Keep the node's own composition's sealed values in its key and read a policy within the agent's context, so a restart applies nothing again (issue 1126)

internal/selfcompose/selfcompose.go

@@ -453,11 +453,10 @@ func (c *Composer) runningBox(box string) string {
 	}
 	if c.env.Held != nil {
 		c.mu.Lock()
+		// The node's own key among them (agent.NodeModule): its core boxes, as its last run said them.
 		modules := make([]string, 0, len(c.wants))
 		for m := range c.wants {
-			if m != agent.NodeModule {
-				modules = append(modules, m)
-			}
+			modules = append(modules, m)
 		}
 		c.mu.Unlock()
 		sort.Strings(modules)
@@ -514,15 +513,16 @@ func (c *Composer) builtManifest(ctx context.Context, module, fp string) (string
 }
 
 // Policy is a module's upgrade policy as its manifest at the indexer's trunk derives it (catalogue.DerivedUpgrade), for
-// the agent's judgement of a move (ADR 0547 §3); empty when the manifest is not known or cannot be read.
-func (c *Composer) Policy(module string) string {
+// the agent's judgement of a move (ADR 0547 §3); empty when the manifest is not known or cannot be read. The manifest is
+// read within ctx, the agent's (review of L2, round 1, finding 5), so a stopping agent stops the read.
+func (c *Composer) Policy(ctx context.Context, module string) string {
 	c.mu.Lock()
 	m, ok := c.modules[module]
 	c.mu.Unlock()
 	if !ok || m.Manifest == "" {
 		return ""
 	}
-	raw, err := reader{c: c}.Manifest(context.Background(), m.Manifest)
+	raw, err := reader{c: c}.Manifest(ctx, m.Manifest)
 	if err != nil {
 		return ""
 	}