Let the watchman read and delete a given-up message only on the streams dead letters come from, each by name and never a bucket's, so keeping dead letters cannot read every bucket (issue 1952 S5)

go/buscompose/nats.go

@@ -199,6 +199,9 @@ type Principal struct {
 	// RemovesFromTheBus is the bus module's tools process (BusToolsProcess, novox/hq ADR 0564 Limits 4): its whole
 	// authority is BusRemovalGrants.
 	RemovesFromTheBus bool
+	// DeadLetterSources are, for the watchman, the streams a dead letter it keeps may come from, by name
+	// (deadLetterSourcesOf, novox/hq ADR 0564 clause 5): never a bucket's.
+	DeadLetterSources []string
 
 	// WitnessesController is a machine principal whose node-engine witnesses the controller's upgrades:
 	// the machine runs the controller (novox/hq ADR 0236, lease/witness.go). It may read the lease's one
@@ -1002,7 +1005,7 @@ func PermissionsFor(p Principal) (Permissions, error) {
 			sub = append(sub, BusConnectSubject, BusDisconnectSubject)
 			pub = append(pub, BusConnzSubject)
 			// And the dead letters, from its own consumer, never the controller's (novox/hq ADR 0564 clause 5).
-			pub = append(pub, WatchmanDeadLetterGrants()...)
+			pub = append(pub, WatchmanDeadLetterGrants(p.DeadLetterSources)...)
 		}
 		// The grants part alone publishes the modules' memberships into the assignments stream (novox/hq ADR 0547 §5;
 		// the operator, 2026-10-25 22:31): one per subject, `mesh.assignment.<node>.<module>`, reading the last one of each