Name a filesystem by its kernel id, never its device name (hq ADR 0325 fourth review)

An ext4 or xfs library mounted by UUID can come back from a reboot as another device
(/dev/sdb1 as /dev/sdc1); naming the filesystem by mountinfo's source read that as a
move, stripped the warranted library's entries and asked for a new Approve. A
filesystem is now named by statfs's f_fsid (from the UUID, or the ZFS dataset), its
type and its mount point. Entries left on the filesystem a folder is on now are
merged back or held, never walked away, and a TakenOn naming a mount point is not
taken.

internal/store/kept.go

@@ -66,7 +66,7 @@ type KeptFolder struct {
 	Placed string `json:"placed,omitempty"`
 	// TakenOn names, as Placed does, the filesystem the operator's warrant was carried out on (ADR 0325 §8): the
 	// controller's word that the folder was taken holds for that filesystem alone, and a folder moved to another
-	// asks again. A record written before held the mount point here, and is read as that mount's name.
+	// asks again. One that names no filesystem this way (a mount point, from an unmerged build) is not taken.
 	TakenOn string `json:"taken_on,omitempty"`
 	// Left is the entries the mesh added on a filesystem no longer at the folder (a disk mounted over it, or
 	// one gone): taken out by a drop walk once that filesystem holds the folder again, said until then.
@@ -83,8 +83,11 @@ type KeptFolder struct {
 
 // KeptLeft is the mesh's entries left on one filesystem: its mount point and whose entries they are.
 type KeptLeft struct {
-	Mount string     `json:"mount"`
-	Users []KeptUser `json:"users"`
+	Mount string `json:"mount"`
+	// Placed names that filesystem as KeptFolder.Placed does: entries left on the filesystem the folder is on
+	// now are the folder's own, never walked away.
+	Placed string     `json:"placed,omitempty"`
+	Users  []KeptUser `json:"users"`
 }
 
 // KeptAct is one walk under a kept folder, as the engine records it. Counts only: never a path.