Hold a joining module at the build it ran, own its directories by its own group, and take a library only when its act is done (hq ADR 0328 review, ADR 0334)

A held module is composed exactly as before it joined, at the build its machine runs, so its port, resources and
contributions stay. A joining module's directories belong to its user and its own group, and its tools' directories
are refused closed to that group; the runner joins it where the engine can say so. A take records the root and is
taken only when the engine states the act done. Libraries' paths and verdicts count modules pulled in by a
requirement, and a unit takes the identity.

cmd/mesh-controller/held_library.go

@@ -0,0 +1,95 @@
+package main
+
+import (
+	"context"
+	"sort"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// A module that joins keeps the user it ran as until every library it uses is taken (novox/hq ADR 0328 §8).
+//
+// **Held at the build it ran before, composed exactly as then.** A module whose registered build uses a library not yet
+// taken, on a machine that was last sent another build of it, is composed at that build — the manifest the build
+// records hold, in place of the registered one, as a recorded module is kept (recorded_kept.go): its resources, its
+// ports in the filter, its contributions and bindings are what they were, and nothing of the new contract is sent for
+// it. The send records that the machine still carries that build. Once the library is taken, the next composition
+// takes the new build. A module the machine never ran has nothing to keep, and is composed as registered; a build the
+// records no longer hold cannot be kept, and the module is composed as registered (it then waits as joining modules do).
+//
+// shelf, when given, has each held module's manifest replaced. It answers what it holds: module → the commit kept.
+func holdJoining(ctx context.Context, inv *inventory.Inventory, node string,
+	shelf map[string]catalogue.Manifest) (map[string]string, error) {
+	registered := shelf
+	if registered == nil {
+		var err error
+		if registered, err = inv.Catalogue(ctx); err != nil {
+			return nil, err
+		}
+	}
+	sent, known, err := inv.SentBuilds(ctx, node)
+	if err != nil || !known {
+		return nil, err
+	}
+	var joining []string
+	for m := range sent {
+		if man, has := registered[m]; has && len(man.Libraries) > 0 {
+			joining = append(joining, m)
+		}
+	}
+	if len(joining) == 0 {
+		return nil, nil
+	}
+	sort.Strings(joining)
+	libs, err := inv.Libraries(ctx)
+	if err != nil {
+		return nil, err
+	}
+	taken, err := librariesTaken(ctx, inv, libs)
+	if err != nil {
+		return nil, err
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]string{}
+	for _, m := range joining {
+		was := sent[m]
+		if was == "" || sameCommit(was, current[m].Commit) {
+			continue // the machine already runs the registered build: nothing before it to keep
+		}
+		untaken := ""
+		for _, u := range registered[m].Libraries {
+			if !taken[u.Library] {
+				untaken = u.Library
+				break
+			}
+		}
+		if untaken == "" {
+			continue
+		}
+		before, found, err := inv.ManifestAt(ctx, m, was)
+		if err != nil {
+			return nil, err
+		}
+		if !found || usesLibrary(before, untaken) {
+			continue
+		}
+		if shelf != nil {
+			shelf[m] = before
+		}
+		out[m] = was
+	}
+	return out, nil
+}
+
+func usesLibrary(m catalogue.Manifest, library string) bool {
+	for _, u := range m.Libraries {
+		if u.Library == library {
+			return true
+		}
+	}
+	return false
+}

