The node's composer asks the vault's own for its modules' secrets sealed to its key, and keeps a value first had while its generation stands; two agent tests folded to hold the count (issue 1126, ADR 0550 §5)

internal/agent/agent_test.go

@@ -327,6 +327,7 @@ func TestStartingOnWhatTheKeptDeclarationHoldsAppliesNothing(t *testing.T) {
 
 // What the node-engine itself last applied is what runs after a restart, not the kept declaration.
 func TestStartingOnItsOwnHaveAppliesNothing(t *testing.T) {
+	t.Run("says the have again", testStartingOnItsOwnHaveSaysTheHaveAgainSoItsHealthIsThisEngines)
 	b := newBed(t)
 	fp := fpOf("a")
 	ck, craw, dig := composition(t, "web", fp, false, file("web", "x", "1"))
@@ -346,7 +347,7 @@ func TestStartingOnItsOwnHaveAppliesNothing(t *testing.T) {
 // it and writes the health this engine judges. Not said, its key kept the health an older engine wrote: xorg's have on
 // g14 and shanks said unknown from before the engine said a module with nothing to judge ok, and the assigner held every
 // module requiring x11-display back for it (2026-10-25).
-func TestStartingOnItsOwnHaveSaysTheHaveAgainSoItsHealthIsThisEngines(t *testing.T) {
+func testStartingOnItsOwnHaveSaysTheHaveAgainSoItsHealthIsThisEngines(t *testing.T) {
 	b := newBed(t)
 	fp := fpOf("a")
 	ck, craw, dig := composition(t, "xorg", fp, false, file("xorg", "x", "1"))
@@ -599,6 +600,7 @@ func TestTheNodesOwnCompositionComesBeforeAnyModules(t *testing.T) {
 // R6-A AC9: a composition signed by either trusted key is applied; one signed by another key, one changed after it was
 // signed and one unsigned are refused and nothing of them is applied (ADR 0539 §3).
 func TestOnlyACompositionSignedByATrustedKeyIsApplied(t *testing.T) {
+	t.Run("with no trusted key", testWithNoTrustedKeyNothingIsApplied)
 	b := newBed(t)
 	stop := b.run()
 	defer stop()
@@ -649,7 +651,7 @@ func TestOnlyACompositionSignedByATrustedKeyIsApplied(t *testing.T) {
 }
 
 // With no key trusted, nothing is applied: a node that does not know its signers fails closed.
-func TestWithNoTrustedKeyNothingIsApplied(t *testing.T) {
+func testWithNoTrustedKeyNothingIsApplied(t *testing.T) {
 	b := newBed(t)
 	b.env.Trusted = nil
 	stop := b.run()