Hold a joining build for a person without superseding its delivery, join only on an engine that keeps own groups, and keep a held module's settings (hq ADR 0328 §8, ADR 0334; re-review of 96e15f86)

A delivery does not send a joining build held for its library or its engine: the module waits for a person,
the plan stays open saying so and judges its other modules, and sends it once nothing holds it. A held move is
no move for the gate. A module joins only on an engine at contract 7, and a held module is composed with the
settings it last ran with. The runner's verdicts are said for their modules and judged by whether a move
changes them. mesh-host pinned at #97 (7a41e120), its bundle now examples/foundation-first-node.lock.

cmd/mesh-controller/held_library.go

@@ -0,0 +1,164 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// A module that joins keeps the user it ran as until it may join (novox/hq ADR 0328 §8, ADR 0334).
+//
+// **Held at the build it ran before, composed exactly as then.** A module whose registered build joins — declares
+// libraries or uses its identity — on a machine that was last sent another build of it, is held there while
+//
+//   - the machine's engine is older than link.OwnGroupContract: it cannot put the tool runner in the module's own group
+//     nor keep its own directories' group, so the module's tools would lose their read (the re-review of 96e15f86, 2);
+//   - or a library it uses is not yet taken (§8).
+//
+// Held, it is composed at that build — the manifest the build records hold, in place of the registered one, as a
+// recorded module is kept (recorded_kept.go) — and with the settings it last ran with (SettingsAsOf the machine's last
+// send): its resources, its ports in the filter, its contributions and bindings are what they were, and nothing of the
+// new contract is sent for it. The send records that the machine still carries that build. A delivery that brings the
+// joining build does not send it while it is held: the module waits for a person, the plan says so and judges its
+// other modules, and sends it once nothing holds it (release_plan.go, heldIn). A module the machine never ran has
+// nothing to keep, and is composed as registered; a build the records no longer hold cannot be kept.
+
+// heldModule is one module held on a machine: the build it keeps and why, in words with no path.
+type heldModule struct {
+	commit string
+	// library is the first library it uses that is not taken, empty when none.
+	library string
+	why     string
+}
+
+// holdJoining is every module held on a machine, by module; shelf, when given, has each one's manifest replaced by
+// the build it keeps.
+func holdJoining(ctx context.Context, inv *inventory.Inventory, node string,
+	shelf map[string]catalogue.Manifest) (map[string]heldModule, error) {
+	registered := shelf
+	if registered == nil {
+		var err error
+		if registered, err = inv.Catalogue(ctx); err != nil {
+			return nil, err
+		}
+	}
+	sent, known, err := inv.SentBuilds(ctx, node)
+	if err != nil || !known {
+		return nil, err
+	}
+	var joining []string
+	for m := range sent {
+		if man, has := registered[m]; has && catalogue.Joins(man) {
+			joining = append(joining, m)
+		}
+	}
+	if len(joining) == 0 {
+		return nil, nil
+	}
+	sort.Strings(joining)
+	stated, had, err := inv.HealthOf(ctx, node)
+	if err != nil {
+		return nil, err
+	}
+	engineJoins := had && stated.Contract >= link.OwnGroupContract
+	libs, err := inv.Libraries(ctx)
+	if err != nil {
+		return nil, err
+	}
+	taken, err := librariesTaken(ctx, inv, libs)
+	if err != nil {
+		return nil, err
+	}
+	current, err := inv.CurrentBuilds(ctx)
+	if err != nil {
+		return nil, err
+	}
+	out := map[string]heldModule{}
+	for _, m := range joining {
+		was := sent[m]
+		if was == "" || sameCommit(was, current[m].Commit) {
+			continue // the machine already runs the registered build: nothing before it to keep
+		}
+		h := heldModule{commit: was}
+		for _, u := range registered[m].Libraries {
+			if !taken[u.Library] {
+				h.library = u.Library
+				break
+			}
+		}
+		switch {
+		case !engineJoins:
+			h.why = fmt.Sprintf("%s keeps the build it runs on %s until that machine's node-engine keeps a module's own "+
+				"group (novox/hq ADR 0334)", m, node)
+		case h.library != "":
+			h.why = fmt.Sprintf("%s waits for the operator to let the mesh keep the library %s (novox/hq ADR 0328 §8)",
+				m, h.library)
+		default:
+			continue
+		}
+		before, found, err := inv.ManifestAt(ctx, m, was)
+		if err != nil {
+			return nil, err
+		}
+		if !found || (engineJoins && usesLibrary(before, h.library)) {
+			continue
+		}
+		if shelf != nil {
+			shelf[m] = before
+		}
+		out[m] = h
+	}
+	return out, nil
+}
+
+// heldIn is why a module is held on any of the machines given, or "": what a delivery's first send waits on.
+func heldIn(ctx context.Context, inv *inventory.Inventory, module string, machines []string) (string, error) {
+	for _, node := range machines {
+		held, err := holdJoining(ctx, inv, node, nil)
+		if err != nil {
+			return "", err
+		}
+		if h, is := held[module]; is {
+			return h.why, nil
+		}
+	}
+	return "", nil
+}
+
+// heldSettings puts, for each module held on a machine, the settings it last ran with in place of today's: the layers
+// as they stood at the machine's last send. Today's stand where no send is recorded.
+func heldSettings(ctx context.Context, inv *inventory.Inventory, node string, held map[string]heldModule,
+	settings catalogue.SettingsBy) error {
+	if len(held) == 0 {
+		return nil
+	}
+	last, found, err := inv.LastSend(ctx, node)
+	if err != nil || !found {
+		return err
+	}
+	for m := range held {
+		layers, err := inv.SettingsAsOf(ctx, node, m, last.SentAt)
+		if err != nil {
+			return err
+		}
+		if len(layers) == 0 {
+			delete(settings, m)
+			continue
+		}
+		settings[m] = layers
+	}
+	return nil
+}
+
+func usesLibrary(m catalogue.Manifest, library string) bool {
+	for _, u := range m.Libraries {
+		if library != "" && u.Library == library {
+			return true
+		}
+	}
+	return false
+}

cmd/mesh-controller/held_library_test.go

@@ -0,0 +1,144 @@
+package main
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+const heldImage = "x@sha256:2222222222222222222222222222222222222222222222222222222222222222"
+
+// radarrBefore is radarr as it ran before it joined: its own port, its own data, PUID from a setting.
+func radarrBefore() catalogue.Manifest {
+	return catalogue.Manifest{Module: "radarr", Version: "1", Capabilities: []string{"container-runtime"},
+		Listens: []catalogue.Listening{{Port: 7878, From: catalogue.FromMesh, Name: "web", Why: "its web UI"}},
+		Resources: []map[string]any{
+			{"id": "config", "type": "directory", "mode": "0750"},
+			{"id": "app", "type": "container", "name": "radarr", "image": heldImage, "ports": []any{"7878"},
+				"env": map[string]any{"PUID": "1000"}, "volumes": []any{"${dir:config}:/config"}},
+		}}
+}
+
+// radarrJoined is the same module's next build, joining the media library.
+func radarrJoined() catalogue.Manifest {
+	m := radarrBefore()
+	m.Libraries = []catalogue.LibraryUse{{ID: "movies", Library: "media", Path: "movies", Use: catalogue.AccessReadWrite}}
+	m.Resources = []map[string]any{
+		{"id": "config", "type": "directory", "mode": "0750"},
+		{"id": "app", "type": "container", "name": "radarr", "image": heldImage, "ports": []any{"7878"},
+			"env":     map[string]any{"PUID": "${identity:uid}"},
+			"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}},
+	}
+	return m
+}
+
+// novox/hq ADR 0328 §8 (the review of 7ea6d36e, item 1): a joining module that ran on a machine before is held until
+// its libraries are taken — composed EXACTLY as before it joined, at the build the machine runs: its resources, its
+// port in the filter, its contributions; only the new build waits. The record says the machine still carries that build.
+func TestAHeldModuleIsComposedAsBeforeItJoined(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	controller := catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"}
+	register(t, open, controller)
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	before, joined := radarrBefore(), radarrJoined()
+	raw, _ := json.Marshal(before)
+	b1 := inventory.Build{ID: "b1", Repository: "https://forge.invalid/media.git", Ref: "main", Module: "radarr",
+		Commit: "c1c1c1c1", On: "builder", Manifest: raw}
+	if err := inv.RecordBuild(ctx, b1); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, before, inventory.Source{Repository: b1.Repository, Ref: "main", BuiltFrom: b1.Commit}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// What anchor composes for radarr before it joined.
+	plan, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	was, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wasRules, err := plan.Rules(catalogue.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	record, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": b1.Commit}, 1, 1,
+		inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
+	// Anchor's engine keeps libraries; the next build joins media, which is not taken.
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.LibraryContract,
+		SaidAt: time.Now(), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ = json.Marshal(joined)
+	b2 := b1
+	b2.ID, b2.Commit, b2.Manifest = "b2", "c2c2c2c2", raw
+	if err := inv.RecordBuild(ctx, b2); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, joined, inventory.Source{Repository: b2.Repository, Ref: "main", BuiltFrom: b2.Commit}); err != nil {
+		t.Fatal(err)
+	}
+
+	plan, settings, err = planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := held.leftOutWhy["radarr"]; left {
+		t.Fatalf("radarr was left out while held: %s", why)
+	}
+	if !reflect.DeepEqual(radarrResources(was.Resources), radarrResources(held.Resources)) {
+		t.Fatalf("radarr held is composed otherwise than before it joined:\n %v\n %v", radarrResources(was.Resources),
+			radarrResources(held.Resources))
+	}
+	rules, err := plan.Rules(catalogue.Rendering{Settings: settings})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(rules, wasRules) || !strings.Contains(asJSON(rules), "7878") {
+		t.Fatalf("radarr's port is not in the filter as before: %s", asJSON(rules))
+	}
+}
+
+func radarrResources(rs []map[string]any) []map[string]any {
+	var out []map[string]any
+	for _, r := range rs {
+		if strings.HasPrefix(r["id"].(string), "radarr.") {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+func asJSON(v any) string {
+	raw, _ := json.Marshal(v)
+	return string(raw)
+}