cmd/mesh-controller/held_library_test.go

@@ -0,0 +1,144 @@
+package main
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+const heldImage = "x@sha256:2222222222222222222222222222222222222222222222222222222222222222"
+
+// radarrBefore is radarr as it ran before it joined: its own port, its own data, PUID from a setting.
+func radarrBefore() catalogue.Manifest {
+	return catalogue.Manifest{Module: "radarr", Version: "1", Capabilities: []string{"container-runtime"},
+		Listens: []catalogue.Listening{{Port: 7878, From: catalogue.FromMesh, Name: "web", Why: "its web UI"}},
+		Resources: []map[string]any{
+			{"id": "config", "type": "directory", "mode": "0750"},
+			{"id": "app", "type": "container", "name": "radarr", "image": heldImage, "ports": []any{"7878"},
+				"env": map[string]any{"PUID": "1000"}, "volumes": []any{"${dir:config}:/config"}},
+		}}
+}
+
+// radarrJoined is the same module's next build, joining the media library.
+func radarrJoined() catalogue.Manifest {
+	m := radarrBefore()
+	m.Libraries = []catalogue.LibraryUse{{ID: "movies", Library: "media", Path: "movies", Use: catalogue.AccessReadWrite}}
+	m.Resources = []map[string]any{
+		{"id": "config", "type": "directory", "mode": "0750"},
+		{"id": "app", "type": "container", "name": "radarr", "image": heldImage, "ports": []any{"7878"},
+			"env":     map[string]any{"PUID": "${identity:uid}"},
+			"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}},
+	}
+	return m
+}
+
+// novox/hq ADR 0328 §8 (the review of 7ea6d36e, item 1): a joining module that ran on a machine before is held until
+// its libraries are taken — composed EXACTLY as before it joined, at the build the machine runs: its resources, its
+// port in the filter, its contributions; only the new build waits. The record says the machine still carries that build.
+func TestAHeldModuleIsComposedAsBeforeItJoined(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	controller := catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"}
+	register(t, open, controller)
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	before, joined := radarrBefore(), radarrJoined()
+	raw, _ := json.Marshal(before)
+	b1 := inventory.Build{ID: "b1", Repository: "https://forge.invalid/media.git", Ref: "main", Module: "radarr",
+		Commit: "c1c1c1c1", On: "builder", Manifest: raw}
+	if err := inv.RecordBuild(ctx, b1); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, before, inventory.Source{Repository: b1.Repository, Ref: "main", BuiltFrom: b1.Commit}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// What anchor composes for radarr before it joined.
+	plan, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	was, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wasRules, err := plan.Rules(catalogue.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	record, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": b1.Commit}, 1, 1,
+		inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
+	// Anchor's engine keeps libraries; the next build joins media, which is not taken.
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.LibraryContract,
+		SaidAt: time.Now(), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ = json.Marshal(joined)
+	b2 := b1
+	b2.ID, b2.Commit, b2.Manifest = "b2", "c2c2c2c2", raw
+	if err := inv.RecordBuild(ctx, b2); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, joined, inventory.Source{Repository: b2.Repository, Ref: "main", BuiltFrom: b2.Commit}); err != nil {
+		t.Fatal(err)
+	}
+
+	plan, settings, err = planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := held.leftOutWhy["radarr"]; left {
+		t.Fatalf("radarr was left out while held: %s", why)
+	}
+	if !reflect.DeepEqual(radarrResources(was.Resources), radarrResources(held.Resources)) {
+		t.Fatalf("radarr held is composed otherwise than before it joined:\n %v\n %v", radarrResources(was.Resources),
+			radarrResources(held.Resources))
+	}
+	rules, err := plan.Rules(catalogue.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(rules, wasRules) || !strings.Contains(asJSON(rules), "7878") {
+		t.Fatalf("radarr's port is not in the filter as before: %s", asJSON(rules))
+	}
+}
+
+func radarrResources(rs []map[string]any) []map[string]any {
+	var out []map[string]any
+	for _, r := range rs {
+		if strings.HasPrefix(r["id"].(string), "radarr.") {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+func asJSON(v any) string {
+	raw, _ := json.Marshal(v)
+	return string(raw)
+}

cmd/mesh-controller/kept_libraries.go

@@ -57,8 +57,11 @@ type libraryTake struct {
 // takeVerb is the verb a take's answer binds: the controller's own, performed by itself on the warrant.
 const takeVerb = askerName + ".take"
 
-// key is the library on its home and filesystem: what one ask is kept for. A library that moved is asked again.
-func (t libraryTake) key() string { return t.Library + "\x00" + t.Node + "\x00" + t.Placed }
+// key is the library on its home, at its root, on its filesystem: what one ask is kept for. A library that moved is
+// asked again.
+func (t libraryTake) key() string {
+	return t.Library + "\x00" + t.Node + "\x00" + t.Root + "\x00" + t.Placed
+}
 
