Keep the node's own composition's sealed values in its key and read a policy within the agent's context, so a restart applies nothing again (issue 1126)

cmd/mesh-host/nodeagent.go

@@ -56,6 +56,14 @@ func (w bucketWatch) Watch(ctx context.Context, pattern string) (<-chan agent.Up
 type sessionHaves struct{ session *link.Session }
 
 func (h sessionHaves) Read(ctx context.Context, module string) (agent.Have, bool) {
+	if module == agent.NodeModule {
+		// The node's own key: the digest of its own composition it runs, and what that carries sealed.
+		got, ok := h.session.ReadNodeHave(ctx)
+		if !ok || got.Composed == "" {
+			return agent.Have{}, false
+		}
+		return agent.Have{Module: module, Composed: got.Composed, Sealed: got.Sealed}, true
+	}
 	got, ok := h.session.ReadHave(ctx, module)
 	if !ok {
 		return agent.Have{}, false
@@ -68,7 +76,7 @@ func (h sessionHaves) Write(ctx context.Context, x agent.Have) {
 	if x.Module == agent.NodeModule {
 		// The node's own key holds its facts and the digest of the composition it runs.
 		if x.Phase == "" || x.Phase == string(delivery.PhaseRunning) {
-			h.session.NoteNode(ctx, x.Composed)
+			h.session.NoteNode(ctx, x.Composed, x.Sealed)
 		}
 		return
 	}
@@ -511,6 +519,10 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 			unseal: sealOpener(opts.state),
 			// And what each module's have says it runs sealed: after a restart the agent has applied nothing yet.
 			held: func(module string) []string {
+				if module == agent.NodeModule {
+					got, _ := session.ReadNodeHave(linked)
+					return got.Sealed
+				}
 				got, ok := session.ReadHave(linked, module)
 				if !ok {
 					return nil