cmd/mesh-controller/held_plan_test.go

@@ -0,0 +1,329 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/conditions"
+	"github.com/novox/mesh-controller/internal/inventory"
+	"github.com/novox/mesh-controller/internal/lease"
+	"github.com/novox/mesh-controller/internal/link"
+)
+
+// The re-review of 96e15f86, item 1 (novox/hq ADR 0328 §8): a delivery that brings a joining build of a module whose
+// library is not taken does not send it — the module waits for a person, the plan stays open saying so, and the other
+// modules of the plan are sent and judged as usual. Once the library is taken, the waiting build is sent and judged,
+// with no new merge.
+func TestADeliveryWaitsForALibraryAndJudgesTheRest(t *testing.T) {
+	judgeLeavesAsTheCore(t)
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	keeper, _ := withConditionsInMemory(t)
+	was := doctorFrom
+	doctorFrom = &doctor{open: open, keeper: keeper, teller: &conditions.Told{}}
+	t.Cleanup(func() { doctorFrom = was })
+
+	register(t, open, catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"})
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	app1 := catalogue.Manifest{Module: "app", Version: "c1"}
+	app2 := catalogue.Manifest{Module: "app", Version: "c2"}
+	builds := []struct {
+		id, module, commit string
+		m                  catalogue.Manifest
+		at                 time.Time
+	}{
+		{"build-app-1", "app", "c1", app1, time.Now().Add(-2 * time.Hour)},
+		{"build-radarr-1", "radarr", "r1", radarrBefore(), time.Now().Add(-2 * time.Hour)},
+		{"build-app-2", "app", "c2", app2, time.Now().Add(-time.Minute)},
+		{"build-radarr-2", "radarr", "r2", radarrJoined(), time.Now().Add(-time.Minute)},
+	}
+	for _, b := range builds {
+		raw, _ := json.Marshal(b.m)
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: b.id, Module: b.module, Commit: b.commit,
+			Repository: "novox/mesh-media-catalog", Path: "modules/" + b.module, Ref: "main", Manifest: raw,
+			Asked: b.at, At: b.at}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	registerAt := func(m catalogue.Manifest, commit string, asked time.Time) {
+		if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-media-catalog", Seat: "git",
+			Path: "modules/" + m.Module, Ref: "main", BuiltFrom: commit, Head: commit, Asked: asked}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	registerAt(app1, "c1", time.Now().Add(-2*time.Hour))
+	registerAt(radarrBefore(), "r1", time.Now().Add(-2*time.Hour))
+	if _, err := inv.Assign(ctx, "anchor", "app"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.Assign(ctx, "anchor", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSent(ctx, nodeID(t, open, "anchor"), "d-anchor-0", map[string]string{"app": "c1", "radarr": "r1"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.OwnGroupContract,
+		SaidAt: time.Now(), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	registerAt(app2, "c2", time.Now().Add(-time.Minute))
+	registerAt(radarrJoined(), "r2", time.Now().Add(-time.Minute))
+
+	// Every send records what it carries: the registered builds, a held module at the build it runs.
+	var sent []string
+	wasSend := sendRollout
+	sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
+		current, err := open.inventory.CurrentBuilds(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range names {
+			held, err := holdJoining(ctx, open.inventory, node, nil)
+			if err != nil {
+				return nil, err
+			}
+			carried := map[string]string{"app": current["app"].Commit, "radarr": current["radarr"].Commit}
+			for m, h := range held {
+				carried[m] = h.commit
+			}
+			sent = append(sent, node+":app="+carried["app"]+",radarr="+carried["radarr"])
+			digest := fmt.Sprintf("d-%s-%d", node, len(sent))
+			if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, carried); err != nil {
+				return nil, err
+			}
+			if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
+				Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
+				return nil, err
+			}
+		}
+		return names, nil
+	}
+	t.Cleanup(func() { sendRollout = wasSend })
+	wasGather := gatherGateFacts
+	gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
+		f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
+			rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
+		reports, err := open.inventory.LastReports(ctx)
+		for _, r := range reports {
+			f.reports[r.Node] = r
+		}
+		return f, err
+	}
+	t.Cleanup(func() { gatherGateFacts = wasGather })
+	wasSettle, wasEvery := gateSettle, gateEvery
+	gateSettle, gateEvery = 0, 0
+	t.Cleanup(func() { gateSettle, gateEvery = wasSettle, wasEvery })
+
+	built := time.Now().UTC()
+	plan := inventory.Plan{ID: "plan-held", Repository: "novox/mesh-media-catalog", Branch: "main", Commit: "c2",
+		Created: built, State: inventory.PlanBuilding, Tiers: [][]string{{"app", "radarr"}},
+		Modules: map[string]*inventory.PlanModule{
+			"app":    {State: "built", BuiltAt: &built, Commit: "c2", Build: "build-app-2"},
+			"radarr": {State: "built", BuiltAt: &built, Commit: "r2", Build: "build-radarr-2"}}}
+	if err := inv.SavePlan(ctx, &plan); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, open)
+	}
+	p, err := inv.PlanByID(ctx, "plan-held")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if p.State == inventory.PlanSuperseded || p.State == inventory.PlanDone || p.State == inventory.PlanFailed {
+		t.Fatalf("the plan is %s (%s); want it open, waiting for the library", p.State, p.Note)
+	}
+	if g := p.Modules["app"].Gate; g == nil || g.Verdict != inventory.GatePassed {
+		t.Fatalf("app was not judged and passed beside the held module: %+v (%s)", p.Modules["app"], p.Note)
+	}
+	if p.Modules["radarr"].FirstAt != nil || !strings.Contains(p.Note, "library media") {
+		t.Fatalf("radarr was sent, or the plan does not say it waits for the library: %+v, %q", p.Modules["radarr"], p.Note)
+	}
+	if slices.ContainsFunc(sent, func(s string) bool { return strings.Contains(s, "radarr=r2") }) {
+		t.Fatalf("radarr's joining build was sent while held: %v", sent)
+	}
+
+	// The library is taken: the waiting build is sent, with no new merge.
+	if err := inv.RecordTakeStarted(ctx, inventory.TakenLibrary{Library: "media", Home: "anchor", Root: "/storage/media",
+		By: "the operator", Ask: "c01", Warrant: "c01"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.TakeDone(ctx, "media", "c01"); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 4; i++ {
+		advancePlans(ctx, open)
+	}
+	if !slices.ContainsFunc(sent, func(s string) bool { return strings.Contains(s, "radarr=r2") }) {
+		t.Fatalf("radarr's joining build was not sent once its library was taken: %v", sent)
+	}
+}
+
+// The re-review of 96e15f86, item 2: a module joins only on an engine stating link.OwnGroupContract (7). On an engine
+// at 6 a module that ran there before is held at the build it ran, whatever its library — so its tools never lose
+// their read of its directories.
+func TestAJoiningModuleIsHeldOnAnEngineOlderThanOwnGroups(t *testing.T) {
+	open, record := heldMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	if err := inv.RecordTakeStarted(ctx, inventory.TakenLibrary{Library: "media", Home: "anchor", Root: "/storage/media",
+		By: "the operator", Ask: "c01", Warrant: "c01"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.TakeDone(ctx, "media", "c01"); err != nil {
+		t.Fatal(err)
+	}
+	_ = record
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.LibraryContract,
+		SaidAt: time.Now(), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	held, err := holdJoining(ctx, inv, "anchor", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if held["radarr"].commit != "c1c1c1c1" {
+		t.Fatalf("on an engine at contract 6 radarr is not held at the build it ran: %+v", held)
+	}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.OwnGroupContract,
+		SaidAt: time.Now().Add(time.Second), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	if held, err = holdJoining(ctx, inv, "anchor", nil); err != nil || len(held) > 0 {
+		t.Fatalf("on an engine at contract 7 with its library taken radarr is still held: %+v (%v)", held, err)
+	}
+}
+
+// heldMesh is anchor running radarr's build from before it joined, the joining build registered, media defined.
+func heldMesh(t *testing.T) (*stores, inventory.Node) {
+	t.Helper()
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"})
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	for _, b := range []struct {
+		id, commit string
+		m          catalogue.Manifest
+	}{{"b1", "c1c1c1c1", radarrBefore()}, {"b2", "c2c2c2c2", radarrJoined()}} {
+		raw, _ := json.Marshal(b.m)
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: b.id, Repository: "https://forge.invalid/media.git", Ref: "main",
+			Module: "radarr", Commit: b.commit, On: "builder", Manifest: raw}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RegisterModule(ctx, radarrBefore(), inventory.Source{Repository: "https://forge.invalid/media.git",
+		Ref: "main", BuiltFrom: "c1c1c1c1"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	record, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": "c1c1c1c1"}, 1, 1,
+		inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RegisterModule(ctx, radarrJoined(), inventory.Source{Repository: "https://forge.invalid/media.git",
+		Ref: "main", BuiltFrom: "c2c2c2c2"}); err != nil {
+		t.Fatal(err)
+	}
+	return open, record
+}
+
+// The re-review of 96e15f86, item 3: a held module is composed with the settings it last ran with — a layer changed
+// for the joining build (its puid removed) does not reach the build it still runs.
+func TestAHeldModuleKeepsTheSettingsItRanWith(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"})
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	before := radarrBefore()
+	before.Resources = append(before.Resources, map[string]any{"id": "identity", "type": "file",
+		"path": "${dir:config}/identity.env", "mode": "0644", "content": "PUID=${setting:puid}\n"})
+	joined := radarrJoined()
+	for _, b := range []struct {
+		id, commit string
+		m          catalogue.Manifest
+	}{{"b1", "c1c1c1c1", before}, {"b2", "c2c2c2c2", joined}} {
+		raw, _ := json.Marshal(b.m)
+		if err := inv.RecordBuild(ctx, inventory.Build{ID: b.id, Repository: "https://forge.invalid/media.git", Ref: "main",
+			Module: "radarr", Commit: b.commit, On: "builder", Manifest: raw}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := inv.RegisterModule(ctx, before, inventory.Source{Repository: "https://forge.invalid/media.git",
+		Ref: "main", BuiltFrom: "c1c1c1c1"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.SetSettings(ctx, "anchor", "radarr", map[string]any{"puid": "1000"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := assign(ctx, open, "anchor", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	record, err := inv.NodeByName(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": "c1c1c1c1"}, 1, 1,
+		inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(20 * time.Millisecond)
+	if err := inv.RegisterModule(ctx, joined, inventory.Source{Repository: "https://forge.invalid/media.git",
+		Ref: "main", BuiltFrom: "c2c2c2c2"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.ClearSettings(ctx, "anchor", "radarr"); err != nil { // the joining build reads no puid
+		t.Fatal(err)
+	}
+	if _, err := inv.RecordHealth(ctx, inventory.NodeHealth{Node: "anchor", Contract: link.OwnGroupContract,
+		SaidAt: time.Now(), HeardAt: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	gens, err := generators(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plan, settings, err := planFor(ctx, open, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	held, err := declarationWith(ctx, open, "anchor", plan, settings, gens, Reading)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why, left := held.leftOutWhy["radarr"]; left {
+		t.Fatalf("radarr held was left out: %s", why)
+	}
+	for _, r := range held.Resources {
+		if r["id"] == "radarr.identity" {
+			if r["content"] != "PUID=1000\n" {
+				t.Fatalf("radarr held reads %q; want the puid it ran with", r["content"])
+			}
+			return
+		}
+	}
+	t.Fatal("radarr held has no identity file")
+}

cmd/mesh-controller/kept_libraries.go

@@ -57,8 +57,11 @@ type libraryTake struct {
 // takeVerb is the verb a take's answer binds: the controller's own, performed by itself on the warrant.
 const takeVerb = askerName + ".take"
 
-// key is the library on its home and filesystem: what one ask is kept for. A library that moved is asked again.
-func (t libraryTake) key() string { return t.Library + "\x00" + t.Node + "\x00" + t.Placed }
+// key is the library on its home, at its root, on its filesystem: what one ask is kept for. A library that moved is
+// asked again.
+func (t libraryTake) key() string {
+	return t.Library + "\x00" + t.Node + "\x00" + t.Root + "\x00" + t.Placed
+}
 
 // digest binds everything the take does and was said for.
 func (t libraryTake) digest() string {
@@ -264,12 +267,14 @@ func takeFolderIn(open *stores, ask func(ctx context.Context, act link.AccessAct
 		if answer.Refused != "" {
 			return "", fmt.Errorf("%s refused to take the library %s: %s", t.Node, t.Library, answer.Refused)
 		}
-		if err := open.inventory.RecordTaken(ctx, inventory.TakenLibrary{Library: t.Library, Home: t.Node,
-			Placed: t.Placed, By: by, Ask: askID, Warrant: askID, Said: answer.Said}); err != nil {
+		// Started, not taken: the library is taken when the engine states the act done (stateHealth, TakeDone).
+		if err := open.inventory.RecordTakeStarted(ctx, inventory.TakenLibrary{Library: t.Library, Home: t.Node,
+			Root: t.Root, Placed: t.Placed, By: by, Ask: askID, Warrant: askID, Said: answer.Said}); err != nil {
 			return "", fmt.Errorf("%s started the take of %s (%s), and it could NOT be recorded: %w", t.Node, t.Library,
 				answer.Said, err)
 		}
-		return fmt.Sprintf("%s takes the library %s: %s", t.Node, t.Library, answer.Said), nil
+		return fmt.Sprintf("%s started taking the library %s: %s; it is taken when the engine says the act is done",
+			t.Node, t.Library, answer.Said), nil
 	}
 }
 
