The provisioner client's account stays named while the client is held: a held client keeps the node's handing (issue 774)

provisionerAccount reads the user of the client's process from this pass's plan, and a client held as its stub (or
carried as it runs) composes no process: on ace, 2026-11-04 01:29 to 01:33, the node's own composition named no
account, the node-engine refused every filled write, and no module was handed (postgres's consumers, restic, power).
A node now carries the account its client runs as (Node.RunningProvisioner: its own composition's account as it runs,
else the user of the client's running process), and a placed client that composes none this pass keeps it. A row holds
the client in the provisioned mesh, both ways: the account stays and restic keeps its filled files; both were lost
before.

Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn

internal/compose/frombus/frombus.go

@@ -234,6 +234,7 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 	}
 	in, err := b.finish(ctx, r, r.Build, mesh, s, b.in, refuse, wanted)
 	if err == nil {
+		runningProvisioner(&in, s.Node, s.Running)
 		// What runs is kept while a manifest does not yet say what shared code no longer infers (ADR 0601 §4).
 		for _, k := range keepWhatRuns(&in, s.Node, s.Running) {
 			if s.Kept != nil {
@@ -1231,3 +1232,38 @@ func withoutHeldData(in compose.Input, node string) compose.Input {
 	}
 	return out
 }
+
+// runningProvisioner names, on node, the account its provisioner client runs as now (compose.Node.RunningProvisioner): the
+// account its own composition as it runs names, else the user of the running process of the module that runs the client.
+func runningProvisioner(in *compose.Input, node string, running []delivery.Composed) {
+	account := ""
+	for _, c := range running {
+		if c.Module == "" && c.Own.Provisioner != "" {
+			account = c.Own.Provisioner
+		}
+	}
+	for _, c := range running {
+		if account != "" {
+			break
+		}
+		man, ok := in.Catalogue[c.Module]
+		if c.Module == "" || !ok || !man.ClaimsSeat(compose.NodeProvisionerSeat) {
+			continue
+		}
+		for _, raw := range c.Resources {
+			var r struct {
+				Type string `json:"type"`
+				User string `json:"user"`
+			}
+			if json.Unmarshal(raw, &r) == nil && r.Type == "process" && r.User != "" && r.User != "root" {
+				account = r.User
+				break
+			}
+		}
+	}
+	for i := range in.Nodes {
+		if in.Nodes[i].Name == node {
+			in.Nodes[i].RunningProvisioner = account
+		}
+	}
+}

internal/compose/frombus/frombustest/frombustest_test.go

@@ -204,6 +204,48 @@ func TestTheProvisionedMeshHandsAPlanWithItsProvision(t *testing.T) {
 	if fetched-archives != 1 {
 		t.Errorf("restic's archive was read %d times over two compositions, want once", fetched-archives)
 	}
+
+	// Issue 774 (ace, 2026-11-04 01:29): the provisioner client held as its stub (its build not done, so the node keeps
+	// running what it runs) keeps the account the node's own composition names, and restic stays handed to it with its
+	// plan; without it every filled write was refused and no module was handed.
+	if b, err = Provisioned(); err != nil {
+		t.Fatal(err)
+	}
+	fps, ownKey := FPs(), ""
+	ownKey, _ = delivery.ComposedNodeKey(Node)
+	resticKey, _ := delivery.ComposedKey(Node, "restic", fps["restic"])
+	before, _, _, err := frombus.Compose(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node}, fps)
+	account := before[ownKey].Own.Provisioner
+	if err != nil || account == "" || len(before[resticKey].Filled) == 0 {
+		t.Fatalf("the node composes with its client: account %q, restic's filled files %v: %v", account, before[resticKey].Filled, err)
+	}
+	var running []delivery.Composed
+	for _, c := range before {
+		running = append(running, c)
+	}
+	for _, own := range []bool{true, false} {
+		runs := running
+		if !own { // what runs names no account of its own: the client's running process says it
+			runs = nil
+			for _, c := range running {
+				if c.Module == "" {
+					c.Own.Provisioner = ""
+				}
+				runs = append(runs, c)
+			}
+		}
+		b.Builds["mesh-provisioner-client "+fps["mesh-provisioner-client"]] = &delivery.BuilderBuild{State: delivery.BuildBuilding}
+		after, _, held, err := frombus.Compose(context.Background(), b, frombus.Mesh{}, frombus.Scope{Node: Node, Running: runs}, fps)
+		if _, isHeld := held["mesh-provisioner-client"]; err != nil || !isHeld {
+			t.Fatalf("the client with no done build is not held: %v %v", held, err)
+		}
+		if got := after[ownKey].Own.Provisioner; got != account {
+			t.Errorf("the client held (account from its own composition: %v): the node's own names %q, want %q", own, got, account)
+		}
+		if !reflect.DeepEqual(after[resticKey].Filled, before[resticKey].Filled) {
+			t.Errorf("the client held (account from its own composition: %v): restic's filled files %v, want %v", own, after[resticKey].Filled, before[resticKey].Filled)
+		}
+	}
 }
 
 // statesOf is the bus b as a module's read states hold it.