Node-engine: logins, signers, enrolment tokens and redeems, and the grants part's sealed user list come from the vault and node-enroller clients and the grants state package; no file imports go/delivery (ADR 0634 §1, §4; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

internal/buckets/buckets.go

@@ -5,6 +5,7 @@ package buckets
 
 import (
 	"errors"
+	vault "git.novox.be/novox/mesh-contracts/identity-and-access/go/seats/meshvault"
 
 	assigner "git.novox.be/novox/mesh-contracts/placement/go/clients/meshmoduleassignerclient"
 	seat "git.novox.be/novox/mesh-contracts/placement/go/seats/meshmoduleassigner"
@@ -57,3 +58,15 @@ func CandidateKey(group string) (string, error) {
 	}
 	return catalog.CandidatesByGroupKey(keys.EscapeName(group)), nil
 }
+
+// The states of the vault seat's holder that the engine reads, named by the holder's module (ADR 0634 §1, finding F4).
+const (
+	// Signers holds the vault's public signing halves; NodeLogins each node's logins, `<node>`.
+	Signers    = vaultHolder + "_" + vault.StateSigners
+	NodeLogins = vaultHolder + "_" + vault.StateNodeLogins
+	// SignersRead and NodeLoginsRead are the states as a manifest's reads names them.
+	SignersRead    = vaultHolder + "." + vault.StateSigners
+	NodeLoginsRead = vaultHolder + "." + vault.StateNodeLogins
+
+	vaultHolder = "mesh-vault"
+)