e5fc2a5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/before-sleep
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment before-sleep, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:before-sleep:first}${shell:before-sleep:normal}${shell:before-sleep:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-battery b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-battery
new file mode 100644
index 0000000..58e41a9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-battery
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment on-battery, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:on-battery:first}${shell:on-battery:normal}${shell:on-battery:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-mains b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-mains
new file mode 100644
index 0000000..b4a6586
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/mesh-power/moments/on-mains
@@ -0,0 +1,4 @@
+# What every module on this machine runs at the moment on-mains, as the mesh placed it (module power,
+# novox/hq ADR 0211). Replaced on every push: code is added by the module it belongs to, as a
+# contribution for this moment. Each module's piece runs on its own, as root, bounded in time.
+${shell:on-mains:first}${shell:on-mains:normal}${shell:on-mains:last}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/logind.conf.d/power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/logind.conf.d/power.conf
new file mode 100644
index 0000000..9cf93bd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/logind.conf.d/power.conf
@@ -0,0 +1,8 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+#
+# The power key and the lid, from this module's settings: the mesh's, then this machine's.
+[Login]
+HandlePowerKey=${config:handle-power-key}
+HandleLidSwitch=${config:handle-lid-switch}
+HandleLidSwitchExternalPower=${config:handle-lid-switch-external-power}
+HandleLidSwitchDocked=${config:handle-lid-switch-docked}
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hibernate.target.d/mesh-power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hibernate.target.d/mesh-power.conf
new file mode 100644
index 0000000..81223d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hibernate.target.d/mesh-power.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Wants=mesh-power-after-wake.service
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hybrid-sleep.target.d/mesh-power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hybrid-sleep.target.d/mesh-power.conf
new file mode 100644
index 0000000..81223d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/hybrid-sleep.target.d/mesh-power.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Wants=mesh-power-after-wake.service
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-boot.service b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-boot.service
new file mode 100644
index 0000000..b704577
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-boot.service
@@ -0,0 +1,13 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Description=Every module's code after boot (mesh power)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/lib/mesh-power/bin/power-moment after-boot
+
+[Install]
+WantedBy=multi-user.target
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-wake.service b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-wake.service
new file mode 100644
index 0000000..773b228
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-after-wake.service
@@ -0,0 +1,11 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+#
+# Pulled in by the four sleep targets through this module's drop-ins on them, and ordered after
+# them, so it runs once the machine is awake again. Never enabled.
+[Unit]
+Description=Every module's code after waking (mesh power)
+After=suspend.target hibernate.target hybrid-sleep.target suspend-then-hibernate.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/mesh-power/bin/power-moment after-wake
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-shutdown.service b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-shutdown.service
new file mode 100644
index 0000000..52db0a4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-shutdown.service
@@ -0,0 +1,18 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+#
+# Started at boot and left active; stopping it is the shutdown. Ordered after the network, so at
+# shutdown it stops, and runs every module's code, while the network is still up.
+[Unit]
+Description=Every module's code before shutdown (mesh power)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/true
+ExecStop=/usr/local/lib/mesh-power/bin/power-moment before-shutdown
+TimeoutStopSec=120
+
+[Install]
+WantedBy=multi-user.target
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-sleep.service b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-sleep.service
new file mode 100644
index 0000000..727587e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-before-sleep.service
@@ -0,0 +1,11 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+#
+# Pulled in by sleep.target through this module's drop-in on it, never enabled: a one-shot waiting
+# for a sleep is not a service whose state the mesh can declare.
+[Unit]
+Description=Every module's code before sleep (mesh power)
+Before=sleep.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/mesh-power/bin/power-moment before-sleep
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-supply.service b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-supply.service
new file mode 100644
index 0000000..5096a00
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/mesh-power-supply.service
@@ -0,0 +1,10 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+#
+# Started by the module's udev rule when a power supply changes; runs on-mains or on-battery once per
+# change of source.
+[Unit]
+Description=Every module's code for the power source (mesh power)
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/lib/mesh-power/bin/power-moment supply
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/sleep.target.d/mesh-power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/sleep.target.d/mesh-power.conf
new file mode 100644
index 0000000..096f793
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/sleep.target.d/mesh-power.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Wants=mesh-power-before-sleep.service
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend-then-hibernate.target.d/mesh-power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend-then-hibernate.target.d/mesh-power.conf
new file mode 100644
index 0000000..81223d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend-then-hibernate.target.d/mesh-power.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Wants=mesh-power-after-wake.service
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend.target.d/mesh-power.conf b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend.target.d/mesh-power.conf
new file mode 100644
index 0000000..81223d3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/systemd/system/suspend.target.d/mesh-power.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+[Unit]
+Wants=mesh-power-after-wake.service
diff --git a/testdata/beside/mesh-catalog/modules/power/templates/udev/rules.d/90-mesh-power.rules b/testdata/beside/mesh-catalog/modules/power/templates/udev/rules.d/90-mesh-power.rules
new file mode 100644
index 0000000..d0a75bb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/power/templates/udev/rules.d/90-mesh-power.rules
@@ -0,0 +1,5 @@
+# Written by the mesh (module power, novox/hq ADR 0211). Replaced on every push.
+# Only the charger's change can switch the machine between mains and battery. A battery reports its
+# level many times a minute, and USB-C supplies come and go; matching them started the supply unit
+# every second or two on the laptop.
+SUBSYSTEM=="power_supply", ACTION=="change", ATTR{type}=="Mains", RUN+="/usr/bin/systemctl --no-block start mesh-power-supply.service"
diff --git a/testdata/beside/mesh-catalog/modules/powerlevel10k/files/zsh-normal b/testdata/beside/mesh-catalog/modules/powerlevel10k/files/zsh-normal
new file mode 100644
index 0000000..ba4fc1d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/powerlevel10k/files/zsh-normal
@@ -0,0 +1,3 @@
+# The prompt: powerlevel10k v1.20.0, pinned in this module (novox/hq ADR 0205), and its configuration.
+[[ ! -f ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme ]] || source ~/.local/share/powerlevel10k/powerlevel10k.zsh-theme
+[[ ! -f ~/.config/powerlevel10k/p10k.zsh ]] || source ~/.config/powerlevel10k/p10k.zsh
diff --git a/testdata/beside/mesh-catalog/modules/powerlevel10k/module.json.captured b/testdata/beside/mesh-catalog/modules/powerlevel10k/module.json.captured
new file mode 100644
index 0000000..da1bd4d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/powerlevel10k/module.json.captured
@@ -0,0 +1,49 @@
+{
+  "module": "powerlevel10k",
+  "version": "1",
+  "moved": true,
+  "resources": [
+    {
+      "id": "theme",
+      "type": "archive",
+      "path": "${machine:account-home}/.local/share/powerlevel10k",
+      "owner": "${machine:account}",
+      "artifact": "theme",
+      "unknown": "move-out",
+      "knows": ["powerlevel9k.zsh-theme.zwc", "powerlevel10k.zsh-theme.zwc", "internal/p10k.zsh.zwc", "internal/icons.zsh.zwc", "internal/configure.zsh.zwc", "internal/worker.zsh.zwc", "internal/parser.zsh.zwc", "gitstatus/gitstatus.plugin.zsh.zwc", "gitstatus/install.zwc"]
+    },
+    {
+      "id": "configuration",
+      "type": "archive",
+      "path": "${machine:account-home}/.config/powerlevel10k",
+      "owner": "${machine:account}",
+      "artifact": "configuration",
+      "unknown": "move-out"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "theme",
+        "kind": "archive",
+        "from": "theme"
+      },
+      {
+        "name": "configuration",
+        "kind": "archive",
+        "from": "config"
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/records/files/config.json b/testdata/beside/mesh-catalog/modules/records/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/records/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/records/files/origin b/testdata/beside/mesh-catalog/modules/records/files/origin
new file mode 100644
index 0000000..8c829dc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/records/files/origin
@@ -0,0 +1 @@
+${bound:git:scheme}://${bound:git:at}:${bound:git:port}
diff --git a/testdata/beside/mesh-catalog/modules/records/module.json.captured b/testdata/beside/mesh-catalog/modules/records/module.json.captured
new file mode 100644
index 0000000..db6f7e5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/records/module.json.captured
@@ -0,0 +1,103 @@
+{
+  "module": "records",
+  "version": "1",
+  "slug": "records",
+  "requires": [
+    "git"
+  ],
+  "binds": {
+    "git": "${dir:mesh-state}/git.json"
+  },
+  "consumes": [
+    "gitea.pull.merged"
+  ],
+  "tools": [
+    "records_search",
+    "records_read",
+    "records_list",
+    "records_decisions",
+    "records_status",
+    "records_sync"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "checkout",
+        "path": "${dir:checkout}",
+        "class": "rebuildable",
+        "why": "a clone of the record, cloned again"
+      }
+    ]
+  },
+  "config": {
+    "repository": {
+      "type": "string",
+      "description": "The repository the records module keeps a checkout of and serves the record from, as owner/name on the mesh's forge; the operator's, with no default (novox/hq ADR 0112).",
+      "pattern": "[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+",
+      "trusted": true,
+      "required": true
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "checkout",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "takes-config": ["repository"],
+      "merge": "json"
+    },
+    {
+      "id": "origin",
+      "type": "file",
+      "path": "${dir:mesh-state}/origin",
+      "mode": "0600",
+      "template": "files/origin"
+    },
+    {
+      "id": "git",
+      "type": "package",
+      "package": "git"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/records",
+        "binary": "records",
+        "loads": [
+          "records"
+        ],
+        "env": {
+          "MESH_RECORDS_CONFIG_FILE": "${dir:mesh-state}/config.json",
+          "MESH_RECORDS_ORIGIN_FILE": "${dir:mesh-state}/origin",
+          "MESH_RECORDS_DIR": "${dir:checkout}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/redis/files/redis.conf b/testdata/beside/mesh-catalog/modules/redis/files/redis.conf
new file mode 100644
index 0000000..ac27331
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/redis/files/redis.conf
@@ -0,0 +1,3 @@
+requirepass ${secret:secret}
+appendonly yes
+dir /data
diff --git a/testdata/beside/mesh-catalog/modules/redis/module.json.captured b/testdata/beside/mesh-catalog/modules/redis/module.json.captured
new file mode 100644
index 0000000..58e1106
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/redis/module.json.captured
@@ -0,0 +1,154 @@
+{
+  "module": "redis",
+  "version": "1",
+  "provides": [
+    {
+      "name": "redis-cache",
+      "scope": "mesh",
+      "identity": {
+        "in": "a Redis ACL user and key prefix"
+      }
+    }
+  ],
+  "requires": [
+    "secret"
+  ],
+  "capabilities": [
+    "container-runtime"
+  ],
+  "emits": [
+    "cache.provisioned",
+    "cache.deprovisioned"
+  ],
+  "consumes": [
+    "redis.cache.provisioned",
+    "redis.cache.deprovisioned"
+  ],
+  "serves": {
+    "redis-cache": {
+      "port": 6379
+    }
+  },
+  "receives": {
+    "redis-cache": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "redis-cache": "${dir:grants}"
+  },
+  "secrets": {
+    "secret": "${dir:state}/default.secret"
+  },
+  "listens": [
+    {
+      "name": "cache",
+      "port": 6379,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "modules on any machine that were granted a cache"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "cache",
+        "why": "the cache's own snapshot"
+      }
+    ],
+    "consumers": {
+      "redis-cache": {
+        "class": "cache",
+        "why": "a cache: nothing in this mesh requires it, and a consumer that kept data in it would be using a cache as a store"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "999:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "server-conf",
+      "type": "file",
+      "path": "${dir:state}/redis.conf",
+      "mode": "0600",
+      "template": "files/redis.conf",
+      "owner": "999:1000"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "redis"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "redis",
+      "image": "redis@sha256:520775a41a63e77e06c73e35d2fd9cc15921a609516818796b4ecbb813078bc7",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "cache"
+      },
+      "network": "redis",
+      "ports": [
+        "6379"
+      ],
+      "volumes": [
+        "${dir:data}:/data",
+        "${dir:state}/redis.conf:/etc/redis/redis.conf:ro"
+      ],
+      "args": [
+        "/etc/redis/redis.conf"
+      ],
+      "restart-on": [
+        "server-conf"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_PROVISION_REDIS": "127.0.0.1:${port:6379}",
+          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/default.secret"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/restic/files/backups.conf b/testdata/beside/mesh-catalog/modules/restic/files/backups.conf
new file mode 100644
index 0000000..2f23f90
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/restic/files/backups.conf
@@ -0,0 +1,2 @@
+# What the modules on this machine back up, composed by the mesh (novox/hq to-be 43). Do not edit.
+${backup:lines}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/restic/files/data.conf b/testdata/beside/mesh-catalog/modules/restic/files/data.conf
new file mode 100644
index 0000000..f19e849
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/restic/files/data.conf
@@ -0,0 +1,2 @@
+# The data the modules on this machine declare, composed by the mesh (novox/hq ADR 0233). Do not edit.
+${backup:data}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/restic/files/retention.conf b/testdata/beside/mesh-catalog/modules/restic/files/retention.conf
new file mode 100644
index 0000000..cd7954c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/restic/files/retention.conf
@@ -0,0 +1,6 @@
+# How many restore points the night keeps, written by the mesh from this machine's settings keep-daily,
+# keep-weekly, keep-monthly (novox/hq issue 416) and keep-hand-taken-days (novox/hq issue 453). Replaced on every push; change the settings, never this file.
+daily=${config:keep-daily}
+weekly=${config:keep-weekly}
+monthly=${config:keep-monthly}
+hand=${config:keep-hand-taken-days}
diff --git a/testdata/beside/mesh-catalog/modules/restic/module.json.captured b/testdata/beside/mesh-catalog/modules/restic/module.json.captured
new file mode 100644
index 0000000..18ee811
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/restic/module.json.captured
@@ -0,0 +1,196 @@
+{
+  "module": "restic",
+  "version": "1",
+  "moved": true,
+  "claims": [
+    {
+      "name": "node-backup",
+      "scope": "node",
+      "serves": [
+        "backed-up",
+        "now",
+        "restore"
+      ]
+    }
+  ],
+  "tools": [
+    "backup_health",
+    "backup_delete_retired",
+    "backup_deleted"
+  ],
+  "own-secrets": {
+    "repository": "${dir:state}/repository.secret"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "repository",
+        "path": "${dir:repository}",
+        "class": "rebuildable",
+        "backup": "none",
+        "why": "the restore points themselves: a copy of data kept elsewhere on this machine, never the only copy of anything; lost, the history goes and nothing live does"
+      },
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "cache",
+        "why": "what the last nights and measurements were; the next night writes it again"
+      }
+    ]
+  },
+    "config": {
+      "keep-daily": {
+        "type": "number",
+        "description": "How many nightly restore points are kept, a count from 1 to 9999: two weeks undo a mistake noticed within a fortnight. Read by the night, which thins nothing while it does not read (novox/hq issue 416); lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 14
+      },
+      "keep-weekly": {
+        "type": "number",
+        "description": "How many weekly restore points are kept behind the dailies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 8
+      },
+      "keep-monthly": {
+        "type": "number",
+        "description": "How many monthly restore points are kept behind the weeklies, a count from 1 to 9999, refused by the night like keep-daily; lowering it deletes the restore points beyond the new count at the next night, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 6
+      },
+      "keep-hand-taken-days": {
+        "type": "number",
+        "description": "How many days a restore point taken by hand (node-backup.now, or the mesh's before a module moves) is kept at least, a count from 1 to 9999; it is kept until a later good night of its module exists, and this many days in any case, so the next thinning never takes the one taken against a risky change (novox/hq issue 453). Lowering it lets go of the older ones taken by hand at the next thinning, and that cannot be undone.",
+        "minimum": 1,
+        "maximum": 9999,
+        "trusted": true,
+        "default": 7
+      }
+    },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "repository",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "declared",
+      "type": "file",
+      "path": "${dir:state}/backups.conf",
+      "mode": "0600",
+      "template": "files/backups.conf"
+    },
+    {
+      "id": "data-declared",
+      "type": "file",
+      "path": "${dir:state}/data.conf",
+      "mode": "0600",
+      "template": "files/data.conf"
+    },
+    {
+      "id": "retention",
+      "type": "file",
+      "path": "${dir:state}/retention.conf",
+      "mode": "0644",
+      "trusted": true,
+      "template": "files/retention.conf"
+    },
+    {
+      "id": "tool",
+      "type": "package",
+      "package": "restic"
+    },
+    {
+      "id": "sqlite",
+      "type": "package",
+      "package": "sqlite"
+    },
+    {
+      "id": "night",
+      "type": "process",
+      "name": "restic-night",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "night"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "tool",
+        "tool": "backup_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    },
+    {
+      "id": "measure",
+      "type": "process",
+      "name": "restic-measure",
+      "artifact": "tools",
+      "run": [
+        "./restic-backups",
+        "measure"
+      ],
+      "user": "${machine:account}",
+      "env": {
+        "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+        "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+        "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+        "MESH_BACKUP_STATE": "${dir:state}",
+        "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+      },
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/restic-backups",
+        "binary": "restic-backups",
+        "loads": [
+          "restic-backups"
+        ],
+        "env": {
+          "MESH_BACKUP_DECLARED": "${dir:state}/backups.conf",
+          "MESH_BACKUP_REPOSITORY": "${dir:repository}",
+          "MESH_BACKUP_PASSWORD_FILE": "${dir:state}/repository.secret",
+          "MESH_BACKUP_STATE": "${dir:state}",
+          "MESH_BACKUP_DATA": "${dir:state}/data.conf"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/bin/dmenu b/testdata/beside/mesh-catalog/modules/rofi/files/bin/dmenu
new file mode 100755
index 0000000..b7460e9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/bin/dmenu
@@ -0,0 +1,26 @@
+#!/bin/sh
+# dmenu, as this node's launcher answers it (module rofi, novox/hq ADR 0208). The node-launcher
+# seat's dmenu-compatible command: choices on standard input, the chosen one on standard output,
+# exit 1 when nothing was chosen. A script calls `dmenu` and works whichever module holds the seat.
+#
+# rofi understands dmenu's -p, -l and -i. dmenu's look options (-fn, -nb, -nf, -sb, -sf, -m, -w)
+# take a value rofi would misread, so they are dropped with it; -b and -f are dropped alone. The
+# look is the launcher's theme.
+set -u
+n=$#
+while [ "$n" -gt 0 ]; do
+	arg=$1
+	shift
+	n=$((n - 1))
+	case $arg in
+	-fn | -nb | -nf | -sb | -sf | -m | -w)
+		if [ "$n" -gt 0 ]; then
+			shift
+			n=$((n - 1))
+		fi
+		;;
+	-b | -f) ;;
+	*) set -- "$@" "$arg" ;;
+	esac
+done
+exec rofi -dmenu "$@"
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-launch b/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-launch
new file mode 100755
index 0000000..788f23c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-launch
@@ -0,0 +1,39 @@
+#!/bin/sh
+# rofi-launch drun|run|window|filebrowser|sudo (module rofi, novox/hq ADR 0208): what the launcher's
+# key bindings run.
+#
+# After a resume the keyboard grab can fail for a moment, and rofi then exits at once: a key press
+# that opens nothing. So a failure within half a second is tried again, up to five times. A person
+# closing the menu takes longer than that, and is never shown it a second time.
+set -u
+mode=${1:-drun}
+
+now_ms() { date +%s%3N; }
+
+attempt() {
+	i=0
+	while [ "$i" -lt 5 ]; do
+		start=$(now_ms)
+		"$@" && return 0
+		[ $(($(now_ms) - start)) -ge 500 ] && return 1
+		i=$((i + 1))
+		sleep 0.1
+	done
+	return 1
+}
+
+case $mode in
+drun | run | window | filebrowser)
+	attempt rofi -show "$mode"
+	;;
+sudo)
+	# A command line, run with sudo in the node's terminal.
+	command=$(attempt rofi -dmenu -p sudo </dev/null) || exit 0
+	[ -n "$command" ] || exit 0
+	exec rofi-sensible-terminal -e sudo sh -c "$command"
+	;;
+*)
+	echo "rofi-launch: no mode $mode (drun, run, window, filebrowser, sudo)" >&2
+	exit 2
+	;;
+esac
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-powermenu b/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-powermenu
new file mode 100755
index 0000000..2bdf64c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/bin/rofi-powermenu
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# rofi-powermenu (module rofi, novox/hq ADR 0208): lock, suspend, log out, reboot, shut down.
+#
+# It belongs to the session, and it is the launcher's: its whole face is rofi's. Every action is a
+# verb of logind or the service manager, so nothing here names a window manager or a locker:
+#   - lock asks logind to lock the session, which the holder of node-lock-screen answers;
+#   - log out ends this login session, whichever window manager runs in it.
+# Adopted from the workstations' power menu of 2026-10-04 (after adi1090x's powermenu type-2).
+set -u
+
+theme=mesh-powermenu
+uptime="$(uptime -p | sed -e 's/^up //')"
+
+shutdown='󰤂'
+reboot='󰜉'
+lock='󰌾'
+suspend='󰤄'
+logout='󰍃'
+yes='󰄲'
+no='󰅖'
+
+menu() {
+	rofi -dmenu -p "Uptime: $uptime" -mesg "Uptime: $uptime" -theme "$theme"
+}
+
+confirm() {
+	printf '%s\n%s\n' "$yes" "$no" | rofi -dmenu -p 'Confirmation' -mesg 'Are you sure?' -theme "$theme" \
+		-theme-str 'window {location: center; anchor: center; fullscreen: false; width: 350px;}' \
+		-theme-str 'mainbox {children: [ "message", "listview" ];}' \
+		-theme-str 'listview {columns: 2; lines: 1;}' \
+		-theme-str 'element-text {horizontal-align: 0.5;}' \
+		-theme-str 'textbox {horizontal-align: 0.5;}'
+}
+
+session() {
+	# The login session this menu runs in: the session's own id, else logind's answer for this process.
+	if [ -n "${XDG_SESSION_ID:-}" ]; then
+		echo "$XDG_SESSION_ID"
+	else
+		loginctl show-session auto -p Id --value 2>/dev/null
+	fi
+}
+
+confirmed() { [ "$(confirm)" = "$yes" ]; }
+
+chosen="$(printf '%s\n' "$lock" "$suspend" "$logout" "$reboot" "$shutdown" | menu)" || exit 0
+case $chosen in
+"$lock") loginctl lock-session "$(session)" ;;
+"$suspend") confirmed && systemctl suspend ;;
+"$logout") confirmed && loginctl terminate-session "$(session)" ;;
+"$reboot") confirmed && systemctl reboot ;;
+"$shutdown") confirmed && systemctl poweroff ;;
+esac
+exit 0
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/config.rasi b/testdata/beside/mesh-catalog/modules/rofi/files/config.rasi
new file mode 100644
index 0000000..d123371
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/config.rasi
@@ -0,0 +1,54 @@
+/* rofi, the launcher (module rofi, novox/hq ADR 0208). Owned by the mesh: this file is replaced at
+ * every push. Adopted from the two workstations' file of 2026-10-04: the settings that differ from
+ * rofi's defaults, nothing else. Its look is the theme "mesh", in themes/ beside this file. */
+
+configuration {
+	modi: "drun,run,window,filebrowser";
+	show-icons: true;
+	case-sensitive: false;
+	normalize-match: true;
+	matching: "normal";
+	tokenize: true;
+	cycle: true;
+	steal-focus: false;
+	click-to-exit: true;
+	sort: false;
+
+	/* Applications: the user's and the system's desktop entries, read fresh each time so a
+	 * program installed a minute ago is there. */
+	drun-match-fields: "name,generic,exec,categories,keywords";
+	drun-display-format: "{name} [<span weight='light' size='small'><i>({generic})</i></span>]";
+	drun-show-actions: false;
+	drun-url-launcher: "xdg-open";
+	drun-use-desktop-cache: false;
+	drun-reload-desktop-cache: false;
+	run,drun {
+		fallback-icon: "application-x-addon";
+	}
+
+	/* A command run from `run` opens in the node's terminal when it asks for one. */
+	terminal: "rofi-sensible-terminal";
+	run-shell-command: "{terminal} -e {cmd}";
+	ssh-command: "{terminal} -e {ssh-client} {host} [-p {port}]";
+	parse-hosts: true;
+	parse-known-hosts: true;
+
+	window-match-fields: "title,class,role,name,desktop";
+	window-format: "{w} - {c} - {t:0}";
+
+	disable-history: false;
+	max-history-size: 25;
+
+	filebrowser {
+		directories-first: true;
+		sorting-method: "name";
+	}
+
+	display-window: "Windows";
+	display-run: "Run";
+	display-ssh: "SSH";
+	display-drun: "Apps";
+	display-filebrowser: "Files";
+}
+
+@theme "mesh"
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/i3/50-rofi.conf b/testdata/beside/mesh-catalog/modules/rofi/files/i3/50-rofi.conf
new file mode 100644
index 0000000..1395d2c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/i3/50-rofi.conf
@@ -0,0 +1,8 @@
+# The launcher's key bindings (module rofi, novox/hq ADR 0208). Owned by the mesh: replaced at every
+# push. i3 reads this file through its configuration's `include ~/.config/i3/config.d/*.conf`, after
+# the variables it sets, so $mod is i3's.
