The beds name images the way a machine would find them

Twenty-eight integration tests each carried their own copy of the same two helpers,
which pointed a manifest and the substrate bundle at whatever the lab's registry had
assigned. They now share two in the harness, and the difference is the point: ours is
rewritten to the ID the machine holds it under, and everything else is left exactly as
written so the machine pulls it.

**The substrate bundle is where the fiction was most load-bearing.** mesh-host's
`examples/substrate-first-node.lock` pins all three of its images at
`192.0.2.250:5000/…`, which is the address the lab's registry served from — it was
written for a target, and the target was the lab. Two of those are ordinary third-party
images and become the digests mesh-catalog's own postgres and lavinmq modules pin, so
the substrate's store and broker are literally the images the mesh runs. mesh-control
exists in no registry at all and becomes the ID the machine was handed. **The bundle
itself should be fixed in mesh-host and this substitution deleted with it.**

Beds that wrote a manifest by hand named an image by repository and let the rewrite
supply a digest. There is nothing to supply one now, so `onTheMachine` refuses an
unpinned reference and hands back the digest the catalogue pins — a bed runs the image
the mesh ships, and a bed that drifts from the catalogue is testing a different
postgres.

Three beds took a third-party image out of the raised list, which no longer contains
one: certificates (pebble), objectstore (minio and its client) and provisioner
(postgres) now name theirs and pull it. builds and mesh publish into the MESH's own
artifact store — the `registry` module's image, on the node, on 5000 — rather than into
scenery the lab raised. That is a different claim, and only one of them exists in
production.

New unit tests cover what a full raise would otherwise be the only way to check: the
routes an egress machine gets (that its gateway is still the path to the rest of the
scenario, that a range with no path is unreachable rather than leaked to the uplink,
that each family gets its own next hop), which machine is handed which of our images,
and the `images:` rule that refuses a third-party entry. The "shipped scenarios are
valid" test now loads every scenario rather than two of them.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

test/integration/whole-mesh-novox.test.ts

@@ -42,7 +42,8 @@ import { loadScenario } from "../../src/declaration/parse.ts";
 import { raise } from "../../src/lifecycle/raise.ts";
 import { destroy, exec } from "../../src/lifecycle/operate.ts";
 import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
-import { labIsUsable, destroyAll } from "./harness.ts";
+import { labIsUsable, destroyAll, substrateBundle, onTheMachine } from "./harness.ts";
+import type { HeldImage } from "../../src/pinning.ts";
 
 const capability = await labIsUsable();
 const binary = hostBinaryPath();
@@ -160,8 +161,8 @@ const REMAP: Record<string, Record<string, string>> = {
 };
 
 let instanceId = "";
-/** What the scenario's registry serves, by digest. */
-let stocked: string[] = [];
+/** The mesh's own images, as the machines hold them. */
+let held: HeldImage[] = [];
 
 function quote(s: string): string {
   return `'${s.replaceAll("'", `'\\''`)}'`;
@@ -187,30 +188,15 @@ async function mesh(command: string, timeoutMs?: number): Promise<string> {
   return must("anchor", `docker exec mesh-control /mesh-control ${command}`, timeoutMs);
 }
 
-/** The repository path a reference serves under — registry.ts's repositoryFor, mirrored. */
-function repositoryFor(reference: string): string {
-  const withoutDigest = reference.split("@")[0] ?? reference;
-  const lastColon = withoutDigest.lastIndexOf(":");
-  const lastSlash = withoutDigest.lastIndexOf("/");
-  return lastColon > lastSlash ? withoutDigest.slice(0, lastColon) : withoutDigest;
-}
-
 /** The pinned reference this scenario's registry serves for a repository. */
-function pinned(repository: string): string {
-  const found = stocked.find((r) => r.slice(r.indexOf("/") + 1, r.indexOf("@")) === repository);
-  assert.ok(found, `the scenario stocks no ${repository}; it serves\n  ${stocked.join("\n  ")}`);
-  return found;
+/** What a manifest's image reference becomes on the machine — ours by ID, everything else as written. */
+function pinned(reference: string): string {
+  return onTheMachine(reference, held);
 }
 
-/** The substrate bundle, its image references pointed at this scenario's own registry. */
-function bundleFor(images: string[]): string {
-  let text = readFileSync(bundle, "utf8");
-  for (const ref of images) {
-    const repository = ref.slice(ref.indexOf("/") + 1, ref.indexOf("@"));
-    const escaped = repository.replaceAll("/", "\\/").replaceAll(".", "\\.");
-    text = text.replaceAll(new RegExp(`[A-Za-z0-9_.:-]+\\/${escaped}@sha256:[0-9a-f]+`, "g"), ref);
-  }
-  return text;
+/** The substrate bundle: ours by the ID the machine holds, everything else upstream. */
+function bundleFor(images: HeldImage[]): string {
+  return substrateBundle(bundle, images);
 }
 
 /**
@@ -226,7 +212,7 @@ function loadManifest(name: string): { manifest: string; broker: boolean } {
   const remap = REMAP[name] ?? {};
   for (const r of m.resources ?? []) {
     if (r.type !== "container") continue;
-    if (typeof r.image === "string") r.image = pinned(repositoryFor(r.image));
+    if (typeof r.image === "string") r.image = pinned(r.image);
     if (Array.isArray(r.ports)) r.ports = r.ports.map((p) => remap[p] ?? p);
   }
   const manifest = JSON.stringify(m);
@@ -282,7 +268,7 @@ before(async () => {
     onProgress: (m) => console.log(`raise: ${m}`),
   });
   instanceId = raised.instanceId;
-  stocked = raised.images;
+  held = raised.images;
 
   // anchor raises the substrate from its bundle, digests rewritten to the scenario registry's.
   await must("anchor", `cat > /tmp/substrate.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);