diff --git a/internal/broker/process_grants_test.go b/internal/broker/process_grants_test.go
index e24400bf..7866df30 100644
--- a/internal/broker/process_grants_test.go
+++ b/internal/broker/process_grants_test.go
@@ -1,6 +1,10 @@
 package broker
 
-import "testing"
+import (
+	"slices"
+	"sort"
+	"testing"
+)
 
 // A module's process with a bus declaration gets a bus account of its own (novox/hq ADR 0436 §1, §2, §3,
 // §5): named <machine>.<module>.<process id>, granted exactly its bus declaration and nothing of its
@@ -28,21 +32,33 @@ func TestAProcessIsGrantedExactlyItsBusDeclaration(t *testing.T) {
 		t.Fatalf("username: %q", got)
 	}
 	got := perms(t, p)
-	for _, s := range []string{
-		"mesh.mod.mesh-mail.event.mail.send.sent",
-		"mesh.mod.mesh-mail.event.mail.send.failed",
+	// review round 1, finding 8: the whole publish set, not merely that each wanted subject is somewhere in
+	// it — AC1 says "exactly". Dumped from a passing run (TestZZDumpProcessPublish, removed): 16 subjects,
+	// correct today.
+	wantPublish := []string{
+		"$JS.ACK.MAIL_SENDS.novox_mesh-mail_send.>",
+		"$JS.API.CONSUMER.CREATE.KV_mesh-mail_sends.>",
+		"$JS.API.CONSUMER.DELETE.KV_mesh-mail_sends.>",
 		"$JS.API.CONSUMER.INFO.MAIL_SENDS.novox_mesh-mail_send",
 		"$JS.API.CONSUMER.MSG.NEXT.MAIL_SENDS.novox_mesh-mail_send",
-		"$JS.ACK.MAIL_SENDS.novox_mesh-mail_send.x",
-		"$KV.mesh-mail_sends.x",
-		"$JS.API.DIRECT.GET.KV_mesh-mail_sends.$KV.mesh-mail_sends.x",
-		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-mail.a1",
-		"mesh.seat.operator-channel.tool.tell",
+		"$JS.API.DIRECT.GET.KV_mesh-mail_sends.>",
+		"$JS.API.DIRECT.GET.KV_messenger_asks.$KV.messenger_asks.mesh-mail.>",
+		"$JS.API.STREAM.INFO.KV_mesh-mail_sends",
+		"$JS.FC.KV_mesh-mail_sends.>",
+		"$KV.mesh-mail_sends.>",
+		"mesh.mod.mesh-mail.event.mail.send.failed",
+		"mesh.mod.mesh-mail.event.mail.send.sent",
+		"mesh.seat.operator-channel.call.tell.*.novox~mesh-mail~send",
 		"mesh.seat.operator-channel.call.tell.novox~mesh-mail~send",
-	} {
-		if !allowed(got.Publish, s) {
-			t.Errorf("the process may not publish %s", s)
-		}
+		"mesh.seat.operator-channel.tool.tell",
+		"mesh.seat.operator-channel.tool.tell.*",
+	}
+	pub := append([]string(nil), got.Publish...)
+	sort.Strings(pub)
+	want := append([]string(nil), wantPublish...)
+	sort.Strings(want)
+	if !slices.Equal(pub, want) {
+		t.Fatalf("the process's whole publish set:\n%v\nwant exactly:\n%v", pub, want)
 	}
 	if !allowed(got.Subscribe, "_INBOX.novox.mesh-mail.send.x") {
 		t.Error("the process does not hear its own inbox")