+bindsym $mod+d exec --no-startup-id ~/.local/bin/rofi-launch drun
+bindsym $mod+t exec --no-startup-id ~/.local/bin/rofi-launch run
+bindsym $mod+Shift+t exec --no-startup-id ~/.local/bin/rofi-launch sudo
+bindsym $mod+Shift+w exec --no-startup-id ~/.local/bin/rofi-launch window
+bindsym $mod+Escape exec --no-startup-id ~/.local/bin/rofi-powermenu
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh-powermenu.rasi b/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh-powermenu.rasi
new file mode 100644
index 0000000..5b837f4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh-powermenu.rasi
@@ -0,0 +1,172 @@
+/**
+ * The theme "mesh-powermenu" (module rofi, novox/hq ADR 0208): the power menu's five buttons.
+ * Owned by the mesh; replaced at every push. Adopted from the workstations' power menu theme of
+ * 2026-10-04 (after adi1090x's powermenu type-2, style-1), its colours inlined.
+ **/
+
+/*****----- Configuration -----*****/
+configuration {
+    show-icons:                 false;
+}
+
+/*****----- Global Properties -----*****/
+* {
+    background:                  #000000FF;
+    background-alt:              #282B31FF;
+    foreground:                  #FFFFFFFF;
+    selected:                    #DE5200FF;
+    active:                      #DE5200FF;
+    urgent:                      #CC0000FF;
+
+    font:                        "JetBrainsMono Nerd Font 11";
+}
+
+
+/*****----- Main Window -----*****/
+window {
+    /* properties for window widget */
+    transparency:                "real";
+    location:                    center;
+    anchor:                      center;
+    fullscreen:                  false;
+    width:                       800px;
+    x-offset:                    0px;
+    y-offset:                    0px;
+
+    /* properties for all widgets */
+    enabled:                     true;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    cursor:                      "default";
+    background-color:            @background;
+}
+
+/*****----- Main Box -----*****/
+mainbox {
+    enabled:                     true;
+    spacing:                     15px;
+    margin:                      0px;
+    padding:                     30px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            transparent;
+    children:                    [ "inputbar", "listview" ];
+}
+
+/*****----- Inputbar -----*****/
+inputbar {
+    enabled:                     true;
+    spacing:                     15px;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            transparent;
+    text-color:                  @foreground;
+    children:                    [ "textbox-prompt-colon", "prompt"];
+}
+
+dummy {
+    background-color:            transparent;
+}
+
+textbox-prompt-colon {
+    enabled:                     true;
+    expand:                      false;
+    str:                         "";
+    padding:                     12px 16px;
+    border-radius:               0px;
+    background-color:            @urgent;
+    text-color:                  @background;
+}
+prompt {
+    enabled:                     true;
+    padding:                     12px;
+    border-radius:               0px;
+    background-color:            @active;
+    text-color:                  @background;
+}
+
+/*****----- Message -----*****/
+message {
+    enabled:                     true;
+    margin:                      0px;
+    padding:                     12px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            @background-alt;
+    text-color:                  @foreground;
+}
+textbox {
+    background-color:            inherit;
+    text-color:                  inherit;
+    vertical-align:              0.5;
+    horizontal-align:            0.5;
+    placeholder-color:           @foreground;
+    blink:                       true;
+    markup:                      true;
+}
+error-message {
+    padding:                     12px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            @background;
+    text-color:                  @foreground;
+}
+
+/*****----- Listview -----*****/
+listview {
+    enabled:                     true;
+    columns:                     5;
+    lines:                       1;
+    cycle:                       true;
+    dynamic:                     true;
+    scrollbar:                   false;
+    layout:                      vertical;
+    reverse:                     false;
+    fixed-height:                true;
+    fixed-columns:               true;
+
+    spacing:                     15px;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            transparent;
+    text-color:                  @foreground;
+    cursor:                      "default";
+}
+
+/*****----- Elements -----*****/
+element {
+    enabled:                     true;
+    spacing:                     0px;
+    margin:                      0px;
+    padding:                     40px 10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @selected;
+    background-color:            @background-alt;
+    text-color:                  @foreground;
+    cursor:                      pointer;
+}
+element-text {
+    font:                        "JetBrainsMono Nerd Font Bold 32";
+    background-color:            transparent;
+    text-color:                  inherit;
+    cursor:                      inherit;
+    vertical-align:              0.5;
+    horizontal-align:            0.5;
+}
+element selected.normal {
+    background-color:            var(selected);
+    text-color:                  var(background);
+}
diff --git a/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh.rasi b/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh.rasi
new file mode 100644
index 0000000..8be0f55
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/files/themes/mesh.rasi
@@ -0,0 +1,263 @@
+/**
+ * The theme "mesh" (module rofi, novox/hq ADR 0208): every rofi window unless a caller names
+ * another. Owned by the mesh; replaced at every push. Adopted from the workstations' theme of
+ * 2026-10-04 (after adi1090x's launcher type-4, style-1), its colour file inlined so the theme is
+ * one file, and its face the monospace one every desktop module names.
+ **/
+
+/*****----- Global Properties -----*****/
+* {
+    background:                  #000000FF;
+    background-alt:              #282B31FF;
+    foreground:                  #FFFFFFFF;
+    selected:                    #DE5200FF;
+    active:                      #DE5200FF;
+    urgent:                      #CC0000FF;
+
+    font:                        "JetBrainsMono Nerd Font 11";
+
+    border-colour:               var(selected);
+    handle-colour:               var(selected);
+    background-colour:           var(background);
+    foreground-colour:           var(foreground);
+    alternate-background:        var(background-alt);
+    normal-background:           var(background);
+    normal-foreground:           var(foreground);
+    urgent-background:           var(urgent);
+    urgent-foreground:           var(background);
+    active-background:           var(active);
+    active-foreground:           var(background);
+    selected-normal-background:  var(selected);
+    selected-normal-foreground:  var(background);
+    selected-urgent-background:  var(active);
+    selected-urgent-foreground:  var(background);
+    selected-active-background:  var(urgent);
+    selected-active-foreground:  var(background);
+    alternate-normal-background: var(background);
+    alternate-normal-foreground: var(foreground);
+    alternate-urgent-background: var(urgent);
+    alternate-urgent-foreground: var(background);
+    alternate-active-background: var(active);
+    alternate-active-foreground: var(background);
+}
+
+/*****----- Main Window -----*****/
+window {
+    transparency:                "real";
+    location:                    center;
+    anchor:                      center;
+    fullscreen:                  false;
+    width:                       600px;
+    x-offset:                    0px;
+    y-offset:                    0px;
+    enabled:                     true;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      1px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    cursor:                      "default";
+    background-color:            @background-colour;
+}
+
+/*****----- Main Box -----*****/
+mainbox {
+    enabled:                     true;
+    spacing:                     10px;
+    margin:                      0px;
+    padding:                     10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            transparent;
+    children:                    [ "inputbar", "message", "listview", "mode-switcher" ];
+}
+
+/*****----- Inputbar -----*****/
+inputbar {
+    enabled:                     true;
+    spacing:                     10px;
+    margin:                      0px;
+    padding:                     10px;
+    border:                      0px 0px 1px 0px;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            @alternate-background;
+    text-color:                  @foreground-colour;
+    children:                    [ "prompt", "entry" ];
+}
+
+prompt {
+    enabled:                     true;
+    background-color:            inherit;
+    text-color:                  inherit;
+}
+textbox-prompt-colon {
+    enabled:                     true;
+    expand:                      false;
+    str:                         "::";
+    background-color:            inherit;
+    text-color:                  inherit;
+}
+entry {
+    enabled:                     true;
+    background-color:            inherit;
+    text-color:                  inherit;
+    cursor:                      text;
+    placeholder:                 "Search...";
+    placeholder-color:           inherit;
+}
+
+/*****----- Listview -----*****/
+listview {
+    enabled:                     true;
+    columns:                     1;
+    lines:                       8;
+    cycle:                       true;
+    dynamic:                     true;
+    scrollbar:                   false;
+    layout:                      vertical;
+    reverse:                     false;
+    fixed-height:                true;
+    fixed-columns:               true;
+    spacing:                     0px;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            transparent;
+    text-color:                  @foreground-colour;
+    cursor:                      "default";
+}
+scrollbar {
+    handle-width:                5px;
+    handle-color:                @handle-colour;
+    border-radius:               0px;
+    background-color:            @alternate-background;
+}
+
+/*****----- Elements -----*****/
+element {
+    enabled:                     true;
+    spacing:                     10px;
+    margin:                      0px;
+    padding:                     10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            transparent;
+    text-color:                  @foreground-colour;
+    cursor:                      pointer;
+}
+element normal.normal {
+    background-color:            var(normal-background);
+    text-color:                  var(normal-foreground);
+}
+element normal.urgent {
+    background-color:            var(urgent-background);
+    text-color:                  var(urgent-foreground);
+}
+element normal.active {
+    background-color:            var(active-background);
+    text-color:                  var(active-foreground);
+}
+element selected.normal {
+    background-color:            var(selected-normal-background);
+    text-color:                  var(selected-normal-foreground);
+}
+element selected.urgent {
+    background-color:            var(selected-urgent-background);
+    text-color:                  var(selected-urgent-foreground);
+}
+element selected.active {
+    background-color:            var(selected-active-background);
+    text-color:                  var(selected-active-foreground);
+}
+element alternate.normal {
+    background-color:            var(alternate-normal-background);
+    text-color:                  var(alternate-normal-foreground);
+}
+element alternate.urgent {
+    background-color:            var(alternate-urgent-background);
+    text-color:                  var(alternate-urgent-foreground);
+}
+element alternate.active {
+    background-color:            var(alternate-active-background);
+    text-color:                  var(alternate-active-foreground);
+}
+element-icon {
+    background-color:            transparent;
+    text-color:                  inherit;
+    size:                        24px;
+    cursor:                      inherit;
+}
+element-text {
+    background-color:            transparent;
+    text-color:                  inherit;
+    highlight:                   inherit;
+    cursor:                      inherit;
+    vertical-align:              0.5;
+    horizontal-align:            0.0;
+}
+
+/*****----- Mode Switcher -----*****/
+mode-switcher {
+    enabled:                     true;
+    spacing:                     10px;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            transparent;
+    text-color:                  @foreground-colour;
+}
+button {
+    padding:                     10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            @alternate-background;
+    text-color:                  inherit;
+    cursor:                      pointer;
+}
+button selected {
+    background-color:            var(selected-normal-background);
+    text-color:                  var(selected-normal-foreground);
+}
+
+/*****----- Message -----*****/
+message {
+    enabled:                     true;
+    margin:                      0px;
+    padding:                     0px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            transparent;
+    text-color:                  @foreground-colour;
+}
+textbox {
+    font:                        "Inter 11";
+    padding:                     10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            @alternate-background;
+    text-color:                  @foreground-colour;
+    vertical-align:              0.5;
+    horizontal-align:            0.0;
+    highlight:                   none;
+    placeholder-color:           @foreground-colour;
+    blink:                       true;
+    markup:                      true;
+}
+error-message {
+    padding:                     10px;
+    border:                      0px solid;
+    border-radius:               0px;
+    border-color:                @border-colour;
+    background-color:            @background-colour;
+    text-color:                  @foreground-colour;
+}
diff --git a/testdata/beside/mesh-catalog/modules/rofi/module.json.captured b/testdata/beside/mesh-catalog/modules/rofi/module.json.captured
new file mode 100644
index 0000000..fbd061d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/rofi/module.json.captured
@@ -0,0 +1,124 @@
+{
+  "module": "rofi",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-launcher",
+      "scope": "node",
+      "serves": [
+        "menu",
+        "secret"
+      ]
+    }
+  ],
+  "tools": [
+    "rofi_applications",
+    "rofi_themes",
+    "rofi_run"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "rofi"
+    },
+    {
+      "id": "configuration-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/rofi",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "themes-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/rofi/themes",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "configuration",
+      "type": "file",
+      "path": "${machine:account-home}/.config/rofi/config.rasi",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/config.rasi"
+    },
+    {
+      "id": "theme",
+      "type": "file",
+      "path": "${machine:account-home}/.config/rofi/themes/mesh.rasi",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/themes/mesh.rasi"
+    },
+    {
+      "id": "theme-powermenu",
+      "type": "file",
+      "path": "${machine:account-home}/.config/rofi/themes/mesh-powermenu.rasi",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/themes/mesh-powermenu.rasi"
+    },
+    {
+      "id": "dmenu",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/dmenu",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/dmenu"
+    },
+    {
+      "id": "launch",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/rofi-launch",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/rofi-launch"
+    },
+    {
+      "id": "powermenu",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/rofi-powermenu",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/rofi-powermenu"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/rofi-tools",
+        "binary": "rofi-tools",
+        "loads": [
+          "rofi-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/i3/50-rofi.conf"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/route-adapter/files/config.json b/testdata/beside/mesh-catalog/modules/route-adapter/files/config.json
new file mode 100644
index 0000000..1d8d8c2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/route-adapter/files/config.json
@@ -0,0 +1,6 @@
+{
+  "dynamic": "/services/traefik/dynamic",
+  "entrypoint": "websecure",
+  "certificate-resolver": "le",
+  "machine": "host.docker.internal"
+}
diff --git a/testdata/beside/mesh-catalog/modules/route-adapter/module.json.captured b/testdata/beside/mesh-catalog/modules/route-adapter/module.json.captured
new file mode 100644
index 0000000..5234c78
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/route-adapter/module.json.captured
@@ -0,0 +1,134 @@
+{
+  "module": "route-adapter",
+  "version": "1",
+  "moved": true,
+  "slug": "radapt",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "route",
+      "scope": "mesh",
+      "identity": false
+    }
+  ],
+  "serves": {
+    "route": {}
+  },
+  "receives": {
+    "route": "${dir:routes-dir}/mesh.json"
+  },
+  "accesses": [
+    {
+      "id": "dynamic",
+      "path": "/services/traefik/dynamic",
+      "mode": "read-write"
+    }
+  ],
+  "config": {
+    "dynamic": {
+      "type": "string",
+      "description": "The directory the predecessor proxy's file provider reads, on this machine, as an absolute path.",
+      "pattern": "/.*",
+      "trusted": true,
+      "default": "/services/traefik/dynamic"
+    },
+    "entrypoint": {
+      "type": "string",
+      "description": "The predecessor proxy's entry point it serves public HTTPS on, by its own name.",
+      "trusted": true,
+      "default": "websecure"
+    },
+    "certificate-resolver": {
+      "type": "string",
+      "description": "The predecessor proxy's certificate resolver, by its own name.",
+      "trusted": true,
+      "default": "le"
+    },
+    "machine": {
+      "type": "string",
+      "description": "How the predecessor's proxy reaches this machine: a host name or an address.",
+      "trusted": true,
+      "default": "host.docker.internal"
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "routes-dir",
+      "type": "directory",
+      "path": "/var/lib/route-adapter/routes",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:state}/config.json",
+      "takes-config": ["dynamic", "entrypoint", "certificate-resolver", "machine"],
+      "merge": "json",
+      "mode": "0644",
+      "template": "files/config.json"
+    },
+    {
+      "id": "adapt",
+      "type": "process",
+      "name": "route-adapter",
+      "artifact": "code",
+      "run": [
+        "node",
+        "index.js"
+      ],
+      "run-once": true,
+      "env": {
+        "MESH_RECEIVES": "${dir:routes-dir}/mesh.json",
+        "MESH_ROUTE_ADAPTER_CONFIG": "${dir:state}/config.json"
+      },
+      "restart-on": [
+        "received-route",
+        "config"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js"
+        ]
+      },
+      {
+        "name": "provider",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/route-provider",
+        "binary": "route-provider",
+        "loads": [
+          "route-provider"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "state": [
+    "bound"
+  ],
+  "reads": [
+    "mesh-controller.assignments"
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/screen-lock/files/bin/screen-lock b/testdata/beside/mesh-catalog/modules/screen-lock/files/bin/screen-lock
new file mode 100755
index 0000000..18008bd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/screen-lock/files/bin/screen-lock
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# screen-lock (module screen-lock, novox/hq ADR 0208): the locker. xss-lock runs it on idle, before
+# suspend and on logind's Lock, and node-lock-screen's `lock` ends in it.
+#
+# The operator's look, adopted from the predecessor's my-i3lock: the screen as it was, blurred, with
+# an orange ring, the time and the date. That needs i3lock-color, from the distribution's user
+# repository, kept as found until the mesh carries such software (novox/hq research 027, question 1).
+# On a machine without it the distribution's i3lock shows the same blurred screen, taken here, with
+# its own plain ring; failing that, black.
+#
+# Before a suspend, xss-lock hands this script a lock on the sleep (XSS_SLEEP_LOCK_FD) and suspends
+# once it is released. The locker must not inherit it, or the machine would wait for the unlock
+# before sleeping; it is released once i3lock is up, so the machine never sleeps unlocked. This is
+# xss-lock's own documented pattern for i3lock.
+set -u
+
+# One locker: a second press of the key, or a lock while locked, changes nothing.
+if pgrep -xu "$EUID" i3lock >/dev/null; then
+	exit 0
+fi
+
+# The colour build numbers its versions <n>.c.<n> (2.13.c.5); its version line never says "color".
+if i3lock --version 2>&1 | grep -qE '[0-9]\.c\.[0-9]'; then
+	blank='#00000000' clear='#ffffff22' accent='#ca4a00' wrong='#880000bb' verifying='#bb00bbbb'
+	options=(
+		--insidever-color="$clear" --ringver-color="$verifying"
+		--insidewrong-color="$clear" --ringwrong-color="$wrong"
+		--inside-color="$blank" --ring-color="$accent" --line-color="$blank" --separator-color="$accent"
+		--verif-color="$accent" --wrong-color="$accent" --time-color="$accent" --date-color="$accent"
+		--layout-color="$accent" --keyhl-color="$wrong" --bshl-color="$wrong"
+		--screen 1 --blur 5 --ring-width=7.0 --clock --indicator
+		--time-str="%H:%M:%S" --date-str="%A, %Y-%m-%d"
+		--time-font=sans-serif --date-font=sans-serif --verif-font=sans-serif
+		--wrong-font=sans-serif --layout-font=sans-serif --keylayout 1
+		--show-failed-attempts --ignore-empty-password
+	)
+else
+	options=(--color=000000 --show-failed-attempts --ignore-empty-password)
+	shot="${XDG_RUNTIME_DIR:-/tmp}/screen-lock.png"
+	if command -v magick >/dev/null && magick import -window root -resize 25% -blur 0x3 -resize 400% "$shot" 2>/dev/null; then
+		options+=(--image="$shot")
+	fi
+fi
+
+if [[ -e /dev/fd/${XSS_SLEEP_LOCK_FD:--1} ]]; then
+	kill_i3lock() { pkill -xu "$EUID" "$@" i3lock; }
+	trap kill_i3lock TERM INT
+	i3lock "${options[@]}" {XSS_SLEEP_LOCK_FD}<&-
+	exec {XSS_SLEEP_LOCK_FD}<&-
+	while kill_i3lock -0; do
+		sleep 0.5
+	done
+else
+	trap 'kill %%' TERM INT
+	i3lock --nofork "${options[@]}" &
+	wait
+fi
diff --git a/testdata/beside/mesh-catalog/modules/screen-lock/files/xinitrc-normal b/testdata/beside/mesh-catalog/modules/screen-lock/files/xinitrc-normal
new file mode 100644
index 0000000..f7f7123
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/screen-lock/files/xinitrc-normal
@@ -0,0 +1,8 @@
+# The lock screen (module screen-lock, novox/hq ADR 0208): the session locks after 30 minutes idle,
+# the displays go to standby and suspend then and off after an hour, and xss-lock runs the locker on
+# idle, before suspend and on logind's Lock. xss-lock needs this login session, so it starts here and
+# not as a unit. It is started again if it exits, for as long as this session lasts ($$ is the
+# session's own process, which becomes the window manager).
+xset s 1800 1800
+xset dpms 1800 1800 3600
+(while kill -0 $$ 2>/dev/null; do xss-lock --transfer-sleep-lock -- "$HOME/.local/bin/screen-lock"; sleep 2; done) &
diff --git a/testdata/beside/mesh-catalog/modules/screen-lock/module.json.captured b/testdata/beside/mesh-catalog/modules/screen-lock/module.json.captured
new file mode 100644
index 0000000..1791c79
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/screen-lock/module.json.captured
@@ -0,0 +1,78 @@
+{
+  "module": "screen-lock",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-lock-screen",
+      "scope": "node",
+      "serves": [
+        "lock"
+      ]
+    }
+  ],
+  "tools": [
+    "screen_lock_idle",
+    "screen_lock_inhibit",
+    "screen_lock_locked"
+  ],
+  "items": [
+    {
+      "collection": "shell:xinitrc:normal",
+      "name": "xinitrc-normal",
+      "template": "files/xinitrc-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "screensaver",
+      "type": "package",
+      "package": "xscreensaver",
+      "absent": true
+    },
+    {
+      "id": "watcher",
+      "type": "package",
+      "package": "xss-lock"
+    },
+    {
+      "id": "locker",
+      "type": "package",
+      "package": "i3lock"
+    },
+    {
+      "id": "wrapper",
+      "type": "file",
+      "path": "${machine:account-home}/.local/bin/screen-lock",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "template": "files/bin/screen-lock"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/screen-lock-tools",
+        "binary": "screen-lock-tools",
+        "loads": [
+          "screen-lock-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/searxng/files/config.json b/testdata/beside/mesh-catalog/modules/searxng/files/config.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/searxng/files/config.json
@@ -0,0 +1 @@
+{}
diff --git a/testdata/beside/mesh-catalog/modules/searxng/files/settings.yml b/testdata/beside/mesh-catalog/modules/searxng/files/settings.yml
new file mode 100644
index 0000000..6d7248e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/searxng/files/settings.yml
@@ -0,0 +1,16 @@
+{
+  "use_default_settings": true,
+  "server": {
+    "secret_key": "${secret:secret}",
+    "base_url": false,
+    "limiter": false,
+    "image_proxy": false,
+    "public_instance": false
+  },
+  "search": {
+    "formats": ["html", "json"]
+  },
+  "valkey": {
+    "url": "valkey://valkey:6379/0"
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/searxng/module.json.captured b/testdata/beside/mesh-catalog/modules/searxng/module.json.captured
new file mode 100644
index 0000000..cee18e4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/searxng/module.json.captured
@@ -0,0 +1,229 @@
+{
+  "module": "searxng",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "own-secrets": {
+    "secret": {
+      "path": "${dir:mesh-state}/secret",
+      "taken": "at-start"
+    }
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the search pages"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "valkey",
+        "path": "${dir:valkey-data}",
+        "class": "cache",
+        "why": "the search cache"
+      }
+    ]
+  },
+  "config": {
+    "general": {
+      "type": "object",
+      "description": "SearXNG's general section of settings.yml, laid over the file's own and SearXNG's defaults: the instance's name, contact and debug switches.",
+      "trusted": true,
+      "default": {}
+    },
+    "brand": {
+      "type": "object",
+      "description": "SearXNG's brand section of settings.yml, laid over the file's own and SearXNG's defaults: the links the pages show for the instance's source, issues and documentation.",
+      "trusted": true,
+      "default": {}
+    },
+    "search": {
+      "type": "object",
+      "description": "SearXNG's search section of settings.yml, laid over the file's own and SearXNG's defaults: safe search, autocomplete, the result formats offered and how long an engine is suspended after an error.",
+      "trusted": true,
+      "default": {
+        "formats": [
+          "html",
+          "json"
+        ]
+      }
+    },
+    "server": {
+      "type": "object",
+      "description": "SearXNG's server section of settings.yml, laid over the file's own and SearXNG's defaults: the public base URL, the request method, the limiter and the image proxy; its secret_key is the vault's.",
+      "trusted": true,
+      "default": {
+        "secret_key": "${secret:secret}",
+        "base_url": false,
+        "limiter": false,
+        "image_proxy": false,
+        "public_instance": false
+      }
+    },
+    "ui": {
+      "type": "object",
+      "description": "SearXNG's ui section of settings.yml, laid over the file's own and SearXNG's defaults: the theme, the default locale and how results are shown.",
+      "trusted": true,
+      "default": {}
+    },
+    "outgoing": {
+      "type": "object",
+      "description": "SearXNG's outgoing section of settings.yml, laid over the file's own and SearXNG's defaults: how SearXNG reaches the engines: timeouts, connection pool and proxies.",
+      "trusted": true,
+      "default": {}
+    },
+    "engines": {
+      "type": "list",
+      "description": "SearXNG's engines section of settings.yml, laid over the file's own and SearXNG's defaults: the engines to add or change, each by its name.",
+      "trusted": true,
+      "default": []
+    },
+    "plugins": {
+      "type": "object",
+      "description": "SearXNG's plugins section of settings.yml, laid over the file's own and SearXNG's defaults: the plugins to switch on or off, by their id.",
+      "trusted": true,
+      "default": {}
+    },
+    "categories_as_tabs": {
+      "type": "object",
+      "description": "SearXNG's categories_as_tabs section of settings.yml, laid over the file's own and SearXNG's defaults: the categories shown as tabs above the results.",
+      "trusted": true,
+      "default": {}
+    },
+    "preferences": {
+      "type": "object",
+      "description": "SearXNG's preferences section of settings.yml, laid over the file's own and SearXNG's defaults: the preferences a user cannot change (lock).",
+      "trusted": true,
+      "default": {}
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "valkey-data",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "searxng"
+    },
+    {
+      "id": "cache",
+      "type": "container",
+      "name": "valkey",
+      "image": "valkey/valkey@sha256:b21fd94099dcd4bc6b2b9230daef69b6558b887ad4a2a1afe56ff6e745a88cdb",
+      "network": "searxng",
+      "args": [
+        "valkey-server",
+        "--save",
+        "30",
+        "1",
+        "--loglevel",
+        "warning"
+      ],
+      "volumes": [
+        "${dir:valkey-data}:/data"
+      ]
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.yml",
+      "mode": "0600",
+      "merge": "json",
+      "takes-config": [
+        "general",
+        "brand",
+        "search",
+        "server",
+        "ui",
+        "outgoing",
+        "engines",
+        "plugins",
+        "categories_as_tabs",
+        "preferences"
+      ],
+      "template": "files/settings.yml"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "searxng",
+      "image": "searxng/searxng@sha256:cd8812607ab73730a0b1a0dc4990223fe1b9e383f6f35947114d0bef7f8bb441",
+      "network": "searxng",
+      "ports": [
+        "8080"
+      ],
+      "volumes": [
+        "${dir:state}/settings.yml:/etc/searxng/settings.yml:ro"
+      ],
+      "restart-on": [
+        "settings"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "searxng",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_SEARXNG_URL": "http://127.0.0.1:${port:8080}",
+          "MESH_SEARXNG_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/sensors/module.json.captured b/testdata/beside/mesh-catalog/modules/sensors/module.json.captured
new file mode 100644
index 0000000..3df6783
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/sensors/module.json.captured
@@ -0,0 +1,69 @@
+{
+  "module": "sensors",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "sensors_summary",
+    "sensors_temperatures",
+    "sensors_fans",
+    "sensors_drives",
+    "sensors_faults",
+    "sensors_health"
+  ],
+  "resources": [
+    {
+      "id": "smartmontools",
+      "type": "package",
+      "package": "smartmontools"
+    },
+    {
+      "id": "drives",
+      "type": "process",
+      "name": "sensors-drives",
+      "artifact": "tools",
+      "run": [
+        "./sensors",
+        "drives"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "sensors-watch",
+      "artifact": "tools",
+      "run": [
+        "./sensors",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "sensors_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/sensors",
+        "binary": "sensors",
+        "loads": [
+          "sensors"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/showcase/files/README.md b/testdata/beside/mesh-catalog/modules/showcase/files/README.md
new file mode 100644
index 0000000..5c369cc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/showcase/files/README.md
@@ -0,0 +1,6 @@
+# showcase's packed files
+
+Packed as an `archive` artifact and unpacked onto the machine by an `archive` resource.
