Keep carrying a module whose bundle the tool runtime loads, as route-proxy's helper writes its state on the runner's account (issue 1329)

internal/broker/users.go

@@ -69,6 +69,10 @@ type Declared struct {
 	// Checks are the module's own tools its health asks, each `<module>.<tool>` (novox/hq ADR 0240, to-be
 	// 48 §3): the machine's node-engine asks them of its own node tools, and is granted that and no more.
 	Checks []string
+	// Loads says the module has a compiled bundle whose entrypoints the machine's tool runtime loads and runs
+	// (novox/hq ADR 0175; issue 1329): a helper that reaches the bus on the runner's account, so the runner
+	// must carry the module although it declares no tools.
+	Loads bool
 	// RunsAs is the account the module runs as in a runtime of its own (novox/hq ADR 0259 §8): it is never
 	// carried by the machine's runtime, and reaches the bus on its own account.
 	RunsAs string
@@ -394,11 +398,11 @@ func boundBucketsOf(r Records) []string {
 
 // runnerServes says the machine's tool runner has something of this module to serve (novox/hq ADR 0436 §1,
 // ADR 0437 §4, issue 1329): tools or loads it answers, a seat it holds, event families a session waits on,
-// or a check its health asks. A module with none of these is a process of its own on its own credential, and
+// a bundle the runtime loads (Loads), or a check its health asks. A module with none of these is a process of its own on its own credential, and
 // carrying it would hand every session on the machine the runner's account with that module's state, seat
 // traffic and streams. A module with no account of its own (NoAccount) is spoken for by the runner, so it
 // stays carried, and so does the runtime module itself. Whether the module has its own broker secret is not
 // the test: a module with tools and its own credential is still carried (ADR 0175).
 func runnerServes(d Declared) bool {
-	return d.Module == RuntimeModule || d.NoAccount || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
+	return d.Module == RuntimeModule || d.NoAccount || d.Loads || len(d.Serves) > 0 || len(d.Holds) > 0 || len(d.Waits) > 0 || len(d.Checks) > 0
 }