@@ -341,10 +346,24 @@ func foldersIn(open *stores) func(ctx context.Context) ([]libraryTake, error) {
 			return nil, err
 		}
 		waiting, f := foldersWaiting(ctx, open.inventory, healths)
-		return takesOf(waiting, f.libraries), nil
+		return withoutTakesUnderWay(takesOf(waiting, f.libraries), f.taken), nil
 	}
 }
 
+// withoutTakesUnderWay is the takes not already under way: a take started on the same home, root and filesystem, which
+// the engine has not yet stated done or failed, is not asked about again (the review of 7ea6d36e, item 5).
+func withoutTakesUnderWay(takes []libraryTake, recorded map[string]inventory.TakenLibrary) []libraryTake {
+	var out []libraryTake
+	for _, t := range takes {
+		r, was := recorded[t.Library]
+		if was && !r.Done && r.Home == t.Node && r.Root == t.Root && (t.Placed == "" || r.Placed == "" || r.Placed == t.Placed) {
+			continue
+		}
+		out = append(out, t)
+	}
+	return out
+}
+
 // takesOf is one take per library and filesystem from the waits gathered, sorted. A library no longer defined is
 // asked about nowhere.
 func takesOf(waiting map[string][]waitingFolder, libraries map[string]catalogue.Library) []libraryTake {

cmd/mesh-controller/kept_libraries_test.go

@@ -49,7 +49,7 @@ func diskWait(access string) inventory.Wait {
 func libraryFactsWith(taken ...string) operatorWaitFacts {
 	t := map[string]inventory.TakenLibrary{}
 	for _, l := range taken {
-		t[l] = inventory.TakenLibrary{Library: l, Home: "ace", Placed: "fs-000000000001"}
+		t[l] = inventory.TakenLibrary{Library: l, Home: "ace", Root: "/storage/media", Placed: "fs-000000000001", Done: true}
 	}
 	return operatorWaitFacts{
 		manifests:     map[string]catalogue.Manifest{"radarr": radarrManifest, "plex": plexManifest},
@@ -82,6 +82,12 @@ func TestALibraryWaitIsExcusedOnlyForALibraryNotYetTaken(t *testing.T) {
 			libraryFactsWith("media"), "taken already"},
 		{"taken on another filesystem: it moved", "ace", placedWait("library:media", "fs-0000000000ff"),
 			libraryFactsWith("media"), ""},
+		{"taken at another root: its root changed", "ace", keepWait("movies"), func() operatorWaitFacts {
+			f := libraryFactsWith("media")
+			f.taken["media"] = inventory.TakenLibrary{Library: "media", Home: "ace", Root: "/storage/old-media", Done: true,
+				Placed: "fs-000000000001"}
+			return f
+		}(), ""},
 		{"a machine it does not reach", "far", keepWait("movies"), libraryFactsWith(), "does not reach far"},
 		{"undefined", "ace", keepWait("library:books"), libraryFactsWith(), "not defined"},
 		{"not a library", "ace", keepWait("downloads"), libraryFactsWith(), "only a library waits"},
@@ -432,10 +438,21 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 		if err := inv.RegisterModule(ctx, m, inventory.Source{}); err != nil {
 			t.Fatal(err)
 		}
+		if m.Module == "plex" {
+			continue // pulled in by a requirement, not assigned: it is in what the machine was sent (item 4)
+		}
 		if _, err := inv.Assign(ctx, "ace", m.Module); err != nil {
 			t.Fatal(err)
 		}
 	}
+	record, err := inv.NodeByName(ctx, "ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": "c1", "plex": "c2", "plain": "c3"},
+		1, 1, inventory.Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
 	lib := inventory.ResourceHealth{Resource: "library:media", Kind: link.KindLibrary, Target: "/storage/media",
 		State: link.StateWaiting, Waits: []inventory.Wait{{Part: "media", Access: "library:media", Reason: link.WaitKeep,
 			Placed: "fs-000000000001", What: "let the mesh keep the library media"}}}
@@ -447,6 +464,13 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 	if strings.Join(modules, ",") != "plex,radarr" {
 		t.Fatalf("the library's verdict is said for %v; want plex and radarr, the modules using it", modules)
 	}
+	paths, err := inv.LibraryPaths(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Join(paths["media"], ",") != "movies" {
+		t.Fatalf("the paths kept of media are %v", paths["media"])
+	}
 	now := time.Now()
 	f := gateFacts{now: now, waits: libraryFactsWith(), groupsAdded: map[string]bool{"radarr": false},
 		accessesChanged: map[string]bool{"radarr": false},
@@ -468,3 +492,94 @@ func TestALibrarysVerdictIsSaidForTheModulesThatUseIt(t *testing.T) {
 		f.accessesChanged = map[string]bool{"radarr": false}
 	}
 }
+
+// The review of 7ea6d36e, item 5: the engine saying it started a take does not make the library taken. While the act
+// runs the library still waits and the operator is not asked again; it is taken when the engine states the act done
+// under that warrant.
+func TestALibraryIsTakenOnlyWhenTheEngineSaysTheActIsDone(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, catalogue.Manifest{Module: catalogue.LibrariesModule, Version: "1"})
+	if err := inv.SetSettings(ctx, "", catalogue.LibrariesModule, map[string]any{catalogue.LibrariesSetting: map[string]any{
+		"media": map[string]any{"home": "anchor", "root": "/storage/media"}}}); err != nil {
+		t.Fatal(err)
+	}
+	take := takeFolderIn(open, func(context.Context, link.AccessActAsk) (link.HandOverAnswer, error) {
+		return link.HandOverAnswer{Said: "the take of library:media started"}, nil
+	})
+	lt := libraryTake{Library: "media", Node: "anchor", Root: "/storage/media", Placed: "fs-000000000001"}
+	if _, err := take(ctx, lt, "c01", "the operator"); err != nil {
+		t.Fatal(err)
+	}
+	libs, err := inv.Libraries(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	taken, err := librariesTaken(ctx, inv, libs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if taken["media"] {
+		t.Fatal("a take only started made the library taken")
+	}
+	// While it runs: the wait is still excused, and no new ask is made for it.
+	var f operatorWaitFacts
+	readWaitFacts(ctx, inv, "anchor", nil, nil, &f)
+	if err := checkWait("radarr", "anchor", placedWait("library:media", "fs-000000000001"), f); err != nil {
+		t.Fatalf("the wait while the take runs: %v", err)
+	}
+	if got := withoutTakesUnderWay([]libraryTake{lt}, f.taken); len(got) != 0 {
+		t.Fatalf("a library whose take runs is asked about again: %+v", got)
+	}
+	// The engine states the act done under that warrant.
+	act, _ := json.Marshal(map[string]any{"act": "take", "access": "library:media", "warrant": "c01", "state": "done"})
+	if err := stateHealth(ctx, inv, nil, "anchor", link.Health{Contract: link.LibraryContract, At: time.Now(),
+		Resources: []link.ResourceHealth{{Resource: "library:media", Kind: link.KindLibrary, Target: "/storage/media",
+			State: link.StateHealthy, Since: time.Now(), Act: act}}}, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if taken, err = librariesTaken(ctx, inv, libs); err != nil || !taken["media"] {
+		t.Fatalf("the act done did not make the library taken (%v)", err)
+	}
+}
+
+// ADR 0334: the engine states the tool runner's membership as resources of kind runner — `runner:<module>` of that
+// module, `runner:library:<name>` of no module. A library's is said for the modules that use it; neither fails the
+// first-node gate of a move that leaves the module's libraries as they were, and both hold one that changes them.
+func TestARunnersVerdictIsSaidAndJudgedByWhetherTheMoveChangesIt(t *testing.T) {
+	inv := inventory.ForTest(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "ace"); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []catalogue.Manifest{radarrManifest, plexManifest} {
+		if err := inv.RegisterModule(ctx, m, inventory.Source{}); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := inv.Assign(ctx, "ace", m.Module); err != nil {
+			t.Fatal(err)
+		}
+	}
+	lib := inventory.ResourceHealth{Resource: "runner:library:media", Kind: link.KindRunner, Target: "jochen",
+		State: link.StateUnhealthy, Reason: "the tool runner is not in mesh-media yet", Since: time.Now()}
+	copies := libraryVerdictsFor(ctx, inv, "ace", []inventory.ResourceHealth{lib})
+	if len(copies) != 2 || copies[0].Module != "plex" || copies[1].Module != "radarr" {
+		t.Fatalf("the runner's library verdict is said for %+v; want plex and radarr", copies)
+	}
+	own := inventory.ResourceHealth{Module: "radarr", Resource: "runner:radarr", Kind: link.KindRunner, Target: "jochen",
+		State: link.StateUnhealthy, Reason: "the tool runner is not in mesh-radarr yet", Since: time.Now()}
+	now := time.Now()
+	for _, r := range []inventory.ResourceHealth{copies[1], own} {
+		f := gateFacts{now: now, waits: libraryFactsWith(), groupsAdded: map[string]bool{"radarr": false},
+			accessesChanged: map[string]bool{"radarr": false},
+			health:          map[string]inventory.NodeHealth{"ace": {Node: "ace", HeardAt: now, Resources: []inventory.ResourceHealth{r}}}}
+		if h, why := moduleHealthWord("radarr", "ace", now.Add(-time.Minute), f); h != healthGood {
+			t.Errorf("%s, a move that changes no library: %v %q; want not counted", r.Resource, h, why)
+		}
+		f.accessesChanged = map[string]bool{"radarr": true}
+		if h, _ := moduleHealthWord("radarr", "ace", now.Add(-time.Minute), f); h != healthNotYet {
+			t.Errorf("%s, a move that changes a library: %v; want held to the bound", r.Resource, h)
+		}
+	}
+}

cmd/mesh-controller/module_health.go

@@ -2,7 +2,9 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"sync/atomic"
@@ -40,14 +42,18 @@ const (
 	moduleUnhealthyAfter = 2
 )
 
+// runnerLibrary prefixes the engine's verdict on the tool runner's membership of a library's group (ADR 0334).
+const runnerLibrary = "runner:library:"
+
 // libraryVerdictsFor is, for each library verdict in a statement (kind library, no module), one copy for each module
-// assigned to the machine whose manifest uses that library: what the module is judged and said by. None when the
+// on the machine — assigned, or pulled in by a requirement — whose manifest uses that library: what the module is judged and said by. None when the
 // assignments or the catalogue cannot be read: the library's own verdict stands alone, and no module is excused by it.
 func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node string,
 	rs []inventory.ResourceHealth) []inventory.ResourceHealth {
 	var libraries []inventory.ResourceHealth
 	for _, r := range rs {
-		if r.Module == "" && r.Kind == link.KindLibrary && strings.HasPrefix(r.Resource, libraryAccess) {
+		if r.Module == "" && ((r.Kind == link.KindLibrary && strings.HasPrefix(r.Resource, libraryAccess)) ||
+			(r.Kind == link.KindRunner && strings.HasPrefix(r.Resource, runnerLibrary))) {
 			libraries = append(libraries, r)
 		}
 	}
@@ -59,6 +65,18 @@ func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node stri
 		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
 		return nil
 	}
+	// And the modules a requirement pulled in: what the machine was last sent (the review of 7ea6d36e, item 4).
+	sent, _, err := inv.SentBuilds(ctx, node)
+	if err != nil {
+		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
+		return nil
+	}
+	for m := range sent {
+		if !slices.Contains(assigned, m) {
+			assigned = append(assigned, m)
+		}
+	}
+	sort.Strings(assigned)
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
 		// empty-on-error: the library's own verdict is kept and judged; no module is excused by a copy it could not make
@@ -66,7 +84,7 @@ func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node stri
 	}
 	var out []inventory.ResourceHealth
 	for _, lib := range libraries {
-		name := strings.TrimPrefix(lib.Resource, libraryAccess)
+		name := strings.TrimPrefix(strings.TrimPrefix(lib.Resource, runnerLibrary), libraryAccess)
 		for _, module := range assigned {
 			for _, u := range shelf[module].Libraries {
 				if u.Library == name {
@@ -81,6 +99,39 @@ func libraryVerdictsFor(ctx context.Context, inv *inventory.Inventory, node stri
 	return out
 }
 
