Re-make an own secret sealed to a key the machine lost, and name the validator's mesh-sdk pin in a check

cmd/mesh-controller/compose_perform.go

@@ -204,7 +204,9 @@ func prepareSend(ctx context.Context, open *stores, node string) ([]string, erro
 	if n.SealingKey != "" {
 		held := map[string]bool{}
 		for _, r := range in.OwnSecrets {
-			if r.Node == node {
+			// Held only when sealed to the key the machine has now, or given by a person (which is not the mesh's
+			// to make again): a made row under an old key is re-made, as SecretForModule did.
+			if r.Node == node && (r.SealedTo == n.SealingKey || r.Origin == inventory.OriginAccepted) {
 				held[r.Module+"/"+r.Name] = true
 			}
 		}

cmd/mesh-controller/compose_perform_integration_test.go

@@ -195,3 +195,41 @@ func TestAFinishedSendMakesNothingTheSecondTime(t *testing.T) {
 		}
 	}
 }
+
+// Review round 1, finding 1: a machine that rejoined with a new sealing key keeps its made rows sealed to the old key. A
+// send re-makes them for the new key, as SecretForModule did on main, and the file naming the secret is not refused.
+func TestASendReMakesAnOwnSecretSealedToAKeyTheMachineNoLongerHas(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	inv := open.inventory
+	register(t, open, aBot("bot", false))
+	if _, err := assign(ctx, open, "laptop", "bot"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("the first send is refused: %v", err)
+	}
+	if err := inv.RecordSealingKey(ctx, nodeID(t, open, "laptop"), aPublicKey(t)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := composeSend(ctx, open, "laptop"); err != nil {
+		t.Fatalf("a machine that rejoined cannot be sent to: %v", err)
+	}
+	in, err := readComposeInput(ctx, open)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n, _ := nodeOf(in.Input, "laptop")
+	found := false
+	for _, r := range in.OwnSecrets {
+		if r.Node == "laptop" && r.Module == "bot" && r.Name == "token" {
+			found = true
+			if r.SealedTo != n.SealingKey {
+				t.Fatalf("the own secret is still sealed to a key the machine no longer has")
+			}
+		}
+	}
+	if !found {
+		t.Fatal("the own secret has no row")
+	}
+}