The node-engine's account hears what its manifest consumes: the view's settled is a consumes line, not a special case in the grants part (ADR 0625 section 4, issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/mesh-grants/internal/buscompose/buscompose_test.go

@@ -965,10 +965,12 @@ func healthChecks(t *testing.T) {
 // listing and the creation advisory that find them, and its membership issues the family by its prefix; a module not
 // named is refused it; each node's engine writes its own node's bucket alone.
 func everyNodesCompositions(t *testing.T) {
-	records := Records{Nodes: []string{"one", "two"}, Assigned: map[string][]Declared{
-		"one": {{Module: "mesh-delivery-view", Reads: []string{ComposedRead}},
-			{Module: "plex", Reads: []string{ComposedRead}}},
-	}}
+	// The node-engine's manifest consumes the view's settled; that line alone grants its account the event (design 51, ENG-11).
+	records := Records{Nodes: []string{"one", "two"}, Engine: &Declared{Module: EngineModule, Consumes: []string{"mesh-delivery-view.settled"}},
+		Assigned: map[string][]Declared{
+			"one": {{Module: "mesh-delivery-view", Reads: []string{ComposedRead}},
+				{Module: "plex", Reads: []string{ComposedRead}}},
+		}}
 	users, err := Users(records)
 	if err != nil {
 		t.Fatal(err)

modules/mesh-grants/internal/buscompose/composed.go

@@ -81,15 +81,6 @@ func NodeAgentAsks(node string) ([]string, error) {
 	return out, nil
 }
 
-// NodeAgentHears are the events a node's node-engine subscribes while it applies a want: the backup holder's word that a
-// backup is taken (`backed-up`), from whichever module holds node-backup on its machine (restic today); and the status
-// view's `settled`, on which it retries a pull from a store's holder that failed (design 51, ENG-11).
-var NodeAgentHears = []string{"mesh.mod." + BackupHolderModule + ".event.backed-up", "mesh.mod." + ViewModule + ".event.settled"}
-
-// BackupHolderModule is the module that holds node-backup on every node, restic: the one whose word a node-engine hears.
-// A second holder of the seat is a change of this grant.
-const BackupHolderModule = "restic"
-
 // DeclarationsStream is the stream of each node's last declaration, `mesh.node.<node>.declare` (issue 107). Release 6
 // sends none (ADR 0539 clauses 5 and 11): the stream is kept, with each node's consumer, only so a node away during the
 // switch finds its last declaration and with it the new node-engine; the controller deletes it once every node's have

modules/mesh-grants/internal/buscompose/nats.go

@@ -770,9 +770,15 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			return Permissions{}, err
 		}
 		pub = append(pub, backups...)
-		// And the backup holder's word that it backed the module up (ADR 0539 clause 16), whichever module holds
-		// node-backup: one event, by its name.
-		sub = append(sub, NodeAgentHears...)
+		// And the events the node-engine's manifest consumes (the backup holder's word that it backed the module up, ADR 0539
+		// clause 16; the status view's `settled`, design 51): by the emitter's own subject, as any consumer's.
+		for _, c := range p.Consumes {
+			subject, err := consumedSubject(c)
+			if err != nil {
+				return Permissions{}, err
+			}
+			sub = append(sub, subject)
+		}
 		// And the creation of the seat mesh-placement's two states it composes from (ADR 0567 §9), so a node agent started
 		// before they exist binds each when the bus says it was made, with no timer; no other bucket's.
 		sub = append(sub, NodeComposeAdvisories()...)

modules/mesh-grants/internal/buscompose/users.go

@@ -198,8 +198,14 @@ func Users(r Records) ([]Principal, error) {
 		}
 		// **One user per login the node has** (novox/hq ADR 0583 §1): the one in use, and while it rotates the other too,
 		// each with the node's permissions.
+		// What the node-engine consumes is what its account hears (a `consumes` line of its own manifest; Engine): the
+		// backup holder's word and the status view's `settled`, with no module named in this code.
+		var engineHears []string
+		if r.Engine != nil {
+			engineHears = r.Engine.Consumes
+		}
 		for _, login := range nodeLoginsOf(r, node) {
-			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, Checks: checks, Runner: runner,
+			out = append(out, Principal{Kind: KindNode, Node: node, Login: login, Checks: checks, Runner: runner, Consumes: engineHears,
 				MovesIntoTheVault: servesMoveIn(r), StatesItsKeyToTheVault: servesVerb(r, VaultNodeKey),
 				AsksItsOwnSecrets: servesVerb(r, VaultOwn), AsksTheVaultToSign: servesVerb(r, VaultSign), Uses: asksSeatOf(r),
 				FollowsGrantsUserList: bus, ServedReads: servedOn(served, node), RotatesItsLogin: servesVerb(r, VaultRotateNode)})