+// takesStated keeps what a statement says of each library's take act: done under a warrant, the library is taken;
+// failed, the take is forgotten and the operator asked again. Running or stopped (it goes on) changes nothing.
+func takesStated(ctx context.Context, inv *inventory.Inventory, rs []link.ResourceHealth) error {
+	if inv == nil {
+		return nil
+	}
+	for _, r := range rs {
+		lib, isLibrary := strings.CutPrefix(r.Resource, libraryAccess)
+		if !isLibrary || r.Kind != link.KindLibrary || len(r.Act) == 0 {
+			continue
+		}
+		var act struct {
+			Act     string `json:"act"`
+			Warrant string `json:"warrant"`
+			State   string `json:"state"`
+		}
+		if err := json.Unmarshal(r.Act, &act); err != nil || act.Act != link.ActTake || act.Warrant == "" {
+			continue
+		}
+		var err error
+		switch act.State {
+		case "done":
+			err = inv.TakeDone(ctx, lib, act.Warrant)
+		case "failed":
+			err = inv.TakeFailed(ctx, lib, act.Warrant)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // healthRefused counts the statements refused as older than the one kept, for the log and a test.
 var healthRefused atomic.Int64
 
@@ -126,6 +177,11 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
 		}
 		resources = append(resources, kept)
 	}
+	// **A library's take is done, or failed, when its engine says so** (novox/hq ADR 0328 §7): only then is it taken,
+	// or asked about again.
+	if err := takesStated(ctx, inv, h.Resources); err != nil {
+		return err
+	}
 	// **A library's verdict is said for the modules that use it** (novox/hq ADR 0328 §8): the engine states each
 	// library once, as `library:<name>`, of no module; a module that uses it waits with it, and is said so.
 	resources = append(resources, libraryVerdictsFor(ctx, inv, node, resources)...)
@@ -738,6 +794,11 @@ func moduleHealthWord(module, machine string, since time.Time, f gateFacts) (hea
 			(r.State == link.StateUnknown || (r.Kind == link.KindLibrary && r.State == link.StateStarting)) {
 			continue
 		}
+		// The tool runner's membership (ADR 0334 §2), of a move that changes no library of the module, is not this
+		// move's: it is said as the module's condition, and holds a move that changes them to the gate's bound.
+		if r.Kind == link.KindRunner && !changes {
+			continue
+		}
 		switch r.State {
 		case link.StateHealthy:
 		case link.StateStarting:

cmd/mesh-controller/operator_wait.go

@@ -138,7 +138,8 @@ func checkLibraryWait(machine, lib string, w inventory.Wait, f operatorWaitFacts
 	if machine != l.Home {
 		placed = ""
 	}
-	if t, was := f.taken[lib]; was && t.Home == l.Home && (placed == "" || t.Placed == "" || t.Placed == placed) {
+	if t, was := f.taken[lib]; was && t.Done && t.Home == l.Home && t.Root == l.Root &&
+		(placed == "" || t.Placed == "" || t.Placed == placed) {
 		return fmt.Errorf("says it waits for the library %s, which is taken already: a module that uses a taken "+
 			"library is never asked about it", lib)
 	}

cmd/mesh-controller/plan.go

@@ -134,6 +134,11 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 	if _, err := keepRecorded(ctx, open, nodeName, shelf); err != nil {
 		return catalogue.Resolution{}, nil, err
 	}
+	// And a module that may not join yet, at the build it ran before (novox/hq ADR 0328 §8, ADR 0334).
+	held, err := holdJoining(ctx, inv, nodeName, shelf)
+	if err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
 
 	resolved, err := catalogue.Resolve(shelf, assigned,
 		catalogue.Node{Name: nodeName, Site: site, Capabilities: capabilities,
@@ -219,6 +224,10 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 		}
 		settings[m.Module] = layers
 	}
+	// A held module with the settings it last ran with (ADR 0328 §8).
+	if err := heldSettings(ctx, inv, nodeName, held, settings); err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
 	return resolved, settings, nil
 }
 
@@ -473,11 +482,22 @@ func declarationWith(ctx context.Context, open *stores, node string,
 			names = append(names, m.Module)
 		}
 		out.Builds = carriedBuilds(names, composed.LeftOut, current, before)
-		// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245).
+		// A recorded module kept at the build the machine runs is recorded as carrying that one (ADR 0245), and so
+		// is a joining module held at the build it ran before (ADR 0328 §8).
 		kept, err := recordedKept(ctx, open, node)
 		if err != nil {
 			return sendable{}, err
 		}
+		held, err := holdJoining(ctx, open.inventory, node, nil)
+		if err != nil {
+			return sendable{}, err
+		}
+		if kept == nil && len(held) > 0 {
+			kept = map[string]string{}
+		}
+		for m, h := range held {
+			kept[m] = h.commit
+		}
 		for m, was := range kept {
 			if _, carried := out.Builds[m]; carried {
 				out.Builds[m] = was
@@ -987,7 +1007,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		ReadsHealth:    readsHealth,
 		JudgesRoot:     judgesRoot,
 		KeepsLibraries: lf.keeps, Identities: lf.identities, Libraries: lf.libraries, LibraryGroups: lf.groups,
-		TakenLibraries: lf.taken, LibraryPaths: lf.paths, Held: lf.held,
+		TakenLibraries: lf.taken, LibraryPaths: lf.paths, RunnerJoinsOwnGroups: lf.ownGroups,
 		BusMembership: memberships[node],
 		Settings:      settings, Generators: gens, Grants: grants, Needed: needed, Foreseen: foreseen, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
@@ -1020,15 +1040,16 @@ func engineJudgesRoot(ctx context.Context, inv *inventory.Inventory, node string
 	return had && stated.Contract >= link.RootContract, nil
 }
 
-// engineKeepsLibraries says whether a machine's node-engine makes the mesh's users and library groups and keeps
-// libraries (novox/hq ADR 0328), by its own newest statement, for the same reason as engineReadsHealth: an older engine
-// parses strictly, and is sent none of it.
+// engineKeepsLibraries says whether a machine's node-engine makes the mesh's users and library groups, keeps
+// libraries, and keeps a joining module's own groups (novox/hq ADR 0328, ADR 0334: its statement's contract is
+// link.OwnGroupContract or later), by its own newest statement. On an older one no module joins: the libraries
+// alone are not enough, since its tools would lose their read of a joining module's directories.
 func engineKeepsLibraries(ctx context.Context, inv *inventory.Inventory, node string) (bool, error) {
 	stated, had, err := inv.HealthOf(ctx, node)
 	if err != nil {
 		return false, err
 	}
-	return had && stated.Contract >= link.LibraryContract, nil
+	return had && stated.Contract >= link.OwnGroupContract, nil
 }
 
 // libraryRendering is what a machine's composition needs of ADR 0328.
@@ -1039,12 +1060,11 @@ type libraryRendering struct {
 	groups     map[string]int
 	taken      map[string]bool
 	paths      map[string][]string
-	held       map[string]string
+	ownGroups  bool
 }
 
 // libraryFacts reads what a machine's composition needs of ADR 0328: the libraries and their group numbers, the
-// numbers of the modules here that join, which libraries are taken, the sub-paths every module asks of each, and which
-// joining modules here are held at the user they ran as. **A number is allocated only on the send path** (Allocating),
+// numbers of the modules here that join, which libraries are taken, and the sub-paths every module asks of each. **A number is allocated only on the send path** (Allocating),
 // as a port is: a question about what would be sent reads what was allocated. The libraries are read for every engine,
 // so a module that joins is left out, naming why, where its engine cannot be told it does.
 func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, plan catalogue.Resolution,
@@ -1069,6 +1089,7 @@ func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, pl
 	if lf.keeps, err = engineKeepsLibraries(ctx, inv, node); err != nil || !lf.keeps {
 		return lf, err
 	}
+	lf.ownGroups = true // a module joins only on an engine that also keeps its own groups (ADR 0334)
 	lf.identities = map[string]catalogue.ModuleIdentity{}
 	for _, m := range plan.Modules {
 		if !catalogue.Joins(m) {
@@ -1107,26 +1128,6 @@ func libraryFacts(ctx context.Context, inv *inventory.Inventory, node string, pl
 	if lf.taken, err = librariesTaken(ctx, inv, libs); err != nil {
 		return lf, err
 	}
-	// **A joining module that ran here before keeps the user it ran as until every library it uses is taken** (§8):
-	// held, it is left out of the declaration, its containers untouched. One new here has nothing to keep.
-	sent, known, err := inv.SentBuilds(ctx, node)
-	if err != nil {
-		return lf, err
-	}
-	for _, m := range plan.Modules {
-		if _, ran := sent[m.Module]; !known || !ran || !catalogue.Joins(m) {
-			continue
-		}
-		for _, u := range m.Libraries {
-			if !lf.taken[u.Library] {
-				if lf.held == nil {
-					lf.held = map[string]string{}
-				}
-				lf.held[m.Module] = u.Library
-				break
-			}
-		}
-	}
 	return lf, nil
 }
 
@@ -1140,7 +1141,7 @@ func librariesTaken(ctx context.Context, inv *inventory.Inventory, libs map[stri
 	out := map[string]bool{}
 	for name, l := range libs {
 		t, was := recorded[name]
-		taken := was && t.Home == l.Home
+		taken := was && t.Done && t.Home == l.Home && t.Root == l.Root
 		stated, had, err := inv.HealthOf(ctx, l.Home)
 		if err != nil {
 			return nil, err

cmd/mesh-controller/release.go

@@ -253,9 +253,24 @@ func withoutKept(ctx context.Context, open *stores, node string, moves []invento
 		keeping = keepingRecorded(ctx)
 	}
 	keeps, err := recordedKept(keeping, open, node)
-	if err != nil || len(keeps) == 0 {
+	if err != nil {
 		return moves, err
 	}
+	// And a joining module held at the build it runs (novox/hq ADR 0328 §8): its new build is no move this send makes,
+	// and judging it would read the gate as superseded by its own send (the re-review of 96e15f86, item 1).
+	held, err := holdJoining(ctx, open.inventory, node, nil)
+	if err != nil {
+		return moves, err
+	}
+	if len(held) > 0 && keeps == nil {
+		keeps = map[string]string{}
+	}
+	for m, h := range held {
+		keeps[m] = h.commit
+	}
+	if len(keeps) == 0 {
+		return moves, nil
+	}
 	var out []inventory.CarriedMove
 	for _, mv := range moves {
 		if was, kept := keeps[mv.Module]; kept && sameCommit(was, mv.From) {

cmd/mesh-controller/release_plan.go

@@ -690,7 +690,7 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 	// being behind. Now every module of the tier whose first machine is the same is sent there in one
 	// send, judged there by one gate — kept on the first of them, the others gated by it — and the rest
 	// of the tier's machines are sent once, together, when the gates have passed.
-	var pending []string
+	var pending, waitsForAPerson []string
 	firstOn := map[string][]string{}
 	runningOf := map[string][]string{}
 	var rest []string
@@ -706,6 +706,20 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			return false, err
 		}
 		runningOf[m] = running
+		// **A joining build held for a person is not sent** (novox/hq ADR 0328 §8, the re-review of 96e15f86): its
+		// machines keep the build they run until its library is taken (or their engine keeps own groups), so sending
+		// it would send nothing new and judge the old build. It waits for a person, said; the plan stays open, the other
+		// modules are sent and judged, and it is sent on the walk after nothing holds it — no new merge.
+		if state.FirstAt == nil {
+			why, err := heldIn(ctx, inv, m, running)
+			if err != nil {
+				return false, err
+			}
+			if why != "" {
+				waitsForAPerson = append(waitsForAPerson, why)
+				continue
+			}
+		}
 		// **A build whose source is unchanged is never a move** (novox/hq issue 280): made from the source
 		// of the build every machine running it was sent, it is registered with that build's artifacts —
 		// nothing to send, and nothing for a gate to judge.
@@ -868,9 +882,17 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
 			strings.Join(sent, ", "))
 		return true, nil
 	}
-	if len(pending) > 0 {
-		note := "tier " + fmt.Sprint(p.Tier) + " built; waiting for " + strings.Join(pending, "; ") +
-			" to report it applied before the rest are sent"
+	if len(pending) > 0 || len(waitsForAPerson) > 0 {
+		note := "tier " + fmt.Sprint(p.Tier) + " built; "
+		if len(pending) > 0 {
+			note += "waiting for " + strings.Join(pending, "; ") + " to report it applied before the rest are sent"
+		}
+		if len(waitsForAPerson) > 0 {
+			if len(pending) > 0 {
+				note += "; and "
+			}
+			note += "waiting for a person: " + strings.Join(waitsForAPerson, "; ")
+		}
 		changed := p.State != inventory.PlanRolling || p.Note != note
 		p.State = inventory.PlanRolling
 		p.Note = note

