What a node keeps of a module as it runs, for a manifest that does not yet say it, is carried on the module's have by module, so the watchman raises its condition (ADR 0601 §4; review round 1, finding 3)

internal/compose/frombus/frombus.go

@@ -156,7 +156,7 @@ type Scope struct {
 	SameValue func(a, b string) (same, known bool)
 	// Kept is told, in words, each module composed as what runs shows because its manifest does not yet say it (the tool
 	// runner, the core's credentials; ADR 0601 §4), so the node says it. Nil: said nowhere.
-	Kept func(words string)
+	Kept func(module, words string)
 }
 
 // InOwn is, of the modules p places on its node, those whose resources the node's own composition it runs
@@ -235,9 +235,9 @@ func input(ctx context.Context, r Reader, mesh Mesh, s Scope, refuse func(module
 	in, err := b.finish(ctx, r, r.Build, mesh, s, b.in, refuse, wanted)
 	if err == nil {
 		// What runs is kept while a manifest does not yet say what shared code no longer infers (ADR 0601 §4).
-		for _, words := range keepWhatRuns(&in, s.Node, s.Running) {
+		for _, k := range keepWhatRuns(&in, s.Node, s.Running) {
 			if s.Kept != nil {
-				s.Kept(words)
+				s.Kept(k.Module, k.Words)
 			}
 		}
 	}

internal/compose/frombus/frombus_test.go

@@ -887,7 +887,7 @@ func whatRunsIsKeptWhileAManifestDoesNotSayIt(t *testing.T) {
 	in := input(false)
 	said := keepWhatRuns(&in, "a", running)
 	if !in.Catalogue["runner-x"].ToolRunner || !in.Catalogue["prov-y"].CoreCredentials || in.Catalogue["app"].ToolRunner ||
-		in.Catalogue["app"].CoreCredentials || len(said) != 2 {
+		in.Catalogue["app"].CoreCredentials || len(said) != 2 || said[0].Module != "prov-y" || said[1].Module != "runner-x" {
 		t.Errorf("what runs was not kept: %+v, said %q", in.Catalogue, said)
 	}
 	in = input(true)

internal/compose/frombus/keep.go

@@ -23,9 +23,9 @@ import (
 // Known by what runs, never by a module's name.
 
 // keepWhatRuns marks, in in, each module placed on node that what runs shows is the tool runner or carries the core's
-// credentials, where its manifest does not say so; it returns, sorted, what it marked, in words. The tool runner is marked
-// only where no placed module's manifest says it is one.
-func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) []string {
+// credentials, where its manifest does not say so; it returns, sorted by module, what it marked, in words. The tool runner is
+// marked only where no placed module's manifest says it is one.
+func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) []KeptAsRuns {
 	placed := assignedOn(*in, node)
 	if len(placed) == 0 || len(running) == 0 {
 		return nil
@@ -60,7 +60,7 @@ func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) [
 			}
 		}
 	}
-	var said []string
+	var said []KeptAsRuns
 	saysRunner := false
 	for _, m := range placed {
 		if man, ok := manifestOn(*in, node, m); ok && catalogue.IsToolRunner(man) {
@@ -68,6 +68,7 @@ func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) [
 		}
 	}
 	mark := func(module string, set func(*catalogue.Manifest), words string) {
+		k := KeptAsRuns{Module: module, Words: words}
 		for i := range in.Nodes {
 			if in.Nodes[i].Name != node {
 				continue
@@ -75,14 +76,14 @@ func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) [
 			if man, ok := in.Nodes[i].Kept[module]; ok {
 				set(&man)
 				in.Nodes[i].Kept[module] = man
-				said = append(said, words)
+				said = append(said, k)
 				return
 			}
 		}
 		if man, ok := in.Catalogue[module]; ok {
 			set(&man)
 			in.Catalogue[module] = man
-			said = append(said, words)
+			said = append(said, k)
 		}
 	}
 	if runner != "" && !saysRunner {
@@ -95,6 +96,11 @@ func keepWhatRuns(in *compose.Input, node string, running []delivery.Composed) [
 				"and its manifest does not say they are the core's credentials (core-credentials): they stay sealed, until its manifest says so", m))
 		}
 	}
-	sort.Strings(said)
+	sort.SliceStable(said, func(i, j int) bool { return said[i].Module < said[j].Module })
 	return said
 }
+
+// KeptAsRuns is one module composed as what runs shows, and why, in words (ADR 0601 §4): its have carries the words.
+type KeptAsRuns struct {
+	Module, Words string
+}