Grant a provider only the consumers bound to it (hq issue 274)

grantsFor granted every consumer a pair credential from the provider was
ever made for, so a consumer pinned back to its own store was still asked
of the store it left, which then never retired it. A credential whose
consumer's resolution binds it elsewhere is now withdrawn like one nobody
asks for, kept on record for the login the provider keeps, and said on
plan and push.

cmd/mesh-controller/plan.go

@@ -405,7 +405,8 @@ func declarationWith(ctx context.Context, open *stores, node string,
 	}
 	out := sendable{Resources: composed.Resources, Adoption: adoption,
 		Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
-		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld}
+		LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
+		unbound: with.Unbound}
 	// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
 	// 0221). Read only on the send path: a question about what would be sent records nothing.
 	if choosing == Allocating {
@@ -500,6 +501,10 @@ func reportLeftOut(node string, declared sendable) {
 	for _, o := range declared.withheld {
 		fmt.Printf("%s: %s\n", node, o)
 	}
+	// And whom it no longer serves because they are bound elsewhere (novox/hq issue 274).
+	for _, u := range declared.unbound {
+		fmt.Printf("%s: %s\n", node, u)
+	}
 }
 
 // renderingFor is everything a node's declaration is composed with, and the node's record.
@@ -507,7 +512,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	plan catalogue.Resolution, settings catalogue.SettingsBy,
 	gens map[string]catalogue.Generator, choosing Choosing) (catalogue.Rendering, inventory.Node, error) {
 	inv := open.inventory
-	grants, withheld, err := grantsFor(ctx, open, node)
+	grants, withheld, unbound, err := grantsFor(ctx, open, node)
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
@@ -830,7 +835,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
 		Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
 		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
-		BusUsers: busUsers, Withheld: withheld,
+		BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
 	}, record, nil
 }
 
@@ -971,22 +976,32 @@ func certificateFor(ctx context.Context, open *stores, node string) (string, str
 // A consumer whose identity overflows the provision's bound is left out of the grants and returned
 // beside them, for push, plan and `status` to say; every other consumer is granted and the provider's
 // declaration composes. Refusing here once made a whole machine unpushable for one module elsewhere.
-func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Grant, []catalogue.Overflow, error) {
+//
+// **A provider is granted exactly the consumers whose own resolution binds them to it** (novox/hq
+// issue 274). The pair credentials on record say only whom this node was ever asked by: after a
+// consumer of a provision that keeps its data was moved and pinned back (issue 273, ADR 0232), the
+// credential from the provider it left was still on record, so that provider went on being asked for
+// five databases nobody used and never retired them. A credential whose consumer is bound elsewhere
+// is withdrawn here like one nobody asks for — the provider retires it and keeps its data (ADR 0230)
+// — and returned beside the grants, for plan and push to say. It stays on record: it is the key to
+// the login the provider keeps until `cleanup delete`, and to that data should a person pin it back.
+func grantsFor(ctx context.Context, open *stores, node string) (
+	[]catalogue.Grant, []catalogue.Overflow, []catalogue.Unbound, error) {
 	inv := open.inventory
 	issued, err := inv.SecretsFrom(ctx, node)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	// Where each consumer is, so a provider that must reach back to one does not have to know how
 	// the mesh names machines.
 	shelf, err := inv.Catalogue(ctx)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 
 	// What each consumer actually asked for, taken from that machine's own resolution rather than
@@ -994,6 +1009,7 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 	// can do nothing with it, and the name a consumer wants is the consumer's to say.
 	out := make([]catalogue.Grant, 0, len(issued))
 	var withheld []catalogue.Overflow
+	var unbound []catalogue.Unbound
 	for _, s := range issued {
 		plan, settings, err := planFor(ctx, open, s.Consumer)
 		switch {
@@ -1006,11 +1022,11 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			// The mesh could not be asked what they wanted, which is not the same as their wanting
 			// nothing — and withholding a grant on that reading takes a consumer's access away
 			// (novox/hq 04-ISSUES/152).
-			return nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Name, err)
+			return nil, nil, nil, fmt.Errorf("what %s asked of %s cannot be read: %w", s.Consumer, s.Name, err)
 		}
 		values, asks, err := plan.ContributionsFrom(s.Name, s.ConsumerModule, settings)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 		// A port in there is the consumer's software port until this. The consumer is on another
 		// machine, so the assignment that moved it is that machine's — fetched here rather than
@@ -1018,7 +1034,7 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 		// this case (novox/hq 04-ISSUES/038, the cross-node half).
 		published, err := portsOn(ctx, inv, s.Consumer, s.ConsumerModule)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, nil, err
 		}
 		values = catalogue.AtPublishedPort(values, s.ConsumerModule, published)
 		from := s.ConsumerModule
@@ -1028,6 +1044,15 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			// working for ever after its consumer went away.
 			from = ""
 		}
+		if bound := plan.BindsFrom(s.Name, s.ConsumerModule, s.Local); from != "" && !slices.Contains(bound, node) {
+			// It still asks, and not of this node: its resolution — the same one read above, so an
+			// unreadable one is the error above and never an empty answer here (issue 152) — binds
+			// this credential to another provider, or under this local name to none. Withdrawn
+			// exactly as a credential nobody asks for, and said.
+			from = ""
+			unbound = append(unbound, catalogue.Unbound{Provision: s.Name, Provider: node,
+				Consumer: s.Consumer, Module: s.ConsumerModule, Local: s.Local, BoundTo: bound})
+		}
 		// The consumer's identity slug, from its own manifest, carried on the grant so the provider
 		// derives the same login the consumer does (novox/hq ADR 0049). Judged against the bound of
 		// this provision, as the consumer's resolution states it from the provider's offer (ADR
@@ -1054,7 +1079,7 @@ func grantsFor(ctx context.Context, open *stores, node string) ([]catalogue.Gran
 			Provision: s.Name, Consumer: s.Consumer, At: onNetwork[s.Consumer],
 			From: from, Values: values, Slug: slug, Sealed: s.ForProvider, Local: s.Local})
 	}
-	return out, withheld, nil
+	return out, withheld, unbound, nil
 }
 
 // boundOfGrant is the identity bound the consumer's own resolution states for the requirement this