The node composes again when the vault says a secret changed, so a rotated secret or credential reaches it at once (issue 1126, ADR 0547 §2)

internal/selfcompose/selfcompose_test.go

@@ -97,6 +97,13 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 		return json.RawMessage(fmt.Sprintf(`{"node":"n1","key":"sk","own":[{"module":"keeper","name":"password","origin":"made",`+
 			`"generation":%d,"sealed":{"ask":%d}}]}`, generation+1, asks)), nil
 	}
+	secretChanged := make(chan []byte, 1)
+	env.Hear = func(subject string) (<-chan []byte, func(), error) {
+		if subject != VaultSecretChanged {
+			t.Errorf("heard %s", subject)
+		}
+		return secretChanged, func() {}, nil
+	}
 	c := New(env)
 	out, err := c.Watch(ctx, "n1.>")
 	if err != nil {
@@ -205,7 +212,8 @@ func TestTheNodeComposesItsWantsFromTheBus(t *testing.T) {
 	b.mu.Lock()
 	generation++
 	b.mu.Unlock()
-	b.put(t, ResolvedBucket, "n1.other.k", []byte(`{"value":3}`))
+	// The vault says the secret changed: the node composes again on that word, with no other input moving.
+	secretChanged <- []byte(`{"name":"own/n1/keeper/password","generation":2}`)
 	if u := next(t, out); u.Key != keeperKey {
 		t.Fatalf("a new generation handed %s, want keeper again", u.Key)
 	}