The running provisioner account is kept only for a client held this pass, and rows hold the guard (issue 774, review)

The review removed the guard and the suite still passed. The guard is now provisionerHeld, a placed client held as
its stand-in, rather than any placed client, so one placed and not held that composes no account keeps none stale.
Rows in the held client's table: the client taken out of the node's placement while what runs names the account, read
from the running own composition and from the client's running process, names no account; a placed client whose
process names no user names none. With the guard removed the first three fail; with it reduced to "placed", the last.

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn

internal/compose/rendering.go

@@ -74,10 +74,10 @@ func (c *composer) places(nodeName string, resolved Resolved) (Placed, error) {
 	// not sent the field they would refuse.
 	r.Hands = takesHanded(node)
 	r.Provisioner = provisionerAccount(plan)
-	if r.Provisioner == "" && provisionerPlaced(plan) {
-		// The provisioner's client is placed here but composes no account this pass (held as its stub, which runs no
-		// process of its own composition): it keeps running as it runs, so the account it runs as stays named, and every
-		// module stays handed to it.
+	if r.Provisioner == "" && provisionerHeld(plan) {
+		// The provisioner's client is placed here and held this pass (its stub, or carried as it runs, composes no process
+		// of its own): it keeps running as it runs, so the account it runs as stays named, and every module stays handed
+		// to it. A client not held that composes no account, or none placed, names none: no stale account is kept.
 		r.Provisioner = node.RunningProvisioner
 	}
 	r.Assigned = node.Handed
@@ -196,11 +196,11 @@ func provisionerAccount(plan catalogue.Resolution) string {
 	return ""
 }
 
-// provisionerPlaced says the plan places a module claiming the provisioner client's seat on the machine, whether or not
-// it composes the client's process this pass.
-func provisionerPlaced(plan catalogue.Resolution) bool {
+// provisionerHeld says the plan places a module claiming the provisioner client's seat on the machine that this pass
+// holds (its stand-in: Stub, or Carried as it runs), which composes none of the client's process.
+func provisionerHeld(plan catalogue.Resolution) bool {
 	for _, m := range plan.Modules {
-		if m.ClaimsSeat(NodeProvisionerSeat) {
+		if m.Stubbed && m.ClaimsSeat(NodeProvisionerSeat) {
 			return true
 		}
 	}