Take the suffix of internal names from the Input and never the environment: Input.InternalSuffix and a local internal-name helper, so the package doc is true (review round 1, finding 5). The test failed first; the suite is 1257 tests in 1.04 s

go/compose/credentials_test.go

@@ -447,3 +447,25 @@ func TestAGivenFamilyMemberWithoutItsValueIsAStandInAndNamedForeseen(t *testing.
 		t.Errorf("foreseen %v", got.Foreseen)
 	}
 }
+
+// Round 1, finding 5: the suffix internal names end in is a field of the Input, and the environment is never read.
+func TestTheInternalSuffixIsTheInputsAndNeverTheEnvironments(t *testing.T) {
+	t.Setenv(overlay.SuffixVar, "from-the-environment")
+	in := aGrantMesh(t)
+	got := rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.Suffix != "internal" || got.Rendering.Grants[0].At != "laptop.internal" {
+		t.Errorf("by default: suffix %q, grant at %q", got.Rendering.Suffix, got.Rendering.Grants[0].At)
+	}
+	in.InternalSuffix = ".lan"
+	got = rendered(t, in, "anchor", Foreseeing)
+	if got.Rendering.Suffix != "lan" || got.Rendering.Grants[0].At != "laptop.lan" {
+		t.Errorf("given: suffix %q, grant at %q", got.Rendering.Suffix, got.Rendering.Grants[0].At)
+	}
+	where, err := newComposer(in).whereEveryoneIs()
+	if err != nil || where["anchor"] != "anchor.lan" {
+		t.Errorf("where everyone is: %v %v", where, err)
+	}
+	if names := newComposer(in).namesInTheMesh(); names["anchor.lan"] == "" || names["anchor.internal"] != "" {
+		t.Errorf("names: %v", names)
+	}
+}