+
+This exists to exercise the case inlining cannot serve: a tree of files that belongs on a machine
+and would make a declaration enormous if it were carried inside one.
diff --git a/testdata/beside/mesh-catalog/modules/showcase/files/marker.txt b/testdata/beside/mesh-catalog/modules/showcase/files/marker.txt
new file mode 100644
index 0000000..0246772
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/showcase/files/marker.txt
@@ -0,0 +1 @@
+showcase
diff --git a/testdata/beside/mesh-catalog/modules/showcase/module.json.captured b/testdata/beside/mesh-catalog/modules/showcase/module.json.captured
new file mode 100644
index 0000000..e657e2a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/showcase/module.json.captured
@@ -0,0 +1,207 @@
+{
+  "module": "showcase",
+  "version": "1",
+  "templates": "templates",
+  "slug": "show",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "greeting",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "greeting": {
+      "path": "/greeting"
+    }
+  },
+  "requires": [
+    "postgres-database"
+  ],
+  "binds": {
+    "postgres-database": "${dir:state}/database.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret"
+  },
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "claims": [
+    {
+      "name": "the-showcase",
+      "scope": "node"
+    }
+  ],
+  "emits": [
+    "greeted",
+    "acknowledged"
+  ],
+  "consumes": [
+    "showcase.greeted"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the port the daemon itself listens on. The mesh assigns the machine-side number and tells consumers that one (ADR 0038)"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "index.js",
+          "tools/index.js",
+          "provisioner/index.js",
+          "daemon/index.js",
+          "step/index.js",
+          "report/index.js"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      },
+      {
+        "name": "helper",
+        "kind": "upstream",
+        "from": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+      },
+      {
+        "name": "templates",
+        "kind": "archive",
+        "from": "templates"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "showcase",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/showcase"
+    },
+    {
+      "id": "logs",
+      "type": "access",
+      "path": "/var/log",
+      "mode": "0755"
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0755",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/showcase.env",
+      "mode": "0600",
+      "template": "templates/showcase.env"
+    },
+    {
+      "id": "packed",
+      "type": "archive",
+      "path": "/opt/showcase",
+      "artifact": "files",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "showcase"
+    },
+    {
+      "id": "tooling",
+      "type": "package",
+      "package": "jq"
+    },
+    {
+      "id": "migrate",
+      "type": "process",
+      "name": "showcase-migrate",
+      "artifact": "code",
+      "run": [
+        "node",
+        "step/index.js"
+      ],
+      "run-once": true,
+      "env-file": [
+        "${dir:state}/showcase.env"
+      ]
+    },
+    {
+      "id": "server",
+      "type": "process",
+      "name": "showcase",
+      "artifact": "code",
+      "run": [
+        "node",
+        "daemon/index.js"
+      ],
+      "user": "showcase",
+      "env-file": [
+        "${dir:state}/showcase.env"
+      ],
+      "restart-on": [
+        "settings"
+      ]
+    },
+    {
+      "id": "reporting",
+      "type": "process",
+      "name": "showcase-report",
+      "artifact": "code",
+      "run": [
+        "node",
+        "report/index.js"
+      ],
+      "schedule": "0 3 * * *",
+      "env-file": [
+        "${dir:state}/showcase.env"
+      ]
+    },
+    {
+      "id": "tools",
+      "type": "container",
+      "name": "the-showcase",
+      "artifact": "helper",
+      "network": "showcase",
+      "volumes": [
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro"
+      ],
+      "env": {
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "args": [
+        "sleep",
+        "infinity"
+      ]
+    }
+  ],
+  "seats": [
+    {
+      "name": "the-showcase",
+      "scope": "node"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/showcase/templates/showcase.env b/testdata/beside/mesh-catalog/modules/showcase/templates/showcase.env
new file mode 100644
index 0000000..8ea4a90
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/showcase/templates/showcase.env
@@ -0,0 +1,5 @@
+SHOWCASE_GREETING=hello
+SHOWCASE_EVERY_SECONDS=30
+SHOWCASE_STATE=/var/lib/showcase
+SHOWCASE_DATABASE=${bound:postgres-database:at}
+SHOWCASE_LISTEN=${port:8080}
diff --git a/testdata/beside/mesh-catalog/modules/slack/files/display-session b/testdata/beside/mesh-catalog/modules/slack/files/display-session
new file mode 100644
index 0000000..01660f8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/slack/files/display-session
@@ -0,0 +1,11 @@
+# Slack (module slack, novox/hq ADR 0208, ADR 0212). Owned by the mesh: replaced at every push.
+# Its one start: at login, to the tray (-s), with the arguments of the package's own desktop entry.
+# No XDG autostart entry starts it as well; slack_check names one if it appears.
+exec --no-startup-id /usr/bin/slack --gtk-version=3 -s
+# The chat window. Slack owns four X windows, and the only one i3 manages has the class "slack" in
+# lower case; the three of class "Slack" (the packaged entry's StartupWMClass) are its unmanaged
+# helpers and its tray icon, so a rule on class="Slack" matches nothing. window_role keeps a call or
+# screen-share window out of the rules. $ws3 is i3's, in scope here.
+for_window [class="(?i)^slack$" window_role="browser-window"] move to workspace $ws3
+for_window [class="(?i)^slack$" window_role="browser-window"] floating disable
+for_window [class="(?i)^slack$" window_role="browser-window"] border pixel 2
diff --git a/testdata/beside/mesh-catalog/modules/slack/module.json.captured b/testdata/beside/mesh-catalog/modules/slack/module.json.captured
new file mode 100644
index 0000000..9feeedb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/slack/module.json.captured
@@ -0,0 +1,41 @@
+{
+  "module": "slack",
+  "version": "1",
+  "moved": true,
+  "requires": [
+    "x11-display"
+  ],
+  "tools": [
+    "slack_status",
+    "slack_log",
+    "slack_restart",
+    "slack_check"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/slack-tools",
+        "binary": "slack-tools",
+        "loads": [
+          "slack-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "items": [
+    {
+      "collection": "contribution:node-display-session:config",
+      "name": "display-session",
+      "template": "files/display-session"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/snapd/module.json.captured b/testdata/beside/mesh-catalog/modules/snapd/module.json.captured
new file mode 100644
index 0000000..93ad730
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/snapd/module.json.captured
@@ -0,0 +1,31 @@
+{
+  "module": "snapd",
+  "version": "1",
+  "tools": [
+    "snapd_status",
+    "snapd_list",
+    "snapd_info",
+    "snapd_updates",
+    "snapd_disk_usage",
+    "snapd_services",
+    "snapd_changes",
+    "snapd_install",
+    "snapd_remove",
+    "snapd_refresh"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/snapd-tools",
+        "binary": "snapd-tools",
+        "loads": [
+          "snapd-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/ssh-client/files/config b/testdata/beside/mesh-catalog/modules/ssh-client/files/config
new file mode 100644
index 0000000..dac07fb
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ssh-client/files/config
@@ -0,0 +1,6 @@
+# The mesh's region (module ssh-client, novox/hq research 027/03). It comes first because ssh
+# takes the first value it finds for each option. It brings in ~/.ssh/config.d/ in name order:
+# 00-mesh, the mesh's Host per machine, then each file another module places there. Replaced at
+# every push. Everything below it is yours, kept as you wrote it, and applies to every host the
+# files above leave unsettled.
+Include ~/.ssh/config.d/*
diff --git a/testdata/beside/mesh-catalog/modules/ssh-client/files/forge b/testdata/beside/mesh-catalog/modules/ssh-client/files/forge
new file mode 100644
index 0000000..6bbf4e2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ssh-client/files/forge
@@ -0,0 +1,7 @@
+Host ${bound:forge-account:ssh_alias}
+  HostName ${bound:forge-account:ssh_host}
+  Port ${bound:forge-account:ssh_port}
+  HostKeyAlias ${bound:forge-account:ssh_alias}
+  User git
+  IdentityFile ~/.ssh/mesh_ed25519
+  IdentitiesOnly yes
diff --git a/testdata/beside/mesh-catalog/modules/ssh-client/files/gitconfig b/testdata/beside/mesh-catalog/modules/ssh-client/files/gitconfig
new file mode 100644
index 0000000..0525230
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ssh-client/files/gitconfig
@@ -0,0 +1,2 @@
+[url "ssh://${bound:forge-account:ssh_alias}/"]
+	insteadOf = ${bound:forge-account:https_base}
diff --git a/testdata/beside/mesh-catalog/modules/ssh-client/files/known_hosts b/testdata/beside/mesh-catalog/modules/ssh-client/files/known_hosts
new file mode 100644
index 0000000..e0df6d8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ssh-client/files/known_hosts
@@ -0,0 +1 @@
+${bound:forge-account:ssh_alias} ${bound:forge-account:host_key}
diff --git a/testdata/beside/mesh-catalog/modules/ssh-client/module.json.captured b/testdata/beside/mesh-catalog/modules/ssh-client/module.json.captured
new file mode 100644
index 0000000..a696544
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/ssh-client/module.json.captured
@@ -0,0 +1,112 @@
+{
+  "module": "ssh-client",
+  "version": "1",
+  "moved": true,
+  "tools": [
+    "ssh_client_hosts",
+    "ssh_client_resolve",
+    "ssh_client_check",
+    "ssh_client_keys",
+    "ssh_client_authorized",
+    "ssh_client_revoke",
+    "ssh_client_known_host",
+    "ssh_client_test"
+  ],
+  "requires": [
+    "forge-account"
+  ],
+  "state": [
+    "keys"
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "ssh",
+        "path": "${dir:ssh-dir}",
+        "class": "valuable",
+        "why": "the operator's keys and known hosts"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "ssh-dir",
+      "type": "directory",
+      "path": "${machine:account-home}/.ssh",
+      "owner": "${machine:account}",
+      "mode": "0700",
+      "unknown": "module"
+    },
+    {
+      "id": "config-d",
+      "type": "directory",
+      "path": "${machine:account-home}/.ssh/config.d",
+      "owner": "${machine:account}",
+      "mode": "0700",
+      "unknown": "module"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${machine:account-home}/.ssh/config",
+      "owner": "${machine:account}",
+      "mode": "0600",
+      "into": "block",
+      "at": "start",
+      "template": "files/config"
+    },
+    {
+      "id": "known-hosts",
+      "type": "file",
+      "path": "${machine:account-home}/.ssh/known_hosts",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "into": "block",
+      "template": "files/known_hosts"
+    },
+    {
+      "id": "forge-host",
+      "type": "file",
+      "path": "${machine:account-home}/.ssh/config.d/10-forge",
+      "owner": "${machine:account}",
+      "mode": "0600",
+      "template": "files/forge"
+    },
+    {
+      "id": "git-config",
+      "type": "file",
+      "path": "${machine:account-home}/.config/git/config",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "into": "block",
+      "template": "files/gitconfig"
+    }
+  ],
+  "facts": {
+    "mesh-hosts": {
+      "path": ".ssh/config.d/00-mesh",
+      "home": true,
+      "template": "# Generated by the mesh. Do not edit — module ssh-client writes this file whenever a machine\n# joins, leaves or is renamed. ~/.ssh/config includes it first, so these hosts win over every\n# later line; a host of your own goes below the mesh's region in ~/.ssh/config.\n{{range .Machines}}{{if ne .Name $.Node}}\nHost {{.Name}} {{.FQDN}}\n  HostName {{.FQDN}}\n{{if .Account}}  User {{.Account}}\n{{end}}{{end}}{{end}}"
+    }
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/ssh-client-tools",
+        "binary": "ssh-client-tools",
+        "loads": [
+          "ssh-client-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/sshd/files/10-mesh.conf b/testdata/beside/mesh-catalog/modules/sshd/files/10-mesh.conf
new file mode 100644
index 0000000..86cd883
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/sshd/files/10-mesh.conf
@@ -0,0 +1,10 @@
+# Managed by the mesh (module sshd). Replaced on every push; edit the catalogue instead.
+Port 22
+PermitRootLogin no
+PasswordAuthentication no
+PubkeyAuthentication yes
+KbdInteractiveAuthentication no
+UsePAM yes
+X11Forwarding no
+PrintMotd no
+AcceptEnv LANG LC_*
diff --git a/testdata/beside/mesh-catalog/modules/sshd/module.json.captured b/testdata/beside/mesh-catalog/modules/sshd/module.json.captured
new file mode 100644
index 0000000..066e058
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/sshd/module.json.captured
@@ -0,0 +1,54 @@
+{
+  "module": "sshd",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the operator's way into the machine when the mesh cannot reach it: a build that breaks it is found only when that way is needed, which no gate sees (hq ADR 0236)"
+  },
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "listens": [
+    {
+      "name": "ssh",
+      "port": 22,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "the operator's own door. From anywhere because the machines that need it are exactly the ones not on the mesh yet \u2014 and locking the operator out is the one failure a firewall must never arrange"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "openssh"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/ssh/sshd_config.d/10-mesh.conf",
+      "mode": "0644",
+      "template": "files/10-mesh.conf"
+    },
+    {
+      "id": "run",
+      "type": "service",
+      "unit": "sshd.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "config"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/step-ca/files/config.json b/testdata/beside/mesh-catalog/modules/step-ca/files/config.json
new file mode 100644
index 0000000..9e26dfe
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/step-ca/files/config.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/step-ca/files/init.env b/testdata/beside/mesh-catalog/modules/step-ca/files/init.env
new file mode 100644
index 0000000..31d0896
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/step-ca/files/init.env
@@ -0,0 +1,2 @@
+DOCKER_STEPCA_INIT_PASSWORD=${secret:password}
+DOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1
diff --git a/testdata/beside/mesh-catalog/modules/step-ca/module.json.captured b/testdata/beside/mesh-catalog/modules/step-ca/module.json.captured
new file mode 100644
index 0000000..b11d2b9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/step-ca/module.json.captured
@@ -0,0 +1,106 @@
+{
+  "module": "step-ca",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "internal-acme-ca",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "internal-acme-ca": {
+      "path": "/acme/acme/directory",
+      "roots": "/roots.pem"
+    }
+  },
+  "listens": [
+    {
+      "name": "acme",
+      "port": 9000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the ACME directory and step-ca API; a proxy on any node reaches it here over the mesh to obtain certificates, and its single listen is what the consumer is told the port is"
+    }
+  ],
+  "own-secrets": {
+    "password": "${dir:mesh-state}/password"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "home",
+        "path": "${dir:home}",
+        "class": "valuable",
+        "why": "the mesh's certificate authority: its keys and its database of what it issued"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "home",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0644",
+      "template": "files/config.json",
+      "takes-config": [],
+      "merge": "json"
+    },
+    {
+      "id": "init-env",
+      "type": "file",
+      "path": "${dir:mesh-state}/init.env",
+      "mode": "0600",
+      "template": "files/init.env"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "step-ca",
+      "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "host",
+      "env-file": [
+        "${dir:mesh-state}/init.env"
+      ],
+      "env": {
+        "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
+        "DOCKER_STEPCA_INIT_ACME": "true",
+        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
+      },
+      "volumes": [
+        "${dir:home}:/home/step",
+        "${dir:mesh-state}:/run/mesh:ro"
+      ],
+      "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/sudo/files/10-mesh-operator b/testdata/beside/mesh-catalog/modules/sudo/files/10-mesh-operator
new file mode 100644
index 0000000..997a49a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/sudo/files/10-mesh-operator
@@ -0,0 +1,9 @@
+# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates
+# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;
+# until this file, every machine said so only in a line set by hand in /etc/sudoers.
+# Written whole at every push: an edit here is overwritten. A file of this directory whose name
+# holds a dot or ends in ~ is not read by sudo; this name holds neither.
+# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator
+# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).
+Defaults use_pty
+${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL
diff --git a/testdata/beside/mesh-catalog/modules/sudo/module.json.captured b/testdata/beside/mesh-catalog/modules/sudo/module.json.captured
new file mode 100644
index 0000000..364ce5f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/sudo/module.json.captured
@@ -0,0 +1,47 @@
+{
+  "module": "sudo",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "sudo_rules",
+    "sudo_check",
+    "sudo_escalation",
+    "sudo_drop_ins"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "sudo"
+    },
+    {
+      "id": "operator",
+      "type": "file",
+      "path": "/etc/sudoers.d/10-mesh-operator",
+      "mode": "0440",
+      "template": "files/10-mesh-operator"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/sudo-tools",
+        "binary": "sudo-tools",
+        "loads": [
+          "sudo-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/analytics-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-env.env
new file mode 100644
index 0000000..b1b877f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-env.env
@@ -0,0 +1,14 @@
+LOGFLARE_NODE_HOST=127.0.0.1
+DB_USERNAME=supabase_admin
+DB_DATABASE=_supabase
+DB_HOSTNAME=supabase-db
+DB_PORT=5432
+DB_PASSWORD=${secret:postgres}
+DB_SCHEMA=_analytics
+LOGFLARE_API_KEY=${secret:logflare}
+LOGFLARE_SINGLE_TENANT=true
+LOGFLARE_SUPABASE_MODE=true
+LOGFLARE_MIN_CLUSTER_SIZE=1
+POSTGRES_BACKEND_URL=postgresql://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase
+POSTGRES_BACKEND_SCHEMA=_analytics
+LOGFLARE_FEATURE_FLAG_OVERRIDE=multibackend=true
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/analytics-reconcile.exs b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-reconcile.exs
new file mode 100644
index 0000000..179776e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-reconcile.exs
@@ -0,0 +1,86 @@
+# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.
+#
+# logflare 1.4.0 copies two of its settings into its own database once and never reads them again:
+# LOGFLARE_API_KEY becomes the default user's api_key when that user is created, and
+# POSTGRES_BACKEND_URL becomes each source's backend when that source is created. A changed value
+# reaches neither: a rotated key is refused, and a moved database is never written to (every
+# source here pointed at db:5432, a name that resolves nowhere, so nothing was stored).
+#
+# Run by the start script before logflare starts, through logflare's own code (its Repo, its Users
+# and Backends contexts and their changesets): it makes both copies say what the environment says.
+# It changes nothing when they already do, says what it changed, never prints the key or a URL's
+# password, and stops the start when it cannot finish.
+fail = fn why ->
+  IO.puts(:stderr, "analytics: #{why}; not starting")
+  System.halt(1)
+end
+
+say = fn what -> IO.puts(:stderr, "analytics: #{what}") end
+
+key = System.get_env("LOGFLARE_API_KEY")
+url = System.get_env("POSTGRES_BACKEND_URL")
+schema = System.get_env("POSTGRES_BACKEND_SCHEMA")
+
+if key in [nil, ""], do: fail.("LOGFLARE_API_KEY is not set, so the key logflare must accept is unknown")
+if url in [nil, ""], do: fail.("POSTGRES_BACKEND_URL is not set, so where logflare must store logs is unknown")
+
+where = fn u ->
+  case URI.parse(to_string(u)) do
+    %URI{host: host, port: port, path: path} when is_binary(host) -> "#{host}:#{port}#{path}"
+    _ -> "an unreadable URL"
+  end
+end
+
+Application.ensure_all_started(:ssl)
+
+outcome =
+  Ecto.Migrator.with_repo(Logflare.Repo, fn _repo ->
+    # Backends.update_source_backend_config restarts the source's pipeline after saving, and looks
+    # it up in this registry to do so; logflare is not running yet, so the registry is empty and
+    # there is nothing to restart.
+    {:ok, _} = Registry.start_link(keys: :unique, name: Logflare.Backends.SourceRegistry)
+
+    case Logflare.SingleTenant.get_default_user() do
+      nil ->
+        say.("no default user yet; logflare creates it from LOGFLARE_API_KEY and POSTGRES_BACKEND_URL as it starts")
+        :ok
+
+      user ->
+        if user.api_key == key and is_nil(user.old_api_key) do
+          say.("the default user's API key is LOGFLARE_API_KEY already")
+        else
+          # old_api_key is cleared too: logflare's UI can swap it back in, and the key replaced
+          # here may be one that leaked.
