Grants part: a node's engine may write and clear its own node's findings (state findings), so the finding that the node waits for the seat list is not refused on the bus (ADR 0564 §2, ADR 0636 §1; issue 1966)

modules/mesh-grants/internal/buscompose/buscompose_test.go

@@ -816,6 +816,11 @@ func healthChecks(t *testing.T) {
 			MayPublish(perms, "$JS.API.DIRECT.GET.KV_mesh-controller_declared-packages.$KV.mesh-controller_declared-packages.a")) {
 			t.Errorf("node %s writes the packages keys %v", u.Node, perms.Publish)
 		}
+		// ADR 0564 §2, ADR 0636 §1: and the findings it raises about its own node, its own node's keys alone.
+		if u.Kind == KindNode && (!MayPublish(perms, "$KV.mesh-host_findings.machine.a.seat-list-unread") || MayPublish(perms, "$KV.mesh-host_findings.machine.b.seat-list-unread") ||
+			MayPublish(perms, "$KV.mesh-host_findings.a")) {
+			t.Errorf("node %s writes the findings keys %v", u.Node, perms.Publish)
+		}
 		if u.Kind == KindModule && MayPublish(perms, "$KV.mesh-delivery-assigner_policies.x") {
 			t.Errorf("%s writes the assigner's policies", u.Username())
 		}

modules/mesh-grants/internal/buscompose/engine.go

@@ -32,6 +32,17 @@ var EnginePackagesBucket = BucketName(EngineModule, delivery.EnginePackagesState
 // key `<node>.<module>` per module, written by that node's engine alone.
 var EngineDataBucket = delivery.EngineDataBucket
 
+// EngineFindingsBucket is the engine's state of the findings it raises about its own node (novox/hq ADR 0564 §2, ADR 0636 §1):
+// keys `machine.<node>.<kind>`, written by that node's engine alone and cleared by it; the condition keeper raises each as a
+// condition.
+var EngineFindingsBucket = BucketName(EngineModule, "findings")
+
+// EngineFindingsGrants is what a node's engine publishes to write and clear its node's findings: its own node's keys alone,
+// and their read. Without it the finding that the node waits for the seat list is refused on the bus and never raised.
+func EngineFindingsGrants(node string) []string {
+	return append([]string{"$KV." + EngineFindingsBucket + ".machine." + node + ".>"}, readGrants(EngineFindingsBucket, "machine."+node+".>")...)
+}
+
 // EnginePackagesGrants is what a node's engine publishes to keep its node's key of the packages bucket: the key alone,
 // and its read.
 func EnginePackagesGrants(node string) []string {
@@ -80,5 +91,9 @@ func engineGrants(p Principal) (pub, sub []string) {
 	if safeSubject.MatchString(p.Node) {
 		pub = append(pub, EnginePackagesGrants(p.Node)...)
 	}
+	// And the findings it raises about its own node, its own node's keys alone (ADR 0564 §2, ADR 0636 §1).
+	if safeSubject.MatchString(p.Node) {
+		pub = append(pub, EngineFindingsGrants(p.Node)...)
+	}
 	return append(pub, tp...), append(sub, ts...)
 }