go.mod

@@ -36,4 +36,4 @@ require (
 // committed. Every build (the build agent's `go build`, the Dockerfile) compiles from vendor/ and
 // fetches nothing; go refuses to build when vendor/ and this file disagree, so a pin moved without
 // `go mod vendor` fails loudly, at once, everywhere.
-replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012202816-d8e785bb4b4b
+replace github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012222214-7a41e120635b

go.sum

@@ -1,5 +1,5 @@
-git.novox.be/novox/mesh-host v0.0.0-20261012202816-d8e785bb4b4b h1:NvXKvFi4lV/oXg29dQ9iUX5oQm+NtPN9ACTa9Ev1i8E=
-git.novox.be/novox/mesh-host v0.0.0-20261012202816-d8e785bb4b4b/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
+git.novox.be/novox/mesh-host v0.0.0-20261012222214-7a41e120635b h1:PGdZJHUU9rCDucdrZIqSs4DGyxlo4lokvwmofpGk9RI=
+git.novox.be/novox/mesh-host v0.0.0-20261012222214-7a41e120635b/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c h1:l5onJwoIeH8yE/PjVlEeoPyXBsHp2NQiWLllz2fwX7s=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=

internal/broker/genesis_template_test.go

@@ -82,7 +82,7 @@ func theCarriedAccounts(t *testing.T) string {
 // the commit the mesh runs, or as captured in testdata/beside (internal/beside, novox/hq issue 432).
 func theTemplate(t *testing.T) []map[string]any {
 	t.Helper()
-	path := filepath.Join(beside.Dir(t, "mesh-host"), "examples", "foundation-first-node-nats.lock")
+	path := filepath.Join(beside.Dir(t, "mesh-host"), "examples", "foundation-first-node.lock")
 	raw, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)

internal/catalogue/declaration.go

@@ -261,9 +261,10 @@ type Rendering struct {
 	LibraryGroups  map[string]int
 	TakenLibraries map[string]bool
 	LibraryPaths   map[string][]string
-	// Held is, by module, the library a joining module that ran here before waits on: until every library it uses
-	// is taken its containers keep the user they ran as, so it is left out of the declaration (§8).
-	Held map[string]string
+	// RunnerJoinsOwnGroups says this machine's engine puts the tool runner's account in a joining module's own group
+	// and takes a directory's setgid mode (novox/hq ADR 0334 §1, §2: its statement's contract is link.OwnGroupContract
+	// or later); to an older one neither the identity's runner nor the setgid bit is sent.
+	RunnerJoinsOwnGroups bool
 }
 
 // RootField is a user resource's field saying the account must never become root without a person
@@ -1061,7 +1062,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
 			// And its identity and libraries, where it joins (novox/hq ADR 0328 §4, §5, §10): after the placement's
 			// owner, which a joining module may not set.
 			if joins {
-				if err := joinedInto(copied, m, joined, libPaths); err != nil {
+				if err := joinedInto(copied, m, joined, libPaths, with.RunnerJoinsOwnGroups); err != nil {
 					return nil, err
 				}
 			}

internal/catalogue/libraries.go

@@ -371,6 +371,7 @@ func libraryProblems(m Manifest) []string {
 	if !Joins(m) {
 		return problems
 	}
+	problems = append(problems, toolsDirectoryProblems(m)...)
 	for _, r := range m.Resources {
 		if fmt.Sprint(r["type"]) == "directory" {
 			if owner, said := r["owner"]; said {
@@ -383,6 +384,55 @@ func libraryProblems(m Manifest) []string {
 	return problems
 }
 
+// toolsDirectoryProblems refuses a joining module whose tools name one of its directories whose mode closes it to its
+// group (novox/hq ADR 0334 §3): the tool runner reads it through the module's own group, so it needs group read and
+// enter.
+func toolsDirectoryProblems(m Manifest) []string {
+	modes := map[string]string{}
+	for _, r := range m.Resources {
+		if fmt.Sprint(r["type"]) == "directory" {
+			mode, _ := r["mode"].(string)
+			modes[fmt.Sprint(r["id"])] = mode
+		}
+	}
+	var words []string
+	for _, b := range m.Bundles {
+		for _, v := range b.Env {
+			words = append(words, v)
+		}
+	}
+	if m.Build != nil {
+		for _, a := range m.Build.Artifacts {
+			for _, v := range a.Env {
+				words = append(words, v)
+			}
+		}
+	}
+	seen := map[string]bool{}
+	var problems []string
+	for _, w := range words {
+		for _, match := range dirRef.FindAllStringSubmatch(w, -1) {
+			id := match[1]
+			mode, declared := modes[id]
+			if !declared || seen[id] {
+				continue
+			}
+			seen[id] = true
+			var n uint64
+			if _, err := fmt.Sscanf(mode, "%o", &n); err != nil || mode == "" {
+				continue // its mode is judged where the directory is
+			}
+			if n&0o050 != 0o050 {
+				problems = append(problems, fmt.Sprintf("%s's tools name its directory %s, whose mode %s closes it to its "+
+					"own group: the tool runner reads it through that group, so it needs group read and enter (0750; "+
+					"the mesh adds setgid, 2750) (novox/hq ADR 0334 §3)", m.Module, id, mode))
+			}
+		}
+	}
+	sort.Strings(problems)
+	return problems
+}
+
 // LibraryWarnings is what the module check warns of a module's libraries (§4): an image that drops added groups
 // reaches only the first library the module uses.
 func LibraryWarnings(m Manifest) []string {
@@ -511,8 +561,9 @@ func joinedOf(m Manifest, with Rendering) (Joined, error) {
 }
 
 // libraryLeftOut is why module m is left out of this machine's declaration for its libraries, or "": a library it
-// uses not defined or not reaching the machine (§2), an engine that cannot be told it joins, or a container held at
-// the user it ran as until every library it uses is taken (§8).
+// uses not defined or not reaching the machine (§2), or an engine that cannot be told it joins. A module held at the
+// user it ran as until its libraries are taken (§8) is not left out: it is composed at the build it ran before it
+// joined (cmd/mesh-controller holdJoining).
 func libraryLeftOut(m Manifest, node string, with Rendering) string {
 	if !Joins(m) {
 		return ""
@@ -534,10 +585,6 @@ func libraryLeftOut(m Manifest, node string, with Rendering) string {
 	if _, has := with.Identities[m.Module]; !has {
 		return fmt.Sprintf("%s joins, and its number is allocated at its first send", m.Module)
 	}
-	if lib := with.Held[m.Module]; lib != "" {
-		return fmt.Sprintf("%s keeps the user it ran as until the library %s is taken: the operator is asked once "+
-			"(%s §8)", m.Module, lib, ADR0328)
-	}
 	return ""
 }
 
@@ -572,7 +619,7 @@ func identityFill(s string, j Joined) string {
 // joinedInto composes one resource of a joining module (§4, §5, §10): ${identity:…} filled everywhere, a container's
 // ${library:<id>} volume sources filled with the host path and a read entry mounted read-only, and a directory owned by
 // the module's user and primary group.
-func joinedInto(resource map[string]any, m Manifest, j Joined, paths map[string]string) error {
+func joinedInto(resource map[string]any, m Manifest, j Joined, paths map[string]string, setgid bool) error {
 	for k, v := range resource {
 		if k == "id" || k == "type" {
 			continue
@@ -583,8 +630,18 @@ func joinedInto(resource map[string]any, m Manifest, j Joined, paths map[string]
 		}
 		resource[k] = filled
 	}
+	// Its own directories belong to its user and its own group, with setgid (ADR 0334 §1, v4): the library's group is
+	// its processes' primary, so what they make in a library keeps that group — and what they make in their own
+	// directories keeps mesh-<module> by the setgid bit. The bit only to an engine that takes a mode with it
+	// (Rendering.RunnerJoinsOwnGroups, link.OwnGroupContract): the one pinned refuses a mode not starting with 0.
 	if fmt.Sprint(resource["type"]) == "directory" {
-		resource["owner"] = fmt.Sprintf("%d:%d", j.UID, j.PrimaryGID)
+		resource["owner"] = fmt.Sprintf("%d:%d", j.UID, j.UID)
+		if mode, ok := resource["mode"].(string); ok && setgid {
+			var n uint64
+			if _, err := fmt.Sscanf(mode, "%o", &n); err == nil && mode != "" {
+				resource["mode"] = fmt.Sprintf("%04o", n|0o2000)
+			}
+		}
 	}
 	if fmt.Sprint(resource["type"]) != "container" {
 		return nil
@@ -734,6 +791,9 @@ type IdentityEntry struct {
 	UID    int    `json:"uid"`
 	GID    int    `json:"gid"`
 	Groups []int  `json:"groups,omitempty"`
+	// Runner is the tool runner's account, put in this module's own group, where its tools run there (ADR 0334 §2).
+	// Only to an engine that reads it (Rendering.RunnerJoinsOwnGroups).
+	Runner string `json:"runner,omitempty"`
 }
 
 // libraryEnvelope is what a machine's declaration says of libraries and joining modules: the group of every library
@@ -753,13 +813,20 @@ func (r Resolution) libraryEnvelope(with Rendering, joined []Joined) ([]GroupEnt
 	for _, j := range joined {
 		e := IdentityEntry{Module: j.Module, Name: IdentityName(j.Module), UID: j.UID, GID: j.PrimaryGID,
 			Groups: append([]int(nil), j.AddedGIDs...)}
+		if with.RunnerJoinsOwnGroups {
+			for _, m := range r.Modules {
+				if m.Module == j.Module {
+					e.Runner = r.toolsAccount(m, with)
+				}
+			}
+		}
 		ids = append(ids, e)
 	}
 	sort.Slice(ids, func(a, b int) bool { return ids[a].Module < ids[b].Module })
 	used := map[string]map[string]bool{}
 	runner := map[string]string{}
 	for _, m := range r.Modules {
-		if with.Held[m.Module] == "" && libraryLeftOut(m, r.Node, with) != "" {
+		if libraryLeftOut(m, r.Node, with) != "" {
 			continue
 		}
 		for _, u := range m.Libraries {

internal/catalogue/libraries_test.go

@@ -88,8 +88,8 @@ func TestAJoiningModuleIsComposedWithItsIdentityAndLibraries(t *testing.T) {
 		"PUID=50020\nPGID=50010\nUSER=mesh-radarr\nGROUP=mesh-media\nUMASK=002\n" {
 		t.Errorf("the identity file reads %q", content)
 	}
-	if owner := got["radarr.config"]["owner"]; owner != "50020:50010" {
-		t.Errorf("its directory is owned by %v; want its user and primary group", owner)
+	if owner := got["radarr.config"]["owner"]; owner != "50020:50020" {
+		t.Errorf("its directory is owned by %v; want its user and own group (ADR 0334 §1)", owner)
 	}
 	if len(composed.Identities) != 1 || !reflect.DeepEqual(composed.Identities[0], IdentityEntry{Module: "radarr",
 		Name: "mesh-radarr", UID: 50020, GID: 50010, Groups: []int{50011}}) {
@@ -144,37 +144,46 @@ func TestALibraryNotReachingTheMachineLeavesItsModuleOut(t *testing.T) {
 	}
 }
 