+          case Logflare.Users.update_user_all_fields(user, %{api_key: key, old_api_key: nil}) do
+            {:ok, _} -> say.("the default user's API key was replaced with LOGFLARE_API_KEY")
+            {:error, changeset} -> fail.("the default user's API key could not be replaced: #{inspect(changeset.errors)}")
+          end
+        end
+
+        results =
+          for source <- Logflare.Sources.list_sources_by_user(user),
+              backend <- Logflare.Backends.list_source_backends(source),
+              backend.type == :postgres do
+            if backend.config.url == url and backend.config.schema == schema do
+              :same
+            else
+              case Logflare.Backends.update_source_backend_config(backend, %{url: url, schema: schema}) do
+                {:ok, _} ->
+                  say.("source #{source.name} stored logs at #{where.(backend.config.url)} schema #{inspect(backend.config.schema)}; now at #{where.(url)} schema #{inspect(schema)}")
+
+                {:error, changeset} ->
+                  fail.("source #{source.name}'s backend could not be pointed at #{where.(url)}: #{inspect(changeset.errors)}")
+              end
+            end
+          end
+
+        say.("#{Enum.count(results, &(&1 == :same))} source backend(s) already at #{where.(url)}")
+
+        :ok
+    end
+  end)
+
+case outcome do
+  {:ok, :ok, _} -> :ok
+  other -> fail.("logflare's database could not be reconciled: #{inspect(other)}")
+end
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/analytics-start.sh b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-start.sh
new file mode 100644
index 0000000..bf39892
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/analytics-start.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Generated by the mesh. Do not edit: module supabase writes this file and replaces it at every push.
+#
+# Two things logflare 1.4.0 does not do for itself, done here before it starts; either failing
+# stops the start, with the reason as the last line of this container's log.
+#
+# 1. The API key never travels in a URL. logflare prints the whole URL of every request that fails,
+# query string included, in the error report Plug.Cowboy writes ("Request: POST
+# /api/logs?source_name=...&api_key=..."). That is an error, so no log level hides it while errors
+# are logged at all (novox/hq issue 268). logflare reads the key from the x-api-key header as well,
+# and the mesh's caller, vector, sends it there; this refuses to start logflare while the vector
+# config it is given still passes the key in a URL: an analytics that does not start says why
+# here, and one that leaks says nothing.
+#
+# 2. Its database says what its environment says. logflare copies LOGFLARE_API_KEY into its default
+# user and POSTGRES_BACKEND_URL into every source's backend once, when it creates them, and never
+# again; reconcile.exs makes both copies match the environment through logflare's own code, after
+# its migrations and before it starts. That is what lets the mesh rotate the key by starting
+# logflare again, and what moves the sources' backend when the database's address or password
+# changes.
+set -e
+conf=/run/logflare/vector.yml
+if [ ! -r "$conf" ]; then
+  echo "analytics: $conf is not there to check, so whether the API key travels in a URL is unknown; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+if grep -v '^[[:space:]]*#' "$conf" | grep -q 'api_key='; then
+  echo "analytics: $conf passes the API key in a URL, and logflare prints a failed request's URL; not starting (novox/hq issue 268)" >&2
+  exit 1
+fi
+reconcile=/run/logflare/reconcile.exs
+if [ ! -r "$reconcile" ]; then
+  echo "analytics: $reconcile is not there, so whether logflare's stored key and backends match its environment is unknown; not starting" >&2
+  exit 1
+fi
+cd /opt/app/rel/logflare/bin
+# The tables reconcile.exs reads exist only once the migrations have run; run.sh runs them again,
+# which finds nothing left to do.
+./logflare eval Logflare.Release.migrate
+./logflare eval 'Code.eval_file("/run/logflare/reconcile.exs")'
+exec sh run.sh
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/jwt.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/jwt.sql
new file mode 100644
index 0000000..90d8822
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/jwt.sql
@@ -0,0 +1,2 @@
+ALTER DATABASE postgres SET "app.settings.jwt_secret" TO '${secret:jwt}';
+ALTER DATABASE postgres SET "app.settings.jwt_exp" TO '3600';
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/logs.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/logs.sql
new file mode 100644
index 0000000..255c0f4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/logs.sql
@@ -0,0 +1,6 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+\c _supabase
+create schema if not exists _analytics;
+alter schema _analytics owner to :pguser;
+\c postgres
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/pooler.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/pooler.sql
new file mode 100644
index 0000000..162c5b9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/pooler.sql
@@ -0,0 +1,6 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+\c _supabase
+create schema if not exists _supavisor;
+alter schema _supavisor owner to :pguser;
+\c postgres
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/realtime.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/realtime.sql
new file mode 100644
index 0000000..4d4b9ff
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/realtime.sql
@@ -0,0 +1,4 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+create schema if not exists _realtime;
+alter schema _realtime owner to :pguser;
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/roles.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/roles.sql
new file mode 100644
index 0000000..2a05c0b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/roles.sql
@@ -0,0 +1,7 @@
+\set pgpass `echo "$POSTGRES_PASSWORD"`
+
+ALTER USER authenticator WITH PASSWORD :'pgpass';
+ALTER USER pgbouncer WITH PASSWORD :'pgpass';
+ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
+ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/supabase.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/supabase.sql
new file mode 100644
index 0000000..6236ae1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/supabase.sql
@@ -0,0 +1,3 @@
+\set pguser `echo "$POSTGRES_USER"`
+
+CREATE DATABASE _supabase WITH OWNER :pguser;
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/db-init/webhooks.sql b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/webhooks.sql
new file mode 100644
index 0000000..5837b86
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/db-init/webhooks.sql
@@ -0,0 +1,208 @@
+BEGIN;
+  -- Create pg_net extension
+  CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+  -- Create supabase_functions schema
+  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+  GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  -- supabase_functions.migrations definition
+  CREATE TABLE supabase_functions.migrations (
+    version text PRIMARY KEY,
+    inserted_at timestamptz NOT NULL DEFAULT NOW()
+  );
+  -- Initial supabase_functions migration
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  -- supabase_functions.hooks definition
+  CREATE TABLE supabase_functions.hooks (
+    id bigserial PRIMARY KEY,
+    hook_table_id integer NOT NULL,
+    hook_name text NOT NULL,
+    created_at timestamptz NOT NULL DEFAULT NOW(),
+    request_id bigint
+  );
+  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
+  CREATE FUNCTION supabase_functions.http_request()
+    RETURNS trigger
+    LANGUAGE plpgsql
+    AS $function$
+    DECLARE
+      request_id bigint;
+      payload jsonb;
+      url text := TG_ARGV[0]::text;
+      method text := TG_ARGV[1]::text;
+      headers jsonb DEFAULT '{}'::jsonb;
+      params jsonb DEFAULT '{}'::jsonb;
+      timeout_ms integer DEFAULT 1000;
+    BEGIN
+      IF url IS NULL OR url = 'null' THEN
+        RAISE EXCEPTION 'url argument is missing';
+      END IF;
+
+      IF method IS NULL OR method = 'null' THEN
+        RAISE EXCEPTION 'method argument is missing';
+      END IF;
+
+      IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
+        headers = '{"Content-Type": "application/json"}'::jsonb;
+      ELSE
+        headers = TG_ARGV[2]::jsonb;
+      END IF;
+
+      IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
+        params = '{}'::jsonb;
+      ELSE
+        params = TG_ARGV[3]::jsonb;
+      END IF;
+
+      IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
+        timeout_ms = 1000;
+      ELSE
+        timeout_ms = TG_ARGV[4]::integer;
+      END IF;
+
+      CASE
+        WHEN method = 'GET' THEN
+          SELECT http_get INTO request_id FROM net.http_get(
+            url,
+            params,
+            headers,
+            timeout_ms
+          );
+        WHEN method = 'POST' THEN
+          payload = jsonb_build_object(
+            'old_record', OLD,
+            'record', NEW,
+            'type', TG_OP,
+            'table', TG_TABLE_NAME,
+            'schema', TG_TABLE_SCHEMA
+          );
+
+          SELECT http_post INTO request_id FROM net.http_post(
+            url,
+            payload,
+            params,
+            headers,
+            timeout_ms
+          );
+        ELSE
+          RAISE EXCEPTION 'method argument % is invalid', method;
+      END CASE;
+
+      INSERT INTO supabase_functions.hooks
+        (hook_table_id, hook_name, request_id)
+      VALUES
+        (TG_RELID, TG_NAME, request_id);
+
+      RETURN NEW;
+    END
+  $function$;
+  -- Supabase super admin
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_functions_admin'
+    )
+    THEN
+      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
+    END IF;
+  END
+  $$;
+  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
+  ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
+  ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
+  ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
+  ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
+  GRANT supabase_functions_admin TO postgres;
+  -- Remove unused supabase_pg_net_admin role
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_roles
+      WHERE rolname = 'supabase_pg_net_admin'
+    )
+    THEN
+      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
+      DROP OWNED BY supabase_pg_net_admin;
+      DROP ROLE supabase_pg_net_admin;
+    END IF;
+  END
+  $$;
+  -- pg_net grants when extension is already enabled
+  DO
+  $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_extension
+      WHERE extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END
+  $$;
+  -- Event trigger for pg_net
+  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
+  RETURNS event_trigger
+  LANGUAGE plpgsql
+  AS $$
+  BEGIN
+    IF EXISTS (
+      SELECT 1
+      FROM pg_event_trigger_ddl_commands() AS ev
+      JOIN pg_extension AS ext
+      ON ev.objid = ext.oid
+      WHERE ext.extname = 'pg_net'
+    )
+    THEN
+      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
+      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
+      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
+      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
+    END IF;
+  END;
+  $$;
+  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
+  DO
+  $$
+  BEGIN
+    IF NOT EXISTS (
+      SELECT 1
+      FROM pg_event_trigger
+      WHERE evtname = 'issue_pg_net_access'
+    ) THEN
+      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
+      EXECUTE PROCEDURE extensions.grant_pg_net_access();
+    END IF;
+  END
+  $$;
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
+  ALTER function supabase_functions.http_request() SECURITY DEFINER;
+  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+  REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
+  GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+COMMIT;
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/functions-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/functions-env.env
new file mode 100644
index 0000000..5eade5e
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/functions-env.env
@@ -0,0 +1,6 @@
+JWT_SECRET=${secret:jwt}
+SUPABASE_URL=http://supabase-kong:8000
+SUPABASE_ANON_KEY=${secret:anon-key}
+SUPABASE_SERVICE_ROLE_KEY=${secret:service-role-key}
+SUPABASE_DB_URL=postgresql://postgres:${secret:postgres}@supabase-db:5432/postgres
+VERIFY_JWT=false
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/functions-main/index.ts b/testdata/beside/mesh-catalog/modules/supabase/files/functions-main/index.ts
new file mode 100644
index 0000000..a094010
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/functions-main/index.ts
@@ -0,0 +1,94 @@
+import { serve } from 'https://deno.land/std@0.131.0/http/server.ts'
+import * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'
+
+console.log('main function started')
+
+const JWT_SECRET = Deno.env.get('JWT_SECRET')
+const VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'
+
+function getAuthToken(req: Request) {
+  const authHeader = req.headers.get('authorization')
+  if (!authHeader) {
+    throw new Error('Missing authorization header')
+  }
+  const [bearer, token] = authHeader.split(' ')
+  if (bearer !== 'Bearer') {
+    throw new Error(`Auth header is not 'Bearer {token}'`)
+  }
+  return token
+}
+
+async function verifyJWT(jwt: string): Promise<boolean> {
+  const encoder = new TextEncoder()
+  const secretKey = encoder.encode(JWT_SECRET)
+  try {
+    await jose.jwtVerify(jwt, secretKey)
+  } catch (err) {
+    console.error(err)
+    return false
+  }
+  return true
+}
+
+serve(async (req: Request) => {
+  if (req.method !== 'OPTIONS' && VERIFY_JWT) {
+    try {
+      const token = getAuthToken(req)
+      const isValidJWT = await verifyJWT(token)
+
+      if (!isValidJWT) {
+        return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {
+          status: 401,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+    } catch (e) {
+      console.error(e)
+      return new Response(JSON.stringify({ msg: e.toString() }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+  }
+
+  const url = new URL(req.url)
+  const { pathname } = url
+  const path_parts = pathname.split('/')
+  const service_name = path_parts[1]
+
+  if (!service_name || service_name === '') {
+    const error = { msg: 'missing function name in request' }
+    return new Response(JSON.stringify(error), {
+      status: 400,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+
+  const servicePath = `/home/deno/functions/${service_name}`
+  console.error(`serving the request with ${servicePath}`)
+
+  const memoryLimitMb = 150
+  const workerTimeoutMs = 1 * 60 * 1000
+  const noModuleCache = false
+  const importMapPath = null
+  const envVarsObj = Deno.env.toObject()
+  const envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])
+
+  try {
+    const worker = await EdgeRuntime.userWorkers.create({
+      servicePath,
+      memoryLimitMb,
+      workerTimeoutMs,
+      noModuleCache,
+      importMapPath,
+      envVars,
+    })
+    return await worker.fetch(req)
+  } catch (e) {
+    const error = { msg: e.toString() }
+    return new Response(JSON.stringify(error), {
+      status: 500,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+})
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/gotrue.env b/testdata/beside/mesh-catalog/modules/supabase/files/gotrue.env
new file mode 100644
index 0000000..f29f778
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/gotrue.env
@@ -0,0 +1,28 @@
+GOTRUE_API_HOST=0.0.0.0
+GOTRUE_API_PORT=9999
+API_EXTERNAL_URL=https://${bound:route:name}
+GOTRUE_DB_DRIVER=postgres
+GOTRUE_DB_DATABASE_URL=postgres://supabase_auth_admin:${secret:postgres}@supabase-db:5432/postgres
+GOTRUE_SITE_URL=https://${bound:route:name}
+GOTRUE_URI_ALLOW_LIST=
+GOTRUE_DISABLE_SIGNUP=true
+GOTRUE_JWT_ADMIN_ROLES=service_role
+GOTRUE_JWT_AUD=authenticated
+GOTRUE_JWT_DEFAULT_GROUP_NAME=authenticated
+GOTRUE_JWT_EXP=3600
+GOTRUE_JWT_SECRET=${secret:jwt}
+GOTRUE_EXTERNAL_EMAIL_ENABLED=false
+GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED=false
+GOTRUE_MAILER_AUTOCONFIRM=false
+GOTRUE_SMTP_ADMIN_EMAIL=admin@example.com
+GOTRUE_SMTP_HOST=supabase-mail
+GOTRUE_SMTP_PORT=2500
+GOTRUE_SMTP_USER=fake_mail_user
+GOTRUE_SMTP_PASS=fake_mail_password
+GOTRUE_SMTP_SENDER_NAME=fake_sender
+GOTRUE_MAILER_URLPATHS_INVITE=/auth/v1/verify
+GOTRUE_MAILER_URLPATHS_CONFIRMATION=/auth/v1/verify
+GOTRUE_MAILER_URLPATHS_RECOVERY=/auth/v1/verify
+GOTRUE_MAILER_URLPATHS_EMAIL_CHANGE=/auth/v1/verify
+GOTRUE_EXTERNAL_PHONE_ENABLED=false
+GOTRUE_SMS_AUTOCONFIRM=true
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/kong.yml b/testdata/beside/mesh-catalog/modules/supabase/files/kong.yml
new file mode 100644
index 0000000..e13bdb2
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/kong.yml
@@ -0,0 +1,242 @@
+# Written by the mesh (modules/supabase): the gateway's declarative config, credentials rendered in.
+_format_version: '2.1'
+_transform: true
+
+###
+### Consumers / Users
+###
+consumers:
+  - username: DASHBOARD
+  - username: anon
+    keyauth_credentials:
+      - key: "${secret:anon-key}"
+  - username: service_role
+    keyauth_credentials:
+      - key: "${secret:service-role-key}"
+
+###
+### Access Control List
+###
+acls:
+  - consumer: anon
+    group: anon
+  - consumer: service_role
+    group: admin
+
+###
+### Dashboard credentials
+###
+basicauth_credentials:
+  - consumer: DASHBOARD
+    username: "${secret:dashboard-user}"
+    password: "${secret:dashboard}"
+
+###
+### API Routes
+###
+services:
+  ## Open Auth routes
+  - name: auth-v1-open
+    url: http://supabase-auth:9999/verify
+    routes:
+      - name: auth-v1-open
+        strip_path: true
+        paths:
+          - /auth/v1/verify
+    plugins:
+      - name: cors
+  - name: auth-v1-open-callback
+    url: http://supabase-auth:9999/callback
+    routes:
+      - name: auth-v1-open-callback
+        strip_path: true
+        paths:
+          - /auth/v1/callback
+    plugins:
+      - name: cors
+  - name: auth-v1-open-authorize
+    url: http://supabase-auth:9999/authorize
+    routes:
+      - name: auth-v1-open-authorize
+        strip_path: true
+        paths:
+          - /auth/v1/authorize
+    plugins:
+      - name: cors
+
+  ## Secure Auth routes
+  - name: auth-v1
+    _comment: 'GoTrue: /auth/v1/* -> http://auth:9999/*'
+    url: http://supabase-auth:9999/
+    routes:
+      - name: auth-v1-all
+        strip_path: true
+        paths:
+          - /auth/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure REST routes
+  - name: rest-v1
+    _comment: 'PostgREST: /rest/v1/* -> http://rest:3000/*'
+    url: http://supabase-rest:3000/
+    routes:
+      - name: rest-v1-all
+        strip_path: true
+        paths:
+          - /rest/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure GraphQL routes
+  - name: graphql-v1
+    _comment: 'PostgREST: /graphql/v1/* -> http://rest:3000/rpc/graphql'
+    url: http://supabase-rest:3000/rpc/graphql
+    routes:
+      - name: graphql-v1-all
+        strip_path: true
+        paths:
+          - /graphql/v1
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: true
+      - name: request-transformer
+        config:
+          add:
+            headers:
+              - Content-Profile:graphql_public
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+
+  ## Secure Realtime routes
+  - name: realtime-v1-ws
+    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+    url: http://realtime-dev.supabase-realtime:4000/socket
+    protocol: ws
+    routes:
+      - name: realtime-v1-ws
+        strip_path: true
+        paths:
+          - /realtime/v1/
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+  - name: realtime-v1-rest
+    _comment: 'Realtime: /realtime/v1/* -> ws://realtime:4000/socket/*'
+    url: http://realtime-dev.supabase-realtime:4000/api
+    protocol: http
+    routes:
+      - name: realtime-v1-rest
+        strip_path: true
+        paths:
+          - /realtime/v1/api
+    plugins:
+      - name: cors
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+            - anon
+  ## Storage routes: the storage server manages its own auth
+  - name: storage-v1
+    _comment: 'Storage: /storage/v1/* -> http://storage:5000/*'
+    url: http://supabase-storage:5000/
+    routes:
+      - name: storage-v1-all
+        strip_path: true
+        paths:
+          - /storage/v1/
+    plugins:
+      - name: cors
+
+  ## Edge Functions routes
+  - name: functions-v1
+    _comment: 'Edge Functions: /functions/v1/* -> http://functions:9000/*'
+    url: http://supabase-edge-functions:9000/
+    routes:
+      - name: functions-v1-all
+        strip_path: true
+        paths:
+          - /functions/v1/
+    plugins:
+      - name: cors
+
+  ## Analytics routes
+  - name: analytics-v1
+    _comment: 'Analytics: /analytics/v1/* -> http://logflare:4000/*'
+    url: http://supabase-analytics:4000/
+    routes:
+      - name: analytics-v1-all
+        strip_path: true
+        paths:
+          - /analytics/v1/
+
+  ## Secure Database routes
+  - name: meta
+    _comment: 'pg-meta: /pg/* -> http://pg-meta:8080/*'
+    url: http://supabase-meta:8080/
+    routes:
+      - name: meta-all
+        strip_path: true
+        paths:
+          - /pg/
+    plugins:
+      - name: key-auth
+        config:
+          hide_credentials: false
+      - name: acl
+        config:
+          hide_groups_header: true
+          allow:
+            - admin
+
+  ## Protected Dashboard - catch all remaining routes
+  - name: dashboard
+    _comment: 'Studio: /* -> http://studio:3000/*'
+    url: http://supabase-studio:3000/
+    routes:
+      - name: dashboard-all
+        strip_path: true
+        paths:
+          - /
+    plugins:
+      - name: cors
+      - name: basic-auth
+        config:
+          hide_credentials: true
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/meta-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/meta-env.env
new file mode 100644
index 0000000..c9d2509
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/meta-env.env
@@ -0,0 +1,6 @@
+PG_META_PORT=8080
+PG_META_DB_HOST=supabase-db
+PG_META_DB_PORT=5432
+PG_META_DB_NAME=postgres
+PG_META_DB_USER=supabase_admin
+PG_META_DB_PASSWORD=${secret:postgres}
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/pooler-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/pooler-env.env
new file mode 100644
index 0000000..f02c7cd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/pooler-env.env
@@ -0,0 +1,14 @@
+PORT=4000
+POSTGRES_PORT=5432
+POSTGRES_DB=postgres
+POSTGRES_PASSWORD=${secret:postgres}
+DATABASE_URL=ecto://supabase_admin:${secret:postgres}@supabase-db:5432/_supabase
+CLUSTER_POSTGRES=true
+SECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}
+VAULT_ENC_KEY=${secret:pooler-vault}
+API_JWT_SECRET=${secret:jwt}
+METRICS_JWT_SECRET=${secret:jwt}
+REGION=local
+ERL_AFLAGS=-proto_dist inet_tcp
+RELEASE_NODE=supavisor@127.0.0.1
+POOLER_POOL_MODE=transaction
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/pooler.exs b/testdata/beside/mesh-catalog/modules/supabase/files/pooler.exs
new file mode 100644
index 0000000..61b5ba8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/pooler.exs
@@ -0,0 +1,43 @@
+{:ok, _} = Application.ensure_all_started(:supavisor)
+
+# Written by the mesh (modules/supabase). Per-machine values come from settings.json (the module's
+# one merge:json file); secrets come from the environment the image reads.
+settings = "/etc/pooler/settings.json" |> File.read!() |> Jason.decode!() |> Map.get("pooler", %{})
+
+{:ok, version} =
+  case Supavisor.Repo.query!("select version()") do
+    %{rows: [[ver]]} -> Supavisor.Helpers.parse_pg_version(ver)
+    _ -> nil
+  end
+
+params = %{
+  "external_id" => to_string(settings["tenant"] || "default"),
+  "db_host" => "supabase-db",
+  "db_port" => System.get_env("POSTGRES_PORT"),
+  "db_database" => System.get_env("POSTGRES_DB"),
+  "require_user" => false,
+  "auth_query" => "SELECT * FROM pgbouncer.get_auth($1)",
+  "default_max_clients" => settings["max-client-connections"] || 100,
+  "default_pool_size" => settings["pool-size"] || 20,
+  "default_parameter_status" => %{"server_version" => version},
+  "users" => [%{
+    "db_user" => "pgbouncer",
+    "db_password" => System.get_env("POSTGRES_PASSWORD"),
+    "mode_type" => System.get_env("POOLER_POOL_MODE"),
+    "pool_size" => settings["pool-size"] || 20,
+    "is_manager" => true
+  }]
+}
+
+case Supavisor.Tenants.get_tenant_by_external_id(params["external_id"]) do
+  nil ->
+    {:ok, _} = Supavisor.Tenants.create_tenant(params)
+
+  # A tenant made elsewhere (HAL named the database host "db") is pointed at this module's
+  # database container; nothing else it holds is changed.
+  %{db_host: host} = tenant when host != "supabase-db" ->
+    {:ok, _} = Supavisor.Tenants.update_tenant(tenant, %{"db_host" => "supabase-db"})
+
+  _ ->
+    :ok
+end
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/postgrest.conf b/testdata/beside/mesh-catalog/modules/supabase/files/postgrest.conf
new file mode 100644
index 0000000..1755753
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/postgrest.conf
@@ -0,0 +1,7 @@
+db-uri = "postgres://authenticator:${secret:postgres}@supabase-db:5432/postgres"
+db-schemas = "public,storage,graphql_public"
+db-anon-role = "anon"
+jwt-secret = "${secret:jwt}"
+db-use-legacy-gucs = false
+app.settings.jwt_secret = "${secret:jwt}"
+app.settings.jwt_exp = "3600"
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/realtime-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/realtime-env.env
new file mode 100644
index 0000000..75e2136
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/realtime-env.env
@@ -0,0 +1,16 @@
+PORT=4000
+DB_HOST=supabase-db
+DB_PORT=5432
+DB_USER=supabase_admin
+DB_PASSWORD=${secret:postgres}
+DB_NAME=postgres
+DB_AFTER_CONNECT_QUERY=SET search_path TO _realtime
+DB_ENC_KEY=supabaserealtime
+API_JWT_SECRET=${secret:jwt}
+SECRET_KEY_BASE=${secret:key-base-a}${secret:key-base-b}
+ERL_AFLAGS=-proto_dist inet_tcp
+DNS_NODES=''
+RLIMIT_NOFILE=10000
+APP_NAME=realtime
+SEED_SELF_HOST=true
+RUN_JANITOR=true
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/settings.json b/testdata/beside/mesh-catalog/modules/supabase/files/settings.json
new file mode 100644
index 0000000..8ab8cfa
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/settings.json
@@ -0,0 +1,7 @@
+{
+  "pooler": {
+    "tenant": "default",
+    "pool-size": 20,
+    "max-client-connections": 100
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/storage-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/storage-env.env
new file mode 100644
index 0000000..fd5da86
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/storage-env.env
@@ -0,0 +1,13 @@
+ANON_KEY=${secret:anon-key}
+SERVICE_KEY=${secret:service-role-key}
+POSTGREST_URL=http://supabase-rest:3000
+PGRST_JWT_SECRET=${secret:jwt}
+DATABASE_URL=postgres://supabase_storage_admin:${secret:postgres}@supabase-db:5432/postgres
+FILE_SIZE_LIMIT=52428800
+STORAGE_BACKEND=file
+FILE_STORAGE_BACKEND_PATH=/var/lib/storage
+TENANT_ID=stub
+REGION=stub
+GLOBAL_S3_BUCKET=stub
+ENABLE_IMAGE_TRANSFORMATION=true
+IMGPROXY_URL=http://supabase-imgproxy:5001
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/studio-env.env b/testdata/beside/mesh-catalog/modules/supabase/files/studio-env.env
new file mode 100644
index 0000000..303dbc5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/studio-env.env
@@ -0,0 +1,18 @@
+# Next.js listens on the address HOSTNAME names, and docker sets HOSTNAME to the container's id,
+# so studio answered only on its network address while its image's health check asks localhost:
+# unhealthy for ever while working. Every address, as the upstream compose file has it.