 // digest binds everything the take does and was said for.
 func (t libraryTake) digest() string {
@@ -264,12 +267,14 @@ func takeFolderIn(open *stores, ask func(ctx context.Context, act link.AccessAct
 		if answer.Refused != "" {
 			return "", fmt.Errorf("%s refused to take the library %s: %s", t.Node, t.Library, answer.Refused)
 		}
-		if err := open.inventory.RecordTaken(ctx, inventory.TakenLibrary{Library: t.Library, Home: t.Node,
-			Placed: t.Placed, By: by, Ask: askID, Warrant: askID, Said: answer.Said}); err != nil {
+		// Started, not taken: the library is taken when the engine states the act done (stateHealth, TakeDone).
+		if err := open.inventory.RecordTakeStarted(ctx, inventory.TakenLibrary{Library: t.Library, Home: t.Node,
+			Root: t.Root, Placed: t.Placed, By: by, Ask: askID, Warrant: askID, Said: answer.Said}); err != nil {
 			return "", fmt.Errorf("%s started the take of %s (%s), and it could NOT be recorded: %w", t.Node, t.Library,
 				answer.Said, err)
 		}
-		return fmt.Sprintf("%s takes the library %s: %s", t.Node, t.Library, answer.Said), nil
+		return fmt.Sprintf("%s started taking the library %s: %s; it is taken when the engine says the act is done",
+			t.Node, t.Library, answer.Said), nil
 	}
 }
 
@@ -341,10 +346,24 @@ func foldersIn(open *stores) func(ctx context.Context) ([]libraryTake, error) {
 			return nil, err
 		}
 		waiting, f := foldersWaiting(ctx, open.inventory, healths)
-		return takesOf(waiting, f.libraries), nil
+		return withoutTakesUnderWay(takesOf(waiting, f.libraries), f.taken), nil
 	}
 }
 
+// withoutTakesUnderWay is the takes not already under way: a take started on the same home, root and filesystem, which
+// the engine has not yet stated done or failed, is not asked about again (the review of 7ea6d36e, item 5).
+func withoutTakesUnderWay(takes []libraryTake, recorded map[string]inventory.TakenLibrary) []libraryTake {
+	var out []libraryTake
+	for _, t := range takes {
+		r, was := recorded[t.Library]
+		if was && !r.Done && r.Home == t.Node && r.Root == t.Root && (t.Placed == "" || r.Placed == "" || r.Placed == t.Placed) {
+			continue
+		}
+		out = append(out, t)
+	}
+	return out
+}
+
 // takesOf is one take per library and filesystem from the waits gathered, sorted. A library no longer defined is
 // asked about nowhere.
 func takesOf(waiting map[string][]waitingFolder, libraries map[string]catalogue.Library) []libraryTake {

