A taken container keeps a found network, a left-out module is kept, and genesis raises the forge as its module declares (hq ADR 0163)

A container may name networks it also joins once created, for the per-machine
setting that keeps a found network while a neighbour still resolves it there:
joined after the run, part of the spec, refused when it cannot be joined.

A declaration may say which modules the mesh left out because a stored setting
cannot compose with its definition. Absence used to read as removal; a left-out
module's records are kept and said, and its holds are not released.

Genesis raises the bootstrap forge under the gitea module's container name, with
its image digest and its data directory mounted at /data, so the module holds it
by the found rule instead of raising a second forge beside it (issue 090). The
network is the one difference left for a take to say. Before this the forge had
no volume: its repositories were the container's, lost with it.

internal/apply/apply.go

@@ -20,6 +20,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -230,6 +231,18 @@ func ApplyKeeping(
 			protecting = append(protecting, orphan)
 			continue
 		}
+		// **A module the mesh left out is not a module the mesh removed** (novox/hq ADR 0163, rule
+		// 6): its resources are absent because a setting stored for it cannot compose, and the
+		// mesh said so by name. What the host wrote for it stays as it is, recorded, until the
+		// module is declared again or unassigned.
+		if module, left := d.LeftOutModuleOf(orphan.ID); left {
+			report.Outcomes = append(report.Outcomes, Outcome{
+				ID: orphan.ID, Type: orphan.Type, Target: orphan.Target,
+				Action: "unchanged", Detail: "kept: " + module + " was left out of this declaration by the mesh, not removed",
+			})
+			log(fmt.Sprintf("  kept %s (%s): %s was left out of this declaration by the mesh, not removed", orphan.ID, orphan.Target, module))
+			continue
+		}
 		orphans = append(orphans, orphan)
 	}
 	ordered := d.Resources
@@ -270,6 +283,11 @@ func ApplyKeeping(
 			if declared[h.ID] {
 				continue
 			}
+			if slices.Contains(d.LeftOut, h.Module) {
+				// Left out, not unassigned (ADR 0163, rule 6): still held for the module, as the
+				// mesh asked.
+				continue
+			}
 			known.Release(h.ID)
 			report.Outcomes = append(report.Outcomes, Outcome{ID: h.ID, Type: h.Kind, Target: h.Target,
 				Action: "forgotten", Detail: "no longer declared; left as found"})
@@ -1526,6 +1544,11 @@ func containerSpecReading(r *declaration.Container, declares, reads map[string]s
 	if r.IP != "" {
 		b.WriteString("ip " + r.IP + "\n")
 	}
+	// The networks it also joins are part of what it is (ADR 0163, rule 4): kept or let go, the
+	// container is recreated, and a neighbour's reach changes with it.
+	for _, n := range r.Networks {
+		b.WriteString("also-on " + n + "\n")
+	}
 	// The cadence is part of what was declared, so a changed schedule is a changed spec — the marker
 	// moves and the install is reported "updated" and re-established. Added only when present, so no
 	// ordinary container's or run-once step's digest moves for a field it does not set.
@@ -1766,6 +1789,15 @@ func applyContainer(ctx context.Context, r *declaration.Container, run Runner,
 	if after.Spec != want {
 		return out, fmt.Errorf("container %s is not the one that was declared after creating it", r.Name)
 	}
+	// The found networks a per-machine setting keeps for it (novox/hq ADR 0163, rule 4), joined
+	// once it runs: a runtime starts a container on one network, and the others are connected.
+	// Refused, not skipped, when one cannot be joined — a neighbour that was promised to keep
+	// reaching this container by name would silently not.
+	for _, n := range r.Networks {
+		if _, err := run(ctx, cri, "network", "connect", n, r.Name); err != nil {
+			return out, fmt.Errorf("container %s could not join the kept network %s: %w", r.Name, n, err)
+		}
+	}
 
 	out.Action = "created"
 	if existed {