+HOSTNAME=::
+STUDIO_PG_META_URL=http://supabase-meta:8080
+POSTGRES_PASSWORD=${secret:postgres}
+DEFAULT_ORGANIZATION_NAME=Default Organization
+DEFAULT_PROJECT_NAME=Default Project
+OPENAI_API_KEY=${secret:openai}
+SUPABASE_URL=http://supabase-kong:8000
+SUPABASE_PUBLIC_URL=https://${bound:route:name}
+SUPABASE_ANON_KEY=${secret:anon-key}
+SUPABASE_SERVICE_KEY=${secret:service-role-key}
+AUTH_JWT_SECRET=${secret:jwt}
+LOGFLARE_API_KEY=${secret:logflare}
+LOGFLARE_URL=http://supabase-analytics:4000
+NEXT_PUBLIC_ENABLE_LOGS=true
+NEXT_ANALYTICS_BACKEND_PROVIDER=postgres
diff --git a/testdata/beside/mesh-catalog/modules/supabase/files/vector.yml b/testdata/beside/mesh-catalog/modules/supabase/files/vector.yml
new file mode 100644
index 0000000..fb0f03d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/files/vector.yml
@@ -0,0 +1,258 @@
+# Written by the mesh (modules/supabase).
+#
+# Every sink hands logflare its API key in the x-api-key header, never as an api_key query parameter:
+# logflare prints a failed request's whole URL, query string included, in its error report, so a
+# key in the URL is a key in its log (novox/hq issue 268). supabase-analytics refuses to start
+# while this file still puts the key in a URL.
+api:
+  enabled: true
+  address: 0.0.0.0:9001
+
+sources:
+  docker_host:
+    type: docker_logs
+    include_containers:
+      - supabase-kong
+      - supabase-auth
+      - supabase-rest
+      - realtime-dev.supabase-realtime
+      - supabase-storage
+      - supabase-edge-functions
+      - supabase-db
+
+transforms:
+  project_logs:
+    type: remap
+    inputs:
+      - docker_host
+    source: |-
+      .project = "default"
+      .event_message = del(.message)
+      .appname = del(.container_name)
+      del(.container_created_at)
+      del(.container_id)
+      del(.source_type)
+      del(.stream)
+      del(.label)
+      del(.image)
+      del(.host)
+      del(.stream)
+  router:
+    type: route
+    inputs:
+      - project_logs
+    route:
+      kong: '.appname == "supabase-kong"'
+      auth: '.appname == "supabase-auth"'
+      rest: '.appname == "supabase-rest"'
+      realtime: '.appname == "realtime-dev.supabase-realtime"'
+      storage: '.appname == "supabase-storage"'
+      functions: '.appname == "supabase-edge-functions"'
+      db: '.appname == "supabase-db"'
+  # Ignores non nginx errors since they are related with kong booting up
+  kong_logs:
+    type: remap
+    inputs:
+      - router.kong
+    source: |-
+      req, err = parse_nginx_log(.event_message, "combined")
+      if err == null {
+          .timestamp = req.timestamp
+          .metadata.request.headers.referer = req.referer
+          .metadata.request.headers.user_agent = req.agent
+          .metadata.request.headers.cf_connecting_ip = req.client
+          .metadata.request.method = req.method
+          .metadata.request.path = req.path
+          .metadata.request.protocol = req.protocol
+          .metadata.response.status_code = req.status
+      }
+      if err != null {
+        abort
+      }
+  # Ignores non nginx errors since they are related with kong booting up
+  kong_err:
+    type: remap
+    inputs:
+      - router.kong
+    source: |-
+      .metadata.request.method = "GET"
+      .metadata.response.status_code = 200
+      parsed, err = parse_nginx_log(.event_message, "error")
+      if err == null {
+          .timestamp = parsed.timestamp
+          .severity = parsed.severity
+          .metadata.request.host = parsed.host
+          .metadata.request.headers.cf_connecting_ip = parsed.client
+          url, err = split(parsed.request, " ")
+          if err == null {
+              .metadata.request.method = url[0]
+              .metadata.request.path = url[1]
+              .metadata.request.protocol = url[2]
+          }
+      }
+      if err != null {
+        abort
+      }
+  # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.
+  auth_logs:
+    type: remap
+    inputs:
+      - router.auth
+    source: |-
+      parsed, err = parse_json(.event_message)
+      if err == null {
+          .metadata.timestamp = parsed.time
+          .metadata = merge!(.metadata, parsed)
+      }
+  # PostgREST logs are structured so we separate timestamp from message using regex
+  rest_logs:
+    type: remap
+    inputs:
+      - router.rest
+    source: |-
+      parsed, err = parse_regex(.event_message, r'^(?P<time>.*): (?P<msg>.*)$')
+      if err == null {
+          .event_message = parsed.msg
+          .timestamp = to_timestamp!(parsed.time)
+          .metadata.host = .project
+      }
+  # Realtime logs are structured so we parse the severity level using regex (ignore time because it has no date)
+  realtime_logs:
+    type: remap
+    inputs:
+      - router.realtime
+    source: |-
+      .metadata.project = del(.project)
+      .metadata.external_id = .metadata.project
+      parsed, err = parse_regex(.event_message, r'^(?P<time>\d+:\d+:\d+\.\d+) \[(?P<level>\w+)\] (?P<msg>.*)$')
+      if err == null {
+          .event_message = parsed.msg
+          .metadata.level = parsed.level
+      }
+  # Storage logs may contain json objects so we parse them for completeness
+  storage_logs:
+    type: remap
+    inputs:
+      - router.storage
+    source: |-
+      .metadata.project = del(.project)
+      .metadata.tenantId = .metadata.project
+      parsed, err = parse_json(.event_message)
+      if err == null {
+          .event_message = parsed.msg
+          .metadata.level = parsed.level
+          .metadata.timestamp = parsed.time
+          .metadata.context[0].host = parsed.hostname
+          .metadata.context[0].pid = parsed.pid
+      }
+  # Postgres logs some messages to stderr which we map to warning severity level
+  db_logs:
+    type: remap
+    inputs:
+      - router.db
+    source: |-
+      .metadata.host = "db-default"
+      .metadata.parsed.timestamp = .timestamp
+
+      parsed, err = parse_regex(.event_message, r'.*(?P<level>INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC?):.*', numeric_groups: true)
+
+      if err != null || parsed == null {
+        .metadata.parsed.error_severity = "info"
+      }
+      if parsed != null {
+       .metadata.parsed.error_severity = parsed.level
+      }
+      if .metadata.parsed.error_severity == "info" {
+          .metadata.parsed.error_severity = "log"
+      }
+      .metadata.parsed.error_severity = upcase!(.metadata.parsed.error_severity)
+
+sinks:
+  logflare_auth:
+    type: 'http'
+    inputs:
+      - auth_logs
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=gotrue.logs.prod'
+  logflare_realtime:
+    type: 'http'
+    inputs:
+      - realtime_logs
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=realtime.logs.prod'
+  logflare_rest:
+    type: 'http'
+    inputs:
+      - rest_logs
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=postgREST.logs.prod'
+  logflare_db:
+    type: 'http'
+    inputs:
+      - db_logs
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    # We must route the sink through kong because ingesting logs before logflare is fully initialised will
+    # lead to broken queries from studio. This works by the assumption that containers are started in the
+    # following order: vector > db > logflare > kong
+    uri: 'http://supabase-kong:8000/analytics/v1/api/logs?source_name=postgres.logs'
+  logflare_functions:
+    type: 'http'
+    inputs:
+      - router.functions
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=deno-relay-logs'
+  logflare_storage:
+    type: 'http'
+    inputs:
+      - storage_logs
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=storage.logs.prod.2'
+  logflare_kong:
+    type: 'http'
+    inputs:
+      - kong_logs
+      - kong_err
+    encoding:
+      codec: 'json'
+    method: 'post'
+    request:
+      retry_max_duration_secs: 10
+      headers:
+        x-api-key: '${secret:logflare}'
+    uri: 'http://supabase-analytics:4000/api/logs?source_name=cloudflare.logs.prod'
diff --git a/testdata/beside/mesh-catalog/modules/supabase/module.json.captured b/testdata/beside/mesh-catalog/modules/supabase/module.json.captured
new file mode 100644
index 0000000..14ddbcd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/supabase/module.json.captured
@@ -0,0 +1,659 @@
+{
+  "module": "supabase",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "api",
+      "port": 8000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the Kong gateway: the REST, auth, storage, realtime, functions and GraphQL APIs under their /\u2026/v1 paths, and Studio at / behind the dashboard password. The one surface people and apps use, reached through the route"
+    },
+    {
+      "name": "pooler-session",
+      "port": 5432,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Supavisor's session-mode Postgres port, for clients that connect to the database directly as <user>.<tenant>"
+    },
+    {
+      "name": "pooler-transaction",
+      "port": 6543,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "Supavisor's transaction-mode Postgres port"
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "own-secrets": {
+    "postgres": "${dir:state}/postgres.secret",
+    "jwt": "${dir:state}/jwt.secret",
+    "anon-key": "${dir:state}/anon-key.secret",
+    "service-role-key": "${dir:state}/service-role-key.secret",
+    "dashboard-user": "${dir:state}/dashboard-user.secret",
+    "dashboard": "${dir:state}/dashboard.secret",
+    "logflare": {
+      "path": "${dir:state}/logflare.secret",
+      "taken": "at-start"
+    },
+    "pooler-vault": "${dir:state}/pooler-vault.secret",
+    "key-base-a": "${dir:state}/key-base-a.secret",
+    "key-base-b": "${dir:state}/key-base-b.secret",
+    "openai": {
+      "path": "${dir:state}/openai.secret",
+      "issued-by": "outside"
+    }
+  },
+  "contributes": {
+    "route": {
+      "label": "supabase",
+      "endpoint": "api"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "data": {
+    "own": [
+      {
+        "id": "db",
+        "path": "${dir:db-data}",
+        "class": "valuable",
+        "backup": {
+          "dump": "docker exec supabase-db pg_dumpall -h 127.0.0.1 -U supabase_admin > ${dir:dumps}/all.sql.partial && mv ${dir:dumps}/all.sql.partial ${dir:dumps}/all.sql",
+          "into": "dumps"
+        },
+        "why": "every table; copied by pg_dumpall inside the database's container (local connections are trusted there), since a running store's files are not a consistent copy"
+      },
+      {
+        "id": "dumps",
+        "path": "${dir:dumps}",
+        "class": "rebuildable",
+        "why": "last night's dump of the database, made again every night"
+      },
+      {
+        "id": "storage",
+        "path": "${dir:storage}",
+        "class": "valuable",
+        "why": "uploaded objects"
+      },
+      {
+        "id": "functions",
+        "path": "${dir:functions}",
+        "class": "valuable",
+        "why": "the edge functions' code"
+      },
+      {
+        "id": "db-config",
+        "path": "${dir:db-config}",
+        "class": "rebuildable",
+        "why": "the database's configuration, seeded again"
+      }
+    ]
+  },
+  "config": {
+    "pooler": {
+      "type": "object",
+      "description": "The connection pooler's settings, laid over the file's: its tenant, pool size and the most client connections it takes.",
+      "trusted": true,
+      "default": {
+        "tenant": "default",
+        "pool-size": 20,
+        "max-client-connections": 100
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "db-init",
+      "type": "directory",
+      "path": "${dir:state}/db-init",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "functions-main-dir",
+      "type": "directory",
+      "path": "${dir:state}/functions-main",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "db-data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "105:106",
+      "unknown": "program"
+    },
+    {
+      "id": "dumps",
+      "type": "directory",
+      "path": "${dir:state}/dumps",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "db-config",
+      "type": "directory",
+      "mode": "0755",
+      "owner": "105:106",
+      "unknown": "program"
+    },
+    {
+      "id": "storage",
+      "type": "directory",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "functions",
+      "type": "directory",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0644",
+      "merge": "json",
+      "takes-config": ["pooler"],
+      "template": "files/settings.json"
+    },
+    {
+      "id": "kong-conf",
+      "type": "file",
+      "path": "${dir:state}/kong.yml",
+      "mode": "0600",
+      "owner": "100:65533",
+      "template": "files/kong.yml"
+    },
+    {
+      "id": "auth-conf",
+      "type": "file",
+      "path": "${dir:state}/gotrue.env",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "template": "files/gotrue.env"
+    },
+    {
+      "id": "rest-conf",
+      "type": "file",
+      "path": "${dir:state}/postgrest.conf",
+      "mode": "0600",
+      "owner": "1000:1000",
+      "template": "files/postgrest.conf"
+    },
+    {
+      "id": "vector-conf",
+      "type": "file",
+      "path": "${dir:state}/vector.yml",
+      "mode": "0600",
+      "template": "files/vector.yml"
+    },
+    {
+      "id": "pooler-conf",
+      "type": "file",
+      "path": "${dir:state}/pooler.exs",
+      "mode": "0644",
+      "template": "files/pooler.exs"
+    },
+    {
+      "id": "db-init-roles",
+      "type": "file",
+      "path": "${dir:state}/db-init/roles.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/roles.sql"
+    },
+    {
+      "id": "db-init-jwt",
+      "type": "file",
+      "path": "${dir:state}/db-init/jwt.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/jwt.sql"
+    },
+    {
+      "id": "db-init-realtime",
+      "type": "file",
+      "path": "${dir:state}/db-init/realtime.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/realtime.sql"
+    },
+    {
+      "id": "db-init-supabase",
+      "type": "file",
+      "path": "${dir:state}/db-init/supabase.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/supabase.sql"
+    },
+    {
+      "id": "db-init-logs",
+      "type": "file",
+      "path": "${dir:state}/db-init/logs.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/logs.sql"
+    },
+    {
+      "id": "db-init-pooler",
+      "type": "file",
+      "path": "${dir:state}/db-init/pooler.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/pooler.sql"
+    },
+    {
+      "id": "db-init-webhooks",
+      "type": "file",
+      "path": "${dir:state}/db-init/webhooks.sql",
+      "mode": "0600",
+      "owner": "105:106",
+      "template": "files/db-init/webhooks.sql"
+    },
+    {
+      "id": "functions-main",
+      "type": "file",
+      "path": "${dir:state}/functions-main/index.ts",
+      "mode": "0644",
+      "template": "files/functions-main/index.ts"
+    },
+    {
+      "id": "realtime-env",
+      "type": "file",
+      "path": "${dir:state}/realtime-env.env",
+      "mode": "0600",
+      "template": "files/realtime-env.env"
+    },
+    {
+      "id": "storage-env",
+      "type": "file",
+      "path": "${dir:state}/storage-env.env",
+      "mode": "0600",
+      "template": "files/storage-env.env"
+    },
+    {
+      "id": "meta-env",
+      "type": "file",
+      "path": "${dir:state}/meta-env.env",
+      "mode": "0600",
+      "template": "files/meta-env.env"
+    },
+    {
+      "id": "functions-env",
+      "type": "file",
+      "path": "${dir:state}/functions-env.env",
+      "mode": "0600",
+      "template": "files/functions-env.env"
+    },
+    {
+      "id": "analytics-env",
+      "type": "file",
+      "path": "${dir:state}/analytics-env.env",
+      "mode": "0600",
+      "template": "files/analytics-env.env"
+    },
+    {
+      "id": "analytics-start",
+      "type": "file",
+      "path": "${dir:state}/analytics-start.sh",
+      "mode": "0644",
+      "template": "files/analytics-start.sh"
+    },
+    {
+      "id": "analytics-reconcile",
+      "type": "file",
+      "path": "${dir:state}/analytics-reconcile.exs",
+      "mode": "0644",
+      "template": "files/analytics-reconcile.exs"
+    },
+    {
+      "id": "studio-env",
+      "type": "file",
+      "path": "${dir:state}/studio-env.env",
+      "mode": "0600",
+      "template": "files/studio-env.env"
+    },
+    {
+      "id": "pooler-env",
+      "type": "file",
+      "path": "${dir:state}/pooler-env.env",
+      "mode": "0600",
+      "template": "files/pooler-env.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "supabase"
+    },
+    {
+      "id": "vector",
+      "type": "container",
+      "name": "supabase-vector",
+      "image": "timberio/vector@sha256:4bc04aca94a44f04b427a490f346e7397ef7ce61fe589d718f744f7d92cb5c80",
+      "network": "supabase",
+      "args": [
+        "--config",
+        "/etc/vector/vector.yml"
+      ],
+      "volumes": [
+        "${dir:state}/vector.yml:/etc/vector/vector.yml:ro",
+        "/var/run/docker.sock:/var/run/docker.sock:ro"
+      ],
+      "restart-on": [
+        "vector-conf"
+      ]
+    },
+    {
+      "id": "db-config-seed",
+      "type": "container",
+      "name": "supabase-db-config-seed",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "cp -rn /etc/postgresql-custom/. /seed/ && chown -R postgres:postgres /seed"
+      ],
+      "volumes": [
+        "${dir:db-config}:/seed"
+      ]
+    },
+    {
+      "id": "db",
+      "type": "container",
+      "name": "supabase-db",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "supabase",
+      "args": [
+        "postgres",
+        "-c",
+        "config_file=/etc/postgresql/postgresql.conf",
+        "-c",
+        "log_min_messages=fatal"
+      ],
+      "env": {
+        "POSTGRES_HOST": "/var/run/postgresql",
+        "PGPORT": "5432",
+        "POSTGRES_PORT": "5432",
+        "PGDATABASE": "postgres",
+        "POSTGRES_DB": "postgres",
+        "POSTGRES_PASSWORD_FILE": "/run/secrets/postgres"
+      },
+      "volumes": [
+        "${dir:state}/postgres.secret:/run/secrets/postgres:ro",
+        "${dir:state}/db-init/realtime.sql:/docker-entrypoint-initdb.d/migrations/99-realtime.sql:ro",
+        "${dir:state}/db-init/webhooks.sql:/docker-entrypoint-initdb.d/init-scripts/98-webhooks.sql:ro",
+        "${dir:state}/db-init/roles.sql:/docker-entrypoint-initdb.d/init-scripts/99-roles.sql:ro",
+        "${dir:state}/db-init/jwt.sql:/docker-entrypoint-initdb.d/init-scripts/99-jwt.sql:ro",
+        "${dir:state}/db-init/supabase.sql:/docker-entrypoint-initdb.d/migrations/97-_supabase.sql:ro",
+        "${dir:state}/db-init/logs.sql:/docker-entrypoint-initdb.d/migrations/99-logs.sql:ro",
+        "${dir:state}/db-init/pooler.sql:/docker-entrypoint-initdb.d/migrations/99-pooler.sql:ro",
+        "${dir:db-data}:/var/lib/postgresql/data",
+        "${dir:db-config}:/etc/postgresql-custom"
+      ]
+    },
+    {
+      "id": "db-ready",
+      "type": "container",
+      "name": "supabase-db-ready",
+      "image": "supabase/postgres@sha256:ee29d0aaff03d0e12c7aa63437cba25f24246872f0ed3f82a9fd13184d780777",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "for i in $(seq 150); do pg_isready -h supabase-db -p 5432 -U postgres && exit 0; sleep 2; done; echo 'the database did not come up' >&2; exit 1"
+      ]
+    },
+    {
+      "id": "analytics",
+      "type": "container",
+      "name": "supabase-analytics",
+      "image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/analytics-env.env"
+      ],
+      "volumes": [
+        "${dir:state}/analytics-start.sh:/run/logflare/start.sh:ro",
+        "${dir:state}/vector.yml:/run/logflare/vector.yml:ro",
+        "${dir:state}/analytics-reconcile.exs:/run/logflare/reconcile.exs:ro"
+      ],
+      "args": [
+        "sh",
+        "/run/logflare/start.sh"
+      ],
+      "restart-on": [
+        "analytics-env",
+        "analytics-start",
+        "analytics-reconcile",
+        "vector-conf"
+      ],
+      "secrets-in-environment": "Logflare reads its database password and API key from the environment only. The API key is never in a URL the mesh writes: logflare prints a failed request's URL, so vector sends the key in the x-api-key header, and the start script refuses to start logflare while vector.yml says otherwise"
+    },
+    {
+      "id": "analytics-ready",
+      "type": "container",
+      "name": "supabase-analytics-ready",
+      "image": "supabase/logflare@sha256:e693c787ffe1ae17b6e4e920a3cdd212416d3e1f97e1bd7cb5b67de0abbb0264",
+      "network": "supabase",
+      "run-once": true,
+      "args": [
+        "sh",
+        "-c",
+        "for i in $(seq 150); do curl -fsS -o /dev/null http://supabase-analytics:4000/health && exit 0; sleep 2; done; echo 'analytics did not come up' >&2; exit 1"
+      ]
+    },
+    {
+      "id": "kong",
+      "type": "container",
+      "name": "supabase-kong",
+      "image": "kong@sha256:1b53405d8680a09d6f44494b7990bf7da2ea43f84a258c59717d4539abf09f6d",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "supabase",
+      "ports": [
+        "8000"
+      ],
+      "env": {
+        "KONG_DATABASE": "off",
+        "KONG_DECLARATIVE_CONFIG": "/home/kong/kong.yml",
+        "KONG_DNS_ORDER": "LAST,A,CNAME",
+        "KONG_PLUGINS": "request-transformer,cors,key-auth,acl,basic-auth",
+        "KONG_NGINX_PROXY_PROXY_BUFFER_SIZE": "160k",
+        "KONG_NGINX_PROXY_PROXY_BUFFERS": "64 160k"
+      },
+      "volumes": [
+        "${dir:state}/kong.yml:/home/kong/kong.yml:ro"
+      ],
+      "restart-on": [
+        "kong-conf"
+      ]
+    },
+    {
+      "id": "auth",
+      "type": "container",
+      "name": "supabase-auth",
+      "image": "supabase/gotrue@sha256:f8b871f46f3f9c5306af00d2fb856fb5479db730bb6d4fd2757b2da8abe953f9",
+      "network": "supabase",
+      "args": [
+        "auth",
+        "-c",
+        "/etc/gotrue/gotrue.env"
+      ],
+      "volumes": [
+        "${dir:state}/gotrue.env:/etc/gotrue/gotrue.env:ro"
+      ],
+      "restart-on": [
+        "auth-conf"
+      ]
+    },
+    {
+      "id": "rest",
+      "type": "container",
+      "name": "supabase-rest",
+      "image": "postgrest/postgrest@sha256:2cf1efd2c9c2e7606610c113cc73e936d8ce9ba089271cb9cbf11aa564bc30c7",
+      "network": "supabase",
+      "args": [
+        "postgrest",
+        "/etc/postgrest/postgrest.conf"
+      ],
+      "volumes": [
+        "${dir:state}/postgrest.conf:/etc/postgrest/postgrest.conf:ro"
+      ],
+      "restart-on": [
+        "rest-conf"
+      ]
+    },
+    {
+      "id": "realtime",
+      "type": "container",
+      "name": "realtime-dev.supabase-realtime",
+      "image": "supabase/realtime@sha256:104fe2e4e09a7c81eebe0c39e3a9b9dca4684f55470ca01cb3c080d1d56453a1",
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/realtime-env.env"
+      ],
+      "secrets-in-environment": "Supabase Realtime (Elixir release) reads DB_PASSWORD, API_JWT_SECRET and SECRET_KEY_BASE from its environment only; no file or _FILE form"
+    },
+    {
+      "id": "imgproxy",
+      "type": "container",
+      "name": "supabase-imgproxy",
+      "image": "darthsim/imgproxy@sha256:0facd355d50f3be665ebe674486f2b2e9cdaebd3f74404acd9b7fece2f661435",
+      "network": "supabase",
+      "env": {
+        "IMGPROXY_BIND": ":5001",
+        "IMGPROXY_LOCAL_FILESYSTEM_ROOT": "/",
+        "IMGPROXY_USE_ETAG": "true",
+        "IMGPROXY_ENABLE_WEBP_DETECTION": "true"
+      },
+      "volumes": [
+        "${dir:storage}:/var/lib/storage"
+      ]
+    },
+    {
+      "id": "storage-api",
+      "type": "container",
+      "name": "supabase-storage",
+      "image": "supabase/storage-api@sha256:1e85dad48e8b3e85890a555e5114dc7ee48c2e8be4cfd97dd4e3564b4f104fcd",
+      "network": "supabase",
+      "volumes": [
+        "${dir:storage}:/var/lib/storage"
+      ],
+      "env-file": [
+        "${dir:state}/storage-env.env"
+      ],
+      "secrets-in-environment": "Supabase Storage reads its keys and DATABASE_URL from the environment only"
+    },
+    {
+      "id": "meta",
+      "type": "container",
+      "name": "supabase-meta",
+      "image": "supabase/postgres-meta@sha256:d0a96973e9f1b6303f7500421a459af3d7273b3f9f1db38610899f9f573da7c7",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/meta-env.env"
+      ],
+      "secrets-in-environment": "postgres-meta reads PG_META_DB_PASSWORD from the environment only"
+    },
+    {
+      "id": "edge-functions",
+      "type": "container",
+      "name": "supabase-edge-functions",
+      "image": "supabase/edge-runtime@sha256:6f7ac3b363f6b278ff9235672a81504ad07709a07f62c50cd4fffb6708842ff1",
+      "network": "supabase",
+      "args": [
+        "start",
+        "--main-service",
+        "/home/deno/main"
+      ],
+      "volumes": [
+        "${dir:functions}:/home/deno/functions",
+        "${dir:state}/functions-main/index.ts:/home/deno/main/index.ts:ro"
+      ],
+      "env-file": [
+        "${dir:state}/functions-env.env"
+      ],
+      "secrets-in-environment": "the edge runtime's main service hands its own environment (JWT secret, service key, database URL) to every function worker by design; there is no other channel"
+    },
+    {
+      "id": "studio",
+      "type": "container",
+      "name": "supabase-studio",
+      "image": "supabase/studio@sha256:ebf492ba82db1fc9497f56e4cdebf5cddb464b61f6227e21c8f5f3693f9dbbc5",
+      "health": {
+        "kind": "runtime"
+      },
+      "network": "supabase",
+      "env-file": [
+        "${dir:state}/studio-env.env"
+      ],
+      "restart-on": [
+        "studio-env"
+      ],
+      "secrets-in-environment": "Studio (Next.js) reads its keys, the database password and the OpenAI key from the environment only"
+    },
+    {
+      "id": "pooler",
+      "type": "container",
+      "name": "supabase-pooler",
+      "image": "supabase/supavisor@sha256:2f24ab556380db7aaf402d2ec5db09d1974739e685781a91a77ab5ae0dadb3a5",
+      "network": "supabase",
+      "ports": [
+        "5432",
+        "6543"
+      ],
+      "args": [
+        "/bin/sh",
+        "-c",
+        "/app/bin/migrate && /app/bin/supavisor eval \"$(cat /etc/pooler/pooler.exs)\" && /app/bin/server"
+      ],
+      "volumes": [
+        "${dir:state}/pooler.exs:/etc/pooler/pooler.exs:ro",
+        "${dir:state}/settings.json:/etc/pooler/settings.json:ro"
+      ],
+      "restart-on": [
+        "pooler-conf",
+        "settings"
+      ],
+      "env-file": [
+        "${dir:state}/pooler-env.env"
+      ],
+      "secrets-in-environment": "Supavisor reads DATABASE_URL, SECRET_KEY_BASE, VAULT_ENC_KEY and the JWT secret from the environment only"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/systemd-networkd/files/00-mesh0.network b/testdata/beside/mesh-catalog/modules/systemd-networkd/files/00-mesh0.network
new file mode 100644
index 0000000..aef4ba4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/systemd-networkd/files/00-mesh0.network
@@ -0,0 +1,35 @@
+# Managed by the mesh (module systemd-networkd). Replaced on every push; edit
+# the catalogue instead.