cmd/mesh-controller/kept_libraries_test.go

@@ -49,7 +49,7 @@ func diskWait(access string) inventory.Wait {
 func libraryFactsWith(taken ...string) operatorWaitFacts {
 	t := map[string]inventory.TakenLibrary{}
 	for _, l := range taken {
-		t[l] = inventory.TakenLibrary{Library: l, Home: "ace", Placed: "fs-000000000001"}
+		t[l] = inventory.TakenLibrary{Library: l, Home: "ace", Root: "/storage/media", Placed: "fs-000000000001", Done: true}
 	}
 	return operatorWaitFacts{
 		manifests:     map[string]catalogue.Manifest{"radarr": radarrManifest, "plex": plexManifest},
@@ -82,6 +82,12 @@ func TestALibraryWaitIsExcusedOnlyForALibraryNotYetTaken(t *testing.T) {
 			libraryFactsWith("media"), "taken already"},
 		{"taken on another filesystem: it moved", "ace", placedWait("library:media", "fs-0000000000ff"),
 			libraryFactsWith("media"), ""},
+		{"taken at another root: its root changed", "ace", keepWait("movies"), func() operatorWaitFacts {
+			f := libraryFactsWith("media")
+			f.taken["media"] = inventory.TakenLibrary{Library: "media", Home: "ace", Root: "/storage/old-media", Done: true,
+				Placed: "fs-000000000001"}
+			return f
+		}(), ""},
 		{"a machine it does not reach", "far", keepWait("movies"), libraryFactsWith(), "does not reach far"},
 		{"undefined", "ace", keepWait("library:books"), libraryFactsWith(), "not defined"},
 		{"not a library", "ace", keepWait("downloads"), libraryFactsWith(), "only a library waits"},
@@ -432,10 +438,21 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 		if err := inv.RegisterModule(ctx, m, inventory.Source{}); err != nil {
 			t.Fatal(err)
 		}
+		if m.Module == "plex" {
+			continue // pulled in by a requirement, not assigned: it is in what the machine was sent (item 4)
+		}
 		if _, err := inv.Assign(ctx, "ace", m.Module); err != nil {
 			t.Fatal(err)
 		}
 	}
+	record, err := inv.NodeByName(ctx, "ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": "c1", "plex": "c2", "plain": "c3"},
+		1, 1, inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
 	lib := inventory.ResourceHealth{Resource: "library:media", Kind: link.KindLibrary, Target: "/storage/media",
 		State: link.StateWaiting, Waits: []inventory.Wait{{Part: "media", Access: "library:media", Reason: link.WaitKeep,
 			Placed: "fs-000000000001", What: "let the mesh keep the library media"}}}
@@ -447,6 +464,13 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 	if strings.Join(modules, ",") != "plex,radarr" {
 		t.Fatalf("the library's verdict is said for %v; want plex and radarr, the modules using it", modules)
 	}
+	paths, err := inv.LibraryPaths(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(paths["media"], ",") != "movies" {
+		t.Fatalf("the paths kept of media are %v", paths["media"])
+	}
 	now := time.Now()
 	f := gateFacts{now: now, waits: libraryFactsWith(), groupsAdded: map[string]bool{"radarr": false},
 		accessesChanged: map[string]bool{"radarr": false},
@@ -468,3 +492,54 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 		f.accessesChanged = map[string]bool{"radarr": false}
 	}
 }
+
+// The review of 7ea6d36e, item 5: the engine saying it started a take does not make the library taken. While the act
+// runs the library still waits and the operator is not asked again; it is taken when the engine states the act done
+// under that warrant.
+func TestALibraryIsTakenOnlyWhenTheEngineSaysTheActIsDone(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"})
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	take := takeFolderIn(open, func(context.Context, link.AccessActAsk) (link.HandOverAnswer, error) {
+		return link.HandOverAnswer{Said: "the take of library:media started"}, nil
+	})
+	lt := libraryTake{Library: "media", Node: "anchor", Root: "/storage/media", Placed: "fs-000000000001"}
+	if _, err := take(ctx, lt, "c01", "the operator"); err != nil {
+		t.Fatal(err)
+	}
+	libs, err := inv.Libraries(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	taken, err := librariesTaken(ctx, inv, libs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if taken["media"] {
+		t.Fatal("a take only started made the library taken")
+	}
+	// While it runs: the wait is still excused, and no new ask is made for it.
+	var f operatorWaitFacts
+	readWaitFacts(ctx, inv, "anchor", nil, nil, &f)
+	if err := checkWait("radarr", "anchor", placedWait("library:media", "fs-000000000001"), f); err != nil {
+		t.Fatalf("the wait while the take runs: %v", err)
+	}
+	if got := withoutTakesUnderWay([]libraryTake{lt}, f.taken); len(got) != 0 {
+		t.Fatalf("a library whose take runs is asked about again: %+v", got)
+	}
+	// The engine states the act done under that warrant.
+	act, _ := json.Marshal(map[string]any{"act": "take", "access": "library:media", "warrant": "c01", "state": "done"})
+	if err := stateHealth(ctx, inv, nil, "anchor", link.Health{Contract: link.LibraryContract, At: time.Now(),
+		Resources: []link.ResourceHealth{{Resource: "library:media", Kind: link.KindLibrary, Target: "/storage/media",
+			State: link.StateHealthy, Since: time.Now(), Act: act}}}, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if taken, err = librariesTaken(ctx, inv, libs); err != nil || !taken["media"] {
+		t.Fatalf("the act done did not make the library taken (%v)", err)
+	}
+}

cmd/mesh-controller/module_health.go

@@ -2,7 +2,9 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"sync/atomic"
@@ -41,7 +43,7 @@ const (
 )
 
