Grant a provider only the consumers bound to it (hq issue 274)

grantsFor granted every consumer a pair credential from the provider was
ever made for, so a consumer pinned back to its own store was still asked
of the store it left, which then never retired it. A credential whose
consumer's resolution binds it elsewhere is now withdrawn like one nobody
asks for, kept on record for the login the provider keeps, and said on
plan and push.

internal/catalogue/bound.go

@@ -1,6 +1,10 @@
 package catalogue
 
-import "fmt"
+import (
+	"fmt"
+	"slices"
+	"strings"
+)
 
 // A consumer of a provision that keeps its data stays bound where its data is (novox/hq ADR 0232).
 //
@@ -125,3 +129,55 @@ func boundNeed(n Needed, bound Chosen, catalogue map[string]Manifest, node Node,
 	held.From, held.At, held.Module, held.Serves, held.Identity = p.Node, p.At, p.Module, p.Serves, identity
 	return held, true, ""
 }
+
+// Unbound is one consumer that still asks for a provision and whose own resolution binds it to
+// another provider than the one a pair credential on record was made with (novox/hq issue 274).
+//
+// **A provider is granted exactly the consumers bound to it.** The credential from the old provider
+// stays on record — it is the key to a login that provider keeps, disabled, with the consumer's data,
+// until a person deletes it with `cleanup delete` (ADR 0230), and a pin back must find it — but it is
+// no longer granted, so the provider stops being asked for it and retires it. Said on every plan and
+// push of the provider, so a credential the mesh keeps and does not use is never kept silently.
+type Unbound struct {
+	// Provision is what was required, Provider the machine the credential on record is from.
+	Provision string `json:"provision"`
+	Provider  string `json:"provider"`
+	// Consumer is the machine, Module the module on it that requires it, Local the credential's
+	// name inside it where it keeps several (ADR 0094).
+	Consumer string `json:"consumer"`
+	Module   string `json:"module"`
+	Local    string `json:"local,omitempty"`
+	// BoundTo is every provider the consumer's resolution binds this credential to now; empty when
+	// it binds it nowhere — the module asks for the provision under other local names.
+	BoundTo []string `json:"bound_to,omitempty"`
+}
+
+func (u Unbound) String() string {
+	who := u.Module
+	if u.Local != "" {
+		who += " (as " + u.Local + ")"
+	}
+	now := "is bound to no provider under that name"
+	if len(u.BoundTo) > 0 {
+		now = "is bound to " + strings.Join(u.BoundTo, ", ")
+	}
+	return fmt.Sprintf("%s on %s %s for %s, not to %s — %s no longer grants it, so it retires that "+
+		"login and keeps its data until `cleanup delete` (ADR 0230); the credential from %s stays on "+
+		"record while that login does", who, u.Consumer, now, u.Provision, u.Provider, u.Provider, u.Provider)
+}
+
+// BindsFrom is the providers this resolution binds a pair credential's need to — the provision, the
+// module that requires it and the credential's local name — answered by a machine rather than by a
+// record. None means this machine states no such binding.
+func (r Resolution) BindsFrom(provision, module, local string) []string {
+	var from []string
+	for _, n := range r.Needs {
+		if n.ByRecord || n.Name != provision || n.For != module || n.Local != local {
+			continue
+		}
+		if !slices.Contains(from, n.From) {
+			from = append(from, n.From)
+		}
+	}
+	return from
+}

internal/catalogue/declaration.go

@@ -174,6 +174,9 @@ type Rendering struct {
 	// bound (novox/hq ADR 0225). Composed into nothing; carried so the machine's declaration can say
 	// whom it does not serve, and why, beside what it does.
 	Withheld []Overflow
+	// Unbound is every consumer whose pair credential from this node is on record and whose own
+	// resolution binds it elsewhere (novox/hq issue 274): never granted, carried to be said.
+	Unbound []Unbound
 
 	// Ports is where this machine puts what each module needs reachable, by module and by the
 	// port the software itself uses (novox/hq ADR 0038).