Design 51: a routed image names its seat and holder, so the retry matches settled by it

The declaration carried only the store's address, so the node-engine could
not tell whose settled ends a failed pull without naming a module.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md

@@ -9,7 +9,7 @@ code:
   - mesh-delivery modules/mesh-delivery-builder (versions, tag asks), the forge bridge, the indexer, the checker, the assigner
   - mesh-sdk (the bus helper for sending in parts)
   - mesh-catalog modules/docker (image pruning)
-  - mesh-host internal/apply (every new image of a module pulled before any of its containers is replaced; a failed pull applied again on the status view's `settled` for the store's holder, and at the node-engine's start)
+  - mesh-host internal/apply (every new image of a module pulled before any of its containers is replaced; a failed pull applied again on the status view's `settled` for the store's holder, and at the node-engine's start), internal/compose (each routed image reference written with its seat and that seat's holder)
   - mesh-delivery modules/mesh-grants (what a node-engine hears: the status view's `settled`)
 updated: 2026-11-04
 decisions:
@@ -207,7 +207,10 @@ the verb.
   said in its journal. **No `settled` is missed in a race**: when the node-engine records a pull failed against a
   store, it checks whether the holder's latest event is already `settled`, and if so applies again at once, so a
   pull that failed just before the holder settled does not wait for the next one. It finds the holder by the seat the failed image came through, read from its
-  declaration, never by a module's name. **The seam that changes is the grants part's list of what a node-engine
+  declaration, never by a module's name: **the composition writes, beside each image reference it routes, the seat the
+  reference came through and that seat's holder**, taken from the holdings the composition already has, so the retry
+  matches `settled` by the holder its declaration names. A change of the seat's holder composes the declaration
+  again, so the name it carries is the holder of now. **The seam that changes is the grants part's list of what a node-engine
   hears** (`NodeAgentHears`; the node-engine declares no `consumes` of its own): it gains one entry, the status
   view's `settled` family, which the node-engine filters for the holder of the seat its failed image names. **At its
   own start** the node-engine also applies once more every have that failed naming an image of a store, so a restart
@@ -490,6 +493,9 @@ test).
   `settled` of another module applies nothing; at the
   node-engine's start it is applied once more with no event; a module being applied when `settled` arrives is not
   applied twice; a retry whose pull fails again says failed again and starts no further apply.
+- **Node-engine's composition, unit** (cases of its composition test): a declaration's routed image reference names
+  the seat it came through and that seat's holder; a change of the seat's holder composes the declaration again with
+  the new holder named.
 - **The grants part, unit** (a case of its composition test): a node-engine's subscriptions hold the status view's
   `settled` family beside the backup holder's word, and nothing more.
 - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the