Name who a read-write access grants its path's group to, so modules write shared data through the group the operator gave it (hq ADR 0312, issue 537)

Each read-write access is composed with a grant: the module's containers that
mount its path and the account its tools run as (the operator's, or the module's
own under ADR 0259 §8); that runtime restarts on the access, so it holds a group
the engine put its account in. A read access grants nothing. Sent only to an
engine whose statement says GrantContract (4), since an older one refuses the
field. Pins the node-engine at the branch that reads it.

internal/catalogue/declaration.go

@@ -246,6 +246,11 @@ type Rendering struct {
 	// statement's contract is link.RootContract or later). To an older, strict engine the field is not
 	// sent, and the account it names is not judged — which the self-check says, as not judged.
 	JudgesRoot bool
+
+	// GrantsGroups says this machine's node-engine reads an access's `grant` (novox/hq ADR 0312: its statement's
+	// contract is link.GrantContract or later). To an older, strict engine the field is not sent, nor the
+	// runtime's restarts on it, and a read-write access is reached as before: by whoever owns the path.
+	GrantsGroups bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -543,6 +548,9 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 	}
 
 	var out []map[string]any
+	// The read-write accesses each module grants its tools' account, by module (novox/hq ADR 0312): the runtime
+	// that runs as that account is restarted on them.
+	grantedToTools := map[string][]string{}
 	for _, m := range r.Modules {
 		if with.Adopted && m.Filtering != nil {
 			// Nothing of a module that loads a filter, on an adopted node: its table would drop
@@ -1115,6 +1123,13 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			out = append(out, copied)
 		}
 
+		// **A read-write access grants its path's group to what runs this module's code** (novox/hq ADR 0312):
+		// the containers composed above that mount it, and the account its tools run as. Only to an engine that
+		// reads the field.
+		if with.GrantsGroups {
+			grantedToTools[m.Module] = grantAccesses(out, owner, m.Module, r.toolsAccount(m, with))
+		}
+
 		// **What only the mesh knows, where this module asked for it.** The graph is the control
 		// plane's; making a name resolve is the module's software. Emitted as ordinary files under
 		// this module's name, so they are applied, reported and removed exactly as anything else
@@ -1141,6 +1156,12 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		}
 		owner[fmt.Sprint(process["id"])] = RuntimeModule
 		out = append(out, process)
+		// Restarted when an access moved its account's groups, so its process holds them (novox/hq ADR 0312 §6).
+		for _, m := range r.Modules {
+			if m.RunsAs == "" {
+				restartOnGrants(process, grantedToTools[m.Module])
+			}
+		}
 		// And a runtime of its own for each module of its own account, after it (novox/hq ADR 0259 §8).
 		owns, err := r.ownRuntimes(with)
 		if err != nil {
@@ -1149,6 +1170,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 		for _, p := range owns {
 			id := fmt.Sprint(p["id"])
 			owner[id] = strings.TrimSuffix(id, "."+OwnRuntimeID())
+			restartOnGrants(p, grantedToTools[owner[id]])
 			out = append(out, p)
 		}
 		// What each module's bundles are given is read as the account the runtime runs as — not what a