+#
+# This machine's uplink is systemd-networkd's, and the mesh asks one thing of it
+# here (novox/hq ADR 0117): leave the private network's interface alone. mesh0
+# is the mesh's; the mesh brings it up and configures it itself. The mesh never
+# declares a link, an address, a route, a wireless network or its credentials,
+# nor a network file for any of this machine's own interfaces — those are
+# the operator's, and the link they make is the only channel the mesh reaches
+# this machine over.
+#
+# 00-: networkd applies the first .network file, in alphanumeric order across
+# every directory, that matches an interface, and ignores every later one even
+# if it matches too (systemd.network(5), [Match]). A catch-all of the operator's
+# — Name=*, Type=ether, a file with no [Match] at all — sorted before
+# this one would claim mesh0 first. 00 sorts before every numbered prefix the
+# man page recommends.
+#
+# Unmanaged=yes: "no attempts are made to bring up or configure matching links,
+# equivalent to when there are no matching network files" (systemd.network(5),
+# [Link], since 233). A match that ends the search, and does nothing else.
+#
+# No DNS setting, because none is needed: networkd never writes
+# /etc/resolv.conf. What it learns from a lease it hands only to
+# systemd-resolved, which the mesh does not run (novox/hq ADR 0196). So this
+# module declares the resolver file itself, beside this one, listing the
+# mesh's resolvers (novox/hq ADR 0223).
+#
+# The service is reloaded when this file changes, never restarted: a restart
+# drops the links networkd holds, this machine's channel to the mesh among them.
+[Match]
+Name=mesh0
+
+[Link]
+Unmanaged=yes
diff --git a/testdata/beside/mesh-catalog/modules/systemd-networkd/module.json.captured b/testdata/beside/mesh-catalog/modules/systemd-networkd/module.json.captured
new file mode 100644
index 0000000..0c4c109
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/systemd-networkd/module.json.captured
@@ -0,0 +1,65 @@
+{
+  "module": "systemd-networkd",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's network: a build that breaks it can cut the machine off from the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236)"
+  },
+  "slug": "networkd",
+  "requires": [
+    "wildcard-resolution"
+  ],
+  "capabilities": [
+    "service-manager",
+    "uplink-systemd-networkd"
+  ],
+  "claims": [
+    {
+      "name": "node-uplink",
+      "scope": "node"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/uplink-tools",
+        "binary": "uplink-tools",
+        "loads": [
+          "uplink-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "facts": {
+    "resolvers": {
+      "path": "/etc/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's uplink:\n# the program that manages the machine's network would otherwise rewrite this\n# file on every change of network, so its holder is the one that writes it\n# (novox/hq ADR 0117, ADR 0223). Replaced on every push; edit nothing here.\n#\n# Every resolver of the mesh, by address, and nothing else (novox/hq ADR 0223) —\n# this machine's own first when it holds one, then the others by name. Each\n# answers the mesh's names from the same roster and forwards every other name, so\n# whichever answers first gives the one answer. There is no public resolver here:\n# a C library that asks every listed server at once and takes the first reply —\n# musl, so every Alpine container — took a public resolver's \"no such name\" for\n# a mesh name and failed. A machine that reaches none of these has no names until\n# it does. Containers copy these lines from their machine.\n{{range index .Holders \"mesh-dns-resolver\"}}nameserver {{.Address}}\n{{end}}options timeout:1 attempts:2 edns0\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/systemd/network/00-mesh0.network",
+      "mode": "0644",
+      "template": "files/00-mesh0.network"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "systemd-networkd.service",
+      "reload-on": [
+        "config"
+      ]
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/systemd-resolved/module.json.captured b/testdata/beside/mesh-catalog/modules/systemd-resolved/module.json.captured
new file mode 100644
index 0000000..b850afc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/systemd-resolved/module.json.captured
@@ -0,0 +1,110 @@
+{
+  "module": "systemd-resolved",
+  "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the machine's names: a build that breaks this resolver stops every name resolving on a machine a person works on, the bus's included, and then neither the gate's rollback nor a push reaches it (hq ADR 0236, ADR 0247)"
+  },
+  "provides": [
+    {
+      "name": "split-dns",
+      "reach": "machine"
+    }
+  ],
+  "requires": [
+    "wildcard-resolution"
+  ],
+  "capabilities": [
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-resolver",
+      "scope": "node",
+      "serves": [
+        "routes",
+        "route",
+        "unroute"
+      ]
+    }
+  ],
+  "listens": [
+    {
+      "name": "dns-udp",
+      "port": 53,
+      "protocol": "udp",
+      "from": "machine",
+      "fixed": true,
+      "why": "this machine's own resolver (ADR 0247), on loopback and on its private address for its own containers; never another machine's, so a VPN's domains routed here are asked by nothing beyond this machine"
+    },
+    {
+      "name": "dns-tcp",
+      "port": 53,
+      "protocol": "tcp",
+      "from": "machine",
+      "fixed": true,
+      "why": "the same names over tcp, which a resolver answers on for an answer too large for a datagram"
+    }
+  ],
+  "facts": {
+    "kept": {
+      "path": "/etc/node-resolver/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's own resolver\n# (module systemd-resolved, novox/hq ADR 0247). On every other machine the module holding\n# the uplink writes this file, listing the mesh's resolvers (ADR 0223); here something\n# requires names routed by domain - a VPN client's domains to its own servers - so the file\n# names this machine's own resolver alone, which sends those domains over the VPN's link and\n# every other name to the mesh's resolvers. One server listed, so one answer per name.\n#\n# Its address on the private network, not loopback: a container copies this file, and\n# this address is one it can reach. Another program writing this file is put back by the\n# module's guard, which keeps what it wrote for whoever handles it on this machine.\n# Replaced on every push; edit nothing here.\n{{$own := \"\"}}{{range .Machines}}{{if eq .Name $.Node}}{{$own = .Address}}{{end}}{{end}}nameserver {{if $own}}{{$own}}{{else}}127.0.0.53{{end}}\noptions timeout:1 attempts:2 edns0\n"
+    },
+    "resolved": {
+      "path": "/etc/systemd/resolved.conf.d/50-mesh.conf",
+      "template": "# Managed by the mesh (module systemd-resolved, novox/hq ADR 0247). Replaced on every\n# push; a drop-in of the operator's that sorts after this one overrides it, and is theirs.\n#\n# The mesh's resolvers, every one of them (ADR 0223): they answer every name no link's own\n# domains route elsewhere. ~. makes them the default route for names, and a link's servers\n# answer only the domains routed to them (the module's verb `route`).\n[Resolve]\nDNS={{range index .Holders \"mesh-dns-resolver\"}}{{.Address}} {{end}}\nDomains=~.\n# No compiled-in public fallback: a public resolver beside the mesh's is what ADR 0223\n# removed, because one of them said \"no such name\" for a mesh name and was believed.\nFallbackDNS=\n# The stub on loopback for this machine, and on its private address for its containers,\n# which cannot reach loopback. The packet filter admits this machine's own guests and\n# nobody else: another machine never asks this resolver (ADR 0247).\nDNSStubListener=yes\n{{$own := \"\"}}{{range .Machines}}{{if eq .Name $.Node}}{{$own = .Address}}{{end}}{{end}}DNSStubListenerExtra={{$own}}\n# No cache: nothing on this machine keeps a copy of a mesh name or of a \"no such name\",\n# as before this resolver - each question is asked again (ADR 0223's objection to a\n# local forwarder was a copy disagreeing with the truth).\nCache=no\n# What this machine's own programs read from /etc/hosts they read themselves; containers\n# asking here get what the mesh's resolvers say, as before.\nReadEtcHosts=no\n# Names are the mesh's resolvers' and a routed link's to answer, never the local network's\n# guesses; validation stays the upstreams' (the mesh's resolvers pass the bit through).\nLLMNR=no\nMulticastDNS=no\nDNSSEC=no\nDNSOverTLS=no\n"
+    },
+    "resolvers": {
+      "path": "/etc/resolv.conf",
+      "template": "# Managed by the mesh, and written by the module holding this machine's own resolver\n# (module systemd-resolved, novox/hq ADR 0247). On every other machine the module holding\n# the uplink writes this file, listing the mesh's resolvers (ADR 0223); here something\n# requires names routed by domain - a VPN client's domains to its own servers - so the file\n# names this machine's own resolver alone, which sends those domains over the VPN's link and\n# every other name to the mesh's resolvers. One server listed, so one answer per name.\n#\n# Its address on the private network, not loopback: a container copies this file, and\n# this address is one it can reach. Another program writing this file is put back by the\n# module's guard, which keeps what it wrote for whoever handles it on this machine.\n# Replaced on every push; edit nothing here.\n{{$own := \"\"}}{{range .Machines}}{{if eq .Name $.Node}}{{$own = .Address}}{{end}}{{end}}nameserver {{if $own}}{{$own}}{{else}}127.0.0.53{{end}}\noptions timeout:1 attempts:2 edns0\n"
+    },
+    "suffix": {
+      "path": "/etc/node-resolver/suffix",
+      "template": "{{.Suffix}}\n"
+    }
+  },
+  "resources": [
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "systemd-resolved.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "systemd-resolved.fact-resolved"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "guard",
+      "type": "process",
+      "name": "systemd-resolved-guard",
+      "artifact": "tools",
+      "run": [
+        "./resolver-tools",
+        "guard"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/resolver-tools",
+        "binary": "resolver-tools",
+        "loads": [
+          "resolver-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/systemd/module.json.captured b/testdata/beside/mesh-catalog/modules/systemd/module.json.captured
new file mode 100644
index 0000000..984ccf3
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/systemd/module.json.captured
@@ -0,0 +1,63 @@
+{
+  "module": "systemd",
+  "version": "1",
+  "capabilities": [
+    "service-manager",
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-service-manager",
+      "scope": "node",
+      "serves": [
+        "units",
+        "status",
+        "start",
+        "stop",
+        "restart",
+        "enable",
+        "disable",
+        "journal",
+        "failed",
+        "reset-failed",
+        "wanted-by",
+        "unlink-dangling"
+      ]
+    }
+  ],
+  "emits": [
+    "link.removal"
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/systemd-tools",
+        "binary": "systemd-tools",
+        "loads": [
+          "systemd-tools"
+        ],
+        "env": {
+          "MESH_SYSTEMD_STATE": "${dir:state}"
+        }
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "systemd"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/telegram/module.json.captured b/testdata/beside/mesh-catalog/modules/telegram/module.json.captured
new file mode 100644
index 0000000..95ae6f1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/telegram/module.json.captured
@@ -0,0 +1,79 @@
+{
+  "module": "telegram",
+  "version": "1",
+  "slug": "tgrm",
+  "runs-as": "telegram",
+  "claims": [
+    {
+      "name": "channel",
+      "scope": "mesh",
+      "kind": "telegram",
+      "capabilities": [
+        "deliver",
+        "reaches-away",
+        "silent",
+        "edit",
+        "max-length:4096",
+        "choice",
+        "verified-sender",
+        "exact-render",
+        "code-factor"
+      ]
+    },
+    {
+      "name": "intake",
+      "scope": "mesh",
+      "kind": "telegram"
+    }
+  ],
+  "state": [
+    "offset",
+    {
+      "name": "messages",
+      "ttl-seconds": 2592000
+    }
+  ],
+  "own-secrets": {
+    "broker": "${dir:state}/broker",
+    "telegram-token": "${dir:state}/telegram-token"
+  },
+  "secrets-owner": "telegram",
+  "tools": [
+    "telegram_status"
+  ],
+  "resources": [
+    {
+      "id": "account",
+      "type": "user",
+      "name": "telegram",
+      "shell": "/usr/bin/nologin",
+      "home": "/var/lib/telegram"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "telegram",
+      "place": ".",
+      "unknown": "program"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/telegram",
+        "binary": "telegram",
+        "loads": [
+          "telegram"
+        ],
+        "env": {
+          "MESH_TELEGRAM_TOKEN_FILE": "${dir:state}/telegram-token"
+        }
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/time-sync/files/50-mesh.conf b/testdata/beside/mesh-catalog/modules/time-sync/files/50-mesh.conf
new file mode 100644
index 0000000..2f465e9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/time-sync/files/50-mesh.conf
@@ -0,0 +1,6 @@
+# The mesh's (module time-sync, novox/hq to-be 42): the servers timesyncd asks. Written whole at
+# every push. A drop-in whose name sorts after this one wins over it: a hosting provider's own
+# servers are kept that way where the machine was found with them.
+[Time]
+NTP=0.europe.pool.ntp.org 1.europe.pool.ntp.org 2.europe.pool.ntp.org 3.europe.pool.ntp.org
+FallbackNTP=0.arch.pool.ntp.org 1.arch.pool.ntp.org 2.arch.pool.ntp.org 3.arch.pool.ntp.org
diff --git a/testdata/beside/mesh-catalog/modules/time-sync/module.json.captured b/testdata/beside/mesh-catalog/modules/time-sync/module.json.captured
new file mode 100644
index 0000000..c3d9b0c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/time-sync/module.json.captured
@@ -0,0 +1,81 @@
+{
+  "module": "time-sync",
+  "version": "1",
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "tools": [
+    "time_sync_status",
+    "time_sync_servers",
+    "time_sync_sync_now"
+  ],
+  "resources": [
+    {
+      "id": "servers",
+      "type": "file",
+      "path": "/etc/systemd/timesyncd.conf.d/50-mesh.conf",
+      "mode": "0644",
+      "template": "files/50-mesh.conf",
+      "names-on-purpose": {
+        "0.europe.pool.ntp.org": "the public NTP pool's European zone: the world's time service, the same for every installation; nearest to every machine of this mesh",
+        "1.europe.pool.ntp.org": "the public NTP pool's European zone: the world's time service, the same for every installation; nearest to every machine of this mesh",
+        "2.europe.pool.ntp.org": "the public NTP pool's European zone: the world's time service, the same for every installation; nearest to every machine of this mesh",
+        "3.europe.pool.ntp.org": "the public NTP pool's European zone: the world's time service, the same for every installation; nearest to every machine of this mesh",
+        "0.arch.pool.ntp.org": "the distribution's own NTP pool, timesyncd's compiled-in fallback, stated so the drop-in says the whole of what timesyncd uses",
+        "1.arch.pool.ntp.org": "the distribution's own NTP pool, timesyncd's compiled-in fallback, stated so the drop-in says the whole of what timesyncd uses",
+        "2.arch.pool.ntp.org": "the distribution's own NTP pool, timesyncd's compiled-in fallback, stated so the drop-in says the whole of what timesyncd uses",
+        "3.arch.pool.ntp.org": "the distribution's own NTP pool, timesyncd's compiled-in fallback, stated so the drop-in says the whole of what timesyncd uses"
+      }
+    },
+    {
+      "id": "retire-ntpd",
+      "type": "process",
+      "name": "time-sync-retire-ntpd",
+      "artifact": "tools",
+      "run": [
+        "./time-sync-tools",
+        "retire",
+        "ntpd.service",
+        "ntpdate.service"
+      ],
+      "run-once": true
+    },
+    {
+      "id": "daemon",
+      "type": "service",
+      "unit": "systemd-timesyncd.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "servers"
+      ]
+    },
+    {
+      "id": "ntp",
+      "type": "package",
+      "package": "ntp",
+      "absent": true
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/time-sync-tools",
+        "binary": "time-sync-tools",
+        "loads": [
+          "time-sync-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/triggerhappy/files/service.conf b/testdata/beside/mesh-catalog/modules/triggerhappy/files/service.conf
new file mode 100644
index 0000000..c7905a0
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/triggerhappy/files/service.conf
@@ -0,0 +1,8 @@
+# Written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on every push.
+#
+# The daemon opens the input devices as root, then drops to the operator's account with its groups,
+# so every trigger runs as the account: it reaches the account's session bus and display, with no su
+# and no hard-coded user. Only the mesh's trigger file is read.
+[Service]
+ExecStart=
+ExecStart=/usr/bin/thd --triggers /etc/triggerhappy/triggers.d/mesh.conf --socket /run/thd.socket --user ${machine:account} --deviceglob /dev/input/event*
diff --git a/testdata/beside/mesh-catalog/modules/triggerhappy/files/triggers.conf b/testdata/beside/mesh-catalog/modules/triggerhappy/files/triggers.conf
new file mode 100644
index 0000000..4576633
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/triggerhappy/files/triggers.conf
@@ -0,0 +1,4 @@
+# The machine's hotkeys, written by the mesh (module triggerhappy, novox/hq ADR 0212). Replaced on
+# every push: a key is added by the module it belongs to, as a contribution to node-hotkeys.
+# A line is: the key, its state (1 pressed, 2 held, 0 released), the command.
