A held module is no dependence of its neighbours: its hold stops spreading (issue 1126)

novox's seed p-20261028t231141-ec84b4 refused 11 modules "what it composes of ..., held, is not what runs of them":
de-spiegel's hold spread through mailu to postgres, nftables and route-proxy, and from postgres to every consumer, and
gitea, held so, refused the node: "its credential of postgres-database is handed to the provisioner and the module is
not: nothing would fill it". Three rounds each moved the error. The kind: a held module still took part in the
composition as a dependence, so its hold spread.

- The quick fix: let heldAsToday also follow dependsOnHeld's words, and skip the handed refusal for gitea. It moves the
  error once more and leaves every node's applying path holding consumers.
- The thorough fix, chosen: a held module composes only as what runs of it. composeEach no longer compares the
  composition with each held module as its stub (dependsOnHeld removed): a consumer or collector composes against what
  runs of the held module like any other module, and a real difference is still a named difference in the answer, a
  module's own refusal still its refusal. A stub (compose.Stub, catalogue.Manifest.Stubbed) leaves the credentials and
  own secrets it would hand the provisioner out of its plan as they run, never refused for want of a plan. Only what a
  held module's new manifest says to others in their own files is still held behind it (dependents: the provider of
  what it contributes to, the filter where it listens), which heldAsToday already follows.

Tests: rows added to existing tests (a held provider with a binding consumer, which the old code held in the seed's
words; a held feeder of a collector; a held module with a handed credential and own secret). No new test function.

go/compose/frombus/answer_rows_test.go

@@ -433,8 +433,8 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 
 	// (G) A held module that runs a composition of its own (review of the apply, round 1, finding 2): what the others
 	// compose of it is what runs, never its stub's. site listens on 8080, placed at the machine's 20005, and its own
-	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. A module whose
-	// composition depends on how site is held (here the filter) is held with it.
+	// secret was never issued here: held, the filter must not open 8080 and drop the 20005 that runs. The filter, which
+	// reads what site's manifest listens on, is held with it (dependents).
 	site := []byte(`{"module":"site","version":"1","capabilities":["container-runtime"],` +
 		`"listens":[{"port":8080,"from":"mesh","why":"the site"}],"own-secrets":{"key":"${dir:state}/key"},` +
 		`"resources":[{"id":"state","type":"directory","path":"/var/lib/site","mode":"0700"},` +
@@ -470,6 +470,53 @@ func answerNamesEveryRefusalAndLeavesAnOldBuildToTheNode(t *testing.T) {
 			}
 		}
 	}
+	// (G2) Issue 1126, the spreading hold: a held module is no dependence of its neighbours. site, held, provides page, and
+	// app requires and binds it: app composes against what runs of site and is not held (novox's seed held every postgres
+	// consumer behind de-spiegel's hold, "what it composes of …, held, is not what runs of them").
+	provider := []byte(strings.Replace(string(site), `"listens":`, `"provides":[{"name":"page","scope":"node"}],"serves":{"page":{"port":8080}},"listens":`, 1))
+	app := []byte(`{"module":"app","version":"1","capabilities":["systemd"],"requires":["page"],"binds":{"page":"/etc/app/page.json"},` +
+		`"resources":[{"id":"service","type":"service","unit":"app.service","state":"running","boot":"enabled"}]}`)
+	b2 := mk("lemurs", overlay.Name, "site", "nft", "app")
+	for m, raw := range map[string][]byte{"site": provider, "nft": nft, "app": app} {
+		b2.manifests[delivery.ManifestDigest(raw)] = raw
+		b2.modules[m] = delivery.Module{Manifest: delivery.ManifestDigest(raw)}
+	}
+	p2 := b2.placements["n1"]
+	p2.Decided.Endpoint = "n1.example:51820"
+	for i := range p2.Modules {
+		if p2.Modules[i].Module == "site" {
+			p2.Modules[i].Ports = map[string]int{"8080": 20005}
+		}
+	}
+	b2.placements["n1"] = p2
+	b2.records["n1"] = rec
+	b2.held = true
+	fps["app"] = fp("9")
+	got, _, held, err = Compose(ctx, b2, Mesh{}, Scope{Node: "n1", Running: []delivery.Composed{siteRuns}}, fps)
+	appKey, _ := delivery.ComposedKey("n1", "app", fps["app"])
+	if _, composed := got[appKey]; err != nil || held["site"] == "" || held["app"] != "" || !composed {
+		t.Errorf("a consumer of held site: %v, held %v; want site held, and app composed against what runs of it", err, held)
+	}
+	if bound, _ := json.Marshal(got[appKey].Resources); !strings.Contains(string(bound), "20005") {
+		t.Errorf("app's binding does not reach held site where it runs (20005): %s", bound)
+	}
+	delete(fps, "app")
+	// A held feeder of a collector holds no collector: its items reach their collection through its own plan, which it
+	// keeps as it runs. Only a provider it contributes to in that provider's own files is held behind it (the proxy its
+	// routes), as is the filter where it listens.
+	withCollector := compose.Input{Catalogue: map[string]catalogue.Manifest{
+		"feeder": {Module: "feeder", Items: []catalogue.Item{{Collection: "routes", Content: "x"}}},
+		"col":    {Module: "col", Collections: []catalogue.Collection{{Name: "routes"}}},
+		"proxy":  {Module: "proxy", Provides: []catalogue.Offer{{Name: "route"}}}},
+		Nodes: []compose.Node{{Name: "n1", Assigned: []string{"feeder", "col", "proxy"}}}}
+	feeder := withCollector.Catalogue["feeder"]
+	if d := dependents(withCollector, "n1", feeder, map[string]string{"feeder": "held"}); len(d) != 0 {
+		t.Errorf("a held feeder of a collector holds %v, want none", d)
+	}
+	feeder.Contributes = map[string]map[string]any{"route": {"name": "x"}}
+	if d := dependents(withCollector, "n1", feeder, map[string]string{"feeder": "held"}); !reflect.DeepEqual(d, []string{"proxy"}) {
+		t.Errorf("a held module contributing routes holds %v, want the proxy", d)
+	}
 	// (H) Review of the apply, round 2: a held module is composed from its new manifest, so what the others read of its
 	// manifest (its listens, what it contributes) may not be what runs. site's new manifest moves it to 9090 while the
 	// build that runs listens on 8080: the filter, the holder of what site listens on, is held with it, and nothing