-// Row 8: a joining module that ran here before keeps the user it ran as until its libraries are taken — left out, its
-// containers untouched — while its libraries are still named, so the engine states the wait and the take can come.
-func TestAJoiningModuleIsHeldUntilItsLibrariesAreTaken(t *testing.T) {
-	with := librariesRendering()
-	with.TakenLibraries["media"] = false
-	with.Held = map[string]string{"radarr": "media"}
-	composed := composeLibraries(t, Resolution{Node: "ace", Account: "jochen",
-		Modules: []Manifest{aRadarr(t), theRuntime(t)}}, with)
-	if why := composed.LeftOut["radarr"]; !strings.Contains(why, "keeps the user it ran as until the library media is taken") {
-		t.Fatalf("radarr while media is not taken: %q", why)
-	}
-	if byID(composed.Resources)["radarr.app"] != nil {
-		t.Fatal("a held module's container was sent")
-	}
-	found := false
-	for _, l := range composed.Libraries {
-		found = found || (l.Library == "media" && !l.Taken)
-	}
-	if !found {
-		t.Fatalf("the library a held module waits on is not named: %+v", composed.Libraries)
-	}
-}
-
-// Row 14: a module that neither declares libraries nor uses its identity is composed exactly as before, on an engine
-// that keeps libraries or not; and a joining module on an older engine is left out, naming why.
+// Row 14: a module that neither declares libraries nor uses its identity is composed exactly as before — the whole
+// declaration: its resources, the filter its port reaches, the contributions it makes — on an engine that keeps
+// libraries or not; on a machine a library reaches, only that library's group is added. A joining module on an older
+// engine is left out, naming why.
 func TestAModuleThatDoesNotJoinIsComposedAsBefore(t *testing.T) {
-	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aPlain(), theRuntime(t)}}
-	before := composeLibraries(t, r, Rendering{})
-	after := composeLibraries(t, r, librariesRendering())
-	if !reflect.DeepEqual(before.Resources, after.Resources) {
-		t.Fatalf("a module that does not join composed otherwise:\n %v\n %v", before.Resources, after.Resources)
+	plain := aPlain()
+	plain.Listens = []Listening{{Port: 8080, From: FromEverywhere, Name: "web", Why: "its page"}}
+	plain.Contributes = map[string]map[string]any{"reverse-proxy": {"host": "plain", "port": 8080}}
+	plain.Requires = []string{"reverse-proxy"}
+	modules := []Manifest{plain, proxy(), {Module: "nftables", Filtering: &Filtering{Into: "/etc/mesh/filter.nft"}},
+		theRuntime(t)}
+	base := Rendering{Mesh: []string{"198.51.100.2"}, OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"}
+	keeping := func(node string) Rendering {
+		with := librariesRendering()
+		with.Mesh, with.OutwardLinks, with.TunnelInterface = base.Mesh, base.OutwardLinks, base.TunnelInterface
+		return with
+	}
+	for _, node := range []string{"far", "ace"} {
+		r := Resolution{Node: node, Account: "jochen", Modules: modules}
+		before := composeLibraries(t, r, base)
+		after := composeLibraries(t, r, keeping(node))
+		if node == "far" {
+			if !reflect.DeepEqual(before, after) {
+				t.Fatalf("on a machine no library reaches, a module that does not join composed otherwise:\n %+v\n %+v",
+					before, after)
+			}
+			continue
+		}
+		groups := after.Groups
+		after.Groups, after.Libraries = nil, nil
+		if !reflect.DeepEqual(before, after) {
+			t.Fatalf("on %s, a module that does not join composed otherwise:\n %+v\n %+v", node, before, after)
+		}
+		if len(groups) == 0 || len(after.Identities) > 0 {
+			t.Fatalf("on the library's home: groups %v, identities %v", groups, after.Identities)
+		}
+		filter := fmt.Sprint(byID(before.Resources)["nftables."+FilteringID()]["content"])
+		if !strings.Contains(filter, "8080") || received(t, before.Resources)[0].From != "plain" {
+			t.Fatalf("the comparison held no filter or contribution of the module: %s", filter)
+		}
 	}
 	if Joins(aPlain()) || !Joins(aRadarr(t)) {
 		t.Fatal("joining is not read from the libraries and the identity")
@@ -326,6 +335,7 @@ func TestTheEngineTakesWhatIsComposedForLibraries(t *testing.T) {
 	for _, node := range []string{"ace", "novox"} {
 		r := Resolution{Node: node, Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
 		with := librariesRendering()
+		with.RunnerJoinsOwnGroups = true // contract 7 (mesh-host #97): the runner on identities, setgid on own directories
 		with.Libraries["books"] = Library{Name: "books", Home: "ace", Root: "/storage/books", Reach: []string{"novox"}}
 		composed := composeLibraries(t, r, with)
 		body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": composed.Resources,
@@ -338,3 +348,82 @@ func TestTheEngineTakesWhatIsComposedForLibraries(t *testing.T) {
 		}
 	}
 }
+
+// novox/hq ADR 0334 §1, §2 (the review of 7ea6d36e, item 2): a joining module's own directories are owned by its user
+// and its own group, not the library's; and the tool runner's account joins the own group of every joining module whose
+// tools run on the machine — sent only to an engine that reads it (link.OwnGroupContract).
+func TestAJoiningModulesOwnDirectoriesAreItsOwnGroups(t *testing.T) {
+	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
+	got := byID(composeLibraries(t, r, librariesRendering()).Resources)
+	if owner := got["radarr.config"]["owner"]; owner != "50020:50020" {
+		t.Errorf("its directory is owned by %v; want its user and its own group", owner)
+	}
+	// ADR 0334 v4: with setgid, so what is made in it later keeps mesh-radarr though the process's primary group is the
+	// library's.
+	if mode := got["radarr.config"]["mode"]; mode != "0750" {
+		t.Errorf("an engine that refuses setgid modes was sent %v", mode)
+	}
+	if env := got["radarr.app"]["env"].(map[string]any); env["PGID"] != "50010" {
+		t.Errorf("its process's primary group is %v; want the library's, so what it makes there keeps the group", env["PGID"])
+	}
+	older := composeLibraries(t, r, librariesRendering())
+	if older.Identities[0].Runner != "" {
+		t.Errorf("an engine that cannot put the runner in a module's own group was told %q", older.Identities[0].Runner)
+	}
+	with := librariesRendering()
+	with.RunnerJoinsOwnGroups = true
+	newer := composeLibraries(t, r, with)
+	if got := newer.Identities[0].Runner; got != "jochen" {
+		t.Errorf("the runner joins %q's own group; want jochen, whose tools it runs", got)
+	}
+	if mode := byID(newer.Resources)["radarr.config"]["mode"]; mode != "2750" {
+		t.Errorf("its directory's mode is %v; want 2750, setgid on its own 0750", mode)
+	}
+}
+
+// novox/hq ADR 0334 §3: a joining module whose tools name a directory whose mode closes it to its group is refused at
+// the module check, naming the directory.
+func TestAToolsDirectoryIsOpenToItsGroup(t *testing.T) {
+	closed := map[string]any{
+		"libraries": []any{map[string]any{"id": "movies", "library": "media", "path": "movies", "use": "read"}},
+		"resources": []any{
+			map[string]any{"id": "config", "type": "directory", "mode": "0700"},
+			map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
+				"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}}},
+		"build": map[string]any{"artifacts": []any{map[string]any{"name": "tools", "kind": "bundle",
+			"language": "go", "system": "arch", "from": "cmd/app", "binary": "app", "loads": []any{"app"},
+			"env": map[string]any{"APP_CONFIG": "${dir:config}/config.xml"}}}}}
+	_, err := ParseManifest(libraryManifest(t, closed))
+	if err == nil || !strings.Contains(err.Error(), "config") || !strings.Contains(err.Error(), "ADR 0334") {
+		t.Fatalf("a tools' directory closed to its group: %v", err)
+	}
+	open := closed
+	open["resources"] = []any{
+		map[string]any{"id": "config", "type": "directory", "mode": "0750"},
+		map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
+			"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}}}
+	if _, err := ParseManifest(libraryManifest(t, open)); err != nil {
+		t.Fatalf("a tools' directory open to its group was refused: %v", err)
+	}
+}
+
+// The review of 7ea6d36e, item 6: a service's unit takes the identity too — `User=${identity:user}` — at the module
+// check and in what is composed.
+func TestAServicesUnitTakesTheIdentity(t *testing.T) {
+	unit := "[Service]\nUser=${identity:user}\nGroup=${identity:group}\nUMask=0002\nExecStart=/usr/bin/importer\n"
+	raw := libraryManifest(t, map[string]any{"resources": []any{
+		map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
+			"volumes": []any{"${library:movies}:/movies"}},
+		map[string]any{"id": "watch", "type": "service", "name": "app-watch", "unit": unit}}})
+	m, err := ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("a unit naming the identity was refused: %v", err)
+	}
+	with := librariesRendering()
+	with.Identities["app"] = ModuleIdentity{Module: "app", UID: 50030}
+	composed := composeLibraries(t, Resolution{Node: "ace", Modules: []Manifest{m}}, with)
+	got := fmt.Sprint(byID(composed.Resources)["app.watch"]["unit"])
+	if !strings.Contains(got, "User=mesh-app\nGroup=mesh-media\n") {
+		t.Fatalf("the unit reads %q", got)
+	}
+}

internal/catalogue/unconsumed_placeholder.go

@@ -61,7 +61,7 @@ var fillers = []filler{
 	{namespace: "access", patterns: []*regexp.Regexp{accessRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file"}}},
 	// A joining module's identity, wherever its resources take values; a library's host path, only in a container's
 	// volumes, whose source libraryProblems holds it to (novox/hq ADR 0328 §5).
-	{namespace: "identity", patterns: []*regexp.Regexp{identityRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file", "run", "command", "user", "name"}}},
+	{namespace: "identity", patterns: []*regexp.Regexp{identityRef}, fields: map[string][]string{"*": {"path", "content", "volumes", "env", "env-file", "run", "command", "user", "name", "unit"}}},
 	{namespace: "library", patterns: []*regexp.Regexp{libraryRef}, fields: map[string][]string{"container": {"volumes"}},
 		why: "a library's path is a host path, filled only in a container's volume source; the process reads the " +
 			"container side its volume gives (novox/hq ADR 0328 §5)"},

internal/inventory/libraries.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 
@@ -179,13 +180,17 @@ func (i *Inventory) LibraryNamed(ctx context.Context, module string) error {
 	return nil
 }
 
-// LibraryPaths is every sub-path a module assigned anywhere asks of each library (§6): what its home keeps.
+// LibraryPaths is every sub-path a module on any machine asks of each library (§6): what its home keeps. A module on a
+// machine is one assigned there or one a requirement pulled in — what the machine was last sent.
 func (i *Inventory) LibraryPaths(ctx context.Context) (map[string][]string, error) {
 	shelf, err := i.Catalogue(ctx)
 	if err != nil {
 		return nil, err
 	}
-	rows, err := i.store.Pool().Query(ctx, `select distinct module from assignment`)
+	// Every module assigned anywhere, and every module a machine was last sent — those a requirement pulled in too.
+	rows, err := i.store.Pool().Query(ctx,
+		`select module from assignment
+		 union select jsonb_object_keys(sent_builds) from node where sent_builds is not null and jsonb_typeof(sent_builds) = 'object'`)
 	if err != nil {
 		return nil, err
 	}
@@ -219,17 +224,20 @@ func (i *Inventory) LibraryPaths(ctx context.Context) (map[string][]string, erro
 type TakenLibrary struct {
 	Library string
 	Home    string
+	Root    string
 	Placed  string
 	By      string
 	Ask     string
 	Warrant string
 	Said    string
+	// Done is whether the engine stated the take's act done: only then is the library taken.
+	Done bool
 }
 
