warn when a hive host without a leaf names the otel oidc secret file

nix/module-eval/hive-otel.nix

@@ -49,6 +49,10 @@ let
     deploy.authelia.enable = true;
   };
 
+  # Neither a leaf nor a secret file: the one shape the collector has no
+  # credential for.
+  hiveOtelBare = hiveWithController { };
+
   hiveOtelFetch = machine: machine.systemd.services.swarm-bao-hive-otel-oidc;
 
   hiveOtelPipelines = hiveOtel.services.opentelemetry-collector.settings.service.pipelines;
@@ -262,6 +266,27 @@ let
         && !(builtins.elem "f ${run} 0400 root root -" (rules hiveOtel))
         && warned hiveOtel;
     }
+    {
+      # Without a store identity, a hand-named secret file is warned to place
+      # the leaf; with the leaf nothing is warned and the fetch unit exists;
+      # with neither, the assertion still refuses the build. `hiveOtelBare`
+      # and `hiveOtelLeaf` are the controls: a lookup that never matches
+      # would pass the negated arms.
+      name = "a hive host with no leaf and an operator secret file is warned to place the leaf";
+      ok =
+        let
+          warned = m: lib.any (lib.hasInfix "holds no store identity") m.warnings;
+          refused = m: lib.any (a: !a.assertion && lib.hasInfix "identity to present" a.message) m.assertions;
+        in
+        warned hiveOtel
+        && lib.any (lib.hasInfix "/var/lib/swarm-bao-pki/hives/h1/") hiveOtel.warnings
+        && !(warned hiveOtelLeaf)
+        && hiveOtelLeaf.systemd.services ? swarm-bao-hive-otel-oidc
+        && !(warned hiveOtelBare)
+        && refused hiveOtelBare
+        && !(refused hiveOtel)
+        && !(refused hiveOtelLeaf);
+    }
     {
       # `LoadCredential` copies the file at the collector's start, so a value
       # landed later reaches it only through a restart. Retries every 30s