rig updates

rig/ctrl/lib/config.sh

@@ -61,7 +61,10 @@ load_config() {
 
     set -a
     source ./versions.env
-    [ -f ./.env ] && source ./.env
+    # RIG_PORTABLE skips the machine-local layer. config_snapshot sets it, so a
+    # generated standalone kit never carries this machine's .env — which holds
+    # local values and, by its own description, secrets.
+    if [ -z "${RIG_PORTABLE:-}" ] && [ -f ./.env ]; then source ./.env; fi
     set +a
 
     # Re-apply overrides now so PROFILE is the caller's before we pick the file.
@@ -76,7 +79,7 @@ load_config() {
 
     set -a
     source "./env.d/${profile}.env"
-    [ -f ./.env ] && source ./.env
+    if [ -z "${RIG_PORTABLE:-}" ] && [ -f ./.env ]; then source ./.env; fi
     set +a
 
     _config_restore "$saved"
@@ -138,6 +141,17 @@ load_config() {
     # changed afterwards — both would mislead if the numbers drifted.
     NODES=$(grep -c '^  - role:' "$KIND_CONFIG_PATH")
     if grep -q 'audit-policy-file' "$KIND_CONFIG_PATH"; then AUDIT=on; else AUDIT=off; fi
+
+    # What one node costs, measured rather than guessed. On 2026-09-11 a minimal
+    # control-plane node ran at 620 MiB idle and ~728 MiB with a small mock, plus
+    # 16 MiB for the local registry — ~745 MiB of working set. 800 rounds that up,
+    # and agrees with the 800 MB observed independently on a larger rig. Worker
+    # nodes carry no etcd or apiserver and are lighter, so for a multi-node shape
+    # this errs high. It is the cluster alone: whatever you deploy comes on top.
+    #
+    # Here rather than in check.sh because the memory tool and every standalone
+    # kit need the same figure.
+    NODE_MB=800
 }
 
 # Render a cluster shape to stdout. sed rather than envsubst: envsubst is
@@ -167,3 +181,78 @@ _config_restore() {
     # line would otherwise make this return 1 and trip `set -e` in the caller.
     return 0
 }
+
+# ── what a standalone kit needs to know ────────────────────────────────────
+# Two questions the kit generator (ctrl/standalone.sh) asks, so that it never has
+# to know how configuration is stored. Where profiles live, which files are
+# layered and what is derived are this file's business and can change freely;
+# the generator only calls these.
+
+# Every profile rig can be run as, one per line.
+config_profiles() {
+    local f
+    for f in ./env.d/*.env; do
+        [ -e "$f" ] || continue
+        f=${f##*/}; echo "${f%.env}"
+    done
+}
+
+# The resolved configuration for one profile, as `declare -p` lines — exactly
+# what load_config leaves behind, minus the machine-local layer. A kit freezes
+# this in place of load_config, so it carries rig's decisions for that profile
+# and nothing about the machine it was generated on.
+#
+# Found by difference, not by a list: whatever load_config sets today, it sets.
+# A list here would be one more place to forget a variable.
+config_snapshot() {
+    local _rig_snap_profile="$1"
+    (
+        # Nothing from the caller's shell may leak into a kit.
+        for _rig_snap_n in $CONFIG_OVERRIDABLE; do unset "$_rig_snap_n"; done
+        declare -A _rig_snap_was=()
+        for _rig_snap_n in $(compgen -v); do
+            _rig_snap_was[$_rig_snap_n]="${!_rig_snap_n-}"
+        done
+        PROFILE="$_rig_snap_profile" RIG_PORTABLE=1 load_config >/dev/null
+        for _rig_snap_n in $(compgen -v); do
+            case "$_rig_snap_n" in
+                _rig_snap_*|RIG_PORTABLE|BASH*|FUNCNAME|PIPESTATUS|LINENO|RANDOM|SRANDOM|\
+                SECONDS|EPOCH*|HISTCMD|COLUMNS|LINES|PWD|OLDPWD|_|SHLVL|OPTIND|OPTERR) continue ;;
+            esac
+            if [ -z "${_rig_snap_was[$_rig_snap_n]+x}" ] \
+               || [ "${_rig_snap_was[$_rig_snap_n]}" != "${!_rig_snap_n-}" ]; then
+                declare -p "$_rig_snap_n"
+            fi
+        done
+    )
+}
+
+# A replacement for load_config with one profile's resolution frozen in, printed
+# as a function definition for a standalone kit to carry. The generator embeds
+# whatever this prints and interprets none of it, so what "frozen" means stays
+# rig's decision.
+#
+# It keeps load_config's one stated rule: the caller's env wins for anything in
+# CONFIG_OVERRIDABLE. A kit therefore behaves like rig — `OUT_BIN=... rigdeps.sh`
+# still works — rather than like a copy with everything pinned.
+#
+# What freezing does give up, knowingly: values DERIVED from an overridable one
+# are fixed at generation. Override CLUSTER and the ports stay the ones derived
+# for the original name. Re-deriving would mean carrying the layering itself,
+# which is exactly what a kit exists not to need.
+config_freeze() {
+    local snap
+    snap=$(config_snapshot "$1") || return 1
+    cat <<'EOF'
+load_config() {
+    local k saved=""
+    for k in $CONFIG_OVERRIDABLE; do
+        if [ -n "${!k+x}" ]; then saved+="$k=$(printf '%q' "${!k}")"$'\n'; fi
+    done
+EOF
+    printf '%s\n' "$snap" | sed -E 's/^declare --* /    declare -g /; s/^declare -([a-zA-Z]+) /    declare -g\1 /'
+    cat <<'EOF'
+    _config_restore "$saved"
+}
+EOF
+}