Module feed 

The estate values the installer’s door feeds (monetize key, clock key and peer), taken instead of the medium’s — see the module. The estate values the installer’s door FEEDS, taken instead of the medium’s — so one medium serves any estate.

The join reply the pairing loop receives carries a feed table (nordisk_pairing::join::JoinReply::feed); the loop persists the whole reply to <data>/pairing/joined.toml ([crate::pairing::JOINED_REL]). Three of its keys configure this box:

key	what it replaces on the medium	applied
monetize_pubkey	GUNNAR_MONETIZE_PUBKEY / --monetize-pubkey	at start, or LIVE when it arrives
clock_key	ESTATE_CLOCK_KEY / GUNNAR_CLOCK_KEY (korp.env. / clock_key= param)	on every clock sync
clock_peer	ESTATE_CLOCK / GUNNAR_CLOCK (korp.env. / clock= param)	on every clock sync

(admin_pubkey is the fourth feed key; the pairing loop installs it itself.)

Precedence: there is none — a disagreement is REFUSED by name

Medium alone → the medium’s. Door alone → the door’s. Both and EQUAL → that value. Both and DIFFERENT → FEED_MISMATCH, never a silent pick: the medium and the installer disagree about which estate this box is in, and choosing either one is choosing whose money or whose time to trust without saying so (the reasoning of ops’ monetize-pubkey-mismatch preflight, which refuses a bring-up over the same disagreement).

• The monetize key at start: a refusal to start (resolve_monetize).
• The monetize key arriving while running (first boot): the key in force stays, the Admin.Health alarm FEED_MISMATCH is raised.
• The clock: every sync reads the effective configuration (clock_config), and a disagreement is the sync’s misconfigured report naming FEED_MISMATCH — the clock is left alone.

The monetize key applies LIVE (owner 2026-09-25: avoid restarts)

A metered box on a fed medium starts KEYLESS: its entitlement slot and its growth go-ahead policy are built with no key (every namespace Free, Entitlement.Set refused, a monetize go-ahead refused) and registered as takers (on_monetize_key). When the installer feeds the key (or vm1 offers it), monetize_arrived hands it to each taker, which swaps it in place — the slot re-verifies every stored fact under it — and the key is persisted in joined.toml for the next start as before. Until 2026-09-25 this was a restart of the machine. The clock (clock_key, clock_peer) and the fed principals were already live: the clock reads the feed on every sync, and the primary installs principals on every feed.

The bus is the shared one (L10, 2026-10-20)

Every feed this process takes is published on nordisk-pairing’s process-wide feed bus (feedbus::publish, Skidbladnir 0.5.15, A7 row 8): a part that applies a fed value LIVE subscribes with feedbus::on_published and reads the typed Fed::from_feed; Fed::current is the typed view of the value in force. Gunnar’s own bus (this module’s publish, on_published, current) is gone; this module is the typed view over the shared one.

Structs

Fed

What the door fed, as far as this box’s configuration goes.

Withheld

A fed value that is a credential: kept, compared, never shown.

Enums

MonetizeArrival

Constants

FEED_BILLING_URL

The SITE’s pay page (UW-6, feed key refusal_link: the open build names no money): a {tenant} template, https://<site>/billing/{tenant} — a page the site’s own console serves. The medium is one for every estate, so the page it bakes (--billing-url) is a placeholder this replaces, LIVE ([crate::entitlement::EntitlementSlot::set_billing_url]).

FEED_CLOCK_KEY

FEED_CLOCK_PEER

FEED_EGRESS

The front’s egress door (Skidbladnir nordisk-pairing egress::FEED_EGRESS, the lean estate, A19): fed by the shop to a box laid with no public IPv4. The box’s clients that reach the internet (the identity provider’s, the webhooks’, the mirrors’, the mail relay’s) leave through it (take_egress, nordisk_pairing::egress::proxy).

FEED_FLEET

The ONE monetize’s Fleet door (5.4, ONE monetize, M-D35): what --fleet names on the medium. shop-pairing feeds it to the front, the front offers it to every box; the box’s pull channel reports there ([crate::repair::resolve_fleet]).

FEED_FLEET_AT

Where the pull channel connects (host:port), fed beside FEED_FLEET when the door’s name is not what this box should dial (a test bench whose guests resolve no names). TLS still verifies the certificate under FEED_FLEET’s host. Absent: the URL’s own host, resolved. A BENCH address only (ST-19, [crate::repair::seam_refusal]).

FEED_FLEET_CA

The PEM the pull channel’s door is checked against, fed beside FEED_FLEET when its certificate is not under the public roots. Absent: the public roots. Only beside a bench FEED_FLEET_AT (ST-19).

FEED_FLEET_INSTANCE

The estate this box reports for (--fleet-instance), fed beside FEED_FLEET.

FEED_MISMATCH

The alarm/refusal word for a medium value and a DIFFERENT fed value.

