The beds name images the way a machine would find them

Twenty-eight integration tests each carried their own copy of the same two helpers,
which pointed a manifest and the substrate bundle at whatever the lab's registry had
assigned. They now share two in the harness, and the difference is the point: ours is
rewritten to the ID the machine holds it under, and everything else is left exactly as
written so the machine pulls it.

**The substrate bundle is where the fiction was most load-bearing.** mesh-host's
`examples/substrate-first-node.lock` pins all three of its images at
`192.0.2.250:5000/…`, which is the address the lab's registry served from — it was
written for a target, and the target was the lab. Two of those are ordinary third-party
images and become the digests mesh-catalog's own postgres and lavinmq modules pin, so
the substrate's store and broker are literally the images the mesh runs. mesh-control
exists in no registry at all and becomes the ID the machine was handed. **The bundle
itself should be fixed in mesh-host and this substitution deleted with it.**

Beds that wrote a manifest by hand named an image by repository and let the rewrite
supply a digest. There is nothing to supply one now, so `onTheMachine` refuses an
unpinned reference and hands back the digest the catalogue pins — a bed runs the image
the mesh ships, and a bed that drifts from the catalogue is testing a different
postgres.

Three beds took a third-party image out of the raised list, which no longer contains
one: certificates (pebble), objectstore (minio and its client) and provisioner
(postgres) now name theirs and pull it. builds and mesh publish into the MESH's own
artifact store — the `registry` module's image, on the node, on 5000 — rather than into
scenery the lab raised. That is a different claim, and only one of them exists in
production.

New unit tests cover what a full raise would otherwise be the only way to check: the
routes an egress machine gets (that its gateway is still the path to the rest of the
scenario, that a range with no path is unreachable rather than leaked to the uplink,
that each family gets its own next hop), which machine is handed which of our images,
and the `images:` rule that refuses a third-party entry. The "shipped scenarios are
valid" test now loads every scenario rather than two of them.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

test/integration/assigned-audit.test.ts

@@ -7,7 +7,7 @@
  * container that connects over amqps with that account — never the broker's own. The trail filling
  * is the proof the delivered, scoped credential authenticated and the subscription bound.
  *
- * It needs the host binary, the substrate bundle, and the runtime image stocked by the scenario:
+ * It needs the host binary, the substrate bundle, and the runtime image the scenario loads:
  *
  *   MESH_LAB_HOST_BINARY=.../mesh-host
  *   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
@@ -22,7 +22,8 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll } from "./harness.ts";
+import { labIsUsable, destroyAll, substrateBundle, onTheMachine } from "./harness.ts";
+import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
 const binary = hostBinaryPath();
@@ -40,8 +41,8 @@ const SCENARIO = "audit-node";
 const MACHINE = "anchor";
 
 let instanceId = "";
-/** What the scenario's registry serves, by digest. */
-let stocked: string[] = [];
+/** The mesh's own images, as the machines hold them. */
+let held: HeldImage[] = [];
 
 function quote(s: string): string {
   return `'${s.replaceAll("'", `'\\''`)}'`;
@@ -67,22 +68,15 @@ async function mesh(command: string, timeoutMs?: number): Promise<string> {
   return must(`docker exec mesh-control /mesh-control ${command}`, timeoutMs);
 }
 
-/** The pinned reference for one of the scenario's images, by repository. */
-function pinned(repository: string): string {
-  const found = stocked.find((r) => r.slice(r.indexOf("/") + 1, r.indexOf("@")) === repository);
-  assert.ok(found, `the scenario stocks no ${repository}; it serves ${stocked.join(", ")}`);
-  return found;
+/** The reference a manifest should carry, once this scenario has been raised. */
+/** What a manifest's image reference becomes on the machine — ours by ID, everything else as written. */
+function pinned(reference: string): string {
+  return onTheMachine(reference, held);
 }
 
-/** The substrate bundle, its image references pointed at this scenario's own registry. */
-function bundleFor(images: string[]): string {
-  let text = readFileSync(bundle, "utf8");
-  for (const ref of images) {
-    const repository = ref.slice(ref.indexOf("/") + 1, ref.indexOf("@"));
-    const escaped = repository.replaceAll("/", "\\/").replaceAll(".", "\\.");
-    text = text.replaceAll(new RegExp(`[A-Za-z0-9_.:-]+\\/${escaped}@sha256:[0-9a-f]+`, "g"), ref);
-  }
-  return text;
+/** The substrate bundle: ours by the ID the machine holds, everything else upstream. */
+function bundleFor(images: HeldImage[]): string {
+  return substrateBundle(bundle, images);
 }
 
 function tokenFrom(said: string): string {
@@ -125,7 +119,7 @@ before(async () => {
     onProgress: (m) => console.log(`raise: ${m}`),
   });
   instanceId = raised.instanceId;
-  stocked = raised.images;
+  held = raised.images;
 
   // Raise the substrate — store, broker, control — from the bundle.
   await must(`cat > /tmp/substrate.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
@@ -151,7 +145,7 @@ after(async () => {
 test("the mesh assigns the audit logger, and it consumes over the account the mesh delivered", {
   skip, timeout: 900_000,
 }, async () => {
-  // The assigned-module manifest (mesh-catalog), its runtime image the digest this registry serves.
+  // The assigned-module manifest (mesh-catalog), its runtime image the ID the machine holds.
   const manifest = JSON.stringify({
     module: "audit-logger",
     version: "1",