What runs is the agent's compositions plus the kept declaration's rest: health, filling, take act, directories and the others held out of an apply read it; a restart trusts the node-engine's own haves; the bed tests run off Arch (review round 1)

internal/agent/agent.go

@@ -85,9 +85,10 @@ type Env struct {
 	Remove func(ctx context.Context, module string, others []delivery.Composed) Result
 	// Backup backs a module up before a new composition of it is applied; nil backs up nothing.
 	Backup func(ctx context.Context, module string) Backup
-	// Kept is the resources the node last applied for a module from the declaration it kept before the switch (ADR 0539
-	// §9), as JSON, and whether it held the module. Nil when the node kept none.
-	Kept func(module string) ([]json.RawMessage, bool)
+	// Kept is the resources the node last applied, by module, from the declaration it kept before the switch (ADR 0539
+	// §9), as JSON; the node's own are under NodeModule. Nil when the node kept none. A module the agent does not hold yet
+	// still runs from it.
+	Kept func() map[string][]json.RawMessage
 	// Trusted is the public keys a composition may be signed by: the controller's and the operator's (ADR 0539 §3). A
 	// composition unsigned, signed by another key, or changed after it was signed is refused and nothing of it is
 	// applied. Nil trusts no key, so nothing is applied.
@@ -348,7 +349,8 @@ func (a *Agent) compositionFor(module, fp string) (compNow, bool) {
 	return c, ok
 }
 
-// others are the compositions the node's other modules run now, so what they hold is not taken.
+// others are what the node's other modules run now, so what they hold is not taken: the compositions the agent runs and,
+// for every module the agent does not hold yet, the resources the kept declaration has for it (ADR 0429 §4).
 func (a *Agent) others(except string) []delivery.Composed {
 	var out []delivery.Composed
 	mods := make([]string, 0, len(a.running))
@@ -367,9 +369,44 @@ func (a *Agent) others(except string) []delivery.Composed {
 			out = append(out, c.C)
 		}
 	}
+	if a.env.Kept != nil {
+		kept := a.env.Kept()
+		names := make([]string, 0, len(kept))
+		for m := range kept {
+			if _, held := a.running[m]; !held && m != except {
+				names = append(names, m)
+			}
+		}
+		sort.Strings(names)
+		for _, m := range names {
+			c := delivery.Composed{Node: a.env.Node, Module: m, Resources: kept[m]}
+			if m == NodeModule {
+				c.Module = ""
+			}
+			out = append(out, c)
+		}
+	}
 	return out
 }
 
+// Everything is what the node runs: the compositions the agent runs, and the kept declaration's resources for each module
+// the agent does not hold yet. What the node judges its health by, and what the filling, the take act and the judgement
+// of directories read, is built from it.
+func (a *Agent) Everything() []delivery.Composed {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.others("\x00")
+}
+
+// HoldsNode says whether the agent runs the node's own composition, so the node's parts are its and not the kept
+// declaration's.
+func (a *Agent) HoldsNode() bool {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	h, ok := a.running[NodeModule]
+	return ok && h.Phase != delivery.PhaseRemoved
+}
+
 func (a *Agent) settleOne(ctx context.Context, module string) {
 	a.mu.Lock()
 	w := a.wants[module]
@@ -434,19 +471,24 @@ func (a *Agent) baseline(ctx context.Context, module string, w wantNow, comp com
 			a.mu.Lock()
 			a.prior[module] = true
 			a.mu.Unlock()
-			if h.FP == w.Want.FP && h.Composed == w.Want.Composed &&
-				(h.Phase == "" || h.Phase == string(delivery.PhaseRunning)) {
-				a.mu.Lock()
-				a.running[module] = delivery.Have{FP: h.FP, Composed: h.Composed, Phase: delivery.PhaseRunning}
-				a.mu.Unlock()
-				return true
+			if h.Composed != "" {
+				// This node-engine wrote it: what it says is what runs, and the kept declaration says nothing more. A
+				// failed apply or a different composition is applied again.
+				if h.FP == w.Want.FP && h.Composed == w.Want.Composed &&
+					(h.Phase == "" || h.Phase == string(delivery.PhaseRunning)) {
+					a.mu.Lock()
+					a.running[module] = delivery.Have{FP: h.FP, Composed: h.Composed, Phase: delivery.PhaseRunning}
+					a.mu.Unlock()
+					return true
+				}
+				return false
 			}
 		}
 	}
 	if a.env.Kept == nil {
 		return false
 	}
-	kept, ok := a.env.Kept(module)
+	kept, ok := a.env.Kept()[module]
 	if ok {
 		a.mu.Lock()
 		a.prior[module] = true