Apply an older controller's accesses exactly as before (hq ADR 0325)

The engine delivers before the controller half, and today's controller sends no
identities, users or taken. Keeping now starts only for an access whose folder has
users, or a declaration with identities; every other access is mounted when present
and refused when absent as on main, with nothing made, kept, held or judged. A
leftover whose walk could not run says why, not always that its disk is away.

cmd/mesh-host/kept.go

@@ -83,6 +83,10 @@ func (j *accessJudge) set(d *declaration.Declaration, held map[string]bool) {
 			if !ok || held[a.ID] || strings.HasPrefix(a.ID, declaration.AdoptionPrefix) {
 				continue
 			}
+			// An older controller's access is judged by nothing, as before ADR 0325: no state is said of it.
+			if !apply.Keeps(d, a.Path) {
+				continue
+			}
 			at := strings.LastIndex(a.ID, ".")
 			if at <= 0 {
 				continue

cmd/mesh-host/kept_test.go

@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/novox/mesh-host/internal/declaration"
 	"github.com/novox/mesh-host/internal/link"
@@ -47,3 +48,23 @@ func TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind(t *testing.T) {
 		t.Fatalf("the reason names the path: %s", v.reason)
 	}
 }
+
+// An older controller's accesses (no users, no identities) are judged by nothing, as before ADR 0325: the statement
+// carries no resource for them, waiting, unknown or kept-entries.
+func TestAnOlderControllersAccessesSayNothing(t *testing.T) {
+	dir := t.TempDir()
+	d, err := declaration.Parse([]byte(`{"declaration":1,"resources":[
+	  {"id":"radarr.library","type":"access","path":"` + filepath.Join(dir, "library") + `","mode":"read-write"},
+	  {"id":"plex.movies","type":"access","path":"` + filepath.Join(dir, "absent") + `"}]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(filepath.Join(dir, "library"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	j := newAccessJudge()
+	j.set(d, nil)
+	if vs, _ := j.look(time.Now()); len(vs) != 0 {
+		t.Fatalf("an older controller's accesses are judged: %+v", vs)
+	}
+}