Give every module an identity and ask once to keep a shared folder (hq ADR 0325, issue 575)

A module's containers that declare identity run as an identity the controller allocates once, mesh-wide,
from 50000-59999; each access names its users and whether its folder is taken; an access wait is excused
for a folder the mesh may not keep yet, and the operator is asked once per folder and machine, the folder
taken only on the warrant. All of it is sent only to an engine at contract 5. A placement for an access a
newer build brings is judged against that build (issue 575). mesh-host pinned to the ADR 0325 branch head.

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     a76baa4b47f07a8b2bab065603414530bd02b53a  examples/foundation-first-node-nats.lock
+mesh-host     51e97a8c14058fd58e108a045b5d94744f23a6ee  examples/foundation-first-node-nats.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:

testdata/beside/mesh-host/internal/apply/placement_guard.go.captured

@@ -523,6 +523,20 @@ func refusedPlaces(resources []declaration.Resource) map[string]error {
 		switch res := r.(type) {
 		case *declaration.Directory:
 			err = refusePath(res.Path, placingDirectory, moduleOfID(res.ID), res.Owner)
+			// And outside every home, the walk's judgement before anything is applied (novox/hq issue 358): a
+			// link another account could make in its path refuses it, and with it what is below it, whatever
+			// order they are declared in. The apply walks again at the moment of use. A directory handed over
+			// keeps its own, stricter walk (issue 356), which refuses any link at all.
+			if err == nil && meshDirsByDescriptor && homeAbove(res.Path) == "" &&
+				!HandedOver()[handOverKey(res.ID, res.Path)] {
+				if judged := judgeMeshDir(res.Path); judged != nil {
+					err = judged
+					var link *LinkInPathError
+					if errors.As(judged, &link) {
+						err = &PlacementRefusedError{Path: res.Path, Why: "it " + link.why()}
+					}
+				}
+			}
 		case *declaration.Access:
 			err = refusePath(res.Path, placingAccess, moduleOfID(res.ID), "")
 		default:

testdata/store-tests

@@ -29,3 +29,8 @@
 ./cmd/mesh-controller TestADirectoryOwnersKeyIsRefusedThroughAVerb
 ./cmd/mesh-controller TestTheSendMakesNoValueForAnOutsideSecretNobodyGave
 ./cmd/mesh-controller TestAQuestionComposesWithoutAnOutsideSecretNobodyGave
+# novox/hq ADR 0325 §3, §8, §11 and issue 575: identities allocated once and never root, a folder taken under a
+# warrant, a placement judged against the build that brings its access.
+./internal/inventory TestAModuleIsGivenOneIdentityOnceAndNeverRoot
+./internal/inventory TestAFolderIsTakenOnceUnderAWarrant
+./internal/inventory TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess