The node keeps the mesh's own certificate it applies, from its kept declaration at start, for its record; one agent test folded to hold the count (issue 1126, ADR 0555 §3)

cmd/mesh-host/nodeagent.go

@@ -404,6 +404,15 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 		}
 		var ag *agent.Agent
 		kept := keptOnce(opts, signer)
+		// The mesh's own certificate the declaration kept from before carries, kept for the record before this machine
+		// composes its own (ADR 0555 §3): without it a module that asks for a certificate would be stood in for.
+		if byModule, _ := kept(); byModule != nil {
+			for module, resources := range byModule {
+				if err := keepAuthority(opts.state, delivery.Composed{Module: module, Resources: resources}); err != nil {
+					say("the mesh's certificate the kept declaration carries could not be kept for this machine's record: " + err.Error())
+				}
+			}
+		}
 		// The bus's user list, written alone from the newest composition of the bus module (ADR 0547 §8): on every
 		// node, and a node whose compositions carry no list writes nothing.
 		users := userListFollower(opts, session, composedBucket, trustedKeys(opts, signer), say, func() {
@@ -462,6 +471,12 @@ func nodeAgent(ctx context.Context, opts options, signer ed25519.PublicKey, sess
 					res = applyComposition(actx, opts, held, others, sched, say)
 				}
 				done()
+				// The mesh's own certificate it carries is kept for this machine's record (ADR 0555 §3).
+				if !res.Failed {
+					if err := keepAuthority(opts.state, c); err != nil {
+						say("the mesh's certificate in " + c.Module + "'s composition could not be kept for this machine's record: " + err.Error())
+					}
+				}
 				// An apply of the bus module may write an older list than the newest composition holds: looked at again.
 				if module, _ := users.State(); module != "" && module == c.Module {
 					users.Again()