The sandbox fails a node whose change refuses a module the node-engine did not hold, in that module's words, instead of passing it with the rest composed (issue 774, review of the sandbox input)

internal/compose/frombus/frombus.go

@@ -604,7 +604,21 @@ func ComposeSent(in compose.Input, node string) (map[string]delivery.Composed, b
 		held = map[string]string{}
 	}
 	out, _, _, err := composeEach(in, node, c.Builds, false, c.Running, held, nil)
-	return out, true, err
+	if err != nil {
+		return nil, true, err
+	}
+	// A module the sandbox held that the node-engine did not is the change refusing it: the node does not compose, said
+	// in that module's words, never passed with the rest composed (issue 774, review of the sandbox input).
+	var refused []string
+	for _, m := range sortedKeys(held) {
+		if _, was := c.Held[m]; !was {
+			refused = append(refused, m+": "+held[m])
+		}
+	}
+	if len(refused) > 0 {
+		return nil, true, fmt.Errorf("on %s the change refuses %s", node, strings.Join(refused, "; "))
+	}
+	return out, true, nil
 }
 
 // Plans is the provisioning plan of each module handed to the provisioner on the scope's node, composed from the bus