FEED_MONETIZE

The feed keys this module reads (the contract’s names; never renamed).

FEED_NOT_APPLIED

The alarm for a fed monetize key this running process could not apply (no entitlement slot to apply it to, or a taker refused it). It used to be pairing.feed_restart and a reboot; the key is applied live now.

FEED_REPAIR_AUTO

Auto-fix, fed (main rebuild, 2026-10-12): exactly true turns the box’s auto-fix on, as --repair-auto does. The estate’s opt-in, carried by its installer; nothing else changes what the guard allows (gunnar_repair::rebuild).

FEED_REPAIR_KEY

The repair key, fed (main rebuild, 2026-10-12): an OpenSSH private key this box signs its repair calls with when no --repair-key is given — a re-laid main holds no twin key, and without one every pulled order and the auto recharge were refused. The installer feeds its public half as a principal, so the twin reads its log to it and a fresh main takes its Bootstrap.Restore.

FEED_SELLS_ROOM

This estate SELLS room (2026-10-08): true on a selling shop’s boxes (gunnar.rs, test2), absent everywhere else — a SOLD estate and the open build keep “no fact is uncapped”. Applied LIVE (Fed::sells_room, gunnar-grpc selling).

FEED_SMTP_FROM

FEED_SMTP_URL

The relay a sold estate’s main mails through, as the shop feeds it (monetize-server estate_order::FEED_SMTP_*, P1).

FEED_SSO_PRIVATE_IDP_CIDRS

The operator’s internal networks a company IdP may live on (owner 2026-10-06, a private gunnar): a list of CIDRs, estate config the installer feeds; never an account admin’s. Empty or absent: today’s guard (gunnar_grpc::sso::PrivateNets). Applied LIVE on every feed.

Functions

alarms

The feed alarms, for Admin.Health.

clock_config

The clock configuration in force now: the process environment (the medium’s korp.env.ESTATE_CLOCK*, or Gunnar’s korp.env.GUNNAR_CLOCK* read as its alias, estate_clock::config::var) merged with the current feed. Read on EVERY sync, so a feed that arrives while running applies to the next one.

clock_fed

Whether the door fed a clock source.

kept_feed

A build without the pairing loop has no door to be fed by.

load_at_start

Read joined.toml under root and publish its feed on the shared bus (feedbus::publish). Called once at start; an unreadable file is logged and treated as no feed (the loop re-joins and rewrites it).

monetize_arrived

The fed monetize key arriving while running (the pairing loop’s answer, or vm1’s offer carried by the installer): APPLIED IN PLACE by every registered taker (on_monetize_key), with no restart (owner 2026-09-25). None = nothing to do (no key fed, the same key already in force, or a process that recorded none — a community build or a test).

monetize_in_force

offered_by

vm’s offer of key (offer.<vm>.<key>), trimmed; blank is absent.

on_monetize_key

Register a taker of the monetize key (owner 2026-09-25: avoid restarts) — called by serve for the entitlement slot and the go-ahead policy it built keyless, so a key the installer feeds later is applied in place by monetize_arrived.

raise

Raise (or re-raise, counting) a feed alarm; said on the log too.

record_monetize_in_force

resolve_clock

The clock’s two values, medium against door — edda estate-clock’s (offer::resolve_clock, moved there from here AS IS; the refusal names FEED_MISMATCH, the same word). Ok((clock, key)) is what estate_clock::config::Config::parse is handed. The clock’s two values, medium against door. Ok((clock, key)) is what crate::config::Config::parse is handed. Both set and DIFFERENT is a refusal naming FEED_MISMATCH, never a silent pick.

resolve_monetize

The monetize key at start. medium is the resolved key off --monetize-pubkey/GUNNAR_MONETIZE_PUBKEY; fed is the door’s spelling (64 hex). A fed value that is not a key, or that differs from the medium’s, is refused by name.

seam_refusal

The mock’s seam, honoured only as the mock feeds it (ST-19): a fed fleet_at is a bench forward — an address literal ip:port on a private, loopback, link-local or shared (100.64/10) network — and a fed fleet_ca comes only beside one. Anything else (a public address, a name, a CA with no bench address) is refused by name: a release box never dials elsewhere, nor re-roots its trust, on a feed’s word.

sso_private_nets

The operator’s internal networks a company IdP may live on, as fed names them: none when nothing is fed. A list gunnar refuses (a public or loopback range) is an error, said by the caller and applied as none.

take_egress

This box leaves through the door it was fed (FEED_EGRESS): kept process-wide (nordisk_pairing::egress::set_proxy, the first wins: the door is the front’s overlay address, the same for the life of the estate) for every client that reaches the internet. Called with each feed published (serve); a feed with no door changes nothing.

Type Aliases

MonetizeTaker

Something that takes the monetize key LIVE: the entitlement slot (both front doors’ plan gate and Entitlement.Set read it) and the growth go-ahead policy. Registered by serve once each is built.