fix(store, scaleway): what a pack stores is what a snapshot gives back, and the VPC body answers the name Scaleway publishes today (#567, #570)

[stephrobert]

Closes #567. Closes #570.

#548 stays open, with its third path measured, working, and deliberately not
shipped — the last section says why, and it is the part of this branch worth
reading first.

#567 — the issue's premise was wrong, and the measurement says so

The model pack now stores the JSON shape through named doors, and
TestTheFourthPacksNodeKeepsWhatItWearsAcrossASnapshot asserts behaviour:
snapshot, restore into a fresh store, reboot on a revived pack, and read what the
runtime was actually asked for.

The issue says the three real packs are immune. They were not.
storetest.GoShapes, run over Scaleway's own barrage, reported 82 resources
holding a []string in Attrs["tags"].

Nothing broke, which is exactly why it lasted: hasEveryTag and tagsOf each
carry a hand-written type switch tolerating both shapes — #542's seven copies
of one tolerance, one storey down. Exoscale had the sharper form: two helpers for
one job, labelsToAttr right and labelsOrEmpty wrong. All three packs are
fixed — orEmpty answers []any, labelsOrEmpty is deleted rather than
repaired, Outscale gains idsList.

The rule now lives in two places, because prose alone is what let this last:

• beside Resource.Attrs — the six shapes a restore returns, the three
  measured losses, and why numbers are the one exception;
• as storetest.GoShapes, registered in the shared barrage and wired into all
  three packs' barrage_test.go, among the controls
  TestEveryPackRunsTheSharedBarrage discovers from a pack's own test sources —
  so a fourth pack fails a control it never had to write.

The maintainer's decision is respected exactly: the shared layer gained a
control, not a repair. Nothing in internal/core learned to rebuild a
[]Rule, which it must not (rule 5).

#570 — the new name alone, and three gates that were all honestly silent

What the body answers: the new name, and only it.
.upstream/scaleway-openapi/vpc-v2.yml — the product's published schema, fetched
2026-08-28 — carries object_storage_private_access_enabled and
has_object_storage_private_access in each schema's x-properties-order, the
document's own exhaustive property list, and not the old names. The SDK
agrees (vpc_sdk.go:1024, :646). No deprecation alias is declared anywhere,
so answering both would have invented one. A test asserts the old spelling is
gone, and its falsification is a body that answers both.

The issue names the VPC half only; the private network was renamed in the same
move and is fixed too.

What the 2026-08-20 recording now means: historical for the spelling and
for nothing else. It still settles that the field is present on every answer
and false on an empty account. That split is written at the assertion, in
corpus/accepted.json (20 entries keyed (file, operation, kind, path), so each
names exactly the field it excuses), and in one DeclinedFields() entry —
one, because the offline shapes store holds a default VPC and no private network,
so ListVPCs is the only recorded operation that gate reaches, and a decline
that excuses nothing fails.

What else moved: nothing. mise run contract:update produced an empty
diff. The issue says the contract was never re-extracted; it was, for #372, and
already carried both new names. Only the pack lagged.

The blind spot, named rather than implied

A rename passes between three gates, and each is honest in its own population:

• drift:check compares operations, not field names — green for any rename;
• the omission gate lists fields declared and recorded — the new name is
  declared but unrecorded, so it has nothing to miss;
• the contract check refuses undeclared fields on closed schemas only, and
  Scaleway closes none: 0 of 632.

Three silent gates, three populations, a rename between all of them. Recorded
here because nothing in this branch closes it.

#548 — a third path, measured, working, and not shipped

The defect still reproduces from the API alone under --vm incus-ovn: a server
created with public_ip, private NIC attached after, ends with
eth0 nictype=routed ipv4.address=203.0.113.2 and no security.acls, beside
eth1 on the managed network carrying its group.

The premise was re-measured first: Incus 7.2 refuses security.acls on a routed
NIC — Invalid device option "security.acls". So #337 holds and the remedy has
to move the address.