 // libraryVerdictsFor is, for each library verdict in a statement (kind library, no module), one copy for each module
-// assigned to the machine whose manifest uses that library: what the module is judged and said by. None when the
+// on the machine — assigned, or pulled in by a requirement — whose manifest uses that library: what the module is judged and said by. None when the
 // assignments or the catalogue cannot be read: the library's own verdict stands alone, and no module is excused by it.
 func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node string,
 	rs []inventory.ResourceHealth) []inventory.ResourceHealth {
@@ -59,6 +61,18 @@ func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node stri
 		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
 		return nil
 	}
+	// And the modules a requirement pulled in: what the machine was last sent (the review of 7ea6d36e, item 4).
+	sent, _, err := inv.SentBuilds(ctx, node)
+	if err != nil {
+		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
+		return nil
+	}
+	for m := range sent {
+		if !slices.Contains(assigned, m) {
+			assigned = append(assigned, m)
+		}
+	}
+	sort.Strings(assigned)
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
 		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
@@ -81,6 +95,39 @@ func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node stri
 	return out
 }
 
+// takesStated keeps what a statement says of each library's take act: done under a warrant, the library is taken;
+// failed, the take is forgotten and the operator asked again. Running or stopped (it goes on) changes nothing.
+func takesStated(ctx context.Context, inv *inventory.Inventory, rs []link.ResourceHealth) error {
+	if inv == nil {
+		return nil
+	}
+	for _, r := range rs {
+		lib, isLibrary := strings.CutPrefix(r.Resource, libraryAccess)
+		if !isLibrary || r.Kind != link.KindLibrary || len(r.Act) == 0 {
+			continue
+		}
+		var act struct {
+			Act     string `json:"act"`
+			Warrant string `json:"warrant"`
+			State   string `json:"state"`
+		}
+		if err := json.Unmarshal(r.Act, &act); err != nil || act.Act != link.ActTake || act.Warrant == "" {
+			continue
+		}
+		var err error
+		switch act.State {
+		case "done":
+			err = inv.TakeDone(ctx, lib, act.Warrant)
+		case "failed":
+			err = inv.TakeFailed(ctx, lib, act.Warrant)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // healthRefused counts the statements refused as older than the one kept, for the log and a test.
 var healthRefused atomic.Int64
 
@@ -126,6 +173,11 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 		}
 		resources = append(resources, kept)
 	}
+	// **A library's take is done, or failed, when its engine says so** (novox/hq ADR 0328 §7): only then is it taken,
+	// or asked about again.
+	if err := takesStated(ctx, inv, h.Resources); err != nil {
+		return err
+	}
 	// **A library's verdict is said for the modules that use it** (novox/hq ADR 0328 §8): the engine states each
 	// library once, as `library:<name>`, of no module; a module that uses it waits with it, and is said so.
 	resources = append(resources, libraryVerdictsFor(ctx, inv, node, resources)...)

cmd/mesh-controller/operator_wait.go

@@ -138,7 +138,8 @@ func checkLibraryWait(machine, lib string, w inventory.Wait, f operatorWaitFacts
 	if machine != l.Home {
 		placed = ""
 	}
-	if t, was := f.taken[lib]; was && t.Home == l.Home && (placed == "" || t.Placed == "" || t.Placed == placed) {
+	if t, was := f.taken[lib]; was && t.Done && t.Home == l.Home && t.Root == l.Root &&
+		(placed == "" || t.Placed == "" || t.Placed == placed) {
 		return fmt.Errorf("says it waits for the library %s, which is taken already: a module that uses a taken "+
 			"library is never asked about it", lib)
 	}

cmd/mesh-controller/plan.go

@@ -134,6 +134,10 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 	if _, err := keepRecorded(ctx, open, nodeName, shelf); err != nil {
 		return catalogue.Resolution{}, nil, err
 	}
+	// And a module that joins a library not yet taken, at the build it ran before (novox/hq ADR 0328 §8).
+	if _, err := holdJoining(ctx, inv, nodeName, shelf); err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
 
