diff --git a/scenarios/redis-node.yml b/scenarios/redis-node.yml
index b8b4441..36df1c2 100644
--- a/scenarios/redis-node.yml
+++ b/scenarios/redis-node.yml
@@ -24,6 +24,9 @@ images:
   # Redis's tool+provisioner runtime, built by scripts/build-module-runtime.sh redis into the local
   # daemon and loaded onto the machine, which holds it by its own image ID.
   - mesh-runtime-redis:development
+  # The vault's, for the beds that install the catalogue's redis: its own password is a secret the
+  # vault provides (novox/hq ADR 0085).
+  - mesh-runtime-mesh-vault:development
 
 place:
   all: [host, runtime]
diff --git a/test/beds-read-the-catalogue.test.ts b/test/beds-read-the-catalogue.test.ts
index fc1fb70..c6e0bad 100644
--- a/test/beds-read-the-catalogue.test.ts
+++ b/test/beds-read-the-catalogue.test.ts
@@ -34,8 +34,11 @@ import { catalogueIsPresent, catalogueDir } from "./integration/harness.ts";
  *   WEARING  the bed proves a mesh mechanism (a grant, a credential, a restart, a route) with a
  *            module cut down to the shape the mechanism needs — no upstream server, a secret in the
  *            environment, a requirement edge removed — and gives it a catalogue name. It is a mesh
- *            test wearing a catalogue module's name. It should carry a name of its own, or read the
- *            catalogue and meet the module's real requirements.
+ *            test wearing a catalogue module's name. It cannot simply be renamed: a module's name
+ *            is its tool namespace and its broker scope, so a fixture running the module's runtime
+ *            must carry the module's name (novox/hq ADR 0093). It reads the catalogue and installs
+ *            what the module requires — the vault for a secret, the route module for a route — or
+ *            it runs no real runtime and carries a name of its own.
  *   DIFFERS  a module bed whose copy differs from the catalogue in more than the lab may rewrite
  *            (an image, a port, an address). Reading the catalogue is the fix and needs a run.
  */
@@ -55,10 +58,8 @@ const STILL_CARRIED: Record<string, { modules: string[]; why: string }> = {
   "assigned-plex.test.ts": { modules: ["plex"], why: "WEARING: the sidecar alone, no Plex, the token in the environment" },
   "assigned-redis.test.ts": { modules: ["redis"], why: "WEARING: its own secret, a lab seal key in the environment" },
   "assigned-sonarr.test.ts": { modules: ["sonarr"], why: "WEARING: the sidecar alone against a forged config.xml" },
-  "mesh-grant-end-to-end.test.ts": { modules: ["redis"], why: "WEARING: a grant mechanism test" },
   "minio-grant-end-to-end.test.ts": { modules: ["minio"], why: "WEARING: a grant mechanism test, the root password by env-file" },
   "postgres-grant-end-to-end.test.ts": { modules: ["postgres"], why: "WEARING: a grant mechanism test, the superuser by env-file" },
-  "provider-on-backend-network.test.ts": { modules: ["redis"], why: "WEARING: a network mechanism test" },
   "provider-uses-mesh-credential.test.ts": { modules: ["redis"], why: "WEARING: a credential mechanism test" },
   "runtime-restart-on-config.test.ts": { modules: ["grafana"], why: "WEARING: a restart mechanism test" },
   "route-forwarding.test.ts": { modules: ["route-proxy", "hello-web"],
diff --git a/test/integration/mesh-grant-end-to-end.test.ts b/test/integration/mesh-grant-end-to-end.test.ts
index 167aff9..172fdc1 100644
--- a/test/integration/mesh-grant-end-to-end.test.ts
+++ b/test/integration/mesh-grant-end-to-end.test.ts
@@ -23,7 +23,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle, onTheMachine, catalogueModule, catalogueIsPresent } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
@@ -36,7 +36,7 @@ const skip = !capability.usable
     ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
     : !bundle || !existsSync(bundle)
       ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
-      : false;
+      : catalogueIsPresent();
 