+${contribution:node-hotkeys:trigger}
\ No newline at end of file
diff --git a/testdata/beside/mesh-catalog/modules/triggerhappy/module.json.captured b/testdata/beside/mesh-catalog/modules/triggerhappy/module.json.captured
new file mode 100644
index 0000000..18faaf4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/triggerhappy/module.json.captured
@@ -0,0 +1,81 @@
+{
+  "module": "triggerhappy",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-hotkeys",
+      "scope": "node"
+    }
+  ],
+  "tools": [
+    "triggerhappy_keys",
+    "triggerhappy_devices",
+    "triggerhappy_dump",
+    "triggerhappy_check"
+  ],
+  "resources": [
+    {
+      "id": "drop-ins",
+      "type": "directory",
+      "path": "/etc/systemd/system/triggerhappy.service.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "as-account",
+      "type": "file",
+      "path": "/etc/systemd/system/triggerhappy.service.d/mesh.conf",
+      "mode": "0644",
+      "template": "files/service.conf"
+    },
+    {
+      "id": "triggers-dir",
+      "type": "directory",
+      "path": "/etc/triggerhappy/triggers.d",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "triggers",
+      "type": "file",
+      "path": "/etc/triggerhappy/triggers.d/mesh.conf",
+      "mode": "0644",
+      "template": "files/triggers.conf"
+    },
+    {
+      "id": "service",
+      "type": "service",
+      "unit": "triggerhappy.service",
+      "state": "running",
+      "boot": "enabled",
+      "restart-on": [
+        "as-account",
+        "triggers"
+      ]
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/triggerhappy-tools",
+        "binary": "triggerhappy-tools",
+        "loads": [
+          "triggerhappy-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/umami/files/server.env b/testdata/beside/mesh-catalog/modules/umami/files/server.env
new file mode 100644
index 0000000..7f3ccca
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/umami/files/server.env
@@ -0,0 +1,3 @@
+DATABASE_URL=postgresql://${bound:postgres-database:as}:${secret:postgres-database}@${bound:postgres-database:at}:${bound:postgres-database:port}/${bound:postgres-database:as}
+DATABASE_TYPE=postgresql
+APP_SECRET=${secret:app-secret}
diff --git a/testdata/beside/mesh-catalog/modules/umami/module.json.captured b/testdata/beside/mesh-catalog/modules/umami/module.json.captured
new file mode 100644
index 0000000..22ead41
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/umami/module.json.captured
@@ -0,0 +1,142 @@
+{
+  "module": "umami",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "postgres-database",
+    "route",
+    "secret"
+  ],
+  "contributes": {
+    "postgres-database": {
+      "name": "umami"
+    },
+    "route": {
+      "label": "umami",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "postgres-database": "${dir:state}/database.json",
+    "route": "${dir:state}/route.json"
+  },
+  "secrets": {
+    "postgres-database": "${dir:state}/database.secret",
+    "secret": {
+      "app-secret": "${dir:state}/app.secret",
+      "admin": "${dir:state}/admin.secret"
+    }
+  },
+  "provides": [
+    {
+      "name": "analytics",
+      "scope": "mesh"
+    }
+  ],
+  "serves": {
+    "analytics": {}
+  },
+  "receives": {
+    "analytics": "${dir:grants}/mesh.json"
+  },
+  "grants": {
+    "analytics": "${dir:grants}"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 3000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "one port serves two surfaces — the dashboard and the collection endpoint that the browsers of every tracked site POST to. Both are reached through the proxy, by name, so the port is how the proxy reaches this module and nothing else (novox/hq ADR 0045). It said \"anywhere\" and gave the reason that the collection endpoint must be public, which is true of the name and not of the port: opened, the machine-side port served the dashboard over plain HTTP to the internet, bypassing every rule the proxy applies by path"
+    }
+  ],
+  "data": {
+    "consumers": {
+      "analytics": {
+        "class": "valuable",
+        "in": "postgres-database",
+        "why": "a site's page views are recorded nowhere else"
+      }
+    }
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "grants",
+      "type": "directory",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "server-env",
+      "type": "file",
+      "path": "${dir:state}/server.env",
+      "mode": "0600",
+      "template": "files/server.env"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "umami"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/api/share/mesh-health",
+        "status": 404,
+        "body": "\"code\":\"not-found\"",
+        "timeout": "10s",
+        "needs": "postgres-database"
+      },
+      "name": "umami",
+      "image": "ghcr.io/umami-software/umami@sha256:85909afc45bdcda1917394594a087421fdbb05610fded0fa9f6fb861abb2f367",
+      "network": "umami",
+      "env-file": [
+        "${dir:state}/server.env"
+      ],
+      "ports": [
+        "3000"
+      ],
+      "secrets-in-environment": "a Next.js/Prisma application: DATABASE_URL and APP_SECRET are read from the environment only; not convertible"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "code",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "loads": [
+          "tools/index.js",
+          "provisioner/index.js"
+        ],
+        "env": {
+          "MESH_RECEIVES": "${dir:grants}/mesh.json",
+          "MESH_UMAMI_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_PROVISION_UMAMI_URL": "http://127.0.0.1:${port:3000}"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/unifi/files/config.json b/testdata/beside/mesh-catalog/modules/unifi/files/config.json
new file mode 100644
index 0000000..dd311b9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/unifi/files/config.json
@@ -0,0 +1,4 @@
+{
+  "site": "default",
+  "password": "${secret:controller}"
+}
diff --git a/testdata/beside/mesh-catalog/modules/unifi/module.json.captured b/testdata/beside/mesh-catalog/modules/unifi/module.json.captured
new file mode 100644
index 0000000..2ee5cf4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/unifi/module.json.captured
@@ -0,0 +1,203 @@
+{
+  "module": "unifi",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "listens": [
+    {
+      "name": "web",
+      "port": 8443,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the controller web UI and API, over its own self-signed tls; named through the proxy as an https route"
+    },
+    {
+      "name": "inform",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "device inform, how APs and switches check in and are adopted; the controller tells devices this number, so the machine must publish it on the same one"
+    },
+    {
+      "name": "stun",
+      "port": 3478,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "STUN for managed devices; the controller tells devices this number, so the machine must publish it on the same one"
+    },
+    {
+      "name": "discovery",
+      "port": 10001,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "device discovery broadcasts from unadopted devices and the UniFi apps"
+    },
+    {
+      "name": "discovery-l2",
+      "port": 1900,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "make-controller-discoverable-on-L2 (SSDP); the software listens on 1900, which machines commonly have taken by another SSDP speaker"
+    },
+    {
+      "name": "portal-tls",
+      "port": 8843,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the guest captive portal over https"
+    },
+    {
+      "name": "portal",
+      "port": 8880,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the guest captive portal over http"
+    },
+    {
+      "name": "speedtest",
+      "port": 6789,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "mobile-app speed-test throughput measurement"
+    },
+    {
+      "name": "syslog",
+      "port": 5514,
+      "protocol": "udp",
+      "from": "mesh",
+      "why": "remote syslog from managed devices"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "data",
+        "path": "${dir:data}",
+        "class": "valuable",
+        "why": "the network's configuration and every adopted device"
+      }
+    ]
+  },
+  "config": {
+    "site": {
+      "type": "string",
+      "description": "The UniFi site the module's tools act on, by its id; the file's default is default.",
+      "trusted": true,
+      "default": "default"
+    },
+    "url": {
+      "type": "string",
+      "description": "The address the module's tools reach the UniFi controller at, as a URL; unset, the code falls back to its environment, else this machine's controller on its HTTPS port.",
+      "trusted": true,
+      "default": ""
+    },
+    "username": {
+      "type": "string",
+      "description": "The UniFi account the module's tools sign in as with the vault's password; unset, the code falls back to its environment.",
+      "trusted": true,
+      "default": ""
+    }
+  },
+  "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh",
+      "unknown": "program"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "data",
+      "type": "directory",
+      "mode": "0700",
+      "owner": "1000:1000",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "unifi-controller",
+      "image": "lscr.io/linuxserver/unifi-controller@sha256:0ae315a3a45635e443899e30e86bd507c2c48922cb27f4bc7241777885f4650e",
+      "ports": [
+        "8443",
+        "8080",
+        "3478/udp",
+        "10001/udp",
+        "1900/udp",
+        "8843",
+        "8880",
+        "6789",
+        "5514/udp"
+      ],
+      "env": {
+        "PUID": "1000",
+        "PGID": "1000",
+        "TZ": "Etc/UTC",
+        "MEM_LIMIT": "1024",
+        "MEM_STARTUP": "1024"
+      },
+      "volumes": [
+        "${dir:data}:/config"
+      ]
+    },
+    {
+      "id": "runtime-config",
+      "type": "file",
+      "path": "${dir:mesh-state}/config.json",
+      "mode": "0600",
+      "template": "files/config.json",
+      "merge": "json",
+      "takes-config": ["site", "url", "username"],
+      "protected": ["password"]
+    }
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "unifi",
+      "endpoint": "web",
+      "scheme": "https",
+      "insecure": true
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "own-secrets": {
+    "controller": "${dir:mesh-state}/controller"
+  },
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "loads": [
+          "tools/index.js"
+        ],
+        "env": {
+          "MESH_UNIFI_URL": "https://127.0.0.1:${port:8443}",
+          "MESH_UNIFI_CONFIG_FILE": "${dir:mesh-state}/config.json"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/website/module.json.captured b/testdata/beside/mesh-catalog/modules/website/module.json.captured
new file mode 100644
index 0000000..481cfc6
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/website/module.json.captured
@@ -0,0 +1,60 @@
+{
+  "module": "website",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "@",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8080,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the public website over http; its public name is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": ".",
+      "unknown": "program"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "website"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "website",
+      "image": "registry-api.novox.be/novox/www@sha256:aa7ed20a293e1d7444c5c5d59b6d8bdb382bad159559a22e006810e379cae69c",
+      "health": {
+        "kind": "http",
+        "endpoint": "web",
+        "path": "/"
+      },
+      "network": "website",
+      "ports": [
+        "8080"
+      ],
+      "names-on-purpose": {
+        "registry-api.novox.be": "built outside the mesh, from the application's own repository, and pulled from the registry that built it; moves when that repository is a build source on the git seat (novox/hq ADR 0155, issue 122)"
+      }
+    }
+  ]
+}
diff --git a/testdata/beside/mesh-catalog/modules/xclip/module.json.captured b/testdata/beside/mesh-catalog/modules/xclip/module.json.captured
new file mode 100644
index 0000000..bf06f6f
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xclip/module.json.captured
@@ -0,0 +1,35 @@
+{
+  "module": "xclip",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "xclip_copy",
+    "xclip_paste",
+    "xclip_targets",
+    "xclip_session"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xclip"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xclip-tools",
+        "binary": "xclip-tools",
+        "loads": [
+          "xclip-tools"
+        ]
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/xdg/files/mimeapps.list b/testdata/beside/mesh-catalog/modules/xdg/files/mimeapps.list
new file mode 100644
index 0000000..b70f0a8
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xdg/files/mimeapps.list
@@ -0,0 +1,29 @@
+# The machine's default applications (module xdg, novox/hq ADR 0182), written by the mesh and
+# replaced at every push.
+#
+# This is the lowest list an application consults. The account's own ~/.config/mimeapps.list comes
+# first: every program that offers "always open with" writes there, and so does xdg_default. That
+# file is the person's and is never written by the mesh, so a choice made there always wins; this
+# list answers only what the person has not chosen. Adopted from the workstations' own lists of
+# 2026-10-05, without the entries naming an application neither workstation has installed (see the
+# module's README).
+[Default Applications]
+application/pdf=firefox.desktop;
+application/x-extension-htm=firefox.desktop;
+application/x-extension-shtml=firefox.desktop;
+application/x-extension-xht=firefox.desktop;
+application/x-extension-xhtml=firefox.desktop;
+application/xhtml+xml=firefox.desktop;
+text/html=firefox.desktop;
+x-scheme-handler/chrome=firefox.desktop;
+x-scheme-handler/ftp=firefox.desktop;
+x-scheme-handler/http=firefox.desktop;
+x-scheme-handler/https=firefox.desktop;
+text/markdown=org.kde.ghostwriter.desktop;
+inode/directory=thunar.desktop;
+x-scheme-handler/abc=plexamp.desktop;
+x-scheme-handler/slack=slack.desktop;
+x-scheme-handler/tg=org.telegram.desktop.desktop;
+
+[Added Associations]
+video/mp4=mpv.desktop;mplayer.desktop;vlc.desktop;
diff --git a/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.conf b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.conf
new file mode 100644
index 0000000..f26143a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.conf
@@ -0,0 +1,9 @@
+# xdg-user-dirs-update for this account (module xdg, novox/hq ADR 0182), written by the mesh and
+# replaced at every push.
+#
+# The update runs at every login (its XDG autostart entry, which the session's dex starts). Enabled,
+# it reassigns a folder it cannot find to the home and adds a line for every folder its defaults
+# know, rewriting user-dirs.dirs, which is the mesh's. Disabled, it does nothing, even with --force.
+# The folders are this module's to say.
+enabled=False
+filename_encoding=UTF-8
diff --git a/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.dirs b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.dirs
new file mode 100644
index 0000000..a18fa7a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.dirs
@@ -0,0 +1,17 @@
+# The account's folders (module xdg, novox/hq ADR 0182), written by the mesh and replaced at every
+# push. Adopted from the workstations' own files of 2026-10-05. A folder that differs between the
+# machines is a setting of this module; every other one is the same everywhere. PROJECTS names the
+# folder the operator's repositories are in (it pointed at the home, or was absent).
+#
+# xdg-user-dirs-update never rewrites this file: user-dirs.conf beside it says enabled=False. Each
+# line is xdg-user-dirs' only format, XDG_xxx_DIR="$HOME/yyy" or XDG_xxx_DIR="/yyy". "$HOME/" is
+# the home itself: the folder is not wanted. xdg_user_dirs says what each one resolves to.
+XDG_DESKTOP_DIR="${config:desktop-dir}"
+XDG_DOWNLOAD_DIR="$HOME/Downloads"
+XDG_TEMPLATES_DIR="$HOME/Templates"
+XDG_PUBLICSHARE_DIR="${config:publicshare-dir}"
+XDG_DOCUMENTS_DIR="$HOME/Documents"
+XDG_MUSIC_DIR="$HOME/Music"
+XDG_PICTURES_DIR="$HOME/Pictures"
+XDG_VIDEOS_DIR="${config:videos-dir}"
+XDG_PROJECTS_DIR="$HOME/projects"
diff --git a/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.locale b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.locale
new file mode 100644
index 0000000..7741b83
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xdg/files/user-dirs.locale
@@ -0,0 +1 @@
+en_US
diff --git a/testdata/beside/mesh-catalog/modules/xdg/module.json.captured b/testdata/beside/mesh-catalog/modules/xdg/module.json.captured
new file mode 100644
index 0000000..c3d191a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xdg/module.json.captured
@@ -0,0 +1,97 @@
+{
+  "module": "xdg",
+  "version": "1",
+  "capabilities": [
+    "package-manager"
+  ],
+  "tools": [
+    "xdg_user_dirs",
+    "xdg_default",
+    "xdg_open_handlers",
+    "xdg_autostart",
+    "xdg_check"
+  ],
+    "config": {
+      "desktop-dir": {
+        "type": "string",
+        "description": "The desktop folder, as user-dirs.dirs writes it: \"$HOME/<folder>\", or \"$HOME/\" when the folder is not wanted; it differs between the workstations, so each says its own.",
+        "trusted": true,
+        "required": true
+      },
+      "publicshare-dir": {
+        "type": "string",
+        "description": "The public share folder, as user-dirs.dirs writes it: \"$HOME/<folder>\", or \"$HOME/\" when the folder is not wanted; it differs between the workstations, so each says its own.",
+        "trusted": true,
+        "required": true
+      },
+      "videos-dir": {
+        "type": "string",
+        "description": "The videos folder, as user-dirs.dirs writes it: \"$HOME/<folder>\", or \"$HOME/\" when the folder is not wanted; it differs between the workstations, so each says its own.",
+        "trusted": true,
+        "required": true
+      }
+    },
+  "resources": [
+    {
+      "id": "package-xdg-user-dirs",
+      "type": "package",
+      "package": "xdg-user-dirs"
+    },
+    {
+      "id": "package-xdg-utils",
+      "type": "package",
+      "package": "xdg-utils"
+    },
+    {
+      "id": "user-dirs",
+      "type": "file",
+      "path": "${machine:account-home}/.config/user-dirs.dirs",
+      "owner": "${machine:account}",
+      "mode": "0600",
+      "template": "files/user-dirs.dirs"
+    },
+    {
+      "id": "user-dirs-locale",
+      "type": "file",
+      "path": "${machine:account-home}/.config/user-dirs.locale",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/user-dirs.locale"
+    },
+    {
+      "id": "user-dirs-update",
+      "type": "file",
+      "path": "${machine:account-home}/.config/user-dirs.conf",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/user-dirs.conf"
+    },
+    {
+      "id": "default-applications",
+      "type": "file",
+      "path": "/etc/xdg/mimeapps.list",
+      "mode": "0644",
+      "template": "files/mimeapps.list"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xdg-tools",
+        "binary": "xdg-tools",
+        "loads": [
+          "xdg-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/xorg/files/xinitrc b/testdata/beside/mesh-catalog/modules/xorg/files/xinitrc
new file mode 100755
index 0000000..bb7accc
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xorg/files/xinitrc
@@ -0,0 +1,51 @@
+# The mesh's block (module xorg, novox/hq ADR 0208 §5): the graphical session's start, replaced at
+# every push. It ends by starting the session, so no line below it in this file runs any more. A line
+# of your own that must run at every session start goes in ~/.xinitrc.local, which this block sources
+# just before the session starts (the module's README lists where each of today's lines went).
+
+# 1. The account's environment (ADR 0203): the file every shell sources, written by node-environment.
+if [ -r "${machine:account-home}/.config/mesh/environment.sh" ]; then
+  . "${machine:account-home}/.config/mesh/environment.sh"
+fi
+
+# The session bus is the user manager's. pam_systemd normally hands it over; when it did not, take
+# the canonical socket rather than starting a second bus, which runs every D-Bus-activated service
+# twice (two notifiers, two portals) and hides one copy from the other.
+if [ -z "$DBUS_SESSION_BUS_ADDRESS" ] && [ -S "/run/user/$(id -u)/bus" ]; then
+  DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(id -u)/bus"
+  export DBUS_SESSION_BUS_ADDRESS
+fi
+
+# 2. The session's own words into the user manager and D-Bus activation, so the portal, the notifier
+# and every user service see the display and the desktop's identity. An explicit list and never
+# --all: a session's environment may hold things no user service should be able to read back.
+mesh_words=
+for mesh_word in DISPLAY XAUTHORITY XDG_SESSION_TYPE XDG_CURRENT_DESKTOP XDG_SESSION_DESKTOP \
+  XDG_CONFIG_HOME XDG_DATA_DIRS GTK_THEME GTK2_RC_FILES QT_QPA_PLATFORMTHEME QT_STYLE_OVERRIDE \
+  QT_SELECT XCURSOR_THEME XCURSOR_SIZE TERMINAL; do
+  if printenv "$mesh_word" >/dev/null 2>&1; then
+    mesh_words="$mesh_words $mesh_word"
+  fi
+done
+dbus-update-activation-environment --systemd $mesh_words
+unset mesh_word mesh_words
+
+# 3. X resources: the mesh's, then yours in ~/.Xresources, which win. The mesh's file is merged
+# without the C preprocessor, so no compiler is needed for it.
+xrdb -nocpp -merge "${machine:account-home}/.config/xorg/xresources"
+if [ -r "$HOME/.Xresources" ]; then
+  xrdb -merge "$HOME/.Xresources"
+fi
+
+# 4. The monitors: the saved layout profile that matches the monitors connected, if one does.
+if command -v autorandr >/dev/null 2>&1; then
+  autorandr --change >/dev/null 2>&1 || true
+fi
+
+# 5. Other modules' session lines (ADR 0208 §4), then yours.
+${shell:xinitrc:first}${shell:xinitrc:normal}if [ -r "$HOME/.xinitrc.local" ]; then
+  . "$HOME/.xinitrc.local"
+fi
+
+# 6. The session itself: the holder of node-display-session starts it from the last slot.
+${shell:xinitrc:last}
diff --git a/testdata/beside/mesh-catalog/modules/xorg/files/xresources b/testdata/beside/mesh-catalog/modules/xorg/files/xresources
new file mode 100644
index 0000000..e06126c
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xorg/files/xresources
@@ -0,0 +1,13 @@
+! The mesh's X resources (module xorg, novox/hq ADR 0208 §4), replaced at every push. The session's
+! start merges them with xrdb -nocpp before ~/.Xresources, so your own resources there win. Without
+! the preprocessor there is no #include or #define here, and a line starting with # is skipped,
+! which is what the line naming each contributing module is.
+!
+! Font rendering, as both workstations had it. 96 DPI becomes a setting with issue 168; xorg_dpi
+! changes it for the running session.
+Xft.dpi: 96
+Xft.antialias: 1
+Xft.hinting: 1
+Xft.hintstyle: hintslight
+Xft.rgba: rgb
+${shell:xresources:first}${shell:xresources:normal}${shell:xresources:last}
diff --git a/testdata/beside/mesh-catalog/modules/xorg/module.json.captured b/testdata/beside/mesh-catalog/modules/xorg/module.json.captured
new file mode 100644
index 0000000..7b0b6b1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xorg/module.json.captured
@@ -0,0 +1,134 @@
+{
+  "module": "xorg",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager",
+    "seat"
+  ],
+  "provides": [
+    {
+      "name": "x11-display",
+      "reach": "machine"
+    }
+  ],
+  "claims": [
+    {
+      "name": "node-display-server",
+      "scope": "node",
+      "serves": [
+        "displays",
+        "layout"
+      ]
+    }
+  ],
+  "tools": [
+    "xorg_set_mode",
+    "xorg_primary",
+    "xorg_dpi",
+    "xorg_input_devices",
+    "xorg_input_set",
+    "xorg_keyboard",
+    "xorg_screenshot",
+    "xorg_windows",
+    "xorg_x_log"
+  ],
+  "resources": [
+    {
+      "id": "package-xorg-server",
+      "type": "package",
+      "package": "xorg-server"
+    },
+    {
+      "id": "package-xorg-xinit",
+      "type": "package",
+      "package": "xorg-xinit"
+    },
+    {
+      "id": "package-xorg-xrandr",
+      "type": "package",
+      "package": "xorg-xrandr"
+    },
+    {
+      "id": "package-xorg-xset",
+      "type": "package",
+      "package": "xorg-xset"
+    },
+    {
+      "id": "package-xorg-xrdb",
+      "type": "package",
+      "package": "xorg-xrdb"
+    },
+    {
+      "id": "package-xorg-xinput",
+      "type": "package",
+      "package": "xorg-xinput"
+    },
+    {
+      "id": "package-xorg-setxkbmap",
+      "type": "package",
+      "package": "xorg-setxkbmap"
+    },
+    {
+      "id": "package-xorg-xwd",
+      "type": "package",
+      "package": "xorg-xwd"
+    },
+    {
+      "id": "package-xorg-xwininfo",
+      "type": "package",
+      "package": "xorg-xwininfo"
+    },
+    {
+      "id": "package-autorandr",
+      "type": "package",
+      "package": "autorandr"
+    },
+    {
+      "id": "config",
+      "type": "directory",
+      "path": "${machine:account-home}/.config/xorg",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "unknown": "move-out"
+    },
+    {
+      "id": "xresources",
+      "type": "file",
+      "path": "${machine:account-home}/.config/xorg/xresources",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "template": "files/xresources"
+    },
+    {
+      "id": "xinitrc",
+      "type": "file",
+      "path": "${machine:account-home}/.xinitrc",
+      "owner": "${machine:account}",
+      "mode": "0755",
+      "into": "block",
+      "at": "start",
+      "template": "files/xinitrc"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xorg",
+        "binary": "xorg",
+        "loads": [
+          "xorg"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/xterm/files/env-terminal b/testdata/beside/mesh-catalog/modules/xterm/files/env-terminal
new file mode 100644
index 0000000..db0c341
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xterm/files/env-terminal
@@ -0,0 +1 @@
+xterm
diff --git a/testdata/beside/mesh-catalog/modules/xterm/files/xresources-normal b/testdata/beside/mesh-catalog/modules/xterm/files/xresources-normal
new file mode 100644
index 0000000..d95ee3b
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xterm/files/xresources-normal
@@ -0,0 +1,31 @@
+! xterm: the face, the palette and the clipboard keys. Scoped to the XTerm class, so they
+! outrank any `*name` resource of yours and touch no other X program.
+XTerm*termName: xterm-256color
+XTerm*saveLines: 10000
+XTerm*renderFont: true
+XTerm*faceName: JetBrainsMono Nerd Font
+XTerm*faceSize: 12
+XTerm*boldMode: false
+XTerm*alwaysBoldMode: false
+XTerm*allowBoldFonts: true
+XTerm*background: #000000
+XTerm*foreground: #a8a8a8
+XTerm*color0: #000000
+XTerm*color8: #666666
+XTerm*color1: #9e1828
+XTerm*color9: #bc5766
+XTerm*color2: #008800
+XTerm*color10: #61a171
+XTerm*color3: #d2bb4b
+XTerm*color11: #e7db52
+XTerm*color4: #414171
+XTerm*color12: #5085af
+XTerm*color5: #963c59
+XTerm*color13: #a97a99
+XTerm*color6: #418179
+XTerm*color14: #6ba4a4
+XTerm*color7: #bebebe
+XTerm*color15: #ffffff
+XTerm*VT100.Translations: #override \n\
+  Ctrl Shift ~Alt <Key> C: copy-selection(CLIPBOARD) \n\
+  Ctrl Shift ~Alt <Key> V: insert-selection(CLIPBOARD)
diff --git a/testdata/beside/mesh-catalog/modules/xterm/module.json.captured b/testdata/beside/mesh-catalog/modules/xterm/module.json.captured
new file mode 100644
index 0000000..e6a565a
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/xterm/module.json.captured
@@ -0,0 +1,67 @@
+{
+  "module": "xterm",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "requires": [
+    "x11-display"
+  ],
+  "claims": [
+    {
+      "name": "node-terminal-emulator",
+      "scope": "node",
+      "serves": [
+        "open"
+      ]
+    }
+  ],
+  "tools": [
+    "xterm_font",
+    "xterm_colours"
+  ],
+  "items": [
+    {
+      "collection": "environment",
+      "name": "terminal",
+      "attributes": {
+        "kind": "variable",
+        "name": "TERMINAL"
+      },
+      "template": "files/env-terminal"
+    },
+    {
+      "collection": "shell:xresources:normal",
+      "name": "xresources-normal",
+      "template": "files/xresources-normal"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "xterm"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/xterm-tools",
+        "binary": "xterm-tools",
+        "loads": [
+          "xterm-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/zfs/files/scrub.conf b/testdata/beside/mesh-catalog/modules/zfs/files/scrub.conf
new file mode 100644
index 0000000..daccbd9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zfs/files/scrub.conf
@@ -0,0 +1,6 @@
+# Written by the mesh (module zfs) from this machine's assignment. Replaced on every push; change the
+# settings scrub-pool, scrub-cadence, scrub-day and scrub-time, never this file. The module's tools read it.
