Let the controller ask an issued credential's tool in its own name, and seal it again over a remade pair (hq issue 526, ADR 0305)

The bus left the controller out of the caller-named grants, so issued could never reach plex's tool; the
controller is now granted exactly the tools of offers whose software issues the credential, composed from
the records, so the installer's first user list is unchanged. A pair remade on a key change or accepted by
hand kept the issued stamp and was never sealed again; those writes now clear it.

internal/inventory/issued_test.go

@@ -122,3 +122,57 @@ func TestAnIssuedValueIsSealedToEveryHolderOnceAndNotAgain(t *testing.T) {
 		t.Fatal("an empty value was kept")
 	}
 }
+
+// A consumer whose sealing key changed holds a value the mesh made in place of the issued one, and the next ask
+// seals the issued value to it again; so does a pair a person accepted over it (novox/hq ADR 0305 §5, the review
+// of mesh-controller #239).
+func TestAnIssuedValueIsSealedAgainAfterAKeyChangeOrAnAcceptance(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "kometa", Version: "1", Requires: []string{"plex-api"},
+		Secrets: map[string]string{"plex-api": "/run/plex-api.secret"}}, Source{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.SecretFor(ctx, "plex-api", "consumer", "kometa", "provider", ""); err != nil {
+		t.Fatal(err)
+	}
+	if kept, err := inv.KeepIssuedSecret(ctx, "plex-api", "provider", "the-servers-own-token"); err != nil || !kept.Changed {
+		t.Fatalf("the first ask did not seal: %+v %v", kept, err)
+	}
+
+	// The consumer rejoins with a new key: the mesh remakes the pair, a value the software refuses.
+	newKey, opens := aSealingKey(t)
+	cn, _ := inv.NodeByName(ctx, "consumer")
+	if err := inv.RecordSealingKey(ctx, cn.ID, newKey); err != nil {
+		t.Fatal(err)
+	}
+	remade, err := inv.SecretFor(ctx, "plex-api", "consumer", "kometa", "provider", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if remade.Origin != OriginMade {
+		t.Fatalf("a value the mesh remade says it came from %q", remade.Origin)
+	}
+	again, err := inv.KeepIssuedSecret(ctx, "plex-api", "provider", "the-servers-own-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !again.Changed || len(again.Sealed) != 1 {
+		t.Fatalf("the issued value was not sealed again after the key changed: %+v", again)
+	}
+	got, _ := inv.SecretFor(ctx, "plex-api", "consumer", "kometa", "provider", "")
+	if opened, ok := opens(got.ForConsumer); !ok || string(opened) != "the-servers-own-token" {
+		t.Fatal("the consumer does not hold the issued value under its new key")
+	}
+
+	// A person accepts another value over it: the next ask seals the software's again.
+	if err := inv.AcceptSecretForPair(ctx, "plex-api", "consumer", "kometa", "provider", "", "a-typed-copy"); err != nil {
+		t.Fatal(err)
+	}
+	after, err := inv.KeepIssuedSecret(ctx, "plex-api", "provider", "the-servers-own-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !after.Changed {
+		t.Fatal("an accepted value over the issued one was read as still holding it")
+	}
+}