 const SCENARIO = "redis-node";
 const MACHINE = "anchor";
@@ -139,51 +139,12 @@ after(async () => {
 test("the mesh grants a consumer redis's cache, and the credential it delivers authenticates", {
   skip, timeout: 900_000,
 }, async () => {
-  // The PROVIDER: redis in its committed shape — server and a broker-bound runtime on the private
-  // redis network, the runtime running the provisioner.
-  const redisManifest = JSON.stringify({
-    module: "redis",
-    version: "1",
-    provides: [{ name: "redis-cache", scope: "mesh" }],
-    serves: { "redis-cache": {} },
-    emits: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    consumes: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    receives: { "redis-cache": "/var/lib/redis-module/grants/mesh.json" },
-    grants: { "redis-cache": "/var/lib/redis-module/grants" },
-    "own-secrets": { default: "/var/lib/redis-module/default.secret", broker: "/var/lib/mesh/redis/broker" },
-    resources: [
-      { id: "mesh-state", type: "directory", path: "/var/lib/mesh/redis", mode: "0700" },
-      { id: "state", type: "directory", path: "/var/lib/redis-module", mode: "0700" },
-      { id: "grants-dir", type: "directory", path: "/var/lib/redis-module/grants", mode: "0700" },
-      { id: "data", type: "directory", path: "/services/redis/data", mode: "0700", owner: "999:999" },
-      {
-        id: "server-conf", type: "file", path: "/var/lib/redis-module/redis.conf", mode: "0644",
-        content: "requirepass ${secret:default}\nappendonly no\ndir /data\n",
-      },
-      { id: "net", type: "network", name: "redis" },
-      {
-        id: "server", type: "container", name: "redis", image: pinned("redis"), network: "redis",
-        ports: ["6379"],
-        volumes: ["/services/redis/data:/data", "/var/lib/redis-module/redis.conf:/etc/redis/redis.conf:ro"],
-        args: ["/etc/redis/redis.conf"],
-      },
-      {
-        id: "runtime", type: "container", name: "mesh-redis", image: pinned("mesh-runtime-redis"),
-        network: "redis",
-        volumes: [
-          "/var/lib/mesh/redis/broker:/run/secrets/broker:ro",
-          "/var/lib/redis-module/grants:/var/lib/redis-module/grants:ro",
-          "/var/lib/redis-module/default.secret:/run/secrets/default:ro",
-        ],
-        env: {
-          MESH_BROKER_FILE: "/run/secrets/broker",
-          MESH_RECEIVES: "/var/lib/redis-module/grants/mesh.json",
-          MESH_PROVISION_REDIS: "redis:6379",
-          MESH_PROVISION_PASSWORD_FILE: "/run/secrets/default",
-        },
-      },
-    ],
-  });
+  // The PROVIDER: the catalogue's redis (novox/hq 04-ISSUES/074) — server and a broker-bound
+  // runtime on the private redis network, the runtime running the provisioner. It requires a
+  // `secret` for its own password, so the vault that provides one is installed beside it, exactly
+  // as the vault bed does.
+  const vaultManifest = catalogueModule("mesh-vault", held);
+  const redisManifest = catalogueModule("redis", held);
 
   // The CONSUMER: a module that requires redis-cache and no more. It runs no code here — the mesh
   // delivers it a bound file (where redis is, and the login to present) and its sealed password,
@@ -201,6 +162,10 @@ test("the mesh grants a consumer redis's cache, and the credential it delivers a
     resources: [{ id: "state", type: "directory", path: "/var/lib/cacheuser", mode: "0700" }],
   });
 
+  await must(`printf %s ${quote(vaultManifest)} > /tmp/mesh-vault.json && docker cp /tmp/mesh-vault.json mesh-controller:/mesh-vault.json`);
+  await mesh("module add /mesh-vault.json");
+  await mesh(`module issue mesh-vault --node ${MACHINE}`);
+  await mesh(`assign ${MACHINE} mesh-vault`);
   await must(`printf %s ${quote(redisManifest)} > /tmp/redis.json && docker cp /tmp/redis.json mesh-controller:/redis.json`);
   await mesh("module add /redis.json");
   await mesh(`module issue redis --node ${MACHINE}`);
diff --git a/test/integration/provider-on-backend-network.test.ts b/test/integration/provider-on-backend-network.test.ts
index 18b1894..2903356 100644
--- a/test/integration/provider-on-backend-network.test.ts
+++ b/test/integration/provider-on-backend-network.test.ts
@@ -20,7 +20,7 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
+import { labIsUsable, destroyAll, foundationBundle, onTheMachine, catalogueModule, catalogueIsPresent } from "./harness.ts";
 import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
@@ -33,7 +33,7 @@ const skip = !capability.usable
     ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
     : !bundle || !existsSync(bundle)
       ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
-      : false;
+      : catalogueIsPresent();
 
