WIP: recheck a take's filesystem, follow only the module's branch, count users in an access change, hold the identity until its data is taken (hq ADR 0325 review)

internal/catalogue/declaration.go

@@ -257,6 +257,9 @@ type Rendering struct {
 	Identities map[string]ModuleIdentity
 	// KeptFolders is every folder the operator let the mesh keep on this machine (ADR 0325 §8), by its clean path.
 	KeptFolders map[string]bool
+	// ReadyFolders is every folder the engine states it keeps on this machine (its access healthy), by clean path: a
+	// folder it found empty and kept, or took itself. With KeptFolders, what lets a container switch to its identity.
+	ReadyFolders map[string]bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -583,6 +586,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			*identities = append(*identities, ident)
 		}
 		mountedByIdentity := dirsMountedByIdentity(m)
+		// Its containers run as it only once every read-write folder they mount is taken (the operator's question on
+		// ADR 0325): until then the identity is allocated, sent and named in the take's users, and not switched to.
+		runsAsIdent := hasIdent && !identityHeld(m, with)
 
 		// What the mesh computes for this module goes FIRST, before the module's own resources.
 		//
@@ -1036,7 +1042,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			ownerInto(copied, placed)
 			// And its identity (novox/hq ADR 0325 §2, §3): a container's resolved, or taken out where none is composed;
 			// the owner of a directory its identity's containers mount. After the placement's owner: the identity wins.
-			if err := identityInto(copied, m, ident, hasIdent, mountedByIdentity); err != nil {
+			if err := identityInto(copied, m, ident, runsAsIdent, mountedByIdentity); err != nil {
 				return nil, err
 			}
 			// **After settings, and that is the whole reason it is here.** A module's file