A user unit waits for its account's manager, and lingering is the account's (hq ADR 0177)

An account's manager runs only while it is logged in or lingers. A user-scoped unit
whose manager is not running is now "waiting" rather than failed, its record kept as
it was; its removal is never fatal (kept recorded, retried) and an account that is
gone is forgotten. Whether the manager runs is asked of user@<uid>.service in the
machine's manager: asking the account's own, through --machine, logs it in.

The user shape gains `linger`, set with loginctl, read back from logind's record,
and given back on removal like the shell. Unit files the mesh writes under
~/.config/systemd/user or /etc/systemd/user make that unit the mesh's, and made,
holds and found units are keyed by manager and name, so an account's unit and the
machine's of one name are two units. A service moved between managers gives the old
one back through the manager it was in. OpenRC refuses both.

cmd/mesh-host/main.go

@@ -1487,6 +1487,11 @@ func applyAndKeep(ctx context.Context, opts options, raw []byte, signed *store.D
 		if change.Action == "held" {
 			continue
 		}
+		// Nor is a unit waiting for its account's manager that this machine never applied (novox/hq
+		// ADR 0177); one applied before and waiting now is still the machine's, recorded as it was.
+		if _, recorded := updated.Find(change.ID); change.Action == "waiting" && !recorded {
+			continue
+		}
 		report.Applied = append(report.Applied, change.ID)
 	}
 	// Kept whichever way it went, so a node that is disconnected next minute still knows what it