A stopped tool drops its membership handler and a stopped bundle starts no copy on a call, so a replaced bundle's old tools stay gone (issue 1945, review round 2)

Its events are refused before the old bundle stops, the bundle watch follows a directory made between
its stat and its watch, and a bundle's reason is read without node's colour codes.

node-tools/internal/bus/bus.go

@@ -602,9 +602,13 @@ func (c *Conn) HandleCalled(key string, h CalledHandler) (func(), error) {
 	}
 	var mu sync.Mutex
 	var stops []func()
+	stopped := false
 	serve := func() {
 		mu.Lock()
 		defer mu.Unlock()
+		if stopped {
+			return
+		}
 		for _, s := range stops {
 			s()
 		}
@@ -618,14 +622,18 @@ func (c *Conn) HandleCalled(key string, h CalledHandler) (func(), error) {
 		}
 	}
 	serve()
-	c.OnMembership(func(m Membership) {
+	// Its stop drops the membership handler too: a handler left behind would bind the stopped tool again
+	// on the module's next membership, and call a handler whose bundle was replaced (issue 1945).
+	unfollow := c.onMembership(func(m Membership) {
 		if m.Module == module {
 			serve()
 		}
 	})
 	return func() {
+		unfollow()
 		mu.Lock()
 		defer mu.Unlock()
+		stopped = true
 		for _, s := range stops {
 			s()
 		}