Both refusals already in docs/limits.md come from one place — the host route the
routed NIC owns. The third path takes the address off the device without taking
the device off the instance, which is neither of them, and Incus 7.2 accepts it
on a running instance: ipv4.address= empty, then the /32 into
feint-uplink's ipv4.routes — accepted, where it answered file exists
before — then ipv4.routes.external on the managed NIC.

Coverage, with a listener on both ports so that a refusal cannot be an empty
port, and a third port with no listener as the negative control:

203.0.113.2:443   connect_ex=0    OPEN      a rule opens it
203.0.113.2:80    connect_ex=111  refused   a listener is there, no rule is
203.0.113.2:8080  connect_ex=111  refused   no listener: the negative control

Before the migration, port 80 on that address was OPEN. Outbound survives
(ipv4.nat=true, ping 1.1.1.1 answers from inside, the station as control).

It is not shipped, and both reasons are measurements written into the section:

• What a machine "answers on" would move. Incus.Inspect takes the first
  global IPv4 of the lowest-named interface. After the migration both addresses
  share eth1 ({"eth0":[],"eth1":["10.199.0.2","203.0.113.2"]}, stable over
  three reads), so Binding.Address / Started.Address would report the private
  address where they reported the public one. Scaleway is unaffected — its API
  answered public_ip from its own store throughout — but Binding.Address is
  the shared layer, and the Exoscale pack reads it.
• Only OVN was measured. Bridge mode routes through ipv4.routes on the
  device instead, and nothing ran under --vm incus.

So the bound stands, functional.sh goes on skipping the public half, and
docs/limits.md now carries a sequence with numbers instead of "a sequence
exists on paper". Shipping it would have moved the problem from the firewall to
the address the API publishes, which is not a fix.

Gates

mise run conformance whole suite, one emulator, FEINT_FIELD_GATE=1 — green,
267 s, 352/375, no omission failure · FEINT_VM=incus-ovn conformance:leg -- runtime — green, 639 s, doorstep clean both ends · conformance:environment
green · prepush, docs:check, limits:check, falsify:lint (890 mutations,
144 specs) green.

Falsification replays on the five specs whose subject this diff touches —
attrs-json-shape (new, 9), private-network-ipv6 (8), corpus-findings (10),
stored-numbers (10), provider-four (13) — every mutation bites.

Two mutations did not bite at first, and in both cases the comment was wrong,
not the harness. One was planted in a loop the barrage never enters, retargeted
into orEmpty's body. The other is #295's aliasing mutation, whose property had
moved: addressesOf now decodes map[string]any into a fresh map, so the
conversion is the copy. Replanted at JoinSegment, where aliasing is still
reachable, with the reason in its label.

Where testplan was wrong

Its note "a change to the stored shape is proved across a restart by
mise run conformance:environment" is false: environment/up.sh contains
zero occurrences of snapshot or --state — it brings an emulator up and down
and never saves or loads state. What proves #567 across that door is the unit
round trip, not that leg.

It also earned the OVN runtime leg because provider-four/intents.go imports
internal/core/machine, though this diff changes no driver code. Correct by its
rule, expensive in practice; it was run because #548 asked for it.

What was not obtained

• A server created with a public IP keeps an unfiltered routed NIC beside its private one: the group covers one and not the other, and docs/limits.md claims the opposite #548 is not fixed in code, as above.
• Bridge mode was never exercised for A server created with a public IP keeps an unfiltered routed NIC beside its private one: the group covers one and not the other, and docs/limits.md claims the opposite #548.
• The vpc/v2 corpus was not re-recorded — it needs a paid account. The 20
  accepted divergences stand until somebody records it, and the staleness rule
  deletes them that day.
• GoShapes judges what a barrage drives. The Exoscale and Outscale sites
  were found by reading sources, not by the control; that blind spot is stated in
  its own doc.
• Not all ~20 specs testplan listed were replayed — the five whose subject
  this diff touches were; falsify:lint covers the cheap half for all 144.