-// TakenLibraries is every library taken, by name.
+// TakenLibraries is every library whose take was started, by name; Done says it is taken.
 func (i *Inventory) TakenLibraries(ctx context.Context) (map[string]TakenLibrary, error) {
 	rows, err := i.store.Pool().Query(ctx,
-		`select library, home, placed, taken_by, ask, warrant, said from kept_library`)
+		`select library, home, root, placed, taken_by, ask, warrant, said, done from kept_library`)
 	if err != nil {
 		return nil, err
 	}
@@ -237,7 +245,7 @@ func (i *Inventory) TakenLibraries(ctx context.Context) (map[string]TakenLibrary
 	out := map[string]TakenLibrary{}
 	for rows.Next() {
 		var t TakenLibrary
-		if err := rows.Scan(&t.Library, &t.Home, &t.Placed, &t.By, &t.Ask, &t.Warrant, &t.Said); err != nil {
+		if err := rows.Scan(&t.Library, &t.Home, &t.Root, &t.Placed, &t.By, &t.Ask, &t.Warrant, &t.Said, &t.Done); err != nil {
 			return nil, err
 		}
 		out[t.Library] = t
@@ -245,23 +253,79 @@ func (i *Inventory) TakenLibraries(ctx context.Context) (map[string]TakenLibrary
 	return out, rows.Err()
 }
 
-// RecordTaken keeps that a library was taken on its home, under the operator's warrant. Once per home and filesystem:
-// a second take of the same keeps the first, and one on another home or filesystem (it moved, and the operator was
-// asked again) replaces it.
-func (i *Inventory) RecordTaken(ctx context.Context, t TakenLibrary) error {
+// RecordTakeStarted keeps that a take of a library was started on its home, under the operator's warrant: the
+// engine said it began. The library is taken only once the engine states the act done (TakeDone). Once per home, root
+// and filesystem: a second start of the same keeps the first, and one on another (it moved, and the operator was asked
+// again) replaces it, not done.
+func (i *Inventory) RecordTakeStarted(ctx context.Context, t TakenLibrary) error {
 	switch {
-	case t.Library == "" || t.Home == "":
-		return errors.New("a taken library names itself and its home")
+	case t.Library == "" || t.Home == "" || !strings.HasPrefix(t.Root, "/"):
+		return errors.New("a taken library names itself, its home and its root")
 	case strings.TrimSpace(t.Warrant) == "" || strings.TrimSpace(t.Ask) == "":
 		return errors.New("a library is taken only on the operator's warrant, and this names none")
 	}
 	_, err := i.store.Pool().Exec(ctx,
-		`insert into kept_library (library, home, placed, taken_by, ask, warrant, said)
-		 values ($1, $2, $3, $4, $5, $6, $7)
+		`insert into kept_library (library, home, root, placed, taken_by, ask, warrant, said, done)
+		 values ($1, $2, $3, $4, $5, $6, $7, $8, false)
 		 on conflict (library) do update
-		   set home = excluded.home, placed = excluded.placed, taken_at = now(), taken_by = excluded.taken_by,
-		       ask = excluded.ask, warrant = excluded.warrant, said = excluded.said
-		 where kept_library.home <> excluded.home or kept_library.placed <> excluded.placed`,
-		t.Library, t.Home, t.Placed, t.By, t.Ask, t.Warrant, t.Said)
+		   set home = excluded.home, root = excluded.root, placed = excluded.placed, taken_at = now(),
+		       taken_by = excluded.taken_by, ask = excluded.ask, warrant = excluded.warrant, said = excluded.said,
+		       done = false
+		 where kept_library.home <> excluded.home or kept_library.root <> excluded.root
+		    or kept_library.placed <> excluded.placed`,
+		t.Library, t.Home, t.Root, t.Placed, t.By, t.Ask, t.Warrant, t.Said)
 	return err
 }
+
+// TakeDone keeps that the engine stated a library's take done under a warrant: the library is taken. A warrant the
+// recorded take was not started under changes nothing.
+func (i *Inventory) TakeDone(ctx context.Context, library, warrant string) error {
+	_, err := i.store.Pool().Exec(ctx,
+		`update kept_library set done = true where library = $1 and warrant = $2 and not done`, library, warrant)
+	return err
+}
+
+// TakeFailed forgets a take the engine stated failed under a warrant, never one done: the library is asked about again.
+func (i *Inventory) TakeFailed(ctx context.Context, library, warrant string) error {
+	_, err := i.store.Pool().Exec(ctx,
+		`delete from kept_library where library = $1 and warrant = $2 and not done`, library, warrant)
+	return err
+}
+
+// SettingsAsOf is a module's settings layers on a machine as they stood at a moment: each layer — the whole mesh's,
+// then the machine's — as it was set then, read from the layer standing now or from its history. What a module held at
+// the build it ran is composed with: the settings it last ran with (novox/hq ADR 0328 §8).
+func (i *Inventory) SettingsAsOf(ctx context.Context, nodeName, module string, at time.Time) ([]catalogue.Layer, error) {
+	node, err := i.NodeByName(ctx, nodeName)
+	if err != nil {
+		return nil, err
+	}
+	var layers []catalogue.Layer
+	for _, scope := range []struct {
+		id   *string
+		from string
+	}{{nil, catalogue.MeshWideLayer}, {&node.ID, nodeName}} {
+		var raw []byte
+		err := i.store.Pool().QueryRow(ctx,
+			`select values from settings
+			  where module = $1 and node is not distinct from $2::uuid and set_at <= $3
+			 union all
+			 select values from (select values from settings_history
+			  where module = $1 and node is not distinct from $2::uuid
+			    and (set_at is null or set_at <= $3) and replaced_at > $3
+			  order by replaced_at asc limit 1) h
+			 limit 1`, module, scope.id, at).Scan(&raw)
+		if errors.Is(err, pgx.ErrNoRows) {
+			continue
+		}
+		if err != nil {
+			return nil, err
+		}
+		values := map[string]any{}
+		if err := json.Unmarshal(raw, &values); err != nil {
+			return nil, err
+		}
+		layers = append(layers, catalogue.Layer{From: scope.from, Values: values})
+	}
+	return layers, nil
+}

internal/inventory/libraries_test.go

@@ -3,6 +3,7 @@ package inventory
 import (
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 	"testing"
 
@@ -157,17 +158,17 @@ func TestALibraryIsDefinedOnceForTheMeshAndNeverOverlaps(t *testing.T) {
 func TestALibraryIsTakenOnceUnderAWarrant(t *testing.T) {
 	inv := fresh(t)
 	ctx := t.Context()
-	if err := inv.RecordTaken(ctx, TakenLibrary{Library: "media", Home: "ace", By: "the operator"}); err == nil {
+	if err := inv.RecordTakeStarted(ctx, TakenLibrary{Library: "media", Home: "ace", By: "the operator"}); err == nil {
 		t.Fatal("a library was recorded taken with no warrant")
 	}
-	first := TakenLibrary{Library: "media", Home: "ace", Placed: "fs-000000000001", By: "the operator", Ask: "c01",
-		Warrant: "c01"}
-	if err := inv.RecordTaken(ctx, first); err != nil {
+	first := TakenLibrary{Library: "media", Home: "ace", Root: "/storage/media", Placed: "fs-000000000001",
+		By: "the operator", Ask: "c01", Warrant: "c01"}
+	if err := inv.RecordTakeStarted(ctx, first); err != nil {
 		t.Fatal(err)
 	}
 	again := first
 	again.Ask, again.Warrant, again.By = "c02", "c02", "someone else"
-	if err := inv.RecordTaken(ctx, again); err != nil {
+	if err := inv.RecordTakeStarted(ctx, again); err != nil {
 		t.Fatal(err)
 	}
 	taken, err := inv.TakenLibraries(ctx)
@@ -179,12 +180,25 @@ func TestALibraryIsTakenOnceUnderAWarrant(t *testing.T) {
 	}
 	moved := first
 	moved.Placed, moved.Ask, moved.Warrant = "fs-0000000000ff", "c03", "c03"
-	if err := inv.RecordTaken(ctx, moved); err != nil {
+	if err := inv.RecordTakeStarted(ctx, moved); err != nil {
 		t.Fatal(err)
 	}
 	if taken, err = inv.TakenLibraries(ctx); err != nil || taken["media"].Ask != "c03" {
 		t.Fatalf("a take on another filesystem: %+v (%v)", taken["media"], err)
 	}
+	// The review of 7ea6d36e, item 3: the root is part of what was taken — a library whose root changed is taken
+	// again, and the new take replaces the old.
+	if got := taken["media"].Root; got != "/storage/media" {
+		t.Fatalf("the take recorded the root %q", got)
+	}
+	rooted := moved
+	rooted.Root, rooted.Ask, rooted.Warrant = "/storage/media2", "c04", "c04"
+	if err := inv.RecordTakeStarted(ctx, rooted); err != nil {
+		t.Fatal(err)
+	}
+	if taken, err = inv.TakenLibraries(ctx); err != nil || taken["media"].Ask != "c04" || taken["media"].Root != "/storage/media2" {
+		t.Fatalf("a take at another root: %+v (%v)", taken["media"], err)
+	}
 }
 
 // novox/hq issue 575: a module registered without the access movies, whose newest build on its branch declares it —
@@ -298,3 +312,82 @@ func TestOnlyABuildOfTheFollowedBranchJudgesAPlacementAhead(t *testing.T) {
 		t.Fatalf("a module with no branch recorded: %v", err)
 	}
 }
+
+// The review of 7ea6d36e, item 4: every sub-path a module asks of a library is kept on its home, whether the module
+// was assigned or pulled in by a requirement (it is in what its machine was last sent).
+func TestTheSubPathsOfModulesPulledInByARequirementAreKept(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	record, err := inv.AddNode(ctx, "ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []catalogue.Manifest{
+		{Module: "radarr", Version: "1", Libraries: []catalogue.LibraryUse{{ID: "m", Library: "media", Path: "movies", Use: "read-write"}}},
+		{Module: "importer", Version: "1", Libraries: []catalogue.LibraryUse{{ID: "i", Library: "media", Path: "incoming", Use: "read-write"}}},
+	} {
+		if err := inv.RegisterModule(ctx, m, Source{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := inv.Assign(ctx, "ace", "radarr"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RecordSentWith(ctx, record.ID, "d1", map[string]string{"radarr": "c1", "importer": "c2"}, 1, 1,
+		Send{Sequence: 1}); err != nil {
+		t.Fatal(err)
+	}
+	paths, err := inv.LibraryPaths(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := append([]string{}, paths["media"]...)
+	sort.Strings(got)
+	if strings.Join(got, ",") != "incoming,movies" {
+		t.Fatalf("the paths kept of media are %v; want the importer's, pulled in by a requirement, too", got)
+	}
+}
+
+// The review of 7ea6d36e, item 5: a take the engine says it started is recorded as started, not taken; it is taken when
+// the engine states the act done under that warrant, and forgotten when it states it failed, so the operator is asked
+// again.
+func TestALibraryIsTakenWhenTheActIsDone(t *testing.T) {
+	inv := fresh(t)
+	ctx := t.Context()
+	started := TakenLibrary{Library: "media", Home: "ace", Root: "/storage/media", Placed: "fs-000000000001",
+		By: "the operator", Ask: "c01", Warrant: "c01"}
+	if err := inv.RecordTakeStarted(ctx, started); err != nil {
+		t.Fatal(err)
+	}
+	taken, err := inv.TakenLibraries(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := taken["media"]; got.Done || got.Ask != "c01" {
+		t.Fatalf("a take only started reads %+v; want started, not done", got)
+	}
+	if err := inv.TakeDone(ctx, "media", "c99"); err != nil {
+		t.Fatal(err)
+	}
+	if taken, _ = inv.TakenLibraries(ctx); taken["media"].Done {
+		t.Fatal("another warrant's act made the take done")
+	}
+	if err := inv.TakeDone(ctx, "media", "c01"); err != nil {
+		t.Fatal(err)
+	}
+	if taken, _ = inv.TakenLibraries(ctx); !taken["media"].Done {
+		t.Fatal("the act done under the take's warrant did not make it taken")
+	}
+	// A failed act forgets a take not done, so it is asked again; never one done.
+	again := started
+	again.Root, again.Ask, again.Warrant = "/storage/media2", "c02", "c02"
+	if err := inv.RecordTakeStarted(ctx, again); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.TakeFailed(ctx, "media", "c02"); err != nil {
+		t.Fatal(err)
+	}
+	if taken, _ = inv.TakenLibraries(ctx); taken["media"].Ask == "c02" {
+		t.Fatalf("a failed take is still recorded: %+v", taken["media"])
+	}
+}

