A have waiting for a yes says whether the move changes the build alone: the composer composes the build the module runs with today's settings and secrets and the agent compares it with what runs, so a release's Approve answers it and a changed setting is still asked (ADR 0601 §1)

internal/agent/agent_test.go

@@ -1288,6 +1288,17 @@ func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(
 		}
 		return catalogue.PolicyRoll
 	}
+	// ADR 0601 §1: what runs composed today. rec's build composed again is what it runs, so its move changes the build alone;
+	// db's is not (a setting changed too).
+	b.env.ComposedToday = func(_ context.Context, m, fp string) (string, bool) {
+		switch m {
+		case "rec":
+			return "sha256:" + strings.Repeat("8", 64), fp == fpOf("d")
+		case "db":
+			return "sha256:" + strings.Repeat("6", 64), true
+		}
+		return "", false
+	}
 	// The bucket's revisions of each key, as the verb composition reads them (issue 774).
 	var historyMu sync.Mutex
 	history := map[string][]Update{}
@@ -1452,6 +1463,9 @@ func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(
 		h := b.haves.last("db")
 		return h.Phase == string(delivery.PhaseWaitingYes) && h.Waits == ddigMoved
 	})
+	if h := b.haves.last("db"); h.BuildAlone {
+		t.Errorf("a revision at the build it runs is said to change the build alone: %+v", h)
+	}
 	// The verb composition says why it waits: the revision that waits, what runs, the judgement, and with diff the
 	// container it recreates; the revision that runs, asked by its digest, is no move (issue 774).
 	keep(dk, draw)
@@ -1508,7 +1522,8 @@ func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(
 	for _, row := range []struct {
 		module, fp, composed, waits string
 		sealed                      delivery.Seals
-	}{{"db", fp, "", ddig2, nil}, {"rec", recFP, recDig, rdig, delivery.Seals{"rec.key#sealed": `{"box":"rec"}`}}} {
+		alone                       bool
+	}{{"db", fp, "", ddig2, nil, false}, {"rec", recFP, recDig, rdig, delivery.Seals{"rec.key#sealed": `{"box":"rec"}`}, true}} {
 		eventually(t, row.module+"'s move did not wait for a yes", func() bool {
 			h := b.haves.last(row.module)
 			return h.Phase == string(delivery.PhaseWaitingYes) && h.Waits == row.waits
@@ -1518,6 +1533,9 @@ func TestTheNodesOwnCompositionIsAppliedWhenItDiffersAndARecordMoveWaitsForAYes(
 			(row.sealed != nil && !maps.Equal(h.Sealed, row.sealed)) {
 			t.Errorf("%s's have waiting for a yes does not keep what runs: %+v", row.module, h)
 		}
+		if h.BuildAlone != row.alone {
+			t.Errorf("%s's have waiting for a yes says build alone %v, want %v", row.module, h.BuildAlone, row.alone)
+		}
 	}
 	if got := b.appliedList(); len(got) != applied {
 		t.Fatalf("a move waiting for a yes was applied: %v", got)