Pin the node-engine at its reviewed grant, and hold the mount match to the path itself (hq ADR 0312, issue 537 review)

A path beginning with the same letters is another path, and a read-only mount
of a read-write access is still granted: the grant follows what mounts it.

vendor/github.com/novox/mesh-host/internal/declaration/declaration.go

@@ -522,9 +522,11 @@ func (a *Access) validate(where string, _ bool) []string {
 				problems = append(problems, where+": a grant names a container with no id")
 			}
 		}
-		if a.Grant.Account != "" && strings.ContainsAny(a.Grant.Account, " :/\t\n") {
-			problems = append(problems, where+": a grant's account is an account's name, and "+
-				a.Grant.Account+" is not one")
+		if a.Grant.Account != "" && !accountName.MatchString(a.Grant.Account) {
+			// Handed to id, usermod and gpasswd as an argument: a name starting with a dash would be read as an
+			// option by each of them.
+			problems = append(problems, fmt.Sprintf("%s: a grant's account is an account's name — letters, digits, "+
+				"dots, underscores and dashes, not starting with a dash — and %q is not one", where, a.Grant.Account))
 		}
 	}
 	return problems
@@ -1778,6 +1780,10 @@ func checkWhileStopped(resources []Resource) []string {
 	return problems
 }
 
+// accountName is what a grant's account may be: the portable account name the user tools take, optionally ending
+// in `$`, never starting with a dash.
+var accountName = regexp.MustCompile(`^[A-Za-z0-9_.][A-Za-z0-9_.-]*\$?$`)
+
 // checkGrants judges each access's grant against the whole declaration (novox/hq ADR 0312): a container it
 // names is a container of this declaration, as a maintenance window's are. A grant to a container the machine
 // is not told about would be a group given to nothing, said as granted.