 	resolved, err := catalogue.Resolve(shelf, assigned,
 		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
@@ -473,11 +477,22 @@ func declarationWith(ctx context.Context, open *stores, node string,
 			names = append(names, m.Module)
 		}
 		out.Builds = carriedBuilds(names, composed.LeftOut, current, before)
-		// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245).
+		// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245), and so
+		// is a joining module held at the build it ran before (ADR 0328 §8).
 		kept, err := recordedKept(ctx, open, node)
 		if err != nil {
 			return sendable{}, err
 		}
+		held, err := holdJoining(ctx, open.inventory, node, nil)
+		if err != nil {
+			return sendable{}, err
+		}
+		if kept == nil && len(held) > 0 {
+			kept = map[string]string{}
+		}
+		for m, was := range held {
+			kept[m] = was
+		}
 		for m, was := range kept {
 			if _, carried := out.Builds[m]; carried {
 				out.Builds[m] = was
@@ -987,7 +1002,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		ReadsHealth:    readsHealth,
 		JudgesRoot:     judgesRoot,
 		KeepsLibraries: lf.keeps, Identities: lf.identities, Libraries: lf.libraries, LibraryGroups: lf.groups,
-		TakenLibraries: lf.taken, LibraryPaths: lf.paths, Held: lf.held,
+		TakenLibraries: lf.taken, LibraryPaths: lf.paths, RunnerJoinsOwnGroups: lf.ownGroups,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -1039,12 +1054,11 @@ type libraryRendering struct {
 	groups     map[string]int
 	taken      map[string]bool
 	paths      map[string][]string
-	held       map[string]string
+	ownGroups  bool
 }
 
 // libraryFacts reads what a machine's composition needs of ADR 0328: the libraries and their group numbers, the
-// numbers of the modules here that join, which libraries are taken, the sub-paths every module asks of each, and which
-// joining modules here are held at the user they ran as. **A number is allocated only on the send path** (Allocating),
+// numbers of the modules here that join, which libraries are taken, and the sub-paths every module asks of each. **A number is allocated only on the send path** (Allocating),
 // as a port is: a question about what would be sent reads what was allocated. The libraries are read for every engine,
 // so a module that joins is left out, naming why, where its engine cannot be told it does.
 func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, plan catalogue.Resolution,
@@ -1069,6 +1083,11 @@ func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, pl
 	if lf.keeps, err = engineKeepsLibraries(ctx, inv, node); err != nil || !lf.keeps {
 		return lf, err
 	}
+	if stated, had, err := inv.HealthOf(ctx, node); err != nil {
+		return lf, err
+	} else {
+		lf.ownGroups = had && stated.Contract >= link.OwnGroupContract
+	}
 	lf.identities = map[string]catalogue.ModuleIdentity{}
 	for _, m := range plan.Modules {
 		if !catalogue.Joins(m) {
@@ -1107,26 +1126,6 @@ func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, pl
 	if lf.taken, err = librariesTaken(ctx, inv, libs); err != nil {
 		return lf, err
 	}
-	// **A joining module that ran here before keeps the user it ran as until every library it uses is taken** (§8):
-	// held, it is left out of the declaration, its containers untouched. One new here has nothing to keep.
-	sent, known, err := inv.SentBuilds(ctx, node)
-	if err != nil {
-		return lf, err
-	}
-	for _, m := range plan.Modules {
-		if _, ran := sent[m.Module]; !known || !ran || !catalogue.Joins(m) {
-			continue
-		}
-		for _, u := range m.Libraries {
-			if !lf.taken[u.Library] {
-				if lf.held == nil {
-					lf.held = map[string]string{}
-				}
-				lf.held[m.Module] = u.Library
-				break
-			}
-		}
-	}
 	return lf, nil
 }
 
@@ -1140,7 +1139,7 @@ func librariesTaken(ctx context.Context, inv *inventory.Inventory, libs map[stri
 	out := map[string]bool{}
 	for name, l := range libs {
 		t, was := recorded[name]
-		taken := was && t.Home == l.Home
+		taken := was && t.Done && t.Home == l.Home && t.Root == l.Root
 		stated, had, err := inv.HealthOf(ctx, l.Home)
 		if err != nil {
 			return nil, err