diff --git a/checks/planhands/reads-outside b/checks/planhands/reads-outside
index cc13f16e..ee00f8dc 100644
--- a/checks/planhands/reads-outside
+++ b/checks/planhands/reads-outside
@@ -1,3 +1,3 @@
 # What these tests read outside their package, as paths from the repository's root (issue 1936).
-# every module's Go source, for a line that takes a plan existing for its module handed.
-modules/**/*.go
+# every module whole (a directory is read whole, so a module's Go source at any depth enters the digest), for a line that takes a plan existing for its module handed.
+modules
diff --git a/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go b/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
index 0cc3189d..f1c5c014 100644
--- a/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
+++ b/modules/mesh-provisioner/cmd/mesh-provisioner/holder.go
@@ -251,7 +251,7 @@ func (h *Holder) writeRefused(node string, held map[string]string) error {
 }
 
 // providerPlan is the plan of a provision's provider on its node: from this composition when it is on this node, else
-// as kept in `plans`; nil when the seat keeps no plan of it (one of provisions alone counts: its keys are waited for).
+// as kept in `plans`; nil when the provider is not handed.
 func (h *Holder) providerPlan(p catalogue.PlanProvision, node string, here map[string]catalogue.Plan) *catalogue.Plan {
 	if p.Provider == node {
 		if plan, ok := here[p.ProviderModule]; ok {
diff --git a/modules/mesh-vault/cmd/mesh-vault/pair.go b/modules/mesh-vault/cmd/mesh-vault/pair.go
index 2b655e64..b155d487 100644
--- a/modules/mesh-vault/cmd/mesh-vault/pair.go
+++ b/modules/mesh-vault/cmd/mesh-vault/pair.go
@@ -729,7 +729,7 @@ func sharedRefusal(store *Store, read AssignmentReader, node, provider, provisio
 			continue
 		}
 		var a plannedProvisions
-		if json.Unmarshal(raw, &a) != nil || a.Node != node || a.Module != parts[1] || a.Provisioning == nil { // binds, not handing
+		if json.Unmarshal(raw, &a) != nil || a.Node != node || a.Module != parts[1] || !hands(raw) {
 			continue
 		}
 		for _, p := range a.Provisioning.Provisions {