+pool=${config:scrub-pool}
+cadence=${config:scrub-cadence}
+day=${config:scrub-day}
+time=${config:scrub-time}
diff --git a/testdata/beside/mesh-catalog/modules/zfs/module.json.captured b/testdata/beside/mesh-catalog/modules/zfs/module.json.captured
new file mode 100644
index 0000000..c109320
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zfs/module.json.captured
@@ -0,0 +1,235 @@
+{
+  "module": "zfs",
+  "version": "1",
+  "capabilities": [
+    "service-manager"
+  ],
+  "emits": [
+    "snapshot.taken",
+    "scrub.requested"
+  ],
+    "config": {
+      "scrub-pool": {
+        "type": "string",
+        "description": "The name of the ZFS pool the module scrubs; the operator's, with no default.",
+        "trusted": true,
+        "required": true
+      },
+      "scrub-cadence": {
+        "type": "string",
+        "description": "How often the pool named by scrub-pool is scrubbed: weekly, or monthly on the first scrub-day of each month. Weekly is what the distribution's timer did on the home server before the module, so taking it over moves nothing until the operator chooses.",
+        "enum": [
+          "weekly",
+          "monthly"
+        ],
+        "trusted": true,
+        "default": "weekly"
+      },
+      "scrub-day": {
+        "type": "string",
+        "description": "The weekday the scrub starts, Mon to Sun; for a monthly scrub, the first such day of the month. Checked by the scheduled run, which refuses any other value and runs nothing; Monday is when the distribution's weekly timer fired.",
+        "enum": [
+          "Mon",
+          "Tue",
+          "Wed",
+          "Thu",
+          "Fri",
+          "Sat",
+          "Sun"
+        ],
+        "trusted": true,
+        "default": "Mon"
+      },
+      "scrub-time": {
+        "type": "string",
+        "description": "The time the scrub starts, HH:MM from 00:00 to 23:59 in the machine's time zone; the scheduled run checks it every quarter of an hour, so the scrub starts within 15 minutes of it. Midnight is when the distribution's weekly timer fired.",
+        "pattern": "([01][0-9]|2[0-3]):[0-5][0-9]",
+        "trusted": true,
+        "default": "00:00"
+      }
+    },
+  "tools": [
+    "zfs_datasets",
+    "zfs_snapshots",
+    "zfs_snapshot",
+    "zfs_pools",
+    "zfs_space",
+    "zfs_pool_layout",
+    "zfs_scrub",
+    "zfs_scrub_start",
+    "zfs_scrub_pause",
+    "zfs_scrub_stop",
+    "zfs_io",
+    "zfs_arc",
+    "zfs_events",
+    "zfs_properties",
+    "zfs_health"
+  ],
+  "replaces": {
+    "zfs_datasets": [
+      "zfs list"
+    ],
+    "zfs_snapshots": [
+      "zfs list -t snapshot"
+    ],
+    "zfs_snapshot": [
+      "zfs snapshot"
+    ],
+    "zfs_pools": [
+      "zpool list",
+      "zpool status -x"
+    ],
+    "zfs_space": [
+      "zfs list -o space",
+      "zpool list -v"
+    ],
+    "zfs_pool_layout": [
+      "zpool status",
+      "zpool status -v"
+    ],
+    "zfs_scrub": [
+      "zpool history -i"
+    ],
+    "zfs_io": [
+      "zpool iostat",
+      "zpool iostat -v"
+    ],
+    "zfs_arc": [
+      "arcstat",
+      "arc_summary",
+      "cat /proc/spl/kstat/zfs/arcstats"
+    ],
+    "zfs_events": [
+      "zpool events",
+      "zpool events -v"
+    ],
+    "zfs_properties": [
+      "zfs get all",
+      "zfs get"
+    ],
+    "zfs_scrub_start": [
+      "zpool scrub"
+    ],
+    "zfs_scrub_pause": [
+      "zpool scrub -p"
+    ],
+    "zfs_scrub_stop": [
+      "zpool scrub -s"
+    ]
+  },
+  "resources": [
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "zfs-watch",
+      "artifact": "tools",
+      "run": [
+        "./zfs-tools",
+        "watch"
+      ],
+      "user": "${machine:account}",
+      "health": {
+        "kind": "tool",
+        "tool": "zfs_health",
+        "interval": "60s",
+        "timeout": "20s",
+        "looks": 2,
+        "grace": "60s"
+      }
+    },
+    {
+      "id": "state-dir",
+      "type": "directory",
+      "path": "/var/lib/zfs-tools",
+      "mode": "0755",
+      "owner": "${machine:account}",
+      "unknown": "program"
+    },
+    {
+      "id": "cursor-dir",
+      "type": "directory",
+      "path": "/run/zfs-events",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "events",
+      "type": "process",
+      "name": "zfs-events",
+      "artifact": "tools",
+      "run": [
+        "./zfs-tools",
+        "events"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/zfs-tools",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "scrub-config",
+      "type": "file",
+      "path": "/etc/zfs-tools/scrub.conf",
+      "mode": "0644",
+      "template": "files/scrub.conf"
+    },
+    {
+      "id": "scrub-state-dir",
+      "type": "directory",
+      "path": "/var/lib/zfs-scrub",
+      "mode": "0700",
+      "unknown": "program"
+    },
+    {
+      "id": "scrub-run",
+      "type": "process",
+      "name": "zfs-mesh-scrub",
+      "artifact": "tools",
+      "run": [
+        "./zfs-tools",
+        "scrub-run"
+      ],
+      "schedule": "*/15 * * * *"
+    },
+    {
+      "id": "distribution-weekly",
+      "type": "service",
+      "unit": "zfs-scrub-weekly@${config:scrub-pool}.timer",
+      "state": "stopped",
+      "boot": "disabled"
+    },
+    {
+      "id": "distribution-monthly",
+      "type": "service",
+      "unit": "zfs-scrub-monthly@${config:scrub-pool}.timer",
+      "state": "stopped",
+      "boot": "disabled"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/zfs-tools",
+        "binary": "zfs-tools",
+        "loads": [
+          "zfs-tools"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/files/zsh-normal b/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/files/zsh-normal
new file mode 100644
index 0000000..8179334
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/files/zsh-normal
@@ -0,0 +1,2 @@
+# Suggestions from history as you type, from the distribution's package.
+[[ ! -f /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh ]] || source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
diff --git a/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/module.json.captured b/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/module.json.captured
new file mode 100644
index 0000000..e883921
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh-autosuggestions/module.json.captured
@@ -0,0 +1,30 @@
+{
+  "module": "zsh-autosuggestions",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "zsh-autosuggestions"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:normal",
+      "template": "files/zsh-normal"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/files/zsh-last b/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/files/zsh-last
new file mode 100644
index 0000000..bf9d5b1
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/files/zsh-last
@@ -0,0 +1,3 @@
+# Syntax highlighting of the command line, from the distribution's package. Last, as upstream asks:
+# it wraps every widget defined before it.
+[[ ! -f /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]] || source /usr/share/zsh/plugins/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
diff --git a/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/module.json.captured b/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/module.json.captured
new file mode 100644
index 0000000..b9c81a9
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh-syntax-highlighting/module.json.captured
@@ -0,0 +1,30 @@
+{
+  "module": "zsh-syntax-highlighting",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "zsh-syntax-highlighting"
+    }
+  ],
+  "items": [
+    {
+      "collection": "shell:zsh:last",
+      "template": "files/zsh-last"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-editor b/testdata/beside/mesh-catalog/modules/zsh/files/env-editor
new file mode 100644
index 0000000..f027e0d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-editor
@@ -0,0 +1 @@
+vim
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-path-local-bin b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-local-bin
new file mode 100644
index 0000000..a7e29b5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-local-bin
@@ -0,0 +1 @@
+${machine:account-home}/.local/bin
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts
new file mode 100644
index 0000000..79698dd
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts
@@ -0,0 +1 @@
+${machine:account-home}/scripts
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts-bin b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts-bin
new file mode 100644
index 0000000..ef4c1da
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-path-scripts-bin
@@ -0,0 +1 @@
+${machine:account-home}/scripts/bin
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-visual b/testdata/beside/mesh-catalog/modules/zsh/files/env-visual
new file mode 100644
index 0000000..f027e0d
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-visual
@@ -0,0 +1 @@
+vim
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/env-xdg-config-home b/testdata/beside/mesh-catalog/modules/zsh/files/env-xdg-config-home
new file mode 100644
index 0000000..24cb657
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/env-xdg-config-home
@@ -0,0 +1 @@
+${machine:account-home}/.config
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/tools.conf b/testdata/beside/mesh-catalog/modules/zsh/files/tools.conf
new file mode 100644
index 0000000..365de16
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/tools.conf
@@ -0,0 +1,3 @@
+# Written by the mesh (module zsh, hq ADR 0268) from this machine's setting execute: serve or withhold.
+# Read by the zsh tools bundle when the runtime starts it; change the setting, not this.
+execute=${config:execute}
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/zshenv b/testdata/beside/mesh-catalog/modules/zsh/files/zshenv
new file mode 100644
index 0000000..3a98ee4
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/zshenv
@@ -0,0 +1,9 @@
+# The mesh's block (module zsh, novox/hq ADR 0203, ADR 0204): the account's environment, read by
+# every zsh — a login, a script, and node-login-shell's execute. Replaced at every push; everything
+# outside it is yours.
+# PATH keeps each directory once, wherever it was added: the session, a nested shell or a
+# sourced file. Without it every nested shell prepended the same entries again.
+typeset -U path PATH
+if [[ -r "${machine:account-home}/.config/mesh/environment.sh" ]]; then
+  source "${machine:account-home}/.config/mesh/environment.sh"
+fi
diff --git a/testdata/beside/mesh-catalog/modules/zsh/files/zshrc b/testdata/beside/mesh-catalog/modules/zsh/files/zshrc
new file mode 100644
index 0000000..0e868f5
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/files/zshrc
@@ -0,0 +1,60 @@
+# The mesh's block (module zsh, novox/hq ADR 0204): the defaults every machine shares, and the code
+# other modules contribute in three slots. It is replaced at every push. Everything below it is
+# yours, kept as you wrote it, and runs after it, so your lines win.
+${shell:zsh:first}
+# History, kept across sessions and shared between open shells. Without these zsh saves none:
+# SAVEHIST defaults to 0 (novox/hq to-be 41, found on review 2026-10-04).
+HISTFILE="$HOME/.zsh_history"
+HISTSIZE=100000
+SAVEHIST=100000
+setopt EXTENDED_HISTORY SHARE_HISTORY HIST_IGNORE_DUPS HIST_IGNORE_SPACE HIST_REDUCE_BLANKS
+
+# The completion system. Nothing initialised it, so only zsh's basic completion ran. Its cache
+# goes under ~/.cache rather than beside ~/.zshrc.
+[[ -d "$HOME/.cache/zsh" ]] || mkdir -p "$HOME/.cache/zsh"
+autoload -Uz compinit && compinit -d "$HOME/.cache/zsh/zcompdump"
+zstyle ':completion:*' menu select
+
+# Terminal title: host, directory, git branch
+function set_terminal_title() {
+  local git_branch=""
+  if git rev-parse --is-inside-work-tree &>/dev/null; then
+    git_branch=" ($(git branch --show-current 2>/dev/null))"
+  fi
+  print -Pn "\e]2;%m: %~${git_branch}\a"
+}
+precmd_functions+=(set_terminal_title)
+
+# Keybindings
+bindkey  "^[[H"   beginning-of-line   # Home
+bindkey  "^[OH"   beginning-of-line   # Home
+bindkey  "^A"   beginning-of-line     # Ctrl + A
+bindkey  "^[[F"   end-of-line         # End
+bindkey  "^[OF"   end-of-line         # End
+bindkey  "^E"   end-of-line           # Ctrl + E
+bindkey  "^[[3~"  delete-char         # Del
+
+# Colour support of ls and friends
+if [ -x /usr/bin/dircolors ]; then
+  test -r $HOME/.dircolors && eval "$(dircolors -b $HOME/.dircolors)" || eval "$(dircolors -b)"
+  alias ls='ls --color=auto'
+  alias dir='dir --color=auto'
+  alias vdir='vdir --color=auto'
+  alias grep='grep --color=auto'
+  alias fgrep='fgrep --color=auto'
+  alias egrep='egrep --color=auto'
+fi
+alias ll='ls -alhF'
+alias la='ls -Ah'
+alias l='ls -CFh'
+
+# A throwaway container, and what takes the space under a directory
+alias drun='docker run -it --rm'
+disksize() {
+  du -h --max-depth=1 "${1:-.}" | sort -h
+}
+sudo-disksize() {
+  sudo du -h --max-depth=1 "${1:-.}" | sort -h
+}
+
+${shell:zsh:normal}${shell:zsh:last}
diff --git a/testdata/beside/mesh-catalog/modules/zsh/module.json.captured b/testdata/beside/mesh-catalog/modules/zsh/module.json.captured
new file mode 100644
index 0000000..da125af
--- /dev/null
+++ b/testdata/beside/mesh-catalog/modules/zsh/module.json.captured
@@ -0,0 +1,160 @@
+{
+  "module": "zsh",
+  "version": "1",
+  "moved": true,
+  "capabilities": [
+    "package-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-login-shell",
+      "scope": "node",
+      "serves": [
+        "execute"
+      ]
+    }
+  ],
+  "tools": [
+    "zsh_config"
+  ],
+    "config": {
+      "execute": {
+        "type": "string",
+        "description": "Whether this machine offers execute, which runs any command as the operator account and so can become root without a person: serve, or withhold on a machine that does not offer it (novox/hq ADR 0268), such as the control-node until a call to it needs a person's approval.",
+        "enum": [
+          "serve",
+          "withhold"
+        ],
+        "trusted": true,
+        "default": "serve"
+      }
+    },
+  "items": [
+    {
+      "collection": "environment",
+      "name": "editor",
+      "attributes": {
+        "kind": "variable",
+        "name": "EDITOR"
+      },
+      "template": "files/env-editor"
+    },
+    {
+      "collection": "environment",
+      "name": "visual",
+      "attributes": {
+        "kind": "variable",
+        "name": "VISUAL"
+      },
+      "template": "files/env-visual"
+    },
+    {
+      "collection": "environment",
+      "name": "xdg-config-home",
+      "attributes": {
+        "kind": "variable",
+        "name": "XDG_CONFIG_HOME"
+      },
+      "template": "files/env-xdg-config-home"
+    },
+    {
+      "collection": "environment",
+      "name": "path-local-bin",
+      "attributes": {
+        "kind": "path",
+        "at": "start",
+        "order": "10"
+      },
+      "template": "files/env-path-local-bin"
+    },
+    {
+      "collection": "environment",
+      "name": "path-scripts",
+      "attributes": {
+        "kind": "path",
+        "at": "start",
+        "order": "20"
+      },
+      "template": "files/env-path-scripts"
+    },
+    {
+      "collection": "environment",
+      "name": "path-scripts-bin",
+      "attributes": {
+        "kind": "path",
+        "at": "start",
+        "order": "30"
+      },
+      "template": "files/env-path-scripts-bin"
+    }
+  ],
+  "resources": [
+    {
+      "id": "package",
+      "type": "package",
+      "package": "zsh"
+    },
+    {
+      "id": "env",
+      "type": "file",
+      "path": "${machine:account-home}/.zshenv",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "into": "block",
+      "at": "start",
+      "template": "files/zshenv"
+    },
+    {
+      "id": "rc",
+      "type": "file",
+      "path": "${machine:account-home}/.zshrc",
+      "owner": "${machine:account}",
+      "mode": "0644",
+      "into": "block",
+      "at": "start",
+      "template": "files/zshrc"
+    },
+    {
+      "id": "login",
+      "type": "user",
+      "name": "${machine:account}",
+      "shell": "/usr/bin/zsh"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "place": ".",
+      "owner": "root",
+      "mode": "0755",
+      "unknown": "program"
+    },
+    {
+      "id": "tools-conf",
+      "type": "file",
+      "path": "${dir:state}/tools.conf",
+      "owner": "root",
+      "mode": "0644",
+      "template": "files/tools.conf"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "typescript",
+        "entrypoints": [
+          "tools/index.js"
+        ],
+        "env": {
+          "ZSH_TOOLS_CONF": "${dir:state}/tools.conf"
+        }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  }
+}
diff --git a/testdata/beside/mesh-catalog/predefined.json b/testdata/beside/mesh-catalog/predefined.json
new file mode 100644
index 0000000..9e53676
--- /dev/null
+++ b/testdata/beside/mesh-catalog/predefined.json
@@ -0,0 +1,13 @@
+{
+  "agent-managed-settings": {
+    "type": "object",
+    "description": "The managed settings every agent session on a node is held to (Claude Code's managed-settings.json), as a JSON object.",
+    "trusted": true
+  },
+  "font-size": {
+    "type": "number",
+    "description": "The size a desktop program shows its text in, in points.",
+    "minimum": 6,
+    "maximum": 72
+  }
+}
diff --git a/testdata/beside/mesh-networking/modules/route-proxy/files/acme.env b/testdata/beside/mesh-networking/modules/route-proxy/files/acme.env
new file mode 100644
index 0000000..428aae2
--- /dev/null
+++ b/testdata/beside/mesh-networking/modules/route-proxy/files/acme.env
@@ -0,0 +1,3 @@
+ACME_DIRECTORY=https://acme-v02.api.letsencrypt.org:443/directory
+ACME_ROOTS=https://acme-v02.api.letsencrypt.org:443
+ACME_ROOTS_PATH=
diff --git a/testdata/beside/mesh-networking/modules/route-proxy/files/internal-acme.env b/testdata/beside/mesh-networking/modules/route-proxy/files/internal-acme.env
new file mode 100644
index 0000000..72b0f7b
--- /dev/null
+++ b/testdata/beside/mesh-networking/modules/route-proxy/files/internal-acme.env
@@ -0,0 +1,3 @@
+INTERNAL_ACME_DIRECTORY=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:path}
+INTERNAL_ACME_ROOTS=https://${bound:internal-acme-ca:at}:${bound:internal-acme-ca:port}${bound:internal-acme-ca:roots}
+INTERNAL_ACME_ROOTS_PATH=${bound:internal-acme-ca:roots}
diff --git a/testdata/beside/mesh-networking/modules/route-proxy/module.json.captured b/testdata/beside/mesh-networking/modules/route-proxy/module.json.captured
new file mode 100644
index 0000000..668ab88
--- /dev/null
+++ b/testdata/beside/mesh-networking/modules/route-proxy/module.json.captured
@@ -0,0 +1,272 @@
+{
+  "module": "route-proxy",
+  "version": "1",
+  "slug": "rproxy",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "provides": [
+    {
+      "name": "route",
+      "scope": "mesh",
+      "credential": {
+        "form": "none"
+      },
+      "identity": false,
+      "answered-by": "helper"
+    }
+  ],
+  "serves": {
+    "route": {}
+  },
+  "requires": [
+    "internal-acme-ca"
+  ],
+  "binds": {
+    "internal-acme-ca": "${dir:state}/internal-acme-ca.json"
+  },
+  "own-secrets": {
+    "broker": "${dir:mesh-state}/broker"
+  },
+  "listens": [
+    {
+      "name": "http",
+      "port": 80,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "public HTTP, and the ACME HTTP-01 challenge answered at the name being certified"
+    },
+    {
+      "name": "https",
+      "port": 443,
+      "protocol": "tcp",
+      "from": "anywhere",
+      "why": "public HTTPS for every name the mesh routes here"
+    }
+  ],
+  "data": {
+    "own": [
+      {
+        "id": "acme",
+        "path": "${dir:acme-cache}",
+        "class": "rebuildable",
+        "why": "issued certificates, issued again"
+      },
+      {
+        "id": "ca",
+        "path": "${dir:ca-dir}",
+        "class": "cache",
+        "why": "the authority's roots, fetched again at every start"
+      }
+    ]
+  },
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "mesh"
+    },
+    {
+      "id": "acme-cache",
+      "type": "directory",
+      "path": "/var/lib/route-proxy/acme",
+      "mode": "0700"
+    },
+    {
+      "id": "ca-dir",
+      "type": "directory",
+      "path": "/var/lib/route-proxy/ca",
+      "mode": "0755"
+    },
+    {
+      "id": "acme-env",
+      "type": "file",
+      "path": "${dir:state}/acme.env",
+      "mode": "0600",
+      "template": "files/acme.env"
+    },
+    {
+      "id": "internal-acme-env",
+      "type": "file",
+      "path": "${dir:state}/internal-acme.env",
+      "mode": "0600",
+      "template": "files/internal-acme.env"
+    },
+    {
+      "id": "trust",
+      "type": "container",
+      "name": "route-proxy-trust",
+      "artifact": "trust",
+      "run-once": true,
+      "network": "host",
+      "env-file": [
+        "${dir:state}/acme.env"
+      ],
+      "volumes": [
+        "${dir:ca-dir}:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "if [ -z \"$ACME_ROOTS_PATH\" ]; then cp /etc/ssl/certs/ca-certificates.crt /ca/root.crt; exit 0; fi; for i in $(seq 1 60); do wget -q -T 10 --no-check-certificate -O /ca/root.crt \"$ACME_ROOTS\" && grep -q 'BEGIN CERTIFICATE' /ca/root.crt && exit 0; sleep 2; done; echo \"the authority at $ACME_ROOTS did not serve its roots within two minutes\" >&2; exit 1"
+      ],
+      "restart-on": [
+        "acme-env"
+      ]
+    },
+    {
+      "id": "internal-trust",
+      "type": "container",
+      "name": "route-proxy-internal-trust",
+      "artifact": "trust",
+      "run-once": true,
+      "network": "host",
+      "env-file": [
+        "${dir:state}/internal-acme.env"
+      ],
+      "volumes": [
+        "${dir:ca-dir}:/ca"
+      ],
+      "args": [
+        "sh",
+        "-c",
+        "if [ -z \"$INTERNAL_ACME_ROOTS_PATH\" ]; then cp /etc/ssl/certs/ca-certificates.crt /ca/internal-root.crt; exit 0; fi; for i in $(seq 1 60); do wget -q -T 10 --no-check-certificate -O /ca/internal-root.crt \"$INTERNAL_ACME_ROOTS\" && grep -q 'BEGIN CERTIFICATE' /ca/internal-root.crt && exit 0; sleep 2; done; echo \"the authority at $INTERNAL_ACME_ROOTS did not serve its roots within two minutes\" >&2; exit 1"
+      ],
+      "restart-on": [
+        "internal-acme-env"
+      ]
+    },
+    {
+      "id": "program-route-proxy",
+      "type": "archive",
+      "path": "${dir:state}/route-proxy",
+      "artifact": "server",
+      "unknown": "program"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "route-proxy",
+      "artifact": "trust",
+      "network": "host",
+      "env-file": [
+        "${dir:state}/acme.env",
+        "${dir:state}/internal-acme.env"
+      ],
+      "volumes": [
+        "${dir:acme-cache}:/acme",
+        "${dir:ca-dir}:/ca:ro",
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:state}/route-proxy:/opt/mesh:ro"
+      ],
+      "env": {
+        "LISTEN": ":80",
+        "TLS_LISTEN": ":443",
+        "ACME_CACHE": "/acme",
+        "ACME_CA_BUNDLE": "/ca/root.crt",
+        "INTERNAL_ACME_CA_BUNDLE": "/ca/internal-root.crt",
+        "MESH_BROKER_FILE": "/run/secrets/broker"
+      },
+      "args": [
+        "/opt/mesh/route-proxy"
+      ],
+      "restart-on": [
+        "trust",
+        "acme-env",
+        "internal-trust",
+        "internal-acme-env",
+        "program-route-proxy"
+      ],
+      "logging": "journald",
+      "health": {
+        "kind": "tcp",
+        "endpoint": "http",
+        "interval": "10s",
+        "timeout": "5s",
+        "looks": 3,
+        "grace": "60s"
+      }
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "server",
+        "kind": "bundle",
+        "language": "go",
+        "system": "alpine",
+        "from": "cmd/route-proxy",
+        "binary": "route-proxy"
+      },
+      {
+        "name": "trust",
+        "kind": "upstream",
+        "from": "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"
+      },
+      {
+        "name": "provider",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/route-provider",
+        "binary": "route-provider",
+        "loads": [
+          "route-provider"
+        ]
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
+      }
+    ]
+  },
+  "jails": [
+    {
+      "name": "route-proxy",
+      "failregex": "^.*TLS handshake error from <HOST>:\\d+: (?:no public route for|acme/autocert: missing server name)\n            ^.*refused: no route for .*, asked from <HOST>:\\d+$",
+      "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d"
+    }
+  ],
+  "state": [
+    "bound",
+    "routes",
+    {
+      "name": "unrouted",
+      "ttl-seconds": 604800
+    }
+  ],
+  "tools": [
+    "route_proxy_routes",
+    "route_proxy_route",
+    "route_proxy_unrouted"
+  ],
+  "emits": [
+    "route.served",
+    "route.withdrawn",
+    "route.refused"
+  ],
+  "replaces": {
+    "route_proxy_routes": [
+      "curl -I"
+    ],
+    "route_proxy_route": [
+      "openssl s_client -connect"
+    ],
+    "route_proxy_unrouted": [
+      "docker logs route-proxy"
+    ]
+  },
+  "reads": [
+    "mesh-delivery-assigner.placement",
+    "mesh-provisioner.plans",
+    "mesh-provisioner.provisions"
+  ]
+}