Leave the node's own copy of a module's resource out, and carry the kept declaration's filled paths (issue 1945)

The node's own composition and a module's both declared the same files, and
the joined declaration was refused whole ("2 resources declare X"): the
node's own copy is now left out when joining and at the node's own apply, and
said once (1945/AC17). A module still running from the kept declaration now
carries its filled paths, so the filling no longer refuses them as not named
as filled (1945/AC18).

internal/agent/agent.go

@@ -90,6 +90,10 @@ type Env struct {
 	// §9), as JSON; the node's own are under NodeModule. Nil when the node kept none. A module the agent does not hold yet
 	// still runs from it.
 	Kept func() map[string][]json.RawMessage
+	// KeptFilled is the paths the kept declaration names as filled by the provisioner, by the module whose file is at
+	// each (the node's own under NodeModule). A module that still runs from the kept declaration keeps its filled files
+	// filled: without them the filling refused each one as "not named as filled" (issue 1945). Nil names none.
+	KeptFilled func() map[string][]string
 	// Trusted is the public keys a composition may be signed by: the controller's and the operator's (ADR 0539 §3). A
 	// composition unsigned, signed by another key, or changed after it was signed is refused and nothing of it is
 	// applied. Nil trusts no key, so nothing is applied.
@@ -441,6 +445,9 @@ func (a *Agent) others(except string) []delivery.Composed {
 		sort.Strings(names)
 		for _, m := range names {
 			c := delivery.Composed{Node: a.env.Node, Module: m, Resources: kept[m]}
+			if a.env.KeptFilled != nil {
+				c.Filled = a.env.KeptFilled()[m]
+			}
 			if m == NodeModule {
 				c.Module = ""
 			}

internal/agent/agent_test.go

@@ -835,3 +835,18 @@ func TestTheRevisionAWantNamesIsAppliedFromHistory(t *testing.T) {
 		t.Fatalf("the have names %s, want %s", h.Composed, oldDig)
 	}
 }
+
+// 1945/AC18 (unit): a module that still runs from the kept declaration carries the kept declaration's filled paths of
+// its files, so the filling writes them ("not named as filled" for claude-code and screen-lock, 2026-10-25).
+func TestAModuleRunningFromTheKeptDeclarationKeepsItsFilledPaths(t *testing.T) {
+	b := newBed(t)
+	b.kept = map[string][]json.RawMessage{"claude-code": {file("claude-code", "settings", "")}}
+	b.env.KeptFilled = func() map[string][]string {
+		return map[string][]string{"claude-code": {"/tmp/r6/claude-code/settings"}}
+	}
+	a := New(b.env)
+	got := a.Everything()
+	if len(got) != 1 || got[0].Module != "claude-code" || strings.Join(got[0].Filled, ",") != "/tmp/r6/claude-code/settings" {
+		t.Fatalf("what runs from the kept declaration: %+v", got)
+	}
+}