GR6: a state's <state>-objects store is granted to the state's owner alone

Builds: design 47 G §58, §91

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

modules/mesh-grants/internal/buscompose/busstate.go

@@ -249,6 +249,11 @@ func boundOf(module string, bindings []membership.BusBinding) boundGrants {
 		case catalogue.StorageKeyValue:
 			if b.Bucket == base {
 				g.States = append(g.States, b.Local)
+				// Its object store beside it, `<state>-objects`, is its owner's alone (design 47 G §58, §91): the one bucket the
+				// binding names for this module's own state.
+				if b.Objects != "" && b.Objects == module+"_"+catalogue.StateObjectsName(b.Local) {
+					g.Objects = append(g.Objects, b.Objects)
+				}
 			}
 		case catalogue.StorageObjectStore:
 			if b.ObjectStore == base {

modules/mesh-grants/internal/buscompose/state_objects_test.go

@@ -0,0 +1,38 @@
+package buscompose
+
+import (
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+	"git.novox.be/novox/mesh-sdk/go/membership"
+)
+
+// Design 47 G §58, §59, §91, §124: a state's `<state>-objects` store is its owner's alone, and a sent store is read, never
+// written, by the modules it is for.
+func TestStateObjectsAndSentStores(t *testing.T) {
+	owner, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "shop", Bound: []membership.BusBinding{
+		{Local: "orders", Storage: catalogue.StorageKeyValue, Template: catalogue.TemplateState, Bucket: "shop_orders", Objects: "shop_orders-objects"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	other, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "bank"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, subject := range []string{"$O.shop_orders-objects.C.x", "$O.shop_orders-objects.M.x", "$JS.API.DIRECT.GET.OBJ_shop_orders-objects.x"} {
+		if !MayPublish(owner, subject) {
+			t.Errorf("the owner may not publish %s", subject)
+		}
+		if MayPublish(other, subject) {
+			t.Errorf("another module may publish %s", subject)
+		}
+	}
+	reader, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "bank", ReadsObjects: []string{"shop_sent-objects"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !MayPublish(reader, "$JS.API.DIRECT.GET.OBJ_shop_sent-objects.x") || MayPublish(reader, "$O.shop_sent-objects.C.x") ||
+		MayPublish(reader, "$JS.API.DIRECT.GET.OBJ_other_sent-objects.x") {
+		t.Error("a reader of a sent store reads that one and writes none")
+	}
+}