 const SCENARIO = "redis-node";
 const MACHINE = "anchor";
@@ -136,54 +136,15 @@ after(async () => {
 test("redis's runtime, on the backend's private network, binds the broker and provisions with the mesh's credential", {
   skip, timeout: 900_000,
 }, async () => {
-  // Exactly the committed redis shape: a private `redis` network, the server on it with a published
-  // port, and the runtime on it too — reaching redis by name and the broker by NAT.
-  const manifest = JSON.stringify({
-    module: "redis",
-    version: "1",
-    provides: [{ name: "redis-cache", scope: "mesh" }],
-    serves: { "redis-cache": {} },
-    emits: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    consumes: ["module.redis.cache.provisioned", "module.redis.cache.deprovisioned"],
-    receives: { "redis-cache": "/var/lib/redis-module/grants/mesh.json" },
-    grants: { "redis-cache": "/var/lib/redis-module/grants" },
-    "own-secrets": { default: "/var/lib/redis-module/default.secret", broker: "/var/lib/mesh/redis/broker" },
-    resources: [
-      { id: "mesh-state", type: "directory", path: "/var/lib/mesh/redis", mode: "0700" },
-      { id: "state", type: "directory", path: "/var/lib/redis-module", mode: "0700" },
-      { id: "grants-dir", type: "directory", path: "/var/lib/redis-module/grants", mode: "0700" },
-      { id: "data", type: "directory", path: "/services/redis/data", mode: "0700", owner: "999:999" },
-      {
-        id: "server-conf", type: "file", path: "/var/lib/redis-module/redis.conf", mode: "0644",
-        content: "requirepass ${secret:default}\nappendonly no\ndir /data\n",
-      },
-      { id: "net", type: "network", name: "redis" },
-      {
-        id: "server", type: "container", name: "redis", image: pinned("redis"), network: "redis",
-        ports: ["6379"],
-        volumes: [
-          "/services/redis/data:/data",
-          "/var/lib/redis-module/redis.conf:/etc/redis/redis.conf:ro",
-        ],
-        args: ["/etc/redis/redis.conf"],
-      },
-      {
-        id: "runtime", type: "container", name: "mesh-redis", image: pinned("mesh-runtime-redis"),
-        network: "redis",
-        volumes: [
-          "/var/lib/mesh/redis/broker:/run/secrets/broker:ro",
-          "/var/lib/redis-module/grants:/var/lib/redis-module/grants:ro",
-          "/var/lib/redis-module/default.secret:/run/secrets/default:ro",
-        ],
-        env: {
-          MESH_BROKER_FILE: "/run/secrets/broker",
-          MESH_RECEIVES: "/var/lib/redis-module/grants/mesh.json",
-          MESH_PROVISION_REDIS: "redis:6379",
-          MESH_PROVISION_PASSWORD_FILE: "/run/secrets/default",
-        },
-      },
-    ],
-  });
+  // The catalogue's redis (novox/hq 04-ISSUES/074): a private `redis` network, the server on it
+  // with a published port, and the runtime on it too — reaching redis by name and the broker by
+  // NAT. Its own password is a `secret` the vault provides, so the vault is installed beside it.
+  const vaultManifest = catalogueModule("mesh-vault", held);
+  await must(`printf %s ${quote(vaultManifest)} > /tmp/mesh-vault.json && docker cp /tmp/mesh-vault.json mesh-controller:/mesh-vault.json`);
+  await mesh("module add /mesh-vault.json");
+  await mesh(`module issue mesh-vault --node ${MACHINE}`);
+  await mesh(`assign ${MACHINE} mesh-vault`);
+  const manifest = catalogueModule("redis", held);
   await must(`printf %s ${quote(manifest)} > /tmp/redis.json && docker cp /tmp/redis.json mesh-controller:/redis.json`);
   await mesh("module add /redis.json");
   await mesh(`module issue redis --node ${MACHINE}`);