Correct the grant list above FileObject to the subjects it calls, flow control and consumer delete included (issue 1695)

internal/link/files.go

@@ -53,18 +53,23 @@ type objectInfo struct {
 // anything but the object it names (novox/hq ADR 0486 §2: a node-engine's account may read by name and may neither
 // list nor write).
 //
-// **The bus subjects this uses, and no others** (the grant of issue 1697 is exactly these), for bucket B =
-// declaration-files, stream S = OBJ_B, name N and its base64 (URL alphabet) form E:
+// **The bus subjects this uses, and no others** (the grant of issue 1697 is exactly these; reviewer's note 5 there), for
+// bucket B = declaration-files, stream S = OBJ_B, and E the base64 (URL alphabet) of the object's name:
 //
-//	$JS.API.DIRECT.GET.S.$O.B.M.E       the object's metadata: the last message of one subject, read directly
-//	$JS.API.CONSUMER.CREATE.S.>         an ordered consumer on the object's chunks (the client names it; the filter is
-//	                                    the chunk subject, so the grant may end the subject in the filter)
-//	$O.B.C.<nuid>                       the chunks, delivered to the consumer's inbox (the node's own _INBOX.node.<name>.>)
-//	$JS.ACK / flow control              none: an ordered consumer takes no acks; its flow control and heartbeats are
-//	                                    published to the inbox it delivers to
+//	request  $JS.API.DIRECT.GET.S.$O.B.M.E          the object's metadata. Grant only as ...DIRECT.GET.S.$O.B.M.*, never
+//	                                                 the bare ...DIRECT.GET.S, which takes a sequence number
+//	request  $JS.API.CONSUMER.CREATE.S.<hash>.$O.B.C.<nuid>
+//	                                                 an ordered consumer on the object's chunks. Grant only as
+//	                                                 ...CREATE.S.*.$O.B.C.*, never with ">" (a consumer filtered on
+//	                                                 $O.B.M.> would read every object's name). Repeated on a reset
+//	subscribe  a new inbox under the connection's own inbox prefix, where the chunks are delivered
+//	publish  $JS.FC.S.>                              the flow-control replies of the ordered consumer; without them a
+//	                                                 large object stalls at the flow-control window
+//	request  $JS.API.CONSUMER.DELETE.S.<hash>       on unsubscribe; best effort, the consumer's inactivity threshold
+//	                                                 removes it if refused
 //
-// It does not call js.ObjectStore, which asks for the stream's info (a list of every object's name), nor store.Get, which
-// reads the metadata with a message get a grant cannot keep from reading by sequence.
+// It calls no STREAM.INFO and no STREAM.MSG.GET: js.ObjectStore asks for the stream's info (which lists every object's name)
+// and store.Get reads the metadata with a message get a grant cannot keep from reading by sequence.
 func (b OverNATS) FileObject(ctx context.Context, name string, limit int64) ([]byte, error) {
 	js := b.JS
 	wait := 10 * time.Second