The beds name images the way a machine would find them

Twenty-eight integration tests each carried their own copy of the same two helpers,
which pointed a manifest and the substrate bundle at whatever the lab's registry had
assigned. They now share two in the harness, and the difference is the point: ours is
rewritten to the ID the machine holds it under, and everything else is left exactly as
written so the machine pulls it.

**The substrate bundle is where the fiction was most load-bearing.** mesh-host's
`examples/substrate-first-node.lock` pins all three of its images at
`192.0.2.250:5000/…`, which is the address the lab's registry served from — it was
written for a target, and the target was the lab. Two of those are ordinary third-party
images and become the digests mesh-catalog's own postgres and lavinmq modules pin, so
the substrate's store and broker are literally the images the mesh runs. mesh-control
exists in no registry at all and becomes the ID the machine was handed. **The bundle
itself should be fixed in mesh-host and this substitution deleted with it.**

Beds that wrote a manifest by hand named an image by repository and let the rewrite
supply a digest. There is nothing to supply one now, so `onTheMachine` refuses an
unpinned reference and hands back the digest the catalogue pins — a bed runs the image
the mesh ships, and a bed that drifts from the catalogue is testing a different
postgres.

Three beds took a third-party image out of the raised list, which no longer contains
one: certificates (pebble), objectstore (minio and its client) and provisioner
(postgres) now name theirs and pull it. builds and mesh publish into the MESH's own
artifact store — the `registry` module's image, on the node, on 5000 — rather than into
scenery the lab raised. That is a different claim, and only one of them exists in
production.

New unit tests cover what a full raise would otherwise be the only way to check: the
routes an egress machine gets (that its gateway is still the path to the rest of the
scenario, that a range with no path is unreachable rather than leaked to the uplink,
that each family gets its own next hop), which machine is handed which of our images,
and the `images:` rule that refuses a third-party entry. The "shipped scenarios are
valid" test now loads every scenario rather than two of them.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

test/integration/events.test.ts

@@ -33,7 +33,8 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll } from "./harness.ts";
+import { labIsUsable, destroyAll, substrateBundle } from "./harness.ts";
+import type { HeldImage } from "../../src/pinning.ts";
 import { incus } from "../../src/incus/client.ts";
 import { machineName } from "../../src/lifecycle/names.ts";
 
@@ -97,17 +98,8 @@ async function must(command: string, timeoutMs?: number): Promise<string> {
  * is not this one; matching by repository and rewriting to the digest this registry assigned is
  * what makes it applicable (the same rewrite mesh.test.ts does).
  */
-function bundleFor(images: string[]): string {
-  let text = readFileSync(bundle, "utf8");
-  for (const pinned of images) {
-    const repository = pinned.slice(pinned.indexOf("/") + 1, pinned.indexOf("@"));
-    const escaped = repository.replaceAll("/", "\\/").replaceAll(".", "\\.");
-    text = text.replaceAll(
-      new RegExp(`[A-Za-z0-9_.:-]+\\/${escaped}@sha256:[0-9a-f]+`, "g"),
-      pinned,
-    );
-  }
-  return text;
+function bundleFor(images: HeldImage[]): string {
+  return substrateBundle(bundle, images);
 }
 
 /** Read the trail back as parsed JSON lines. */
@@ -129,7 +121,8 @@ before(async () => {
   instanceId = raised.instanceId;
 
   // The node raises its substrate — store, broker and the rest — from the bundle, applied from a
-  // file because the digests are this registry's and are not known until it is up.
+  // file because the control plane's image is named by the ID this machine holds it under,
+  // which is not knowable until it has been handed over.
   await must(`cat > /tmp/substrate.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
   await must(`${HOST_PATH} apply /tmp/substrate.lock`, 600_000);