Every credential provider says whether it still holds a consumer

holds() for postgres, mssql, mongodb, minio, lavinmq, mosquitto, mailu
and gitea, so the harness makes again a login the backend lost (hq issue
120). Each checks the mesh's password as the consumer presents it, or
compares it read-only, and returns false only when the backend says the
credential is absent or wrong; an unreachable backend throws.

modules/mailu/provisioner/index.ts

@@ -62,4 +62,9 @@ runProvisioner("smtp", {
     // named-account consumer is an operator action until the harness carries values here.
     await mailu.deleteUser(`${p.as}@${domain()}`).catch(() => {});
   },
+  // Asked every minute by the harness: whether the backend still holds this consumer exactly as
+  // the mesh gave it, so a login lost behind the provisioner's back is made again (novox/hq issue 120).
+  async holds(p: Provision): Promise<boolean> {
+    return mailu.holdsUser(addressOf(p), p.password);
+  },
 });