Function placement_group 

pub fn placement_group(
    ws: &WorkloadSpec,
    declared: &[WorkloadConfig],
) -> Vec<WorkloadSpec>

The workloads that must be placed together with ws: the transitive closure of local requirement edges over WorkloadSpec::effective_requirements, starting at the requirer (R860-T4 / W338 §“Each member keeps its own mesh identity”).

Only local binds. prefer-local explicitly “never blocks placement” (W338’s locality table) and anywhere is an ordinary service dependency — treating either as a co-scheduling constraint would turn every depends_on in the tree into one, since the legacy field folds in as anywhere + wait.

A group is not a new addressable object: every member keeps its own mesh identity, spec and healthcheck (W338). This function returns the members’ specs so admission can take the sum / union over them, and nothing here deploys, provisions or tears anything down — supply = "self" provisioning is R860-T6 and per-node native-exec capability is R860-T5.

Two ways a member is reached, in this order:

• [Requirement::provides], the inline spec a supply = "self" requirement carries;
• otherwise an ident lookup against declared (.yah/infra/workloads/), matched on mesh identity first and on workload name second, because those coincide for every spec in the tree today but the requirement is written in the mesh-identity currency.

An ident that resolves to neither is skipped, not an error: admission is a pure function of the declared inventory and must not start failing deploys over a provider that a not-yet-written ticket will declare. The cost is that its request does not count toward the floor, which is the same exposure depends_on has always had.

Cycle-guarded. validate::check_requires bounds provides nesting to depth 1 but nothing stops two separately-declared specs from requiring each other, and this closure would otherwise not terminate. Each requirement ident is resolved at most once and each member joins the group at most once, so a cycle simply closes the group.