Carry over the ADR 0325 controller work as the base for ADR 0328

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     a76baa4b47f07a8b2bab065603414530bd02b53a  examples/foundation-first-node-nats.lock
+mesh-host     303d4037e84ea4968da9880a11f4d5a374b3714a  examples/foundation-first-node-nats.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:

testdata/beside/mesh-host/internal/apply/placement_guard.go.captured

@@ -523,6 +523,20 @@ func refusedPlaces(resources []declaration.Resource) map[string]error {
 		switch res := r.(type) {
 		case *declaration.Directory:
 			err = refusePath(res.Path, placingDirectory, moduleOfID(res.ID), res.Owner)
+			// And outside every home, the walk's judgement before anything is applied (novox/hq issue 358): a
+			// link another account could make in its path refuses it, and with it what is below it, whatever
+			// order they are declared in. The apply walks again at the moment of use. A directory handed over
+			// keeps its own, stricter walk (issue 356), which refuses any link at all.
+			if err == nil && meshDirsByDescriptor && homeAbove(res.Path) == "" &&
+				!HandedOver()[handOverKey(res.ID, res.Path)] {
+				if judged := judgeMeshDir(res.Path); judged != nil {
+					err = judged
+					var link *LinkInPathError
+					if errors.As(judged, &link) {
+						err = &PlacementRefusedError{Path: res.Path, Why: "it " + link.why()}
+					}
+				}
+			}
 		case *declaration.Access:
 			err = refusePath(res.Path, placingAccess, moduleOfID(res.ID), "")
 		default:

testdata/store-tests

@@ -35,3 +35,9 @@
 ./cmd/mesh-controller TestARollbackWhoseSendWasRefusedIsCompletedByTheNextSend
 ./cmd/mesh-controller TestAGateJudgesTheOtherMovesBesideAKeptCore
 ./cmd/mesh-controller TestReplay401
+# novox/hq ADR 0325 §3, §8, §11 and issue 575: identities allocated once and never root, a folder taken under a
+# warrant, a placement judged against the build that brings its access.
+./internal/inventory TestAModuleIsGivenOneIdentityOnceAndNeverRoot
+./internal/inventory TestAFolderIsTakenOnceUnderAWarrant
+./internal/inventory TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess
+./internal/inventory TestOnlyABuildOfTheFollowedBranchJudgesAPlacementAhead