internal/inventory/migrations/0096-a-module-joins-and-a-library-has-a-group.sql

@@ -26,12 +26,14 @@ create table library_group (
 -- **A library taken** (§7). The first time a library's root on its home holds data not yet in its group, the operator
 -- is asked once for that library; on the warrant the node-engine sets the group, group write and setgid under the root,
 -- and the library is taken: kept from then on without asking. The row is the record of that act — on which machine
--- and filesystem, who approved it, under which warrant. A library whose home or filesystem changed since (it moved to
--- another machine or another disk) is not taken by that warrant, and the operator is asked again; a new take replaces
--- the row.
+-- root and filesystem, who approved it, under which warrant. A library whose home, root or filesystem changed since
+-- (it moved to another machine, path or disk) is not taken by that warrant, and the operator is asked again; a new take
+-- replaces the row.
 create table kept_library (
     library  text        primary key,
     home     text        not null,
+    -- The root it was taken at: a library whose root changed since is taken again.
+    root     text        not null check (root like '/%'),
     -- The filesystem the root was on when taken, as the engine names it without a path ("fs-<12 hex>"); empty when
     -- the engine named none.
     placed   text        not null default '',
@@ -40,5 +42,9 @@ create table kept_library (
     ask      text        not null,
     warrant  text        not null,
     -- What the node-engine answered when it started the take.
-    said     text        not null default ''
+    said     text        not null default '',
+    -- Whether the engine has stated the take's act done under this warrant: only then is the library taken. Until
+    -- then the take is under way — the library still waits, and the operator is not asked again — and an act stated
+    -- failed forgets the row, so the operator is asked again.
+    done     boolean     not null default false
 );

internal/link/protocol.go

@@ -451,6 +451,16 @@ const IdentityContract = 5
 // it sent; five, ADR 0325's, is sent nothing new.
 const LibraryContract = 6
 
+// OwnGroupContract is the statement of an engine that also puts the tool runner's account in a joining module's own
+// group, named by an identity's `runner`, and takes a directory's mode with the setgid bit, such as "2750" (novox/hq
+// ADR 0334 §1, §2). Not stated by any engine yet: the engine must add `runner` (an account's name) to its declaration's
+// Identity and put that account in the group mesh-<module>, and accept a directory mode whose first digit is 2.
+const OwnGroupContract = 7
+
+// KindRunner is the tool runner's membership as the engine states it (novox/hq ADR 0334 §2; mesh-host internal/link):
+// `runner:<module>` of a joining module, in its own group; `runner:library:<name>` of no module, in a library's group.
+const KindRunner = "runner"
+
 // KindLibrary is a library's own verdict on its home, as the engine may state it (novox/hq ADR 0328): healthy once
 // kept. Read beside an access verdict naming the library until the engine's shape is settled.
 const KindLibrary = "library"

testdata/beside/CAPTURED

@@ -8,7 +8,7 @@ private addresses. That is acceptable while mesh-controller is private; if it ev
 a second place to clean besides the catalogue itself.
 
 mesh-catalog  b9de001833b1b61b297182b8e3bcdae1cbdeace9  modules/*/module.json, modules/nats/Dockerfile
-mesh-host     d8e785bb4b4bbd4ad99dccec60c588032cd78fa6  examples/foundation-first-node-nats.lock
+mesh-host     7a41e120635b3f7b6cb94cca8b3fc4093e4e6110  examples/foundation-first-node.lock
 mesh-sdk      33917f91ac3cc213b879b32f3c70e2aa70395f98  conformance/events/module-event.json
 
 To move them, from this repository's root, with the two repositories checked out beside it:
@@ -18,7 +18,7 @@ To move them, from this repository's root, with the two repositories checked out
   git -C ../mesh-catalog archive <commit> modules | tar -x -C testdata/beside/mesh-catalog --wildcards \
     'modules/*/module.json' 'modules/nats/Dockerfile'
   find testdata/beside -name module.json -exec mv {} {}.captured \;
-  git -C ../mesh-host archive <commit> examples/foundation-first-node-nats.lock | tar -x -C testdata/beside/mesh-host
+  git -C ../mesh-host archive <commit> examples/foundation-first-node.lock | tar -x -C testdata/beside/mesh-host
 
 and write the commits here. The SDK is captured at the commit go.mod pins for git.novox.be/novox/mesh-sdk/go
 (the last part of its pseudo-version; novox/hq issue 449), which internal/link's conformance test holds it to:

testdata/beside/mesh-host/examples/foundation-first-node.lock

@@ -1,11 +1,17 @@
-// foundation-first-node-nats.lock — what a machine must be before a mesh exists, on the bus being
-// built (novox/hq ADR 0106, design 25).
+// foundation-first-node.lock — what a machine must be before a mesh exists: the one genesis bundle
+// (novox/hq ADR 0331 §2), on the bus the mesh runs on (ADR 0106, ADR 0131, design 25).
 //
-// The same twelve steps as foundation-first-node.lock, with one difference that matters: **the mesh
-// writes its own user list, and at genesis there is no mesh yet to write it.** So this carries the
-// first one — the controller's own account, at a well-known bootstrap password, exactly as the store
-// is reached at `postgres:bootstrap` and the old bus at `guest:guest`. It is rotated with those, and
-// from the controller's first composition onward the file is the controller's to write.
+// The whole bootstrap (novox/hq 03-DESIGN/01-to-be/07-the-foundation.md): a container runtime, a
+// filter, a store, a database per context, those contexts' schemas, the bus with its certificate
+// and its first user list, and the control plane running on top of them.
+//
+// **The mesh writes its own user list, and at genesis there is no mesh yet to write it.** So this
+// carries the first one — the controller's own account — and the control plane's address names the
+// same account. Both say `bootstrap`, and both are placeholders: the installer makes the account's
+// password, puts it in the address and its hash in the list (mesh-host internal/bootstrap
+// rootsecrets.go), and refuses a bundle whose bus connection it does not recognise. Until the first
+// node has enrolled the installer places the list the controller composes; from the bus's adoption
+// as the `nats` module on, the module receives it like any module (ADR 0331 §1, §5).
 //
 // The accounts file is its own file beside the server's configuration, because the server's own
 // settings belong to whoever raises it and the users belong to the mesh (design 25 §4). Both live in
@@ -15,7 +21,18 @@
 //
 // No `verify` on the TLS block, deliberately — that setting makes the server demand a *client*
 // certificate, and nothing in the mesh presents one: a host pins this server's exact certificate and
-// authenticates with a password (ADR 0004, design 25 §4).
+// authenticates with a password (ADR 0004, design 25 §4). The control plane pins it too, through
+// MESH_BROKER_CERTIFICATE, and dials the bus on the machine's own loopback.
+//
+// PINNED BY DIGEST, and the digest is not decoration: a tag can be made to point at a different
+// image, and this file is applied on a machine with no mesh to ask about anything (ADR 0006). The
+// registry prefix is the lab's; the digests are upstream's.
+//
+// The store's data is a NAMED VOLUME, not a directory on the machine. A directory the host
+// creates is owned by root, and the database runs as somebody else inside the container — so it
+// could not write, and the container crash-looped. A named volume lets the image set up its own
+// ownership, and outlives the container, which is what you want for the thing holding the mesh's
+// state.
 
 {
   "declaration": 1,

testdata/store-tests

@@ -43,3 +43,11 @@
 ./internal/inventory TestAPlacementIsJudgedAgainstTheBuildThatBringsTheAccess
 ./internal/inventory TestOnlyABuildOfTheFollowedBranchJudgesAPlacementAhead
 ./cmd/mesh-controller TestALibrarysVerdictIsSaidForTheModulesThatUseIt
+./cmd/mesh-controller TestAHeldModuleIsComposedAsBeforeItJoined
+./cmd/mesh-controller TestALibraryIsTakenOnlyWhenTheEngineSaysTheActIsDone
+./internal/inventory TestTheSubPathsOfModulesPulledInByARequirementAreKept
+./internal/inventory TestALibraryIsTakenWhenTheActIsDone
+./cmd/mesh-controller TestADeliveryWaitsForALibraryAndJudgesTheRest
+./cmd/mesh-controller TestAJoiningModuleIsHeldOnAnEngineOlderThanOwnGroups
+./cmd/mesh-controller TestAHeldModuleKeepsTheSettingsItRanWith
+./cmd/mesh-controller TestARunnersVerdictIsSaidAndJudgedByWhetherTheMoveChangesIt

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -133,7 +133,13 @@ func (d *Directory) validate(where string, _ bool) []string {
 	if d.Path == "" {
 		problems = append(problems, where+": a directory needs a path")
 	}
-	return append(problems, checkMode(where, d.Mode)...)
+	// A directory's mode may carry the setgid bit (2xxx), so what is made beneath it keeps its group (novox/hq ADR
+	// 0334 §1); never setuid or sticky, which mean nothing the mesh asks of a directory it owns.
+	mode := d.Mode
+	if len(mode) == 4 && mode[0] == '2' {
+		mode = "0" + mode[1:]
+	}
+	return append(problems, checkMode(where, mode)...)
 }
 
 // File is a file with literal content. The host renders nothing.
@@ -1564,6 +1570,9 @@ type Identity struct {
 	UID    int    `json:"uid"`
 	GID    int    `json:"gid"`
 	Groups []int  `json:"groups,omitempty"`
+	// Runner is the tool runner's account, put in the module's own group (novox/hq ADR 0334 §2) when its tools run
+	// on this machine. Absent for a module that declares no tools here, and from a controller older than ADR 0334.
+	Runner string `json:"runner,omitempty"`
 }
 
 // Group is one library's group, as the controller allocated it (ADR 0328 §3).
@@ -1707,6 +1716,9 @@ func checkIdentities(ids []Identity, groups []Group) []string {
 					"declaration makes", where, g))
 			}
 		}
+		if id.Runner != "" && !accountName.MatchString(id.Runner) {
+			problems = append(problems, fmt.Sprintf("%s: its runner %q is not an account's name", where, id.Runner))
+		}
 		names[id.Name], uids[id.UID] = true, id.Name
 	}
 	return problems

vendor/modules.txt

@@ -78,7 +78,7 @@ github.com/nats-io/nkeys
 # github.com/nats-io/nuid v1.0.1
 ## explicit
 github.com/nats-io/nuid
-# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261012202816-d8e785bb4b4b
+# github.com/novox/mesh-host v0.0.0 => git.novox.be/novox/mesh-host v0.0.0-20261012222214-7a41e120635b
 ## explicit; go 1.26.0
 github.com/novox/mesh-host/internal/declaration
 github.com/novox/mesh-host/rootsearch
@@ -138,4 +138,4 @@ golang.org/x/text/width
 # golang.org/x/time v0.15.0
 ## explicit; go 1.25.0
 golang.org/x/time/rate
-# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012202816-d8e785bb4b4b
+# github.com/novox/mesh-host => git.novox.be/novox/mesh-host v0.0.0-20261012222214-7a41e120635b