No client names a holder: each reader keeps its own constant, held to its manifest (ADR 0625 section 4, issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

placement/go/clients/meshmoduleassignerclient/reads.go

@@ -1,24 +1,6 @@
 package meshmoduleassignerclient
 
-import (
-	"sort"
-
-	seat "git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner"
-)
-
-// The holder of the seat and the names a reader of its states declares in its `reads` (`<module>.<state>`) and binds
-// to (`<module>_<state>`): named here once, by the seat's state, so no reader builds them from a module's name
-// (ADR 0634 §4; the lead's ruling of 2026-11-05).
-const (
-	// Module is the module that holds the seat mesh-module-assigner.
-	Module = "mesh-delivery-assigner"
-	// PlacementRead and SeatHoldersRead are the states `placement` and `seat-holders`, as a manifest's `reads` names them.
-	PlacementRead   = Module + "." + seat.StatePlacement
-	SeatHoldersRead = Module + "." + seat.StateSeatHolders
-	// PlacementBucket and SeatHoldersBucket are the states' buckets.
-	PlacementBucket   = Module + "_" + seat.StatePlacement
-	SeatHoldersBucket = Module + "_" + seat.StateSeatHolders
-)
+import "sort"
 
 // MachineNames is every machine the seat places modules on, sorted, from its state `placement` as a reader holds its
 // keys: each with a node key `<node>.node` or, in the form before, `placement.<node>`. Module keys and keys of the

placement/go/clients/meshmoduleassignerclient/reads_test.go

@@ -5,15 +5,6 @@ import (
 	"testing"
 )
 
-func TestTheStatesAreNamedBySeatAndState(t *testing.T) {
-	for got, want := range map[string]string{PlacementRead: "mesh-delivery-assigner.placement", SeatHoldersRead: "mesh-delivery-assigner.seat-holders",
-		PlacementBucket: "mesh-delivery-assigner_placement", SeatHoldersBucket: "mesh-delivery-assigner_seat-holders"} {
-		if got != want {
-			t.Errorf("got %q, want %q", got, want)
-		}
-	}
-}
-
 func TestMachineNamesAreTheNodesAKeyNames(t *testing.T) {
 	keys := map[string][]byte{"g14.node": nil, "g14.app": nil, "ace.node": nil, "placement.novox": nil, "want.x.y": nil, "bad": nil}
 	if got, want := MachineNames(keys), []string{"ace", "g14", "novox"}; !reflect.DeepEqual(got, want) {

provisioning/go/clients/meshprovisionerclient/client.go

@@ -126,15 +126,17 @@ func VaultName(form string, p Provision) string {
 	return ""
 }
 
-// VaultModule is the provider of every provision's credential (novox/hq ADR 0570 clauses 1, 6).
-const VaultModule = "mesh-vault"
+// SecretProvision is the provision the seat mesh-vault delivers: the vault's own offer, and the one provision with no
+// credential beside it (novox/hq ADR 0570 clauses 1, 6). The client names the provision, never the module that holds
+// the seat (novox/hq ADR 0625 §4).
+const SecretProvision = "secret"
 
 // CredentialKey is the key of a provision's credential, itself a provision whose provider is the vault (clause 6; the
 // key form the lead settled on 2026-10-29): `<consumer node>.<consumer>.secret-<provision>[.<local>]` for a value of the
 // consumer's own (pair, issued, given), and `<provider node>.<provider>.secret-<provision>` for the provider's one
 // shared value. False for a form with no vault value, and for a provision the vault itself provides.
 func CredentialKey(form string, consumer, provider End, provision, local string) (string, bool) {
-	if provider.Module == VaultModule {
+	if provision == SecretProvision {
 		return "", false // the vault's own offer is the value: it has no credential beside it (the lead, 2026-10-29)
 	}
 	name := catalogue.CredentialProvisionPrefix + provision

provisioning/go/clients/meshprovisionerclient/client_test.go

@@ -111,9 +111,12 @@ func TestAProvisionIsAReferenceUnderItsConsumersKey(t *testing.T) {
 		}
 	}
 	// The vault's own offer is the value: no secret-secret beside it.
-	vaultEntry := catalogue.PlanProvision{Provision: "secret", Provider: "novox", ProviderModule: VaultModule, CredentialForm: FormPair}
-	if got := DependsOn(keycloak, vaultEntry, nil); len(got) != 0 {
-		t.Errorf("the vault's secret depends on %v", got)
+	// It is the seat's provision that has none, whatever module holds the seat (ADR 0625 §4).
+	for _, holder := range []string{"mesh-vault", "another-holder"} {
+		vaultEntry := catalogue.PlanProvision{Provision: SecretProvision, Provider: "novox", ProviderModule: holder, CredentialForm: FormPair}
+		if got := DependsOn(keycloak, vaultEntry, nil); len(got) != 0 {
+			t.Errorf("the secret provided by %s depends on %v", holder, got)
+		}
 	}
 	if ProvisionsBucket != "mesh-provisioner_provisions" || PlansRead != "mesh-provisioner.plans" {
 		t.Errorf("the states are %s and %s", ProvisionsBucket, PlansRead)