mesh-grants: the lease check keeps pacman's read of declared-packages until the write's delivery

pacman still falls back to the controller's declared-packages for a node whose engine has
not written its own packages (ADR 0565 §6), so the check named that read as ended and would
refuse the lease write. It is now a kept read, dropped with the others at the write's own
delivery (issue 774, design 47 L3).

Quick fix chosen over removing pacman's fallback: it matches the record as it stands, and
the read goes with the other kept reads at the write's delivery.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

modules/mesh-grants/internal/grants/leasecheck.go

@@ -94,18 +94,19 @@ var KeepList = []Kept{
 	{Module: "mesh-config", Kind: DependsRead, What: "mesh-controller.predefined", Record: "ADR 0565 §4"},
 	{Module: "mesh-healers", Kind: DependsRead, What: "mesh-controller.hand-acts", Record: "ADR 0565 §11"},
 	{Module: "mesh-hand-acts", Kind: DependsRead, What: "mesh-controller.hand-acts", Record: "ADR 0565 §11"},
+	// pacman's fallback for a node whose engine has not written its own packages yet.
+	{Module: "pacman", Kind: DependsRead, What: "mesh-controller.declared-packages", Record: "ADR 0565 §6"},
 }
 
 // EndedBy names, for a declaration no entry keeps, the record that already ended it, so a refusal says where it moved.
 // The controller's `grants` is one: ADR 0571 §9 has no manifest read it from L7's delivery, which changes ADR 0567 §10
 // and ADR 0547 §5's shadow compare, so neither the assigner's nor the grants part's read of it is kept.
 var EndedBy = map[string]string{
-	DependsRead + " mesh-controller.grants":            "ADR 0571 §9: no manifest reads the controller's grants; the grants part's key is the one read",
+	DependsRead + " mesh-controller.grants":           "ADR 0571 §9: no manifest reads the controller's grants; the grants part's key is the one read",
-	DependsInvoke + " seat:mesh-controller.hand-act":   "ADR 0565 §11: every recorder calls mesh-hand-acts",
+	DependsInvoke + " seat:mesh-controller.hand-act":  "ADR 0565 §11: every recorder calls mesh-hand-acts",
-	DependsInvoke + " seat:mesh-controller.warranted":  "ADR 0565 §11: every recorder calls mesh-hand-acts",
+	DependsInvoke + " seat:mesh-controller.warranted": "ADR 0565 §11: every recorder calls mesh-hand-acts",
-	DependsInvoke + " seat:mesh-controller.root-free":  "ADR 0571 §11: each machine's engine answers root-free (seat:node-engine.root-free@machine)",
+	DependsInvoke + " seat:mesh-controller.root-free": "ADR 0571 §11: each machine's engine answers root-free (seat:node-engine.root-free@machine)",
-	DependsInvoke + " seat:mesh-controller.held":       "ADR 0571 §2: held is the seat mesh-artifact-sweep's",
+	DependsInvoke + " seat:mesh-controller.held":      "ADR 0571 §2: held is the seat mesh-artifact-sweep's",
-	DependsRead + " mesh-controller.declared-packages": "ADR 0565 §6: each node agent writes its own node's packages",
 }
 
 // keptFor is the list's entry for one dependency, or nil.

modules/mesh-grants/leasecheck_test.go

@@ -46,10 +46,14 @@ func TestTheLeaseCheckJudgesEveryDependencyOnTheController(t *testing.T) {
 			map[string]string{"mesh-delivery-assigner": `{"module":"mesh-delivery-assigner","version":"1","reads":["mesh-controller.composed","mesh-controller.lease"]}`},
 			controllerHolds, want{deps: []string{"mesh-delivery-assigner read mesh-controller.composed kept"}, beforePasses: true,
 				reason: "mesh-delivery-assigner declares read mesh-controller.composed, kept by ADR 0571 §8 only until the lease write's own delivery"}, nil},
-		{"a read no record keeps fails both phases, named",
+		{"pacman's read of declared-packages is kept until the write's delivery, which drops it",
 			map[string]string{"pacman": `{"module":"pacman","version":"1","reads":["mesh-controller.declared-packages"]}`},
-			controllerHolds, want{deps: []string{"pacman read mesh-controller.declared-packages unkept"},
+			controllerHolds, want{deps: []string{"pacman read mesh-controller.declared-packages kept"}, beforePasses: true,
-				reason: "pacman declares read mesh-controller.declared-packages, which no record keeps until the lease write"}, nil},
+				reason: "pacman declares read mesh-controller.declared-packages, kept by ADR 0565 §6 only until the lease write's own delivery"}, nil},
+		{"a read no record keeps fails both phases, named",
+			map[string]string{"mod-u": `{"module":"mod-u","version":"1","reads":["mesh-controller.declared-packages"]}`},
+			controllerHolds, want{deps: []string{"mod-u read mesh-controller.declared-packages unkept"},
+				reason: "mod-u declares read mesh-controller.declared-packages, which no record keeps until the lease write"}, nil},
 		{"a seat verb and a module tool of the controller's, a consume and a wait are each one; every tool (*) is none",
 			map[string]string{"mod-i": `{"module":"mod-i","version":"1","invokes":["seat:mesh-controller.root-free","mesh-controller.status","*","nats.nats_users"],` +
 				`"consumes":["mesh-controller.checked","mod-x.thing"],"uses":["mesh-controller"]}`,