Revert L3 (mesh-host, merge 0a4c35f): its node-engine removed every held module on novox, the bus server among them, at 08:54 CET on 2026-10-29 (issue 774)

L3 lands again with two fixes: a held module is never removed, and the grants cover L3's new subjects.

internal/selfcompose/selfcompose_test.go

@@ -3,7 +3,6 @@ package selfcompose
 import (
 	"context"
 	"crypto/sha256"
-	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -1220,32 +1219,6 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		}
 	}
 	b.mu.Unlock()
-
-	// L3 s7 (ADR 0550 §2): the node asks the vault for its own certificate only when a module placed here asks for one
-	// and its record holds none from an authority it trusts; once per serving key.
-	certBus := newFakeBus()
-	certAsks := 0
-	certEnv := certBus.env()
-	certEnv.Certify = func(context.Context) error { certAsks++; return nil }
-	certEnv.VaultAuthority = func() string { return "" }
-	cc := New(certEnv)
-	withCert := `{"module":"web","version":"1","certificate":{"into":"/etc/web/tls.crt"}}`
-	cdigest := delivery.ManifestDigest([]byte(withCert))
-	cc.manifests[digest] = []byte(lemurs)
-	cc.manifests[cdigest] = []byte(withCert)
-	cc.modules = map[string]delivery.Module{"lemurs": {Manifest: digest}, "web": {Manifest: cdigest}}
-	cc.records["n1"] = delivery.NodeRecord{Node: "n1", ServingKey: base64.StdEncoding.EncodeToString(make([]byte, 32))}
-	onlyLemurs := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "lemurs"}}}
-	cc.certifyIfWanted(context.Background(), reader{c: cc}, onlyLemurs)
-	if certAsks != 0 {
-		t.Errorf("no module asks for a certificate, and the vault was asked %d times", certAsks)
-	}
-	withWeb := delivery.Placement{Node: "n1", Modules: []delivery.PlacedModule{{Module: "lemurs"}, {Module: "web"}}}
-	cc.certifyIfWanted(context.Background(), reader{c: cc}, withWeb)
-	cc.certifyIfWanted(context.Background(), reader{c: cc}, withWeb)
-	if certAsks != 1 {
-		t.Errorf("a module asks for a certificate: the vault was asked %d times, want once", certAsks)
-	}
 }
 
 // patternBus is a bus whose every watch gets the updates of its bucket matching its pattern, as the bus's own watches